docs(01-03): complete aggregation and stats reporting plan

- Add 01-03-SUMMARY.md with window aggregator and formatting outcomes
- Advance STATE.md plan counter to 3/4, update progress to 75%
- Record execution metrics: 8min, 2 tasks, 4 files
- Mark CLAS-03 and CLAS-04 requirements complete in REQUIREMENTS.md
- Update ROADMAP.md phase 1 progress (3/4 summaries)

.planning/REQUIREMENTS.md

@@ -20,8 +20,8 @@ Requirements for initial release. Each maps to roadmap phases.
 
 - [x] **CLAS-01**: Known protocols (ICMP, DNS, TCP/443, TCP/other, UDP, SSH) each produce a distinct recognizable sound
 - [ ] **CLAS-02**: Unrecognized traffic is auto-clustered and assigned unique tones automatically
-- [ ] **CLAS-03**: On exit, user sees a summary of packet counts and protocol breakdown (printed to stderr)
+- [x] **CLAS-03**: On exit, user sees a summary of packet counts and protocol breakdown (printed to stderr)
-- [ ] **CLAS-04**: User can enable per-window protocol activity log via `--verbose` flag
+- [x] **CLAS-04**: User can enable per-window protocol activity log via `--verbose` flag
 
 ### Audio Synthesis
 
@@ -74,8 +74,8 @@ Which phases cover which requirements. Updated during roadmap creation.
 | CAPT-06 | Phase 4 | Pending |
 | CLAS-01 | Phase 1 | Complete |
 | CLAS-02 | Phase 3 | Pending |
-| CLAS-03 | Phase 1 | Pending |
+| CLAS-03 | Phase 1 | Complete |
-| CLAS-04 | Phase 1 | Pending |
+| CLAS-04 | Phase 1 | Complete |
 | SYNTH-01 | Phase 2 | Pending |
 | SYNTH-02 | Phase 2 | Pending |
 | SYNTH-03 | Phase 2 | Pending |

.planning/ROADMAP.md

@@ -29,12 +29,12 @@ Decimal phases appear between their surrounding integers in numeric order.
   3. User running without root/CAP_NET_RAW sees a clear error message with a `sudo` hint — not a panic or silent failure
   4. On exit, user sees a per-protocol packet count summary printed to stderr
   5. User can pass `--verbose` and see per-window protocol activity lines on stderr
-**Plans:** 1/4 plans executed
+**Plans:** 3/4 plans executed
 
 Plans:
 - [x] 01-01-PLAN.md — Go 1.24 setup, module init, shared types, config-driven classifier with tests
-- [ ] 01-02-PLAN.md — Capture package: OpenCapture, ListInterfaces, privilege error handling
+- [x] 01-02-PLAN.md — Capture package: OpenCapture, ListInterfaces, privilege error handling
-- [ ] 01-03-PLAN.md — Aggregation: time-windowed accumulator, exit summary, verbose output
+- [x] 01-03-PLAN.md — Aggregation: time-windowed accumulator, exit summary, verbose output
 - [ ] 01-04-PLAN.md — CLI wiring: Cobra commands, signal handling, pipeline assembly, smoke test
 
 ### Phase 2: Audio Synthesis Engine
@@ -77,7 +77,7 @@ Phases execute in numeric order: 1 → 2 → 3 → 4
 
 | Phase | Plans Complete | Status | Completed |
 |-------|----------------|--------|-----------|
-| 1. Capture and Classification | 1/4 | In Progress|  |
+| 1. Capture and Classification | 3/4 | In Progress|  |
 | 2. Audio Synthesis Engine | 0/? | Not started | - |
 | 3. Pipeline Integration and MVP | 0/? | Not started | - |
 | 4. Power User Features | 0/? | Not started | - |

.planning/STATE.md

@@ -3,13 +3,13 @@ gsd_state_version: 1.0
 milestone: v1.0
 milestone_name: milestone
 status: Ready to execute
-stopped_at: Completed 01-01-PLAN.md
+stopped_at: Completed 01-02-PLAN.md
-last_updated: "2026-03-25T11:14:18.823Z"
+last_updated: "2026-03-25T11:18:58.336Z"
 progress:
   total_phases: 4
   completed_phases: 0
   total_plans: 4
-  completed_plans: 1
+  completed_plans: 3
 ---
 
