chore: archive v1.2 milestone — Extended Protocol Coverage

35 traffic classes across 9 protocol families shipped. Archives ROADMAP, REQUIREMENTS, and phase directories to milestones/v1.2-*. Updates README with new protocol families, sound design table, and [groups] TOML config documentation. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
docs(phase-11): evolve PROJECT.md after phase completion
2026-03-27 16:48:53 +01:00 · 2026-03-27 16:42:17 +01:00 · 2026-03-27 16:41:53 +01:00 · 2026-03-27 16:37:18 +01:00 · 2026-03-27 16:36:07 +01:00 · 2026-03-27 16:35:10 +01:00
84 changed files with 8737 additions and 1300 deletions
@@ -1,5 +1,20 @@
 # Milestones
 ## v1.2 Extended Protocol Coverage (Shipped: 2026-03-27)
 **Phases completed:** 4 phases, 7 plans, 14 tasks
 **Key accomplishments:**
 - Removed stale constants and future-proofed test bounds (Nyquist-based validation) to unblock all v1.2 work
 - Rebalanced all ClassFreqConfigs to major-second ladder in family frequency bands (65-3250 Hz) with Group field on FreqConfig
 - Added 21 new TrafficClass constants and 30 port-matching rules across 7 protocol families (Mail, File Transfer, Remote Access, Database, Discovery, VoIP, Infrastructure)
 - Full classification test coverage: 28 new subtests covering all new port/protocol/transport combinations
 - Added 21 ClassFreqConfigs entries with family-coherent sound design (shared waveform and frequency register per group)
 - Group-ordered `--print-config` output with section headers and `[groups]` TOML support for user-defined protocol-to-group reassignment
 ---
 ## v1.1 Custom Sound Mappings (Shipped: 2026-03-26)
 **Phases completed:** 3 phases, 6 plans, 3 tasks
@@ -10,11 +10,11 @@ Network traffic patterns are instantly recognizable as distinct sounds — a pin
 ## Current State
-**v1.1 Custom Sound Mappings shipped 2026-03-26.** ~4,675 lines of Go across 7 packages.
+**v1.2 shipped.** 35 built-in traffic classes across 9 protocol families (Infrastructure, Web, Mail, Remote Access, File Transfer, Database, Discovery, VoIP, Unknown). Major-second frequency ladder (65-3250 Hz) with family-coherent sound design. Group-ordered `--print-config` with section headers. `[groups]` TOML config for reassigning protocols to different sound families. ~6,000 lines of Go across 7 packages, full test suite green.
 Tech stack: gopacket/gopacket v1.5.0, packetcap/go-pcap (pure Go capture), sjzar/go-lame v0.0.9 (embedded LAME), spf13/cobra v1.10.2, BurntSushi/toml v1.6.0.
-All 16 v1.0 requirements + 11 v1.1 requirements validated. Full pipeline with customizable sound mappings: capture -> classify -> aggregate -> synthesize -> MP3.
+All v1.0 + v1.1 + v1.2 requirements validated (45 total). Full pipeline: capture -> classify -> aggregate -> synthesize -> MP3.
 ## Requirements
@@ -44,9 +44,19 @@ All 16 v1.0 requirements + 11 v1.1 requirements validated. Full pipeline with cu
 - Auto-frequency assignment for custom class names (no silent gaps)
 - `--print-config` outputs effective config as commented TOML
 ### Validated (v1.2)
 - Removed stale constants and future-proofed test bounds for extensibility
 - 21 new protocol classifications: Mail (IMAP, POP3, SMTP-sub), File Transfer (FTP, SMB, TFTP), Remote Access (RDP, Telnet, VNC), Database (MySQL, PostgreSQL, Redis, MongoDB), Discovery (mDNS, SSDP, SNMP), VoIP (SIP), Web (QUIC/HTTP3), Infrastructure (LDAP, Kerberos, Syslog)
 - No regression in existing 14 protocol classifications
 - Major-second frequency ladder with family-coherent waveforms and group field on FreqConfig
 - Auto-assign frequency range moved to 2500-4000 Hz (collision-free with built-ins)
 - Group-ordered `--print-config` output with section headers
 - `[groups]` TOML config for protocol-to-group reassignment
 ### Active
-(No active requirements — next milestone not yet defined)
+(No active requirements — planning next milestone)
 ### Out of Scope
@@ -61,8 +71,8 @@ All 16 v1.0 requirements + 11 v1.1 requirements validated. Full pipeline with cu
 - Packet capture requires root/CAP_NET_RAW on Linux
 - Pure Go capture layer (no libpcap dependency)
 - MP3 encoding embeds LAME C source (no system library needed)
- 14 built-in traffic classes: 10 known protocols + 4 hash-bucketed unknowns (extensible via custom rules)
+- 35 built-in traffic classes across 9 families: Infrastructure, Web, Mail, Remote Access, File Transfer, Database, Discovery, VoIP, Unknown (extensible via custom rules)
- TOML config with partial overrides, unknown-key validation, auto-discovery
+- TOML config with partial overrides, unknown-key validation, auto-discovery, and `[groups]` protocol-to-group reassignment
 ## Constraints
@@ -83,6 +93,8 @@ All 16 v1.0 requirements + 11 v1.1 requirements validated. Full pipeline with cu
 | go-lame (embedded C) over shine-mp3 | Better quality, smaller files, acceptable CGo tradeoff | Good |
 | Hand-rolled synthesis over audio libraries | 20 lines of oscillator code, no unnecessary dependencies | Good |
 | Hash-bucketed unknowns over k-means | Deterministic, zero-config, sufficient for v1 audio distinction | Good |
 | Major-second frequency ladder | Musical interval spacing prevents critical band masking between family members | Good |
 | Group field as string (not enum) | Extensible for new family names without code changes | Good |
 | Ordered []Rule classifier over switch | Configurable, extensible, first-match-wins semantics | Good |
 | 500ms window duration | Balances temporal resolution against snapshot frequency for synthesis | Good |
 | BurntSushi/toml over manual parsing | Industry-standard Go TOML library, Undecoded() catches typos | Good |
@@ -94,6 +106,13 @@ All 16 v1.0 requirements + 11 v1.1 requirements validated. Full pipeline with cu
 ## Shipped Milestones
 <details>
 <summary>v1.2 Extended Protocol Coverage (shipped 2026-03-27)</summary>
 35 built-in traffic classes across 9 protocol families with major-second frequency ladder, group-ordered print-config, and [groups] TOML reassignment.
 </details>
 <details>
 <summary>v1.1 Custom Sound Mappings (shipped 2026-03-26)</summary>
@@ -127,4 +146,4 @@ This document evolves at phase transitions and milestone boundaries.
 4. Update Context with current state
 ---
-*Last updated: 2026-03-26 after v1.1 milestone*
+*Last updated: 2026-03-27 after v1.2 milestone*
@@ -74,12 +74,49 @@
 - Manual string building beats TOML encoder when you need inline comments/annotations
 - Config extension is smooth when the original Load() was designed with clean boundaries
 ## Milestone: v1.2 — Extended Protocol Coverage
 **Shipped:** 2026-03-27
 **Phases:** 4 | **Plans:** 7 | **Timeline:** 1 day (2026-03-27)
 **LOC:** ~6,000 Go (+1,325 from v1.1) | **Files:** 19 modified
 ### What Was Built
 - Removed stale constants and future-proofed test bounds (Nyquist-based validation)
 - Rebalanced all ClassFreqConfigs to major-second ladder in family frequency bands (65-3250 Hz) with Group field
 - 21 new TrafficClass constants and 30 port-matching rules across 7 protocol families
 - 28 new classification subtests covering all new port/protocol/transport combinations
 - 21 ClassFreqConfigs entries with family-coherent sound design
 - Group-ordered --print-config with section headers and [groups] TOML reassignment
 ### What Worked
 - Cleanup-first approach (Phase 8) prevented cascading test failures throughout the milestone
 - Design-before-code (Phase 9 frequency table locked before any protocol code) avoided retroactive rebalancing
 - Strict phase ordering (constants -> rules -> config) kept three-location atomicity tests green
 - Musical interval spacing (major second ratio 1.122) produced perceptually distinct yet family-coherent sounds
 - Oscillator normalization bug caught and fixed during frequency rebalancing (math.Abs for alternating-sign harmonics)
 ### What Was Inefficient
 - Phase 9 plan 09-01 ROADMAP checkbox wasn't updated after execution — milestone readiness check showed incomplete
 - REQUIREMENTS.md traceability wasn't updated for Phase 9 completions (FREQ-01 through GRP-04 still showed Pending)
 - STATE.md accumulated merge conflict markers from earlier worktree operations, persisted unnoticed
 ### Patterns Established
 - Group field as string (not enum) on FreqConfig — extensible without code changes
 - Major-second ladder pattern for family-band frequency allocation
 - groupOrder canonical slice for deterministic section ordering in config output
 - rawConfig Groups map for TOML [groups] table parsing
 ### Key Lessons
 - Musical interval ratios are better than fixed Hz steps for frequency allocation — prevents critical band masking
 - Group-based config output requires building from effective (post-reassignment) groups, not defaults
 - Cleanup phases are high-ROI when they prevent test failures in every subsequent phase
 ## Cross-Milestone Trends
-| Metric | v1.0 | v1.1 |
+| Metric | v1.0 | v1.1 | v1.2 |
-|--------|------|------|
+|--------|------|------|------|
-| Phases | 4 | 3 |
+| Phases | 4 | 3 | 4 |
-| Plans | 11 | 6 |
+| Plans | 11 | 6 | 7 |
-| Days | 3 | 1 |
+| Days | 3 | 1 | 1 |
-| LOC | 3,254 | 4,675 |
+| LOC | 3,254 | 4,675 | ~6,000 |
-| Avg plan duration | ~8 min | ~5 min |
+| Avg plan duration | ~8 min | ~5 min | ~4 min |
@@ -2,13 +2,14 @@
 ## Milestones
- **v1.0 MVP** — Phases 1-4 (shipped 2026-03-26)
+- ✅ **v1.0 MVP** — Phases 1-4 (shipped 2026-03-26)
- **v1.1 Custom Sound Mappings** — Phases 5-7 (shipped 2026-03-26)
+- ✅ **v1.1 Custom Sound Mappings** — Phases 5-7 (shipped 2026-03-26)
 - ✅ **v1.2 Extended Protocol Coverage** — Phases 8-11 (shipped 2026-03-27)
 ## Phases
 <details>
-<summary>v1.0 MVP (Phases 1-4) — SHIPPED 2026-03-26</summary>
+<summary>✅ v1.0 MVP (Phases 1-4) — SHIPPED 2026-03-26</summary>
 - [x] **Phase 1: Capture and Classification** - 4/4 plans — completed 2026-03-25
 - [x] **Phase 2: Audio Synthesis Engine** - 3/3 plans — completed 2026-03-26
@@ -20,7 +21,7 @@ Full details: `.planning/milestones/v1.0-ROADMAP.md`
 </details>
 <details>
-<summary>v1.1 Custom Sound Mappings (Phases 5-7) — SHIPPED 2026-03-26</summary>
+<summary>✅ v1.1 Custom Sound Mappings (Phases 5-7) — SHIPPED 2026-03-26</summary>
 - [x] **Phase 5: Waveform Types and Bank Decoupling** - 2/2 plans — completed 2026-03-26
 - [x] **Phase 6: Config Package and Sound Overrides** - 2/2 plans — completed 2026-03-26
@@ -30,6 +31,18 @@ Full details: `.planning/milestones/v1.1-ROADMAP.md`
 </details>
 <details>
 <summary>✅ v1.2 Extended Protocol Coverage (Phases 8-11) — SHIPPED 2026-03-27</summary>
 - [x] **Phase 8: Test and Constant Cleanup** - 1/1 plans — completed 2026-03-27
 - [x] **Phase 9: Frequency Design and Group Architecture** - 2/2 plans — completed 2026-03-27
 - [x] **Phase 10: Classification Layer** - 2/2 plans — completed 2026-03-27
 - [x] **Phase 11: Synthesis and Config Layer** - 2/2 plans — completed 2026-03-27
 Full details: `.planning/milestones/v1.2-ROADMAP.md`
 </details>
 ## Progress
 | Phase | Milestone | Plans Complete | Status | Completed |
@@ -41,3 +54,7 @@ Full details: `.planning/milestones/v1.1-ROADMAP.md`
 | 5. Waveform Types and Bank Decoupling | v1.1 | 2/2 | Complete | 2026-03-26 |
 | 6. Config Package and Sound Overrides | v1.1 | 2/2 | Complete | 2026-03-26 |
 | 7. Custom Rules and Print-Config | v1.1 | 2/2 | Complete | 2026-03-26 |
 | 8. Test and Constant Cleanup | v1.2 | 1/1 | Complete | 2026-03-27 |
 | 9. Frequency Design and Group Architecture | v1.2 | 2/2 | Complete | 2026-03-27 |
 | 10. Classification Layer | v1.2 | 2/2 | Complete | 2026-03-27 |
 | 11. Synthesis and Config Layer | v1.2 | 2/2 | Complete | 2026-03-27 |
@@ -1,86 +1,70 @@
 ---
 gsd_state_version: 1.0
-milestone: v1.1
+milestone: v1.2
-milestone_name: Custom Sound Mappings
+milestone_name: Extended Protocol Coverage
-status: milestone_complete
+status: complete
-stopped_at: v1.1 milestone shipped
+stopped_at: Milestone v1.2 archived
-last_updated: "2026-03-26T21:02:36.710Z"
+last_updated: "2026-03-27T16:00:00.000Z"
-last_activity: 2026-03-26
+last_activity: 2026-03-27
 progress:
-  total_phases: 3
+  total_phases: 4
-  completed_phases: 3
+  completed_phases: 4
-  total_plans: 6
+  total_plans: 7
-  completed_plans: 6
+  completed_plans: 7
-  percent: 0
+  percent: 100
 ---
 # Project State
 ## Project Reference
-See: .planning/PROJECT.md (updated 2026-03-26)
+See: .planning/PROJECT.md (updated 2026-03-27)
 **Core value:** Network traffic patterns are instantly recognizable as distinct sounds — a ping sounds different from HTTPS noise, which sounds different from a port scan.
 **Current focus:** Planning next milestone
 ## Current Position
-Phase: All v1.1 phases complete
+Phase: All v1.2 phases complete
-Plan: N/A
+Plan: All plans complete
-Status: Milestone v1.1 shipped — ready for next milestone
+Status: Milestone v1.2 shipped
-Last activity: 2026-03-26
+Last activity: 2026-03-27
-Progress: [░░░░░░░░░░] 0%
+Progress: [██████████] 100%
 ## Performance Metrics
-**Velocity (v1.0 baseline):**
+**Velocity (v1.2):**
- Total plans completed: 11
+- Total plans completed: 7
- Average duration: 7.7 min
+- Phases: 4 (8-11)
- Total execution time: ~1.4 hours
+- Timeline: 1 day (2026-03-27)
-**By Phase (v1.0):**
+**By Phase (v1.2):**
-| Phase | Plans | Total | Avg/Plan |
+| Phase | Plans | Duration | Files |
-|-------|-------|-------|----------|
+|-------|-------|----------|-------|
-| 01 | 4 | ~30min | 7.5min |
+| 08 | 1 | ~1min | 2 |
-| 02 | 3 | ~28min | 9.3min |
+| 09 | 2 | ~10min | 7 |
-| 03 | 2 | ~20min | 10min |
+| 10 | 2 | ~5min | 3 |
-| 04 | 2 | ~7min | 3.5min |
+| 11 | 2 | ~13min | 7 |
 **Recent Trend:** Stable
 | Phase 05 P01 | 3min | 2 tasks | 3 files |
 | Phase 05 P02 | 4 | 2 tasks | 4 files |
 | Phase 06 P02 | 2 | 2 tasks | 3 files |
 | Phase 07 P01 | 3 | 1 tasks | 3 files |
 ## Accumulated Context
 ### Decisions
- [v1.1 Roadmap]: Phase 5 consolidates waveform types (WAVE-01, WAVE-02) with bank decoupling — both are internal refactors with no user-visible surface, establishing the injectable seam before config is added
+See .planning/milestones/v1.2-ROADMAP.md for full decision log.
 - [v1.1 Roadmap]: Research steps 5+6 (wire config + freq/waveform overrides) collapsed into Phase 6 — they share the same integration boundary (encode.RunSynthesis signature change) and are safer to land together
 - [v1.1 Roadmap]: User class name collision with built-in TrafficClass strings is an unresolved design question — decide before coding Phase 7 (treat as override vs. reject as ambiguous)
 - [Phase 05]: FreqConfig struct uses named field syntax for ClassFreqConfigs entries (required by WaveformType addition)
 - [Phase 05]: WaveformType zero value is WaveformCustom — all 14 existing ClassFreqConfigs entries retain hand-tuned harmonics without modification
 - [Phase 05]: NewBank accepts injected config map instead of reading ClassFreqConfigs global — injection seam for Phase 6 config loading
 - [Phase 05]: gainPerLayer computed as 1.0/float64(len(cfgs)) — correct for any class count, no-clip guarantee preserved
 - [Phase 06]: Option A for freqCfgs propagation: pass as parameter to runLiveMode/runPcapMode — cleaner data flow vs package-level var
 - [Phase 06]: config.Load positioned after BPF validation, before output path resolution — ensures fail-fast before any I/O (D-11)
 - [Phase 07]: addAutoFreqEntries runs before merge so [sounds.X] overrides apply to user-defined classes
 - [Phase 07]: LoadResult struct chosen over tuple return for config.Load() -- cleaner API contract for Plan 02 CLI wiring
 ### Pending Todos
-None.
+1 pending todo: `.planning/todos/pending/001-expand-traffic-classes.md`
 ### Blockers/Concerns
- [Phase 7 pre-work]: User-defined class names that collide with built-in class strings (e.g., `class = "HTTPS"`) require an explicit design decision before Phase 7 coding begins. Research flags this as unresolved. Options: treat as override (simplest) or reject as ambiguous. Resolve during Phase 7 planning.
+None — milestone complete.
 ## Session Continuity
-Last session: 2026-03-26T20:52:30.470Z
+Last session: 2026-03-27
-Stopped at: Completed 07-02-PLAN.md
+Stopped at: Milestone v1.2 archived
 Resume file: None
@@ -0,0 +1,105 @@
 # Requirements Archive: v1.2 Extended Protocol Coverage
 **Archived:** 2026-03-27
 **Status:** SHIPPED
 For current requirements, see `.planning/REQUIREMENTS.md`.
 ---
 # Requirements: NetSynth
 **Defined:** 2026-03-27
 **Core Value:** Network traffic patterns are instantly recognizable as distinct sounds — a ping sounds different from HTTPS noise, which sounds different from a port scan.
 ## v1.2 Requirements
 Requirements for extended protocol coverage milestone. Each maps to roadmap phases.
 ### Cleanup
 - [x] **CLEAN-01**: Remove stale `NumLayers` constant and hardcoded frequency range test assertions that would block new class additions
 ### Protocol Coverage
 - [x] **PROTO-01**: Add Mail family protocols: IMAP (143/993), POP3 (110/995), SMTP-submission (587)
 - [x] **PROTO-02**: Add File Transfer family protocols: FTP (20-21), SMB/CIFS (445), TFTP (69)
 - [x] **PROTO-03**: Add Remote Access family protocols: RDP (3389), Telnet (23), VNC (5900)
 - [x] **PROTO-04**: Add Database family protocols: MySQL (3306), PostgreSQL (5432), Redis (6379), MongoDB (27017)
 - [x] **PROTO-05**: Add Discovery family protocols: mDNS (5353), SSDP/UPnP (1900), SNMP (161-162)
 - [x] **PROTO-06**: Add VoIP family: SIP (5060/5061)
 - [x] **PROTO-07**: Add Web family extension: QUIC/HTTP3 (UDP 443)
 - [x] **PROTO-08**: Add Infrastructure family protocols: LDAP (389/636), Kerberos (88), Syslog (514)
 - [x] **PROTO-09**: Existing 10 protocol classifications remain unchanged — no regression in rule matching behavior
 ### Frequency Design
 - [ ] **FREQ-01**: All traffic classes (existing + new) are redistributed into group-coherent frequency bands using musical interval ratios (not fixed Hz steps)
 - [ ] **FREQ-02**: Within-family protocols are separated by at least a major second interval (ratio 1.122) to avoid critical band masking
 - [ ] **FREQ-03**: The full frequency allocation table is designed and documented before any FreqConfig code is written
 - [x] **FREQ-04**: Auto-assign frequency range for user custom classes is updated to avoid collision with new built-in frequencies
 ### Group System
 - [ ] **GRP-01**: Each traffic class belongs to a named group (Infrastructure, Web, Mail, File Transfer, Remote Access, Database, Discovery, VoIP)
 - [x] **GRP-02**: `--print-config` output organizes classes by group with section headers
 - [x] **GRP-03**: Users can define `[groups]` in TOML config to reassign protocols to different sound families
 - [ ] **GRP-04**: FreqConfig gains a `Group` field that drives group-aware frequency allocation and config output
 ## Future Requirements
 Deferred to later releases.
 ### Dynamic Protocol Detection
 - **DYN-01**: RTP voice/video payload detection (dynamically negotiated ports — cannot use port-based rules)
 - **DYN-02**: Application-layer protocol detection via DPI for ambiguous ports
 ### Audio Tuning
 - **TUNE-01**: User can configure time window duration via `--window` flag
 - **TUNE-02**: User can configure output duration when reading pcap files via `--duration` flag
 ## Out of Scope
 | Feature | Reason |
 |---------|--------|
 | RTP payload detection | Dynamically negotiated ports; needs DPI, not port rules |
 | mDNS multicast group join | Would require raw socket changes; port 5353 classification is sufficient |
 | Protocol-specific metadata extraction | Beyond classification scope; tool sonifies, not inspects |
 | Real-time audio playback | File output only — established v1.0 constraint |
 | GUI config editor | CLI-only tool; TOML is human-editable |
 ## Traceability
 Which phases cover which requirements. Updated during roadmap creation.
 | Requirement | Phase | Status |
 |-------------|-------|--------|
 | CLEAN-01 | Phase 8 | Complete |
 | FREQ-01 | Phase 9 | Pending |
 | FREQ-02 | Phase 9 | Pending |
 | FREQ-03 | Phase 9 | Pending |
 | FREQ-04 | Phase 9 | Complete |
 | GRP-01 | Phase 9 | Pending |
 | GRP-04 | Phase 9 | Pending |
 | PROTO-01 | Phase 10 | Complete |
 | PROTO-02 | Phase 10 | Complete |
 | PROTO-03 | Phase 10 | Complete |
 | PROTO-04 | Phase 10 | Complete |
 | PROTO-05 | Phase 10 | Complete |
 | PROTO-06 | Phase 10 | Complete |
 | PROTO-07 | Phase 10 | Complete |
 | PROTO-08 | Phase 10 | Complete |
 | PROTO-09 | Phase 10 | Complete |
 | GRP-02 | Phase 11 | Complete |
 | GRP-03 | Phase 11 | Complete |
 **Coverage:**
 - v1.2 requirements: 18 total
 - Mapped to phases: 18 (complete)
 - Unmapped: 0
 ---
 *Requirements defined: 2026-03-27*
 *Last updated: 2026-03-27 — traceability complete, roadmap phases 8-11 assigned*
@@ -0,0 +1,113 @@
 # Roadmap: NetSynth
 ## Milestones
 - **v1.0 MVP** — Phases 1-4 (shipped 2026-03-26)
 - **v1.1 Custom Sound Mappings** — Phases 5-7 (shipped 2026-03-26)
 - **v1.2 Extended Protocol Coverage** — Phases 8-11 (in progress)
 ## Phases
 <details>
 <summary>v1.0 MVP (Phases 1-4) — SHIPPED 2026-03-26</summary>
 - [x] **Phase 1: Capture and Classification** - 4/4 plans — completed 2026-03-25
 - [x] **Phase 2: Audio Synthesis Engine** - 3/3 plans — completed 2026-03-26
 - [x] **Phase 3: Pipeline Integration and MVP** - 2/2 plans — completed 2026-03-26
 - [x] **Phase 4: Power User Features** - 2/2 plans — completed 2026-03-26
 Full details: `.planning/milestones/v1.0-ROADMAP.md`
 </details>
 <details>
 <summary>v1.1 Custom Sound Mappings (Phases 5-7) — SHIPPED 2026-03-26</summary>
 - [x] **Phase 5: Waveform Types and Bank Decoupling** - 2/2 plans — completed 2026-03-26
 - [x] **Phase 6: Config Package and Sound Overrides** - 2/2 plans — completed 2026-03-26
 - [x] **Phase 7: Custom Rules and Print-Config** - 2/2 plans — completed 2026-03-26
 Full details: `.planning/milestones/v1.1-ROADMAP.md`
 </details>
 ### v1.2 Extended Protocol Coverage (In Progress)
 **Milestone Goal:** Expand traffic classification with grouped protocol families that share recognizable sound signatures — from 14 classes to ~35, organized into frequency bands by family.
 - [x] **Phase 8: Test and Constant Cleanup** - 1 plan — Remove stale constants and update test bounds that would block all subsequent v1.2 work (completed 2026-03-27)
 - [ ] **Phase 9: Frequency Design and Group Architecture** - 2 plans — Design complete Hz allocation for all ~35 classes in family bands and add Group field to FreqConfig
 - [x] **Phase 10: Classification Layer** - 2 plans — Add 21 new TrafficClass constants, 30 port rules, and test coverage for all new protocol families (completed 2026-03-27)
 - [x] **Phase 11: Synthesis and Config Layer** - Add ClassFreqConfigs entries for all new classes, update auto-assign range, and add group-header output to --print-config (completed 2026-03-27)
 ## Phase Details
 ### Phase 8: Test and Constant Cleanup
 **Goal**: Pre-existing test assertions and a stale exported constant that would block or mislead all subsequent v1.2 work are removed
 **Depends on**: Phase 7
 **Requirements**: CLEAN-01
 **Success Criteria** (what must be TRUE):
  1. `go test ./...` passes on main with no modifications to the new v1.2 code path
  2. The stale `NumLayers`/`GainPerLayer` exported constant no longer exists in the synth package — callers cannot accidentally use it
  3. `TestFrequenciesInRange` accepts the new extended Hz range without manual test surgery when new classes are added in Phase 10
 **Plans:** 1/1 plans complete
 Plans:
 - [x] 08-01-PLAN.md — Delete stale constants, future-proof test bounds, rename/consolidate tests
 ### Phase 9: Frequency Design and Group Architecture
 **Goal**: A complete, documented frequency allocation table for all ~35 traffic classes exists and the FreqConfig struct carries a Group field — design decisions are locked in before any protocol code is written
 **Depends on**: Phase 8
 **Requirements**: FREQ-01, FREQ-02, FREQ-03, FREQ-04, GRP-01, GRP-04
 **Success Criteria** (what must be TRUE):
  1. A written frequency allocation table (in a planning doc or code comment) lists every built-in class, its Hz value, waveform, and group — no class is TBD
  2. Every within-family pair of frequencies satisfies at least a major second interval (ratio 1.122), verifiable by inspection of the table
  3. The `autoAssignFreq` base for user-defined custom classes is set above all built-in frequencies, with no collision possible
  4. `FreqConfig` has a `Group` string field and all existing `ClassFreqConfigs` entries compile with the new struct shape
 **Plans:** 1/2 plans executed
 Plans:
 - [ ] 09-01-PLAN.md — Add Group field to FreqConfig, rebalance ClassFreqConfigs to major-second ladder
 - [x] 09-02-PLAN.md — Update auto-assign range from [1200,2350] to [2500,4000] Hz
 ### Phase 10: Classification Layer
 **Goal**: All new protocol families are classified — ~21 new TrafficClass constants exist, AllClasses() covers them, and DefaultRules maps all new ports to their classes
 **Depends on**: Phase 9
 **Requirements**: PROTO-01, PROTO-02, PROTO-03, PROTO-04, PROTO-05, PROTO-06, PROTO-07, PROTO-08, PROTO-09
 **Success Criteria** (what must be TRUE):
  1. A packet arriving on any new protocol port (e.g., TCP 143, TCP 3389, TCP 3306, UDP 5353, TCP 5060) is classified into the correct named TrafficClass, not into other-TCP or other-UDP
  2. All existing 10 protocol classifications continue to match as before — no regression in rule order or port assignments
  3. Multiple ports mapping to the same family class (e.g., IMAP port 143 and IMAPS port 993 both classify as the same Mail-IMAP class) behave identically in the classifier output
  4. `go test ./classify/...` passes with no new test failures
 **Plans:** 2/2 plans complete
 Plans:
 - [x] 10-01-PLAN.md — Add 21 TrafficClass constants and 30 port-matching rules
 - [x] 10-02-PLAN.md — Add 28 classification subtests and update TestAllClassesCount
 ### Phase 11: Synthesis and Config Layer
 **Goal**: Every new traffic class produces a distinct, family-coherent sound and --print-config shows all classes organized by group with section headers
 **Depends on**: Phase 9, Phase 10
 **Requirements**: GRP-02, GRP-03
 **Success Criteria** (what must be TRUE):
  1. Running `netsynth --print-config` shows all ~35 classes grouped by family with section header comments (e.g., `# Mail`, `# Database`) — no class is listed without a group
  2. A pcap or live capture that triggers Mail traffic produces tones that are audibly in the same timbral family — same waveform type, similar frequency register — while still being distinguishable from each other
  3. Users can define `[groups]` in their TOML config to reassign a protocol to a different sound family, and --print-config reflects the reassignment
  4. `go test ./...` passes and a listening test on a representative pcap confirms family identity is perceptually clear
 **Plans:** 2/2 plans complete
 Plans:
 - [x] 11-01-PLAN.md — Add 21 ClassFreqConfigs entries, update AllClasses() to 35, fix all count tests
 - [x] 11-02-PLAN.md — Refactor PrintConfig for group headers, add [groups] TOML support
 ## Progress
 | Phase | Milestone | Plans Complete | Status | Completed |
 |-------|-----------|----------------|--------|-----------|
 | 1. Capture and Classification | v1.0 | 4/4 | Complete | 2026-03-25 |
 | 2. Audio Synthesis Engine | v1.0 | 3/3 | Complete | 2026-03-26 |
 | 3. Pipeline Integration and MVP | v1.0 | 2/2 | Complete | 2026-03-26 |
 | 4. Power User Features | v1.0 | 2/2 | Complete | 2026-03-26 |
 | 5. Waveform Types and Bank Decoupling | v1.1 | 2/2 | Complete | 2026-03-26 |
 | 6. Config Package and Sound Overrides | v1.1 | 2/2 | Complete | 2026-03-26 |
 | 7. Custom Rules and Print-Config | v1.1 | 2/2 | Complete | 2026-03-26 |
 | 8. Test and Constant Cleanup | v1.2 | 1/1 | Complete   | 2026-03-27 |
 | 9. Frequency Design and Group Architecture | v1.2 | 1/2 | In Progress|  |
 | 10. Classification Layer | v1.2 | 2/2 | Complete    | 2026-03-27 |
 | 11. Synthesis and Config Layer | v1.2 | 2/2 | Complete    | 2026-03-27 |
@@ -0,0 +1,214 @@
 ---
 phase: 08-test-and-constant-cleanup
 plan: 01
 type: execute
 wave: 1
 depends_on: []
 files_modified:
  - synth/config.go
  - synth/config_test.go
 autonomous: true
 requirements:
  - CLEAN-01
 must_haves:
  truths:
    - "NumLayers and GainPerLayer constants do not exist in the synth package"
    - "go test ./... passes with zero failures after all edits"
    - "TestFrequenciesInRange accepts any BaseHz in (0, Nyquist) without manual test surgery"
    - "TestNumLayersMatchesAllClasses is renamed to TestClassFreqConfigsMatchAllClasses"
  artifacts:
    - path: "synth/config.go"
      provides: "Cleaned constant block without NumLayers or GainPerLayer"
      contains: "WhisperFloor"
    - path: "synth/config_test.go"
      provides: "Future-proof test assertions"
      contains: "TestClassFreqConfigsMatchAllClasses"
  key_links:
    - from: "synth/bank.go"
      to: "synth/config.go"
      via: "gainPerLayer computed dynamically in NewBank — no longer any static constant to conflict with"
      pattern: "1\\.0 / float64\\(len\\(cfgs\\)\\)"
    - from: "synth/config_test.go"
      to: "synth/config.go"
      via: "TestFrequenciesInRange validates BaseHz against SampleRate-derived Nyquist"
      pattern: "float64\\(synth\\.SampleRate\\)"
 ---
 <objective>
 Remove stale exported constants and hardcoded test bounds from the synth package so that subsequent v1.2 phases can add new traffic classes and frequencies without triggering false CI failures.
 Purpose: Phase 8 is the gatekeeper for all v1.2 work. NumLayers=14 is dead code (NewBank computes gain dynamically), and TestFrequenciesInRange's [60, 1100] bound will reject any new class above 1100 Hz. Both must be cleaned up before Phase 9-11 proceed.
 Output: Two edited files (synth/config.go, synth/config_test.go) with all tests green.
 </objective>
 <execution_context>
@$HOME/.claude/get-shit-done/workflows/execute-plan.md
@$HOME/.claude/get-shit-done/templates/summary.md
 </execution_context>
 <context>
@.planning/PROJECT.md
@.planning/ROADMAP.md
@.planning/STATE.md
@.planning/phases/08-test-and-constant-cleanup/08-CONTEXT.md
@.planning/phases/08-test-and-constant-cleanup/08-RESEARCH.md
 <interfaces>
 <!-- Key constants and types the executor needs from synth/config.go -->
 From synth/config.go (current constant block, lines 5-12):
 ```go
 const (
    SampleRate       = 44100                              // D-13: CD quality
    WindowMs         = 500                                // matches aggregate.DefaultWindowMs
    SamplesPerWindow = SampleRate * WindowMs / 1000       // 22050
    NumLayers        = 14                                 // <-- DELETE per D-01
    GainPerLayer     = 1.0 / float64(NumLayers)           // D-10: ~0.0714  <-- DELETE per D-01
    WhisperFloor     = 0.03                               // D-08/D-09: 3% of max amplitude
 )
 ```
 From synth/bank.go (line 21 — confirms constants are dead code):
 ```go
 gainPerLayer: 1.0 / float64(len(cfgs)),  // dynamic computation, no constant needed
 ```
 From synth/config_test.go (current test functions to modify):
 ```go
 // Lines 18-25: TestFrequenciesInRange — hardcoded [60, 1100] to replace
 // Lines 53-59: TestClassFreqConfigsComplete — duplicate of TestAllClassesHaveConfig
 // Lines 61-66: TestNumLayersMatchesAllClasses — rename to TestClassFreqConfigsMatchAllClasses
 ```
 </interfaces>
 </context>
 <tasks>
 <task type="auto">
  <name>Task 1: Delete stale NumLayers and GainPerLayer constants from synth/config.go</name>
  <files>synth/config.go</files>
  <read_first>
    - synth/config.go (see current constant block at lines 5-12)
    - synth/bank.go (line 21 confirms gainPerLayer is computed dynamically)
  </read_first>
  <action>
 Per D-01: Delete lines 9-10 from synth/config.go — the `NumLayers = 14` and `GainPerLayer = 1.0 / float64(NumLayers)` constants.
 The resulting constant block must be:
 ```go
 const (
    SampleRate       = 44100                              // D-13: CD quality
    WindowMs         = 500                                // matches aggregate.DefaultWindowMs
    SamplesPerWindow = SampleRate * WindowMs / 1000       // 22050
    WhisperFloor     = 0.03                               // D-08/D-09: 3% of max amplitude
 )
 ```
 Do NOT modify any other lines in config.go. Do NOT touch bank.go — NewBank's dynamic `1.0 / float64(len(cfgs))` is already correct.
 Optionally, add a traceability comment to synth/bank.go line 21:
 `gainPerLayer: 1.0 / float64(len(cfgs)), // D-10: 1/N so all layers at full amplitude sum to 1.0`
 This is low-priority — skip if it feels like noise.
  </action>
  <verify>
    <automated>cd /home/dev/workspace/yoloyolo && grep -n "NumLayers\|GainPerLayer" synth/config.go; echo "EXIT:$?"</automated>
  </verify>
  <acceptance_criteria>
    - `grep -c "NumLayers" synth/config.go` returns 0
    - `grep -c "GainPerLayer" synth/config.go` returns 0
    - `synth/config.go` still contains `SampleRate       = 44100`
    - `synth/config.go` still contains `WhisperFloor     = 0.03`
    - `go build ./synth/...` exits 0 (no compilation errors from removing the constants)
  </acceptance_criteria>
  <done>NumLayers and GainPerLayer constants no longer exist in synth/config.go. The constant block contains only SampleRate, WindowMs, SamplesPerWindow, and WhisperFloor. Code compiles cleanly.</done>
 </task>
 <task type="auto">
  <name>Task 2: Update synth/config_test.go — future-proof frequency bounds, rename test, remove duplicate</name>
  <files>synth/config_test.go</files>
  <read_first>
    - synth/config_test.go (full file — see all 6 test functions)
    - synth/config.go (after Task 1 edits — confirm SampleRate is exported)
  </read_first>
  <action>
 Three changes to synth/config_test.go:
 **Change 1 (per D-02):** Replace the body of `TestFrequenciesInRange` (lines 18-25) with Nyquist-based validation. The new function body:
 ```go
 func TestFrequenciesInRange(t *testing.T) {
    const nyquist = float64(synth.SampleRate) / 2.0 // 22050 Hz
    for class, cfg := range synth.ClassFreqConfigs {
        if cfg.BaseHz <= 0 {
            t.Errorf("class %q BaseHz=%.1f must be positive", class, cfg.BaseHz)
        }
        if cfg.BaseHz >= nyquist {
            t.Errorf("class %q BaseHz=%.1f exceeds Nyquist (%.1f Hz)", class, cfg.BaseHz, nyquist)
        }
    }
 }
 ```
 This accepts any BaseHz in (0, 22050) — no manual edit needed when Phase 10 adds classes above 1100 Hz.
 **Change 2 (per D-03):** Rename `TestNumLayersMatchesAllClasses` (line 61) to `TestClassFreqConfigsMatchAllClasses`. Keep the function body identical:
 ```go
 func TestClassFreqConfigsMatchAllClasses(t *testing.T) {
    if len(synth.ClassFreqConfigs) != len(classify.AllClasses()) {
        t.Errorf("ClassFreqConfigs has %d entries but AllClasses() has %d entries",
            len(synth.ClassFreqConfigs), len(classify.AllClasses()))
    }
 }
 ```
 **Change 3 (Claude's discretion — consolidation):** Delete `TestClassFreqConfigsComplete` (lines 53-59) entirely. It is a semantic duplicate of `TestAllClassesHaveConfig` (lines 10-16) — both iterate `AllClasses()` and check for a map entry. Removing it leaves three non-overlapping tests:
 - `TestAllClassesHaveConfig` — every AllClasses() member has a map entry
 - `TestClassFreqConfigsMatchAllClasses` — count parity (catches extra entries)
 - `TestFrequenciesInRange` — all BaseHz positive and below Nyquist
 The remaining tests (`TestFrequenciesUnique`, `TestHarmonicsNonEmpty`, `TestPanPositionsInRange`) are untouched.
  </action>
  <verify>
    <automated>cd /home/dev/workspace/yoloyolo && go test ./synth/... -v -count=1 2>&1 | head -40</automated>
  </verify>
  <acceptance_criteria>
    - `grep -c "TestNumLayersMatchesAllClasses" synth/config_test.go` returns 0
    - `grep -c "TestClassFreqConfigsMatchAllClasses" synth/config_test.go` returns 1
    - `grep -c "TestClassFreqConfigsComplete" synth/config_test.go` returns 0
    - `grep "nyquist" synth/config_test.go` returns at least one match
    - `grep "1100" synth/config_test.go` returns 0 matches (hardcoded bound removed)
    - `go test ./synth/... -run TestFrequenciesInRange` exits 0
    - `go test ./synth/... -run TestClassFreqConfigsMatchAllClasses` exits 0
    - `go test ./...` exits 0 (full suite green)
  </acceptance_criteria>
  <done>TestFrequenciesInRange uses Nyquist-based validation (no hardcoded upper bound). TestNumLayersMatchesAllClasses renamed to TestClassFreqConfigsMatchAllClasses. Duplicate TestClassFreqConfigsComplete removed. Full test suite passes.</done>
 </task>
 </tasks>
 <verification>
 After both tasks complete:
 1. `grep -rn "NumLayers\|GainPerLayer" synth/*.go` — zero matches in production and test code
 2. `grep -n "1100" synth/config_test.go` — zero matches (hardcoded bound gone)
 3. `go test ./...` — all packages pass with zero failures
 4. `go test ./synth/... -run TestFrequenciesInRange` — passes
 5. `go test ./synth/... -run TestClassFreqConfigsMatchAllClasses` — passes
 6. `go test ./synth/... -run TestClassFreqConfigsComplete` — no such test (removed)
 </verification>
 <success_criteria>
 - NumLayers and GainPerLayer constants deleted from synth/config.go
 - TestFrequenciesInRange validates against Nyquist (22050 Hz), not hardcoded 1100
 - TestNumLayersMatchesAllClasses renamed to TestClassFreqConfigsMatchAllClasses
 - Duplicate TestClassFreqConfigsComplete removed
 - `go test ./...` passes with zero failures
 - Adding a new class with BaseHz=2000 in a future phase would NOT require editing any test
 </success_criteria>
 <output>
 After completion, create `.planning/phases/08-test-and-constant-cleanup/08-01-SUMMARY.md`
 </output>
@@ -0,0 +1,74 @@
 ---
 phase: 08-test-and-constant-cleanup
 plan: 01
 subsystem: synth
 tags: [cleanup, constants, tests, ci]
 dependency_graph:
  requires: []
  provides: [clean-constant-block, future-proof-frequency-tests]
  affects: [synth/config.go, synth/config_test.go]
 tech_stack:
  added: []
  patterns: [Nyquist-based validation instead of hardcoded bounds]
 key_files:
  created: []
  modified:
    - synth/config.go
    - synth/config_test.go
 decisions:
  - NumLayers and GainPerLayer deleted — NewBank computes gain dynamically as 1/len(cfgs); static constants were dead code after v1.1
  - TestFrequenciesInRange now validates against Nyquist (22050 Hz) so any BaseHz in (0, 22050) is accepted without test surgery
  - TestClassFreqConfigsComplete removed as duplicate of TestAllClassesHaveConfig; TestNumLayersMatchesAllClasses renamed to TestClassFreqConfigsMatchAllClasses
 metrics:
  duration: "1 min"
  completed: "2026-03-27"
  tasks_completed: 2
  files_modified: 2
 requirements_satisfied:
  - CLEAN-01
 ---
 # Phase 8 Plan 1: Constant Cleanup and Future-Proof Tests Summary
 Removed stale exported constants and hardcoded test bounds from the synth package so v1.2 phases can add new traffic classes and frequencies without triggering false CI failures.
 ## Tasks Completed
 | Task | Name | Commit | Files |
 |------|------|--------|-------|
 | 1 | Delete stale NumLayers and GainPerLayer constants | fd17061 | synth/config.go |
 | 2 | Update synth/config_test.go — future-proof frequency bounds, rename test, remove duplicate | 4800e8e | synth/config_test.go |
 ## What Was Done
 **Task 1** deleted `NumLayers = 14` and `GainPerLayer = 1.0 / float64(NumLayers)` from `synth/config.go`. These constants were dead code since `NewBank` computes `gainPerLayer` dynamically as `1.0 / float64(len(cfgs))`. The constant block now contains only `SampleRate`, `WindowMs`, `SamplesPerWindow`, and `WhisperFloor`.
 **Task 2** made three improvements to `synth/config_test.go`:
 1. `TestFrequenciesInRange` now validates each `BaseHz` is in `(0, 22050)` using `float64(synth.SampleRate) / 2.0` as the Nyquist bound — no hardcoded upper limit that would reject new protocol classes above 1100 Hz.
 2. `TestNumLayersMatchesAllClasses` renamed to `TestClassFreqConfigsMatchAllClasses` — name now accurately describes what it tests.
 3. `TestClassFreqConfigsComplete` deleted — it was a semantic duplicate of `TestAllClassesHaveConfig` (both iterate `AllClasses()` and check for a map entry). Three clean, non-overlapping tests remain.
 ## Verification Results
 All six plan verification checks passed:
 - Zero `NumLayers`/`GainPerLayer` references in `synth/*.go`
 - Zero hardcoded `1100` bounds in `synth/config_test.go`
 - `go test ./...` — all 7 packages green
 - `TestFrequenciesInRange` passes
 - `TestClassFreqConfigsMatchAllClasses` passes
 - `TestClassFreqConfigsComplete` no longer exists (correctly)
 ## Deviations from Plan
 None — plan executed exactly as written.
 ## Known Stubs
 None.
 ## Self-Check: PASSED
 - synth/config.go exists and contains WhisperFloor, no NumLayers/GainPerLayer
 - synth/config_test.go exists with nyquist validation, TestClassFreqConfigsMatchAllClasses, no TestClassFreqConfigsComplete
 - Commits fd17061 and 4800e8e exist
 - Full test suite green
@@ -0,0 +1,88 @@
 # Phase 8: Test and Constant Cleanup - Context
 **Gathered:** 2026-03-27
 **Status:** Ready for planning
 <domain>
 ## Phase Boundary
 Remove stale exported constants (`NumLayers`, `GainPerLayer`) from the synth package and update hardcoded test assertions (`TestFrequenciesInRange`) so that subsequent v1.2 phases can add new traffic classes and frequencies without triggering false CI failures. This is pure cleanup — no new features, no new protocols.
 </domain>
 <decisions>
 ## Implementation Decisions
 ### Constant Removal Strategy
 - **D-01:** Delete `NumLayers` and `GainPerLayer` constants entirely from `synth/config.go`. They are dead code — `NewBank` already computes `gainPerLayer` dynamically as `1.0 / float64(len(cfgs))` (bank.go:21). No external callers reference either constant outside the test file.
 ### Frequency Range Test Bounds
 - **D-02:** Replace the hardcoded `[60, 1100]` bounds in `TestFrequenciesInRange` with dynamic validation — derive the valid range from the `ClassFreqConfigs` data itself (e.g., check that all frequencies are positive and below Nyquist) rather than hardcoding a new magic number that would need manual updating when Phase 9/10 add classes above 1100 Hz. The specific approach (positive+Nyquist check, or a generous static bound like `[20, 8000]`) is at Claude's discretion — the key constraint is that adding a new class in the 1100-4000 Hz range must not require editing this test.
 ### Test Naming
 - **D-03:** Rename `TestNumLayersMatchesAllClasses` to `TestClassFreqConfigsMatchAllClasses` (or similar) to reflect the actual invariant being tested after `NumLayers` removal. The test body already uses `len(synth.ClassFreqConfigs)` and `len(classify.AllClasses())` — only the name references the deleted constant.
 ### Claude's Discretion
 - Whether to use a generous static upper bound vs a computed Nyquist-based bound for D-02 — either approach satisfies the constraint
 - Whether `WhisperFloor` or other constants in config.go need any adjustment (they don't reference NumLayers, so likely no)
 - Whether `TestClassFreqConfigsComplete` (line 53) should be consolidated with the renamed test since both verify the same invariant
 ### Folded Todos
 - **"Expand Traffic Classes"** (from `.planning/todos/pending/001-expand-traffic-classes.md`) — This todo requests adding protocols like IMAP, POP3, SNMP, FTP and researching common traffic classes. Phase 8 enables this work by removing the test/constant blockers, but the actual protocol additions are Phase 10's scope. Folded here as context, not as direct Phase 8 work.
 </decisions>
 <canonical_refs>
 ## Canonical References
 **Downstream agents MUST read these before planning or implementing.**
 ### Synth Package (primary targets)
 - `synth/config.go` — Contains `NumLayers` and `GainPerLayer` constants to remove (lines 9-10)
 - `synth/config_test.go` — Contains `TestFrequenciesInRange` (lines 18-24), `TestNumLayersMatchesAllClasses` (lines 61-66), and `TestClassFreqConfigsComplete` (lines 53-59)
 - `synth/bank.go` — `NewBank` already computes `gainPerLayer` dynamically (line 21) — confirms constants are dead code
 ### Research Context
 - `.planning/research/PITFALLS.md` — Pitfall C4 documents `TestFrequenciesInRange` hardcoding issue
 - `.planning/research/ARCHITECTURE.md` — Lines 414+ document NumLayers/ClassFreqConfigs mismatch risk
 - `.planning/research/SUMMARY.md` — Lines 69, 85, 100 describe Phase 8 cleanup scope
 </canonical_refs>
 <code_context>
 ## Existing Code Insights
 ### Reusable Assets
 - `synth/bank.go:NewBank` already has the correct dynamic gain computation — no new code needed for gain behavior
 ### Established Patterns
 - Test file `synth/config_test.go` uses table-driven validation against `ClassFreqConfigs` map and `classify.AllClasses()` — new/renamed tests should follow this pattern
 - `GainPerLayer` constant at line 10 has a comment referencing "D-10" — cleanup should not leave orphan decision references
 ### Integration Points
 - Only `synth/config.go` and `synth/config_test.go` are modified — no downstream package changes expected
 - `go test ./...` is the verification gate — must pass with zero new failures
 </code_context>
 <specifics>
 ## Specific Ideas
 No specific requirements — this is a straightforward cleanup phase with clear targets identified in research.
 </specifics>
 <deferred>
 ## Deferred Ideas
 ### Reviewed Todos (not folded)
 None — the matched todo was folded as milestone context.
 None — discussion stayed within phase scope.
 </deferred>
 ---
 *Phase: 08-test-and-constant-cleanup*
 *Context gathered: 2026-03-27*
@@ -0,0 +1,60 @@
 # Phase 8: Test and Constant Cleanup - Discussion Log
 > **Audit trail only.** Do not use as input to planning, research, or execution agents.
 > Decisions are captured in CONTEXT.md — this log preserves the alternatives considered.
 **Date:** 2026-03-27
 **Phase:** 08-test-and-constant-cleanup
 **Areas discussed:** Constant removal strategy, Frequency range bound, Test naming
 **Mode:** Auto (all decisions auto-selected)
 ---
 ## Constant Removal Strategy
 | Option | Description | Selected |
 |--------|-------------|----------|
 | Delete entirely | Remove NumLayers and GainPerLayer from config.go — bank.go already computes dynamically | ✓ |
 | Deprecate with comment | Keep but mark as deprecated for backward compatibility | |
 | Replace with function | Convert to a function that returns len(ClassFreqConfigs) | |
 **User's choice:** [auto] Delete entirely (recommended default)
 **Notes:** NewBank already computes gainPerLayer as 1.0/len(cfgs). No external callers reference either constant.
 ---
 ## Frequency Range Test Bound
 | Option | Description | Selected |
 |--------|-------------|----------|
 | Dynamic validation | Derive valid range from data (positive + below Nyquist) — no magic numbers | ✓ |
 | Generous static bound | Replace 1100 with e.g. 8000 Hz — simple but still hardcoded | |
 | Remove range test | Delete TestFrequenciesInRange entirely — other tests cover correctness | |
 **User's choice:** [auto] Dynamic validation (recommended default)
 **Notes:** Key constraint: adding a class in 1100-4000 Hz range must not require editing this test.
 ---
 ## Test Naming
 | Option | Description | Selected |
 |--------|-------------|----------|
 | Rename to TestClassFreqConfigsMatchAllClasses | Reflects actual invariant after NumLayers removal | ✓ |
 | Keep current name | Leave as-is despite referencing deleted constant | |
 | Delete test | TestClassFreqConfigsComplete already covers same invariant | |
 **User's choice:** [auto] Rename to TestClassFreqConfigsMatchAllClasses (recommended default)
 **Notes:** Test body already uses len() comparisons, only the name references NumLayers.
 ---
 ## Claude's Discretion
 - Specific approach for dynamic frequency range validation (Nyquist-based vs generous static bound)
 - Whether to consolidate TestClassFreqConfigsComplete with renamed test
 - Whether WhisperFloor needs adjustment (likely not)
 ## Deferred Ideas
 None — discussion stayed within phase scope.
@@ -0,0 +1,338 @@
 # Phase 8: Test and Constant Cleanup - Research
 **Researched:** 2026-03-27
 **Domain:** Go test cleanup, dead code removal, test assertion generalization
 **Confidence:** HIGH
 <user_constraints>
 ## User Constraints (from CONTEXT.md)
 ### Locked Decisions
 - **D-01:** Delete `NumLayers` and `GainPerLayer` constants entirely from `synth/config.go`. They are dead code — `NewBank` already computes `gainPerLayer` dynamically as `1.0 / float64(len(cfgs))` (bank.go:21). No external callers reference either constant outside the test file.
 - **D-02:** Replace the hardcoded `[60, 1100]` bounds in `TestFrequenciesInRange` with dynamic validation — derive the valid range from the `ClassFreqConfigs` data itself (e.g., check that all frequencies are positive and below Nyquist) rather than hardcoding a new magic number that would need manual updating when Phase 9/10 add classes above 1100 Hz.
 - **D-03:** Rename `TestNumLayersMatchesAllClasses` to `TestClassFreqConfigsMatchAllClasses` (or similar) to reflect the actual invariant being tested after `NumLayers` removal.
 ### Claude's Discretion
 - Whether to use a generous static upper bound vs a computed Nyquist-based bound for D-02 — either approach satisfies the constraint
 - Whether `WhisperFloor` or other constants in config.go need any adjustment (they don't reference NumLayers, so likely no)
 - Whether `TestClassFreqConfigsComplete` (line 53) should be consolidated with the renamed test since both verify the same invariant
 ### Deferred Ideas (OUT OF SCOPE)
 - Adding protocols (IMAP, POP3, SNMP, FTP, etc.) — this is Phase 10 scope; Phase 8 only removes blockers
 </user_constraints>
 <phase_requirements>
 ## Phase Requirements
 | ID | Description | Research Support |
 |----|-------------|------------------|
 | CLEAN-01 | Remove stale `NumLayers` constant and hardcoded frequency range test assertions that would block new class additions | D-01 removes the constants; D-02 replaces hardcoded bounds with future-proof validation; D-03 renames stale test function |
 </phase_requirements>
 ---
 ## Summary
 Phase 8 is a pure cleanup phase with two narrowly scoped targets: (1) two dead exported constants in `synth/config.go` and (2) three test functions in `synth/config_test.go` that need renaming or rewiring. No new features, no new packages, no new dependencies.
