- Add bpfFilter and readPath global vars with flag registration
- Add deriveOutputPath helper: capture.pcap -> capture.mp3 (D-05)
- run() validates mutual exclusion of --read and -i (D-03)
- run() pre-validates BPF filter via capture.ValidateBPFFilter before capture (CAPT-05)
- runLiveMode: extracts existing live pipeline, passes bpfFilter to StartCapture
- runPcapMode: reads pcap with ReadPcapFile, classifies with timestamps, AggregatePcap, encodes
- Bookend messages: 'Reading <file>...' at start, 'Saved...' at end (D-06)
- --verbose supported in pcap mode via onSnapshot callback (D-07)
- Empty pcap produces clear error with file path (Pitfall 4)
- Add Timestamp time.Time field to ClassifiedPacket (classify/types.go)
- Create capture/bpf.go: ValidateBPFFilter and CompileSoftwareBPF
- Create capture/pcap_reader.go: ReadPcapFile with optional software BPF filter
- Update OpenCapture and StartCapture to accept filter string param
- Update cmd/netsynth/main.go to pass empty filter to StartCapture
- All new tests pass; existing tests unaffected
- Add outputPath var and -o/--output Cobra flag (OUT-01)
- Default output path resolves to netsynth-<timestamp>.mp3 when -o not provided (D-15)
- Snapshot accumulator collects all WindowSnapshots for Phase 3 synthesis wiring
- TODO(phase-3) marker for encode.RunSynthesis integration
- cmd/netsynth/main.go: Cobra root command with -i, --list-interfaces, --verbose flags
- Signal handling via signal.NotifyContext for clean Ctrl+C shutdown
- 3-stage pipeline: capture.StartCapture -> classify.NewClassifier -> aggregate.Aggregate
- Permission errors surface platform-specific sudo/setcap hint (CAPT-04)
- --verbose flag wires aggregate.PrintWindowLine callback for per-window output
- Exit summary via aggregate.PrintSummary with dropped packet warning
- cmd/netsynth/main_test.go: 3 tests covering flag parsing and help output
- go.mod: cobra v1.10.2 and go-pcap promoted to direct dependencies
gurix