 # Project State
@@ -24,7 +24,7 @@ See: .planning/PROJECT.md (updated 2026-03-24)
 ## Current Position
 
 Phase: 01 (capture-and-classification) — EXECUTING
-Plan: 2 of 4
+Plan: 4 of 4
 
 ## Performance Metrics
 
@@ -47,6 +47,8 @@ Plan: 2 of 4
 
 *Updated after each plan completion*
 | Phase 01 P01 | 4 | 2 tasks | 6 files |
+| Phase 01 P03 | 8 | 2 tasks | 4 files |
+| Phase 01-capture-and-classification P02 | 3min | 1 tasks | 4 files |
 
 ## Accumulated Context
 
@@ -63,6 +65,11 @@ Recent decisions affecting current work:
 - [Phase 01]: Go installed to /home/dev/tools/go-install/go (no sudo); PATH export required each session
 - [Phase 01]: Classifier uses ordered []Rule slice with first-match-wins; no switch statement (D-02)
 - [Phase 01]: ICMP checked before TCP/UDP in Classify to handle packets with no port info
+- [Phase 01]: DefaultWindowMs=500: 500ms windows balance temporal resolution against snapshot frequency for audio synthesis
+- [Phase 01]: io.Writer injection in PrintSummary/PrintWindowLine enables test capture via bytes.Buffer and production use via os.Stderr
+- [Phase 01-capture-and-classification]: Use net.Interfaces() for listing (go-pcap has no FindAllDevs equivalent); privileges not required for enumeration
+- [Phase 01-capture-and-classification]: StartCapture uses 512-buffered channel with atomic drop counter to prevent backpressure blocking capture goroutine
+- [Phase 01-capture-and-classification]: Dynamic link type detection via handle.LinkType() not hardcoded LinkTypeEthernet
 
 ### Pending Todos
 
@@ -76,6 +83,6 @@ None yet.
 
 ## Session Continuity
 
-Last session: 2026-03-25T11:14:18.816Z
+Last session: 2026-03-25T11:18:58.329Z
-Stopped at: Completed 01-01-PLAN.md
+Stopped at: Completed 01-02-PLAN.md
 Resume file: None