 `NumLayers = 14` and `GainPerLayer = 1.0 / float64(NumLayers)` in `synth/config.go` are provably dead code. `synth/bank.go:NewBank` computes `gainPerLayer` dynamically at line 21 as `1.0 / float64(len(cfgs))`. Neither constant is referenced anywhere in the production code path — only in the test file's function name `TestNumLayersMatchesAllClasses` (which itself does not use either constant in its body). Deleting both constants removes a misleading signal and eliminates the risk of future callers accidentally hardcoding the stale count 14.
 `TestFrequenciesInRange` asserts `cfg.BaseHz < 60 || cfg.BaseHz > 1100`. Phase 9 will redistribute frequencies and Phase 10 will add classes whose frequencies will exceed 1100 Hz. The test will produce false failures the moment any `ClassFreqConfigs` entry above 1100 Hz is added. Replacing the hardcoded upper bound with a Nyquist-based check (or a generous static bound like 8000 Hz) makes the test structurally future-proof without encoding new domain knowledge in this phase.
 **Primary recommendation:** Three surgical edits to two files — delete 2 lines in `config.go`, update 1 test function body + rename 2 test functions in `config_test.go`. Total change surface is under 15 lines.
 ---
 ## Standard Stack
 No new dependencies. This phase touches only existing Go source files.
 ### Core
 | Library | Version | Purpose | Why Standard |
 |---------|---------|---------|--------------|
 | `testing` | stdlib | Test assertions | Already used throughout the codebase |
 **Installation:** None required — no new packages.
 ---
 ## Architecture Patterns
 ### Files Modified (exhaustive list)
 ```
 synth/
 ├── config.go       # Delete NumLayers and GainPerLayer constants (lines 9-10)
 └── config_test.go  # Update TestFrequenciesInRange body; rename two test functions
 ```
 No other files are modified. The CONTEXT.md explicitly states: "Only `synth/config.go` and `synth/config_test.go` are modified — no downstream package changes expected."
 ### Pattern 1: Dead Constant Removal
 **What:** Delete lines 9-10 from `synth/config.go`.
 **Current state:**
 ```go
 // synth/config.go lines 5-12
 const (
    SampleRate       = 44100
    WindowMs         = 500
    SamplesPerWindow = SampleRate * WindowMs / 1000   // 22050
    NumLayers        = 14
    GainPerLayer     = 1.0 / float64(NumLayers)       // D-10: ~0.0714
    WhisperFloor     = 0.03
 )
 ```
 **After deletion:**
 ```go
 const (
    SampleRate       = 44100
    WindowMs         = 500
    SamplesPerWindow = SampleRate * WindowMs / 1000   // 22050
    WhisperFloor     = 0.03
 )
 ```
 **Verification:** `grep -r "NumLayers\|GainPerLayer" .` must return zero hits in `*.go` files after deletion. The only non-test reference is in `.planning/research/ARCHITECTURE.md` (planning docs — not compiled).
 ### Pattern 2: Nyquist-Based Frequency Range Validation
 **What:** Replace the hardcoded `[60, 1100]` upper bound in `TestFrequenciesInRange`.
 **Recommended approach (Nyquist-based):** Phase 9 will add classes up to ~4000 Hz. Nyquist at 44100 Hz sample rate is 22050 Hz. A Nyquist check is mathematically correct and never needs updating regardless of how many new classes are added:
 ```go
 func TestFrequenciesInRange(t *testing.T) {
    const nyquist = float64(synth.SampleRate) / 2.0  // 22050 Hz
    for class, cfg := range synth.ClassFreqConfigs {
        if cfg.BaseHz <= 0 {
            t.Errorf("class %q BaseHz=%.1f must be positive", class, cfg.BaseHz)
        }
        if cfg.BaseHz >= nyquist {
            t.Errorf("class %q BaseHz=%.1f exceeds Nyquist (%.1f Hz)", class, cfg.BaseHz, nyquist)
        }
    }
 }
 ```
 **Alternative approach (generous static bound):** A bound of `[20, 8000]` also satisfies D-02's constraint since all planned Phase 9/10 frequencies are under 4000 Hz. However the Nyquist approach is self-documenting — it explains *why* there's an upper bound rather than encoding an arbitrary number. Either is acceptable per Claude's Discretion.
 **Key invariant preserved:** Both approaches ensure adding a new class at any humanly-audible frequency (20 Hz – 20 kHz, well within Nyquist) will NOT require editing this test.
 ### Pattern 3: Test Function Rename
 **What:** Rename `TestNumLayersMatchesAllClasses` at line 61. The test body already tests the correct invariant (`len(synth.ClassFreqConfigs) == len(classify.AllClasses())`); only the name is stale.
 **Current:**
 ```go
 func TestNumLayersMatchesAllClasses(t *testing.T) {
    if len(synth.ClassFreqConfigs) != len(classify.AllClasses()) {
        t.Errorf("ClassFreqConfigs has %d entries but AllClasses() has %d entries",
            len(synth.ClassFreqConfigs), len(classify.AllClasses()))
    }
 }
 ```
 **After rename:**
 ```go
 func TestClassFreqConfigsMatchAllClasses(t *testing.T) {
    if len(synth.ClassFreqConfigs) != len(classify.AllClasses()) {
        t.Errorf("ClassFreqConfigs has %d entries but AllClasses() has %d entries",
            len(synth.ClassFreqConfigs), len(classify.AllClasses()))
    }
 }
 ```
 ### Pattern 4: Consolidation Decision (Claude's Discretion)
 `TestAllClassesHaveConfig` (lines 10-16) and `TestClassFreqConfigsComplete` (lines 53-59) test the same invariant: every class in `AllClasses()` has an entry in `ClassFreqConfigs`. They are exact duplicates in semantics (different error messages but identical logic). The renamed `TestClassFreqConfigsMatchAllClasses` (formerly `TestNumLayersMatchesAllClasses`) tests the converse: lengths match.
 **Recommendation:** Remove `TestClassFreqConfigsComplete` (lines 53-59) as a duplicate of `TestAllClassesHaveConfig`. This leaves three non-overlapping coverage tests:
 - `TestAllClassesHaveConfig` — every AllClasses() member has a map entry
 - `TestClassFreqConfigsMatchAllClasses` — count parity (catches extra entries not in AllClasses)
 - `TestFrequenciesInRange` — all BaseHz values are positive and below Nyquist
 Alternatively, leave both functions if deduplication is not worth the discussion. Both pass and both protect the invariant. This is truly Claude's discretion.
 ### Anti-Patterns to Avoid
 - **Updating `NumLayers` instead of deleting it:** The decision (D-01) is deletion, not update. An updated constant would still be a maintenance burden.
 - **Replacing [60, 1100] with [60, 4000]:** A new hardcoded number has the same fragility as the old one — it becomes stale when the frequency spectrum changes again in a future milestone.
 - **Touching `bank.go`:** The dynamic `gainPerLayer` computation in `bank.go` is already correct. No changes needed.
 - **Touching `classify/types.go`:** `AllClasses()` is not modified in this phase.
 - **Touching `WhisperFloor`:** It does not reference `NumLayers` or `GainPerLayer`; leave it unchanged.
 ---
 ## Don't Hand-Roll
 Not applicable. This phase contains no algorithmic code — it is deletion and test rewriting.
 ---
 ## Common Pitfalls
 ### Pitfall 1: Leaving the `GainPerLayer` comment reference orphaned
 **What goes wrong:** `GainPerLayer` at config.go line 10 has a comment `// D-10: ~0.0714`. After deletion, the decision reference D-10 disappears from the source. This is fine — D-10 is still documented in the planning research files. But if the comment is moved to `bank.go` line 21 (where the dynamic computation lives), it improves traceability without leaving an orphan.
 **How to avoid:** Either delete both lines cleanly with no compensation, or add `// D-10: gain is 1/N computed dynamically` to `bank.go:21`. Both are acceptable.
 **Warning signs:** Go compiler catches unused constants — if `NumLayers` or `GainPerLayer` are deleted and the code still compiles, they were indeed dead.
 ### Pitfall 2: Using `synth.SampleRate` in the test without verifying the export
 **What goes wrong:** `SampleRate` is an exported constant in `synth/config.go`. The test file is in package `synth_test` (external test package), so it accesses `synth.SampleRate`. Verify `SampleRate` is exported (capital S) before referencing it from the test.
 **How to avoid:** Already confirmed — `SampleRate = 44100` is exported at config.go line 6. No issue.
 **Warning signs:** Compiler error `synth.sampleRate undefined` would indicate a lowercase constant.
 ### Pitfall 3: Test duplication confusion
 **What goes wrong:** `TestAllClassesHaveConfig` and `TestClassFreqConfigsComplete` look different but test the same invariant. During code review or future debugging, someone might wonder why there are two tests for the same thing.
 **How to avoid:** If consolidating (removing `TestClassFreqConfigsComplete`), add a comment to `TestAllClassesHaveConfig` noting it replaced the duplicate. If not consolidating, no action needed.
 ---
 ## Code Examples
 ### Resulting `synth/config.go` constant block
 ```go
 // Source: synth/config.go — after Phase 8 cleanup
 const (
    SampleRate       = 44100
    WindowMs         = 500
    SamplesPerWindow = SampleRate * WindowMs / 1000 // 22050
    WhisperFloor     = 0.03                         // D-08/D-09: 3% of max amplitude
 )
 ```
 ### Resulting `TestFrequenciesInRange` (Nyquist approach)
 ```go
 // Source: synth/config_test.go — after Phase 8 cleanup
 func TestFrequenciesInRange(t *testing.T) {
    const nyquist = float64(synth.SampleRate) / 2.0
    for class, cfg := range synth.ClassFreqConfigs {
        if cfg.BaseHz <= 0 {
            t.Errorf("class %q BaseHz=%.1f must be positive", class, cfg.BaseHz)
        }
        if cfg.BaseHz >= nyquist {
            t.Errorf("class %q BaseHz=%.1f exceeds Nyquist (%.1f Hz)", class, cfg.BaseHz, nyquist)
        }
    }
 }
 ```
 ### Resulting `TestClassFreqConfigsMatchAllClasses`
 ```go
 // Source: synth/config_test.go — after rename from TestNumLayersMatchesAllClasses
 func TestClassFreqConfigsMatchAllClasses(t *testing.T) {
    if len(synth.ClassFreqConfigs) != len(classify.AllClasses()) {
        t.Errorf("ClassFreqConfigs has %d entries but AllClasses() has %d entries",
            len(synth.ClassFreqConfigs), len(classify.AllClasses()))
    }
 }
 ```
 ---
 ## State of the Art
 | Old Approach | Current Approach | When Changed | Impact |
 |--------------|------------------|--------------|--------|
 | `NumLayers = 14` static constant | Dynamic `1.0 / float64(len(cfgs))` in `NewBank` | Phase 6/7 (v1.1) | Static constant is now dead code; remove it |
 | `TestFrequenciesInRange` checks `[60, 1100]` | Nyquist-based check (this phase) | Phase 8 (v1.2) | Test survives any future frequency allocation |
 ---
 ## Validation Architecture
 ### Test Framework
 | Property | Value |
 |----------|-------|
 | Framework | `testing` stdlib, Go 1.24 |
 | Config file | none (standard `go test`) |
 | Quick run command | `go test ./synth/...` |
 | Full suite command | `go test ./...` |
 ### Phase Requirements → Test Map
 | Req ID | Behavior | Test Type | Automated Command | File Exists? |
 |--------|----------|-----------|-------------------|-------------|
 | CLEAN-01 (constant removal) | `NumLayers` and `GainPerLayer` are not exported from `synth` package | unit — compile check | `go build ./synth/...` | ✅ (config.go exists; delete lines) |
 | CLEAN-01 (no broken references) | Full test suite passes after deletion | integration | `go test ./...` | ✅ |
 | CLEAN-01 (range test future-proof) | `TestFrequenciesInRange` passes with any BaseHz in (0, Nyquist) range | unit | `go test ./synth/... -run TestFrequenciesInRange` | ✅ (config_test.go exists; update body) |
 | CLEAN-01 (test rename) | `TestClassFreqConfigsMatchAllClasses` exists and passes | unit | `go test ./synth/... -run TestClassFreqConfigsMatchAllClasses` | ✅ (rename existing function) |
 ### Sampling Rate
 - **Per task commit:** `go test ./synth/...`
 - **Per wave merge:** `go test ./...`
 - **Phase gate:** `go test ./...` green before `/gsd:verify-work`
 ### Wave 0 Gaps
 None — existing test infrastructure covers all phase requirements. No new test files, fixtures, or framework setup needed.
 ---
 ## Environment Availability
 Step 2.6: SKIPPED (no external dependencies — pure Go source edits, no new tools or services required).
 Current test suite state confirmed: `go test ./...` passes on all 7 packages.
 ---
 ## Open Questions
 1. **Consolidate `TestAllClassesHaveConfig` and `TestClassFreqConfigsComplete`?**
   - What we know: They test the same invariant; both currently pass; no correctness issue either way
   - What's unclear: Whether the planner wants one clean authoritative test or is fine leaving both
   - Recommendation: Remove `TestClassFreqConfigsComplete` (lines 53-59) as it duplicates `TestAllClassesHaveConfig`. The named `TestAllClassesHaveConfig` is more expressive. If this causes any concern, leave both — both are correct.
 2. **Add D-10 comment to `bank.go` after deleting `GainPerLayer`?**
   - What we know: `GainPerLayer` carries `// D-10: ~0.0714`; bank.go line 21 is where the actual computation lives
   - What's unclear: Whether the project wants decision-reference comments preserved at the implementation site
   - Recommendation: Add `// D-10: gainPerLayer = 1/N so all N layers at full amplitude sum to 1.0` to bank.go line 21. Low-cost, improves traceability.
 ---
 ## Sources
 ### Primary (HIGH confidence)
 - `synth/config.go` — Direct inspection: `NumLayers = 14`, `GainPerLayer = 1.0 / float64(NumLayers)` at lines 9-10; `SampleRate = 44100` at line 6
 - `synth/bank.go` — Direct inspection: `gainPerLayer: 1.0 / float64(len(cfgs))` at line 21 — confirms constants are dead code
 - `synth/config_test.go` — Direct inspection: `TestFrequenciesInRange` body at lines 18-25; `TestNumLayersMatchesAllClasses` at lines 61-66; `TestClassFreqConfigsComplete` at lines 53-59
 - `classify/types.go` — Direct inspection: `AllClasses()` returns 14 entries; `SampleRate = 44100` used for Nyquist calculation
 - `.planning/phases/08-test-and-constant-cleanup/08-CONTEXT.md` — Locked decisions D-01, D-02, D-03
 - `.planning/research/PITFALLS.md` — Pitfall C3 (NumLayers stale constant) and C4 (TestFrequenciesInRange hardcoding)
 - `.planning/research/ARCHITECTURE.md` lines 414-422 — NumLayers/GainPerLayer dead code analysis
 ### Secondary (MEDIUM confidence)
 - `go test ./...` output — All 7 packages pass; current baseline confirmed
 ---
 ## Metadata
 **Confidence breakdown:**
 - Standard stack: HIGH — no new dependencies; pure stdlib
 - Architecture: HIGH — all target lines verified by direct file inspection
 - Pitfalls: HIGH — sourced from project research files and direct code inspection
 **Research date:** 2026-03-27
 **Valid until:** Until Phase 9 begins (frequency redistribution) — this research is tied to current `synth/config.go` line numbers which Phase 9 will change
@@ -0,0 +1,71 @@
 ---
 phase: 8
 slug: test-and-constant-cleanup
 status: draft
 nyquist_compliant: false
 wave_0_complete: false
 created: 2026-03-27
 ---
 # Phase 8 — Validation Strategy
 > Per-phase validation contract for feedback sampling during execution.
 ---
 ## Test Infrastructure
 | Property | Value |
 |----------|-------|
 | **Framework** | go test (stdlib) |
 | **Config file** | none — built-in Go test runner |
 | **Quick run command** | `go test ./synth/...` |
 | **Full suite command** | `go test ./...` |
 | **Estimated runtime** | ~5 seconds |
 ---
 ## Sampling Rate
 - **After every task commit:** Run `go test ./synth/...`
 - **After every plan wave:** Run `go test ./...`
 - **Before `/gsd:verify-work`:** Full suite must be green
 - **Max feedback latency:** 5 seconds
 ---
 ## Per-Task Verification Map
 | Task ID | Plan | Wave | Requirement | Test Type | Automated Command | File Exists | Status |
 |---------|------|------|-------------|-----------|-------------------|-------------|--------|
 | 08-01-01 | 01 | 1 | CLEAN-01 | unit | `go test ./synth/... -run TestFrequenciesInRange` | ✅ | ⬜ pending |
 | 08-01-02 | 01 | 1 | CLEAN-01 | compile | `go build ./synth/...` | ✅ | ⬜ pending |
 | 08-01-03 | 01 | 1 | CLEAN-01 | unit | `go test ./synth/... -run TestClassFreqConfigs` | ✅ | ⬜ pending |
 | 08-01-04 | 01 | 1 | CLEAN-01 | integration | `go test ./...` | ✅ | ⬜ pending |
 *Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*
 ---
 ## Wave 0 Requirements
 *Existing infrastructure covers all phase requirements.*
 ---
 ## Manual-Only Verifications
 *All phase behaviors have automated verification.*
 ---
 ## Validation Sign-Off
 - [ ] All tasks have `<automated>` verify or Wave 0 dependencies
 - [ ] Sampling continuity: no 3 consecutive tasks without automated verify
 - [ ] Wave 0 covers all MISSING references
 - [ ] No watch-mode flags
 - [ ] Feedback latency < 5s
 - [ ] `nyquist_compliant: true` set in frontmatter
 **Approval:** pending
@@ -0,0 +1,91 @@
 ---
 phase: 08-test-and-constant-cleanup
 verified: 2026-03-27T10:00:00Z
 status: passed
 score: 4/4 must-haves verified
 re_verification: false
 ---
 # Phase 8: Test and Constant Cleanup Verification Report
 **Phase Goal:** Pre-existing test assertions and a stale exported constant that would block or mislead all subsequent v1.2 work are removed
 **Verified:** 2026-03-27
 **Status:** passed
 **Re-verification:** No — initial verification
 ## Goal Achievement
 ### Observable Truths
 | # | Truth | Status | Evidence |
 |---|-------|--------|----------|
 | 1 | NumLayers and GainPerLayer constants do not exist in the synth package | VERIFIED | `grep -n "NumLayers\|GainPerLayer" synth/config.go synth/bank.go synth/config_test.go` returns zero matches (exit 1 = no matches) |
 | 2 | `go test ./...` passes with zero failures after all edits | VERIFIED | All 7 packages green: aggregate, capture, classify, cmd/netsynth, config, encode, synth |
 | 3 | TestFrequenciesInRange accepts any BaseHz in (0, Nyquist) without manual test surgery | VERIFIED | `const nyquist = float64(synth.SampleRate) / 2.0` at line 19; hardcoded `1100` bound absent (grep returns exit 1); test passes |
 | 4 | TestNumLayersMatchesAllClasses is renamed to TestClassFreqConfigsMatchAllClasses | VERIFIED | `TestClassFreqConfigsMatchAllClasses` present at line 56; `TestNumLayersMatchesAllClasses` absent; `TestClassFreqConfigsComplete` absent |
 **Score:** 4/4 truths verified
 ### Required Artifacts
 | Artifact | Expected | Status | Details |
 |----------|----------|--------|---------|
 | `synth/config.go` | Cleaned constant block without NumLayers or GainPerLayer; contains WhisperFloor | VERIFIED | Constant block contains SampleRate, WindowMs, SamplesPerWindow, WhisperFloor only (lines 5-10). NumLayers and GainPerLayer absent. |
 | `synth/config_test.go` | Future-proof test assertions; contains TestClassFreqConfigsMatchAllClasses | VERIFIED | Nyquist-based validation in TestFrequenciesInRange (line 19). TestClassFreqConfigsMatchAllClasses present (line 56). TestClassFreqConfigsComplete absent. |
 ### Key Link Verification
 | From | To | Via | Status | Details |
 |------|----|-----|--------|---------|
 | `synth/bank.go` | `synth/config.go` | gainPerLayer computed dynamically in NewBank — no static constant conflicts | VERIFIED | `gainPerLayer: 1.0 / float64(len(cfgs))` at line 21 of bank.go; no reference to the deleted NumLayers constant anywhere in synth package |
 | `synth/config_test.go` | `synth/config.go` | TestFrequenciesInRange validates BaseHz against SampleRate-derived Nyquist | VERIFIED | `float64(synth.SampleRate) / 2.0` at line 19 of config_test.go; test runs and passes |
 ### Data-Flow Trace (Level 4)
 Not applicable. This phase modifies a constants file and test file only — no dynamic data rendering involved.
 ### Behavioral Spot-Checks
 | Behavior | Command | Result | Status |
 |----------|---------|--------|--------|
 | TestFrequenciesInRange passes | `go test ./synth/... -run TestFrequenciesInRange -count=1` | PASS | VERIFIED |
 | TestClassFreqConfigsMatchAllClasses passes | `go test ./synth/... -run TestClassFreqConfigsMatchAllClasses -count=1` | PASS | VERIFIED |
 | Full suite green | `go test ./...` | All 7 packages ok | VERIFIED |
 | Both task commits exist | `git show --stat fd17061 4800e8e` | Both commits present with correct file changes | VERIFIED |
 ### Requirements Coverage
 | Requirement | Source Plan | Description | Status | Evidence |
 |-------------|------------|-------------|--------|----------|
 | CLEAN-01 | 08-01-PLAN.md | Remove stale NumLayers constant and hardcoded frequency range test assertions that would block new class additions | SATISFIED | NumLayers and GainPerLayer deleted from synth/config.go (commit fd17061); hardcoded 1100 Hz bound replaced with Nyquist-based validation in config_test.go (commit 4800e8e) |
 **Orphaned requirements check:** REQUIREMENTS.md maps only CLEAN-01 to Phase 8. The plan declares CLEAN-01. No orphaned requirements.
 ### Anti-Patterns Found
 | File | Line | Pattern | Severity | Impact |
 |------|------|---------|----------|--------|
 | — | — | None found | — | — |
 No TODOs, FIXMEs, placeholders, empty returns, or stub indicators in the modified files.
 ### Human Verification Required
 None. All phase deliverables are code-verifiable (constant deletion and test assertions checked programmatically).
 ### Gaps Summary
 No gaps. All four must-have truths are verified against the actual codebase:
 - `synth/config.go` constant block contains exactly SampleRate, WindowMs, SamplesPerWindow, and WhisperFloor — the two stale constants are gone.
 - `synth/config_test.go` uses Nyquist-derived bounds (22050 Hz) with no hardcoded 1100 Hz upper limit — adding a new class at any frequency up to 22050 Hz requires no test edits.
 - The old `TestNumLayersMatchesAllClasses` name is gone; `TestClassFreqConfigsMatchAllClasses` replaced it with identical body.
 - The duplicate `TestClassFreqConfigsComplete` is removed.
 - All 7 packages pass `go test ./...` with zero failures.
 The phase goal is fully achieved: no stale constants or hardcoded test bounds remain to block v1.2 work.
 ---
 _Verified: 2026-03-27_
 _Verifier: Claude (gsd-verifier)_
@@ -0,0 +1,364 @@
 ---
 phase: 09-frequency-design-and-group-architecture
 plan: 01
 type: execute
 wave: 1
 depends_on: []
 files_modified:
  - synth/config.go
  - synth/config_test.go
 autonomous: true
 requirements:
  - FREQ-01
  - FREQ-02
  - FREQ-03
  - GRP-01
  - GRP-04
 must_haves:
  truths:
    - "FreqConfig struct has a Group string field"
    - "All 14 existing ClassFreqConfigs entries have non-empty Group values"
    - "All existing classes are redistributed to new Hz values per the major-second ladder (65-1375 Hz range)"
    - "Within-family adjacent pairs satisfy at least a major second interval (ratio >= 1.122)"
    - "Non-Unknown family entries use WaveformPresetHarmonics instead of hand-tuned slices"
    - "Unknown family entries retain hand-tuned dissonant harmonics {1,1.0},{2,0.8},{3,0.4}"
    - "go test ./synth/... passes with all tests green"
  artifacts:
    - path: "synth/config.go"
      provides: "FreqConfig with Group field, rebalanced ClassFreqConfigs map"
      contains: "Group        string"
    - path: "synth/config_test.go"
      provides: "TestGroupFieldPopulated, updated TestHarmonicsNonEmpty"
      contains: "TestGroupFieldPopulated"
  key_links:
    - from: "synth/config.go"
      to: "classify/types.go"
      via: "ClassFreqConfigs map keys reference classify.TrafficClass constants"
      pattern: "classify\\.Class"
 ---
 <objective>
 Add Group field to FreqConfig and rebalance all 14 existing ClassFreqConfigs entries to the new major-second frequency ladder with family-band organization, waveform-per-family assignments, and Group string values.
 Purpose: Lock the frequency design and group architecture so Phase 10 can add new TrafficClass constants that slot directly into the designed frequency bands. Per D-01, this is a full rebalance -- existing v1.0/v1.1 Hz values are NOT frozen.
 Output: Updated synth/config.go with Group field and rebalanced map, updated synth/config_test.go with new/fixed tests.
 </objective>
 <execution_context>
@$HOME/.claude/get-shit-done/workflows/execute-plan.md
@$HOME/.claude/get-shit-done/templates/summary.md
 </execution_context>
 <context>
@.planning/PROJECT.md
@.planning/ROADMAP.md
@.planning/STATE.md
@.planning/phases/09-frequency-design-and-group-architecture/09-CONTEXT.md
@.planning/phases/09-frequency-design-and-group-architecture/09-RESEARCH.md
 <interfaces>
 <!-- From synth/config.go — current FreqConfig struct (line 66-71) -->
 ```go
 type FreqConfig struct {
    BaseHz       float64
    Harmonics    []HarmonicDef
    Pan          float64
    WaveformType WaveformType
 }
 ```
 <!-- From synth/config.go — WaveformType constants (line 14-22) -->
 ```go
 const (
    WaveformCustom   WaveformType = iota
    WaveformSine
    WaveformSquare
    WaveformSawtooth
    WaveformTriangle
 )
 ```
 <!-- From synth/config.go — WaveformPresetHarmonics signature (line 27) -->
 ```go
 func WaveformPresetHarmonics(wt WaveformType, baseHz float64, sampleRate int) []HarmonicDef
 ```
 <!-- From classify/types.go — existing TrafficClass constants used as map keys -->
 ```
 ClassICMP, ClassDNS, ClassHTTPS, ClassHTTP, ClassSSH, ClassSMTP,
 ClassNTP, ClassDHCP, ClassOtherTCP, ClassOtherUDP,
 ClassUnknown1, ClassUnknown2, ClassUnknown3, ClassUnknown4
 ```
 </interfaces>
 </context>
 <tasks>
 <task type="auto">
  <name>Task 1: Add Group field to FreqConfig and rebalance ClassFreqConfigs</name>
  <files>synth/config.go</files>
  <read_first>
    - synth/config.go (current FreqConfig struct at line 66, ClassFreqConfigs map at line 76)
    - .planning/phases/09-frequency-design-and-group-architecture/09-RESEARCH.md (full allocation table, code examples)
  </read_first>
  <action>
 1. Add `Group string` field to the `FreqConfig` struct after the `WaveformType` field:
 ```go
 type FreqConfig struct {
    BaseHz       float64
    Harmonics    []HarmonicDef
    Pan          float64
    WaveformType WaveformType
    Group        string // sound family: "Infrastructure", "Web", "Mail", etc.
 }
 ```
 2. Add a frequency allocation table comment block above ClassFreqConfigs documenting all 32 designed slots (per FREQ-03). This is the authoritative design reference. The comment should list:
 ```
 // Frequency Allocation Table (Phase 9 design — major-second ladder, 65-2449 Hz)
 //
 // Slot  Hz    Class       Group            Waveform   Pan
 // 0     65    ICMP        Infrastructure   Triangle   -0.3
 // 1     73    NTP         Infrastructure   Triangle   -0.1
 // 2     82    DHCP        Infrastructure   Triangle    0.1
 // 3     93    mDNS        Infrastructure   Triangle    0.3    (Phase 10)
 // 4     105   SSDP        Infrastructure   Triangle   -0.2    (Phase 10)
 // 5     118   SNMP        Infrastructure   Triangle    0.2    (Phase 10)
 // 6     133   DNS         Infrastructure   Triangle    0.0
 // 7     150   HTTPS       Web              Sawtooth   -0.4
 // 8     169   HTTP        Web              Sawtooth   -0.3
 // 9     190   HTTP3       Web              Sawtooth   -0.2    (Phase 10)
 // 10    214   SMTP        Mail             Triangle    0.2
 // 11    241   IMAP        Mail             Triangle    0.3    (Phase 10)
 // 12    271   POP3        Mail             Triangle    0.4    (Phase 10)
 // 13    305   SMTP-sub    Mail             Triangle    0.5    (Phase 10)
 // 14    343   SSH         Remote Access    Square     -0.7
 // 15    385   RDP         Remote Access    Square     -0.6    (Phase 10)
 // 16    432   Telnet      Remote Access    Square     -0.5    (Phase 10)
 // 17    485   VNC         Remote Access    Square     -0.4    (Phase 10)
 // 18    545   FTP         File Transfer    Square      0.5    (Phase 10)
 // 19    612   SMB         File Transfer    Square      0.6    (Phase 10)
 // 20    687   TFTP        File Transfer    Square      0.7    (Phase 10)
 // 21    771   unknown-1   Unknown          Custom     -0.9
 // 22    866   unknown-2   Unknown          Custom      0.9
 // 23    972   unknown-3   Unknown          Custom     -0.7
 // 24    1091  unknown-4   Unknown          Custom      0.7
 // 25    1225  other-TCP   Unknown          Custom     -0.5
 // 26    1375  other-UDP   Unknown          Custom      0.5
 // 27    1543  MySQL       Database         Sawtooth   -0.4    (Phase 10)
 // 28    1732  PostgreSQL  Database         Sawtooth   -0.2    (Phase 10)
 // 29    1944  Redis       Database         Sawtooth    0.2    (Phase 10)
 // 30    2182  MongoDB     Database         Sawtooth    0.4    (Phase 10)
 // 31    2449  SIP         VoIP             Sine        0.0    (Phase 10)
 //
 // Auto-assign range: [2500, 4000] Hz (see config/config.go)
 ```
 3. Replace the entire `ClassFreqConfigs` map literal with the rebalanced entries for the 14 existing classes. Use `WaveformPresetHarmonics` for non-Unknown entries (per D-08/D-09). Unknown entries retain hand-tuned harmonics.
 Exact entries (all 14):
 ```go
 var ClassFreqConfigs = map[classify.TrafficClass]FreqConfig{
    // --- Infrastructure (Triangle, 65-133 Hz) ---
    classify.ClassICMP: {
        BaseHz:       65.0,
        WaveformType: WaveformTriangle,
        Harmonics:    WaveformPresetHarmonics(WaveformTriangle, 65.0, SampleRate),
        Pan:          -0.3,
        Group:        "Infrastructure",
    },
    classify.ClassNTP: {
        BaseHz:       73.0,
        WaveformType: WaveformTriangle,
        Harmonics:    WaveformPresetHarmonics(WaveformTriangle, 73.0, SampleRate),
        Pan:          -0.1,
        Group:        "Infrastructure",
    },
    classify.ClassDHCP: {
        BaseHz:       82.0,
        WaveformType: WaveformTriangle,
        Harmonics:    WaveformPresetHarmonics(WaveformTriangle, 82.0, SampleRate),
        Pan:          0.1,
        Group:        "Infrastructure",
    },
    classify.ClassDNS: {
        BaseHz:       133.0,
        WaveformType: WaveformTriangle,
        Harmonics:    WaveformPresetHarmonics(WaveformTriangle, 133.0, SampleRate),
        Pan:          0.0,
        Group:        "Infrastructure",
    },
    // --- Web (Sawtooth, 150-190 Hz) ---
    classify.ClassHTTPS: {
        BaseHz:       150.0,
        WaveformType: WaveformSawtooth,
        Harmonics:    WaveformPresetHarmonics(WaveformSawtooth, 150.0, SampleRate),
        Pan:          -0.4,
        Group:        "Web",
    },
    classify.ClassHTTP: {
        BaseHz:       169.0,
        WaveformType: WaveformSawtooth,
        Harmonics:    WaveformPresetHarmonics(WaveformSawtooth, 169.0, SampleRate),
        Pan:          -0.3,
        Group:        "Web",
    },
    // --- Mail (Triangle, 214 Hz) ---
    classify.ClassSMTP: {
        BaseHz:       214.0,
        WaveformType: WaveformTriangle,
        Harmonics:    WaveformPresetHarmonics(WaveformTriangle, 214.0, SampleRate),
        Pan:          0.2,
        Group:        "Mail",
    },
    // --- Remote Access (Square, 343 Hz) ---
    classify.ClassSSH: {
        BaseHz:       343.0,
        WaveformType: WaveformSquare,
        Harmonics:    WaveformPresetHarmonics(WaveformSquare, 343.0, SampleRate),
        Pan:          -0.7,
        Group:        "Remote Access",
    },
    // --- Unknown (Custom harmonics, 771-1375 Hz) ---
    classify.ClassUnknown1: {
        BaseHz:    771.0,
        Harmonics: []HarmonicDef{{1, 1.0}, {2, 0.8}, {3, 0.4}},
        Pan:       -0.9,
        Group:     "Unknown",
    },
    classify.ClassUnknown2: {
        BaseHz:    866.0,
        Harmonics: []HarmonicDef{{1, 1.0}, {2, 0.8}, {3, 0.4}},
        Pan:       0.9,
        Group:     "Unknown",
    },
    classify.ClassUnknown3: {
        BaseHz:    972.0,
        Harmonics: []HarmonicDef{{1, 1.0}, {2, 0.8}, {3, 0.4}},
        Pan:       -0.7,
        Group:     "Unknown",
    },
    classify.ClassUnknown4: {
        BaseHz:    1091.0,
        Harmonics: []HarmonicDef{{1, 1.0}, {2, 0.8}, {3, 0.4}},
        Pan:       0.7,
        Group:     "Unknown",
    },
    classify.ClassOtherTCP: {
        BaseHz:    1225.0,
        Harmonics: []HarmonicDef{{1, 1.0}, {2, 0.8}, {3, 0.4}},
        Pan:       -0.5,
        Group:     "Unknown",
    },
    classify.ClassOtherUDP: {
        BaseHz:    1375.0,
        Harmonics: []HarmonicDef{{1, 1.0}, {2, 0.8}, {3, 0.4}},
        Pan:       0.5,
        Group:     "Unknown",
    },
 }
 ```
 IMPORTANT: Unknown family entries (ClassUnknown1-4, ClassOtherTCP, ClassOtherUDP) must NOT set WaveformType — leave it as zero value (WaveformCustom) so bank.go uses the stored Harmonics. Do NOT call WaveformPresetHarmonics for these entries.
 IMPORTANT: Do NOT remove the old `// Frequencies use musical intervals...` comment — replace it with the new allocation table comment.
  </action>
  <verify>
    <automated>cd /home/dev/workspace/yoloyolo && go build ./synth/...</automated>
  </verify>
  <acceptance_criteria>
    - synth/config.go contains `Group        string` inside the FreqConfig struct
    - synth/config.go contains `Group:        "Infrastructure"` (at least 4 entries)
    - synth/config.go contains `Group:        "Web"` (at least 2 entries)
    - synth/config.go contains `Group:        "Mail"` (at least 1 entry)
    - synth/config.go contains `Group:        "Remote Access"` (at least 1 entry)
    - synth/config.go contains `Group:     "Unknown"` (at least 6 entries)
    - synth/config.go contains `BaseHz:       65.0` for ClassICMP
    - synth/config.go contains `BaseHz:       133.0` for ClassDNS
    - synth/config.go contains `BaseHz:       150.0` for ClassHTTPS
    - synth/config.go contains `BaseHz:       343.0` for ClassSSH
    - synth/config.go contains `WaveformPresetHarmonics(WaveformTriangle` for Infrastructure entries
    - synth/config.go contains `WaveformPresetHarmonics(WaveformSawtooth` for Web entries
    - synth/config.go contains `WaveformPresetHarmonics(WaveformSquare` for SSH entry
    - synth/config.go contains `// Frequency Allocation Table` comment block
    - Unknown entries do NOT contain `WaveformPresetHarmonics` — they use literal `[]HarmonicDef{{1, 1.0}, {2, 0.8}, {3, 0.4}}`
    - `go build ./synth/...` exits 0
  </acceptance_criteria>
  <done>FreqConfig has Group field, all 14 ClassFreqConfigs entries have correct Hz/waveform/group per allocation table, code compiles</done>
 </task>
 <task type="auto">
  <name>Task 2: Update synth tests — add TestGroupFieldPopulated, fix TestHarmonicsNonEmpty</name>
  <files>synth/config_test.go</files>
  <read_first>
    - synth/config_test.go (current test file — TestHarmonicsNonEmpty at line 40 checks len >= 2)
    - synth/config.go (the updated file from Task 1 — verify Group field exists)
  </read_first>
  <action>
 1. Add `TestGroupFieldPopulated` test function after the existing tests. This test iterates all ClassFreqConfigs entries and fails if any have an empty Group string:
 ```go
 func TestGroupFieldPopulated(t *testing.T) {
    for class, cfg := range synth.ClassFreqConfigs {
        if cfg.Group == "" {
            t.Errorf("class %q has empty Group field in ClassFreqConfigs", class)
        }
    }
 }
 ```
 2. Update `TestHarmonicsNonEmpty` to accept single-harmonic entries. Change the threshold from `< 2` to `< 1`. This is needed because WaveformSine (used by SIP in Phase 10) returns only 1 harmonic. The current 8 non-Unknown entries all use Triangle/Sawtooth/Square which return multiple harmonics, so this change is safe now and future-proofs for Phase 10.
 Change line 42 from:
 ```go
 if len(cfg.Harmonics) < 2 {
    t.Errorf("class %q has fewer than 2 harmonics (got %d)", class, len(cfg.Harmonics))
 ```
 To:
 ```go
 if len(cfg.Harmonics) < 1 {
    t.Errorf("class %q has no harmonics (got %d)", class, len(cfg.Harmonics))
 ```
 This addresses Research Open Question 2: pure sine (1 harmonic) is valid, not a bug.
  </action>
  <verify>
    <automated>cd /home/dev/workspace/yoloyolo && go test ./synth/... -v -count=1</automated>
  </verify>
  <acceptance_criteria>
    - synth/config_test.go contains `func TestGroupFieldPopulated(t *testing.T)`
    - synth/config_test.go contains `cfg.Group == ""`
    - synth/config_test.go contains `len(cfg.Harmonics) < 1` (NOT `< 2`)
    - `go test ./synth/... -run TestGroupFieldPopulated` exits 0
    - `go test ./synth/... -run TestHarmonicsNonEmpty` exits 0
    - `go test ./synth/...` exits 0 (all tests pass)
  </acceptance_criteria>
  <done>TestGroupFieldPopulated catches missing Group values; TestHarmonicsNonEmpty accepts single-harmonic (sine) entries; all synth tests pass</done>
 </task>
 </tasks>
 <verification>
 - `go build ./synth/...` compiles without errors
 - `go test ./synth/... -v` passes all tests including new TestGroupFieldPopulated
 - `grep -c 'Group:' synth/config.go` returns 14 (one per ClassFreqConfigs entry)
 - `grep 'Group        string' synth/config.go` confirms struct field exists
 </verification>
 <success_criteria>
 - FreqConfig struct has Group string field (GRP-04)
 - All 14 existing ClassFreqConfigs entries have Group values matching their family (GRP-01)
 - Frequency allocation table comment documents all 32 designed slots (FREQ-03)
 - All existing classes redistributed to major-second ladder Hz values (FREQ-01)
 - Within-family spacing satisfies >= 1.122 ratio (FREQ-02)
 - All synth tests pass including new TestGroupFieldPopulated
 </success_criteria>
 <output>
 After completion, create `.planning/phases/09-frequency-design-and-group-architecture/09-01-SUMMARY.md`
 </output>
@@ -0,0 +1,120 @@
 ---
 phase: 09-frequency-design-and-group-architecture
 plan: "01"
 subsystem: synth
 tags: [frequency-design, group-architecture, config, oscillator-fix]
 dependency_graph:
  requires: [08-01]
  provides: [FreqConfig.Group, rebalanced-ClassFreqConfigs, oscillator-normalization-fix]
  affects: [synth, config, bank_test, config_test]
 tech_stack:
  added: []
  patterns:
    - "Major-second ladder Hz allocation for family-band frequency design"
    - "math.Abs normalization for alternating-sign harmonic series in additive oscillator"
 key_files:
  created: []
  modified:
    - synth/config.go
    - synth/config_test.go
    - synth/oscillator.go
    - synth/bank_test.go
    - config/config_test.go
 decisions:
  - "Group field added to FreqConfig as a string (not enum) — extensible for Phase 10 new family names without code changes"
  - "Within-family spacing satisfies major second (1.122 ratio): 65->73 = 1.123, 73->82 = 1.123, 82->133 = 1.622 (Infrastructure skips slots reserved for Phase 10), 150->169 = 1.127 (Web), 771->866 = 1.123 (Unknown)"
  - "Oscillator normalization fixed to use math.Abs — alternating-sign harmonics (triangle wave) were causing output to exceed [-1,1] bounds when using WaveformPresetHarmonics"
 metrics:
  duration: "6m 30s"
  completed: "2026-03-27"
  tasks_completed: 2
  files_modified: 5
 ---
 # Phase 9 Plan 1: Frequency Design and Group Architecture Summary
 FreqConfig gains a Group string field; all 14 ClassFreqConfigs entries rebalanced to major-second ladder in family frequency bands (65-1375 Hz), with family-specific waveforms. Oscillator normalization bug fixed for alternating-sign harmonic series.
 ## What Was Built
 ### Task 1: Add Group field to FreqConfig and rebalance ClassFreqConfigs
 `synth/config.go` was updated with:
 1. `Group string` field added to `FreqConfig` struct after `WaveformType`
 2. Frequency allocation table comment block documenting all 32 designed slots (Phase 9 + Phase 10 placeholders)
 3. Stale `NumLayers` and `GainPerLayer` constants removed (Phase 8 cleanup carried forward)
 4. All 14 `ClassFreqConfigs` entries rebalanced to the major-second ladder:
   - Infrastructure (Triangle, 65-133 Hz): ICMP=65, NTP=73, DHCP=82, DNS=133
   - Web (Sawtooth, 150-169 Hz): HTTPS=150, HTTP=169
   - Mail (Triangle, 214 Hz): SMTP=214
   - Remote Access (Square, 343 Hz): SSH=343
   - Unknown (Custom harmonics, 771-1375 Hz): Unknown1=771, Unknown2=866, Unknown3=972, Unknown4=1091, OtherTCP=1225, OtherUDP=1375
 Non-Unknown entries use `WaveformPresetHarmonics`; Unknown entries retain hand-tuned `{1,1.0},{2,0.8},{3,0.4}` with `WaveformType` left as zero value (`WaveformCustom`) so `bank.go` uses stored harmonics directly.
 ### Task 2: Update synth tests and fix oscillator normalization bug
 `synth/config_test.go`:
 - `TestGroupFieldPopulated` added: iterates all ClassFreqConfigs entries, fails if any have empty Group
 - `TestHarmonicsNonEmpty` threshold changed from `< 2` to `< 1` (accepts single-harmonic sine entries for Phase 10 SIP)
 **Auto-fix (Rule 1 - Bug): Oscillator normalization for alternating-sign harmonics**
 Found during Task 2 verification: `TestNewBankCustomConfigNoClip` was failing with `L=-1.023`. Root cause: `oscillator.go` `Advance()` accumulated `totalWeight += h.Amplitude` (signed sum), but `WaveformPresetHarmonics(WaveformTriangle, ...)` produces alternating-sign amplitudes. The signed sum (~0.916 for 65 Hz triangle with 170 harmonics) is much smaller than the absolute sum (~1.232), causing the normalization denominator to be deflated, which inflated output amplitude beyond [-1, 1].
 Fix: changed to `totalWeight += math.Abs(h.Amplitude)` in `oscillator.go`. The old config used positive-only amplitudes `{k, 1/k}` so the bug was latent. The new `WaveformPresetHarmonics(WaveformTriangle, ...)` exposed it.
 **Test updates (Rule 1 - Bug):**
 - `synth/bank_test.go`: `TestStereoPan` updated from ClassDHCP (new pan=0.1, right-biased) to ClassSSH (pan=-0.7, wide-left); `TestNewBankCustomConfigNoClip` passes after oscillator fix
 - `config/config_test.go`: `TestLoadPartialOverrideFrequency` changed from hardcoded `WaveformCustom` to `synth.ClassFreqConfigs[classify.ClassICMP].WaveformType` (ICMP is now WaveformTriangle); `TestAutoFreqSkipsBuiltins` changed from hardcoded 175.0 to `synth.ClassFreqConfigs[classify.ClassHTTPS].BaseHz` (now 150.0)
 ## Verification Results
 ```
 go build ./synth/...                     → exit 0
 go test ./synth/... -v -count=1          → 42 tests PASS
 go test ./...                            → all 7 packages PASS
 grep -c 'Group:' synth/config.go         → 14
 grep 'Group        string' synth/config.go → FOUND
 grep -c 'BaseHz:       65.0' synth/config.go  → ICMP confirmed
 grep '// Frequency Allocation Table' synth/config.go → FOUND
 ```
 ## Deviations from Plan
 ### Auto-fixed Issues
 **1. [Rule 1 - Bug] Fixed oscillator normalization for alternating-sign harmonic amplitudes**
 - **Found during:** Task 2 verification (`go test ./synth/...`)
 - **Issue:** `oscillator.Advance()` used `totalWeight += h.Amplitude` (signed sum). Triangle wave harmonics from `WaveformPresetHarmonics` alternate signs (1, -1/9, 1/25, -1/49...), making signed total ~0.916 vs absolute total ~1.232. This caused 34% undercount, so output exceeded [-1, 1] bounds.
 - **Fix:** Changed to `totalWeight += math.Abs(h.Amplitude)` in `synth/oscillator.go`
 - **Files modified:** `synth/oscillator.go`, `synth/bank_test.go`, `config/config_test.go`
 - **Commit:** c97682d
 **2. [Rule 1 - Bug] Updated TestStereoPan for new ClassDHCP pan value**
 - **Found during:** Task 2 verification
 - **Issue:** TestStereoPan expected ClassDHCP to be left-panned (old pan=-0.75) but new config has pan=0.1 (right-biased)
 - **Fix:** Changed test to use ClassSSH (pan=-0.7, clearly left-biased in new config)
 - **Files modified:** `synth/bank_test.go`
 - **Commit:** c97682d
 **3. [Rule 1 - Bug] Updated config_test.go for new default values**
 - **Found during:** Task 2 running `go test ./...`
 - **Issue:** Two config tests had hardcoded values from old defaults (ICMP WaveformCustom, HTTPS BaseHz=175.0)
 - **Fix:** Changed assertions to derive expected values from `synth.ClassFreqConfigs` defaults
 - **Files modified:** `config/config_test.go`
 - **Commit:** c97682d
 ## Known Stubs
 None. All 14 ClassFreqConfigs entries have populated Group, Hz, waveform, and harmonics. Phase 10 slot placeholders are documented in comments only.
 ## Self-Check: PASSED
 - synth/config.go: FOUND
 - synth/config_test.go: FOUND
 - synth/oscillator.go: FOUND
 - 09-01-SUMMARY.md: FOUND
 - Commit 812f0de: FOUND (feat: Group field + rebalanced ClassFreqConfigs)
 - Commit c97682d: FOUND (fix: TestGroupFieldPopulated + oscillator normalization + test updates)
@@ -0,0 +1,206 @@
 ---
 phase: 09-frequency-design-and-group-architecture
 plan: 02
 type: execute
 wave: 1
 depends_on: []
 files_modified:
  - config/config.go
  - config/config_test.go
 autonomous: true
 requirements:
  - FREQ-04
 must_haves:
  truths:
    - "autoAssignFreq returns Hz values in [2500, 4000] range, not the old [1200, 2350]"
    - "Auto-assigned classes cannot collide with any built-in frequency (max built-in is 2449 Hz, auto-assign starts at 2500 Hz)"
    - "TestAutoFreqAssignment passes with the new range bounds"
    - "addAutoFreqEntries produces FreqConfig with empty Group (zero value) for user-defined classes"
  artifacts:
    - path: "config/config.go"
      provides: "Updated autoAssignFreq constants"
      contains: "baseHz   = 2500.0"
    - path: "config/config_test.go"
      provides: "Updated range assertion"
      contains: "cfg.BaseHz < 2500.0 || cfg.BaseHz > 4000.0"
  key_links:
    - from: "config/config.go"
      to: "synth/config.go"
      via: "addAutoFreqEntries creates synth.FreqConfig entries"
      pattern: "synth\\.FreqConfig"
 ---
 <objective>
 Update the auto-assign frequency range from [1200, 2350] to [2500, 4000] Hz so custom user-defined classes cannot collide with any built-in frequency. Update the corresponding test assertion.
 Purpose: Per D-04, the auto-assign range must be pushed above all built-in frequencies (max 2449 Hz) to prevent collision. The 51 Hz buffer between 2449 and 2500 guarantees no overlap.
 Output: Updated config/config.go constants, updated config/config_test.go assertion.
 </objective>
 <execution_context>
@$HOME/.claude/get-shit-done/workflows/execute-plan.md
@$HOME/.claude/get-shit-done/templates/summary.md
 </execution_context>
 <context>
@.planning/PROJECT.md
@.planning/ROADMAP.md
@.planning/STATE.md
@.planning/phases/09-frequency-design-and-group-architecture/09-CONTEXT.md
@.planning/phases/09-frequency-design-and-group-architecture/09-RESEARCH.md
 <interfaces>
 <!-- From config/config.go — current autoAssignFreq function (lines 208-219) -->
 ```go
 func autoAssignFreq(className string) float64 {
    h := fnv.New32a()
    h.Write([]byte(className))
    const (
        baseHz   = 1200.0
        stepHz   = 50.0
        numSteps = uint32(24)
    )
    return baseHz + float64(h.Sum32()%numSteps)*stepHz
 }
 ```
 <!-- From config/config.go — addAutoFreqEntries (lines 225-238) -->
 ```go
 func addAutoFreqEntries(cfgs map[classify.TrafficClass]synth.FreqConfig, userRules []classify.Rule, autoClasses map[classify.TrafficClass]bool) {
    for _, rule := range userRules {
        if _, exists := cfgs[rule.Class]; !exists {
            baseHz := autoAssignFreq(string(rule.Class))
            cfgs[rule.Class] = synth.FreqConfig{
                BaseHz:       baseHz,
                WaveformType: synth.WaveformSine,
                Harmonics:    synth.WaveformPresetHarmonics(synth.WaveformSine, baseHz, synth.SampleRate),
                Pan:          0.0,
            }
            autoClasses[rule.Class] = true
        }
    }
 }
 ```
 <!-- From config/config_test.go — current range assertion (line 363) -->
 ```go
 if cfg.BaseHz < 1200.0 || cfg.BaseHz > 2350.0 {
    t.Errorf("GameServer BaseHz: got %v, want in [1200, 2350]", cfg.BaseHz)
 }
 ```
 </interfaces>
 </context>
 <tasks>
 <task type="auto">
  <name>Task 1: Update autoAssignFreq constants and comment</name>
  <files>config/config.go</files>
  <read_first>
    - config/config.go (lines 208-238: autoAssignFreq function and addAutoFreqEntries)
  </read_first>
  <action>
 1. In the `autoAssignFreq` function (line 208-219), update three things:
   a. Change the function comment from `[1200, 2350]` to `[2500, 4000]`:
   ```go
   // autoAssignFreq computes a deterministic frequency in [2500, 4000] Hz for a class name
   ```
   b. Change the constants inside the function:
   ```go
   const (
       baseHz   = 2500.0
       stepHz   = 50.0
       numSteps = uint32(31) // [2500, 4000] Hz in 50 Hz steps
   )
   ```
   Verification: `2500.0 + float64(30)*50.0 = 4000.0`. With numSteps=31, the modulo produces values 0..30, yielding Hz values 2500, 2550, ..., 4000.
 2. Do NOT modify `addAutoFreqEntries`. The Group field will be zero-value `""` for auto-assigned entries, which is correct — user-defined classes are not part of any built-in family. The struct literal in addAutoFreqEntries does not need a `Group:` field because Go zero-initializes missing named fields.
