diff --git a/.planning/PROJECT.md b/.planning/PROJECT.md
index 42798d7..8a11283 100644
--- a/.planning/PROJECT.md
+++ b/.planning/PROJECT.md
@@ -10,7 +10,7 @@ Network traffic patterns are instantly recognizable as distinct sounds — a pin
 
 ## Current State
 
-**v1.2 in progress.** Phase 9 (Frequency Design and Group Architecture) complete 2026-03-27 — all 14 ClassFreqConfigs rebalanced to major-second ladder (65-1375 Hz) in family bands, Group field added to FreqConfig, auto-assign range moved to [2500, 4000] Hz. ~4,800 lines of Go across 7 packages.
+**v1.2 in progress.** Phase 10 (Classification Layer) complete 2026-03-27 — 21 new TrafficClass constants and 30 port-matching rules added covering Mail, File Transfer, Remote Access, Database, Discovery, VoIP, Web (QUIC), and Infrastructure families. 35 total traffic classes (14 existing + 21 new), 42 classification rules. ~5,300 lines of Go across 7 packages.
 
 Tech stack: gopacket/gopacket v1.5.0, packetcap/go-pcap (pure Go capture), sjzar/go-lame v0.0.9 (embedded LAME), spf13/cobra v1.10.2, BurntSushi/toml v1.6.0.
 
@@ -61,7 +61,7 @@ All 16 v1.0 requirements + 11 v1.1 requirements + CLEAN-01 validated. Full pipel
 - Packet capture requires root/CAP_NET_RAW on Linux
 - Pure Go capture layer (no libpcap dependency)
 - MP3 encoding embeds LAME C source (no system library needed)
-- 14 built-in traffic classes: 10 known protocols + 4 hash-bucketed unknowns (extensible via custom rules)
+- 35 built-in traffic classes: 10 original protocols + 21 new protocol families + 4 hash-bucketed unknowns (extensible via custom rules)
 - TOML config with partial overrides, unknown-key validation, auto-discovery
 
 ## Constraints
@@ -139,4 +139,4 @@ This document evolves at phase transitions and milestone boundaries.
 4. Update Context with current state
 
 ---
-*Last updated: 2026-03-27 after Phase 8 completion*
+*Last updated: 2026-03-27 after Phase 10 completion*