chore: archive v1.2 milestone — Extended Protocol Coverage

35 traffic classes across 9 protocol families shipped. Archives
ROADMAP, REQUIREMENTS, and phase directories to milestones/v1.2-*.
Updates README with new protocol families, sound design table,
and [groups] TOML config documentation.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.planning/milestones/v1.2-phases/10-classification-layer/10-01-SUMMARY.md

@@ -0,0 +1,98 @@
+---
+phase: 10-classification-layer
+plan: 01
+subsystem: classify
+tags: [classification, protocols, constants, rules, v1.2]
+dependency_graph:
+  requires: [phase-09-frequency-design]
+  provides: [21-new-traffic-class-constants, 30-new-port-matching-rules, updated-AllClasses]
+  affects: [classify/types.go, classify/rules.go]
+tech_stack:
+  added: []
+  patterns: [first-match-wins ordered rules, family-grouped constants]
+key_files:
+  created: []
+  modified:
+    - classify/types.go
+    - classify/rules.go
+decisions:
+  - LDAP, Kerberos, and Syslog excluded from AllClasses() per D-01 — no ClassFreqConfigs entries until Phase 11; exclusion keeps TestAllClassesHaveConfig green
+  - Plain/TLS variants share a single class constant per D-03 (e.g. IMAP 143 and IMAPS 993 both map to ClassIMAP)
+  - SMTP-sub (port 587) is a separate class from SMTP (port 25) per D-04
+  - QUIC uses Protocol "udp" with DstPort 443 to distinguish from HTTPS (tcp/443)
+  - All 30 new specific-port rules placed before catch-alls per D-06
+metrics:
+  duration: "3 min"
+  completed: "2026-03-27"
+  tasks_completed: 2
+  files_modified: 2
+requirements_satisfied:
+  - PROTO-01
+  - PROTO-02
+  - PROTO-03
+  - PROTO-04
+  - PROTO-05
+  - PROTO-06
+  - PROTO-07
+  - PROTO-08
+---
+
+# Phase 10 Plan 1: Classification Layer — Constants and Rules Summary
+
+Added 21 new TrafficClass constants (IMAP, POP3, SMTP-sub, FTP, SMB, TFTP, RDP, Telnet, VNC, MySQL, PostgreSQL, Redis, MongoDB, mDNS, SSDP, SNMP, SIP, QUIC, LDAP, Kerberos, Syslog) and 30 new port-matching rules to the classify package, expanding traffic classification from 14 to 35 classes (32 in AllClasses(), 3 deferred to Phase 11).
+
+## Tasks Completed
+
+| Task | Name | Commit | Files |
+|------|------|--------|-------|
+| 1 | Add 21 new TrafficClass constants and update AllClasses() | 50e0474 | classify/types.go |
+| 2 | Add 30 new port-matching rules to DefaultRules | cd8593e | classify/rules.go |
+
+## What Was Done
+
+**Task 1** added 21 new `TrafficClass` constants to `classify/types.go`, grouped by protocol family with comments:
+- Mail: `ClassIMAP`, `ClassPOP3`, `ClassSMTPSub`
+- File Transfer: `ClassFTP`, `ClassSMB`, `ClassTFTP`
+- Remote Access: `ClassRDP`, `ClassTelnet`, `ClassVNC`
+- Database: `ClassMySQL`, `ClassPostgreSQL`, `ClassRedis`, `ClassMongoDB`
+- Discovery: `ClassMDNS`, `ClassSSDP`, `ClassSNMP`
+- VoIP: `ClassSIP`
+- Web extension: `ClassQUIC`
+- Infrastructure extension (Phase 11 deferred): `ClassLDAP`, `ClassKerberos`, `ClassSyslog`
+
+`AllClasses()` updated to return 32 classes — the 14 existing classes plus 18 new ones. `ClassLDAP`, `ClassKerberos`, and `ClassSyslog` are intentionally excluded because their `ClassFreqConfigs` entries do not exist until Phase 11.
+
+**Task 2** expanded `DefaultRules` in `classify/rules.go` from 12 to 42 rules. All 30 new rules are specific-port rules placed before the catch-all entries. Key behaviors:
+- Plain/TLS variants map to the same class (IMAP 143/993, POP3 110/995, LDAP 389/636, SIP 5060/5061 tcp+udp, FTP 20/21)
+- QUIC uses `Protocol: "udp", DstPort: 443` — distinct from HTTPS at `tcp/443`
+- Catch-alls `{tcp, 0, ClassOtherTCP}` and `{udp, 0, ClassOtherUDP}` remain as the final two entries
+
+## Verification Results
+
+- `go build ./classify/...` — clean compilation, no errors
+- `go test -count=1 ./...` — all 7 packages pass (classify, synth, aggregate, capture, cmd, config, encode)
+- `TestAllClassesHaveConfig` — PASS (32 AllClasses entries all have ClassFreqConfigs entries)
+- `TestClassFreqConfigsMatchAllClasses` — PASS
+- `TestFrequenciesInRange` — PASS
+- `TestGroupFieldPopulated` — PASS
+
+Final counts:
+- Total TrafficClass constants: 35 (14 existing + 21 new)
+- AllClasses() entries: 32 (14 existing + 18 new; LDAP/Kerberos/Syslog excluded)
+- DefaultRules entries: 42 (12 existing + 30 new)
+
+## Deviations from Plan
+
+None — plan executed exactly as written.
+
+## Known Stubs
+
+None.
+
+## Self-Check: PASSED
+
+- classify/types.go exists with 35 TrafficClass constants including ClassIMAP, ClassMongoDB, ClassQUIC, ClassSyslog
+- classify/rules.go exists with 42 rules including DstPort 3306 ClassMySQL, DstPort 27017 ClassMongoDB
+- AllClasses() returns 32 classes; does NOT include ClassLDAP, ClassKerberos, ClassSyslog
+- Commits 50e0474 and cd8593e exist
+- `go test -count=1 ./...` all green