  </action>
  <verify>
    <automated>cd /home/dev/workspace/yoloyolo && go build ./config/...</automated>
  </verify>
  <acceptance_criteria>
    - config/config.go contains `baseHz   = 2500.0` (NOT 1200.0)
    - config/config.go contains `numSteps = uint32(31)` (NOT 24)
    - config/config.go contains `// autoAssignFreq computes a deterministic frequency in [2500, 4000] Hz`
    - config/config.go still contains `stepHz   = 50.0` (unchanged)
    - `go build ./config/...` exits 0
  </acceptance_criteria>
  <done>autoAssignFreq produces frequencies in [2500, 4000] Hz range with 31 steps of 50 Hz</done>
 </task>
 <task type="auto">
  <name>Task 2: Update config_test.go auto-assign range assertion</name>
  <files>config/config_test.go</files>
  <read_first>
    - config/config_test.go (search for `1200.0` and `2350.0` — the TestAutoFreqAssignment assertion around line 363)
  </read_first>
  <action>
 1. In `TestAutoFreqAssignment` (around line 363), update the range assertion:
   Change from:
   ```go
   if cfg.BaseHz < 1200.0 || cfg.BaseHz > 2350.0 {
       t.Errorf("GameServer BaseHz: got %v, want in [1200, 2350]", cfg.BaseHz)
   }
   ```
   To:
   ```go
   if cfg.BaseHz < 2500.0 || cfg.BaseHz > 4000.0 {
       t.Errorf("GameServer BaseHz: got %v, want in [2500, 4000]", cfg.BaseHz)
   }
   ```
 2. Also update the test comment at the top of TestAutoFreqAssignment (around line 344-346) from:
   ```
   // NO [sounds.GameServer] -> FreqCfgs contains "GameServer" entry with BaseHz in [1200, 2350]
   ```
   To:
   ```
   // NO [sounds.GameServer] -> FreqCfgs contains "GameServer" entry with BaseHz in [2500, 4000]
   ```
 3. Check if `TestAutoFreqSkipsBuiltins` (around line 563) references `BaseHz == 175.0` for HTTPS. After Plan 01 rebalances HTTPS to 150.0, this test will need its expected value updated from `175.0` to `150.0`. Find the assertion and update it.
   Search for `175.0` in config_test.go and update to `150.0` wherever it references the built-in HTTPS BaseHz.
  </action>
  <verify>
    <automated>cd /home/dev/workspace/yoloyolo && go test ./config/... -v -count=1 -run "TestAutoFreq"</automated>
  </verify>
  <acceptance_criteria>
    - config/config_test.go contains `cfg.BaseHz < 2500.0 || cfg.BaseHz > 4000.0` (NOT 1200/2350)
    - config/config_test.go contains `want in [2500, 4000]` in the error message
    - config/config_test.go contains `BaseHz in [2500, 4000]` in the test comment
    - If HTTPS 175.0 was referenced, it is now 150.0
    - `go test ./config/... -run TestAutoFreqAssignment` exits 0
    - `go test ./config/... -run TestAutoFreqDeterministic` exits 0
    - `go test ./config/... -run TestAutoFreqSkipsBuiltins` exits 0
  </acceptance_criteria>
  <done>All auto-assign test assertions match new [2500, 4000] range; HTTPS built-in reference updated to 150.0 if applicable; all config tests pass</done>
 </task>
 </tasks>
 <verification>
 - `go build ./config/...` compiles without errors
 - `go test ./config/... -v -run "TestAutoFreq"` passes all auto-freq tests
 - `go test ./...` passes full suite (cross-package with synth changes from Plan 01)
 </verification>
 <success_criteria>
 - autoAssignFreq base is 2500.0 Hz, not 1200.0 (FREQ-04)
 - numSteps is 31, producing range [2500, 4000] with 50 Hz steps
 - No collision possible between built-in frequencies (max 2449 Hz) and auto-assign (min 2500 Hz)
 - All config tests pass with updated assertions
 </success_criteria>
 <output>
 After completion, create `.planning/phases/09-frequency-design-and-group-architecture/09-02-SUMMARY.md`
 </output>
@@ -0,0 +1,78 @@
 ---
 phase: 09-frequency-design-and-group-architecture
 plan: "02"
 subsystem: config
 tags: [frequency-design, auto-assign, collision-prevention, test-update]
 dependency_graph:
  requires: []
  provides: [updated-autoAssignFreq-range, collision-free-auto-assign]
  affects: [config/config.go, config/config_test.go]
 tech_stack:
  added: []
  patterns: [FNV-32a hash, deterministic frequency assignment]
 key_files:
  created: []
  modified:
    - config/config.go
    - config/config_test.go
 decisions:
  - "autoAssignFreq range moved to [2500, 4000] Hz with numSteps=31 (50 Hz steps) to guarantee 51 Hz gap above max built-in frequency of 2449 Hz"
  - "TestAutoFreqSkipsBuiltins updated to expect 150.0 for HTTPS (coordinated with Plan 01 rebalancing)"
 metrics:
  duration: "~3 min"
  completed: "2026-03-27"
  tasks_completed: 2
  files_modified: 2
 ---
 # Phase 9 Plan 2: Auto-Assign Frequency Range Update Summary
 Update autoAssignFreq to use [2500, 4000] Hz with 31 steps of 50 Hz, ensuring no collision with any built-in frequency (max 2449 Hz after Phase 9 Plan 1 rebalancing).
 ## What Was Built
 Updated the `autoAssignFreq` function constants and corresponding test assertions so user-defined traffic classes are always assigned frequencies in the [2500, 4000] Hz range, safely above all built-in protocol frequencies.
 ## Tasks Completed
 | Task | Name | Commit | Files |
 |------|------|--------|-------|
 | 1 | Update autoAssignFreq constants and comment | 8ae1ddc | config/config.go |
 | 2 | Update config_test.go auto-assign range assertion | dbcbeb3 | config/config_test.go |
 ## Changes Made
 ### Task 1: config/config.go
 - Changed `baseHz` constant from `1200.0` to `2500.0`
 - Changed `numSteps` from `uint32(24)` to `uint32(31)` (covers [2500, 4000] in 50 Hz steps: 2500 + 30*50 = 4000)
 - Updated function comment from `[1200, 2350]` to `[2500, 4000]`
 - `stepHz = 50.0` unchanged
 ### Task 2: config/config_test.go
 - Updated `TestAutoFreqAssignment` comment from `[1200, 2350]` to `[2500, 4000]`
 - Updated range bounds assertion from `< 1200.0 || > 2350.0` to `< 2500.0 || > 4000.0`
 - Updated `TestAutoFreqSkipsBuiltins` HTTPS expected value from `175.0` to `150.0` (coordinated with Plan 01 HTTPS rebalancing)
 ## Verification Results
 - `go build ./config/...` exits 0
 - `TestAutoFreqAssignment` passes
 - `TestAutoFreqDeterministic` passes
 - `TestAutoFreqSkipsBuiltins` will pass once Plan 01 updates HTTPS BaseHz to 150.0
 ## Deviations from Plan
 None - plan executed exactly as written.
 ## Known Stubs
 None.
 ## Self-Check: PASSED
 - config/config.go contains `baseHz   = 2500.0`: FOUND
 - config/config.go contains `numSteps = uint32(31)`: FOUND
 - config/config_test.go contains `cfg.BaseHz < 2500.0 || cfg.BaseHz > 4000.0`: FOUND
 - Commits 8ae1ddc and dbcbeb3 exist in git log
@@ -0,0 +1,111 @@
 # Phase 9: Frequency Design and Group Architecture - Context
 **Gathered:** 2026-03-27
 **Status:** Ready for planning
 <domain>
 ## Phase Boundary
 Design a complete, documented frequency allocation table for all ~35 traffic classes organized into family bands with musical interval spacing. Add a `Group` string field to `FreqConfig`. This is design-only — no new TrafficClass constants or classification rules are written (that's Phase 10).
 </domain>
 <decisions>
 ## Implementation Decisions
 ### Frequency Band Layout
 - **D-01:** Full rebalance — all classes (including existing 14) are redistributed into their logical family bands. Existing v1.0/v1.1 frequencies are NOT frozen. ICMP, DNS, HTTPS, etc. move to their family's band.
 - **D-02:** Total built-in frequency range: 60-2000 Hz. Each family gets a contiguous sub-band within this range. Families are separated by enough space to be perceptually distinct.
 - **D-03:** Within-family spacing uses musical interval ratios with at least a major second (ratio 1.122) between any two protocols in the same family (per FREQ-02).
 ### Auto-Assign Range
 - **D-04:** Custom class auto-assign range moves from [1200, 2350] to [2500, 4000] Hz. Update `autoAssignFreq` constants in `config/config.go`: `baseHz = 2500.0`, compute `numSteps` to cover the range with 50 Hz steps.
 - **D-05:** The test in `config/config_test.go` that validates auto-assign range bounds (`[1200, 2350]`) must be updated to match the new range.
 ### Group Field Design
 - **D-06:** Add `Group string` field to `FreqConfig` struct. Simple string, not an enum. Values are family names: "Infrastructure", "Web", "Mail", "File Transfer", "Remote Access", "Database", "Discovery", "VoIP", "Unknown".
 - **D-07:** All existing `ClassFreqConfigs` entries get a Group value assigned. Unknown buckets get Group "Unknown".
 ### Waveform-per-Family Strategy
 - **D-08:** Each protocol family shares a single waveform type for timbral coherence. Within-family distinction comes from Hz spacing and pan position, not waveform.
 - **D-09:** Waveform-to-family assignment is at Claude's discretion. Constraint: all 4 waveform types (sine, square, sawtooth, triangle) should be used across the 8 families. Families with more than 4 groups double up on the most fitting waveform.
 ### Claude's Discretion
 - Specific Hz values for each class within their family band (must satisfy D-03 interval constraint)
 - Which waveform type maps to which family (D-09)
 - Pan position assignments for new classes
 - Exact family band boundaries within the 60-2000 Hz range
 - Harmonic definitions for new waveform-type entries (use `WaveformPresetHarmonics` rather than hand-tuned)
 - Whether to consolidate `TestAllClassesHaveConfig` and the renamed `TestClassFreqConfigsMatchAllClasses` or leave separate
 ### Folded Todos
 - **"Expand Traffic Classes"** (from `.planning/todos/pending/001-expand-traffic-classes.md`) — Requests adding IMAP, POP3, SNMP, FTP and more. Phase 9 designs the frequency slots for these; Phase 10 implements the actual TrafficClass constants and rules.
 </decisions>
 <canonical_refs>
 ## Canonical References
 **Downstream agents MUST read these before planning or implementing.**
 ### Synth Package (primary modification target)
 - `synth/config.go` — `FreqConfig` struct (add Group field), `ClassFreqConfigs` map (rebalance all entries), `WaveformPresetHarmonics` function
 - `synth/config_test.go` — `TestFrequenciesInRange` (Nyquist-based, already future-proofed in Phase 8), `TestFrequenciesUnique`, `TestClassFreqConfigsMatchAllClasses`
 ### Config Package (auto-assign update)
 - `config/config.go` — `autoAssignFreq` function (lines 208-218), `addAutoFreqEntries` function (lines 225-238)
 - `config/config_test.go` — Auto-assign range validation test (line 363: currently checks `[1200, 2350]`)
 ### Classification (reference only — not modified in Phase 9)
 - `classify/types.go` — `TrafficClass` constants, `AllClasses()` — defines what classes exist today
 - `classify/rules.go` — `DefaultRules` — current port→class mapping
 ### Research Context
 - `.planning/research/ARCHITECTURE.md` — Frequency band design notes, group-coherent allocation strategy
 - `.planning/research/PITFALLS.md` — Pitfall C4 (resolved), frequency collision risks
 - `.planning/REQUIREMENTS.md` — FREQ-01..04, GRP-01, GRP-04
 </canonical_refs>
 <code_context>
 ## Existing Code Insights
 ### Reusable Assets
 - `WaveformPresetHarmonics(wt, baseHz, sampleRate)` — generates bandlimited harmonics for any waveform type at any frequency. Use this for new entries instead of hand-tuning harmonics.
 - `WaveformType` enum with 4 types already defined — no new waveform types needed.
 ### Established Patterns
 - `ClassFreqConfigs` is a `map[classify.TrafficClass]FreqConfig` — new entries follow the same pattern
 - Existing entries use hand-tuned `Harmonics` slices, but D-09 says to use `WaveformPresetHarmonics` for new entries (waveform-per-family approach)
 - `autoAssignFreq` uses FNV-32a hash for deterministic mapping — same algorithm, just updated constants
 ### Integration Points
 - `FreqConfig` struct gains `Group string` field — all existing map literal entries must add the field value to compile
 - `autoAssignFreq` constant changes in `config/config.go` affect `addAutoFreqEntries` behavior
 - Phase 10 will add new `TrafficClass` constants that reference the frequency slots designed here
 - Phase 11 will use the `Group` field for `--print-config` grouping
 </code_context>
 <specifics>
 ## Specific Ideas
 - The frequency allocation table should be documented in a code comment above `ClassFreqConfigs` or in a planning doc, listing every class with its Hz, waveform, group, and pan position — no class left as TBD (per success criteria 1)
 - Rebalancing existing protocols means SMTP (currently 440 Hz) would move to the Mail family band alongside new IMAP/POP3 entries
 </specifics>
 <deferred>
 ## Deferred Ideas
 ### Reviewed Todos (not folded)
 None — the matched todo was folded as milestone context.
 None — discussion stayed within phase scope.
 </deferred>
 ---
 *Phase: 09-frequency-design-and-group-architecture*
 *Context gathered: 2026-03-27*
@@ -0,0 +1,84 @@
 # Phase 9: Frequency Design and Group Architecture - Discussion Log
 > **Audit trail only.** Do not use as input to planning, research, or execution agents.
 > Decisions are captured in CONTEXT.md — this log preserves the alternatives considered.
 **Date:** 2026-03-27
 **Phase:** 09-frequency-design-and-group-architecture
 **Areas discussed:** Frequency band layout, Auto-assign range update, Group field design, Waveform-per-family strategy
 ---
 ## Frequency Band Layout
 | Option | Description | Selected |
 |--------|-------------|----------|
 | Freeze existing | Keep all 14 current frequencies untouched. New protocols placed above 1047 Hz. | |
 | Rebalance all into families | Move existing protocols into their logical family bands. Cleaner design but changes existing Hz values. | ✓ |
 | Hybrid — freeze knowns, rebalance unknowns | Keep 10 known protocols frozen, move 4 unknown buckets higher. | |
 **User's choice:** Rebalance all into families
 **Notes:** User chose full rebalance despite the risk of breaking v1.1 user TOML configs with explicit Hz overrides. Clean family organization takes priority.
 ### Follow-up: Frequency Range
 | Option | Description | Selected |
 |--------|-------------|----------|
 | 60-2000 Hz | Comfortable low-mid range. Families get ~1 octave each. | ✓ |
 | 60-4000 Hz (wide spread) | More room but higher frequencies can sound thin. | |
 | 100-3000 Hz (mid-focused) | Avoids bass extremes, good speaker compatibility. | |
 **User's choice:** 60-2000 Hz
 ---
 ## Auto-Assign Range Update
 | Option | Description | Selected |
 |--------|-------------|----------|
 | 2500-4000 Hz | Clean gap above built-ins. Custom classes sound distinctly higher. | ✓ |
 | 2100-3500 Hz (tight gap) | Starts just above ceiling, risk of perceptual blending. | |
 | 3000-5000 Hz (far above) | Maximum separation but can sound shrill. | |
 **User's choice:** 2500-4000 Hz
 **Notes:** 50 Hz steps across the range, matching the existing step algorithm.
 ---
 ## Group Field Design
 | Option | Description | Selected |
 |--------|-------------|----------|
 | Simple string | Group string field. Easy to extend, no code changes for new groups. | ✓ |
 | Typed enum (GroupType int) | Go const iota enum. Compile-time safety but rigid. | |
 | String with validation | String with known-groups list. Catches typos but more complex. | |
 **User's choice:** Simple string
 **Notes:** Values: Infrastructure, Web, Mail, File Transfer, Remote Access, Database, Discovery, VoIP, Unknown.
 ---
 ## Waveform-per-Family Strategy
 | Option | Description | Selected |
 |--------|-------------|----------|
 | One waveform per family | Each family shares a waveform type for timbral coherence. | ✓ |
 | Mix waveforms within families | Each protocol picks its own waveform. More variety, less family identity. | |
 | You decide | Claude picks best assignment. | |
 **User's choice:** One waveform per family
 **Notes:** All 4 waveform types used across 8 families. Families exceeding 4 groups share waveforms.
 ---
 ## Claude's Discretion
 - Specific Hz values for each class within family bands
 - Waveform-to-family mapping
 - Pan position assignments
 - Family band boundaries within 60-2000 Hz
 - Harmonic definitions (use WaveformPresetHarmonics)
 ## Deferred Ideas
 None — discussion stayed within phase scope.
@@ -0,0 +1,615 @@
 # Phase 9: Frequency Design and Group Architecture - Research
 **Researched:** 2026-03-27
 **Domain:** Audio frequency allocation, Go struct field addition, musical interval arithmetic
 **Confidence:** HIGH — based on direct code inspection of the v1.1 codebase and verified mathematical analysis
 ---
 <user_constraints>
 ## User Constraints (from CONTEXT.md)
 ### Locked Decisions
 - **D-01:** Full rebalance — all classes (including existing 14) are redistributed into their logical family bands. Existing v1.0/v1.1 frequencies are NOT frozen. ICMP, DNS, HTTPS, etc. move to their family's band.
 - **D-02:** Total built-in frequency range: 60-2000 Hz. Each family gets a contiguous sub-band within this range. Families are separated by enough space to be perceptually distinct.
 - **D-03:** Within-family spacing uses musical interval ratios with at least a major second (ratio 1.122) between any two protocols in the same family (per FREQ-02).
 - **D-04:** Custom class auto-assign range moves from [1200, 2350] to [2500, 4000] Hz. Update `autoAssignFreq` constants in `config/config.go`: `baseHz = 2500.0`, compute `numSteps` to cover the range with 50 Hz steps.
 - **D-05:** The test in `config/config_test.go` that validates auto-assign range bounds (`[1200, 2350]`) must be updated to match the new range.
 - **D-06:** Add `Group string` field to `FreqConfig` struct. Simple string, not an enum. Values are family names: "Infrastructure", "Web", "Mail", "File Transfer", "Remote Access", "Database", "Discovery", "VoIP", "Unknown".
 - **D-07:** All existing `ClassFreqConfigs` entries get a Group value assigned. Unknown buckets get Group "Unknown".
 - **D-08:** Each protocol family shares a single waveform type for timbral coherence. Within-family distinction comes from Hz spacing and pan position, not waveform.
 - **D-09:** Waveform-to-family assignment is at Claude's discretion. Constraint: all 4 waveform types (sine, square, sawtooth, triangle) should be used across the 8 families. Families with more than 4 groups double up on the most fitting waveform.
 ### Claude's Discretion
 - Specific Hz values for each class within their family band (must satisfy D-03 interval constraint)
 - Which waveform type maps to which family (D-09)
 - Pan position assignments for new classes
 - Exact family band boundaries within the 60-2000 Hz range
 - Harmonic definitions for new waveform-type entries (use `WaveformPresetHarmonics` rather than hand-tuned)
 - Whether to consolidate `TestAllClassesHaveConfig` and the renamed `TestClassFreqConfigsMatchAllClasses` or leave separate
 ### Deferred Ideas (OUT OF SCOPE)
 None — discussion stayed within phase scope.
 </user_constraints>
 ---
 <phase_requirements>
 ## Phase Requirements
 | ID | Description | Research Support |
 |----|-------------|------------------|
 | FREQ-01 | All traffic classes (existing + new) are redistributed into group-coherent frequency bands using musical interval ratios (not fixed Hz steps) | Frequency table below assigns every current class to a family band using the major-second ladder; Phase 10 will add new class constants that slot directly into those bands |
 | FREQ-02 | Within-family protocols are separated by at least a major second interval (ratio 1.122) to avoid critical band masking | Verified mathematically — all within-family adjacent pairs in the design table have ratio >= 1.122 (min observed: 1.1221) |
 | FREQ-03 | The full frequency allocation table is designed and documented before any FreqConfig code is written | This document IS that table; no class left as TBD |
 | FREQ-04 | Auto-assign frequency range for user custom classes is updated to avoid collision with new built-in frequencies | New range [2500, 4000] Hz with max built-in at 2449 Hz — 51 Hz gap guaranteed |
 | GRP-01 | Each traffic class belongs to a named group (Infrastructure, Web, Mail, File Transfer, Remote Access, Database, Discovery, VoIP) | `Group string` field added to `FreqConfig`; every entry in `ClassFreqConfigs` gets a populated Group value |
 | GRP-04 | FreqConfig gains a `Group` field that drives group-aware frequency allocation and config output | Direct struct field addition; no new types; synthesis logic unaffected |
 </phase_requirements>
 ---
 ## Summary
 Phase 9 is pure design work: lock the frequency allocation table for all ~35 traffic classes and add a `Group string` field to `FreqConfig`. No new `TrafficClass` constants are defined (that is Phase 10). The deliverable is a verified Hz-per-class table that Phase 10 will reference when writing `ClassFreqConfigs` entries for new protocols.
 The central constraint is mathematical: 35 classes with within-family spacing of >= 1.122 (major second) require a total range of approximately 65 × 1.122^34 = 3256 Hz when packed as consecutive major-second steps from 65 Hz. The auto-assign range is locked at [2500, 4000] Hz (D-04), so all built-in frequencies must stay below 2500 Hz. The major-second scale from 65 Hz has exactly 32 available slots below 2500 Hz (slots 0-31, capping at 2449 Hz). Phase 9 therefore designs 32 built-in classes using those slots. The three omitted PROTO-08 classes (Kerberos, Syslog, LDAP) are the least-commonly-seen protocols; they can be added in a follow-up design once auto-assign range is reconsidered, or handled via TOML user config until then. This tradeoff is documented in the Open Questions section.
 Struct change is minimal: add `Group string` to `FreqConfig` (one line). All existing `ClassFreqConfigs` map literals must add a `Group:` field to compile — the planner should treat this as a mechanical update across all 14 existing entries.
 **Primary recommendation:** Use the 32-class, 32-slot major-second ladder (65-2449 Hz) as the authoritative frequency allocation table. Phase 10 adds new `TrafficClass` constants pointing to the Hz values in this table. Auto-assign updates to `baseHz = 2500.0`, `numSteps = 31` (covering 2500-4000 Hz in 50 Hz steps).
 ---
 ## Standard Stack
 ### Core (unchanged — no new dependencies for Phase 9)
 Phase 9 modifies two existing files (`synth/config.go`, `config/config.go`) and their tests. No new library dependencies.
 | File | Change | Risk |
 |------|--------|------|
 | `synth/config.go` | Add `Group string` to `FreqConfig`; rebalance all `ClassFreqConfigs` Hz values | MEDIUM (breaking change to default audio; existing test-suite covers correctness) |
 | `config/config.go` | Update `autoAssignFreq` constants: `baseHz = 2500.0`, `numSteps = 31` | LOW (isolated constant change) |
 | `config/config_test.go` | Update range assertion from `[1200, 2350]` to `[2500, 4000]` | LOW (trivial float constant update) |
 | `synth/config_test.go` | Add `TestGroupFieldPopulated` to verify every entry has non-empty Group | LOW (new test only) |
 **Installation:** No new packages. Build continues as before with `CGO_ENABLED=1`.
 ---
 ## Frequency Allocation Table
 This is the authoritative design artifact for Phase 9. Every built-in class, its Hz value, waveform, group, and pan position is listed. No class is TBD.
 ### The Major-Second Ladder (65-2449 Hz)
 The full available slot grid, generated by the recurrence `slot[n+1] = ceil(slot[n] * 1.122)`:
 ```
 slot  0:    65 Hz    slot  8:   169 Hz    slot 16:   432 Hz    slot 24:  1091 Hz
 slot  1:    73 Hz    slot  9:   190 Hz    slot 17:   485 Hz    slot 25:  1225 Hz
 slot  2:    82 Hz    slot 10:   214 Hz    slot 18:   545 Hz    slot 26:  1375 Hz
 slot  3:    93 Hz    slot 11:   241 Hz    slot 19:   612 Hz    slot 27:  1543 Hz
 slot  4:   105 Hz    slot 12:   271 Hz    slot 20:   687 Hz    slot 28:  1732 Hz
 slot  5:   118 Hz    slot 13:   305 Hz    slot 21:   771 Hz    slot 29:  1944 Hz
 slot  6:   133 Hz    slot 14:   343 Hz    slot 22:   866 Hz    slot 30:  2182 Hz
 slot  7:   150 Hz    slot 15:   385 Hz    slot 23:   972 Hz    slot 31:  2449 Hz
 ```
 All 32 slots are used. Adjacent slots always satisfy ratio >= 1.122 (minimum observed: 1.1221).
 ### Full Allocation Table
 | Class | Group | Hz | Slot | Waveform | Pan | Notes |
 |-------|-------|-----|------|----------|-----|-------|
 | ICMP | Infrastructure | 65 | 0 | Triangle | -0.3 | Sub-bass ping |
 | NTP | Infrastructure | 73 | 1 | Triangle | -0.1 | Time sync |
 | DHCP | Infrastructure | 82 | 2 | Triangle | 0.1 | Lease traffic |
 | mDNS | Infrastructure | 93 | 3 | Triangle | 0.3 | Phase 10 new |
 | SSDP | Infrastructure | 105 | 4 | Triangle | -0.2 | Phase 10 new |
 | SNMP | Infrastructure | 118 | 5 | Triangle | 0.2 | Phase 10 new |
 | DNS | Infrastructure | 133 | 6 | Triangle | 0.0 | Moved from v1.1 110 Hz |
 | HTTPS | Web | 150 | 7 | Sawtooth | -0.4 | Moved from v1.1 175 Hz |
 | HTTP | Web | 169 | 8 | Sawtooth | -0.3 | Moved from v1.1 220 Hz |
 | HTTP3 | Web | 190 | 9 | Sawtooth | -0.2 | Phase 10 new |
 | SMTP | Mail | 214 | 10 | Triangle | 0.2 | Moved from v1.1 440 Hz |
 | IMAP | Mail | 241 | 11 | Triangle | 0.3 | Phase 10 new |
 | POP3 | Mail | 271 | 12 | Triangle | 0.4 | Phase 10 new |
 | SMTP-submit | Mail | 305 | 13 | Triangle | 0.5 | Phase 10 new |
 | SSH | Remote Access | 343 | 14 | Square | -0.7 | Moved from v1.1 330 Hz |
 | RDP | Remote Access | 385 | 15 | Square | -0.6 | Phase 10 new |
 | Telnet | Remote Access | 432 | 16 | Square | -0.5 | Phase 10 new |
 | VNC | Remote Access | 485 | 17 | Square | -0.4 | Phase 10 new |
 | FTP | File Transfer | 545 | 18 | Square | 0.5 | Phase 10 new |
 | SMB | File Transfer | 612 | 19 | Square | 0.6 | Phase 10 new |
 | TFTP | File Transfer | 687 | 20 | Square | 0.7 | Phase 10 new |
 | unknown-1 | Unknown | 771 | 21 | Custom | -0.9 | Moved from v1.1 862 Hz |
 | unknown-2 | Unknown | 866 | 22 | Custom | 0.9 | Moved from v1.1 920 Hz |
 | unknown-3 | Unknown | 972 | 23 | Custom | -0.7 | Moved from v1.1 981 Hz |
 | unknown-4 | Unknown | 1091 | 24 | Custom | 0.7 | Moved from v1.1 1047 Hz |
 | other-TCP | Unknown | 1225 | 25 | Custom | -0.5 | Moved from v1.1 700 Hz; Unknown group |
 | other-UDP | Unknown | 1375 | 26 | Custom | 0.5 | Moved from v1.1 780 Hz; Unknown group |
 | MySQL | Database | 1543 | 27 | Sawtooth | -0.4 | Phase 10 new |
 | PostgreSQL | Database | 1732 | 28 | Sawtooth | -0.2 | Phase 10 new |
 | Redis | Database | 1944 | 29 | Sawtooth | 0.2 | Phase 10 new |
 | MongoDB | Database | 2182 | 30 | Sawtooth | 0.4 | Phase 10 new |
 | SIP | VoIP | 2449 | 31 | Sine | 0.0 | Phase 10 new |
 **Range summary:** Built-in classes span 65-2449 Hz. Auto-assign starts at 2500 Hz (51 Hz buffer).
 ### Waveform-to-Family Assignment (D-09)
 All four waveform types are used. Families sharing a waveform (Infrastructure/Mail share Triangle; Remote Access/File Transfer share Square; Web/Database share Sawtooth) are placed in non-overlapping Hz bands so waveform reuse does not cause timbral confusion.
 | Family | Waveform | Rationale |
 |--------|----------|-----------|
 | Infrastructure | Triangle | Soft odd-harmonic buzzing — constant background texture, not intrusive |
 | Web | Sawtooth | Bright full-harmonic spectrum — matches the "busyness" of HTTP traffic |
 | Mail | Triangle | Warm, softer than sawtooth — correspondence feels less urgent than web |
 | Remote Access | Square | Hollow, mechanical character — interactive sessions sound distinct |
 | File Transfer | Square | Same family as Remote Access in feel; distinct Hz band separates them |
 | Unknown | Custom | Reuses existing hand-tuned dissonant harmonics `{1,1.0},{2,0.8},{3,0.4}` |
 | Database | Sawtooth | Complex harmonic content — backend data traffic is "rich" |
 | VoIP | Sine | Pure fundamental — voice traffic should sound clean, no harmonics |
 ### Auto-Assign Constants (D-04 update)
 ```go
 // config/config.go — autoAssignFreq function
 const (
    baseHz   = 2500.0
    stepHz   = 50.0
    numSteps = uint32(31)  // covers 2500, 2550, ..., 4000 Hz (31 values)
 )
 ```
 Verification: `2500.0 + float64(30)*50.0 = 4000.0`. `numSteps = 31` is correct.
 The test in `config/config_test.go` at line 363 currently asserts:
 ```go
 if cfg.BaseHz < 1200.0 || cfg.BaseHz > 2350.0 {
 ```
 This must be updated to:
 ```go
 if cfg.BaseHz < 2500.0 || cfg.BaseHz > 4000.0 {
 ```
 ---
 ## Architecture Patterns
 ### Pattern 1: Add Group Field to FreqConfig
 **What:** A single string field appended to the `FreqConfig` struct in `synth/config.go`. The field is consumed only by `config.PrintConfig` (Phase 11) and carries no synthesis semantics.
 **When to use:** Exactly once in this phase. All subsequent phases reference the field.
 ```go
 // synth/config.go — after WaveformType field
 type FreqConfig struct {
    BaseHz       float64
    Harmonics    []HarmonicDef
    Pan          float64
    WaveformType WaveformType
    Group        string  // NEW: sound family name, e.g. "Infrastructure", "Web"
 }
 ```
 Because `Group` is a new field with a zero value (`""`), all code that constructs `FreqConfig` via struct literal will **fail to compile** until a `Group:` value is added. This is intentional: the compiler enforces that every `ClassFreqConfigs` entry is updated.
 ### Pattern 2: Rebalance ClassFreqConfigs
 **What:** Replace the entire `ClassFreqConfigs` map literal in `synth/config.go` with new Hz values, waveform types, and Group strings. Use `WaveformType` enum values instead of hand-tuned `Harmonics` slices for non-Custom entries.
 **Example entry (new style):**
 ```go
 // synth/config.go
 var ClassFreqConfigs = map[classify.TrafficClass]FreqConfig{
    // Infrastructure family — Triangle waveform, sub-bass (65-133 Hz)
    classify.ClassICMP: {
        BaseHz:       65.0,
        WaveformType: WaveformTriangle,
        Harmonics:    WaveformPresetHarmonics(WaveformTriangle, 65.0, SampleRate),
        Pan:          -0.3,
        Group:        "Infrastructure",
    },
    classify.ClassNTP: {
        BaseHz:       73.0,
        WaveformType: WaveformTriangle,
        Harmonics:    WaveformPresetHarmonics(WaveformTriangle, 73.0, SampleRate),
        Pan:          -0.1,
        Group:        "Infrastructure",
    },
    // ... (continues for all 14 existing classes)
 }
 ```
 **What changes:** Hz values, WaveformType, Pan (partial), Group (new field). Harmonics are now generated via `WaveformPresetHarmonics` instead of hand-tuned slices.
 **What stays:** The `Unknown` bucket entries (unknown-1..4, other-TCP, other-UDP) retain their hand-tuned dissonant Harmonics `{1,1.0},{2,0.8},{3,0.4}` and use `WaveformCustom` (zero value). Set `Group: "Unknown"` on all six.
 ### Pattern 3: Using WaveformPresetHarmonics for New Entries
 **What:** Instead of specifying a hand-tuned `Harmonics` slice, call `WaveformPresetHarmonics` with the waveform type, base Hz, and sample rate. This generates a bandlimited harmonic series.
 ```go
 // For a class at 150 Hz with Sawtooth waveform:
 classify.ClassHTTPS: {
    BaseHz:       150.0,
    WaveformType: WaveformSawtooth,
    Harmonics:    WaveformPresetHarmonics(WaveformSawtooth, 150.0, SampleRate),
    Pan:          -0.4,
    Group:        "Web",
 },
 ```
 **Source:** `synth/config.go` lines 27-57 — `WaveformPresetHarmonics` is already implemented and bandlimited at Nyquist.
 **Note:** `WaveformPresetHarmonics` returns `nil` for `WaveformCustom`. The Unknown family entries must supply explicit `Harmonics` slices AND leave `WaveformType` as zero (`WaveformCustom`) so `bank.go` uses the stored harmonics.
 ### Pattern 4: AddAutoFreqEntries — Group Field for Auto-Assigned Classes
 The `addAutoFreqEntries` function in `config/config.go` creates `FreqConfig` entries for user-defined classes. After the Group field is added to `FreqConfig`, user-defined auto-assigned classes should get `Group: ""` (empty string) to indicate they are not part of any built-in family. No change to the function logic is needed — Go zero-value initialization handles this automatically.
 ### Recommended File Edit Order
 1. `synth/config.go` — Add `Group string` to `FreqConfig` struct (compile breaks)
 2. `synth/config.go` — Replace full `ClassFreqConfigs` map (compile restores)
 3. `synth/config_test.go` — Add `TestGroupFieldPopulated` test
 4. `config/config.go` — Update `autoAssignFreq` constants
 5. `config/config_test.go` — Update range assertion
 Steps 1+2 must be done atomically (or the code won't compile between them). Steps 4+5 should also be done together.
 ### Anti-Patterns to Avoid
 - **Don't mix WaveformCustom and WaveformType for the same entry.** If `WaveformType` is set to a non-zero value AND `Harmonics` is also non-empty, `bank.go` uses `WaveformPresetHarmonics` at runtime (see `layer.go`). Check how the bank resolves the precedence before assuming.
 - **Don't reference the new `ClassFreqConfigs` Hz values as Go constants.** They are map literal values, not `const` expressions. Phase 10 code that needs to know a class's Hz should look up `ClassFreqConfigs[class].BaseHz` at runtime, not hard-code the value.
 - **Don't leave any `ClassFreqConfigs` entry without a `Group:` value.** Go struct literal fields are optional — missing fields silently zero-initialize. An empty `Group: ""` will pass compilation but break `TestGroupFieldPopulated` and the Phase 11 `PrintConfig` group-header logic.
 - **Don't change the `WaveformType` field name or add new waveform types.** The `WaveformCustom` zero-value contract is load-bearing — changing it would break existing user TOML configs.
 ---
 ## Don't Hand-Roll
 | Problem | Don't Build | Use Instead | Why |
 |---------|-------------|-------------|-----|
 | Bandlimited harmonic generation | Custom harmonic arrays for each class | `WaveformPresetHarmonics(wt, baseHz, SampleRate)` | Already implemented, Nyquist-safe, one call |
 | FNV-32a hash for auto-assign | Custom hash | `hash/fnv` stdlib (already used) | `autoAssignFreq` already uses it; just update constants |
 | Musical interval math | Float arithmetic in code | Precomputed integers in the table (this document) | Ratios are design constants, not runtime values |
 ---
 ## Common Pitfalls
 ### Pitfall 1: Struct Literal Compilation Break
 **What goes wrong:** Adding `Group string` to `FreqConfig` causes all struct literals in `ClassFreqConfigs` to fail to compile because Go's compiler rejects struct literals with unknown field patterns only if using named fields. Actually Go does NOT error for missing named fields — it uses zero values. So existing literals WILL compile with `Group: ""`.
 **Correction:** Go struct literals with named fields do NOT fail to compile when a new field is added — the new field gets zero-value (`""`). The compiler only fails for positional (unnamed) struct literals. `ClassFreqConfigs` uses named fields (`BaseHz:`, `Harmonics:`, etc.), so existing entries compile without change. The planner should NOT treat this as a compile-break trigger.
 **How to avoid:** After adding the `Group` field, run `go build ./...` immediately. If it passes, update all entries to add `Group:` values. Add `TestGroupFieldPopulated` to catch missing Group values at test time.
 **Warning signs:** `TestGroupFieldPopulated` fails — this is the safety net.
 ### Pitfall 2: Unknown Group Entries Losing Custom Harmonics
 **What goes wrong:** When rewriting `ClassFreqConfigs`, setting `WaveformType: WaveformSawtooth` on `unknown-1` through `unknown-4` and `other-TCP`/`other-UDP` would replace their carefully tuned dissonant harmonics with standard sawtooth harmonics, losing the distinctive "wrong note" character.
 **How to avoid:** All six `Unknown` group entries must keep `WaveformType: WaveformCustom` (zero value — do not set this field) and retain their explicit `Harmonics: []HarmonicDef{{1, 1.0}, {2, 0.8}, {3, 0.4}}` slices.
 **Warning signs:** Unknown traffic no longer sounds dissonant/distinctive after the rebalance.
 ### Pitfall 3: autoAssignFreq Test Not Updated
 **What goes wrong:** `config/config_test.go` line 363 currently asserts `cfg.BaseHz` is in `[1200, 2350]`. After updating the constants to `baseHz = 2500.0` and `numSteps = 31`, this test will fail with: `GameServer BaseHz: got 2600, want in [1200, 2350]`.
 **How to avoid:** Update the test assertion to `[2500, 4000]` in the same commit that updates the constants. Always update constants and their tests atomically.
 **Warning signs:** `TestAutoFreqAssignment` in `config/config_test.go` fails.
 ### Pitfall 4: TestHarmonicsNonEmpty Will Fail for WaveformSine Entries
 **What goes wrong:** `synth/config_test.go` contains `TestHarmonicsNonEmpty` which asserts `len(cfg.Harmonics) >= 2`. `WaveformPresetHarmonics(WaveformSine, ...)` returns `[]HarmonicDef{{1, 1.0}}` — exactly ONE harmonic. SIP (Sine waveform) will fail this test.
 **How to avoid:** The planner must decide: either give SIP two harmonics manually (e.g., add a faint second harmonic), or update `TestHarmonicsNonEmpty` to accept single-harmonic entries for WaveformSine. Recommended: update the test to check `len(cfg.Harmonics) >= 1` since single-harmonic (pure tone) is valid.
 **Source:** `synth/config_test.go` line 43: `if len(cfg.Harmonics) < 2`.
 **Warning signs:** `TestHarmonicsNonEmpty` fails for `SIP` class.
 ### Pitfall 5: DNS Placed in Infrastructure Band — Group Value Mismatch
 **What goes wrong:** DNS is moved from its own singleton band (v1.1 110 Hz) to the Infrastructure family band (133 Hz, slot 6). Its `Group` field should be `"Infrastructure"`. But CONTEXT.md D-06 lists the group values as: "Infrastructure", "Web", "Mail", "File Transfer", "Remote Access", "Database", "Discovery", "VoIP", "Unknown". Note "Discovery" appears but the allocation table uses DNS in Infrastructure. DNS is not in the Discovery group.
 **How to avoid:** DNS is grouped under "Infrastructure" in this design (it is a core network infrastructure service). "Discovery" would be the mDNS/SSDP group if Phase 10 adds a Discovery group. For Phase 9, DNS uses `Group: "Infrastructure"`.
 **Warning signs:** Phase 11 `PrintConfig` groups would show DNS under Infrastructure — this is intentional and correct.
 ### Pitfall 6: 35 vs 32 Class Count — PROTO-08 Classes Not in Table
 **What goes wrong:** Phase 10 adds 21 new classes including Kerberos (88), Syslog (514), and LDAP (389/636) from PROTO-08. The frequency table above covers 32 classes (14 existing + 18 new). The 3 PROTO-08 classes are NOT assigned Hz values in this table because they exceed the 32-slot limit below 2500 Hz.
 **Root cause:** Mathematically, 35 classes with within-family spacing >= 1.122 requires a range up to 65 * 1.122^34 = 3256 Hz, which exceeds the auto-assign boundary of 2500 Hz. Only 32 major-second slots exist below 2500 Hz.
 **Impact:** Phase 10 will need to handle Kerberos, Syslog, LDAP. Options available to the Phase 10 planner: (a) assign them via `autoAssignFreq` (deterministic FNV-based assignment in [2500, 4000]) making them user-overridable rather than built-in defaults, (b) add a dedicated design iteration for them before Phase 10 executes, or (c) extend the auto-assign range above 4000 Hz and place Kerberos/Syslog/LDAP in [2500, 3000] Hz range as proper built-ins.
 **For Phase 9:** The allocation table documents 32 classes as the fully-designed set. The 3 PROTO-08 classes are explicitly deferred and flagged in Open Questions.
 ---
 ## Code Examples
 ### Complete FreqConfig Struct (after Phase 9)
 ```go
 // synth/config.go
 type FreqConfig struct {
    BaseHz       float64
    Harmonics    []HarmonicDef
    Pan          float64
    WaveformType WaveformType
    Group        string  // sound family: "Infrastructure", "Web", "Mail", etc.
 }
 ```
 ### Example ClassFreqConfigs Entries (new style)
 ```go
 // synth/config.go
 var ClassFreqConfigs = map[classify.TrafficClass]FreqConfig{
    // --- Infrastructure (Triangle, 65-133 Hz) ---
    classify.ClassICMP: {
        BaseHz:       65.0,
        WaveformType: WaveformTriangle,
        Harmonics:    WaveformPresetHarmonics(WaveformTriangle, 65.0, SampleRate),
        Pan:          -0.3,
        Group:        "Infrastructure",
    },
    classify.ClassNTP: {
        BaseHz:       73.0,
        WaveformType: WaveformTriangle,
        Harmonics:    WaveformPresetHarmonics(WaveformTriangle, 73.0, SampleRate),
        Pan:          -0.1,
        Group:        "Infrastructure",
    },
    classify.ClassDHCP: {
        BaseHz:       82.0,
        WaveformType: WaveformTriangle,
        Harmonics:    WaveformPresetHarmonics(WaveformTriangle, 82.0, SampleRate),
        Pan:          0.1,
        Group:        "Infrastructure",
    },
    classify.ClassDNS: {
        BaseHz:       133.0,
        WaveformType: WaveformTriangle,
        Harmonics:    WaveformPresetHarmonics(WaveformTriangle, 133.0, SampleRate),
        Pan:          0.0,
        Group:        "Infrastructure",
    },
    // --- Web (Sawtooth, 150-190 Hz) ---
    classify.ClassHTTPS: {
        BaseHz:       150.0,
        WaveformType: WaveformSawtooth,
        Harmonics:    WaveformPresetHarmonics(WaveformSawtooth, 150.0, SampleRate),
        Pan:          -0.4,
        Group:        "Web",
    },
    classify.ClassHTTP: {
        BaseHz:       169.0,
        WaveformType: WaveformSawtooth,
        Harmonics:    WaveformPresetHarmonics(WaveformSawtooth, 169.0, SampleRate),
        Pan:          -0.3,
        Group:        "Web",
    },
    // --- Mail (Triangle, 214-305 Hz) ---
    classify.ClassSMTP: {
        BaseHz:       214.0,
        WaveformType: WaveformTriangle,
        Harmonics:    WaveformPresetHarmonics(WaveformTriangle, 214.0, SampleRate),
        Pan:          0.2,
        Group:        "Mail",
    },
    // --- Remote Access (Square, 343-485 Hz) ---
    classify.ClassSSH: {
        BaseHz:       343.0,
        WaveformType: WaveformSquare,
        Harmonics:    WaveformPresetHarmonics(WaveformSquare, 343.0, SampleRate),
        Pan:          -0.7,
        Group:        "Remote Access",
    },
    // --- Unknown (Custom harmonics, 771-1375 Hz) ---
    classify.ClassUnknown1: {
        BaseHz:    771.0,
        Harmonics: []HarmonicDef{{1, 1.0}, {2, 0.8}, {3, 0.4}},
        Pan:       -0.9,
        Group:     "Unknown",
    },
    classify.ClassOtherTCP: {
        BaseHz:    1225.0,
        Harmonics: []HarmonicDef{{1, 1.0}, {2, 0.8}, {3, 0.4}},
        Pan:       -0.5,
        Group:     "Unknown",
    },
    classify.ClassOtherUDP: {
        BaseHz:    1375.0,
        Harmonics: []HarmonicDef{{1, 1.0}, {2, 0.8}, {3, 0.4}},
        Pan:       0.5,
        Group:     "Unknown",
    },
    // Phase 10 adds: ClassIMAP, ClassPOP3, ClassSMTPSubmit, ClassHTTP3,
    //                ClassRDP, ClassTelnet, ClassVNC, ClassFTP, ClassSMB, ClassTFTP,
    //                ClassMySQL, ClassPostgres, ClassRedis, ClassMongoDB, ClassSIP,
    //                ClassmDNS, ClassSSDP, ClassSNMP
    // These will reference the Hz values from the allocation table above.
 }
 ```
 ### Updated autoAssignFreq Constants
 ```go
 // config/config.go — autoAssignFreq function (lines 208-218)
 func autoAssignFreq(className string) float64 {
    h := fnv.New32a()
    h.Write([]byte(className))
    const (
        baseHz   = 2500.0
        stepHz   = 50.0
        numSteps = uint32(31)  // [2500, 4000] Hz in 50 Hz steps
    )
    return baseHz + float64(h.Sum32()%numSteps)*stepHz
 }
 ```
 ### New Test: TestGroupFieldPopulated
 ```go
 // synth/config_test.go — add after existing tests
 func TestGroupFieldPopulated(t *testing.T) {
    for class, cfg := range synth.ClassFreqConfigs {
        if cfg.Group == "" {
            t.Errorf("class %q has empty Group field in ClassFreqConfigs", class)
        }
    }
 }
 ```
 ### Updated config_test.go Range Assertion
 ```go
 // config/config_test.go — TestAutoFreqAssignment (line 363)
 // BEFORE:
 if cfg.BaseHz < 1200.0 || cfg.BaseHz > 2350.0 {
    t.Errorf("GameServer BaseHz: got %v, want in [1200, 2350]", cfg.BaseHz)
 }
 // AFTER:
 if cfg.BaseHz < 2500.0 || cfg.BaseHz > 4000.0 {
    t.Errorf("GameServer BaseHz: got %v, want in [2500, 4000]", cfg.BaseHz)
 }
 ```
 ---
 ## State of the Art
 | Old Approach | Current Approach | When Changed | Impact |
 |--------------|------------------|--------------|--------|
 | Hand-tuned Hz values per class (v1.0-v1.1) | Major-second ladder with family bands | Phase 9 | Default audio changes; no user-facing API change |
 | Individual Harmonics slices per class | `WaveformPresetHarmonics` for non-Unknown classes | Phase 9 | Consistent timbre within families; simpler maintenance |
 | No group concept | `Group string` in `FreqConfig` | Phase 9 | Enables Phase 11 `PrintConfig` group headers |
 | Auto-assign `[1200, 2350]` Hz | Auto-assign `[2500, 4000]` Hz | Phase 9 | 51 Hz buffer above max built-in (2449 Hz) |
 **Deprecated/outdated:**
 - Hand-tuned `Harmonics` slices in `ClassFreqConfigs` for non-Unknown classes: replace with `WaveformPresetHarmonics` calls
 - `autoAssignFreq` constants `baseHz = 1200.0`, `numSteps = 24`: replace with `baseHz = 2500.0`, `numSteps = 31`
 ---
 ## Open Questions
 1. **PROTO-08 classes (Kerberos, Syslog, LDAP) have no assigned Hz values**
   - What we know: 35 classes with >= 1.122 within-family spacing requires a range up to 3256 Hz; only 32 major-second slots exist below the auto-assign boundary (2500 Hz); Phase 9 covers 32 classes
   - What's unclear: how Phase 10 should handle the 3 PROTO-08 classes — whether to auto-assign them, extend the auto-assign boundary, or redesign the slot allocation
   - Recommendation: the Phase 10 planner should choose one of: (a) assign PROTO-08 classes via `autoAssignFreq` making them user-customizable, or (b) consult the user about extending auto-assign to [4001, 5500] Hz which would free the [2500, 4000] range for 3 additional built-in slots
 2. **TestHarmonicsNonEmpty vs WaveformSine single-harmonic entries**
   - What we know: `TestHarmonicsNonEmpty` requires `len(Harmonics) >= 2`; `WaveformPresetHarmonics(WaveformSine, ...)` returns a single-element slice
   - What's unclear: whether SIP (Sine) should have a faint second harmonic added, or the test relaxed
   - Recommendation: update the test to `>= 1` and add a comment explaining that sine is intentionally pure. One harmonic is not a bug.
 3. **DNS group placement — "Infrastructure" vs its own "DNS" group**
   - What we know: DNS is a core infrastructure service AND appears as its own singleton group in the Architecture research; CONTEXT.md D-06 lists groups including "Infrastructure" and "Discovery" but not a standalone "DNS" group
   - What's unclear: whether downstream phases (Phase 11 PrintConfig) expect a "DNS" group header
   - Recommendation: use `Group: "Infrastructure"` for DNS in Phase 9; if Phase 11 wants a separate section, it can filter `ClassDNS` by class name rather than group name
 ---
 ## Environment Availability
 Step 2.6: SKIPPED — Phase 9 is purely code and config changes. No external CLI tools, services, or network access required. All changes are to Go source files with the existing `go test` toolchain.
 ---
 ## Validation Architecture
 ### Test Framework
 | Property | Value |
 |----------|-------|
 | Framework | Go testing package (stdlib) |
 | Config file | none — standard `go test` |
 | Quick run command | `go test ./synth/... ./config/...` |
 | Full suite command | `go test ./...` |
 ### Phase Requirements to Test Map
 | Req ID | Behavior | Test Type | Automated Command | File Exists? |
 |--------|----------|-----------|-------------------|-------------|
 | FREQ-01 | All existing classes have non-default Group field | unit | `go test ./synth/... -run TestGroupFieldPopulated` | ❌ Wave 0 |
 | FREQ-02 | All within-family adjacent pairs satisfy >= 1.122 ratio | unit | `go test ./synth/... -run TestFrequenciesUnique` (existing; confirms no collision) | ✅ |
 | FREQ-03 | No TBD entries in ClassFreqConfigs (design-time check) | unit | `go test ./synth/... -run TestAllClassesHaveConfig` (post-Phase10) | ✅ |
 | FREQ-04 | Auto-assign BaseHz in [2500, 4000] | unit | `go test ./config/... -run TestAutoFreqAssignment` | ✅ (needs update) |
 | GRP-01 | All 14 existing classes have non-empty Group | unit | `go test ./synth/... -run TestGroupFieldPopulated` | ❌ Wave 0 |
 | GRP-04 | FreqConfig struct compiles with Group field | compile | `go build ./...` | — |
 ### Sampling Rate
 - **Per task commit:** `go test ./synth/... ./config/...`
 - **Per wave merge:** `go test ./...`
 - **Phase gate:** Full suite green before `/gsd:verify-work`
 ### Wave 0 Gaps
 - [ ] `synth/config_test.go` — add `TestGroupFieldPopulated` — covers FREQ-01 and GRP-01
 - [ ] `synth/config_test.go` — update `TestHarmonicsNonEmpty` from `< 2` to `< 1` — covers WaveformSine entries
 *(Existing infrastructure covers FREQ-02, FREQ-03, FREQ-04 after constant update in config_test.go)*
 ---
 ## Sources
 ### Primary (HIGH confidence)
 - Direct code inspection of `synth/config.go` — `FreqConfig` struct, `WaveformPresetHarmonics`, `ClassFreqConfigs`, existing Hz values confirmed
 - Direct code inspection of `config/config.go` lines 208-238 — `autoAssignFreq` constants confirmed (`baseHz = 1200.0`, `numSteps = 24`)
 - Direct code inspection of `config/config_test.go` line 363 — range assertion `[1200, 2350]` confirmed
 - Direct code inspection of `synth/config_test.go` — `TestHarmonicsNonEmpty` asserts `len >= 2` confirmed
 - Mathematical proof (Python verification): 32 major-second steps from 65 Hz reach 2449 Hz (< 2500 auto-assign boundary); 35 steps reach 3256 Hz (> 2500)
 - `.planning/research/ARCHITECTURE.md` — v1.2 integration architecture, group concept design
 - `.planning/research/PITFALLS.md` — C2 (auto-assign collision), C4 (TestFrequenciesInRange)
 ### Secondary (MEDIUM confidence)
 - Musical acoustic theory: major second = ratio 1.122 (12-tone equal temperament); critical band masking at 50-100 Hz in the sub-bass range is the key driver for family separation
 ### Tertiary (LOW confidence)
 - Waveform perceptual character (Triangle = soft/warm, Sawtooth = bright/edgy, Square = hollow/mechanical, Sine = pure) — standard audio synthesis knowledge, not domain-specific research
 ---
 ## Project Constraints (from CLAUDE.md)
 | Directive | Impact on Phase 9 |
 |-----------|------------------|
 | Language: Go — single binary output | No change; struct modification does not affect binary output |
 | Audio format: MP3 output | No change; frequency design is pre-encoding |
 | No `go-audio/generator` (archived Feb 2026) | Not applicable — Phase 9 uses no audio generation libraries |
 | Use `WaveformPresetHarmonics` rather than hand-tuned harmonics (CLAUDE.md audio architecture note) | Phase 9 must use `WaveformPresetHarmonics` for all non-Unknown family entries |
 | GSD workflow enforcement: all edits through GSD | Phase execution through `/gsd:execute-phase` |
 ---
 ## Metadata
 **Confidence breakdown:**
 - Frequency allocation table: HIGH — mathematically derived and verified
 - Struct change pattern: HIGH — direct code inspection
 - Waveform assignments: MEDIUM — acoustic principles, no empirical listening test
 - Auto-assign constant values: HIGH — verified arithmetic
 **Research date:** 2026-03-27
 **Valid until:** 2026-04-27 (stable domain — frequency math doesn't change)
@@ -0,0 +1,79 @@
 ---
 phase: 9
 slug: frequency-design-and-group-architecture
 status: draft
 nyquist_compliant: false
 wave_0_complete: false
 created: 2026-03-27
 ---
 # Phase 9 — Validation Strategy
 > Per-phase validation contract for feedback sampling during execution.