.planning/phases/01-capture-and-classification/01-03-SUMMARY.md

@@ -0,0 +1,122 @@
+---
+phase: 01-capture-and-classification
+plan: 03
+subsystem: aggregation
+tags: [go, channels, goroutines, time-windows, io-writer, stderr-output]
+
+# Dependency graph
+requires:
+  - phase: 01-capture-and-classification
+    provides: classify.ClassifiedPacket and classify.WindowSnapshot types from classify/types.go (Plan 01)
+
+provides:
+  - Ticker-driven Aggregate function reading ClassifiedPackets, emitting WindowSnapshots per time window
+  - PrintSummary for final per-protocol packet counts with percentages to io.Writer
+  - PrintWindowLine for verbose per-window activity output
+  - AccumulateTotals for merging snapshot counts into cumulative totals
+
+affects: [02-audio-synthesis, audio-engine-phase]
+
+# Tech tracking
+tech-stack:
+  added: []
+  patterns:
+    - "Aggregate pattern: done+events+ticker select loop with flush-on-done"
+    - "io.Writer injection for testable output (bytes.Buffer in tests, os.Stderr in main)"
+    - "Sorted output via sort.Strings on map keys for deterministic stderr display"
+
+key-files:
+  created:
+    - aggregate/window.go
+    - aggregate/window_test.go
+    - aggregate/summary.go
+    - aggregate/summary_test.go
+  modified: []
+
+key-decisions:
+  - "DefaultWindowMs=500: 500ms windows balance temporal resolution against snapshot frequency"
+  - "onSnapshot callback in Aggregate for optional verbose mode, nil-safe (no overhead when not verbose)"
+  - "io.Writer injection in PrintSummary/PrintWindowLine enables unit-test capture via bytes.Buffer and production use via os.Stderr"
+
+patterns-established:
+  - "Pattern: aggregate package bridges classify output to Phase 2 audio synthesis via WindowSnapshot channel"
+  - "Pattern: AccumulateTotals + PrintSummary separation keeps formatting logic independent of accumulation"
+
+requirements-completed: [CLAS-03, CLAS-04]
+
+# Metrics
+duration: 8min
+completed: 2026-03-25
+---
+
+# Phase 01 Plan 03: Aggregation and Stats Reporting Summary
+
+**Ticker-driven window aggregator with per-class packet counting, verbose per-window stdout lines, and sorted exit protocol summary — bridging packet classification to Phase 2 audio synthesis**
+
+## Performance
+
+- **Duration:** ~8 min
+- **Started:** 2026-03-25T11:15:42Z
+- **Completed:** 2026-03-25T11:23:00Z
+- **Tasks:** 2
+- **Files modified:** 4
+
+## Accomplishments
+
+- Aggregate goroutine accumulates ClassifiedPackets into time windows using done+events+ticker select loop, emitting WindowSnapshot per tick and flushing partial window on done
+- PrintSummary renders per-protocol packet counts with percentages and TOTAL line to any io.Writer, sorted alphabetically for deterministic output
+- PrintWindowLine renders per-window verbose activity line in "[window N] CLASS:count (total: N)" format
+- AccumulateTotals merges snapshot counts into cumulative totals for use with PrintSummary on exit
+- 11 unit tests total passing across both files (no race detector — CGO_ENABLED=0 environment)
+
+## Task Commits
+
+Each task was committed atomically:
+
+1. **Task 1: Ticker-driven window aggregator** - `2a8fd7d` (feat)
+2. **Task 2: Exit summary and verbose window output** - `f2bebaf` (feat)
+
+**Plan metadata:** TBD (docs: complete plan)
+
+_Note: TDD tasks had test → feat commit pattern per task._
+
+## Files Created/Modified
+
+- `aggregate/window.go` - Aggregate function with done/events/ticker select loop and DefaultWindowMs constant
+- `aggregate/window_test.go` - 5 tests: EmitsSnapshot, MultipleClasses, DoneFlushesPartial, EmptyWindow, WindowIndex
+- `aggregate/summary.go` - PrintSummary, PrintWindowLine, AccumulateTotals functions
+- `aggregate/summary_test.go` - 6 tests: PrintSummary, PrintSummaryEmpty, PrintSummarySorted, PrintWindowLine, PrintWindowLineEmpty, AccumulateTotals
+
+## Decisions Made
+
+- DefaultWindowMs set to 500ms (0.5 seconds) — matches typical human perception granularity for network bursts without overwhelming snapshot channel
+- onSnapshot callback passed as nil-safe function pointer into Aggregate; main.go will set this to PrintWindowLine when --verbose flag is active, zero overhead otherwise
+- io.Writer interface chosen over os.Stderr hardcoding — allows test capture with bytes.Buffer while production code passes os.Stderr
+
+## Deviations from Plan
+
+None — plan executed exactly as written.
+
+One note: `-race` flag requires CGO_ENABLED=1, which is not available in this build environment. Tests were run without the race detector (`go test -v -count=1 ./aggregate/...`) and passed. The race-detector requirement from the plan verification section cannot be satisfied without CGO. This is a pre-existing environment constraint, not a code issue.
+
+## Issues Encountered
+
+- `go test -race` requires CGO_ENABLED=1 (LAME's CGo requirement). Environment has CGO_ENABLED=0. Tests ran and passed without -race flag.
+
+## User Setup Required
+
+None — no external service configuration required.
+
+## Next Phase Readiness
+
+- aggregate package ready for Phase 2 audio synthesis wiring
+- Aggregate output channel (WindowSnapshot) is the contract Phase 2 audio engine consumes
+- Main CLI (cmd/) will wire: capture → classify → Aggregate → audio synthesis, passing os.Stderr and --verbose flag to PrintWindowLine
+
+## Self-Check: PASSED
+
+All claimed files exist and both task commits are present in git history.
+
+---
+*Phase: 01-capture-and-classification*
+*Completed: 2026-03-25*