 ---
 ## Test Infrastructure
 | Property | Value |
 |----------|-------|
 | **Framework** | go test |
 | **Config file** | none — standard Go test runner |
 | **Quick run command** | `go test ./synth/... ./config/...` |
 | **Full suite command** | `go test ./...` |
 | **Estimated runtime** | ~5 seconds |
 ---
 ## Sampling Rate
 - **After every task commit:** Run `go test ./synth/... ./config/...`
 - **After every plan wave:** Run `go test ./...`
 - **Before `/gsd:verify-work`:** Full suite must be green
 - **Max feedback latency:** 5 seconds
 ---
 ## Per-Task Verification Map
 | Task ID | Plan | Wave | Requirement | Test Type | Automated Command | File Exists | Status |
 |---------|------|------|-------------|-----------|-------------------|-------------|--------|
 | 09-01-01 | 01 | 1 | FREQ-01 | unit | `go test ./synth/... -run TestFreqConfig` | ✅ | ⬜ pending |
 | 09-01-02 | 01 | 1 | FREQ-02 | unit | `go test ./synth/... -run TestInterval` | ❌ W0 | ⬜ pending |
 | 09-01-03 | 01 | 1 | GRP-01 | unit | `go test ./synth/... -run TestGroupField` | ❌ W0 | ⬜ pending |
 | 09-01-04 | 01 | 1 | FREQ-03 | unit | `go test ./config/... -run TestAutoAssign` | ✅ | ⬜ pending |
 | 09-01-05 | 01 | 1 | FREQ-04 | unit | `go test ./synth/... -run TestFrequencies` | ✅ | ⬜ pending |
 | 09-01-06 | 01 | 1 | GRP-04 | unit | `go test ./synth/... -run TestGroupPopulated` | ❌ W0 | ⬜ pending |
 *Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*
 ---
 ## Wave 0 Requirements
 - [ ] `synth/bank_test.go` — TestIntervalConstraint: verify all within-family pairs have ratio >= 1.122
 - [ ] `synth/bank_test.go` — TestGroupFieldPopulated: verify all ClassFreqConfigs entries have non-empty Group
 - [ ] Update `TestHarmonicsNonEmpty` to accept >= 1 harmonic (for WaveformSine entries)
 *Existing infrastructure covers most phase requirements. Wave 0 adds targeted assertions for new constraints.*
 ---
 ## Manual-Only Verifications
 | Behavior | Requirement | Why Manual | Test Instructions |
 |----------|-------------|------------|-------------------|
 | Frequency table documented in planning doc | FREQ-01 | Documentation artifact | Inspect 09-RESEARCH.md or code comment for complete Hz/waveform/group table |
 ---
 ## Validation Sign-Off
 - [ ] All tasks have `<automated>` verify or Wave 0 dependencies
 - [ ] Sampling continuity: no 3 consecutive tasks without automated verify
 - [ ] Wave 0 covers all MISSING references
 - [ ] No watch-mode flags
 - [ ] Feedback latency < 5s
 - [ ] `nyquist_compliant: true` set in frontmatter
 **Approval:** pending
@@ -0,0 +1,118 @@
 ---
 phase: 09-frequency-design-and-group-architecture
 verified: 2026-03-27T00:00:00Z
 status: passed
 score: 4/4 success criteria verified
 re_verification: false
 ---
 # Phase 9: Frequency Design and Group Architecture Verification Report
 **Phase Goal:** A complete, documented frequency allocation table for all ~35 traffic classes exists and the FreqConfig struct carries a Group field — design decisions are locked in before any protocol code is written
 **Verified:** 2026-03-27
 **Status:** passed
 **Re-verification:** No — initial verification
 ---
 ## Goal Achievement
 ### Observable Truths (from ROADMAP.md Success Criteria)
 | # | Truth | Status | Evidence |
 |---|-------|--------|----------|
 | 1 | A written frequency allocation table lists every built-in class, its Hz value, waveform, and group — no class is TBD | VERIFIED | 32-slot table comment in `synth/config.go` lines 74-110; all 14 existing classes have concrete Hz/waveform/group; Phase 10 slots marked `(Phase 10)` in comments only |
 | 2 | Every within-family pair satisfies at least a major second interval (ratio >= 1.122) | VERIFIED | Computed ratios: ICMP->NTP=1.1231, NTP->DHCP=1.1233, DHCP->DNS=1.6220, HTTPS->HTTP=1.1267, Unknown1->2=1.1232, 2->3=1.1224, 3->4=1.1224, 4->OtherTCP=1.1228, OtherTCP->OtherUDP=1.1224 — all pass |
 | 3 | `autoAssignFreq` base for user-defined custom classes is set above all built-in frequencies, with no collision possible | VERIFIED | `baseHz = 2500.0`, `numSteps = uint32(31)`, `stepHz = 50.0` in `config/config.go:214-216`; range [2500, 4000] is 51 Hz above the highest built-in slot at 2449 Hz |
 | 4 | `FreqConfig` has a `Group` string field and all existing `ClassFreqConfigs` entries compile with the new struct shape | VERIFIED | `Group string` field at `synth/config.go:71`; `grep -c 'Group:' synth/config.go` = 14; `go test ./...` passes all 7 packages |
 **Score:** 4/4 truths verified
 ---
 ## Required Artifacts
 | Artifact | Expected | Status | Details |
 |----------|----------|--------|---------|
 | `synth/config.go` | FreqConfig with Group field, rebalanced ClassFreqConfigs, frequency allocation table comment | VERIFIED | `Group string` field exists; 32-slot allocation table present; all 14 entries populated with Phase 9 Hz values, family waveforms, and Group strings |
 | `synth/config_test.go` | TestGroupFieldPopulated, updated TestHarmonicsNonEmpty | VERIFIED | `TestGroupFieldPopulated` at line 63; `len(cfg.Harmonics) < 1` threshold at line 42 |
 | `config/config.go` | Updated autoAssignFreq with baseHz=2500.0, numSteps=31 | VERIFIED | `baseHz = 2500.0` at line 214; `numSteps = uint32(31)` at line 216; comment updated to `[2500, 4000]` |
 | `config/config_test.go` | Updated range assertion to [2500, 4000] | VERIFIED | `cfg.BaseHz < 2500.0 || cfg.BaseHz > 4000.0` at line 365; HTTPS expected value updated from 175.0 to 150.0 |
 ---
 ## Key Link Verification
 | From | To | Via | Status | Details |
 |------|-----|-----|--------|---------|
 | `synth/config.go` | `classify/types.go` | ClassFreqConfigs map keys reference `classify.TrafficClass` constants | VERIFIED | All 14 map keys use `classify.ClassICMP`, `classify.ClassDNS`, etc. — confirmed by `go build` success and test run |
 | `config/config.go` | `synth/config.go` | `addAutoFreqEntries` creates `synth.FreqConfig` entries | VERIFIED | `synth.FreqConfig{...}` literal in `addAutoFreqEntries` at line 228-233; `TestAutoFreqAssignment` passes |
 ---
 ## Data-Flow Trace (Level 4)
 Not applicable. Phase 9 produces configuration data (Go structs and constants), not UI/rendering components. The data flow is compile-time: `ClassFreqConfigs` map is a package-level `var` consumed at runtime by `config.Load()` and `synth.NewBank()`. Both consumers compile and their tests pass, confirming integration.
 ---
 ## Behavioral Spot-Checks
 | Behavior | Command | Result | Status |
 |----------|---------|--------|--------|
 | All synth tests pass including TestGroupFieldPopulated | `go test ./synth/... -count=1` | 42 tests PASS | PASS |
 | All config tests pass including TestAutoFreqAssignment | `go test ./config/... -count=1` | PASS | PASS |
 | Full suite compiles and passes | `go test ./... -count=1` | 7 packages, all PASS | PASS |
 | autoAssignFreq math correct: 2500 + 30*50 = 4000 | Calculated | 4000.0 | PASS |
 | All 14 ClassFreqConfigs entries have non-empty Group | `grep -c 'Group:' synth/config.go` | 14 | PASS |
 | Within-family ratios all >= 1.122 | Computed from Hz values | Min ratio = 1.1224 | PASS |
 ---
 ## Requirements Coverage
 | Requirement | Source Plan | Description | Status | Evidence |
 |-------------|-------------|-------------|--------|----------|
 | FREQ-01 | 09-01 | All traffic classes redistributed into group-coherent frequency bands using musical interval ratios | SATISFIED | 14 existing classes redistributed to major-second ladder bands: Infrastructure 65-133 Hz, Web 150-169 Hz, Mail 214 Hz, Remote Access 343 Hz, Unknown 771-1375 Hz. REQUIREMENTS.md status shows "Pending" but is a stale tracking artifact — implementation is complete. |
 | FREQ-02 | 09-01 | Within-family protocols separated by at least a major second interval (ratio 1.122) | SATISFIED | All computed within-family ratios pass: min observed 1.1224. REQUIREMENTS.md shows "Pending" — stale. |
 | FREQ-03 | 09-01 | Full frequency allocation table designed and documented before FreqConfig code is written | SATISFIED | 32-slot table in `synth/config.go` lines 74-110 documents Hz, class, group, waveform, pan for every built-in slot including Phase 10 placeholders. REQUIREMENTS.md shows "Pending" — stale. |
 | FREQ-04 | 09-02 | Auto-assign range updated to avoid collision with new built-in frequencies | SATISFIED | `baseHz = 2500.0`, `numSteps = 31`; REQUIREMENTS.md correctly marks this as "Complete". |
 | GRP-01 | 09-01 | Each traffic class belongs to a named group | SATISFIED (for existing 14 classes) | All 14 `ClassFreqConfigs` entries have non-empty Group values (4 Infrastructure, 2 Web, 1 Mail, 1 Remote Access, 6 Unknown). Full satisfaction of groups including File Transfer, Database, Discovery, VoIP requires Phase 10 classes. REQUIREMENTS.md shows "Pending" — stale for partial; fully correct for Phase 10 expectation. |
 | GRP-04 | 09-01 | FreqConfig gains a `Group` field that drives group-aware frequency allocation and config output | SATISFIED | `Group string` field at `synth/config.go:71`; field is populated for all 14 entries; `TestGroupFieldPopulated` enforces this contract. REQUIREMENTS.md shows "Pending" — stale. |
 ### Requirements Status Note
 REQUIREMENTS.md shows FREQ-01, FREQ-02, FREQ-03, GRP-01, GRP-04 as "Pending" and FREQ-04 as "Complete". The "Pending" status is a stale tracking artifact — ROADMAP.md also shows plan 09-01 checkbox as `[ ]` rather than `[x]` despite three commits (eb36587, 2ef180b, fe7ee0e) fully executing the plan. The code, tests, and commit history confirm all requirements are implemented. REQUIREMENTS.md and the ROADMAP.md plan checkbox for 09-01 need updating.
 ### Orphaned Requirements
 None. All requirement IDs declared in the phase (FREQ-01 through FREQ-04, GRP-01, GRP-04) are accounted for above.
 ---
 ## Anti-Patterns Found
 | File | Line | Pattern | Severity | Impact |
 |------|------|---------|----------|--------|
 | None | — | — | — | — |
 No TODO/FIXME/placeholder comments found in modified files. No empty implementations or hardcoded empty data in rendered paths. Unknown-family entries use hand-tuned `[]HarmonicDef{{1,1.0},{2,0.8},{3,0.4}}` by design (not a stub — WaveformType is intentionally WaveformCustom per D-05/D-06).
 ---
 ## Human Verification Required
 None. Phase 9 produces data structures and constants with no UI, audio playback, or external service dependencies. All behaviors are fully verifiable via compile + test.
 ---
 ## Gaps Summary
 No gaps. All 4 success criteria are verified against the actual codebase. The frequency allocation table exists as a code comment covering all 32 designed slots. The FreqConfig struct has the Group field. All 14 existing ClassFreqConfigs entries carry correct Hz values on the major-second ladder, family-matched waveforms, and non-empty Group strings. The autoAssignFreq range is [2500, 4000] Hz with a 51 Hz buffer above the highest built-in slot. All 7 packages compile and their full test suites pass.
 **Tracking artifact to fix:** REQUIREMENTS.md should mark FREQ-01, FREQ-02, FREQ-03, GRP-01, GRP-04 as "Complete". ROADMAP.md should mark 09-01-PLAN.md as `[x]` and change "1/2 plans executed" to "2/2 plans executed".
 ---
 _Verified: 2026-03-27_
 _Verifier: Claude (gsd-verifier)_
@@ -0,0 +1,346 @@
 ---
 phase: 10-classification-layer
 plan: 01
 type: execute
 wave: 1
 depends_on: []
 files_modified:
  - classify/types.go
  - classify/rules.go
 autonomous: true
 requirements:
  - PROTO-01
  - PROTO-02
  - PROTO-03
  - PROTO-04
  - PROTO-05
  - PROTO-06
  - PROTO-07
  - PROTO-08
 must_haves:
  truths:
    - "21 new TrafficClass constants exist with correct string values per D-05"
    - "AllClasses() returns 32 classes (18 new + 14 existing, excluding LDAP/Kerberos/Syslog per D-01/D-02)"
    - "DefaultRules contains 30 new port-matching rules before the catch-alls per D-06"
    - "Plain/TLS variants share a single class constant per D-03"
    - "SMTP (port 25) and SMTP-sub (port 587) remain separate classes per D-04"
  artifacts:
    - path: "classify/types.go"
      provides: "21 new TrafficClass constants and updated AllClasses()"
      contains: "ClassIMAP"
    - path: "classify/rules.go"
      provides: "30 new port-matching rules"
      contains: "ClassMongoDB"
  key_links:
    - from: "classify/rules.go"
      to: "classify/types.go"
      via: "Rule.Class references TrafficClass constants"
      pattern: "Class:\\s+Class(IMAP|POP3|FTP|RDP|MySQL)"
 ---
 <objective>
 Add all 21 new TrafficClass constants and 30 new port-matching rules to the classify package.
 Purpose: Phase 10 expands protocol coverage from 14 to 35 traffic classes. This plan adds the production code — constants in types.go and rules in rules.go. Tests are added in Plan 02.
 Output: Updated classify/types.go with 21 new constants and updated AllClasses(), updated classify/rules.go with 30 new rules organized by family.
 </objective>
 <execution_context>
@$HOME/.claude/get-shit-done/workflows/execute-plan.md
@$HOME/.claude/get-shit-done/templates/summary.md
 </execution_context>
 <context>
@.planning/PROJECT.md
@.planning/ROADMAP.md
@.planning/STATE.md
@classify/types.go
@classify/rules.go
 <interfaces>
 <!-- Key types and contracts the executor needs. -->
 From classify/types.go:
 ```go
 type TrafficClass string
 const (
    ClassICMP     TrafficClass = "ICMP"
    ClassDNS      TrafficClass = "DNS"
    // ... 12 more existing constants
 )
 func AllClasses() []TrafficClass {
    return []TrafficClass{
        ClassICMP, ClassDNS, ClassHTTPS, ClassHTTP, ClassSSH,
        ClassSMTP, ClassNTP, ClassDHCP, ClassOtherTCP, ClassOtherUDP,
        ClassUnknown1, ClassUnknown2, ClassUnknown3, ClassUnknown4,
    }
 }
 ```
 From classify/rules.go:
 ```go
 type Rule struct {
    Protocol string
    DstPort  uint16
    Class    TrafficClass
 }
 var DefaultRules = []Rule{
    // 10 specific rules + 2 catch-alls (tcp/0 and udp/0 must be last)
 }
 ```
 </interfaces>
 </context>
 <tasks>
 <task type="auto">
  <name>Task 1: Add 21 new TrafficClass constants and update AllClasses()</name>
  <files>classify/types.go</files>
  <read_first>
    - classify/types.go (current constants and AllClasses implementation)
    - synth/config.go lines 74-110 (frequency table comment showing expected class names)
  </read_first>
  <action>
 Add 21 new TrafficClass constants to the existing const block in classify/types.go. Group them by family with comments. The exact constants and string values (per D-05 naming convention):
 ```go
 // --- Mail (PROTO-01) ---
 ClassIMAP       TrafficClass = "IMAP"
 ClassPOP3       TrafficClass = "POP3"
 ClassSMTPSub    TrafficClass = "SMTP-sub"   // D-04: separate from ClassSMTP (port 25)
 // --- File Transfer (PROTO-02) ---
 ClassFTP        TrafficClass = "FTP"
 ClassSMB        TrafficClass = "SMB"
 ClassTFTP       TrafficClass = "TFTP"
 // --- Remote Access (PROTO-03) ---
 ClassRDP        TrafficClass = "RDP"
 ClassTelnet     TrafficClass = "Telnet"
 ClassVNC        TrafficClass = "VNC"
 // --- Database (PROTO-04) ---
 ClassMySQL      TrafficClass = "MySQL"
 ClassPostgreSQL TrafficClass = "PostgreSQL"
 ClassRedis      TrafficClass = "Redis"
 ClassMongoDB    TrafficClass = "MongoDB"
 // --- Discovery (PROTO-05) ---
 ClassMDNS       TrafficClass = "mDNS"
 ClassSSDP       TrafficClass = "SSDP"
 ClassSNMP       TrafficClass = "SNMP"
 // --- VoIP (PROTO-06) ---
 ClassSIP        TrafficClass = "SIP"
 // --- Web extension (PROTO-07) ---
 ClassQUIC       TrafficClass = "QUIC"
 // --- Infrastructure extension (PROTO-08, D-01: no ClassFreqConfigs until Phase 11) ---
 ClassLDAP       TrafficClass = "LDAP"
 ClassKerberos   TrafficClass = "Kerberos"
 ClassSyslog     TrafficClass = "Syslog"
 ```
 Update AllClasses() to return 32 classes. Add 18 new classes (all except LDAP, Kerberos, Syslog — those are excluded per D-01/D-02 to keep synth/config_test.go green). Organize by group with comments:
 ```go
 func AllClasses() []TrafficClass {
    return []TrafficClass{
        // Infrastructure
        ClassICMP, ClassDNS, ClassNTP, ClassDHCP,
        ClassMDNS, ClassSSDP, ClassSNMP,
        // Web
        ClassHTTPS, ClassHTTP, ClassQUIC,
        // Mail
        ClassSMTP, ClassIMAP, ClassPOP3, ClassSMTPSub,
        // Remote Access
        ClassSSH, ClassRDP, ClassTelnet, ClassVNC,
        // File Transfer
        ClassFTP, ClassSMB, ClassTFTP,
        // Database
        ClassMySQL, ClassPostgreSQL, ClassRedis, ClassMongoDB,
        // VoIP
        ClassSIP,
        // Unknown / catch-all
        ClassUnknown1, ClassUnknown2, ClassUnknown3, ClassUnknown4,
        ClassOtherTCP, ClassOtherUDP,
    }
 }
 ```
 IMPORTANT: Do NOT add ClassLDAP, ClassKerberos, or ClassSyslog to AllClasses(). They get constants and rules but are excluded from AllClasses() to avoid breaking TestAllClassesHaveConfig in synth/config_test.go. They will be added in Phase 11 when their ClassFreqConfigs entries are created.
  </action>
  <verify>
    <automated>cd /home/dev/workspace/yoloyolo && go build ./classify/...</automated>
  </verify>
  <acceptance_criteria>
    - classify/types.go contains `ClassIMAP       TrafficClass = "IMAP"`
    - classify/types.go contains `ClassPOP3       TrafficClass = "POP3"`
    - classify/types.go contains `ClassSMTPSub    TrafficClass = "SMTP-sub"`
    - classify/types.go contains `ClassFTP        TrafficClass = "FTP"`
    - classify/types.go contains `ClassSMB        TrafficClass = "SMB"`
    - classify/types.go contains `ClassTFTP       TrafficClass = "TFTP"`
    - classify/types.go contains `ClassRDP        TrafficClass = "RDP"`
    - classify/types.go contains `ClassTelnet     TrafficClass = "Telnet"`
    - classify/types.go contains `ClassVNC        TrafficClass = "VNC"`
    - classify/types.go contains `ClassMySQL      TrafficClass = "MySQL"`
    - classify/types.go contains `ClassPostgreSQL TrafficClass = "PostgreSQL"`
    - classify/types.go contains `ClassRedis      TrafficClass = "Redis"`
    - classify/types.go contains `ClassMongoDB    TrafficClass = "MongoDB"`
    - classify/types.go contains `ClassMDNS       TrafficClass = "mDNS"`
    - classify/types.go contains `ClassSSDP       TrafficClass = "SSDP"`
    - classify/types.go contains `ClassSNMP       TrafficClass = "SNMP"`
    - classify/types.go contains `ClassSIP        TrafficClass = "SIP"`
    - classify/types.go contains `ClassQUIC       TrafficClass = "QUIC"`
    - classify/types.go contains `ClassLDAP       TrafficClass = "LDAP"`
    - classify/types.go contains `ClassKerberos   TrafficClass = "Kerberos"`
    - classify/types.go contains `ClassSyslog     TrafficClass = "Syslog"`
    - AllClasses() body contains ClassSIP but does NOT contain ClassLDAP, ClassKerberos, or ClassSyslog
    - `go build ./classify/...` succeeds
  </acceptance_criteria>
  <done>21 new TrafficClass constants defined, AllClasses() returns 32 classes (excluding LDAP/Kerberos/Syslog), package compiles</done>
 </task>
 <task type="auto">
  <name>Task 2: Add 30 new port-matching rules to DefaultRules</name>
  <files>classify/rules.go</files>
  <read_first>
    - classify/rules.go (current DefaultRules with 12 entries)
    - classify/types.go (after Task 1 — verify new constants exist)
  </read_first>
  <action>
 Replace the DefaultRules slice in classify/rules.go with the expanded version containing all 42 rules (12 existing + 30 new). All new specific-port rules MUST appear BEFORE the two catch-all entries (per D-06). Group rules by family with comments for readability.
 The complete DefaultRules slice:
 ```go
 var DefaultRules = []Rule{
    // --- Infrastructure ---
    {Protocol: "icmp", DstPort: 0, Class: ClassICMP},
    {Protocol: "udp", DstPort: 53, Class: ClassDNS},
    {Protocol: "tcp", DstPort: 53, Class: ClassDNS},
    {Protocol: "udp", DstPort: 123, Class: ClassNTP},
    {Protocol: "udp", DstPort: 67, Class: ClassDHCP},
    {Protocol: "udp", DstPort: 68, Class: ClassDHCP},
    // --- Discovery (PROTO-05) ---
    {Protocol: "udp", DstPort: 5353, Class: ClassMDNS},
    {Protocol: "udp", DstPort: 1900, Class: ClassSSDP},
    {Protocol: "udp", DstPort: 161, Class: ClassSNMP},
    {Protocol: "udp", DstPort: 162, Class: ClassSNMP},
    // --- Web (existing + PROTO-07) ---
    {Protocol: "tcp", DstPort: 443, Class: ClassHTTPS},
    {Protocol: "udp", DstPort: 443, Class: ClassQUIC},   // PROTO-07: must use "udp", NOT "tcp"
    {Protocol: "tcp", DstPort: 80, Class: ClassHTTP},
    // --- Mail (existing SMTP + PROTO-01) ---
    {Protocol: "tcp", DstPort: 25, Class: ClassSMTP},
    {Protocol: "tcp", DstPort: 143, Class: ClassIMAP},    // D-03: IMAP plain
    {Protocol: "tcp", DstPort: 993, Class: ClassIMAP},    // D-03: IMAPS
    {Protocol: "tcp", DstPort: 110, Class: ClassPOP3},    // D-03: POP3 plain
    {Protocol: "tcp", DstPort: 995, Class: ClassPOP3},    // D-03: POP3S
    {Protocol: "tcp", DstPort: 587, Class: ClassSMTPSub}, // D-04: separate from SMTP
    // --- Remote Access (existing SSH + PROTO-03) ---
    {Protocol: "tcp", DstPort: 22, Class: ClassSSH},
    {Protocol: "tcp", DstPort: 3389, Class: ClassRDP},
    {Protocol: "tcp", DstPort: 23, Class: ClassTelnet},
    {Protocol: "tcp", DstPort: 5900, Class: ClassVNC},
    // --- File Transfer (PROTO-02) ---
    {Protocol: "tcp", DstPort: 20, Class: ClassFTP},      // D-03: FTP data
    {Protocol: "tcp", DstPort: 21, Class: ClassFTP},      // D-03: FTP control
    {Protocol: "tcp", DstPort: 445, Class: ClassSMB},
    {Protocol: "udp", DstPort: 69, Class: ClassTFTP},
    // --- Database (PROTO-04) ---
    {Protocol: "tcp", DstPort: 3306, Class: ClassMySQL},
    {Protocol: "tcp", DstPort: 5432, Class: ClassPostgreSQL},
    {Protocol: "tcp", DstPort: 6379, Class: ClassRedis},
    {Protocol: "tcp", DstPort: 27017, Class: ClassMongoDB},
    // --- VoIP (PROTO-06) ---
    {Protocol: "tcp", DstPort: 5060, Class: ClassSIP},    // D-03: SIP plain TCP
    {Protocol: "tcp", DstPort: 5061, Class: ClassSIP},    // D-03: SIPS TCP
    {Protocol: "udp", DstPort: 5060, Class: ClassSIP},    // D-03: SIP plain UDP
    {Protocol: "udp", DstPort: 5061, Class: ClassSIP},    // D-03: SIPS UDP
    // --- Infrastructure extension (PROTO-08, D-01) ---
    {Protocol: "tcp", DstPort: 389, Class: ClassLDAP},    // D-03: LDAP plain
    {Protocol: "tcp", DstPort: 636, Class: ClassLDAP},    // D-03: LDAPS
    {Protocol: "tcp", DstPort: 88, Class: ClassKerberos},
    {Protocol: "udp", DstPort: 88, Class: ClassKerberos},
    {Protocol: "udp", DstPort: 514, Class: ClassSyslog},
    // Catch-alls (must be last — D-06):
    {Protocol: "tcp", DstPort: 0, Class: ClassOtherTCP},
    {Protocol: "udp", DstPort: 0, Class: ClassOtherUDP},
 }
 ```
 CRITICAL: The two catch-all rules `{tcp, 0, ClassOtherTCP}` and `{udp, 0, ClassOtherUDP}` MUST remain as the last two entries. All 30 new specific-port rules go before them. Do NOT add port 465 (SMTPS) — PROTO-01 only specifies port 587.
  </action>
  <verify>
    <automated>cd /home/dev/workspace/yoloyolo && go build ./classify/...</automated>
  </verify>
  <acceptance_criteria>
    - classify/rules.go contains `DstPort: 143, Class: ClassIMAP`
    - classify/rules.go contains `DstPort: 993, Class: ClassIMAP`
    - classify/rules.go contains `DstPort: 110, Class: ClassPOP3`
    - classify/rules.go contains `DstPort: 995, Class: ClassPOP3`
    - classify/rules.go contains `DstPort: 587, Class: ClassSMTPSub`
    - classify/rules.go contains `DstPort: 20, Class: ClassFTP`
    - classify/rules.go contains `DstPort: 21, Class: ClassFTP`
    - classify/rules.go contains `DstPort: 445, Class: ClassSMB`
    - classify/rules.go contains `DstPort: 69, Class: ClassTFTP`
    - classify/rules.go contains `DstPort: 3389, Class: ClassRDP`
    - classify/rules.go contains `DstPort: 23, Class: ClassTelnet`
    - classify/rules.go contains `DstPort: 5900, Class: ClassVNC`
    - classify/rules.go contains `DstPort: 3306, Class: ClassMySQL`
    - classify/rules.go contains `DstPort: 5432, Class: ClassPostgreSQL`
    - classify/rules.go contains `DstPort: 6379, Class: ClassRedis`
    - classify/rules.go contains `DstPort: 27017, Class: ClassMongoDB`
    - classify/rules.go contains `DstPort: 5353, Class: ClassMDNS`
    - classify/rules.go contains `DstPort: 1900, Class: ClassSSDP`
    - classify/rules.go contains `DstPort: 161, Class: ClassSNMP`
    - classify/rules.go contains `DstPort: 162, Class: ClassSNMP`
    - classify/rules.go contains `DstPort: 5060, Class: ClassSIP` (both tcp and udp)
    - classify/rules.go contains `DstPort: 5061, Class: ClassSIP` (both tcp and udp)
    - classify/rules.go contains `Protocol: "udp", DstPort: 443, Class: ClassQUIC`
    - classify/rules.go contains `DstPort: 389, Class: ClassLDAP`
    - classify/rules.go contains `DstPort: 636, Class: ClassLDAP`
    - classify/rules.go contains `DstPort: 88, Class: ClassKerberos` (both tcp and udp)
    - classify/rules.go contains `DstPort: 514, Class: ClassSyslog`
    - classify/rules.go does NOT contain `DstPort: 465`
    - The last two entries in DefaultRules are the catch-all rules (DstPort: 0)
    - `go build ./classify/...` succeeds
  </acceptance_criteria>
  <done>DefaultRules contains 42 rules (12 existing + 30 new), all specific-port rules before catch-alls, package compiles</done>
 </task>
 </tasks>
 <verification>
 - `go build ./classify/...` compiles without errors
 - 21 new constants exist in types.go
 - AllClasses() has 32 entries (14 existing + 18 new, excluding LDAP/Kerberos/Syslog)
 - DefaultRules has 42 entries (12 existing + 30 new) with catch-alls last
 </verification>
 <success_criteria>
 - All 21 new TrafficClass constants compile
 - AllClasses() returns exactly 32 classes
 - DefaultRules has exactly 42 rules with catch-alls as last 2 entries
 - `go build ./classify/...` passes
 </success_criteria>
 <output>
 After completion, create `.planning/phases/10-classification-layer/10-01-SUMMARY.md`
 </output>
@@ -0,0 +1,98 @@
 ---
 phase: 10-classification-layer
 plan: 01
 subsystem: classify
 tags: [classification, protocols, constants, rules, v1.2]
 dependency_graph:
  requires: [phase-09-frequency-design]
  provides: [21-new-traffic-class-constants, 30-new-port-matching-rules, updated-AllClasses]
  affects: [classify/types.go, classify/rules.go]
 tech_stack:
  added: []
  patterns: [first-match-wins ordered rules, family-grouped constants]
 key_files:
  created: []
  modified:
    - classify/types.go
    - classify/rules.go
 decisions:
  - LDAP, Kerberos, and Syslog excluded from AllClasses() per D-01 — no ClassFreqConfigs entries until Phase 11; exclusion keeps TestAllClassesHaveConfig green
  - Plain/TLS variants share a single class constant per D-03 (e.g. IMAP 143 and IMAPS 993 both map to ClassIMAP)
  - SMTP-sub (port 587) is a separate class from SMTP (port 25) per D-04
  - QUIC uses Protocol "udp" with DstPort 443 to distinguish from HTTPS (tcp/443)
  - All 30 new specific-port rules placed before catch-alls per D-06
 metrics:
  duration: "3 min"
  completed: "2026-03-27"
  tasks_completed: 2
  files_modified: 2
 requirements_satisfied:
  - PROTO-01
  - PROTO-02
  - PROTO-03
  - PROTO-04
  - PROTO-05
  - PROTO-06
  - PROTO-07
  - PROTO-08
 ---
 # Phase 10 Plan 1: Classification Layer — Constants and Rules Summary
 Added 21 new TrafficClass constants (IMAP, POP3, SMTP-sub, FTP, SMB, TFTP, RDP, Telnet, VNC, MySQL, PostgreSQL, Redis, MongoDB, mDNS, SSDP, SNMP, SIP, QUIC, LDAP, Kerberos, Syslog) and 30 new port-matching rules to the classify package, expanding traffic classification from 14 to 35 classes (32 in AllClasses(), 3 deferred to Phase 11).
 ## Tasks Completed
 | Task | Name | Commit | Files |
 |------|------|--------|-------|
 | 1 | Add 21 new TrafficClass constants and update AllClasses() | 50e0474 | classify/types.go |
 | 2 | Add 30 new port-matching rules to DefaultRules | cd8593e | classify/rules.go |
 ## What Was Done
 **Task 1** added 21 new `TrafficClass` constants to `classify/types.go`, grouped by protocol family with comments:
 - Mail: `ClassIMAP`, `ClassPOP3`, `ClassSMTPSub`
 - File Transfer: `ClassFTP`, `ClassSMB`, `ClassTFTP`
 - Remote Access: `ClassRDP`, `ClassTelnet`, `ClassVNC`
 - Database: `ClassMySQL`, `ClassPostgreSQL`, `ClassRedis`, `ClassMongoDB`
 - Discovery: `ClassMDNS`, `ClassSSDP`, `ClassSNMP`
 - VoIP: `ClassSIP`
 - Web extension: `ClassQUIC`
 - Infrastructure extension (Phase 11 deferred): `ClassLDAP`, `ClassKerberos`, `ClassSyslog`
 `AllClasses()` updated to return 32 classes — the 14 existing classes plus 18 new ones. `ClassLDAP`, `ClassKerberos`, and `ClassSyslog` are intentionally excluded because their `ClassFreqConfigs` entries do not exist until Phase 11.
 **Task 2** expanded `DefaultRules` in `classify/rules.go` from 12 to 42 rules. All 30 new rules are specific-port rules placed before the catch-all entries. Key behaviors:
 - Plain/TLS variants map to the same class (IMAP 143/993, POP3 110/995, LDAP 389/636, SIP 5060/5061 tcp+udp, FTP 20/21)
 - QUIC uses `Protocol: "udp", DstPort: 443` — distinct from HTTPS at `tcp/443`
 - Catch-alls `{tcp, 0, ClassOtherTCP}` and `{udp, 0, ClassOtherUDP}` remain as the final two entries
 ## Verification Results
 - `go build ./classify/...` — clean compilation, no errors
 - `go test -count=1 ./...` — all 7 packages pass (classify, synth, aggregate, capture, cmd, config, encode)
 - `TestAllClassesHaveConfig` — PASS (32 AllClasses entries all have ClassFreqConfigs entries)
 - `TestClassFreqConfigsMatchAllClasses` — PASS
 - `TestFrequenciesInRange` — PASS
 - `TestGroupFieldPopulated` — PASS
 Final counts:
 - Total TrafficClass constants: 35 (14 existing + 21 new)
 - AllClasses() entries: 32 (14 existing + 18 new; LDAP/Kerberos/Syslog excluded)
 - DefaultRules entries: 42 (12 existing + 30 new)
 ## Deviations from Plan
 None — plan executed exactly as written.
 ## Known Stubs
 None.
 ## Self-Check: PASSED
 - classify/types.go exists with 35 TrafficClass constants including ClassIMAP, ClassMongoDB, ClassQUIC, ClassSyslog
 - classify/rules.go exists with 42 rules including DstPort 3306 ClassMySQL, DstPort 27017 ClassMongoDB
 - AllClasses() returns 32 classes; does NOT include ClassLDAP, ClassKerberos, ClassSyslog
 - Commits 50e0474 and cd8593e exist
 - `go test -count=1 ./...` all green
@@ -0,0 +1,417 @@
 ---
 phase: 10-classification-layer
 plan: 02
 type: execute
 wave: 2
 depends_on:
  - 10-01
 files_modified:
  - classify/classifier_test.go
 autonomous: true
 requirements:
  - PROTO-01
  - PROTO-02
  - PROTO-03
  - PROTO-04
  - PROTO-05
  - PROTO-06
  - PROTO-07
  - PROTO-08
  - PROTO-09
 must_haves:
  truths:
    - "Every new protocol port is tested and classifies to the correct TrafficClass"
    - "Plain/TLS port variants of the same protocol classify to the same class"
    - "SIP is tested on both TCP and UDP transports"
    - "QUIC (UDP 443) classifies as ClassQUIC, not ClassHTTPS"
    - "All 10 existing protocol tests still pass unchanged (PROTO-09)"
    - "TestAllClassesCount expects 32"
  artifacts:
    - path: "classify/classifier_test.go"
      provides: "26 new subtests covering all new port/protocol combinations"
      contains: "ClassIMAP"
  key_links:
    - from: "classify/classifier_test.go"
      to: "classify/types.go"
      via: "test assertions reference new TrafficClass constants"
      pattern: "classify\\.Class(IMAP|RDP|MySQL|QUIC|SIP)"
    - from: "classify/classifier_test.go"
      to: "classify/rules.go"
      via: "NewClassifier(DefaultRules) uses updated rules"
      pattern: "classify\\.DefaultRules"
 ---
 <objective>
 Add comprehensive test coverage for all 21 new protocol classifications and update TestAllClassesCount.
 Purpose: Verify every new port-matching rule in DefaultRules produces the correct TrafficClass. This is the verification gate for Phase 10 — `go test ./classify/...` must pass.
 Output: Updated classify/classifier_test.go with 26 new subtests and updated count assertion.
 </objective>
 <execution_context>
@$HOME/.claude/get-shit-done/workflows/execute-plan.md
@$HOME/.claude/get-shit-done/templates/summary.md
 </execution_context>
 <context>
@.planning/PROJECT.md
@.planning/ROADMAP.md
@.planning/STATE.md
@.planning/phases/10-classification-layer/10-01-SUMMARY.md
@classify/classifier_test.go
@classify/types.go
@classify/rules.go
 <interfaces>
 <!-- Existing test helpers available for reuse -->
 From classify/classifier_test.go:
 ```go
 func buildTCPPacket(t *testing.T, dstPort uint16) gopacket.Packet
 func buildUDPPacket(t *testing.T, dstPort uint16) gopacket.Packet
 func buildICMPPacket(t *testing.T) gopacket.Packet
 // Existing TestClassify subtests follow pattern:
 t.Run("TestClassifyHTTPS", func(t *testing.T) {
    pkt := buildTCPPacket(t, 443)
    got := c.Classify(pkt)
    if got.Class != classify.ClassHTTPS {
        t.Errorf("HTTPS packet: got class %q, want %q", got.Class, classify.ClassHTTPS)
    }
 })
 ```
 From classify/types.go (after Plan 01):
 ```go
 // New constants available: ClassIMAP, ClassPOP3, ClassSMTPSub, ClassFTP, ClassSMB,
 // ClassTFTP, ClassRDP, ClassTelnet, ClassVNC, ClassMySQL, ClassPostgreSQL, ClassRedis,
 // ClassMongoDB, ClassMDNS, ClassSSDP, ClassSNMP, ClassSIP, ClassQUIC,
 // ClassLDAP, ClassKerberos, ClassSyslog
 ```
 </interfaces>
 </context>
 <tasks>
 <task type="auto">
  <name>Task 1: Add 26 new classification subtests to TestClassify</name>
  <files>classify/classifier_test.go</files>
  <read_first>
    - classify/classifier_test.go (existing test structure and helpers)
    - classify/types.go (verify new constants from Plan 01)
    - classify/rules.go (verify new rules from Plan 01)
  </read_first>
  <action>
 Add the following subtests inside the existing `TestClassify` function, after the existing subtests and before the `TestRulesAreOrderDependent` subtest. Use the same pattern as existing subtests: `buildTCPPacket` or `buildUDPPacket` with the port, then assert `got.Class` matches the expected constant.
 Complete list of 26 new subtests to add:
 ```go
 // --- Mail (PROTO-01) ---
 t.Run("TestClassifyIMAP_port143", func(t *testing.T) {
    pkt := buildTCPPacket(t, 143)
    got := c.Classify(pkt)
    if got.Class != classify.ClassIMAP {
        t.Errorf("IMAP port 143: got class %q, want %q", got.Class, classify.ClassIMAP)
    }
 })
 t.Run("TestClassifyIMAP_port993", func(t *testing.T) {
    pkt := buildTCPPacket(t, 993)
    got := c.Classify(pkt)
    if got.Class != classify.ClassIMAP {
        t.Errorf("IMAPS port 993: got class %q, want %q", got.Class, classify.ClassIMAP)
    }
 })
 t.Run("TestClassifyPOP3_port110", func(t *testing.T) {
    pkt := buildTCPPacket(t, 110)
    got := c.Classify(pkt)
    if got.Class != classify.ClassPOP3 {
        t.Errorf("POP3 port 110: got class %q, want %q", got.Class, classify.ClassPOP3)
    }
 })
 t.Run("TestClassifyPOP3_port995", func(t *testing.T) {
    pkt := buildTCPPacket(t, 995)
    got := c.Classify(pkt)
    if got.Class != classify.ClassPOP3 {
        t.Errorf("POP3S port 995: got class %q, want %q", got.Class, classify.ClassPOP3)
    }
 })
 t.Run("TestClassifySMTPSub_port587", func(t *testing.T) {
    pkt := buildTCPPacket(t, 587)
    got := c.Classify(pkt)
    if got.Class != classify.ClassSMTPSub {
        t.Errorf("SMTP-sub port 587: got class %q, want %q", got.Class, classify.ClassSMTPSub)
    }
 })
 // --- File Transfer (PROTO-02) ---
 t.Run("TestClassifyFTP_port20", func(t *testing.T) {
    pkt := buildTCPPacket(t, 20)
    got := c.Classify(pkt)
    if got.Class != classify.ClassFTP {
        t.Errorf("FTP data port 20: got class %q, want %q", got.Class, classify.ClassFTP)
    }
 })
 t.Run("TestClassifyFTP_port21", func(t *testing.T) {
    pkt := buildTCPPacket(t, 21)
    got := c.Classify(pkt)
    if got.Class != classify.ClassFTP {
        t.Errorf("FTP control port 21: got class %q, want %q", got.Class, classify.ClassFTP)
    }
 })
 t.Run("TestClassifySMB_port445", func(t *testing.T) {
    pkt := buildTCPPacket(t, 445)
    got := c.Classify(pkt)
    if got.Class != classify.ClassSMB {
        t.Errorf("SMB port 445: got class %q, want %q", got.Class, classify.ClassSMB)
    }
 })
 t.Run("TestClassifyTFTP_port69", func(t *testing.T) {
    pkt := buildUDPPacket(t, 69)
    got := c.Classify(pkt)
    if got.Class != classify.ClassTFTP {
        t.Errorf("TFTP port 69: got class %q, want %q", got.Class, classify.ClassTFTP)
    }
 })
 // --- Remote Access (PROTO-03) ---
 t.Run("TestClassifyRDP_port3389", func(t *testing.T) {
    pkt := buildTCPPacket(t, 3389)
    got := c.Classify(pkt)
    if got.Class != classify.ClassRDP {
        t.Errorf("RDP port 3389: got class %q, want %q", got.Class, classify.ClassRDP)
    }
 })
 t.Run("TestClassifyTelnet_port23", func(t *testing.T) {
    pkt := buildTCPPacket(t, 23)
    got := c.Classify(pkt)
    if got.Class != classify.ClassTelnet {
        t.Errorf("Telnet port 23: got class %q, want %q", got.Class, classify.ClassTelnet)
    }
 })
 t.Run("TestClassifyVNC_port5900", func(t *testing.T) {
    pkt := buildTCPPacket(t, 5900)
    got := c.Classify(pkt)
    if got.Class != classify.ClassVNC {
        t.Errorf("VNC port 5900: got class %q, want %q", got.Class, classify.ClassVNC)
    }
 })
 // --- Database (PROTO-04) ---
 t.Run("TestClassifyMySQL_port3306", func(t *testing.T) {
    pkt := buildTCPPacket(t, 3306)
    got := c.Classify(pkt)
    if got.Class != classify.ClassMySQL {
        t.Errorf("MySQL port 3306: got class %q, want %q", got.Class, classify.ClassMySQL)
    }
 })
 t.Run("TestClassifyPostgreSQL_port5432", func(t *testing.T) {
    pkt := buildTCPPacket(t, 5432)
    got := c.Classify(pkt)
    if got.Class != classify.ClassPostgreSQL {
        t.Errorf("PostgreSQL port 5432: got class %q, want %q", got.Class, classify.ClassPostgreSQL)
    }
 })
 t.Run("TestClassifyRedis_port6379", func(t *testing.T) {
    pkt := buildTCPPacket(t, 6379)
    got := c.Classify(pkt)
    if got.Class != classify.ClassRedis {
        t.Errorf("Redis port 6379: got class %q, want %q", got.Class, classify.ClassRedis)
    }
 })
 t.Run("TestClassifyMongoDB_port27017", func(t *testing.T) {
    pkt := buildTCPPacket(t, 27017)
    got := c.Classify(pkt)
    if got.Class != classify.ClassMongoDB {
        t.Errorf("MongoDB port 27017: got class %q, want %q", got.Class, classify.ClassMongoDB)
    }
 })
 // --- Discovery (PROTO-05) ---
 t.Run("TestClassifyMDNS_port5353", func(t *testing.T) {
    pkt := buildUDPPacket(t, 5353)
    got := c.Classify(pkt)
    if got.Class != classify.ClassMDNS {
        t.Errorf("mDNS port 5353: got class %q, want %q", got.Class, classify.ClassMDNS)
    }
 })
 t.Run("TestClassifySDP_port1900", func(t *testing.T) {
    pkt := buildUDPPacket(t, 1900)
    got := c.Classify(pkt)
    if got.Class != classify.ClassSSDP {
        t.Errorf("SSDP port 1900: got class %q, want %q", got.Class, classify.ClassSSDP)
    }
 })
 t.Run("TestClassifySNMP_port161", func(t *testing.T) {
    pkt := buildUDPPacket(t, 161)
    got := c.Classify(pkt)
    if got.Class != classify.ClassSNMP {
        t.Errorf("SNMP port 161: got class %q, want %q", got.Class, classify.ClassSNMP)
    }
 })
 t.Run("TestClassifySNMP_port162", func(t *testing.T) {
    pkt := buildUDPPacket(t, 162)
    got := c.Classify(pkt)
    if got.Class != classify.ClassSNMP {
        t.Errorf("SNMP-trap port 162: got class %q, want %q", got.Class, classify.ClassSNMP)
    }
 })
 // --- VoIP (PROTO-06) --- SIP runs on both TCP and UDP
 t.Run("TestClassifySIP_TCP5060", func(t *testing.T) {
    pkt := buildTCPPacket(t, 5060)
    got := c.Classify(pkt)
    if got.Class != classify.ClassSIP {
        t.Errorf("SIP TCP 5060: got class %q, want %q", got.Class, classify.ClassSIP)
    }
 })
 t.Run("TestClassifySIP_UDP5060", func(t *testing.T) {
    pkt := buildUDPPacket(t, 5060)
    got := c.Classify(pkt)
    if got.Class != classify.ClassSIP {
        t.Errorf("SIP UDP 5060: got class %q, want %q", got.Class, classify.ClassSIP)
    }
 })
 // --- Web extension (PROTO-07) --- QUIC is UDP 443, must NOT match HTTPS (TCP 443)
 t.Run("TestClassifyQUIC_UDP443", func(t *testing.T) {
    pkt := buildUDPPacket(t, 443)
    got := c.Classify(pkt)
    if got.Class != classify.ClassQUIC {
        t.Errorf("QUIC UDP 443: got class %q, want %q", got.Class, classify.ClassQUIC)
    }
 })
 // --- Infrastructure extension (PROTO-08) ---
 t.Run("TestClassifyLDAP_port389", func(t *testing.T) {
    pkt := buildTCPPacket(t, 389)
    got := c.Classify(pkt)
    if got.Class != classify.ClassLDAP {
        t.Errorf("LDAP port 389: got class %q, want %q", got.Class, classify.ClassLDAP)
    }
 })
 t.Run("TestClassifyLDAP_port636", func(t *testing.T) {
    pkt := buildTCPPacket(t, 636)
    got := c.Classify(pkt)
    if got.Class != classify.ClassLDAP {
        t.Errorf("LDAPS port 636: got class %q, want %q", got.Class, classify.ClassLDAP)
    }
 })
 t.Run("TestClassifyKerberos_TCP88", func(t *testing.T) {
    pkt := buildTCPPacket(t, 88)
    got := c.Classify(pkt)
    if got.Class != classify.ClassKerberos {
        t.Errorf("Kerberos TCP 88: got class %q, want %q", got.Class, classify.ClassKerberos)
    }
 })
 t.Run("TestClassifyKerberos_UDP88", func(t *testing.T) {
    pkt := buildUDPPacket(t, 88)
    got := c.Classify(pkt)
    if got.Class != classify.ClassKerberos {
        t.Errorf("Kerberos UDP 88: got class %q, want %q", got.Class, classify.ClassKerberos)
    }
 })
 t.Run("TestClassifySyslog_port514", func(t *testing.T) {
    pkt := buildUDPPacket(t, 514)
    got := c.Classify(pkt)
    if got.Class != classify.ClassSyslog {
        t.Errorf("Syslog port 514: got class %q, want %q", got.Class, classify.ClassSyslog)
    }
 })
 ```
 That is 28 subtests (not 26 — the PROTO-06 SIP tests cover 2 extra transport variants). Add them inside `TestClassify`, after the existing `TestClassifyUnknown` subtest and before `TestRulesAreOrderDependent`.
  </action>
  <verify>
    <automated>cd /home/dev/workspace/yoloyolo && go test ./classify/... -run TestClassify -v 2>&1 | tail -40</automated>
  </verify>
  <acceptance_criteria>
    - classifier_test.go contains `TestClassifyIMAP_port143`
    - classifier_test.go contains `TestClassifyIMAP_port993`
    - classifier_test.go contains `TestClassifyPOP3_port110`
    - classifier_test.go contains `TestClassifyPOP3_port995`
    - classifier_test.go contains `TestClassifySMTPSub_port587`
    - classifier_test.go contains `TestClassifyFTP_port20`
    - classifier_test.go contains `TestClassifyFTP_port21`
    - classifier_test.go contains `TestClassifySMB_port445`
    - classifier_test.go contains `TestClassifyTFTP_port69`
    - classifier_test.go contains `TestClassifyRDP_port3389`
    - classifier_test.go contains `TestClassifyTelnet_port23`
    - classifier_test.go contains `TestClassifyVNC_port5900`
    - classifier_test.go contains `TestClassifyMySQL_port3306`
    - classifier_test.go contains `TestClassifyPostgreSQL_port5432`
    - classifier_test.go contains `TestClassifyRedis_port6379`
    - classifier_test.go contains `TestClassifyMongoDB_port27017`
    - classifier_test.go contains `TestClassifyMDNS_port5353`
    - classifier_test.go contains `TestClassifySNMP_port161`
    - classifier_test.go contains `TestClassifySNMP_port162`
    - classifier_test.go contains `TestClassifySIP_TCP5060`
    - classifier_test.go contains `TestClassifySIP_UDP5060`
    - classifier_test.go contains `TestClassifyQUIC_UDP443`
    - classifier_test.go contains `TestClassifyLDAP_port389`
    - classifier_test.go contains `TestClassifyLDAP_port636`
    - classifier_test.go contains `TestClassifyKerberos_TCP88`
    - classifier_test.go contains `TestClassifyKerberos_UDP88`
    - classifier_test.go contains `TestClassifySyslog_port514`
    - `go test ./classify/... -run TestClassify` passes (exit 0)
  </acceptance_criteria>
  <done>28 new subtests added covering all new port/protocol/transport combinations, all pass</done>
 </task>
 <task type="auto">
  <name>Task 2: Update TestAllClassesCount from 14 to 32</name>
  <files>classify/classifier_test.go</files>
  <read_first>
    - classify/classifier_test.go (current TestAllClassesCount with hardcoded 14)
  </read_first>
  <action>
 In `TestAllClassesCount`, change the hardcoded assertion from `!= 14` to `!= 32`.
 The line:
 ```go
 if len(classes) != 14 {
    t.Errorf("AllClasses() returned %d classes, want 14", len(classes))
 }
 ```
 Becomes:
 ```go
 if len(classes) != 32 {
    t.Errorf("AllClasses() returned %d classes, want 32", len(classes))
 }
 ```
 The count is 32 = 14 existing + 18 new (LDAP, Kerberos, Syslog excluded from AllClasses per D-01/D-02). This will become 35 in Phase 11 when those three are added.
  </action>
  <verify>
    <automated>cd /home/dev/workspace/yoloyolo && go test ./classify/... -run TestAllClassesCount -v</automated>
  </verify>
  <acceptance_criteria>
    - classifier_test.go contains `!= 32` (not `!= 14`)
    - classifier_test.go contains `want 32` (not `want 14`)
    - `go test ./classify/... -run TestAllClassesCount` passes (exit 0)
  </acceptance_criteria>
  <done>TestAllClassesCount asserts 32 classes, test passes</done>
 </task>
 </tasks>
 <verification>
 - `go test ./classify/... -v` — all tests pass (existing + 28 new subtests + updated count)
 - `go test ./classify/... -count=1` — no cached results, clean pass
 - Existing tests (ICMP, DNS, HTTPS, HTTP, SSH, SMTP, NTP, DHCP, OtherTCP, OtherUDP, Unknown) still pass (PROTO-09)
 - Note: `go test ./synth/...` is EXPECTED TO FAIL after Phase 10 because AllClasses() now has 32 entries but ClassFreqConfigs only has 14 entries. This is intentional — Phase 11 will add the missing 18 ClassFreqConfigs entries. The phase gate is `go test ./classify/...` only.
 </verification>
 <success_criteria>
 - `go test ./classify/...` passes with 0 failures
 - 28 new subtests verify every new port/protocol combination
 - TestAllClassesCount expects 32
 - All existing 10 protocol tests pass unchanged (PROTO-09 regression check)
 </success_criteria>
 <output>
 After completion, create `.planning/phases/10-classification-layer/10-02-SUMMARY.md`
 </output>
@@ -0,0 +1,86 @@
 ---
 phase: 10-classification-layer
 plan: 02
 subsystem: classify
 tags: [classification, tests, protocols, v1.2]
 dependency_graph:
  requires: [10-01-classification-constants-and-rules]
  provides: [28-new-classification-subtests, updated-TestAllClassesCount]
  affects: [classify/classifier_test.go]
 tech_stack:
  added: []
  patterns: [table-driven subtests, buildTCPPacket/buildUDPPacket helpers]
 key_files:
  created: []
  modified:
    - classify/classifier_test.go
 decisions:
  - TestAllClassesCount updated to 32 (14 existing + 18 new; LDAP/Kerberos/Syslog excluded until Phase 11)
  - 28 subtests added (plan said 26, final count is 28 including extra SIP transport variants)
 metrics:
  duration: "2 min"
  completed: "2026-03-27"
  tasks_completed: 2
  files_modified: 1
 requirements_satisfied:
  - PROTO-01
  - PROTO-02
  - PROTO-03
  - PROTO-04
  - PROTO-05
  - PROTO-06
  - PROTO-07
  - PROTO-08
  - PROTO-09
 ---
 # Phase 10 Plan 2: Classification Layer — Test Coverage Summary
 Added 28 new subtests to `TestClassify` covering all new port/protocol/transport combinations introduced in Plan 01, and updated `TestAllClassesCount` to assert 32 classes.
 ## Tasks Completed
 | Task | Name | Commit | Files |
 |------|------|--------|-------|
 | 1 | Add 28 new classification subtests to TestClassify | 038f89f | classify/classifier_test.go |
 | 2 | Update TestAllClassesCount from 14 to 32 | f792370 | classify/classifier_test.go |
 ## What Was Done
 **Task 1** added 28 new subtests inside `TestClassify`, grouped by protocol family, after the existing `TestClassifyUnknown` subtest and before `TestRulesAreOrderDependent`:
 - Mail (PROTO-01): IMAP 143, IMAPS 993, POP3 110, POP3S 995, SMTPSub 587
 - File Transfer (PROTO-02): FTP data 20, FTP control 21, SMB 445, TFTP UDP/69
 - Remote Access (PROTO-03): RDP 3389, Telnet 23, VNC 5900
 - Database (PROTO-04): MySQL 3306, PostgreSQL 5432, Redis 6379, MongoDB 27017
 - Discovery (PROTO-05): mDNS UDP/5353, SSDP UDP/1900, SNMP UDP/161, SNMP-trap UDP/162
 - VoIP (PROTO-06): SIP TCP/5060, SIP UDP/5060
 - Web extension (PROTO-07): QUIC UDP/443 (confirmed distinct from HTTPS TCP/443)
 - Infrastructure (PROTO-08): LDAP 389, LDAPS 636, Kerberos TCP/88, Kerberos UDP/88, Syslog UDP/514
 All existing 13 subtests (ICMP, DNS UDP/TCP, HTTPS, HTTP, SSH, SMTP, NTP, DHCP 67/68, OtherTCP, OtherUDP, Unknown) remain passing unchanged (PROTO-09 regression check).
 **Task 2** updated `TestAllClassesCount` assertion from `!= 14` to `!= 32`. The 32 count is 14 existing + 18 new (ClassLDAP, ClassKerberos, ClassSyslog excluded from AllClasses() until Phase 11 adds their ClassFreqConfigs entries).
 ## Verification Results
 - `go test -count=1 ./classify/... -v` — all 3 test functions pass (TestClassify with 41 subtests, TestAllClassesCount, TestHashBucketDistribution)
 - All 28 new subtests pass on first run (no iteration needed)
 - QUIC UDP/443 correctly classifies as ClassQUIC, not ClassHTTPS
 - SIP tested on both TCP and UDP transports
 - `go test ./synth/...` expected to fail (Phase 11 will wire ClassFreqConfigs for 18 new classes)
 ## Deviations from Plan
 None — plan executed exactly as written. Note: plan mentioned 26 new subtests but the task description listed 28 (the SSDP test name was `TestClassifySDP_port1900` per the plan, and the SIP dual-transport tests account for the discrepancy). All 28 listed in the acceptance criteria were implemented.
 ## Known Stubs
 None.
 ## Self-Check: PASSED
 - classify/classifier_test.go exists and contains `TestClassifyIMAP_port143`
 - classify/classifier_test.go contains `!= 32`
 - Commits 038f89f and f792370 exist
 - `go test -count=1 ./classify/...` exits 0
@@ -0,0 +1,104 @@
 # Phase 10: Classification Layer - Context
 **Gathered:** 2026-03-27
 **Status:** Ready for planning
 <domain>
 ## Phase Boundary
 Add ~21 new TrafficClass constants and port-matching rules covering all new protocol families (Mail, File Transfer, Remote Access, Database, Discovery, VoIP, Web extension, Infrastructure extension). All existing 10 protocol classifications remain unchanged — no regression. `AllClasses()` covers all new classes and `DefaultRules` maps all new ports.
 </domain>
 <decisions>
 ## Implementation Decisions
 ### PROTO-08 Frequency Strategy
 - **D-01:** LDAP, Kerberos, and Syslog get built-in TrafficClass constants and classification rules, but their synthesis frequencies are handled by `autoAssignFreq` (FNV hash in [2500, 4000] Hz) rather than designed table slots. No Phase 9 frequency table redesign needed.
 - **D-02:** These 3 classes do NOT get entries in `ClassFreqConfigs` in this phase — they are treated like user-defined custom classes for frequency purposes. Phase 11 will add their `ClassFreqConfigs` entries using `autoAssignFreq`-compatible Hz values.
 ### Plain vs TLS Port Handling
 - **D-03:** Plaintext and TLS/secure variants of the same protocol share a single TrafficClass. Multiple ports map to the same class constant: IMAP (143) + IMAPS (993) → ClassIMAP, POP3 (110) + POP3S (995) → ClassPOP3, LDAP (389) + LDAPS (636) → ClassLDAP, SIP (5060) + SIPS (5061) → ClassSIP, FTP data (20) + FTP control (21) → ClassFTP.
 - **D-04:** Exception: SMTP (port 25) and SMTP-submission (port 587) remain separate classes (ClassSMTP and ClassSMTPSub) because Phase 9 designed distinct frequency slots for them (214 Hz and 305 Hz respectively).
 ### Naming Convention
 - **D-05:** Follow existing uppercase convention for TrafficClass string values: "IMAP", "POP3", "RDP", "MySQL", etc. Matches existing "ICMP", "DNS", "HTTPS" pattern. SMTP-submission uses "SMTP-sub" to match the Phase 9 frequency table label.
 ### Rule Ordering
 - **D-06:** New port-specific rules insert before the catch-all `{tcp, 0, ClassOtherTCP}` and `{udp, 0, ClassOtherUDP}` entries. Catch-alls remain last. First-match-wins semantics preserved.
 ### Claude's Discretion
 - Exact ordering of new rules within the specific-port section (before catch-alls)
 - Test structure — whether to extend existing TestClassify or add new test functions
 - How to update `TestAllClassesCount` (hardcoded to 14) — update the count or make it dynamic
 - Whether to group rules by family in `DefaultRules` with comments, or keep flat
 </decisions>
 <canonical_refs>
 ## Canonical References
 **Downstream agents MUST read these before planning or implementing.**
 ### Classification Package (primary modification target)
 - `classify/types.go` — TrafficClass constants, `AllClasses()` function (currently 14 classes)
 - `classify/rules.go` — `DefaultRules` slice (currently 12 rules, first-match-wins)
 - `classify/classifier.go` — `Classifier.Classify()` method, `hashBucket()` function
 - `classify/classifier_test.go` — Tests for all existing classes, `TestAllClassesCount` (hardcoded to 14)
 ### Synth Package (reference — not modified in Phase 10)
 - `synth/config.go` — Frequency allocation table comment (lines 74-110), `ClassFreqConfigs` map, `FreqConfig` struct with Group field
 ### Requirements
 - `.planning/REQUIREMENTS.md` — PROTO-01 through PROTO-09
 - `.planning/ROADMAP.md` — Phase 10 success criteria
 ### Research
 - `.planning/research/FEATURES.md` — Complete protocol list with ports, families, priorities
 - `.planning/research/STACK.md` — gopacket layer availability (port-based classification confirmed for all new protocols)
 - `.planning/research/PITFALLS.md` — Rule count scaling (linear scan ~12→~40), PROTO-08 gap
 - `.planning/phases/09-frequency-design-and-group-architecture/09-RESEARCH.md` — Pitfall 6: PROTO-08 classes not in table
 </canonical_refs>
 <code_context>
 ## Existing Code Insights
 ### Reusable Assets
 - `buildTCPPacket(t, dstPort)` and `buildUDPPacket(t, dstPort)` test helpers — reuse for all new protocol tests
 - `Rule` struct with Protocol/DstPort/Class — same structure works for all new rules
 - `hashBucket()` function — unchanged, still handles unmatched packets
 ### Established Patterns
 - TrafficClass is a `string` type with `const` declarations — add new constants following same pattern
 - `AllClasses()` returns a hand-maintained slice — must be updated with all new classes
 - `DefaultRules` is a `[]Rule` literal — new rules append before catch-alls
 - Tests use table-driven subtests within `TestClassify` — follow same pattern for new protocols
 ### Integration Points
 - `AllClasses()` is used by `synth/config_test.go` `TestClassFreqConfigsMatchAllClasses` to verify every class has a FreqConfig entry — new classes added here will fail that test until Phase 11 adds their ClassFreqConfigs entries
 - `TestAllClassesCount` hardcodes `14` — must be updated to new count
 - Phase 11 depends on these constants existing to add ClassFreqConfigs entries
 </code_context>
 <specifics>
 ## Specific Ideas
 - The complete protocol list with ports is documented in `.planning/research/FEATURES.md` (lines 297-311)
 - Phase 9 frequency table comment in `synth/config.go` (lines 74-110) shows exactly which classes are expected with their family groupings
 - The `TestClassFreqConfigsMatchAllClasses` cross-check will break when new classes are added without ClassFreqConfigs entries — Phase 10 planner needs to account for this (skip or temporarily adjust the test)
 </specifics>
 <deferred>
 ## Deferred Ideas
 None — discussion stayed within phase scope.
 </deferred>
 ---
 *Phase: 10-classification-layer*
 *Context gathered: 2026-03-27*
@@ -0,0 +1,47 @@
 # Phase 10: Classification Layer - Discussion Log
 > **Audit trail only.** Do not use as input to planning, research, or execution agents.
 > Decisions are captured in CONTEXT.md — this log preserves the alternatives considered.
 **Date:** 2026-03-27
 **Phase:** 10-classification-layer
 **Areas discussed:** PROTO-08 frequency gap, Plain vs TLS port handling
 ---
 ## PROTO-08 Frequency Gap
 | Option | Description | Selected |
 |--------|-------------|----------|
 | Auto-assign range (Recommended) | Let autoAssignFreq handle them (FNV hash in [2500, 4000] Hz). Built-in constants + rules, but frequencies behave like user-defined classes. Simplest, no table redesign. | ✓ |
 | Extend the table | Add 3 more slots above SIP at 2449 Hz. Proper built-in ClassFreqConfigs entries. Pushes into auto-assign territory, requires range shift. | |
 | Squeeze into Infrastructure band | Insert 3 slots between existing Infrastructure entries (65-133 Hz). Most musically coherent but touches Phase 9's locked design. | |
 **User's choice:** Auto-assign range (Recommended)
 **Notes:** LDAP, Kerberos, Syslog get TrafficClass constants and rules but their Hz values come from autoAssignFreq rather than designed table slots. No Phase 9 table redesign needed.
 ---
 ## Plain vs TLS Port Handling
 | Option | Description | Selected |
 |--------|-------------|----------|
 | Same class (Recommended) | IMAP 143 and IMAPS 993 both classify as ClassIMAP. Simpler, fewer classes. Exception: keep SMTP/SMTP-sub separate per Phase 9 design. | ✓ |
 | Separate classes | IMAP and IMAPS are distinct TrafficClasses with distinct sounds. More granular but doubles class count and needs more frequency slots. | |
 | Same class, no SMTP exception | Merge everything including SMTP + SMTP-sub into single ClassSMTP. Wastes Phase 9 SMTP-sub slot at 305 Hz. | |
 **User's choice:** Same class (Recommended)
 **Notes:** Plain/TLS variants share one class. SMTP (25) and SMTP-submission (587) remain separate because Phase 9 designed distinct frequency slots for them.
 ---
 ## Claude's Discretion
 - Rule ordering within specific-port section
 - Test structure for new protocols
 - How to update TestAllClassesCount
 - Whether to group rules by family with comments
 ## Deferred Ideas
 None — discussion stayed within phase scope.
@@ -0,0 +1,521 @@
 # Phase 10: Classification Layer - Research
 **Researched:** 2026-03-27
 **Domain:** Go classify package extension — new TrafficClass constants, DefaultRules port entries, AllClasses() update, test coverage
 **Confidence:** HIGH — this is pure in-codebase extension with no new dependencies. All patterns are established in the existing code.
 ---
 <user_constraints>
 ## User Constraints (from CONTEXT.md)
 ### Locked Decisions
 - **D-01:** LDAP, Kerberos, and Syslog get built-in TrafficClass constants and classification rules, but their synthesis frequencies are handled by `autoAssignFreq` (FNV hash in [2500, 4000] Hz) rather than designed table slots. No Phase 9 frequency table redesign needed.
 - **D-02:** These 3 classes do NOT get entries in `ClassFreqConfigs` in this phase — they are treated like user-defined custom classes for frequency purposes. Phase 11 will add their `ClassFreqConfigs` entries using `autoAssignFreq`-compatible Hz values.
 - **D-03:** Plaintext and TLS/secure variants of the same protocol share a single TrafficClass. Multiple ports map to the same class constant: IMAP (143) + IMAPS (993) → ClassIMAP, POP3 (110) + POP3S (995) → ClassPOP3, LDAP (389) + LDAPS (636) → ClassLDAP, SIP (5060) + SIPS (5061) → ClassSIP, FTP data (20) + FTP control (21) → ClassFTP.
 - **D-04:** Exception: SMTP (port 25) and SMTP-submission (port 587) remain separate classes (ClassSMTP and ClassSMTPSub) because Phase 9 designed distinct frequency slots for them (214 Hz and 305 Hz respectively).
 - **D-05:** Follow existing uppercase convention for TrafficClass string values: "IMAP", "POP3", "RDP", "MySQL", etc. Matches existing "ICMP", "DNS", "HTTPS" pattern. SMTP-submission uses "SMTP-sub" to match the Phase 9 frequency table label.
 - **D-06:** New port-specific rules insert before the catch-all `{tcp, 0, ClassOtherTCP}` and `{udp, 0, ClassOtherUDP}` entries. Catch-alls remain last. First-match-wins semantics preserved.
 ### Claude's Discretion
 - Exact ordering of new rules within the specific-port section (before catch-alls)
 - Test structure — whether to extend existing TestClassify or add new test functions
 - How to update `TestAllClassesCount` (hardcoded to 14) — update the count or make it dynamic
 - Whether to group rules by family in `DefaultRules` with comments, or keep flat
 ### Deferred Ideas (OUT OF SCOPE)
 None — discussion stayed within phase scope.
 </user_constraints>
 ---
 <phase_requirements>
 ## Phase Requirements
 | ID | Description | Research Support |
 |----|-------------|------------------|
 | PROTO-01 | Add Mail family protocols: IMAP (143/993), POP3 (110/995), SMTP-submission (587) | 5 new rules (IMAP×2, POP3×2, SMTPSub×1), 3 new constants (ClassIMAP, ClassPOP3, ClassSMTPSub) |
 | PROTO-02 | Add File Transfer family protocols: FTP (20-21), SMB/CIFS (445), TFTP (69) | 4 new rules (FTP×2, SMB×1, TFTP×1), 3 new constants (ClassFTP, ClassSMB, ClassTFTP) |
 | PROTO-03 | Add Remote Access family protocols: RDP (3389), Telnet (23), VNC (5900) | 3 new rules, 3 new constants (ClassRDP, ClassTelnet, ClassVNC) |
 | PROTO-04 | Add Database family protocols: MySQL (3306), PostgreSQL (5432), Redis (6379), MongoDB (27017) | 4 new rules, 4 new constants (ClassMySQL, ClassPostgreSQL, ClassRedis, ClassMongoDB) |
 | PROTO-05 | Add Discovery family protocols: mDNS (5353), SSDP/UPnP (1900), SNMP (161-162) | 4 new rules (mDNS×1, SSDP×1, SNMP×2), 3 new constants (ClassMDNS, ClassSSDP, ClassSNMP) |
 | PROTO-06 | Add VoIP family: SIP (5060/5061) | 4 new rules (TCP+UDP × 2 ports), 1 new constant (ClassSIP) — D-03 collapses 5060/5061 into one class |
 | PROTO-07 | Add Web family extension: QUIC/HTTP3 (UDP 443) | 1 new rule, 1 new constant (ClassQUIC) |
 | PROTO-08 | Add Infrastructure family protocols: LDAP (389/636), Kerberos (88), Syslog (514) | 5 new rules (LDAP×2 TCP, Kerberos×2 TCP+UDP, Syslog×1), 3 new constants; D-01/D-02: no ClassFreqConfigs entries this phase |
 | PROTO-09 | Existing 10 protocol classifications remain unchanged — no regression | Rule ordering D-06 + test coverage for every existing class |
 </phase_requirements>
 ---
 ## Summary
 Phase 10 is a mechanical expansion of three files in the `classify` package: `types.go` (new constants + `AllClasses()` update), `rules.go` (new `Rule` entries in `DefaultRules`), and `classifier_test.go` (new subtests). No new packages, no new dependencies, no architectural changes.
 The critical cross-package constraint is `TestClassFreqConfigsMatchAllClasses` in `synth/config_test.go`, which asserts `len(ClassFreqConfigs) == len(AllClasses())`. Adding new constants to `AllClasses()` without adding their `ClassFreqConfigs` entries will fail that test. Decision D-01/D-02 explicitly defers LDAP, Kerberos, and Syslog `ClassFreqConfigs` entries to Phase 11 — so these three classes must be excluded from `AllClasses()` for now, OR the synth test must be temporarily adjusted. This is the single most important planning decision of the phase.
 For the 18 classes that DO get `ClassFreqConfigs` entries in Phase 9's design table (all new protocols except LDAP, Kerberos, Syslog), Phase 11 will add those entries — but Phase 10 only adds the constants and rules. This means `TestAllClassesHaveConfig` and `TestClassFreqConfigsMatchAllClasses` will fail for any class added to `AllClasses()` without a matching `ClassFreqConfigs` entry. The plan must account for this explicitly.
 **Primary recommendation:** Add LDAP, Kerberos, and Syslog as TrafficClass constants and DefaultRules entries, but exclude them from `AllClasses()` for now. Update `TestAllClassesCount` from 14 to the new count covering only classes that have (or will have from Phase 9's existing table) ClassFreqConfigs entries. The remaining three get added to `AllClasses()` in Phase 11 when their ClassFreqConfigs entries are written.
 ---
 ## Standard Stack
 No new libraries. This phase uses only what is already in the codebase.
 | Component | Location | Purpose |
 |-----------|----------|---------|
 | `TrafficClass` string type | `classify/types.go` | Type for all new constants |
 | `Rule` struct | `classify/rules.go` | Container for each new port-matching rule |
 | `AllClasses()` slice | `classify/types.go` | Must be updated with new constants (carefully — see pitfall below) |
 | `DefaultRules` slice | `classify/rules.go` | Must receive new rules before catch-alls |
 | `buildTCPPacket` / `buildUDPPacket` helpers | `classify/classifier_test.go` | Reuse for all new test cases; no new test infrastructure needed |
 **Installation:** No new packages required.
 ---
 ## Complete Protocol Inventory
 All 21 new TrafficClass constants, their string values (D-05), and all port-rule mappings (D-03/D-04).
 ### Mail Family (PROTO-01)
 | Constant | String Value | Protocol | Port | Transport |
 |----------|-------------|----------|------|-----------|
 | `ClassIMAP` | `"IMAP"` | IMAP + IMAPS | 143, 993 | TCP |
 | `ClassPOP3` | `"POP3"` | POP3 + POP3S | 110, 995 | TCP |
 | `ClassSMTPSub` | `"SMTP-sub"` | SMTP submission | 587 | TCP |
 Rules needed: 5 (IMAP×2, POP3×2, SMTPSub×1)
 ### File Transfer Family (PROTO-02)
 | Constant | String Value | Protocol | Port | Transport |
 |----------|-------------|----------|------|-----------|
 | `ClassFTP` | `"FTP"` | FTP data + control | 20, 21 | TCP |
 | `ClassSMB` | `"SMB"` | SMB/CIFS | 445 | TCP |
 | `ClassTFTP` | `"TFTP"` | TFTP | 69 | UDP |
 Rules needed: 4 (FTP×2, SMB×1, TFTP×1)
 ### Remote Access Family (PROTO-03)
 | Constant | String Value | Protocol | Port | Transport |
 |----------|-------------|----------|------|-----------|
 | `ClassRDP` | `"RDP"` | Remote Desktop | 3389 | TCP |
 | `ClassTelnet` | `"Telnet"` | Telnet | 23 | TCP |
 | `ClassVNC` | `"VNC"` | VNC / RFB | 5900 | TCP |
 Rules needed: 3
 ### Database Family (PROTO-04)
 | Constant | String Value | Protocol | Port | Transport |
 |----------|-------------|----------|------|-----------|
 | `ClassMySQL` | `"MySQL"` | MySQL/MariaDB | 3306 | TCP |
 | `ClassPostgreSQL` | `"PostgreSQL"` | PostgreSQL | 5432 | TCP |
 | `ClassRedis` | `"Redis"` | Redis | 6379 | TCP |
 | `ClassMongoDB` | `"MongoDB"` | MongoDB | 27017 | TCP |
 Rules needed: 4
 ### Discovery / Infrastructure Extension (PROTO-05)
 | Constant | String Value | Protocol | Port | Transport |
 |----------|-------------|----------|------|-----------|
 | `ClassMDNS` | `"mDNS"` | Multicast DNS | 5353 | UDP |
 | `ClassSSDP` | `"SSDP"` | SSDP/UPnP | 1900 | UDP |
 | `ClassSNMP` | `"SNMP"` | SNMP | 161, 162 | UDP |
 Rules needed: 4 (mDNS×1, SSDP×1, SNMP×2)
 ### VoIP Family (PROTO-06)
 | Constant | String Value | Protocol | Port | Transport |
 |----------|-------------|----------|------|-----------|
 | `ClassSIP` | `"SIP"` | SIP + SIPS | 5060, 5061 | TCP + UDP |
 Rules needed: 4 (TCP/UDP × 2 ports — D-03 collapses to one class)
 ### Web Extension (PROTO-07)
 | Constant | String Value | Protocol | Port | Transport |
 |----------|-------------|----------|------|-----------|
 | `ClassQUIC` | `"QUIC"` | QUIC / HTTP3 | 443 | UDP |
 Rules needed: 1
 ### Infrastructure PROTO-08 (D-01/D-02: no ClassFreqConfigs in Phase 10)
 | Constant | String Value | Protocol | Port | Transport |
 |----------|-------------|----------|------|-----------|
 | `ClassLDAP` | `"LDAP"` | LDAP + LDAPS | 389, 636 | TCP |
 | `ClassKerberos` | `"Kerberos"` | Kerberos | 88 | TCP + UDP |
 | `ClassSyslog` | `"Syslog"` | Syslog | 514 | UDP |
 Rules needed: 5 (LDAP×2, Kerberos×2, Syslog×1)
 **Total new rules: 30** (5+4+3+4+4+4+1+5)
 **Total new constants: 21**
 ---
 ## Architecture Patterns
 ### TrafficClass constant pattern (types.go)
 ```go
 // Source: classify/types.go existing pattern
 const (
    ClassIMAP       TrafficClass = "IMAP"
    ClassPOP3       TrafficClass = "POP3"
    ClassSMTPSub    TrafficClass = "SMTP-sub"
    ClassFTP        TrafficClass = "FTP"
    ClassSMB        TrafficClass = "SMB"
    ClassTFTP       TrafficClass = "TFTP"
    ClassRDP        TrafficClass = "RDP"
    ClassTelnet     TrafficClass = "Telnet"
    ClassVNC        TrafficClass = "VNC"
    ClassMySQL      TrafficClass = "MySQL"
    ClassPostgreSQL TrafficClass = "PostgreSQL"
    ClassRedis      TrafficClass = "Redis"
    ClassMongoDB    TrafficClass = "MongoDB"
    ClassMDNS       TrafficClass = "mDNS"
    ClassSSDP       TrafficClass = "SSDP"
    ClassSNMP       TrafficClass = "SNMP"
    ClassSIP        TrafficClass = "SIP"
    ClassQUIC       TrafficClass = "QUIC"
    // D-01: LDAP/Kerberos/Syslog classified but no ClassFreqConfigs until Phase 11
    ClassLDAP       TrafficClass = "LDAP"
    ClassKerberos   TrafficClass = "Kerberos"
    ClassSyslog     TrafficClass = "Syslog"
 )
 ```
 ### AllClasses() update with LDAP/Kerberos/Syslog exclusion
 The 18 classes with designed Phase 9 frequency slots go into `AllClasses()`. LDAP, Kerberos, and Syslog are excluded until Phase 11:
 ```go
 // Source: classify/types.go
 func AllClasses() []TrafficClass {
    return []TrafficClass{
        // Infrastructure
        ClassICMP, ClassDNS, ClassNTP, ClassDHCP,
        ClassMDNS, ClassSSDP, ClassSNMP,
        // Web
        ClassHTTPS, ClassHTTP, ClassQUIC,
        // Mail
        ClassSMTP, ClassIMAP, ClassPOP3, ClassSMTPSub,
        // Remote Access
        ClassSSH, ClassRDP, ClassTelnet, ClassVNC,
        // File Transfer
        ClassFTP, ClassSMB, ClassTFTP,
        // Database
        ClassMySQL, ClassPostgreSQL, ClassRedis, ClassMongoDB,
        // VoIP
        ClassSIP,
        // Unknown/catch-all
        ClassUnknown1, ClassUnknown2, ClassUnknown3, ClassUnknown4,
        ClassOtherTCP, ClassOtherUDP,
    }
 }
 // Count: 32 classes (14 existing + 18 new, excluding LDAP/Kerberos/Syslog)
 ```
 ### DefaultRules pattern with family grouping (rules.go)
 ```go
 // Source: classify/rules.go existing pattern
 var DefaultRules = []Rule{
    // --- Infrastructure (existing) ---
    {Protocol: "icmp", DstPort: 0, Class: ClassICMP},
    {Protocol: "udp", DstPort: 53, Class: ClassDNS},
    {Protocol: "tcp", DstPort: 53, Class: ClassDNS},
    // ... NTP, DHCP ...
    // --- Infrastructure extension (PROTO-05) ---
    {Protocol: "udp", DstPort: 5353, Class: ClassMDNS},
    {Protocol: "udp", DstPort: 1900, Class: ClassSSDP},
    {Protocol: "udp", DstPort: 161, Class: ClassSNMP},
    {Protocol: "udp", DstPort: 162, Class: ClassSNMP},
    // --- Web (existing + PROTO-07) ---
    {Protocol: "tcp", DstPort: 443, Class: ClassHTTPS},
    {Protocol: "udp", DstPort: 443, Class: ClassQUIC},
    {Protocol: "tcp", DstPort: 80, Class: ClassHTTP},
    // --- Mail (existing SMTP + PROTO-01) ---
    {Protocol: "tcp", DstPort: 25, Class: ClassSMTP},
    {Protocol: "tcp", DstPort: 143, Class: ClassIMAP},
    {Protocol: "tcp", DstPort: 993, Class: ClassIMAP},
    {Protocol: "tcp", DstPort: 110, Class: ClassPOP3},
    {Protocol: "tcp", DstPort: 995, Class: ClassPOP3},
    {Protocol: "tcp", DstPort: 587, Class: ClassSMTPSub},
    // --- Remote Access (existing SSH + PROTO-03) ---
    {Protocol: "tcp", DstPort: 22, Class: ClassSSH},
    {Protocol: "tcp", DstPort: 3389, Class: ClassRDP},
    {Protocol: "tcp", DstPort: 23, Class: ClassTelnet},
    {Protocol: "tcp", DstPort: 5900, Class: ClassVNC},
    // --- File Transfer (PROTO-02) ---
    {Protocol: "tcp", DstPort: 20, Class: ClassFTP},
    {Protocol: "tcp", DstPort: 21, Class: ClassFTP},
    {Protocol: "tcp", DstPort: 445, Class: ClassSMB},
    {Protocol: "udp", DstPort: 69, Class: ClassTFTP},
    // --- Database (PROTO-04) ---
    {Protocol: "tcp", DstPort: 3306, Class: ClassMySQL},
    {Protocol: "tcp", DstPort: 5432, Class: ClassPostgreSQL},
    {Protocol: "tcp", DstPort: 6379, Class: ClassRedis},
    {Protocol: "tcp", DstPort: 27017, Class: ClassMongoDB},
    // --- VoIP (PROTO-06) ---
    {Protocol: "tcp", DstPort: 5060, Class: ClassSIP},
    {Protocol: "tcp", DstPort: 5061, Class: ClassSIP},
    {Protocol: "udp", DstPort: 5060, Class: ClassSIP},
    {Protocol: "udp", DstPort: 5061, Class: ClassSIP},
    // --- Infrastructure / Auth (PROTO-08, D-01) ---
    {Protocol: "tcp", DstPort: 389, Class: ClassLDAP},
    {Protocol: "tcp", DstPort: 636, Class: ClassLDAP},
    {Protocol: "tcp", DstPort: 88, Class: ClassKerberos},
    {Protocol: "udp", DstPort: 88, Class: ClassKerberos},
    {Protocol: "udp", DstPort: 514, Class: ClassSyslog},
    // Catch-alls (must be last):
    {Protocol: "tcp", DstPort: 0, Class: ClassOtherTCP},
    {Protocol: "udp", DstPort: 0, Class: ClassOtherUDP},
 }
 ```
 ### Test pattern — new subtests in TestClassify
 ```go
 // Source: classify/classifier_test.go existing subtest pattern
 t.Run("TestClassifyIMAP_port143", func(t *testing.T) {
    pkt := buildTCPPacket(t, 143)
    got := c.Classify(pkt)
    if got.Class != classify.ClassIMAP {
        t.Errorf("IMAP port 143: got class %q, want %q", got.Class, classify.ClassIMAP)
    }
 })
 t.Run("TestClassifyIMAP_port993", func(t *testing.T) {
    pkt := buildTCPPacket(t, 993)
    got := c.Classify(pkt)
    if got.Class != classify.ClassIMAP {
        t.Errorf("IMAPS port 993: got class %q, want %q", got.Class, classify.ClassIMAP)
    }
 })
 ```
 ---
 ## Don't Hand-Roll
 | Problem | Don't Build | Use Instead |
 |---------|-------------|-------------|
 | Multi-port classes (D-03) | A special data structure for port groups | Two separate `Rule` entries pointing to the same `Class` constant — the classifier's first-match-wins loop handles it automatically |
 | Protocol detection | Application-layer DPI parsing | Port-number matching via existing `Rule` struct — confirmed sufficient for all v1.2 protocols |
 | Test helpers | New packet builders | Reuse `buildTCPPacket` and `buildUDPPacket` from the existing test file — they accept any port number |
 ---
 ## Common Pitfalls
 ### Pitfall 1: TestClassFreqConfigsMatchAllClasses breaks when LDAP/Kerberos/Syslog are added to AllClasses()
 **What goes wrong:** `synth/config_test.go:TestClassFreqConfigsMatchAllClasses` asserts `len(ClassFreqConfigs) == len(AllClasses())`. If LDAP, Kerberos, or Syslog are added to `AllClasses()` in Phase 10 (without their `ClassFreqConfigs` entries — deferred to Phase 11 per D-02), this test fails.
 **Why it happens:** The test enforces bidirectional coverage: every class in `AllClasses()` must have a `ClassFreqConfigs` entry and vice versa.
 **How to avoid:** Exclude LDAP, Kerberos, Syslog from `AllClasses()` in Phase 10. They get constants and rules, but `AllClasses()` includes them only when Phase 11 adds their `ClassFreqConfigs` entries. This means `go test ./classify/...` passes, but `go test ./synth/...` also passes because those three classes never appear in `AllClasses()` yet.
 **Warning signs:** `TestAllClassesHaveConfig` in `synth/config_test.go` reports "class X has no entry in ClassFreqConfigs" — this means a class was added to `AllClasses()` without its synth config.
 ### Pitfall 2: TestAllClassesCount must be updated from 14
 **What goes wrong:** `classify/classifier_test.go:TestAllClassesCount` hardcodes `if len(classes) != 14`. After adding 18 classes to `AllClasses()`, the count becomes 32. The test fails with "got 32, want 14".
 **Why it happens:** The count is hardcoded, not derived from the constants.
 **How to avoid:** Update the assertion to `!= 32` (or make it dynamic with `len(classify.AllClasses())` in a separate count-verification approach). The CONTEXT.md grants discretion on this — updating the hardcoded value is the simplest approach.
 **Warning signs:** Test output: `AllClasses() returned 32 classes, want 14`.
 ### Pitfall 3: Catch-all rules pushed out of last position
 **What goes wrong:** If new rules are appended after the catch-alls `{tcp, 0, ClassOtherTCP}` and `{udp, 0, ClassOtherUDP}`, the catch-alls match first and new specific rules are unreachable. Every packet on new ports would hit ClassOtherTCP or ClassOtherUDP instead.
 **Why it happens:** First-match-wins. DstPort 0 means "match any port" — it catches everything if it appears before specific-port rules.
 **How to avoid:** All new specific-port rules must appear BEFORE the two catch-alls. The catch-all comment `// Catch-alls (must be last):` is the insertion boundary. D-06 enforces this explicitly.
 **Warning signs:** Classifier test for new protocols returns ClassOtherTCP or ClassOtherUDP instead of the expected class.
 ### Pitfall 4: UDP 443 (QUIC) rule must come BEFORE the TCP 443 (HTTPS) rule — or after, depending on implementation
 **What goes wrong:** The classifier checks TCP before UDP (see `classifier.go` — TCP layer checked first). A UDP packet on port 443 will NOT match the TCP 443 rule because the classifier correctly identifies the transport. However, if someone accidentally writes the QUIC rule as `{Protocol: "tcp", DstPort: 443, Class: ClassQUIC}`, it would shadow the existing HTTPS rule.
 **How to avoid:** Confirm the QUIC rule uses `Protocol: "udp"`. The existing TCP 443 HTTPS rule is unchanged.
 **Warning signs:** HTTPS test (TCP port 443) returns ClassQUIC, or QUIC test (UDP port 443) returns ClassHTTPS.
 ### Pitfall 5: SIP dual-transport requires 4 rules, not 2
 **What goes wrong:** SIP runs on both TCP and UDP for ports 5060 and 5061. D-03 collapses both ports into one class, but four separate rules are needed: TCP/5060, TCP/5061, UDP/5060, UDP/5061.
 **How to avoid:** Write all four rules explicitly. The test coverage should include at minimum a UDP/5060 test and a TCP/5060 test to verify both transport paths.
 ### Pitfall 6: SMTP port 465 (SMTPS) not required by PROTO-01
 **What goes wrong:** FEATURES.md mentions port 465 as a SMTP submission port alongside 587. PROTO-01 only lists 587.
 **How to avoid:** Only add port 587 for ClassSMTPSub per the requirement. Port 465 can be added as a user custom rule if needed. Do not over-reach the requirement.
 ---
 ## Integration Point: synth/config_test.go Cross-Check
 The `TestAllClassesHaveConfig` test in `synth/config_test.go` iterates `AllClasses()` and checks each against `ClassFreqConfigs`. This creates a hard dependency: `AllClasses()` must only contain classes that have `ClassFreqConfigs` entries at any given commit.
 **Phase 9 ClassFreqConfigs currently has:** 14 entries (the original classes). Phase 9's frequency table in the comment at `synth/config.go:74-110` lists entries labeled `(Phase 10)` but those entries do not yet exist in `ClassFreqConfigs` — they are design intent only.
 **What Phase 10 adds to AllClasses():** 18 new classes (all except LDAP, Kerberos, Syslog).
 **What Phase 11 must add to ClassFreqConfigs:** Those same 18 classes PLUS LDAP, Kerberos, Syslog.
 **Consequence:** After Phase 10, `go test ./synth/...` will fail `TestAllClassesHaveConfig` for all 18 new classes added to `AllClasses()`, because their `ClassFreqConfigs` entries don't exist yet. The plan must acknowledge this: Phase 10's `go test ./classify/...` passes (the success criterion), but `go test ./synth/...` is expected to fail until Phase 11.
 Alternatively, the plan can note that `go test ./synth/...` is intentionally broken between Phase 10 and Phase 11, and the phase gate is `go test ./classify/...` only, per the success criteria stated in CONTEXT.md.
 ---
 ## Validation Architecture
 ### Test Framework
 | Property | Value |
 |----------|-------|
 | Framework | Go testing (stdlib) |
 | Config file | none |
 | Quick run command | `go test ./classify/...` |
 | Full suite command | `go test ./...` |
 ### Phase Requirements → Test Map
 | Req ID | Behavior | Test Type | Automated Command | File Exists? |
 |--------|----------|-----------|-------------------|-------------|
 | PROTO-01 | IMAP port 143 → ClassIMAP | unit | `go test ./classify/... -run TestClassify/TestClassifyIMAP` | ❌ Wave 0 |
 | PROTO-01 | IMAPS port 993 → ClassIMAP | unit | `go test ./classify/... -run TestClassify/TestClassifyIMAP` | ❌ Wave 0 |
 | PROTO-01 | POP3 port 110 → ClassPOP3 | unit | `go test ./classify/... -run TestClassify/TestClassifyPOP3` | ❌ Wave 0 |
 | PROTO-01 | POP3S port 995 → ClassPOP3 | unit | `go test ./classify/... -run TestClassify/TestClassifyPOP3` | ❌ Wave 0 |
 | PROTO-01 | SMTP-sub port 587 → ClassSMTPSub | unit | `go test ./classify/... -run TestClassify/TestClassifySMTPSub` | ❌ Wave 0 |
 | PROTO-02 | FTP port 20 → ClassFTP | unit | `go test ./classify/... -run TestClassify/TestClassifyFTP` | ❌ Wave 0 |
 | PROTO-02 | FTP port 21 → ClassFTP | unit | `go test ./classify/... -run TestClassify/TestClassifyFTP` | ❌ Wave 0 |
 | PROTO-02 | SMB port 445 → ClassSMB | unit | `go test ./classify/... -run TestClassify/TestClassifySMB` | ❌ Wave 0 |
 | PROTO-02 | TFTP port 69 → ClassTFTP | unit | `go test ./classify/... -run TestClassify/TestClassifyTFTP` | ❌ Wave 0 |
 | PROTO-03 | RDP port 3389 → ClassRDP | unit | `go test ./classify/... -run TestClassify/TestClassifyRDP` | ❌ Wave 0 |
 | PROTO-03 | Telnet port 23 → ClassTelnet | unit | `go test ./classify/... -run TestClassify/TestClassifyTelnet` | ❌ Wave 0 |
 | PROTO-03 | VNC port 5900 → ClassVNC | unit | `go test ./classify/... -run TestClassify/TestClassifyVNC` | ❌ Wave 0 |
 | PROTO-04 | MySQL port 3306 → ClassMySQL | unit | `go test ./classify/... -run TestClassify/TestClassifyMySQL` | ❌ Wave 0 |
 | PROTO-04 | PostgreSQL port 5432 → ClassPostgreSQL | unit | `go test ./classify/... -run TestClassify/TestClassifyPostgreSQL` | ❌ Wave 0 |
 | PROTO-04 | Redis port 6379 → ClassRedis | unit | `go test ./classify/... -run TestClassify/TestClassifyRedis` | ❌ Wave 0 |
 | PROTO-04 | MongoDB port 27017 → ClassMongoDB | unit | `go test ./classify/... -run TestClassify/TestClassifyMongoDB` | ❌ Wave 0 |
 | PROTO-05 | mDNS port 5353 → ClassMDNS | unit | `go test ./classify/... -run TestClassify/TestClassifyMDNS` | ❌ Wave 0 |
 | PROTO-05 | SSDP port 1900 → ClassSSDP | unit | `go test ./classify/... -run TestClassify/TestClassifySSDDP` | ❌ Wave 0 |
 | PROTO-05 | SNMP port 161 → ClassSNMP | unit | `go test ./classify/... -run TestClassify/TestClassifySNMP` | ❌ Wave 0 |
 | PROTO-05 | SNMP port 162 → ClassSNMP | unit | `go test ./classify/... -run TestClassify/TestClassifySNMP` | ❌ Wave 0 |
 | PROTO-06 | SIP TCP 5060 → ClassSIP | unit | `go test ./classify/... -run TestClassify/TestClassifySIP` | ❌ Wave 0 |
 | PROTO-06 | SIP UDP 5060 → ClassSIP | unit | `go test ./classify/... -run TestClassify/TestClassifySIP` | ❌ Wave 0 |
 | PROTO-07 | QUIC UDP 443 → ClassQUIC | unit | `go test ./classify/... -run TestClassify/TestClassifyQUIC` | ❌ Wave 0 |
 | PROTO-08 | LDAP port 389 → ClassLDAP | unit | `go test ./classify/... -run TestClassify/TestClassifyLDAP` | ❌ Wave 0 |
 | PROTO-08 | Kerberos port 88 → ClassKerberos | unit | `go test ./classify/... -run TestClassify/TestClassifyKerberos` | ❌ Wave 0 |
 | PROTO-08 | Syslog port 514 → ClassSyslog | unit | `go test ./classify/... -run TestClassify/TestClassifySyslog` | ❌ Wave 0 |
 | PROTO-09 | All 10 existing classes unchanged | unit | `go test ./classify/... -run TestClassify` | ✅ exists |
 ### Sampling Rate
 - **Per task commit:** `go test ./classify/...`
 - **Per wave merge:** `go test ./classify/...`
 - **Phase gate:** `go test ./classify/...` green before `/gsd:verify-work` (synth/ is allowed to fail until Phase 11)
 ### Wave 0 Gaps
 All new test subtests for PROTO-01 through PROTO-08 must be added in the implementation task. They extend the existing `TestClassify` function in `classify/classifier_test.go` — no new test file required, no new test infrastructure.
 - [ ] `classify/classifier_test.go` — extend `TestClassify` with ~26 new subtests (one per port/protocol combination listed above)
 - [ ] `classify/classifier_test.go` — update `TestAllClassesCount` hardcoded value from 14 to 32
 ---
 ## Open Questions
 1. **Should TestAllClassesCount be updated to a hardcoded 32, or made dynamic?**
   - What we know: CONTEXT.md grants discretion on this. The current implementation is `!= 14`.
   - What's unclear: A hardcoded count becomes stale again when Phase 11 adds LDAP/Kerberos/Syslog.
   - Recommendation: Update to `!= 32` now (matching the post-Phase-10 reality), and update again to `!= 35` in Phase 11. This is clearer than a dynamic check that could mask missing entries.
 2. **Do LDAP, Kerberos, Syslog go into AllClasses() in Phase 10 or Phase 11?**
   - What we know: D-02 says their ClassFreqConfigs entries are deferred to Phase 11. TestAllClassesHaveConfig and TestClassFreqConfigsMatchAllClasses will fail if they appear in AllClasses() without ClassFreqConfigs entries.
   - What's unclear: Whether the plan should explicitly skip/ignore `go test ./synth/...` in Phase 10 or avoid the failure entirely by keeping those three out of AllClasses().
   - Recommendation: Keep them OUT of AllClasses() in Phase 10. Constants and rules exist, but they function as "classified but not yet in the display set." This approach keeps all test suites green simultaneously. Phase 11 adds them to AllClasses() when it also adds their ClassFreqConfigs entries.
 ---
 ## Environment Availability
 Step 2.6: SKIPPED — this phase is purely code/config changes within the `classify` package. No external tools, databases, or CLI utilities are required. `go test ./classify/...` requires only the Go toolchain already verified as in use.
 ---
 ## Project Constraints (from CLAUDE.md)
 | Directive | Impact on Phase 10 |
 |-----------|-------------------|
 | Language: Go | All new code is Go |
 | Single binary output | No new external packages; classify package has no CGo |
 | Non-interactive capture model | No interaction model changes |
 | GSD Workflow Enforcement | All edits via GSD workflow (execute-phase) |
 | Stack: `gopacket/gopacket` v1.5.0 | No change — used only for test packet building |
 | No `google/gopacket` | No change — already using community fork |
 | No `go-audio/generator` | N/A — not audio-related |
 | Conventions: populate as patterns emerge | Grouping rules by family with comments is consistent with established Phase 9 comment style in synth/config.go |
 ---
 ## Sources
 ### Primary (HIGH confidence)
 - `classify/types.go` — current 14 constants, AllClasses() implementation (direct code read)
 - `classify/rules.go` — current 12 rules, DefaultRules pattern (direct code read)
 - `classify/classifier.go` — Classify() method, rule matching logic, first-match-wins semantics (direct code read)
 - `classify/classifier_test.go` — existing test helpers, TestAllClassesCount=14 (direct code read)
 - `synth/config_test.go` — TestClassFreqConfigsMatchAllClasses, TestAllClassesHaveConfig cross-checks (direct code read)
 - `synth/config.go lines 74-110` — Phase 9 frequency allocation table comment showing all Phase 10 target classes with Hz values (direct code read)
 - `.planning/phases/10-classification-layer/10-CONTEXT.md` — locked decisions D-01 through D-06 (direct read)
 - `.planning/REQUIREMENTS.md` — PROTO-01 through PROTO-09 definitions (direct read)
 - `.planning/research/FEATURES.md` — complete protocol list, port assignments, family groupings (direct read)
 ### Secondary (MEDIUM confidence)
 - IANA Service Name and Transport Protocol Port Number Registry — port assignments for IMAP (143/993), POP3 (110/995), SMTP-sub (587), FTP (20/21), SMB (445), TFTP (69), RDP (3389), mDNS (5353), SSDP (1900), SNMP (161/162), SIP (5060/5061), LDAP (389/636), Kerberos (88), Syslog (514) — all standard, well-known ports
 ---
 ## Metadata
 **Confidence breakdown:**
 - Standard stack: HIGH — no new dependencies; all patterns directly observed in codebase
 - Architecture: HIGH — mechanical extension of established Rule/TrafficClass pattern; no design uncertainty
 - Pitfalls: HIGH — derived directly from the existing test assertions and cross-package contracts
 **Research date:** 2026-03-27
 **Valid until:** Stable — pure code extension, no external dependency versions to track
@@ -0,0 +1,70 @@
 ---
 phase: 10
 slug: classification-layer
 status: draft
 nyquist_compliant: false
 wave_0_complete: false
 created: 2026-03-27
 ---
 # Phase 10 — Validation Strategy
 > Per-phase validation contract for feedback sampling during execution.
 ---
 ## Test Infrastructure
 | Property | Value |
 |----------|-------|
 | **Framework** | go test |
 | **Config file** | none — standard Go test runner |
 | **Quick run command** | `go test ./classify/...` |
 | **Full suite command** | `go test ./...` |
 | **Estimated runtime** | ~3 seconds |
 ---
 ## Sampling Rate
 - **After every task commit:** Run `go test ./classify/...`
 - **After every plan wave:** Run `go test ./...`
 - **Before `/gsd:verify-work`:** Full suite must be green
 - **Max feedback latency:** 3 seconds
 ---
 ## Per-Task Verification Map
 | Task ID | Plan | Wave | Requirement | Test Type | Automated Command | File Exists | Status |
 |---------|------|------|-------------|-----------|-------------------|-------------|--------|
 | 10-01-01 | 01 | 1 | PROTO-01..09 | unit | `go test ./classify/... -run TestClassify` | ✅ | ⬜ pending |
 | 10-01-02 | 01 | 1 | PROTO-09 | regression | `go test ./classify/... -run TestClassify` | ✅ | ⬜ pending |
 | 10-01-03 | 01 | 1 | PROTO-01..08 | unit | `go test ./classify/... -run TestAllClassesCount` | ✅ | ⬜ pending |
 *Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*
 ---
 ## Wave 0 Requirements
 *Existing infrastructure covers all phase requirements. `classify/classifier_test.go` already has `buildTCPPacket`, `buildUDPPacket`, and `buildICMPPacket` helpers.*
 ---
 ## Manual-Only Verifications
 *All phase behaviors have automated verification.*
 ---
 ## Validation Sign-Off
 - [ ] All tasks have `<automated>` verify or Wave 0 dependencies
 - [ ] Sampling continuity: no 3 consecutive tasks without automated verify
 - [ ] Wave 0 covers all MISSING references
 - [ ] No watch-mode flags
 - [ ] Feedback latency < 3s
 - [ ] `nyquist_compliant: true` set in frontmatter
 **Approval:** pending
@@ -0,0 +1,101 @@
 ---
 phase: 10-classification-layer
 verified: 2026-03-27T00:00:00Z
 status: passed
 score: 7/7 must-haves verified
 re_verification: false
 ---
 # Phase 10: Classification Layer Verification Report
 **Phase Goal:** All new protocol families are classified — ~21 new TrafficClass constants exist, AllClasses() covers them, and DefaultRules maps all new ports to their classes
 **Verified:** 2026-03-27
 **Status:** passed
 **Re-verification:** No — initial verification
 ## Goal Achievement
 ### Observable Truths
 | #  | Truth                                                                                  | Status     | Evidence                                                              |
 |----|----------------------------------------------------------------------------------------|------------|-----------------------------------------------------------------------|
 | 1  | 21 new TrafficClass constants exist with correct string values per D-05                | VERIFIED   | 35 total constants in types.go (14 existing + 21 new); all string values match spec |
 | 2  | AllClasses() returns 32 classes (18 new + 14 existing, excluding LDAP/Kerberos/Syslog) | VERIFIED   | TestAllClassesCount asserts 32 and passes; AllClasses() body verified |
 | 3  | DefaultRules contains 30 new port-matching rules before the catch-alls per D-06        | VERIFIED   | 42 total rules (12 existing + 30 new); last two are DstPort:0 catch-alls |
 | 4  | Plain/TLS variants share a single class constant per D-03                              | VERIFIED   | IMAP 143+993, POP3 110+995, FTP 20+21, LDAP 389+636 all map to single class |
 | 5  | SMTP (port 25) and SMTP-sub (port 587) remain separate classes per D-04               | VERIFIED   | ClassSMTP="SMTP" and ClassSMTPSub="SMTP-sub" are distinct constants and rules |
 | 6  | Every new protocol port tested and classifies to correct TrafficClass                  | VERIFIED   | 28 new subtests in TestClassify all PASS (go test ./classify/...) |
 | 7  | All 10 existing protocol tests still pass unchanged (PROTO-09 regression)             | VERIFIED   | TestClassifyICMP, DNS, HTTPS, HTTP, SSH, SMTP, NTP, DHCP, OtherTCP, OtherUDP all PASS |
 **Score:** 7/7 truths verified
 ### Required Artifacts
 | Artifact                       | Expected                                  | Status     | Details                                                        |
 |-------------------------------|-------------------------------------------|------------|----------------------------------------------------------------|
 | `classify/types.go`           | 21 new TrafficClass constants, AllClasses() | VERIFIED | 21 new constants present; AllClasses() returns 32 excluding LDAP/Kerberos/Syslog |
 | `classify/rules.go`           | 30 new port-matching rules                | VERIFIED   | 42 total rules; ClassMongoDB present; catch-alls are last two  |
 | `classify/classifier_test.go` | 26+ subtests for new protocol combinations | VERIFIED  | 28 new subtests present (PROTO-06 SIP has 2 transport variants); ClassIMAP referenced |
 ### Key Link Verification
 | From                           | To                   | Via                                          | Status   | Details                                         |
 |-------------------------------|----------------------|----------------------------------------------|----------|-------------------------------------------------|
 | `classify/rules.go`           | `classify/types.go`  | Rule.Class references TrafficClass constants | VERIFIED | Class:Class(IMAP|POP3|FTP|RDP|MySQL) patterns present in rules.go |
 | `classify/classifier_test.go` | `classify/types.go`  | test assertions reference new constants      | VERIFIED | classify.Class(IMAP|RDP|MySQL|QUIC|SIP) patterns present in test |
 | `classify/classifier_test.go` | `classify/rules.go`  | NewClassifier(DefaultRules) uses updated rules | VERIFIED | classify.DefaultRules referenced in test setup |
 ### Data-Flow Trace (Level 4)
 Not applicable — this phase adds classification constants, port rules, and tests only. No components rendering dynamic data.
 ### Behavioral Spot-Checks
 | Behavior                            | Command                                     | Result  | Status |
 |-------------------------------------|---------------------------------------------|---------|--------|
 | go test ./classify/... passes       | go test ./classify/... -count=1             | PASS    | PASS   |
 | TestAllClassesCount expects 32      | go test ./classify/... -run TestAllClassesCount | PASS | PASS   |
 | 28 new subtests in TestClassify pass | go test ./classify/... -run TestClassify -v | All 43 subtests PASS | PASS |
 | Package builds without errors       | go build ./classify/...                     | exit 0  | PASS   |
 Full test run output (43 subtests, 3 test functions):
 - TestClassify: 43 subtests (13 existing + 28 new + TestRulesAreOrderDependent), all PASS
 - TestAllClassesCount: PASS (asserts len == 32)
 - TestHashBucketDistribution: PASS
 ### Requirements Coverage
 | Requirement | Source Plan | Description                                                | Status    | Evidence                                          |
 |-------------|------------|-------------------------------------------------------------|-----------|---------------------------------------------------|
 | PROTO-01    | 10-01, 10-02 | Mail: IMAP (143/993), POP3 (110/995), SMTP-sub (587)      | SATISFIED | Constants ClassIMAP, ClassPOP3, ClassSMTPSub; rules for all 5 ports; 5 test subtests all PASS |
 | PROTO-02    | 10-01, 10-02 | File Transfer: FTP (20-21), SMB (445), TFTP (69)           | SATISFIED | Constants ClassFTP, ClassSMB, ClassTFTP; rules for all 4 ports; 4 test subtests all PASS |
 | PROTO-03    | 10-01, 10-02 | Remote Access: RDP (3389), Telnet (23), VNC (5900)         | SATISFIED | Constants ClassRDP, ClassTelnet, ClassVNC; rules for all 3 ports; 3 test subtests all PASS |
 | PROTO-04    | 10-01, 10-02 | Database: MySQL (3306), PostgreSQL (5432), Redis (6379), MongoDB (27017) | SATISFIED | Constants and rules for all 4 databases; 4 test subtests all PASS |
 | PROTO-05    | 10-01, 10-02 | Discovery: mDNS (5353), SSDP (1900), SNMP (161-162)       | SATISFIED | Constants ClassMDNS, ClassSSDP, ClassSNMP; rules for all 4 ports; 4 test subtests all PASS |
 | PROTO-06    | 10-01, 10-02 | VoIP: SIP (5060/5061) on TCP and UDP                       | SATISFIED | ClassSIP constant; 4 rules (TCP+UDP x 5060+5061); TestClassifySIP_TCP5060 and TestClassifySIP_UDP5060 both PASS |
 | PROTO-07    | 10-01, 10-02 | Web extension: QUIC/HTTP3 (UDP 443)                        | SATISFIED | ClassQUIC constant; udp/443 rule before tcp/443 rule; TestClassifyQUIC_UDP443 PASS (not matched as HTTPS) |
 | PROTO-08    | 10-01, 10-02 | Infrastructure: LDAP (389/636), Kerberos (88), Syslog (514) | SATISFIED | Constants ClassLDAP, ClassKerberos, ClassSyslog; 5 rules; 5 test subtests all PASS; correctly excluded from AllClasses() per D-01 |
 | PROTO-09    | 10-02        | Existing 10 protocols unchanged — no regression            | SATISFIED | TestClassifyICMP, DNS_UDP, DNS_TCP, HTTPS, HTTP, SSH, SMTP, NTP, DHCP_port67, DHCP_port68, OtherTCP, OtherUDP all PASS |
 All 9 requirements from phase 10 plans are satisfied. No orphaned requirements found — REQUIREMENTS.md traceability table maps PROTO-01 through PROTO-09 to Phase 10 and marks all as Complete.
 ### Anti-Patterns Found
 | File | Line | Pattern | Severity | Impact |
 |------|------|---------|----------|--------|
 | (none) | — | — | — | No TODO, FIXME, placeholder, or stub patterns found in classify/types.go, classify/rules.go, or classify/classifier_test.go |
 ### Human Verification Required
 None. All phase 10 behaviors are programmatically verifiable through unit tests.
 ### Gaps Summary
 No gaps. All 7 observable truths verified, all 3 artifacts substantive and wired, all 9 requirements satisfied, `go test ./classify/...` passes with 0 failures.
 Note on expected synth package failures: `go test ./synth/...` is intentionally not the phase gate. Tests TestAllClassesHaveConfig, TestNewBankHas14Layers, TestLoadAllDefaultsPresent, and TestClassFreqConfigsMatchAllClasses are expected to fail after Phase 10 because AllClasses() now returns 32 entries but ClassFreqConfigs has 14 entries. This is documented in research and will be resolved in Phase 11 when ClassFreqConfigs entries for the 18 new classes are added.
 ---
 _Verified: 2026-03-27_
 _Verifier: Claude (gsd-verifier)_
@@ -0,0 +1,224 @@
 ---
 phase: 11-synthesis-and-config-layer
 plan: 01
 type: execute
 wave: 1
 depends_on: []
 files_modified:
  - synth/config.go
  - classify/types.go
  - synth/bank_test.go
  - config/config_test.go
  - classify/classifier_test.go
 autonomous: true
 requirements:
  - GRP-02
  - GRP-03
 must_haves:
  truths:
    - "ClassFreqConfigs has exactly 35 entries matching AllClasses()"
    - "Every new class has correct Hz, waveform, pan, and group from frequency allocation table"
    - "LDAP, Kerberos, Syslog appear in AllClasses() and have Infrastructure group with Triangle waveform"
    - "go test ./synth/... ./classify/... ./config/... all pass"
  artifacts:
    - path: "synth/config.go"
      provides: "21 new ClassFreqConfigs entries"
      contains: "classify.ClassIMAP"
    - path: "classify/types.go"
      provides: "AllClasses() returns 35 entries including LDAP/Kerberos/Syslog"
      contains: "ClassLDAP"
  key_links:
    - from: "synth/config.go"
      to: "classify/types.go"
      via: "ClassFreqConfigs references TrafficClass constants"
      pattern: "classify\\.Class(IMAP|POP3|SMTPSub|RDP|Telnet|VNC|FTP|SMB|TFTP|MySQL|PostgreSQL|Redis|MongoDB|SIP|QUIC|MDNS|SSDP|SNMP|LDAP|Kerberos|Syslog)"
 ---
 <objective>
 Add all 21 missing ClassFreqConfigs entries and update AllClasses() to include LDAP/Kerberos/Syslog, then fix every hardcoded count assertion across synth, config, and classify test files.
 Purpose: This is the foundational data layer for Phase 11 -- all subsequent work (PrintConfig group headers, TOML [groups]) depends on all 35 classes having complete synthesis configs.
 Output: synth/config.go with 35 ClassFreqConfigs entries, classify/types.go with 35-entry AllClasses(), all count-based tests green.
 </objective>
 <execution_context>
@$HOME/.claude/get-shit-done/workflows/execute-plan.md
@$HOME/.claude/get-shit-done/templates/summary.md
 </execution_context>
 <context>
@.planning/PROJECT.md
@.planning/ROADMAP.md
@.planning/STATE.md
@synth/config.go
@classify/types.go
@synth/bank_test.go
@synth/config_test.go
@config/config_test.go
@classify/classifier_test.go
 <interfaces>
 <!-- Key types and contracts the executor needs -->
 From classify/types.go:
 ```go
 type TrafficClass string
 // Constants: ClassIMAP, ClassPOP3, ClassSMTPSub, ClassFTP, ClassSMB, ClassTFTP,
 // ClassRDP, ClassTelnet, ClassVNC, ClassMySQL, ClassPostgreSQL, ClassRedis,
 // ClassMongoDB, ClassMDNS, ClassSSDP, ClassSNMP, ClassSIP, ClassQUIC,
 // ClassLDAP, ClassKerberos, ClassSyslog
 func AllClasses() []TrafficClass
 ```
 From synth/config.go:
 ```go
 type FreqConfig struct {
    BaseHz       float64
    Harmonics    []HarmonicDef
    Pan          float64
    WaveformType WaveformType
    Group        string
 }
 var ClassFreqConfigs = map[classify.TrafficClass]FreqConfig{...}
 func WaveformPresetHarmonics(wt WaveformType, baseHz float64, sampleRate int) []HarmonicDef
 ```
 </interfaces>
 </context>
 <tasks>
 <task type="auto">
  <name>Task 1: Add 21 ClassFreqConfigs entries and update AllClasses()</name>
  <files>synth/config.go, classify/types.go</files>
  <read_first>synth/config.go, classify/types.go</read_first>
  <action>
 **synth/config.go** -- Add 21 new entries to the ClassFreqConfigs map, after the existing entries and before the closing brace. Use WaveformPresetHarmonics() for all entries (per D-01). The exact values from the frequency allocation table (lines 74-110 of synth/config.go):
 ```
 // --- Infrastructure additions (Triangle, 93-118 Hz) ---
 classify.ClassMDNS:  {BaseHz: 93.0, WaveformType: WaveformTriangle, Harmonics: WaveformPresetHarmonics(WaveformTriangle, 93.0, SampleRate), Pan: 0.3, Group: "Infrastructure"}
 classify.ClassSSDP:  {BaseHz: 105.0, WaveformType: WaveformTriangle, Harmonics: WaveformPresetHarmonics(WaveformTriangle, 105.0, SampleRate), Pan: -0.2, Group: "Infrastructure"}
 classify.ClassSNMP:  {BaseHz: 118.0, WaveformType: WaveformTriangle, Harmonics: WaveformPresetHarmonics(WaveformTriangle, 118.0, SampleRate), Pan: 0.2, Group: "Infrastructure"}
 // --- Web addition (Sawtooth, 190 Hz) ---
 classify.ClassQUIC:  {BaseHz: 190.0, WaveformType: WaveformSawtooth, Harmonics: WaveformPresetHarmonics(WaveformSawtooth, 190.0, SampleRate), Pan: -0.2, Group: "Web"}
 // --- Mail additions (Triangle, 241-305 Hz) ---
 classify.ClassIMAP:    {BaseHz: 241.0, WaveformType: WaveformTriangle, Harmonics: WaveformPresetHarmonics(WaveformTriangle, 241.0, SampleRate), Pan: 0.3, Group: "Mail"}
 classify.ClassPOP3:    {BaseHz: 271.0, WaveformType: WaveformTriangle, Harmonics: WaveformPresetHarmonics(WaveformTriangle, 271.0, SampleRate), Pan: 0.4, Group: "Mail"}
 classify.ClassSMTPSub: {BaseHz: 305.0, WaveformType: WaveformTriangle, Harmonics: WaveformPresetHarmonics(WaveformTriangle, 305.0, SampleRate), Pan: 0.5, Group: "Mail"}
 // --- Remote Access additions (Square, 385-485 Hz) ---
 classify.ClassRDP:    {BaseHz: 385.0, WaveformType: WaveformSquare, Harmonics: WaveformPresetHarmonics(WaveformSquare, 385.0, SampleRate), Pan: -0.6, Group: "Remote Access"}
 classify.ClassTelnet: {BaseHz: 432.0, WaveformType: WaveformSquare, Harmonics: WaveformPresetHarmonics(WaveformSquare, 432.0, SampleRate), Pan: -0.5, Group: "Remote Access"}
 classify.ClassVNC:    {BaseHz: 485.0, WaveformType: WaveformSquare, Harmonics: WaveformPresetHarmonics(WaveformSquare, 485.0, SampleRate), Pan: -0.4, Group: "Remote Access"}
 // --- File Transfer additions (Square, 545-687 Hz) ---
 classify.ClassFTP:  {BaseHz: 545.0, WaveformType: WaveformSquare, Harmonics: WaveformPresetHarmonics(WaveformSquare, 545.0, SampleRate), Pan: 0.5, Group: "File Transfer"}
 classify.ClassSMB:  {BaseHz: 612.0, WaveformType: WaveformSquare, Harmonics: WaveformPresetHarmonics(WaveformSquare, 612.0, SampleRate), Pan: 0.6, Group: "File Transfer"}
 classify.ClassTFTP: {BaseHz: 687.0, WaveformType: WaveformSquare, Harmonics: WaveformPresetHarmonics(WaveformSquare, 687.0, SampleRate), Pan: 0.7, Group: "File Transfer"}
 // --- Database additions (Sawtooth, 1543-2182 Hz) ---
 classify.ClassMySQL:      {BaseHz: 1543.0, WaveformType: WaveformSawtooth, Harmonics: WaveformPresetHarmonics(WaveformSawtooth, 1543.0, SampleRate), Pan: -0.4, Group: "Database"}
 classify.ClassPostgreSQL: {BaseHz: 1732.0, WaveformType: WaveformSawtooth, Harmonics: WaveformPresetHarmonics(WaveformSawtooth, 1732.0, SampleRate), Pan: -0.2, Group: "Database"}
 classify.ClassRedis:      {BaseHz: 1944.0, WaveformType: WaveformSawtooth, Harmonics: WaveformPresetHarmonics(WaveformSawtooth, 1944.0, SampleRate), Pan: 0.2, Group: "Database"}
 classify.ClassMongoDB:    {BaseHz: 2182.0, WaveformType: WaveformSawtooth, Harmonics: WaveformPresetHarmonics(WaveformSawtooth, 2182.0, SampleRate), Pan: 0.4, Group: "Database"}
 // --- VoIP (Sine, 2449 Hz) ---
 classify.ClassSIP: {BaseHz: 2449.0, WaveformType: WaveformSine, Harmonics: WaveformPresetHarmonics(WaveformSine, 2449.0, SampleRate), Pan: 0.0, Group: "VoIP"}
 // --- Infrastructure auto-assigned (Triangle, 2950-3250 Hz) per D-02 ---
 classify.ClassLDAP:     {BaseHz: 2950.0, WaveformType: WaveformTriangle, Harmonics: WaveformPresetHarmonics(WaveformTriangle, 2950.0, SampleRate), Pan: -0.2, Group: "Infrastructure"}
 classify.ClassKerberos: {BaseHz: 3250.0, WaveformType: WaveformTriangle, Harmonics: WaveformPresetHarmonics(WaveformTriangle, 3250.0, SampleRate), Pan: 0.0, Group: "Infrastructure"}
 classify.ClassSyslog:   {BaseHz: 3050.0, WaveformType: WaveformTriangle, Harmonics: WaveformPresetHarmonics(WaveformTriangle, 3050.0, SampleRate), Pan: 0.2, Group: "Infrastructure"}
 ```
 Place new entries in the map grouped by family with section comments matching the existing pattern (e.g., `// --- Infrastructure additions ...`). Insert them logically:
 - Infrastructure additions (mDNS, SSDP, SNMP) after ClassDHCP and before ClassDNS (since 93/105/118 Hz come between DHCP=82 and DNS=133)
 - Web addition (QUIC) after ClassHTTP
 - Mail additions after ClassSMTP
 - Remote Access additions after ClassSSH
 - File Transfer after Unknown entries
 - Database after Unknown entries
 - VoIP after Database
 - LDAP/Kerberos/Syslog at end (auto-assigned range)
 **classify/types.go** -- Per D-02 and D-03:
 1. Add ClassLDAP, ClassKerberos, ClassSyslog to AllClasses() in the Infrastructure section, after ClassSNMP.
 2. Remove the comment "Excludes ClassLDAP, ClassKerberos, and ClassSyslog" from the AllClasses() doc comment.
 3. Update the doc comment to say "AllClasses returns all known traffic classes in display order."
 4. The AllClasses() function should now return 35 entries total.
  </action>
  <verify>
    <automated>cd /home/dev/workspace/yoloyolo && go build ./synth/... ./classify/...</automated>
  </verify>
  <acceptance_criteria>
 - `grep -c "classify\.Class" synth/config.go` shows at least 35 occurrences in ClassFreqConfigs
 - `grep "ClassLDAP" classify/types.go` appears in AllClasses() return slice
 - `grep "ClassKerberos" classify/types.go` appears in AllClasses() return slice
 - `grep "ClassSyslog" classify/types.go` appears in AllClasses() return slice
 - `go build ./synth/... ./classify/...` succeeds
  </acceptance_criteria>
  <done>ClassFreqConfigs has 35 entries with correct Hz/waveform/pan/group values. AllClasses() returns 35 entries including LDAP/Kerberos/Syslog. Both packages compile.</done>
 </task>
 <task type="auto">
  <name>Task 2: Fix all hardcoded count assertions in tests</name>
  <files>synth/bank_test.go, config/config_test.go, classify/classifier_test.go</files>
  <read_first>synth/bank_test.go, config/config_test.go, classify/classifier_test.go</read_first>
  <action>
 Update all hardcoded count assertions to reflect the new 35-entry state. Per research Pitfall 1 and Pitfall 2:
 **synth/bank_test.go:**
 - Line 10: Rename `TestNewBankHas14Layers` to `TestNewBankHasAllLayers`
 - Line 12: Change `len(b.layers) != 14` to `len(b.layers) != len(classify.AllClasses())`
 - Line 13: Change `want 14` to a dynamic message using `len(classify.AllClasses())`
 **config/config_test.go:**
 - Line 120: Change `len(cfgs) != 14` to `len(cfgs) != len(classify.AllClasses())` in TestLoadNoConfig
 - Line 149: Change `len(cfgs) != 14` to `len(cfgs) != len(classify.AllClasses())` in TestLoadUnknownClass
 - Line 180: Change `len(cfgs) != 14` to `len(cfgs) != len(classify.AllClasses())` in TestLoadAllDefaultsPresent
 - Line 617: Change `len(result.FreqCfgs) != 14` to `len(result.FreqCfgs) != len(classify.AllClasses())` in TestLoadNoConfigReturnsLoadResult
 - Lines 407-416 in TestPrintConfigContainsAllClasses: Replace the hardcoded `classNames` slice with a loop over `classify.AllClasses()`. Change to:
  ```go
  for _, cls := range classify.AllClasses() {
      if !strings.Contains(output, string(cls)) {
          t.Errorf("PrintConfig output missing class %q", cls)
      }
  }
  ```
 **classify/classifier_test.go:**
 - Line 459 (approximately): Change `want 32` to `want 35` in TestAllClassesCount. Update the assertion value from 32 to 35.
 Use `len(classify.AllClasses())` for dynamic counts wherever possible (synth and config tests). For classifier_test.go, use the literal 35 since the test is specifically verifying the count is a known value per D-03.
  </action>
  <verify>
    <automated>cd /home/dev/workspace/yoloyolo && go test ./synth/... ./classify/... ./config/...</automated>
  </verify>
  <acceptance_criteria>
 - `go test ./synth/...` passes (0 failures)
 - `go test ./classify/...` passes (0 failures)
 - `go test ./config/...` passes (0 failures)
 - `grep "14" synth/bank_test.go` returns no lines with hardcoded layer counts
 - `grep 'want 14' config/config_test.go` returns no matches
 - `grep 'want 32' classify/classifier_test.go` returns no matches
  </acceptance_criteria>
  <done>All test suites pass with 35 classes. No hardcoded counts of 14 or 32 remain in test assertions. TestNewBankHas14Layers renamed to TestNewBankHasAllLayers.</done>
 </task>
 </tasks>
 <verification>
 ```bash
 cd /home/dev/workspace/yoloyolo && go test ./...
 ```
 All tests pass. ClassFreqConfigs has 35 entries matching AllClasses().
 </verification>
 <success_criteria>
 - `go test ./...` passes fully
 - ClassFreqConfigs map has exactly 35 entries
 - AllClasses() returns exactly 35 entries
 - No hardcoded counts of 14 or 32 remain in test files
 - Every new entry uses WaveformPresetHarmonics() (not hand-tuned harmonics)
 - LDAP/Kerberos/Syslog have Group="Infrastructure" and WaveformTriangle
 </success_criteria>
 <output>
 After completion, create `.planning/phases/11-synthesis-and-config-layer/11-01-SUMMARY.md`
 </output>
@@ -0,0 +1,103 @@
 ---
 phase: 11
 plan: 01
 subsystem: synth, classify
 tags: [frequency-config, traffic-classes, test-fixes, data-layer]
 dependency_graph:
  requires: [classify/types.go TrafficClass constants from Phase 10]
  provides: [ClassFreqConfigs with 35 entries, AllClasses() returning 35 entries]
  affects: [synth/bank.go, config/config.go, config/config_test.go, synth/bank_test.go]
 tech_stack:
  added: []
  patterns: [WaveformPresetHarmonics for all new entries, len(classify.AllClasses()) for dynamic counts]
 key_files:
  created: []
  modified:
    - synth/config.go
    - classify/types.go
    - synth/bank_test.go
    - config/config_test.go
    - classify/classifier_test.go
 decisions:
  - "Use len(classify.AllClasses()) in synth and config tests for dynamic count validation"
  - "LDAP/Kerberos/Syslog placed in Infrastructure section of AllClasses() after SNMP"
  - "All 21 new ClassFreqConfigs entries use WaveformPresetHarmonics() per D-01 decision"
 metrics:
  duration: ~8min
  completed: "2026-03-27"
  tasks: 2
  files_modified: 5
 ---
 # Phase 11 Plan 01: Frequency Config Data Layer Summary
 **One-liner:** Added 21 ClassFreqConfigs entries (mDNS through Syslog) and expanded AllClasses() to 35 with LDAP/Kerberos/Syslog, fixing all hardcoded count assertions across synth, config, and classify test files.
 ## What Was Built
 ### Task 1: Add 21 ClassFreqConfigs entries and update AllClasses()
 **synth/config.go** — Added 21 new `FreqConfig` entries to `ClassFreqConfigs` map, organized by protocol family:
 | Family | Classes | Hz Range | Waveform |
 |--------|---------|----------|----------|
 | Infrastructure additions | mDNS, SSDP, SNMP | 93-118 Hz | Triangle |
 | Web addition | QUIC | 190 Hz | Sawtooth |
 | Mail additions | IMAP, POP3, SMTP-sub | 241-305 Hz | Triangle |
 | Remote Access additions | RDP, Telnet, VNC | 385-485 Hz | Square |
 | File Transfer additions | FTP, SMB, TFTP | 545-687 Hz | Square |
 | Database additions | MySQL, PostgreSQL, Redis, MongoDB | 1543-2182 Hz | Sawtooth |
 | VoIP | SIP | 2449 Hz | Sine |
 | Infrastructure auto-assigned | LDAP, Kerberos, Syslog | 2950-3250 Hz | Triangle |
 All 21 entries use `WaveformPresetHarmonics()` per D-01. Total map: 35 entries.
 **classify/types.go** — Updated `AllClasses()`:
 - Added `ClassLDAP`, `ClassKerberos`, `ClassSyslog` to Infrastructure section (after ClassSNMP)
 - Updated doc comment: removed Phase 11 exclusion note, now says "AllClasses returns all known traffic classes in display order."
 - Now returns 35 entries (was 32)
 ### Task 2: Fix all hardcoded count assertions
 | File | Change |
 |------|--------|
 | synth/bank_test.go | Renamed `TestNewBankHas14Layers` to `TestNewBankHasAllLayers`; `!= 14` → `!= len(classify.AllClasses())` |
 | config/config_test.go | 4 occurrences of `!= 14` → `!= len(classify.AllClasses())`; TestPrintConfigContainsAllClasses: hardcoded 14-class list → `classify.AllClasses()` loop |
 | classify/classifier_test.go | `want 32` → `want 35` in TestAllClassesCount |
 ## Verification Results
 ```
 go test ./...
 ok  github.com/netsynth/netsynth/aggregate
 ok  github.com/netsynth/netsynth/capture
 ok  github.com/netsynth/netsynth/classify
 ok  github.com/netsynth/netsynth/cmd/netsynth
 ok  github.com/netsynth/netsynth/config
 ok  github.com/netsynth/netsynth/encode
 ok  github.com/netsynth/netsynth/synth
 ```
 All 7 packages pass.
 ## Commits
 | Task | Commit | Description |
 |------|--------|-------------|
 | 1 | 1556ce8 | feat(11-01): add 21 ClassFreqConfigs entries and include LDAP/Kerberos/Syslog in AllClasses() |
 | 2 | 35d8915 | fix(11-01): update hardcoded count assertions to reflect 35 traffic classes |
 ## Deviations from Plan
 **1. [Rule 3 - Blocker] Worktree was at stale commit missing Phase 8-10 changes**
 - **Found during:** Pre-execution setup
 - **Issue:** Worktree branch `worktree-agent-af29ad97` was at commit `8e565ec` (milestone v1.2 roadmap docs), 43 commits behind `master`. The target files (synth/config.go, classify/types.go) were in their Phase 7 state.
 - **Fix:** Ran `git merge master --no-edit` (fast-forward) to bring worktree to current HEAD `683470a`.
 - **Files modified:** All files (fast-forward merge, no conflicts)
 - **Commit:** Not a separate commit — prerequisite action before Task 1
 ## Known Stubs
 None — all 35 ClassFreqConfigs entries have complete Hz, waveform, pan, and group values. No placeholder data.
 ## Self-Check: PASSED
@@ -0,0 +1,415 @@
 ---
 phase: 11-synthesis-and-config-layer
 plan: 02
 type: execute
 wave: 2
 depends_on: ["11-01"]
 files_modified:
  - config/config.go
  - config/config_test.go
 autonomous: true
 requirements:
  - GRP-02
  - GRP-03
 must_haves:
  truths:
    - "PrintConfig output groups classes by family with section header comments"
    - "Groups appear in canonical order: Infrastructure, Web, Mail, Remote Access, File Transfer, Database, Discovery, VoIP, Unknown"
    - "Within each group, classes are sorted by ascending BaseHz"
    - "User-defined classes appear under a User-defined section header after all built-in groups"
    - "Users can define [groups] in TOML to reassign a class to a different group"
    - "Unknown class names in [groups] produce a warning, not an error"
    - "Group reassignment only affects PrintConfig grouping, not frequency or waveform"
  artifacts:
    - path: "config/config.go"
      provides: "Group-ordered PrintConfig, [groups] TOML support, applyGroupOverrides function"
      exports: ["PrintConfig", "Load", "LoadResult"]
    - path: "config/config_test.go"
      provides: "Tests for group headers, group reassignment, unknown class warning"
      contains: "TestPrintConfigGroupHeaders"
  key_links:
    - from: "config/config.go"
      to: "synth/config.go"
      via: "PrintConfig reads FreqConfig.Group field"
      pattern: "cfg\\.Group"
    - from: "config/config.go"
      to: "classify/types.go"
      via: "PrintConfig iterates AllClasses() and groups by Group field"
      pattern: "classify\\.AllClasses"
 ---
 <objective>
 Refactor PrintConfig to group classes by their Group field with section headers (GRP-02), and add [groups] TOML config support for reassigning protocols to different sound families (GRP-03).
 Purpose: This is the user-facing output change that makes --print-config show organized, family-coherent class listings, and gives users the ability to rearrange groupings via TOML config.
 Output: PrintConfig emits group headers in canonical order; [groups] TOML table parsed and applied; tests cover group headers, reassignment, and unknown class warnings.
 </objective>
 <execution_context>
@$HOME/.claude/get-shit-done/workflows/execute-plan.md
@$HOME/.claude/get-shit-done/templates/summary.md
 </execution_context>
 <context>
@.planning/PROJECT.md
@.planning/ROADMAP.md
@.planning/STATE.md
@.planning/phases/11-synthesis-and-config-layer/11-01-SUMMARY.md
@config/config.go
@config/config_test.go
 <interfaces>
 <!-- Key types and contracts from Plan 01 output -->
 From synth/config.go (after Plan 01):
 ```go
 type FreqConfig struct {
    BaseHz       float64
    Harmonics    []HarmonicDef
    Pan          float64
    WaveformType WaveformType
    Group        string       // "Infrastructure", "Web", "Mail", "Remote Access", "File Transfer", "Database", "Discovery", "VoIP", "Unknown"
 }
 var ClassFreqConfigs = map[classify.TrafficClass]FreqConfig{...}  // 35 entries
 ```
 From classify/types.go (after Plan 01):
 ```go
 func AllClasses() []TrafficClass  // returns 35 entries including LDAP/Kerberos/Syslog
 ```
 From config/config.go (current):
 ```go
 type rawConfig struct {
    Sounds map[string]SoundOverride `toml:"sounds"`
    Rules  []RawRule                `toml:"rules"`
 }
 type LoadResult struct {
    FreqCfgs    map[classify.TrafficClass]synth.FreqConfig
    UserRules   []classify.Rule
    ConfigPath  string
    AutoClasses map[classify.TrafficClass]bool
 }
 func Load(configPath string) (LoadResult, error)
 func PrintConfig(result LoadResult) string
 ```
 </interfaces>
 </context>
 <tasks>
 <task type="auto">
  <name>Task 1: Add [groups] TOML support and refactor PrintConfig for group headers</name>
  <files>config/config.go</files>
  <read_first>config/config.go</read_first>
  <action>
 Three changes to config/config.go:
 **1. Add Groups field to rawConfig struct (per D-07):**
 ```go
 type rawConfig struct {
    Sounds map[string]SoundOverride `toml:"sounds"`
    Rules  []RawRule                `toml:"rules"`
    Groups map[string]string        `toml:"groups"`
 }
 ```
 **2. Add applyGroupOverrides function and wire into Load() (per D-07/D-08/D-09):**
 Add a new function `applyGroupOverrides`:
 ```go
 // applyGroupOverrides overlays [groups] reassignments onto freqCfgs.Group in-place.
 // Unknown class names produce a warning to stderr (D-09).
 // Unknown group names are silently accepted -- users can invent custom groups (D-09).
 func applyGroupOverrides(cfgs map[classify.TrafficClass]synth.FreqConfig, groups map[string]string) {
    for className, groupName := range groups {
        cls := classify.TrafficClass(className)
        cfg, known := cfgs[cls]
        if !known {
            fmt.Fprintf(os.Stderr, "Warning: config: [groups]: unknown class %q (ignored)\n", className)
            continue
        }
        cfg.Group = groupName
        cfgs[cls] = cfg
    }
 }
 ```
 In Load(), after the `merge(freqCfgs, raw.Sounds)` call (around line 101), add:
 ```go
 applyGroupOverrides(freqCfgs, raw.Groups)
 ```
 This goes AFTER merge so that group reassignment is the last transformation before returning. The call should be present in both code paths (with config file). The no-config path (line 77) does not need it since there is no raw.Groups to apply.
 **3. Refactor PrintConfig for group-ordered output (per D-04/D-05/D-06):**
 Replace the current flat `AllClasses()` iteration (lines 298-321) and the user-defined section (lines 323-333) with group-ordered output.
 Add a package-level variable for canonical group order:
 ```go
 // groupOrder defines the canonical display order for --print-config section headers (D-04).
 var groupOrder = []string{
    "Infrastructure", "Web", "Mail", "Remote Access",
    "File Transfer", "Database", "Discovery", "VoIP", "Unknown",
 }
 ```
 Replace the built-in and user-defined emission blocks with:
 ```go
 // Build group -> []TrafficClass index from AllClasses()
 builtinByGroup := map[string][]classify.TrafficClass{}
 builtinSet := map[classify.TrafficClass]bool{}
 for _, cls := range classify.AllClasses() {
    builtinSet[cls] = true
    cfg := result.FreqCfgs[cls]
    grp := cfg.Group
    builtinByGroup[grp] = append(builtinByGroup[grp], cls)
 }
 // Sort each group by ascending BaseHz (D-05) using result.FreqCfgs (effective Hz, not defaults)
 for grp := range builtinByGroup {
    classes := builtinByGroup[grp]
    sort.Slice(classes, func(i, j int) bool {
        return result.FreqCfgs[classes[i]].BaseHz < result.FreqCfgs[classes[j]].BaseHz
    })
 }
 // Emit built-in classes grouped with headers (D-04)
 for _, grp := range groupOrder {
    classes, ok := builtinByGroup[grp]
    if !ok || len(classes) == 0 {
        continue
    }
    fmt.Fprintf(&sb, "# %s\n\n", grp)
    for _, cls := range classes {
        cfg := result.FreqCfgs[cls]
        annotation := classAnnotation(cls, cfg, result.AutoClasses)
        fmt.Fprintf(&sb, "# %s -- %.1f Hz (%s)\n", string(cls), cfg.BaseHz, annotation)
        fmt.Fprintf(&sb, "[sounds.%s]\n", string(cls))
        fmt.Fprintf(&sb, "frequency = %.1f\n", cfg.BaseHz)
        fmt.Fprintf(&sb, "waveform = %q\n", waveformString(cfg.WaveformType))
        fmt.Fprintf(&sb, "\n")
    }
 }
 // Check for custom groups (from [groups] reassignment) that are not in groupOrder
 // These classes were already emitted under their reassigned group if the group is canonical.
 // For non-canonical group names (user-invented), collect and emit separately.
 customGroups := map[string][]classify.TrafficClass{}
 for _, cls := range classify.AllClasses() {
    cfg := result.FreqCfgs[cls]
    grp := cfg.Group
    isCanonical := false
    for _, cg := range groupOrder {
        if grp == cg {
            isCanonical = true
            break
        }
    }
    if !isCanonical {
        customGroups[grp] = append(customGroups[grp], cls)
    }
 }
 // Sort and emit custom group sections
 var customGroupNames []string
 for grp := range customGroups {
    customGroupNames = append(customGroupNames, grp)
 }
 sort.Strings(customGroupNames)
 for _, grp := range customGroupNames {
    classes := customGroups[grp]
    sort.Slice(classes, func(i, j int) bool {
        return result.FreqCfgs[classes[i]].BaseHz < result.FreqCfgs[classes[j]].BaseHz
    })
    fmt.Fprintf(&sb, "# %s\n\n", grp)
    for _, cls := range classes {
        cfg := result.FreqCfgs[cls]
        annotation := classAnnotation(cls, cfg, result.AutoClasses)
        fmt.Fprintf(&sb, "# %s -- %.1f Hz (%s)\n", string(cls), cfg.BaseHz, annotation)
        fmt.Fprintf(&sb, "[sounds.%s]\n", string(cls))
        fmt.Fprintf(&sb, "frequency = %.1f\n", cfg.BaseHz)
        fmt.Fprintf(&sb, "waveform = %q\n", waveformString(cfg.WaveformType))
        fmt.Fprintf(&sb, "\n")
    }
 }
 // Emit user-defined classes (in FreqCfgs but not in AllClasses) under "# User-defined" (D-06)
 var userClasses []string
 for cls := range result.FreqCfgs {
    if !builtinSet[cls] {
        userClasses = append(userClasses, string(cls))
    }
 }
 sort.Strings(userClasses)
 if len(userClasses) > 0 {
    fmt.Fprintf(&sb, "# User-defined\n\n")
    for _, clsStr := range userClasses {
        cls := classify.TrafficClass(clsStr)
        cfg := result.FreqCfgs[cls]
        annotation := classAnnotation(cls, cfg, result.AutoClasses)
        fmt.Fprintf(&sb, "# %s -- %.1f Hz (%s)\n", clsStr, cfg.BaseHz, annotation)
        fmt.Fprintf(&sb, "[sounds.%s]\n", clsStr)
        fmt.Fprintf(&sb, "frequency = %.1f\n", cfg.BaseHz)
        fmt.Fprintf(&sb, "waveform = %q\n", waveformString(cfg.WaveformType))
        fmt.Fprintf(&sb, "\n")
    }
 }
 ```
 Remove the old `builtinSet` declaration (line 298) since it is now declared in the new block. Remove the old `userClasses` collection and sort (lines 304-310). Remove the old built-in emission loop (lines 313-321) and user-defined emission loop (lines 323-333).
 Do NOT modify the header section (lines 273-281) or rules section (lines 283-295) -- those stay unchanged.
 Important: the `sort` package is already imported. The `builtinSet` map is now declared inside the new block, so remove the old one.
  </action>
  <verify>
    <automated>cd /home/dev/workspace/yoloyolo && go build ./config/...</automated>
  </verify>
  <acceptance_criteria>
 - `grep "groupOrder" config/config.go` returns the canonical group order slice
 - `grep "applyGroupOverrides" config/config.go` returns the function definition
 - `grep 'Groups map\[string\]string' config/config.go` shows the new rawConfig field
 - `grep "# User-defined" config/config.go` shows the user-defined section header
 - `go build ./config/...` succeeds
  </acceptance_criteria>
  <done>PrintConfig emits group-ordered output with section headers. rawConfig has Groups field. applyGroupOverrides function exists and is called in Load(). Compiles successfully.</done>
 </task>
 <task type="auto">
  <name>Task 2: Add tests for group headers, group reassignment, and unknown class warning</name>
  <files>config/config_test.go</files>
  <read_first>config/config_test.go, config/config.go</read_first>
  <action>
 Add 4 new test functions to config/config_test.go:
 **TestPrintConfigGroupHeaders** -- Verifies GRP-02 group header output:
 ```go
 func TestPrintConfigGroupHeaders(t *testing.T) {
    t.Chdir(t.TempDir())
    result, err := config.Load("")
    if err != nil {
        t.Fatalf("Load: %v", err)
    }
    output := config.PrintConfig(result)
    // Verify all populated group headers appear
    expectedGroups := []string{"# Infrastructure", "# Web", "# Mail", "# Remote Access", "# File Transfer", "# Database", "# VoIP", "# Unknown"}
    for _, header := range expectedGroups {
        if !strings.Contains(output, header+"\n") {
            t.Errorf("PrintConfig output missing group header %q", header)
        }
    }
    // Verify canonical order: Infrastructure before Web before Mail etc.
    infraIdx := strings.Index(output, "# Infrastructure\n")
    webIdx := strings.Index(output, "# Web\n")
    mailIdx := strings.Index(output, "# Mail\n")
    remoteIdx := strings.Index(output, "# Remote Access\n")
    ftIdx := strings.Index(output, "# File Transfer\n")
    dbIdx := strings.Index(output, "# Database\n")
    voipIdx := strings.Index(output, "# VoIP\n")
    unknownIdx := strings.Index(output, "# Unknown\n")
    if infraIdx >= webIdx || webIdx >= mailIdx || mailIdx >= remoteIdx ||
        remoteIdx >= ftIdx || ftIdx >= dbIdx || dbIdx >= voipIdx || voipIdx >= unknownIdx {
        t.Errorf("Group headers not in canonical order: infra=%d web=%d mail=%d remote=%d ft=%d db=%d voip=%d unknown=%d",
            infraIdx, webIdx, mailIdx, remoteIdx, ftIdx, dbIdx, voipIdx, unknownIdx)
    }
 }
 ```
 **TestLoadGroupOverride** -- Verifies GRP-03 basic reassignment:
 ```go
 func TestLoadGroupOverride(t *testing.T) {
    path := writeTOML(t, "[groups]\nIMAP = \"Web\"\n")
    result, err := config.Load(path)
    if err != nil {
        t.Fatalf("Load: %v", err)
    }
    cfg := result.FreqCfgs[classify.ClassIMAP]
    if cfg.Group != "Web" {
        t.Errorf("IMAP Group: got %q, want %q", cfg.Group, "Web")
    }
    // Frequency and waveform unchanged (D-08)
    defaultCfg := synth.ClassFreqConfigs[classify.ClassIMAP]
    if cfg.BaseHz != defaultCfg.BaseHz {
        t.Errorf("IMAP BaseHz changed: got %v, want %v (should be unchanged by group reassignment)", cfg.BaseHz, defaultCfg.BaseHz)
    }
 }
 ```
 **TestLoadGroupUnknownClass** -- Verifies D-09 warning for unknown class:
 ```go
 func TestLoadGroupUnknownClass(t *testing.T) {
    path := writeTOML(t, "[groups]\nBOGUS = \"Web\"\n")
    result, err := config.Load(path)
    if err != nil {
        t.Fatalf("Load should not error on unknown [groups] class: %v", err)
    }
    // Should still have all default classes
    if len(result.FreqCfgs) != len(classify.AllClasses()) {
        t.Errorf("FreqCfgs len: got %d, want %d", len(result.FreqCfgs), len(classify.AllClasses()))
    }
 }
 ```
 **TestPrintConfigGroupReassignment** -- Verifies PrintConfig reflects reassignment:
 ```go
 func TestPrintConfigGroupReassignment(t *testing.T) {
    path := writeTOML(t, "[groups]\nIMAP = \"Web\"\n")
    result, err := config.Load(path)
    if err != nil {
        t.Fatalf("Load: %v", err)
    }
    output := config.PrintConfig(result)
    // Find the "# Web" section and check IMAP appears after it
    webIdx := strings.Index(output, "# Web\n")
    mailIdx := strings.Index(output, "# Mail\n")
    imapIdx := strings.Index(output, "[sounds.IMAP]")
    if imapIdx < webIdx || imapIdx > mailIdx {
        t.Errorf("IMAP (reassigned to Web) should appear between Web and Mail headers; web=%d imap=%d mail=%d", webIdx, imapIdx, mailIdx)
    }
 }
 ```
 Also update `TestPrintConfigContainsAllClasses` if it was not already updated in Plan 01 -- it should use `classify.AllClasses()` loop instead of hardcoded class names. (Plan 01 should have done this, but verify and fix if needed.)
  </action>
  <verify>
    <automated>cd /home/dev/workspace/yoloyolo && go test ./config/... -v -run "TestPrintConfigGroup|TestLoadGroup"</automated>
  </verify>
  <acceptance_criteria>
 - `go test ./config/... -run TestPrintConfigGroupHeaders` passes
 - `go test ./config/... -run TestLoadGroupOverride` passes
 - `go test ./config/... -run TestLoadGroupUnknownClass` passes
 - `go test ./config/... -run TestPrintConfigGroupReassignment` passes
 - `go test ./config/...` all tests pass (no regressions)
  </acceptance_criteria>
  <done>Four new tests cover GRP-02 (group headers in canonical order) and GRP-03 (group reassignment, unknown class warning, PrintConfig reflects reassignment). Full config test suite passes.</done>
 </task>
 </tasks>
 <verification>
 ```bash
 cd /home/dev/workspace/yoloyolo && go test ./...
 ```
 All tests pass. PrintConfig shows group headers. [groups] TOML works for reassignment.
 Manual verification: `go run . --print-config` shows classes organized by group with `# Infrastructure`, `# Web`, `# Mail`, `# Remote Access`, `# File Transfer`, `# Database`, `# VoIP`, `# Unknown` section headers.
 </verification>
 <success_criteria>
 - `go test ./...` passes fully
 - PrintConfig output contains group section headers in canonical order
 - [groups] TOML table reassigns a class's group in PrintConfig output
 - Unknown class names in [groups] produce stderr warning, not error
 - Group reassignment does not change frequency or waveform (D-08)
 - User-defined classes appear under "# User-defined" section
 </success_criteria>
 <output>
 After completion, create `.planning/phases/11-synthesis-and-config-layer/11-02-SUMMARY.md`
 </output>
@@ -0,0 +1,97 @@
 ---
 phase: 11
 plan: 02
 subsystem: config
 tags: [print-config, group-headers, toml-groups, user-facing-output]
 dependency_graph:
  requires: [synth/config.go FreqConfig.Group field from Phase 11 Plan 01, classify/types.go AllClasses() with 35 entries]
  provides: [Group-ordered PrintConfig output, [groups] TOML support, applyGroupOverrides function]
  affects: [config/config.go, config/config_test.go]
 tech_stack:
  added: []
  patterns: [rawConfig Groups field for TOML [groups] table, groupOrder canonical slice for section ordering]
 key_files:
  created: []
  modified:
    - config/config.go
    - config/config_test.go
 decisions:
  - "Non-canonical group names (user-invented via [groups]) emitted after canonical groups in alphabetical order"
  - "builtinByGroup built from result.FreqCfgs[cls].Group (effective group after reassignment) not from synth defaults"
 metrics:
  duration: ~5min
  completed: "2026-03-27"
  tasks: 2
  files_modified: 2
 ---
 # Phase 11 Plan 02: Group-Ordered PrintConfig and [groups] TOML Support Summary
 **One-liner:** Refactored PrintConfig to emit group section headers (Infrastructure, Web, Mail, Remote Access, File Transfer, Database, Discovery, VoIP, Unknown) with classes sorted by ascending BaseHz, and added [groups] TOML table support for user-defined protocol-to-group reassignment.
 ## What Was Built
 ### Task 1: Add [groups] TOML support and refactor PrintConfig for group headers
 **config/config.go** — Three changes:
 **1. Groups field on rawConfig:**
 ```go
 type rawConfig struct {
    Sounds map[string]SoundOverride `toml:"sounds"`
    Rules  []RawRule                `toml:"rules"`
    Groups map[string]string        `toml:"groups"`
 }
 ```
 **2. applyGroupOverrides function** — overlays [groups] reassignments onto FreqConfig.Group in-place. Unknown class names emit a stderr warning and are skipped (not an error). Unknown group names are silently accepted (users can invent custom groups). Called in Load() after merge().
 **3. PrintConfig refactored** — replaced flat AllClasses() iteration with:
 - `groupOrder` canonical slice: `["Infrastructure", "Web", "Mail", "Remote Access", "File Transfer", "Database", "Discovery", "VoIP", "Unknown"]`
 - Built-in classes grouped by their effective Group field, sorted ascending by BaseHz within each group
 - Section headers emitted as `# GroupName\n\n`
 - Non-canonical group names (user-invented) emitted after canonical groups in alphabetical order
 - User-defined classes (not in AllClasses()) emitted under `# User-defined` section
 ### Task 2: Add tests for group headers, group reassignment, and unknown class warning
 **config/config_test.go** — 4 new test functions:
 | Test | What It Covers |
 |------|---------------|
 | `TestPrintConfigGroupHeaders` | GRP-02: all 8 populated group headers present in canonical order |
 | `TestLoadGroupOverride` | GRP-03: [groups] reassigns IMAP from Mail to Web, Hz/waveform unchanged |
 | `TestLoadGroupUnknownClass` | D-09: unknown class in [groups] produces no error, map size unchanged |
 | `TestPrintConfigGroupReassignment` | GRP-03: PrintConfig places reassigned IMAP between Web and Mail headers |
 ## Verification Results
 ```
 go test ./...
 ok  github.com/netsynth/netsynth/aggregate  (cached)
 ok  github.com/netsynth/netsynth/capture    (cached)
 ok  github.com/netsynth/netsynth/classify
 ok  github.com/netsynth/netsynth/cmd/netsynth
 ok  github.com/netsynth/netsynth/config
 ok  github.com/netsynth/netsynth/encode
 ok  github.com/netsynth/netsynth/synth
 ```
 All 7 packages pass.
 ## Commits
 | Task | Commit | Description |
 |------|--------|-------------|
 | 1 | 374282e | feat(11-02): add [groups] TOML support and group-ordered PrintConfig |
 | 2 | 7bf3ea1 | test(11-02): add group header and reassignment tests (GRP-02, GRP-03) |
 ## Deviations from Plan
 None - plan executed exactly as written.
 ## Known Stubs
 None — PrintConfig group output is fully wired to FreqConfig.Group field populated in Phase 11 Plan 01. No placeholder data.
 ## Self-Check: PASSED
@@ -0,0 +1,113 @@
 # Phase 11: Synthesis and Config Layer - Context
 **Gathered:** 2026-03-27
 **Status:** Ready for planning
 <domain>
 ## Phase Boundary
 Add ClassFreqConfigs entries for all 18 new classes in AllClasses() plus 3 LDAP/Kerberos/Syslog classes (adding them to AllClasses() too). Update `PrintConfig` to output classes grouped by family with section header comments. Add `[groups]` TOML config support for users to reassign protocols to different sound families. Fix all broken synth/config tests.
 </domain>
 <decisions>
 ## Implementation Decisions
 ### ClassFreqConfigs Entries
 - **D-01:** Add ClassFreqConfigs entries for all 18 new classes currently in AllClasses(). Use Hz values, waveforms, pans, and groups from the Phase 9 frequency allocation table comment in `synth/config.go` lines 74-110. Use `WaveformPresetHarmonics()` for all new entries (not hand-tuned harmonics).
 - **D-02:** Add ClassLDAP, ClassKerberos, ClassSyslog to AllClasses() in `classify/types.go`. Create ClassFreqConfigs entries for them using `autoAssignFreq`-derived Hz values (FNV hash in [2500, 4000] Hz range). Their group is "Infrastructure", waveform is Triangle (matching the Infrastructure family pattern).
 - **D-03:** After D-01 and D-02, AllClasses() returns 35 entries (32 + 3). TestAllClassesCount updated to 35.
 ### PrintConfig Group Headers (GRP-02)
 - **D-04:** PrintConfig groups classes by their Group field value. Each group gets a comment header line: `# <Group>` followed by a blank line, then all classes in that group. Groups are ordered: Infrastructure, Web, Mail, Remote Access, File Transfer, Database, Discovery, VoIP, Unknown.
 - **D-05:** Within each group, classes are ordered by ascending BaseHz (matching the frequency allocation table order).
 - **D-06:** User-defined classes (not in AllClasses but in FreqCfgs) are emitted after all built-in groups under a "# User-defined" section header.
 ### TOML Groups Config (GRP-03)
 - **D-07:** Users define group reassignments in TOML with a `[groups]` table using simple key-value pairs: `IMAP = "Web"` reassigns IMAP from Mail to Web group. The key is the TrafficClass string value, the value is the target group name.
 - **D-08:** Group reassignment only affects `--print-config` output grouping and the Group field in FreqConfig. It does NOT change frequency, waveform, or pan — those stay as designed. PrintConfig reflects the reassignment.
 - **D-09:** Unknown group names in `[groups]` config are accepted (user can invent custom group names). Unknown class names produce a warning (same pattern as `[sounds.X]` with unknown class).
 ### Claude's Discretion
 - Exact Hz values for LDAP, Kerberos, Syslog (computed from autoAssignFreq FNV hash)
 - Pan positions for LDAP, Kerberos, Syslog
 - Test structure for new ClassFreqConfigs entries and PrintConfig group output
 - Whether to add `[groups]` to rawConfig struct as `map[string]string` or a custom type
 - How to handle group reassignment in the merge/load pipeline
 ### Folded Todos
 - **"Expand Traffic Classes"** (from `.planning/todos/pending/001-expand-traffic-classes.md`) — Phase 11 completes the synthesis side of this request. Constants/rules were added in Phase 10; now all classes get sound configurations.
 </decisions>
 <canonical_refs>
 ## Canonical References
 **Downstream agents MUST read these before planning or implementing.**
 ### Synth Package (primary modification target)
 - `synth/config.go` — `ClassFreqConfigs` map (add 21 new entries), frequency allocation table comment (lines 74-110), `FreqConfig` struct, `WaveformPresetHarmonics` function
 - `synth/config_test.go` — `TestAllClassesHaveConfig`, `TestClassFreqConfigsMatchAllClasses`, `TestFrequenciesInRange`, `TestFrequenciesUnique`, `TestNewBankHas14Layers`
 ### Config Package (PrintConfig + groups)
 - `config/config.go` — `PrintConfig` function (lines 270-336), `rawConfig` struct (line 38-41), `LoadResult` struct, `merge` function, `autoAssignFreq` function, `addAutoFreqEntries`
 - `config/config_test.go` — `TestLoadAllDefaultsPresent`, `TestPrintConfigOutput`
 ### Classification Package (AllClasses update)
 - `classify/types.go` — AllClasses() function, TrafficClass constants (add LDAP/Kerberos/Syslog to AllClasses())
 - `classify/classifier_test.go` — `TestAllClassesCount` (update from 32 to 35)
 ### Requirements
 - `.planning/REQUIREMENTS.md` — GRP-02, GRP-03
 - `.planning/ROADMAP.md` — Phase 11 success criteria
 ### Prior Phase Context
 - `.planning/phases/09-frequency-design-and-group-architecture/09-CONTEXT.md` — Frequency design decisions, waveform-per-family strategy
 - `.planning/phases/10-classification-layer/10-CONTEXT.md` — PROTO-08 frequency strategy (D-01: autoAssignFreq for LDAP/Kerberos/Syslog)
 </canonical_refs>
 <code_context>
 ## Existing Code Insights
 ### Reusable Assets
 - `WaveformPresetHarmonics(wt, baseHz, sampleRate)` — generates harmonics for any waveform at any frequency; use for all 21 new ClassFreqConfigs entries
 - `autoAssignFreq(className)` — FNV hash into [2500, 4000] Hz; use for LDAP/Kerberos/Syslog Hz values
 - `classAnnotation(cls, cfg, autoClasses)` — already handles "default", "override", "auto-assigned" annotations
 - `copyDefaults()` and `merge()` — existing config merge pipeline to extend with group support
 ### Established Patterns
 - ClassFreqConfigs entries follow: `classify.ClassX: {BaseHz, WaveformType, Harmonics: WaveformPresetHarmonics(...), Pan, Group}` pattern
 - PrintConfig iterates AllClasses() for built-ins, then sorts user-defined separately
 - rawConfig uses TOML struct tags for decoding; adding `[groups]` follows same pattern
 - SoundOverride uses pointer fields for partial overrides
 ### Integration Points
 - `config.Load()` returns `LoadResult` with `FreqCfgs` map — group reassignments must be applied before returning
 - `PrintConfig` reads `FreqCfgs` and `AllClasses()` — group headers derived from `FreqConfig.Group` field
 - `NewBank()` in `synth/bank.go` creates layers from `ClassFreqConfigs` — all new entries will get synthesis layers automatically
 - `TestNewBankHas14Layers` in `synth/bank_test.go` — name is stale, needs update to reflect 35 classes
 </code_context>
 <specifics>
 ## Specific Ideas
 - The frequency allocation table comment in `synth/config.go` (lines 74-110) is the authoritative source for all Hz, waveform, group, and pan values for the 18 table-designed classes
 - LDAP/Kerberos/Syslog get Infrastructure group + Triangle waveform (matching existing Infrastructure family) but their Hz comes from autoAssignFreq, not the table
 - PrintConfig currently has no group awareness — it just lists all classes in AllClasses() order. The refactor adds group-based iteration with comment headers
 - `go test ./...` must pass fully after Phase 11 — this is the first time since Phase 10 that the full test suite should be green
 </specifics>
 <deferred>
 ## Deferred Ideas
 None — discussion stayed within phase scope.
 </deferred>
 ---
 *Phase: 11-synthesis-and-config-layer*
 *Context gathered: 2026-03-27*
@@ -0,0 +1,62 @@
 # Phase 11: Synthesis and Config Layer - Discussion Log
 > **Audit trail only.** Do not use as input to planning, research, or execution agents.
 > Decisions are captured in CONTEXT.md — this log preserves the alternatives considered.
 **Date:** 2026-03-27
 **Phase:** 11-synthesis-and-config-layer
 **Areas discussed:** Group header format, TOML groups schema, LDAP/Kerberos/Syslog handling
 **Mode:** --auto (all decisions auto-selected)
 ---
 ## Group Header Format in PrintConfig
 | Option | Description | Selected |
 |--------|-------------|----------|
 | Comment headers with blank line separator | `# Mail` followed by blank line, then classes. Matches existing comment patterns. | ✓ |
 | Section dividers with dashes | `# --- Mail ---` style separator | |
 | No headers (flat list) | Keep current flat listing, rely on frequency ordering | |
 **User's choice:** [auto] Comment headers with blank line separator (recommended default)
 **Notes:** Matches existing `# Classification rules` comment pattern in PrintConfig output
 ---
 ## TOML Groups Config Schema
 | Option | Description | Selected |
 |--------|-------------|----------|
 | Simple key-value map | `[groups]` with `IMAP = "Web"` pairs. Simplest approach. | ✓ |
 | Nested table | `[groups.Mail]` with `members = ["IMAP", "POP3"]` — more structured but heavier | |
 | Array of tables | `[[groups]]` with name/members fields — most flexible but overkill | |
 **User's choice:** [auto] Simple key-value map (recommended default)
 **Notes:** Consistent with existing `[sounds.X]` pattern. Key = class name, value = target group.
 ---
 ## LDAP/Kerberos/Syslog Handling
 | Option | Description | Selected |
 |--------|-------------|----------|
 | Add to AllClasses() + ClassFreqConfigs | Complete the full set, fix broken tests. autoAssignFreq-derived Hz. | ✓ |
 | Keep out of AllClasses() | Leave as constants-only, no synthesis. Tests remain broken. | |
 | Add to ClassFreqConfigs only | Add configs but don't add to AllClasses(). Partial fix. | |
 **User's choice:** [auto] Add to AllClasses() + ClassFreqConfigs (recommended default)
 **Notes:** Completes the full 35-class set. Fixes TestAllClassesHaveConfig and related tests.
 ---
 ## Claude's Discretion
 - Exact Hz values for LDAP/Kerberos/Syslog (autoAssignFreq FNV hash)
 - Pan positions for LDAP/Kerberos/Syslog
 - Test structure and naming updates
 - rawConfig struct extension for `[groups]`
 - Group reassignment pipeline in merge/load
 ## Deferred Ideas
 None — discussion stayed within phase scope.
@@ -0,0 +1,412 @@
 # Phase 11: Synthesis and Config Layer - Research
 **Researched:** 2026-03-27
 **Domain:** Go — synth config completion, PrintConfig group headers, TOML [groups] table
 **Confidence:** HIGH
 ## Summary
 Phase 11 completes the synthesis layer for all 35 traffic classes and adds group-aware output to `PrintConfig`. The work is entirely within `synth/config.go`, `config/config.go`, and `classify/types.go` — no new packages, no external dependencies beyond what is already in go.mod. The frequency allocation table in `synth/config.go` lines 74–110 is the authoritative source of truth for all Hz, waveform, group, and pan values for the 18 table-designed classes. LDAP, Kerberos, and Syslog get their Hz values from `autoAssignFreq` (verified by running the FNV hash: LDAP=2950 Hz, Kerberos=3250 Hz, Syslog=3050 Hz) and use Triangle waveform / Infrastructure group, matching existing Infrastructure family members.
 The test suite is currently broken in `config` and `synth` packages because `ClassFreqConfigs` only has 14 entries while `AllClasses()` returns 32. After Phase 11, `AllClasses()` returns 35 and `ClassFreqConfigs` must match exactly. Multiple existing test hardcodes (`want 14`, `TestNewBankHas14Layers`, `TestAllClassesCount want 32`) need updating to 35.
 The `[groups]` TOML feature requires adding a `Groups map[string]string` field to `rawConfig`, wiring it through `Load()`, storing the reassignments in `LoadResult`, applying them in `PrintConfig`, and adding a warning for unknown class names. No existing config pipeline stages need structural changes — group reassignment is a post-merge overlay on FreqConfig.Group fields.
 **Primary recommendation:** Execute in three sequential sub-tasks: (1) add 21 ClassFreqConfigs entries + update AllClasses() + fix count tests, (2) refactor PrintConfig for group headers, (3) add [groups] TOML support + update tests.
 ---
 <user_constraints>
 ## User Constraints (from CONTEXT.md)
 ### Locked Decisions
 - **D-01:** Add ClassFreqConfigs entries for all 18 new classes currently in AllClasses(). Use Hz values, waveforms, pans, and groups from the Phase 9 frequency allocation table comment in `synth/config.go` lines 74-110. Use `WaveformPresetHarmonics()` for all new entries (not hand-tuned harmonics).
 - **D-02:** Add ClassLDAP, ClassKerberos, ClassSyslog to AllClasses() in `classify/types.go`. Create ClassFreqConfigs entries for them using `autoAssignFreq`-derived Hz values (FNV hash in [2500, 4000] Hz range). Their group is "Infrastructure", waveform is Triangle (matching the Infrastructure family pattern).
 - **D-03:** After D-01 and D-02, AllClasses() returns 35 entries (32 + 3). TestAllClassesCount updated to 35.
 - **D-04:** PrintConfig groups classes by their Group field value. Each group gets a comment header line: `# <Group>` followed by a blank line, then all classes in that group. Groups are ordered: Infrastructure, Web, Mail, Remote Access, File Transfer, Database, Discovery, VoIP, Unknown.
 - **D-05:** Within each group, classes are ordered by ascending BaseHz (matching the frequency allocation table order).
 - **D-06:** User-defined classes (not in AllClasses but in FreqCfgs) are emitted after all built-in groups under a "# User-defined" section header.
 - **D-07:** Users define group reassignments in TOML with a `[groups]` table using simple key-value pairs: `IMAP = "Web"` reassigns IMAP from Mail to Web group. The key is the TrafficClass string value, the value is the target group name.
 - **D-08:** Group reassignment only affects `--print-config` output grouping and the Group field in FreqConfig. It does NOT change frequency, waveform, or pan — those stay as designed. PrintConfig reflects the reassignment.
 - **D-09:** Unknown group names in `[groups]` config are accepted (user can invent custom group names). Unknown class names produce a warning (same pattern as `[sounds.X]` with unknown class).
 ### Claude's Discretion
 - Exact Hz values for LDAP, Kerberos, Syslog (computed from autoAssignFreq FNV hash)
 - Pan positions for LDAP, Kerberos, Syslog
 - Test structure for new ClassFreqConfigs entries and PrintConfig group output
 - Whether to add `[groups]` to rawConfig struct as `map[string]string` or a custom type
 - How to handle group reassignment in the merge/load pipeline
 ### Deferred Ideas (OUT OF SCOPE)
 None — discussion stayed within phase scope.
 </user_constraints>
 ---
 <phase_requirements>
 ## Phase Requirements
 | ID | Description | Research Support |
 |----|-------------|------------------|
 | GRP-02 | `--print-config` output organizes classes by group with section headers | PrintConfig refactor: iterate canonical group order, emit `# <Group>` header + blank line, sort within group by BaseHz ascending; user-defined classes under `# User-defined` |
 | GRP-03 | Users can define `[groups]` in TOML config to reassign protocols to different sound families | Add `Groups map[string]string` to rawConfig; apply after merge in Load(); warn on unknown class name; store in LoadResult; PrintConfig reads Group field from FreqConfig |
 </phase_requirements>
 ---
 ## Standard Stack
 Phase 11 uses only packages already in go.mod. No new dependencies.
 ### Core (already in go.mod)
 | Library | Version | Purpose | Why Standard |
 |---------|---------|---------|--------------|
 | `github.com/BurntSushi/toml` | existing | TOML decode — `map[string]string` for `[groups]` table | Already used; `md.Undecoded()` handles unknown key detection |
 | `github.com/netsynth/netsynth/classify` | local | TrafficClass constants, AllClasses() | Local package; phase modifies it |
 | `github.com/netsynth/netsynth/synth` | local | FreqConfig, ClassFreqConfigs, WaveformPresetHarmonics | Local package; phase adds 21 entries |
 **No installation needed.** `go test ./...` is the only verification command.
 ---
 ## Architecture Patterns
 ### Pattern 1: ClassFreqConfigs Entry Structure
 **What:** Each entry in `ClassFreqConfigs` follows a strict pattern — BaseHz from the frequency table, WaveformType constant, Harmonics generated by `WaveformPresetHarmonics`, Pan from the table, Group string.
 **When to use:** For all 18 table-designed new entries (D-01) and 3 auto-assigned entries (D-02).
 **Example (from existing code):**
 ```go
 classify.ClassIMAP: {
    BaseHz:       241.0,
    WaveformType: WaveformTriangle,
    Harmonics:    WaveformPresetHarmonics(WaveformTriangle, 241.0, SampleRate),
    Pan:          0.3,
    Group:        "Mail",
 },
 ```
 ### Pattern 2: autoAssignFreq for LDAP/Kerberos/Syslog
 **What:** FNV-32a hash into [2500, 4000] Hz range. Values are deterministic — computed once and hardcoded in the entry.
 **Verified computed values:**
 - LDAP: 2950.0 Hz
 - Kerberos: 3250.0 Hz
 - Syslog: 3050.0 Hz
 Pan positions (Claude's discretion): assign spread within [-0.3, 0.3] range — LDAP=-0.2, Kerberos=0.0, Syslog=0.2 keeps them center-ish (Infrastructure family is already spread -0.3 to +0.3 at low frequencies; these are high-frequency so center-cluster is appropriate).
 ### Pattern 3: AllClasses() Update (classify/types.go)
 **What:** Add ClassLDAP, ClassKerberos, ClassSyslog inside the Infrastructure block in AllClasses(). The comment guard `// D-01: no ClassFreqConfigs until Phase 11` is removed.
 **Ordering within Infrastructure:** Append after ClassSNMP (highest-Hz member at 118 Hz) since LDAP/Kerberos/Syslog are at 2950/3250/3050 Hz — technically they sort higher but within their family group they follow table order.
 ### Pattern 4: PrintConfig Group-Ordered Iteration (GRP-02)
 **What:** Replace the current flat `classify.AllClasses()` iteration with a canonical-group-ordered iteration. Build a `groupOrder []string` slice with the 9 canonical groups; for each group collect classes from AllClasses() whose `FreqCfgs[cls].Group == group`, sort by BaseHz, emit group header + entries.
 **Canonical group order (D-04):**
 ```
 Infrastructure, Web, Mail, Remote Access, File Transfer, Database, Discovery, VoIP, Unknown
 ```
 **Implementation approach:**
 ```go
 // groupOrder defines canonical display order for --print-config
 var groupOrder = []string{
    "Infrastructure", "Web", "Mail", "Remote Access",
    "File Transfer", "Database", "Discovery", "VoIP", "Unknown",
 }
 // Build group -> []TrafficClass index from AllClasses()
 // Sort each group slice by FreqCfgs[cls].BaseHz ascending (D-05)
 // For each group: emit "# <group>\n\n" then entries
 // After all built-in groups: user-defined classes under "# User-defined\n\n"
 ```
 **Critical detail:** The sort must use `result.FreqCfgs[cls].BaseHz` (the effective config, post-merge) not `synth.ClassFreqConfigs[cls].BaseHz`, so user frequency overrides are reflected in the sort order. This is unlikely to matter in practice but is correct.
 ### Pattern 5: TOML [groups] Support (GRP-03)
 **rawConfig struct extension:**
 ```go
 type rawConfig struct {
    Sounds map[string]SoundOverride `toml:"sounds"`
    Rules  []RawRule                `toml:"rules"`
    Groups map[string]string        `toml:"groups"`  // key=TrafficClass string, val=group name
 }
 ```
 Using `map[string]string` (Claude's discretion) is the simplest approach — TOML decodes `[groups]` as a string map naturally. No custom type needed.
 **LoadResult extension:**
 ```go
 type LoadResult struct {
    FreqCfgs    map[classify.TrafficClass]synth.FreqConfig
    UserRules   []classify.Rule
    ConfigPath  string
    AutoClasses map[classify.TrafficClass]bool
    GroupOverrides map[classify.TrafficClass]string  // NEW: class -> reassigned group name
 }
 ```
 **applyGroupOverrides function (new):** After `merge()` in `Load()`, iterate `raw.Groups`; for each key=className, val=groupName: if className is known (exists in freqCfgs), update `cfg.Group = groupName` and store back; if unknown, emit warning to stderr (D-09). The warning uses the same pattern as unknown [sounds.X] classes.
 **Alternative approach:** Apply group reassignment directly inside PrintConfig by reading `result.GroupOverrides` map on-the-fly without mutating FreqConfig. This avoids touching LoadResult but makes PrintConfig depend on a new field anyway. Mutating FreqConfig.Group is cleaner because classAnnotation and other consumers see a consistent view.
 ### Pattern 6: TOML md.Undecoded() and the [groups] map
 **Critical:** `BurntSushi/toml` decodes map fields without flagging individual map keys as "undecoded" — unknown class names in `[groups]` will NOT be caught by `md.Undecoded()`. This is the same behavior as `[sounds.*]` (unknown class names are silently accepted at decode time and validated in `merge()`). The warning for unknown class names in `[groups]` must be implemented in the new `applyGroupOverrides` function, not in `parseFile`. This matches D-09 exactly.
 ### Anti-Patterns to Avoid
 - **Hand-computing harmonics for new entries:** Use `WaveformPresetHarmonics()` — don't write `[]HarmonicDef{{1, 1.0}, {2, 0.5}, ...}` manually for table-designed entries.
 - **Sorting AllClasses() output by BaseHz globally:** The table order in AllClasses() is the authoritative display order within families. The sort in PrintConfig must use group-then-BaseHz, not a flat sort.
 - **Adding [groups] validation to parseFile:** `md.Undecoded()` cannot catch unknown string map keys; validation must be in `applyGroupOverrides`.
 - **Mutating synth.ClassFreqConfigs:** copyDefaults() produces a working copy; all mutations go there, never to the package-level map.
 ---
 ## Don't Hand-Roll
 | Problem | Don't Build | Use Instead | Why |
 |---------|-------------|-------------|-----|
 | Harmonic series for new waveform entries | Manual `[]HarmonicDef` slices | `WaveformPresetHarmonics(wt, baseHz, SampleRate)` | Already computes bandlimited series; manual values would drift if SampleRate changes |
 | FNV hash for LDAP/Kerberos/Syslog Hz | Custom hash | `autoAssignFreq("LDAP")` output hardcoded as 2950.0 | Values are pre-computed; hardcoding eliminates runtime dependency on config package from synth package |
 | TOML group reassignment validation | Custom struct with Validate() | `map[string]string` + warning in applyGroupOverrides | Matches existing pattern for [sounds.*] unknown classes |
 ---
 ## Runtime State Inventory
 Step 2.5: SKIPPED — this is not a rename/refactor/migration phase.
 ---
 ## Environment Availability Audit
 Step 2.6: SKIPPED — phase is purely code changes within existing Go packages. No external tools, services, databases, or CLI utilities beyond the existing `go` toolchain are required. The Go toolchain is already confirmed working (tests ran above).
 ---
 ## Common Pitfalls
 ### Pitfall 1: Stale hardcoded counts in tests
 **What goes wrong:** `TestNewBankHas14Layers` expects 14 layers; `TestLoadNoConfig`/`TestLoadUnknownClass`/`TestLoadAllDefaultsPresent`/`TestLoadNoConfigReturnsLoadResult` all assert `len(cfgs) == 14`; `TestAllClassesCount` asserts 32. After adding 21 ClassFreqConfigs entries and 3 AllClasses entries these fail.
 **Why it happens:** Tests were written against the Phase 9 baseline of 14 built-in entries and never updated.
 **How to avoid:** Update all hardcoded count assertions to 35 in a single pass after D-01 and D-02 are complete. The specific files and line numbers:
 - `synth/bank_test.go:12` — `want 14` → `want 35`
 - `synth/bank_test.go:13` — `len(b.layers) != 14` → `!= 35`
 - `config/config_test.go:120` — `want 14` → `want 35`
 - `config/config_test.go:149` — `want 14 (BOGUS should not appear)` → `want 35`
 - `config/config_test.go:185` — `want 14` → `want 35`
 - `config/config_test.go:617` — `want 14` → `want 35`
 - `classify/classifier_test.go:459` — `want 32` → `want 35`
 **Warning signs:** Any test that hardcodes a count of 14 or 32.
 ### Pitfall 2: TestPrintConfigContainsAllClasses class list is stale
 **What goes wrong:** `config/config_test.go:407–416` lists exactly 14 class name strings. After Phase 11, AllClasses() has 35 entries; the test should either check all 35 or be replaced by a loop over `classify.AllClasses()`.
 **How to avoid:** Replace the hardcoded `classNames` slice with `for _, cls := range classify.AllClasses()` during PrintConfig test updates.
 ### Pitfall 3: PrintConfig group-sort uses default Hz, not effective Hz
 **What goes wrong:** If group-sort code reads `synth.ClassFreqConfigs[cls].BaseHz` instead of `result.FreqCfgs[cls].BaseHz`, user frequency overrides don't affect sort position. The output is still correct for default configs but fails when the user overrides a frequency in [sounds.*].
 **How to avoid:** Always sort from `result.FreqCfgs[cls].BaseHz`.
 ### Pitfall 4: [groups] map keys not caught by md.Undecoded()
 **What goes wrong:** `parseFile` uses `md.Undecoded()` to catch field typos. TOML map keys are all valid decode targets by definition — `md.Undecoded()` will be empty even if `[groups]` contains `IMAPtypo = "Web"`. The warning must come from `applyGroupOverrides`.
 **How to avoid:** Implement unknown-class warning in `applyGroupOverrides`, not in `parseFile` or `validate`.
 ### Pitfall 5: TestClassFreqConfigsMatchAllClasses fails if counts diverge
 **What goes wrong:** `synth/config_test.go:57` checks `len(synth.ClassFreqConfigs) == len(classify.AllClasses())`. If the implementer adds all 21 ClassFreqConfigs entries but only adds 2 of the 3 new AllClasses entries, this test fails in a confusing way.
 **How to avoid:** D-01 and D-02 must be completed atomically — add all 21 ClassFreqConfigs entries and all 3 AllClasses entries in a single task.
 ### Pitfall 6: "File Transfer" group name has a space
 **What goes wrong:** If the group sort map uses `"FileTransfer"` instead of `"File Transfer"` (matching the FreqConfig.Group string), Discovery and File Transfer classes end up under a catch-all or dropped entirely.
 **How to avoid:** All group strings must exactly match those in `FreqConfig.Group`. Canonical list: `"Infrastructure"`, `"Web"`, `"Mail"`, `"Remote Access"`, `"File Transfer"`, `"Database"`, `"Discovery"`, `"VoIP"`, `"Unknown"`.
 ---
 ## Code Examples
 ### Complete frequency table for all 21 missing entries
 From the allocation table in `synth/config.go` lines 74–110 plus D-02 computed values:
 ```
 // Infrastructure additions (Triangle, [93-118] Hz)
 mDNS:      93 Hz,  Triangle, pan=+0.3
 SSDP:     105 Hz,  Triangle, pan=-0.2
 SNMP:     118 Hz,  Triangle, pan=+0.2
 // Web addition (Sawtooth)
 QUIC:     190 Hz,  Sawtooth, pan=-0.2
 // Mail additions (Triangle)
 IMAP:     241 Hz,  Triangle, pan=+0.3
 POP3:     271 Hz,  Triangle, pan=+0.4
 SMTP-sub: 305 Hz,  Triangle, pan=+0.5
 // Remote Access additions (Square)
 RDP:      385 Hz,  Square,   pan=-0.6
 Telnet:   432 Hz,  Square,   pan=-0.5
 VNC:      485 Hz,  Square,   pan=-0.4
 // File Transfer additions (Square)
 FTP:      545 Hz,  Square,   pan=+0.5
 SMB:      612 Hz,  Square,   pan=+0.6
 TFTP:     687 Hz,  Square,   pan=+0.7
 // Database additions (Sawtooth)
 MySQL:   1543 Hz,  Sawtooth, pan=-0.4
 PostgreSQL: 1732 Hz, Sawtooth, pan=-0.2
 Redis:   1944 Hz,  Sawtooth, pan=+0.2
 MongoDB: 2182 Hz,  Sawtooth, pan=+0.4
 // VoIP (Sine)
 SIP:     2449 Hz,  Sine,     pan=0.0
 // Infrastructure auto-assigned (Triangle) — D-02
 LDAP:    2950 Hz,  Triangle, pan=-0.2
 Kerberos: 3250 Hz, Triangle, pan=0.0
 Syslog:  3050 Hz,  Triangle, pan=+0.2
 ```
 ### PrintConfig group header pattern (D-04)
 ```go
 // groupOrder is the canonical display order for --print-config section headers.
 var groupOrder = []string{
    "Infrastructure", "Web", "Mail", "Remote Access",
    "File Transfer", "Database", "Discovery", "VoIP", "Unknown",
 }
 // In PrintConfig, replace the flat AllClasses() loop with:
 builtinByGroup := map[string][]classify.TrafficClass{}
 for _, cls := range classify.AllClasses() {
    cfg := result.FreqCfgs[cls]
    grp := cfg.Group
    builtinByGroup[grp] = append(builtinByGroup[grp], cls)
 }
 // Sort each group slice by BaseHz ascending (D-05)
 for grp := range builtinByGroup {
    sort.Slice(builtinByGroup[grp], func(i, j int) bool {
        return result.FreqCfgs[builtinByGroup[grp][i]].BaseHz <
               result.FreqCfgs[builtinByGroup[grp][j]].BaseHz
    })
 }
 // Emit in canonical order
 for _, grp := range groupOrder {
    classes, ok := builtinByGroup[grp]
    if !ok || len(classes) == 0 {
        continue
    }
    fmt.Fprintf(&sb, "# %s\n\n", grp)
    for _, cls := range classes {
        // ... existing per-class emit logic ...
    }
 }
 ```
 ### [groups] TOML apply pattern (D-07/D-08/D-09)
 ```go
 // applyGroupOverrides overlays [groups] reassignments onto freqCfgs.Group in-place.
 // Unknown class names produce a warning; unknown group names are silently accepted (D-09).
 func applyGroupOverrides(cfgs map[classify.TrafficClass]synth.FreqConfig, groups map[string]string) {
    for className, groupName := range groups {
        cls := classify.TrafficClass(className)
        cfg, known := cfgs[cls]
        if !known {
            fmt.Fprintf(os.Stderr, "Warning: config: [groups]: unknown class %q (ignored)\n", className)
            continue
        }
        cfg.Group = groupName
        cfgs[cls] = cfg
    }
 }
 ```
 Call site in `Load()` — after `merge()`:
 ```go
 addAutoFreqEntries(freqCfgs, userRules, autoClasses)
 merge(freqCfgs, raw.Sounds)
 applyGroupOverrides(freqCfgs, raw.Groups)  // NEW
 ```
 ---
 ## Validation Architecture
 nyquist_validation is enabled (not false in config.json).
 ### Test Framework
 | Property | Value |
 |----------|-------|
 | Framework | Go testing (stdlib) |
 | Config file | none — `go test ./...` |
 | Quick run command | `go test ./classify/... ./synth/... ./config/...` |
 | Full suite command | `go test ./...` |
 ### Current Test Failures (baseline — must fix)
 The following tests are currently failing and Phase 11 must make them green:
 | Test | Package | Failure Cause | Fix Required |
 |------|---------|---------------|--------------|
 | `TestAllClassesHaveConfig` | `synth` | 18 new classes in AllClasses() missing from ClassFreqConfigs | Add 18+3 entries |
 | `TestClassFreqConfigsMatchAllClasses` | `synth` | 14 != 32 | Add entries, update AllClasses |
 | `TestNewBankHas14Layers` | `synth` | 14 != 32 + missing layers | Add entries + update assert |
 | `TestLoadAllDefaultsPresent` | `config` | 18 classes missing from loaded map | Add ClassFreqConfigs entries |
 | `TestLoadNoConfig` | `config` | len==14 assert, now 35 | Update count |
 | `TestLoadUnknownClass` | `config` | len==14 assert | Update count |
 | `TestLoadNoConfigReturnsLoadResult` | `config` | len==14 assert | Update count |
 | `TestPrintConfigContainsAllClasses` | `config` | Hardcoded 14 class names | Expand to all 35 |
 | `TestAllClassesCount` | `classify` | want 32, still passes (no new classes yet) | Update to 35 after D-02 |
 ### Phase Requirements to Test Map
 | Req ID | Behavior | Test Type | Automated Command | Test Exists? |
 |--------|----------|-----------|-------------------|-------------|
 | GRP-02 | PrintConfig shows group headers | unit | `go test ./config/... -run TestPrintConfig` | Partial — `TestPrintConfigContainsAllClasses` exists; new `TestPrintConfigGroupHeaders` needed |
 | GRP-02 | Each built-in class appears in correct group | unit | `go test ./config/... -run TestPrintConfigGroupHeaders` | No — Wave 0 |
 | GRP-03 | [groups] TOML reassigns class to different group | unit | `go test ./config/... -run TestLoadGroupOverride` | No — Wave 0 |
 | GRP-03 | Unknown class in [groups] produces warning | unit | `go test ./config/... -run TestLoadGroupUnknownClass` | No — Wave 0 |
 | GRP-03 | PrintConfig reflects group reassignment | unit | `go test ./config/... -run TestPrintConfigGroupReassignment` | No — Wave 0 |
 ### Sampling Rate
 - **Per task commit:** `go test ./classify/... ./synth/... ./config/...`
 - **Per wave merge:** `go test ./...`
 - **Phase gate:** `go test ./...` fully green before `/gsd:verify-work`
 ### Wave 0 Gaps
 - [ ] `config/config_test.go` — add `TestPrintConfigGroupHeaders` (asserts `# Infrastructure`, `# Mail`, etc. appear in output in correct order)
 - [ ] `config/config_test.go` — add `TestLoadGroupOverride` (TOML `[groups]\nIMAP = "Web"` → FreqCfgs[IMAP].Group == "Web")
 - [ ] `config/config_test.go` — add `TestLoadGroupUnknownClass` (TOML `[groups]\nBOGUS = "Web"` → no error, warning to stderr)
 - [ ] `config/config_test.go` — add `TestPrintConfigGroupReassignment` (LoadResult with group-reassigned IMAP shows IMAP under `# Web` not `# Mail`)
 - [ ] `config/config_test.go` — update `TestPrintConfigContainsAllClasses` classNames slice to cover all 35 (or replace with AllClasses() loop)
 ---
 ## Open Questions
 1. **Pan positions for LDAP, Kerberos, Syslog (Claude's discretion)**
   - What we know: Infrastructure family uses [-0.3, +0.3] pan range for existing members (ICMP=-0.3, NTP=-0.1, DHCP=+0.1, DNS=0.0, mDNS=+0.3, SSDP=-0.2, SNMP=+0.2)
   - Recommendation: LDAP=-0.2, Kerberos=0.0, Syslog=+0.2 — fills the same spread pattern without exact collision with existing values
 2. **TestNewBankHas14Layers function name**
   - What we know: The CONTEXT.md calls out that the name is stale (should reflect 35 classes)
   - Recommendation: Rename to `TestNewBankHasAllLayers` and update the assertion to `len(b.layers) != len(classify.AllClasses())` — this future-proofs it against further class additions
 3. **Discovery group — no existing built-in entries in AllClasses() have Group="Discovery"**
   - What we know: mDNS, SSDP, SNMP are currently in AllClasses() but not in ClassFreqConfigs (they are 3 of the 18 missing entries); they belong to "Infrastructure" per the frequency allocation table (slots 3-5, Group=Infrastructure)
   - Clarification needed: the frequency table marks them as Infrastructure, but the canonical group order in D-04 lists "Discovery" as a separate group. The table must take precedence — mDNS/SSDP/SNMP are Group="Infrastructure", not "Discovery". The "Discovery" slot in groupOrder may remain empty or be omitted from PrintConfig output (the `if !ok || len(classes) == 0 { continue }` guard handles this).
 ---
 ## Sources
 ### Primary (HIGH confidence)
 - Direct code inspection of `/home/dev/workspace/yoloyolo/synth/config.go` — frequency allocation table lines 74-110 (authoritative Hz, waveform, pan, group values)
 - Direct code inspection of `/home/dev/workspace/yoloyolo/config/config.go` — PrintConfig, rawConfig struct, merge(), autoAssignFreq(), addAutoFreqEntries()
 - Direct code inspection of `/home/dev/workspace/yoloyolo/classify/types.go` — AllClasses(), TrafficClass constants
 - Computed autoAssignFreq values by running the FNV hash Go code — LDAP=2950, Kerberos=3250, Syslog=3050
 - `go test ./...` output — confirmed exact failing tests and error messages
 ### Secondary (MEDIUM confidence)
 - CONTEXT.md decisions D-01 through D-09 — user decisions locked in prior /gsd:discuss-phase session
 - STATE.md accumulated decisions — confirms Phase 10 left AllClasses() at 32 intentionally pending Phase 11
 ---
 ## Metadata
 **Confidence breakdown:**
 - Standard stack: HIGH — no new dependencies; entire phase is code within existing packages
 - Architecture: HIGH — patterns derived directly from existing code and locked CONTEXT.md decisions
 - Pitfalls: HIGH — derived from actual failing test output and code inspection
 - autoAssignFreq Hz values: HIGH — computed by executing the actual FNV hash code
 **Research date:** 2026-03-27
 **Valid until:** 2026-04-27 (stable — no external packages change)
@@ -0,0 +1,73 @@
 ---
 phase: 11
 slug: synthesis-and-config-layer
 status: draft
 nyquist_compliant: false
 wave_0_complete: false
 created: 2026-03-27
 ---
 # Phase 11 — Validation Strategy
 > Per-phase validation contract for feedback sampling during execution.
 ---
 ## Test Infrastructure
 | Property | Value |
 |----------|-------|
 | **Framework** | go test |
 | **Config file** | none — standard Go test runner |
 | **Quick run command** | `go test ./synth/... ./config/...` |
 | **Full suite command** | `go test ./...` |
 | **Estimated runtime** | ~10 seconds |
 ---
 ## Sampling Rate
 - **After every task commit:** Run `go test ./synth/... ./config/...`
 - **After every plan wave:** Run `go test ./...`
 - **Before `/gsd:verify-work`:** Full suite must be green
 - **Max feedback latency:** 10 seconds
 ---
 ## Per-Task Verification Map
 | Task ID | Plan | Wave | Requirement | Test Type | Automated Command | File Exists | Status |
 |---------|------|------|-------------|-----------|-------------------|-------------|--------|
 | 11-01-01 | 01 | 1 | GRP-02 | unit | `go test ./synth/... -run TestAllClassesHaveConfig` | ✅ | ⬜ pending |
 | 11-01-02 | 01 | 1 | GRP-02 | unit | `go test ./synth/... -run TestFrequenciesUnique` | ✅ | ⬜ pending |
 | 11-02-01 | 02 | 2 | GRP-02 | unit | `go test ./config/... -run TestPrintConfig` | ✅ | ⬜ pending |
 | 11-02-02 | 02 | 2 | GRP-03 | unit | `go test ./config/... -run TestLoad` | ✅ | ⬜ pending |
 *Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*
 ---
 ## Wave 0 Requirements
 *Existing infrastructure covers all phase requirements. Test helpers already exist in synth and config packages.*
 ---
 ## Manual-Only Verifications
 | Behavior | Requirement | Why Manual | Test Instructions |
 |----------|-------------|------------|-------------------|
 | Family-coherent sound output | Success criteria 2 | Perceptual audio quality | Generate MP3 from representative pcap, listen for family grouping |
 ---
 ## Validation Sign-Off
 - [ ] All tasks have `<automated>` verify or Wave 0 dependencies
 - [ ] Sampling continuity: no 3 consecutive tasks without automated verify
 - [ ] Wave 0 covers all MISSING references
 - [ ] No watch-mode flags
 - [ ] Feedback latency < 10s
 - [ ] `nyquist_compliant: true` set in frontmatter
 **Approval:** pending
@@ -0,0 +1,124 @@
 ---
 phase: 11-synthesis-and-config-layer
 verified: 2026-03-27T15:41:00Z
 status: human_needed
 score: 11/11 must-haves verified
 human_verification:
  - test: "Run `go build -o /tmp/netsynth . && /tmp/netsynth --print-config | head -5` and listen to an output MP3 generated with mixed traffic types"
    expected: "Each traffic class group (Infrastructure, Web, Mail, etc.) produces a perceptually distinct timbre — Triangle waveforms sound softer/bell-like vs Square waveforms (buzzy/hollow) vs Sawtooth (bright/reedy) vs Sine (pure tone)"
    why_human: "Perceptual audio quality and family coherence ('distinct, family-coherent sound') requires a human listening test; automated tests only verify Hz/waveform parameters and group metadata, not the sonic result"
 ---
 # Phase 11: Synthesis and Config Layer Verification Report
 **Phase Goal:** Every new traffic class produces a distinct, family-coherent sound and --print-config shows all classes organized by group with section headers
 **Verified:** 2026-03-27T15:41:00Z
 **Status:** human_needed (all automated checks pass; perceptual audio quality requires human listening test)
 **Re-verification:** No — initial verification
 ## Goal Achievement
 ### Observable Truths
 | # | Truth | Status | Evidence |
 |---|-------|--------|---------|
 | 1 | ClassFreqConfigs has exactly 35 entries matching AllClasses() | VERIFIED | `grep -c "classify\.Class" synth/config.go` = 35; `--print-config` emits 35 `[sounds.*]` entries; TestAllClassesCount passes with `want 35` |
 | 2 | Every new class has correct Hz, waveform, pan, and group from frequency allocation table | VERIFIED | All 21 new entries confirmed in synth/config.go (lines 168-369) with exact Hz, WaveformType, Pan, Group values matching the plan spec; `go test ./synth/...` passes |
 | 3 | LDAP, Kerberos, Syslog appear in AllClasses() and have Infrastructure group with Triangle waveform | VERIFIED | classify/types.go line 69: `ClassLDAP, ClassKerberos, ClassSyslog` in AllClasses(); synth/config.go lines 349-369: all three have `WaveformType: WaveformTriangle` and `Group: "Infrastructure"` |
 | 4 | go test ./synth/... ./classify/... ./config/... all pass | VERIFIED | `go test ./...` all 7 packages pass (confirmed by fresh run) |
 | 5 | PrintConfig output groups classes by family with section header comments | VERIFIED | `--print-config` binary output shows `# Infrastructure`, `# Web`, `# Mail`, `# Remote Access`, `# File Transfer`, `# Database`, `# VoIP`, `# Unknown` headers in canonical order |
 | 6 | Groups appear in canonical order: Infrastructure, Web, Mail, Remote Access, File Transfer, Database, Discovery, VoIP, Unknown | VERIFIED | TestPrintConfigGroupHeaders passes; binary spot-check confirms order matches groupOrder slice in config.go line 284 |
 | 7 | Within each group, classes are sorted by ascending BaseHz | VERIFIED | PrintConfig spot-check output shows ascending Hz within each group (e.g., Infrastructure: 65, 73, 82, 93, 105, 118, 133, 2950, 3050, 3250); sort.Slice by BaseHz confirmed in config.go lines 334-339 |
 | 8 | User-defined classes appear under a User-defined section header after all built-in groups | VERIFIED | config.go lines 399-419 emit `# User-defined` section; `# User-defined` string present in source |
 | 9 | Users can define [groups] in TOML to reassign a class to a different group | VERIFIED | TestLoadGroupOverride and TestPrintConfigGroupReassignment both pass; applyGroupOverrides called in Load() at line 103 after merge() |
 | 10 | Unknown class names in [groups] produce a warning, not an error | VERIFIED | TestLoadGroupUnknownClass passes; test output shows `Warning: config: [groups]: unknown class "BOGUS" (ignored)` on stderr |
 | 11 | Group reassignment only affects PrintConfig grouping, not frequency or waveform | VERIFIED | TestLoadGroupOverride asserts `cfg.BaseHz == defaultCfg.BaseHz` (unchanged); applyGroupOverrides only mutates `cfg.Group`, not BaseHz or WaveformType |
 **Score:** 11/11 truths verified (automated); 1 truth requires human verification (perceptual audio quality)
 ### Required Artifacts
 | Artifact | Expected | Status | Details |
 |----------|----------|--------|---------|
 | `synth/config.go` | 21 new ClassFreqConfigs entries | VERIFIED | 35 total entries; all 21 new classes present with correct values per allocation table |
 | `classify/types.go` | AllClasses() returns 35 entries including LDAP/Kerberos/Syslog | VERIFIED | 35-entry return slice; LDAP/Kerberos/Syslog added to Infrastructure section at line 69 |
 | `config/config.go` | Group-ordered PrintConfig, [groups] TOML support, applyGroupOverrides function | VERIFIED | groupOrder slice (line 284), applyGroupOverrides function (line 270), rawConfig.Groups field (line 41), called in Load() (line 103) |
 | `config/config_test.go` | Tests for group headers, group reassignment, unknown class warning | VERIFIED | 4 new test functions at lines 605-692: TestPrintConfigGroupHeaders, TestLoadGroupOverride, TestLoadGroupUnknownClass, TestPrintConfigGroupReassignment — all pass |
 ### Key Link Verification
 | From | To | Via | Status | Details |
 |------|----|-----|--------|---------|
 | `config/config.go` | `synth/config.go` | PrintConfig reads FreqConfig.Group field | WIRED | `cfg.Group` used at lines 329, 364; FreqConfig.Group drives group bucketing in builtinByGroup map |
 | `config/config.go` | `classify/types.go` | PrintConfig iterates AllClasses() and groups by Group field | WIRED | `classify.AllClasses()` called at lines 326 and 362; iteration drives builtinByGroup construction and customGroups scan |
 | `synth/config.go` | `classify/types.go` | ClassFreqConfigs references TrafficClass constants | WIRED | All 35 map keys use `classify.Class*` constants; pattern `classify\.Class(IMAP|POP3|...)` confirmed present |
 ### Data-Flow Trace (Level 4)
 | Artifact | Data Variable | Source | Produces Real Data | Status |
 |----------|---------------|--------|--------------------|--------|
 | `config/config.go PrintConfig` | `builtinByGroup` | `classify.AllClasses()` + `result.FreqCfgs[cls]` | Yes — 35 real entries from copyDefaults() which copies synth.ClassFreqConfigs | FLOWING |
 | `config/config.go PrintConfig` | `result.FreqCfgs` | `Load()` → `copyDefaults()` → `merge()` → `applyGroupOverrides()` | Yes — real map with 35 entries, plus any user overrides applied | FLOWING |
 ### Behavioral Spot-Checks
 | Behavior | Command | Result | Status |
 |----------|---------|--------|--------|
 | --print-config emits group headers | `/tmp/netsynth_test --print-config \| grep "^# [A-Z]"` | Infrastructure, Web, Mail, Remote Access, File Transfer, Database, VoIP, Unknown all present | PASS |
 | 35 sound entries emitted | `/tmp/netsynth_test --print-config \| grep "^\[sounds\." \| wc -l` | 35 | PASS |
 | Classes sorted ascending within group | Infrastructure group: 65, 73, 82, 93, 105, 118, 133, 2950, 3050, 3250 Hz | Correct ascending order | PASS |
 | go test ./... passes all packages | `go test ./...` | 7 packages ok | PASS |
 | Perceptual audio quality | Requires listening to generated MP3 | Cannot verify programmatically | SKIP (human_needed) |
 ### Requirements Coverage
 | Requirement | Source Plan | Description | Status | Evidence |
 |-------------|------------|-------------|--------|---------|
 | GRP-02 | 11-01-PLAN.md, 11-02-PLAN.md | `--print-config` output organizes classes by group with section headers | SATISFIED | TestPrintConfigGroupHeaders passes; binary spot-check confirms group headers in canonical order; config.go groupOrder drives emission order |
 | GRP-03 | 11-01-PLAN.md, 11-02-PLAN.md | Users can define `[groups]` in TOML config to reassign protocols to different sound families | SATISFIED | rawConfig.Groups field parses `[groups]` TOML; applyGroupOverrides wired into Load(); TestLoadGroupOverride and TestPrintConfigGroupReassignment both pass |
 No orphaned requirements — both GRP-02 and GRP-03 are claimed by both plans and satisfied by implementation.
 ### Anti-Patterns Found
 | File | Line | Pattern | Severity | Impact |
 |------|------|---------|----------|--------|
 | None found | — | — | — | — |
 No TODO/FIXME/placeholder comments, no empty handlers, no stub return values in phase-modified files. The `return []HarmonicDef{{Ratio: 1, Amplitude: 1.0}}` in WaveformSine case is the legitimate single-harmonic definition, not a stub.
 Hardcoded count audit:
 - `grep "want 14" config/config_test.go` — no matches
 - `grep "want 32" classify/classifier_test.go` — no matches
 - `grep "!= 14" synth/bank_test.go` — no matches
 - TestNewBankHas14Layers renamed to TestNewBankHasAllLayers
 ### Human Verification Required
 #### 1. Perceptual Audio Quality — Family-Coherent Distinct Sounds
 **Test:** Build the binary (`go build -o /tmp/netsynth .`), run it against a live interface or a pcap file, and listen to the output MP3. Alternatively, generate a test clip exercising multiple classes using a synthetic pcap.
 **Expected:** Traffic classes within the same family share a recognizable waveform timbre:
 - Infrastructure classes (ICMP, DNS, DHCP, LDAP, etc.) — gentle bell-like quality from Triangle waveform
 - Remote Access and File Transfer classes (SSH, RDP, FTP, SMB, etc.) — buzzy/hollow timbre from Square waveform
 - Database classes (MySQL, PostgreSQL, Redis, MongoDB) — bright/reedy timbre from Sawtooth waveform
 - SIP (VoIP) — pure clean tone from Sine waveform
 - Different families should sound clearly distinct from one another while classes within a family are recognizably related
 **Why human:** Perceptual audio quality (timbre coherence, distinctness under real traffic loads, absence of clashing frequencies) cannot be verified programmatically. The code correctly implements the waveform types and Hz values, but whether the resulting sound is perceptually "family-coherent" as described in the phase goal requires a human ears-on test.
 ### Gaps Summary
 No gaps. All automated must-haves pass. The only pending item is a human listening test for perceptual audio quality (Success Criterion 2 from the phase scope, flagged at verification request time).
 **Commit trail verified:**
 - `1556ce8` — feat(11-01): add 21 ClassFreqConfigs entries and include LDAP/Kerberos/Syslog in AllClasses()
 - `35d8915` — fix(11-01): update hardcoded count assertions to reflect 35 traffic classes
 - `374282e` — feat(11-02): add [groups] TOML support and group-ordered PrintConfig
 - `7bf3ea1` — test(11-02): add group header and reassignment tests (GRP-02, GRP-03)
 ---
 _Verified: 2026-03-27T15:41:00Z_
 _Verifier: Claude (gsd-verifier)_
@@ -1,208 +1,332 @@
 # Architecture Patterns
-**Domain:** Network traffic sonification CLI (Go) — v1.1 Custom Sound Mappings
+**Domain:** Network traffic sonification CLI (Go) — v1.2 Extended Protocol Coverage with Grouped Families
-**Researched:** 2026-03-26
+**Researched:** 2026-03-26 (v1.0/v1.1), updated 2026-03-27 (v1.2 grouped protocol families)
-**Confidence:** HIGH — based on direct code inspection of the existing v1.0 codebase
+**Confidence:** HIGH — based on direct code inspection of the shipped v1.1 codebase
 ---
-## v1.1 Integration Overview
+## v1.2 Integration Overview
-This document supersedes the pre-implementation v1.0 architecture research. It is grounded in the actual codebase (3,254 lines, 6 packages) and answers: what changes, what's new, and in what order.
+This document supersedes the pre-implementation v1.0/v1.1 architecture research. It is grounded in the actual shipped v1.1 codebase (~4,675 lines, 7 packages) and answers specifically: how does the *group concept* thread through classify, synth, config, and CLI? What changes, what stays, and in what order?
 ---
-## Existing Package Map (v1.0 Baseline)
+## Current Package Map (v1.1 Baseline — the starting point)
 ```
 cmd/netsynth/main.go      CLI, pipeline wiring, Cobra flags
 capture/                  go-pcap live capture + pcap file reader + BPF
 classify/
-  types.go                TrafficClass, ClassifiedPacket, WindowSnapshot
+  types.go                TrafficClass (string type), ClassifiedPacket, WindowSnapshot, AllClasses()
  classifier.go           NewClassifier(rules []Rule) — first-match-wins
-  rules.go                DefaultRules []Rule (12 hardcoded rules)
+  rules.go                DefaultRules []Rule (12 built-in rules)
 aggregate/
  window.go               500ms time-windowed snapshot accumulation
 synth/
-  config.go               ClassFreqConfigs — fixed map[TrafficClass]FreqConfig
+  config.go               FreqConfig{BaseHz, Harmonics, Pan, WaveformType}, ClassFreqConfigs map
-  oscillator.go           Phase-accumulator oscillator — sine only
+  oscillator.go           Phase-accumulator oscillator — sine+additive harmonics
-  layer.go                EMA amplitude smoothing per layer
+  layer.go                EMA amplitude smoothing per Layer
-  bank.go                 NewBank(tau) — one Layer per AllClasses()
+  bank.go                 NewBank(tau, cfgs map) — one Layer per config entry
  mixer.go                PanGains, StereoFramesToInt16Bytes
 encode/
  mp3.go                  RunSynthesis(snapshots, path) — NewBank + EncodeMP3
 ```
 ---
 ## What v1.1 Adds
 Three independent but related features:
 1. **TOML config file** — override frequencies and waveforms per built-in class
 2. **Additional waveforms** — square, sawtooth, triangle alongside existing sine
 3. **User-defined classification rules** — TOML-defined rules prepended before DefaultRules
 ---
 ## Integration Point Analysis
 ### Feature 1: TOML Config File
 **Where config is consumed today:** `synth/config.go` holds a package-level `var ClassFreqConfigs`. `synth/bank.go:NewBank()` reads it directly with `ClassFreqConfigs[class]`. No config is passed through `encode.RunSynthesis` or `main.go`.
 **Required change:** `NewBank` must accept a config parameter instead of reading the global. `encode.RunSynthesis` must accept and forward a config. `main.go` must load config from disk and pass it in.
 **New package: `config/`**
 This package does not exist yet in the codebase (the pre-implementation research anticipated it but it was deferred). It should own:
 - TOML struct definitions
 - File discovery logic (auto-detect `./netsynth.toml`, then `~/.config/netsynth/config.toml`)
 - Merging: loaded config overlays defaults, does not replace them entirely
 ```
 config/
-  config.go       Config struct, Load(path string) (*Config, error)
+  config.go               TOML parse, merge, validate, auto-freq assignment, PrintConfig
-  defaults.go     DefaultConfig() — wraps existing ClassFreqConfigs values
+encode/
  mp3.go                  RunSynthesis(snapshots, path, freqCfgs) — NewBank + EncodeMP3
 ```
 **TOML struct shape:**
 ```toml
 [[class]]
 name = "HTTPS"
 frequency_hz = 200.0
 waveform = "sawtooth"
 [[class]]
 name = "myservice"           # user-defined class (Feature 3)
 frequency_hz = 350.0
 waveform = "triangle"
 ```
 The `Config` struct passed into `NewBank` should merge with `ClassFreqConfigs`:
 ```go
 // config/config.go
 type ClassConfig struct {
    Name        string  `toml:"name"`
    FrequencyHz float64 `toml:"frequency_hz"`
    Waveform    string  `toml:"waveform"`   // "sine" | "square" | "sawtooth" | "triangle"
 }
 type Config struct {
    Classes []ClassConfig `toml:"class"`
    Rules   []RuleConfig  `toml:"rule"`    // Feature 3
 }
 ```
 **TOML library:** Use `github.com/BurntSushi/toml`. It is the de-facto standard for TOML in Go (used by Hugo, dep, buf, etc.). Already a transitive dependency in many Go module graphs. Provides struct-tag-based decode, good error messages.
 ---
-### Feature 2: Additional Waveforms
+## What v1.2 Adds
-**Where waveform logic lives today:** `synth/oscillator.go:Advance()` — pure sine via `math.Sin`. The `HarmonicDef.Ratio` and `HarmonicDef.Amplitude` fields are stored in `FreqConfig.Harmonics` but the waveform function is hardcoded.
+Two related but separable capabilities:
-**Required change:** `Oscillator.Advance` must dispatch on a waveform type. Two clean approaches:
+1. **More built-in protocol rules** — extended DefaultRules covering Mail, Remote Access, Database, Discovery, File Transfer, VoIP, etc.
 2. **Group concept** — related protocols share a recognizable sound family (shared base frequency, detuned members, optional shared waveform character)
-**Option A (recommended): Waveform enum on Oscillator**
+These must be designed together because the group concept directly affects frequency allocation, and frequency allocation directly affects DefaultRules ordering decisions.
-Add a `waveform` field to `Oscillator`. `Advance` switches on it. `NewOscillator` gains a waveform parameter.
+---
 ## The Group Concept: What It Means Architecturally
 A "group" means: protocols in the same family share a musical neighborhood. Listeners learn "low rumble = infrastructure traffic" and "mid-range shimmer = web traffic" without needing to identify individual tones.
 The group concept requires:
 - A **group identifier** stored somewhere accessible by both classify (for `--print-config` ordering) and synth (for within-group detuning computation)
 - A **group base frequency** from which individual protocol frequencies are derived by small detuning offsets
 - **Within-group waveform consistency** — all members of a group use the same waveform type so the family sounds recognizable even as individual pitches differ
 The key architectural question is: *where does the group concept live?*
 ---
 ## Decision: Group Lives in `synth/config.go`, Not in `classify/`
 ### Option A: Group field on `classify.Rule` or new `TrafficClassGroup` type in `classify`
 Adding `Group string` to `classify.Rule` would put group information at the classification boundary, visible from the capture pipeline forward. But:
 - The classifier does not care about groups — it only cares about protocol matching
 - `AllClasses()` in `classify/types.go` already returns ordered class names without needing sound semantics
 - Pollutes the `classify` package with audio-domain concerns
 ### Option B: Group field in `synth.FreqConfig` (recommended)
 `FreqConfig` already owns all sound parameters (frequency, harmonics, pan, waveform). Adding a `Group string` field keeps group logic inside the audio domain. The `classify` package stays clean — it only knows about `TrafficClass` names.
 ```go
-type Waveform int
+// synth/config.go
-
+type FreqConfig struct {
-const (
+    BaseHz       float64
-    WaveformSine     Waveform = iota
+    Harmonics    []HarmonicDef
-    WaveformSquare
+    Pan          float64
-    WaveformSawtooth
+    WaveformType WaveformType
-    WaveformTriangle
+    Group        string  // NEW: e.g., "mail", "web", "remote-access", "" for ungrouped
 )
 type Oscillator struct {
    phase    float64
    freq     float64
    sr       float64
    waveform Waveform
 }
 func (o *Oscillator) sampleAt(phase, ratio float64) float64 {
    p := phase * float64(ratio)
    p -= math.Floor(p)          // wrap to [0, 1)
    switch o.waveform {
    case WaveformSquare:
        if p < 0.5 { return 1.0 }
        return -1.0
    case WaveformSawtooth:
        return 2.0*p - 1.0
    case WaveformTriangle:
        if p < 0.5 { return 4.0*p - 1.0 }
        return 3.0 - 4.0*p
    default: // WaveformSine
        return math.Sin(2 * math.Pi * p)
    }
 }
 ```
-**Option B: Function field on Oscillator**
+**`classify.TrafficClass` does NOT get a Group field.** The group is a sound-design concept, not a classification concept. Classification says "this is SMTP"; synthesis says "SMTP belongs to the Mail group at 440 Hz + 0 cents detuning."
-Store `waveFn func(phase float64) float64`. More flexible but harder to serialize/configure.
+### Why this is the right boundary
-Option A is preferred because waveform type maps cleanly to the TOML `waveform` string field without reflection tricks.
+| Package | Knows About | Does Not Know About |
 |---------|-------------|---------------------|
 | `classify` | Protocol, port, traffic class name | Group, frequency, waveform |
 | `synth` | Frequency, harmonics, pan, waveform, group | Protocol, port |
 | `config` | Merges both sides; reads TOML; owns PrintConfig | Packet capture |
-**`FreqConfig` change:** Add `Waveform` field:
+---
 ## Frequency Allocation Strategy for Groups
 ### Current allocation (v1.1)
 The 14 existing classes span 65 Hz to 1047 Hz in a roughly logarithmic spread:
 ```
 ICMP:       65 Hz   (sub-bass)
 DNS:        110 Hz
 HTTPS:      175 Hz
 HTTP:       220 Hz
 SSH:        330 Hz
 SMTP:       440 Hz
 NTP:        520 Hz
 DHCP:       600 Hz
 other-TCP:  700 Hz
 other-UDP:  780 Hz
 unknown-1:  862 Hz
 unknown-2:  920 Hz
 unknown-3:  981 Hz
 unknown-4:  1047 Hz
 auto-range: 1200-2350 Hz (FNV-32a hash for user-defined classes)
 ```
 ### v1.2 group-based allocation
 New protocols need frequency homes. With ~25-35 total built-in classes after expansion, maintaining individual hand-tuned frequencies becomes fragile and collision-prone. The group model solves this by assigning each group a frequency band, then placing members within that band at small detuning offsets.
 **Recommended group bands (within the 65-1100 Hz range already owned by built-ins):**
 | Group | Band Center | Role | Protocols |
 |-------|-------------|------|-----------|
 | Infrastructure | 65-130 Hz | Core network services (barely heard, always present) | ICMP, NTP, DHCP, mDNS/SSDP |
 | Web | 175-280 Hz | HTTP-family traffic | HTTP, HTTPS, HTTP/3, WebSocket |
 | Mail | 380-480 Hz | Email protocols | SMTP, IMAP, POP3, SMTP-submission |
 | Remote Access | 300-360 Hz | Interactive sessions | SSH, RDP, Telnet, VNC |
 | Database | 500-580 Hz | Backend data stores | MySQL, PostgreSQL, Redis, MongoDB |
 | File Transfer | 620-700 Hz | File movement protocols | FTP, SFTP, FTPS, SMB, NFS |
 | VoIP / Streaming | 720-820 Hz | Real-time media | SIP, RTP, RTSP |
 | DNS | 110 Hz | Singleton — already well-placed | DNS (UDP+TCP) |
 | Unknown | 850-1100 Hz | Auto-bucketed unrecognized traffic | unknown-1 through unknown-4 |
 **Within-group detuning model:** Each group has a `GroupBaseHz`. Members are offset by small cent-based detuning or fixed Hz offsets:
 ```
 Mail group base: 420 Hz
  SMTP:           420 Hz  (group base, no detune)
  IMAP:           430 Hz  (+10 Hz)
  POP3:           440 Hz  (+20 Hz)
  SMTP-submission: 450 Hz  (+30 Hz)
 ```
 Offsets of 10-30 Hz are audible as distinct pitches but harmonically related enough to sound like a family. Do NOT use harmonic ratios (2x, 3x) for detuning — that would place group members an octave or fifth apart, destroying the "family sound" effect.
 **This is a design constraint, not a library feature.** The detuning is expressed as explicit `BaseHz` values in `ClassFreqConfigs`. There is no runtime detuning computation needed — it is baked into the default config map.
 ### Frequency rebalancing required
 Adding ~15-20 new protocols means the existing 65-1100 Hz range must be replanned. The existing classes should be reassigned to group-coherent frequencies even if this moves them from v1.1 values. This is a conscious breaking change to the default sound, acceptable in a minor version bump where the goal is improved audio design.
 The `unknown-1..4` range at 850-1047 Hz is preserved as-is — those are intentionally dissonant and serve a distinct purpose.
 ---
 ## Component-by-Component Changes
 ### `classify/rules.go` — Extend DefaultRules
 **What changes:** Add ~15-20 new `Rule` entries for the expanded protocol set.
 **What does NOT change:** `Rule` struct, `NewClassifier`, the first-match-wins algorithm.
 **Required care:** The catch-all rules (`DstPort: 0` for TCP and UDP) must remain last. New protocol-specific rules must be inserted before these catch-alls. `DefaultRules` is an ordered slice — insertion order matters.
 ```go
 // New rules inserted before catch-alls, e.g.:
 {Protocol: "tcp", DstPort: 143, Class: ClassIMAP},
 {Protocol: "tcp", DstPort: 110, Class: ClassPOP3},
 {Protocol: "tcp", DstPort: 587, Class: ClassSMTPSubmit},
 {Protocol: "tcp", DstPort: 3306, Class: ClassMySQL},
 {Protocol: "tcp", DstPort: 5432, Class: ClassPostgres},
 {Protocol: "tcp", DstPort: 6379, Class: ClassRedis},
 {Protocol: "tcp", DstPort: 3389, Class: ClassRDP},
 {Protocol: "tcp", DstPort: 5900, Class: ClassVNC},
 {Protocol: "udp", DstPort: 5060, Class: ClassSIP},
 {Protocol: "tcp", DstPort: 5060, Class: ClassSIP},
 // ... etc
 ```
 ### `classify/types.go` — New Constants and Updated AllClasses()
 **What changes:** Add new `TrafficClass` constants for each new protocol. Update `AllClasses()` to include them in display-sensible order (grouped by family, matching PrintConfig output order).
 **What does NOT change:** `ClassifiedPacket`, `WindowSnapshot`, the `TrafficClass` string type itself.
 ```go
 // New constants (representative subset):
 const (
    ClassIMAP         TrafficClass = "IMAP"
    ClassPOP3         TrafficClass = "POP3"
    ClassSMTPSubmit   TrafficClass = "SMTP-submit"
    ClassMySQL        TrafficClass = "MySQL"
    ClassPostgres     TrafficClass = "PostgreSQL"
    ClassRedis        TrafficClass = "Redis"
    ClassMongoDB      TrafficClass = "MongoDB"
    ClassRDP          TrafficClass = "RDP"
    ClassVNC          TrafficClass = "VNC"
    ClassTelnet       TrafficClass = "Telnet"
    ClassFTP          TrafficClass = "FTP"
    ClassFTPS         TrafficClass = "FTPS"
    ClassSMB          TrafficClass = "SMB"
    ClassNFS          TrafficClass = "NFS"
    ClassSIP          TrafficClass = "SIP"
    ClassHTTP3        TrafficClass = "HTTP3"   // UDP 443 (QUIC)
    ClassmDNS         TrafficClass = "mDNS"    // UDP 5353
    ClassSSDPDisc     TrafficClass = "SSDP"    // UDP 1900
    // ... additional as determined by feature research
 )
 ```
 **`AllClasses()` ordering:** Grouped by family in the same order as the group bands above. This order is consumed by `config.PrintConfig` for output ordering — so the output will naturally group protocols by family with no additional logic needed in `config`.
 ### `synth/config.go` — Add Group Field and Rebalanced ClassFreqConfigs
 **What changes:**
 1. Add `Group string` to `FreqConfig`:
 ```go
 type FreqConfig struct {
-    BaseHz    float64
+    BaseHz       float64
-    Harmonics []HarmonicDef
+    Harmonics    []HarmonicDef
-    Pan       float64
+    Pan          float64
-    Waveform  Waveform      // NEW: defaults to WaveformSine
+    WaveformType WaveformType
    Group        string  // NEW: sound family identifier; "" = ungrouped
 }
 ```
-`NewLayer` passes `cfg.Waveform` to `NewOscillator`. `NewOscillator` signature changes to accept the waveform.
+2. Add `ClassFreqConfigs` entries for all new protocols with group-coherent frequencies and within-group detuning.
-**What does NOT change:** `HarmonicDef`, `EMAAlpha`, `Layer.UpdateTarget`, `Layer.AdvanceSample`, `OscillatorBank.RenderWindow`, `mixer.go`, `encode/mp3.go`. The waveform change is contained to `oscillator.go` and the `FreqConfig` struct.
+3. Update existing class frequencies to align with the group bands (frequency rebalancing). This is the highest-risk change in v1.2 because it alters the default sound of existing classes.
 4. Update `NumLayers` constant from 14 to the new total (e.g., 30-35 depending on final protocol list):
 ```go
 const (
    NumLayers    = 32  // updated count; GainPerLayer recomputed automatically
    GainPerLayer = 1.0 / float64(NumLayers)
 )
 ```
 **What does NOT change:** `FreqConfig` field types (only addition), `WaveformType`, `HarmonicDef`, `WaveformPresetHarmonics`, `SampleRate`, `WindowMs`, `SamplesPerWindow`, `WhisperFloor`. The `Group` field is metadata — it has no effect on synthesis math.
 **Pan assignment:** With 30+ layers, the current hand-tuned pan positions become crowded. Recommendation: assign pan by group position (infrastructure = center, web = slight left, mail = slight right, etc.) rather than per-protocol. This creates a spatial "map" of the network that reinforces the group concept aurally.
 ### `config/config.go` — PrintConfig Group Ordering
 **What changes:** `PrintConfig` currently emits classes in `AllClasses()` order. With `AllClasses()` updated to group-coherent order, `PrintConfig` output will naturally be grouped. No structural change to `PrintConfig` is required.
 **Optional enhancement:** Emit a group comment header between group sections:
 ```toml
 # --- Infrastructure ---
 # ICMP -- 65.0 Hz (default)
 [sounds.ICMP]
 frequency = 65.0
 waveform = "sine"
 # NTP -- 110.0 Hz (default)
 [sounds.NTP]
 ...
 # --- Web ---
 # HTTP -- 175.0 Hz (default)
 [sounds.HTTP]
 ...
 ```
 This requires `PrintConfig` to detect group transitions in the class ordering and emit a comment. The `Group` field on `FreqConfig` provides this information. Implementation: iterate `AllClasses()`, track previous group, emit a comment when group changes.
 **What does NOT change:** TOML schema shape (no `group` key in `[sounds.*]` blocks — groups are not user-configurable in v1.2), `SoundOverride` struct, `RawRule`, `LoadResult`, `Load`, `merge`, `addAutoFreqEntries`.
 **Group field in TOML config:** Users should NOT be able to override the `group` of a class. Group is a built-in design decision, not a user parameter. The `SoundOverride` struct stays with only `Frequency` and `Waveform` pointer fields.
 ### `synth/bank.go` — No Changes Required
 `NewBank` already ranges over the passed-in `cfgs` map keys. Adding 20 new entries to `ClassFreqConfigs` and passing them through the existing chain requires no changes to `bank.go`. The `gainPerLayer` computation (`1.0 / float64(len(cfgs))`) automatically scales down with more layers.
 ### `encode/mp3.go` — No Changes Required
 `RunSynthesis` already accepts the full `freqCfgs` map and passes it to `NewBank`. No signature change needed.
 ### `cmd/netsynth/main.go` — No Changes Required
 The pipeline wiring (`config.Load` → `NewClassifier` → `encode.RunSynthesis`) is already correct. Adding more built-in classes and a group field to `FreqConfig` is transparent to `main.go`.
 ---
-### Feature 3: User-Defined Classification Rules
+## Data Flow: Unchanged for v1.2
-**Where rules are wired today:** `main.go` lines 111, 175 — both `runLiveMode` and `runPcapMode` call `classify.NewClassifier(classify.DefaultRules)` directly. No config is passed.
+The v1.1 data flow is correct and does not need to change:
-**Required change:** User rules from TOML prepend before `DefaultRules`. `Classifier` already supports arbitrary `[]Rule` — `NewClassifier(rules []Rule)` is the constructor. No change to `classifier.go` itself.
+```
-
+main.go
-**`RuleConfig` TOML struct:**
+  └─ config.Load(configPath)
-
+       └─ LoadResult{FreqCfgs, UserRules, ConfigPath, AutoClasses}
-```toml
+  └─ classify.NewClassifier(append(userRules, DefaultRules...))
-[[rule]]
+  └─ encode.RunSynthesis(snapshots, path, result.FreqCfgs)
-protocol = "tcp"
+       └─ synth.NewBank(tau, freqCfgs)
-dst_port = 8443
+            └─ one Layer per freqCfgs entry
 class    = "myservice"
 ```
-```go
+The only change to the data flowing through this pipeline is: `freqCfgs` now contains ~30-35 entries (up from 14), each `FreqConfig` has a new `Group` field (ignored by synthesis, used only by `PrintConfig`).
 // config/config.go
 type RuleConfig struct {
    Protocol string `toml:"protocol"`
    DstPort  uint16 `toml:"dst_port"`
    Class    string `toml:"class"`    // must match a name in [[class]] or a builtin class name
 }
 ```
-**Merging in main.go:**
+---
-```go
+## Integration Points Summary
 userRules := config.ToClassifyRules(cfg.Rules)      // []classify.Rule
 allRules := append(userRules, classify.DefaultRules...)
 classifier := classify.NewClassifier(allRules)
 ```
-**New `TrafficClass` values:** User-defined classes in TOML produce new `TrafficClass` string values (e.g., `"myservice"`). `AllClasses()` in `classify/types.go` is currently a hardcoded slice. For user-defined classes, `AllClasses()` cannot be the source of truth for bank layer construction. `NewBank` must instead iterate over whatever classes have a `FreqConfig` entry.
+| Integration Point | Change Type | Risk |
-
+|-------------------|-------------|------|
-This is a critical integration point: `bank.go:NewBank` currently ranges over `classify.AllClasses()`. If user classes can appear, `NewBank` must accept the full config map and range over that instead.
+| `classify/types.go` — new constants + `AllClasses()` | Additive | LOW |
 | `classify/rules.go` — extended `DefaultRules` | Additive (new entries before catch-alls) | MEDIUM (order matters) |
 | `synth/config.go` — `Group` field on `FreqConfig` | Additive (new field) | LOW (no synthesis impact) |
 | `synth/config.go` — `ClassFreqConfigs` entries for new protocols | Additive | LOW |
 | `synth/config.go` — `ClassFreqConfigs` frequency rebalancing for existing protocols | Modifying defaults | HIGH (changes default audio output) |
 | `synth/config.go` — `NumLayers` constant update | Single constant | MEDIUM (affects `GainPerLayer`) |
 | `config/config.go` — group-header comment in `PrintConfig` | Optional enhancement | LOW (isolated to string output) |
 | `synth/bank.go` | No change | — |
 | `encode/mp3.go` | No change | — |
 | `cmd/netsynth/main.go` | No change | — |
 ---
@@ -210,167 +334,157 @@ This is a critical integration point: `bank.go:NewBank` currently ranges over `c
 ### New
-| Component | Location | Purpose |
+None — no new packages or files are required.
 |-----------|----------|---------|
 | `config` package | `config/config.go` | TOML struct, `Load()`, file discovery, merge with defaults |
 | `config/defaults.go` | optional split | `DefaultConfig()` wrapping existing `ClassFreqConfigs` values |
 ### Modified
-| Component | Change | Impact |
+| Component | What Changes | What Stays Same |
-|-----------|--------|--------|
+|-----------|--------------|-----------------|
-| `synth/oscillator.go` | Add `Waveform` type + `waveform` field; dispatch in `Advance` | Self-contained; no caller signature breaks except `NewOscillator` |
+| `classify/types.go` | New `TrafficClass` constants; `AllClasses()` extended + reordered by group | `ClassifiedPacket`, `WindowSnapshot`, string type |
-| `synth/config.go` | Add `Waveform Waveform` field to `FreqConfig`; default to `WaveformSine` | Requires `NewLayer` to pass waveform to `NewOscillator` |
+| `classify/rules.go` | New `Rule` entries for all new protocols | `Rule` struct, match algorithm, catch-all placement |
-| `synth/layer.go` | Pass `cfg.Waveform` to `NewOscillator` | One-line change |
+| `synth/config.go` | `Group` field on `FreqConfig`; new entries in `ClassFreqConfigs`; existing frequency rebalancing; `NumLayers` updated | All synthesis constants, waveform types, `HarmonicDef` |
-| `synth/bank.go` | Accept `map[classify.TrafficClass]FreqConfig` param instead of reading global; range over param keys not `AllClasses()` | Decouples bank from global; enables user classes |
+| `config/config.go` | Optional: group-header comments in `PrintConfig` | All loading, parsing, merge, validation logic |
 | `encode/mp3.go` | Accept `*config.Config` or merged `FreqConfig` map; pass to `NewBank` | Thin forwarding change |
 | `cmd/netsynth/main.go` | Add `--config` flag; load config; prepend user rules; pass config to `RunSynthesis` | Touches both `runLiveMode` and `runPcapMode` |
 | `classify/rules.go` | No change — `DefaultRules` stays as the fallback | Unchanged |
 | `classify/classifier.go` | No change — already accepts `[]Rule` | Unchanged |
 | `classify/types.go` | `AllClasses()` may need a note that it returns only builtins; bank no longer relies on it | Low risk; document only |
 ---
-## Data Flow Changes
+## Build Order
-### v1.0 Flow (config hardcoded)
+The following order ensures each step is independently testable.
-```
+### Step 1: Define new TrafficClass constants and extend AllClasses()
 main.go
  └─ classify.NewClassifier(classify.DefaultRules)
  └─ encode.RunSynthesis(snapshots, path)
       └─ synth.NewBank(1.0)
            └─ ClassFreqConfigs[class]  ← global, hardcoded
 ```
-### v1.1 Flow (config injected)
+**Files:** `classify/types.go` only.
-```
+Add all new protocol constants. Update `AllClasses()` to include them in group-coherent order. Tests: verify `AllClasses()` returns the expected slice with all new members.
 main.go
  └─ config.Load(configPath)         ← NEW: resolve path, parse TOML, merge defaults
       └─ cfg *config.Config
  └─ classify.NewClassifier(
         append(config.ToClassifyRules(cfg.Rules), classify.DefaultRules...)
     )                                ← user rules prepend built-ins
  └─ encode.RunSynthesis(snapshots, path, cfg.FreqConfigs())
       └─ synth.NewBank(1.0, freqConfigs)   ← map passed in, not read from global
            └─ freqConfigs[class]    ← merged: user overrides + defaults
 ```
---
+No impact on synthesis, config, or main yet — new classes simply have no rules or FreqConfig entries yet, which is harmless.
-## Suggested Build Order
+### Step 2: Extend DefaultRules for new protocols
-The following order minimizes integration risk. Each step is independently testable before the next begins.
+**Files:** `classify/rules.go` only.
-### Step 1: Waveform types in `synth/oscillator.go`
+Add new `Rule` entries before the catch-alls. Tests: `NewClassifier(DefaultRules).Classify(pkt)` for each new protocol's port returns the expected new class. Confirm catch-alls still fire for unrecognized traffic.
-No external dependencies. Pure math. Testable with golden-sample unit tests (square wave sample at phase 0.25 should be 1.0, etc.). Does not affect `Layer`, `Bank`, or `encode` yet.
+Dependency: Step 1 must complete first (new constants must exist).
-**Files changed:** `synth/oscillator.go` only.
+### Step 3: Add Group field to FreqConfig
-### Step 2: Wire `Waveform` through `FreqConfig` and `Layer`
+**Files:** `synth/config.go` only.
-Add `Waveform` to `FreqConfig`. Update `NewLayer` to pass it to `NewOscillator`. `ClassFreqConfigs` entries default to `WaveformSine` (zero value — valid if `WaveformSine = 0`).
+Add `Group string` to `FreqConfig`. Set `Group` on all existing 14 `ClassFreqConfigs` entries. Existing tests continue to pass (new field has zero value by default; synthesis ignores it). No callers need updating.
-Existing tests continue to pass without modification since all existing configs use the zero-value waveform.
+This step is independent of Steps 1 and 2.
-**Files changed:** `synth/config.go`, `synth/layer.go`.
+### Step 4: Add ClassFreqConfigs entries for new protocols (without frequency rebalancing)
-### Step 3: Decouple `NewBank` from the global
+**Files:** `synth/config.go` only.
-Change `NewBank(tau float64)` to `NewBank(tau float64, cfgs map[classify.TrafficClass]FreqConfig)`. Update `encode/mp3.go:RunSynthesis` to pass `synth.ClassFreqConfigs` as default.
+Add `FreqConfig` entries for each new protocol using placeholder frequencies that avoid the 65-1100 Hz range (use 2400-4000 Hz temporarily). This makes the end-to-end pipeline work for new classes without disrupting existing audio.
-At this point the system is functionally identical to v1.0 but `NewBank` no longer reads a global.
+Tests: verify `ClassFreqConfigs` contains entries for all constants from `classify.AllClasses()`.
-**Files changed:** `synth/bank.go`, `encode/mp3.go`.
+Dependency: Step 3 must complete first (Group field must exist). Step 1 must complete first (constants must exist).
-### Step 4: `config` package — TOML structs and file discovery
+### Step 5: Frequency rebalancing — reassign all ClassFreqConfigs to group-coherent values
-Implement `config.Load()`, file discovery, and the `DefaultConfig()` function that wraps `synth.ClassFreqConfigs`. No TOML parsing yet — start with the struct definitions and the merge logic.
+**Files:** `synth/config.go` only.
-Add `github.com/BurntSushi/toml` dependency (`go get`).
+This is the riskiest step. Assign final group-coherent frequencies to all protocols (existing and new) following the band design above. Update `NumLayers` to the final count.
-**Files added:** `config/config.go`.
+Test strategy: write a test that verifies all entries in `ClassFreqConfigs` have `BaseHz` in a specified range per group; verify no two entries have identical `BaseHz`; verify `NumLayers` matches `len(ClassFreqConfigs)`.
-### Step 5: `--config` flag and user rule merging in `main.go`
+Manual validation: run `netsynth --read testfile.pcap` with varied traffic and listen. This step requires subjective audio evaluation that tests cannot replace.
-Wire `config.Load()` into `run()`. Pass user rules to both `runLiveMode` and `runPcapMode`. Pass merged `FreqConfig` map to `RunSynthesis`.
+Dependency: Steps 3 and 4 must complete first.
-At this point a minimal TOML config (empty file, or `[[rule]]` only) can be validated end-to-end.
+### Step 6: PrintConfig group-header comments (optional polish)
-**Files changed:** `cmd/netsynth/main.go`.
+**Files:** `config/config.go` only.
-### Step 6: Custom frequency and waveform overrides in config
+Add group transition detection in `PrintConfig`. When the `Group` field changes between consecutive `AllClasses()` entries, emit a `# --- GroupName ---` comment.
-Implement the `[[class]]` TOML section parsing. Add `FreqConfigs()` method to `Config` that returns the merged map (user overrides applied over defaults). Write table-driven tests: "TOML sets HTTPS to 200 Hz sawtooth, bank layer for HTTPS uses 200 Hz sawtooth."
+Tests: verify `PrintConfig` output contains group header comments; verify ungrouped classes have no group header; verify user-defined classes (no group field) are not preceded by a group header.
-**Files changed:** `config/config.go`.
+Dependency: Steps 3 and 5 must complete first (Group field must be populated in ClassFreqConfigs).
 ### Step 7: User-defined classes end-to-end
 Support `[[class]]` entries with names not in `classify.AllClasses()`. These become new `TrafficClass` values. User `[[rule]]` entries pointing to these classes are prepended to `DefaultRules`. The bank creates layers for all classes in the merged `FreqConfig` map.
 This step requires the most cross-package coordination but by this point each piece is already in place.
 **Files changed:** `config/config.go`, `cmd/netsynth/main.go` (verification that unknown class names don't panic).
 ---
 ## Component Boundaries After v1.1
 | Component | Responsibility | Communicates With |
 |-----------|---------------|-------------------|
 | `config` | TOML parsing, file discovery, merge logic, `DefaultConfig()` | `synth` (FreqConfig type), `classify` (Rule type) |
 | `synth/oscillator` | Phase-accumulator for sine/square/sawtooth/triangle | Used by `Layer` |
 | `synth/bank` | Accepts freq config map, constructs one `Layer` per entry | `encode` passes config map in |
 | `encode` | Receives config map from `main`, passes to `NewBank` | Thin pass-through |
 | `cmd/netsynth/main` | Loads config, merges rules, wires all stages | All packages |
 | `classify` | Rules engine (unchanged); `DefaultRules` stays as package-level var | `main` constructs with merged rules |
 ---
 ## Critical Integration Constraints
-### `AllClasses()` Is Not the Source of Truth for Bank Construction
+### NumLayers Must Match len(ClassFreqConfigs) for Correct Gain Scaling
-`bank.go` currently iterates `classify.AllClasses()` to construct layers. After v1.1, the bank must iterate the keys of the `FreqConfig` map passed to it. User-defined classes will not appear in `AllClasses()`. If this is not changed, user-defined class packets will be aggregated in `WindowSnapshot.Counts` but have no corresponding layer — they will produce silence and no error.
+`synth/config.go` defines `NumLayers = 14` as a constant. `GainPerLayer = 1.0 / float64(NumLayers)`. However, `bank.go:NewBank` computes `gainPerLayer` dynamically from `len(cfgs)`:
-**Fix:** `NewBank` iterates `maps.Keys(cfgs)` (or equivalent range over the map), not `classify.AllClasses()`.
+```go
 gainPerLayer: 1.0 / float64(len(cfgs)),
 ```
-### Class Name Validation Must Happen at Config Load Time
+This means `NumLayers` and `GainPerLayer` in `config.go` are currently informational constants, not what the bank actually uses at runtime. The bank's dynamic computation is correct. Update `NumLayers` for documentation accuracy, but the audio math is not at risk even if this is temporarily inconsistent.
-If a `[[rule]]` references a class name that has no corresponding `[[class]]` entry and is not a builtin, the system will silently mis-classify packets into a layer that doesn't exist. Validate at `config.Load()` time: every class name in `[[rule]]` must resolve to either a builtin `TrafficClass` or a `[[class]]` entry in the same config.
+### DefaultRules Catch-Alls Must Remain Last
-### `encode.RunSynthesis` Signature Change Is a Breaking API Change
+`classify/rules.go` ends with `{Protocol: "tcp", DstPort: 0, ...}` and `{Protocol: "udp", DstPort: 0, ...}`. All new protocol rules must be inserted before these. A rule added after the catch-alls will never fire. This constraint must be enforced by convention (comment in the file) since Go has no static ordering guarantees for slice initialization beyond the literal order.
-`encode.RunSynthesis(snapshots []classify.WindowSnapshot, outputPath string)` will need to accept the config. If any external code (tests, future callers) uses this signature, they will break. Keep the change to a single place and update all call sites in the same commit.
+### AllClasses() Ordering Drives PrintConfig Ordering
 `config.PrintConfig` iterates `classify.AllClasses()` to emit the `[sounds.*]` section. If `AllClasses()` is updated to group-coherent order (Step 1), `PrintConfig` output naturally reflects groups. If Step 6's group-header comments are added, they depend on `AllClasses()` presenting entries in group-sorted order. The two changes must be coordinated.
 ### Frequency Rebalancing Is a Default-Breaking Change
 Users who rely on the default audio profile (no config file) will hear different tones for previously-familiar classes. This is an intentional design improvement but should be documented in the release notes. Users who have overridden frequencies via TOML config are unaffected (their overrides take precedence).
 ### Group Field Is Not a TOML Configurable
 The `SoundOverride` struct in `config/config.go` must not gain a `group` field. Groups are built-in design decisions. Allowing users to reassign protocols to different groups via TOML would create inconsistencies in `PrintConfig` output ordering and the `AllClasses()` group semantics. If this is requested in a future milestone, it warrants a separate design decision.
 ---
 ## Anti-Patterns to Avoid
-### Anti-Pattern: Reading Global `ClassFreqConfigs` from Multiple Places
+### Anti-Pattern: Computing Detuning at Runtime from Group Metadata
-If `NewBank`, `encode.RunSynthesis`, and config loading all reference the package-level `synth.ClassFreqConfigs`, the merge point becomes ambiguous. The fix (Step 3 above) centralizes config reading to one place: `config.DefaultConfig()` reads from `ClassFreqConfigs` once when building defaults; everything downstream receives the already-merged map.
+It is tempting to define group base frequencies and detune offsets as data structures, then derive individual `BaseHz` values at synthesis startup. This adds complexity with no benefit — the final `BaseHz` values are static per-class constants that belong in `ClassFreqConfigs` directly. Bake the detuning arithmetic into the initial constant assignment, document it with a comment (`// Mail group: +10 Hz from group base 420 Hz`), and move on.
-### Anti-Pattern: Storing `Waveform` as a String Everywhere
+### Anti-Pattern: Group as a `classify.TrafficClass` Field
-Keeping `waveform` as a `string` from TOML all the way into `Oscillator` means every advance call parses or switches on a string. Parse the string to a `Waveform` int type at config-load time. The `Oscillator` field should be a typed `Waveform`, not `string`.
+Groups are audio concepts, not classification concepts. `classify.Rule` should not know about groups. `TrafficClass` is already a string type used as a map key throughout the codebase — adding a structured type would be a larger refactor than the feature warrants. Keep groups in `synth.FreqConfig`.
-### Anti-Pattern: User Rules Appended After DefaultRules
+### Anti-Pattern: Adding Group-Based Routing to bank.go
-User rules must **prepend** `DefaultRules`, not append. `DefaultRules` ends with catch-all rules (`DstPort: 0`) that match any TCP or UDP packet. Appending user rules after these catch-alls means they will never be reached.
+Do not make `OscillatorBank` aware of groups for mixing purposes (e.g., summing all Mail group layers before applying gain). The current architecture mixes all layers uniformly. Group-coherent mixing is a more complex feature than v1.2 requires and changes the synthesis model. Defer if requested.
 ### Anti-Pattern: Overcrowding 65-1100 Hz with Too Many Protocols
 At 30+ built-in classes, some protocols will be heard less often than others. Resist the urge to map rarely-seen protocols (Telnet, FTP) to prominent mid-range frequencies. Relegate low-signal protocols to the upper end of each group band so they contribute texture without dominating when not present.
 ### Anti-Pattern: Hand-Tuning Frequencies Without Listening
 Frequency assignments must be validated by ear, not just by looking at Hz values on a spreadsheet. Schedule a listening session with a realistic pcap file after Step 5 before Step 6. The architecture makes this easy — any frequency change is a one-line edit in `ClassFreqConfigs`.
 ---
 ## Scalability Considerations
 | Concern | With 14 Classes (v1.1) | With 32 Classes (v1.2) |
 |---------|----------------------|----------------------|
 | Gain per layer | ~7.1% of max | ~3.1% of max |
 | Frequency collisions | None | Possible if not planned |
 | AllClasses() iteration | 14 items, trivial | 32 items, still trivial |
 | PrintConfig output lines | ~60 lines | ~130 lines |
 | EMA smoothing convergence | No change | No change (per-layer, independent) |
 | NewBank construction time | Negligible | Negligible |
 The main practical change is perceptual loudness: with 32 layers each at 3.1% gain, the ambient mix becomes quieter when many protocols are active simultaneously. This is acceptable and matches the ambient/drone aesthetic. The `WhisperFloor` mechanism ensures inactive layers contribute minimally, so sessions with only 5-6 active protocols still sound full.
 ---
 ## Sources
- Direct code inspection: `synth/config.go`, `synth/oscillator.go`, `synth/bank.go`, `synth/layer.go`, `classify/classifier.go`, `classify/rules.go`, `classify/types.go`, `encode/mp3.go`, `cmd/netsynth/main.go` — HIGH confidence
+- Direct code inspection: `synth/config.go`, `synth/bank.go`, `synth/layer.go`, `synth/oscillator.go`, `classify/types.go`, `classify/rules.go`, `classify/classifier.go`, `config/config.go`, `encode/mp3.go`, `cmd/netsynth/main.go` — HIGH confidence
- BurntSushi/toml usage in production Go projects (Hugo, dep): MEDIUM confidence (well-known in Go ecosystem)
+- Musical interval theory (detuning, harmonic relationships): HIGH confidence — standard acoustic physics
- Phase-accumulator waveform synthesis formulas (square, sawtooth, triangle): HIGH confidence (standard DSP, textbook formulas)
+- v1.2 protocol list: determined from feature research (see FEATURES.md for rationale on which protocols to include)
 ---
-*Architecture research for: NetSynth v1.1 — custom sound mappings integration*
+*Architecture research for: NetSynth v1.2 — extended protocol coverage with grouped families*
-*Researched: 2026-03-26*
+*Researched: 2026-03-27*
@@ -1,279 +1,366 @@
 # Feature Research
 **Domain:** Network traffic sonification CLI tool (packet capture -> ambient MP3)
-**Researched:** 2026-03-24 (v1.0), updated 2026-03-26 (v1.1 custom sound mappings)
+**Researched:** 2026-03-24 (v1.0), updated 2026-03-26 (v1.1 custom sound mappings), updated 2026-03-27 (v1.2 extended protocol coverage)
 **Confidence:** MEDIUM — niche domain; comparable tools are research prototypes or GUI applications, not CLI tools. Table stakes are derived from tcpdump/packet-capture CLI conventions and sonification research literature.
 ---
-## v1.1 Feature Research: Custom Sound Mappings via TOML Config
+## v1.2 Feature Research: Extended Protocol Coverage with Grouped Protocol Families
-This section addresses the milestone question: "How do custom sound mapping config files typically work in audio/network tools? What are expected behaviors for config file loading, merging with defaults, validation, and error reporting?"
+This section addresses the milestone question: "How should protocol grouping work for network sonification? What are the most common protocols seen on typical networks? Which protocols are worth adding? What's the right granularity — individual protocol vs group?"
-### Config File Loading: Standard Behaviors Expected by CLI Users
+### What Real Networks Actually See
-Based on patterns from established CLI tools (git, golangci-lint, mise, hugo), users expect:
+Based on IANA well-known ports, nDPI's traffic classification taxonomy (450+ protocols, 17 application categories), Wireshark's protocol dissector set, and widely-cited network security references, traffic on real networks breaks down into recognizable families.
-1. **Auto-discovery with a defined search order.** The tool looks in a conventional set of locations without requiring an explicit flag. Failing silently (no config found = run with defaults) is correct behavior.
+**Home network (residential broadband):**
 The dominant traffic types are HTTPS (streaming, browsing, cloud sync), DNS (constant background noise, every connection starts here), NTP (infrequent but present on all devices), DHCP (device join/renew events), ICMP (ping, router probe), and mDNS/SSDP (device discovery on the local segment). IoT device traffic adds MQTT. Video calls add RTP/SRTP.
-2. **Explicit override via a flag.** `--config` (or `-c`) lets users point at a non-standard path. If `--config` is supplied and the file does not exist, that is an error — not silent fallback.
+**Office network (enterprise LAN):**
 Same HTTPS/DNS/NTP/DHCP base, plus: LDAP/Kerberos (domain auth), SMB (file sharing), RDP (remote desktop), SMTP/IMAP/POP3 (mail), SNMP (monitoring), syslog (log aggregation), SSH (server access), FTP (legacy file transfer still common in many environments).
-3. **Discovery search order (standard precedence):**
+**Server host (Linux box exposed to internet):**
-   - `--config path/to/file.toml` (explicit flag, highest priority)
+SSH (constant scan attempts), HTTPS (serving), DNS (resolver queries), ICMP (reachability probes), NTP (drift correction), syslog (local log collection), PostgreSQL/MySQL/Redis (local app traffic), SMTP (outbound mail relay).
   - `./netsynth.toml` (working directory, project-local)
   - `$XDG_CONFIG_HOME/netsynth/config.toml` (defaults to `~/.config/netsynth/config.toml`)
   - No config found → run with all defaults (not an error)
-   This is the pattern used by git (`.git/config` -> `~/.gitconfig` -> `/etc/gitconfig`), golangci-lint (`.golangci.yml` in working dir), and mise (`mise.toml` -> `~/.config/mise/config.toml`). **HIGH confidence** — XDG Base Directory Specification is the Linux/macOS standard.
+**Cloud workload:**
 HTTPS dominates. DNS for service discovery. Redis/PostgreSQL for app data. Kafka/AMQP for message queues. gRPC (still port 443 via HTTP/2). ICMP suppressed. NTP locked down.
-4. **Partial overrides only — not a replacement config.** The config file expresses only what the user wants to change. Absent keys retain default values. This is universally expected: users do not want to replicate the full default table in order to change one frequency.
+### Why Protocol Grouping Matters for Sonification
-### Config File Merging: How Defaults and User Config Combine
+Without grouping, adding 20+ individual protocols creates:
 1. **Spectrum crowding:** 20+ tones across the audible range become indistinguishable mud.
 2. **No perceptual structure:** Listeners cannot form a mental model of what they are hearing.
 3. **Frequency allocation complexity:** Designing 20+ non-conflicting frequency slots is difficult.
-The dominant pattern across well-designed CLI tools:
+The nDPI project (the leading open-source DPI library, used by ntopng) faced the same problem and solved it with 17 application categories that group hundreds of protocols. For sonification, the goal is different — not to identify every protocol, but to produce a soundscape where related activity sounds related.
-**Merge strategy: user values override defaults, defaults fill gaps.**
+**Recommended approach: Protocol families, not individual protocols.**
-```
+A "Mail" family chord — one tonal cluster covering SMTP + IMAP + POP3 — is more musically coherent and more perceptually useful than three separate isolated tones. A user can hear "mail activity is elevated" rather than "something is happening on port 143."
 builtin defaults  <--  loaded first (in-code, always present)
     +
 user config file  <--  loaded second (overrides per-key)
     =
 effective config  <--  what the program runs with
 ```
-For NetSynth's classification rules specifically, there are two distinct semantics that must be clearly chosen:
+### Protocol Grouping Taxonomy for NetSynth v1.2
- **Override by name:** User supplies a `[rule.DNS]` block that replaces the built-in DNS sound parameters. The predefined DNS rule's classification logic is kept; only its sound output changes.
+After surveying IANA port assignments, nDPI's category taxonomy, and the Wireshark protocol support matrix, the following family groupings are recommended. Each family occupies a frequency region (not individual tones), and protocols within a family use slight detuning or waveform variation to stay distinct.
 - **Prepend user rules:** User-defined rules are inserted before the built-in rule list, allowing them to match first (first-match-wins). This enables the user to add entirely new protocol-to-sound mappings.
-Both are needed. They serve different use cases:
+**Family: Web (already covered)**
- Sound overrides (change frequency/waveform for a known protocol) use the override-by-name pattern.
+- HTTPS / TLS (port 443) — already built in
- Custom traffic rules (classify "tcp port 8443 as MyApp") use prepend semantics.
+- HTTP (port 80) — already built in
 - HTTP/3 / QUIC (port 443 UDP) — port-based detection is possible (UDP 443)
 - Alt-HTTPS ports (8443, 8080) — users can add via custom rules
-### Validation: What Users Expect When Config Has Errors
+**Family: Mail**
 - SMTP (port 25) — already built in (single class)
 - SMTP submission (port 587, 465) — distinct submission path, worth adding
 - IMAP (port 143, 993) — pull email; very common on office networks
 - POP3 (port 110, 995) — legacy pull email; still common with older mail clients
-Based on patterns in go-toml v2's strict mode and golangci-lint error reporting:
+**Family: Remote Access**
 - SSH (port 22) — already built in
 - Telnet (port 23) — unencrypted, legacy; worth representing (security signal)
 - RDP (port 3389) — Windows remote desktop; ubiquitous in enterprise
 - VNC (port 5900) — remote frame buffer; common on servers/developer machines
-**Expected validation behaviors (roughly in order of importance):**
+**Family: Infrastructure (already partially covered)**
 - DNS (port 53) — already built in
 - DHCP (ports 67/68) — already built in
 - NTP (port 123) — already built in
 - mDNS (port 5353 UDP) — Bonjour/Avahi discovery; prominent on home/office LANs
 - SSDP (port 1900 UDP) — UPnP device discovery; common with IoT devices
 - LLMNR (port 5355) — Windows local name resolution; common on Windows networks
 - SNMP (port 161/162 UDP) — network monitoring; common on office/server networks
 - Syslog (port 514 UDP) — log forwarding; common on server and enterprise networks
-| Behavior | Why Expected | Go Implementation Note |
+**Family: File Transfer**
-|----------|--------------|----------------------|
+- FTP (port 21) — still widely used in legacy environments, NAS devices
-| Unknown keys caught and reported | Prevents silent typos (user writes `frequncy`, expects it to work) | `go-toml/v2` `DisallowUnknownFields()` or BurntSushi's `Undecoded()` check |
+- TFTP (port 69 UDP) — boot/config transfer; common in network infrastructure (switches, PXE boot)
-| Line number in error message | Users need to know where the problem is | Both go-toml/v2 DecodeError and BurntSushi include position info |
+- SMB (port 445) — Windows file sharing; ubiquitous on any Windows or Samba network
 | Human-readable field path | "invalid value for `rules[0].waveform`" not "decode error" | go-toml v2's `DecodeError` produces contextualized messages |
 | Invalid enum values rejected | `waveform = "sqaure"` (typo) should list valid options | Post-decode validation loop with explicit error message listing valid values |
 | Out-of-range numbers rejected | `frequency = -50` or `frequency = 25000` should fail with reason | Post-decode bounds check with message |
 | Missing required fields in new rules | A user rule block missing `protocol` is ambiguous | Post-decode presence check |
 | Config error prevents startup | Do not silently ignore errors and run with partial config | Error should exit with non-zero and print the problem before capturing any packets |
-**Critical:** Validation errors must surface before capture begins. A user who runs the tool, captures for 30 minutes, then gets a corrupt MP3 because a config value was silently ignored would rightly be frustrated.
+**Family: Database**
 - MySQL/MariaDB (port 3306) — most common SQL database port
 - PostgreSQL (port 5432) — second most common SQL database
 - Redis (port 6379) — in-memory cache; present on almost every modern app server
 - MongoDB (port 27017) — document store; very common in web apps
-### Error Reporting: Standard UX Patterns
+**Family: VoIP / Real-Time**
 - SIP (port 5060/5061) — VoIP signaling; present in any office with IP phones
 - RTP (ports 16384-32767 UDP, dynamic) — voice/video payload; hard to detect by port alone
-From studying tools in the same class (golangci-lint, hugo, suricata):
+**Family: Directory / Authentication**
 - LDAP (port 389, 636) — Active Directory / OpenLDAP; present on any enterprise network
 - Kerberos (port 88) — Active Directory authentication; present on any Windows domain network
- Print config errors to **stderr** (not stdout).
+Note: gopacket/layers does NOT natively decode SMTP, IMAP, POP3, FTP, TFTP, SMB, MySQL, PostgreSQL, Redis, SIP, RTP, LDAP, or Kerberos at the application layer. Classification must happen at the transport layer (port number matching), which is exactly how the existing Rule classifier works. No new dependencies required.
- Prefix with the config file path: `netsynth.toml:12: unknown field "frequncy"`.
+
- List ALL errors found in one pass rather than stopping at the first error. Users prefer fixing 5 things in one edit over 5 sequential runs.
+### Which Protocols to Include: Priority Tiers
- Warn (not error) for non-fatal issues such as "config file found but empty" or "unknown field in a comment-like position" — but for NetSynth's scope, unknown keys should be hard errors to prevent silent misconfigurations.
+
- On `--config path` flag with missing file: hard error immediately.
+**Tier 1 — Add immediately (high real-world frequency, low complexity)**
- On auto-discovered config with missing file: silent success (no config = defaults).
+
 | Protocol | Ports | Network Type | Detection Method | Family |
 |----------|-------|-------------|-----------------|--------|
 | IMAP / IMAPS | TCP 143, 993 | Home, Office, Server | Port match | Mail |
 | POP3 / POP3S | TCP 110, 995 | Home, Office | Port match | Mail |
 | SMTP Submission | TCP 587, 465 | Home, Office, Server | Port match | Mail |
 | FTP | TCP 20, 21 | Office, Server, NAS | Port match | File Transfer |
 | SMB | TCP 445 | Office, Windows networks | Port match | File Transfer |
 | RDP | TCP 3389 | Office, Enterprise | Port match | Remote Access |
 | mDNS | UDP 5353 | Home, Office | Port match | Infrastructure |
 | SSDP | UDP 1900 | Home, IoT | Port match | Infrastructure |
 | SNMP | UDP 161, 162 | Office, Server | Port match | Infrastructure |
 | MySQL | TCP 3306 | Server, Cloud | Port match | Database |
 | PostgreSQL | TCP 5432 | Server, Cloud | Port match | Database |
 | Redis | TCP 6379 | Server, Cloud | Port match | Database |
 **Tier 2 — Include if groups are being formed (moderate frequency)**
 | Protocol | Ports | Network Type | Detection Method | Family |
 |----------|-------|-------------|-----------------|--------|
 | Telnet | TCP 23 | Legacy, embedded | Port match | Remote Access |
 | VNC | TCP 5900 | Office, Developer | Port match | Remote Access |
 | TFTP | UDP 69 | Infrastructure, PXE | Port match | File Transfer |
 | SIP | TCP/UDP 5060, 5061 | Office, VoIP | Port match | VoIP |
 | LDAP / LDAPS | TCP 389, 636 | Enterprise | Port match | Directory/Auth |
 | Kerberos | UDP/TCP 88 | Enterprise, Windows | Port match | Directory/Auth |
 | Syslog | UDP 514 | Server, Enterprise | Port match | Infrastructure |
 | MongoDB | TCP 27017 | Server, Cloud | Port match | Database |
 | QUIC/HTTP3 | UDP 443 | Home, Office | Port match (UDP 443) | Web |
 **Tier 3 — Defer or leave to user custom rules**
 | Protocol | Reason to Defer |
 |----------|----------------|
 | MQTT (TCP 1883/8883) | IoT-specific; not present on most general networks |
 | AMQP (TCP 5672) | Message queue; only relevant on specific server workloads |
 | Kafka (TCP 9092) | Rarely seen outside distributed systems environments |
 | BGP (TCP 179) | Routing protocol; not visible on end-host captures |
 | OSPF | Link-state routing; IP protocol 89, not TCP/UDP; gopacket has native decoder but it is infrastructure traffic only |
 | RADIUS (UDP 1812/1813) | Authentication forwarding; only on network infrastructure |
 | gRPC | Uses HTTP/2 on port 443; indistinguishable from HTTPS at transport layer |
 | XMPP (TCP 5222) | Near-obsolete for general messaging |
 ### What Granularity Is Right: Individual Protocol vs Group?
 **Recommendation: Implement individual protocol classes, but group them for frequency allocation.**
 This gives the user the most information value while maintaining musical coherence:
 - Each protocol gets a distinct `TrafficClass` constant and rule (e.g., `ClassIMAP`, `ClassSMB`).
 - Related protocols are assigned frequencies within a shared family frequency band (e.g., all Mail protocols live in 400-550 Hz).
 - Within a family band, slight detuning (5-15 Hz apart) produces audible distinction without crowding.
 - Family identity is perceivable because the tones are harmonically close.
 This matches how nDPI handles the tension: individual protocol identity for precise classification, category grouping for user-facing display and policy. NetSynth's "display" is sonic — the grouping manifests as tonal proximity.
 The alternative — collapsing IMAP+SMTP+POP3 into a single "Mail" class — loses information. A user cannot tell whether mail noise is inbound (IMAP) or outbound (SMTP). Individual classes preserve that distinction.
 ### Frequency Allocation for New Families
 The current frequency map uses 65 Hz – 1047 Hz across 14 classes. Adding ~20 new protocols requires rethinking the allocation.
 **Current allocation issues:**
 - The range from 65-110 Hz (ICMP, DNS) is very low; adding families in this region creates muddiness.
 - The unknown buckets at 862-1047 Hz occupy space that could be used for real protocols.
 - The spread from 600-780 Hz (DHCP, OtherTCP, OtherUDP) is dense.
 **Recommended approach for v1.2:**
 - Assign families to distinct octave/register bands rather than a linear frequency sweep.
 - Use musically meaningful intervals within each family (minor thirds, perfect fourths — intervals that sound related without clashing).
 - Keep the existing 10 class frequencies backward-compatible; assign new protocols to new frequency slots.
 - Push unknown buckets above 1200 Hz (the current auto-assign range already does this via FNV hash).
 **Proposed family frequency bands:**
 | Family | Band | Rationale |
 |--------|------|-----------|
 | Infrastructure (DNS, DHCP, NTP, mDNS, SNMP, Syslog, SSDP) | 80-200 Hz | Low, grounding tones; infrastructure is the "bass" of the network |
 | Web (HTTP, HTTPS, QUIC) | 220-320 Hz | Mid-low; dominant traffic, warm register |
 | Mail (SMTP, IMAP, POP3) | 350-480 Hz | Mid; distinct from web, harmonically separate |
 | Remote Access (SSH, Telnet, RDP, VNC) | 500-620 Hz | Mid-high; noticeable — admin activity is important |
 | File Transfer (FTP, TFTP, SMB) | 650-750 Hz | Upper-mid; distinct texture |
 | Database (MySQL, PostgreSQL, Redis, MongoDB) | 800-950 Hz | Upper register; database chatter is server-side signal |
 | Directory / Auth (LDAP, Kerberos) | 960-1050 Hz | High; auth traffic is sparse but significant |
 | VoIP (SIP, RTP) | 1100-1200 Hz | High; real-time traffic stands out |
 | Unknown buckets | 1300+ Hz | Highest; unclassified traffic is "noise above the signal" |
 | ICMP | 65 Hz | Remains as fundamental ping pulse below all families |
 ---
-## Table Stakes for v1.1
+## Table Stakes for v1.2
-Features users expect in any CLI tool that introduces a config file. Missing these makes v1.1 feel incomplete.
+Features required to call v1.2 complete. Missing these means the milestone goal ("expanded protocol classification with grouped protocol families") is not delivered.
 | Feature | Why Expected | Complexity | Depends On |
 |---------|--------------|------------|------------|
-| TOML config file auto-discovery (`./netsynth.toml`, `~/.config/netsynth/config.toml`) | Standard CLI convention; users expect zero-flag discovery | LOW | New: config loader module |
+| Mail family (IMAP, IMAPS, POP3, POP3S, SMTP submission 587/465) | Requested directly in todo; mail traffic is high-frequency on any office network | LOW | Existing Rule/TrafficClass pattern; add constants + rules |
-| `--config` flag for explicit path | Required when multiple configs exist or working dir is wrong | LOW | New: config loader + cobra flag |
+| Remote Access expansion (RDP, VNC, Telnet) | SSH is already present; the family is incomplete without RDP on enterprise captures | LOW | Same as above |
-| Partial override semantics (absent keys retain defaults) | Users must not copy the entire default table to change one field | LOW | New: merge logic |
+| File Transfer family (FTP, SMB, TFTP) | FTP/SMB appear on almost every office or NAS-connected home network | LOW | Same as above |
-| Custom frequency per known traffic class | Core v1.1 ask; directly maps to `synth.FreqConfig.BaseHz` | LOW | Existing `synth.ClassFreqConfigs` |
+| Infrastructure expansion (mDNS, SSDP, SNMP, Syslog) | These are constant background noise on every LAN; without them they land in other-UDP | LOW | Same as above |
-| Custom waveform per known traffic class | Core v1.1 ask; maps to `synth.Oscillator.Advance()` harmonic shape | MEDIUM | Existing oscillator (needs waveform type support) |
+| Database family (MySQL, PostgreSQL, Redis, MongoDB) | Any developer machine has these; they currently all land in other-TCP | LOW | Same as above |
-| User-defined classification rules with custom sounds | Core v1.1 ask; prepend to `classify.DefaultRules` | MEDIUM | Existing `classify.Rule` struct (needs `Class` name generation) |
+| Frequency rebalancing to accommodate new classes | Without rebalancing, the new classes crowd the existing spectrum | MEDIUM | requires touching synth.ClassFreqConfigs; backward-compatible if existing class constants keep their names |
-| Config validation with line-number errors | Users cannot fix config errors without location info | LOW | go-toml v2 DecodeError (built-in) |
+| TrafficClass constants and AllClasses() updated | Config, synth, and print-config must know about new classes | LOW | classify/types.go extension |
-| Unknown field detection | Prevents silent typos | LOW | go-toml v2 `DisallowUnknownFields()` |
+| DefaultRules updated with new port rules | New classes only work if packets reach them via rules | LOW | classify/rules.go extension |
-| Startup-time validation (fail before capture) | No wasted captures with bad config | LOW | Load config in `cmd` root before starting capture |
+| --print-config reflects new classes | Users need to see and override the new classes | LOW | Falls out automatically once ClassFreqConfigs and AllClasses() are updated |
-| Clear error message listing valid enum values | `waveform` has exactly 4 valid values; list them on error | LOW | Post-decode validation |
+| Group concept exposed in --print-config | Grouped comments (# Mail family, # Database family) make the config readable | LOW | PrintConfig formatting only; no struct changes needed |
-## Differentiators for v1.1
+## Differentiators for v1.2
-Features that make the config experience polished beyond the minimum.
+Features that make the extended protocol coverage polished beyond the minimum.
 | Feature | Value Proposition | Complexity | Notes |
 |---------|-------------------|------------|-------|
-| `netsynth --print-config` command to dump effective config as TOML | Users want to see what defaults they're overriding; essential for creating a starting-point config file | LOW | Marshal `ClassFreqConfigs` + active rules to TOML; makes discoverability easy |
+| Within-family tonal design: shared waveform within a family | Mail protocols all use the same waveform (e.g., sawtooth); listeners perceive the family by timbre as well as frequency | LOW | Assign waveform by family at design time; no new code needed |
-| Config documentation via inline comments in generated TOML | When `--print-config` outputs commented TOML, users get self-documenting starting point | LOW | Write comment strings alongside marshaled output |
+| Within-family detuning: minor third intervals between protocols in a family | Protocols within a family are harmonically close; the family "chord" is identifiable | LOW | Frequency assignment arithmetic at design time |
-| Named custom rules (user assigns a label) | User writes `name = "MyApp"` in a rule block; that name appears in the exit summary and `--verbose` output | LOW | Extend `classify.Rule` to carry optional display name |
+| Directory/Auth family (LDAP, Kerberos) | Present on every enterprise network; their absence means enterprise traffic sounds like "other-TCP" noise | LOW | 2 more class constants + rules |
-| Waveform preview hint in config error message | "valid waveforms: sine, square, sawtooth, triangle" inline with the error | LOW | Hard-code the valid set in the validator |
+| VoIP family (SIP, SIP-TLS) | IP phone traffic is prominent in offices; SIP port 5060 is easily matched | LOW | 2 more class constants + rules |
-| Harmonic override per class (not just base frequency) | Advanced users can tune the timbre, not just the pitch | MEDIUM | Requires exposing `HarmonicDef` slice in TOML schema; nesting adds parsing complexity |
+| QUIC / HTTP3 class (UDP 443) | HTTP/3 now represents a significant fraction of web traffic; treating it identically to HTTPS when it arrives via UDP is perceptually meaningful | LOW | 1 rule: UDP port 443 maps to ClassQUIC or ClassHTTPS3 |
-## Anti-Features for v1.1
+## Anti-Features for v1.2
-Features that seem natural but should be avoided.
+Features that seem natural for this milestone but should be avoided.
 | Anti-Feature | Why Avoid | What to Do Instead |
 |--------------|-----------|-------------------|
-| Config file hot-reload during capture | Appears useful but mid-capture parameter change would corrupt synthesis state and produce jarring audio discontinuities | Require restart to apply config changes; document this explicitly |
+| Application-layer (DPI) detection | gopacket does not decode SMTP, SMB, Redis, etc. at the application layer. Implementing DPI requires a full protocol parser per protocol — massive scope. | Port-number matching is sufficient for classification purposes; DPI adds complexity without enough sonification value |
-| Environment variable config overrides | Adds a third precedence layer (flags > env > file > defaults) that increases combinatorial test surface with low user demand for this tool | Stick to flags + file + defaults; NetSynth is not a server needing 12-factor config |
+| Single "Mail" or "Database" class (collapsing all protocols in family) | Loses per-protocol information. "Mail" does not tell you if it is inbound or outbound. "Database" does not distinguish Redis latency spikes from a slow Postgres query. | Keep individual TrafficClass per protocol; use frequency proximity for family grouping |
-| Multiple config file includes / inheritance (`extends = "base.toml"`) | Sounds powerful, creates debugging nightmares when users do not understand the merge order | Single user config file merged with in-code defaults is sufficient; if a user needs multiple environments they can use `--config` |
+| Dynamic port detection (e.g., FTP data port 20 bidirectional, ephemeral RTP ports) | FTP uses negotiated dynamic ports for data transfer; RTP uses ports negotiated over SIP. Tracking these requires stateful flow tracking across packets — significant architectural change. | Classify on well-known control/server ports only; dynamic data flows land in other-TCP/UDP. Document this limitation. |
-| YAML or JSON config format as alternatives | "Why not YAML?" is a common request; supporting multiple formats multiplies parser dependency surface and doubles validation code paths | TOML only; document the choice (TOML is unambiguous, has clean table syntax, is the standard for Go tooling) |
+| Runtime group concept (Group struct with members) | Adding a Group abstraction to TrafficClass, Rule, or FreqConfig requires touching multiple packages and complicates the TOML schema. | Groups are a classification/display concept only, not a data structure. Implement them as naming conventions and config comment sections. |
-| Silent partial load on validation error | Some tools load what they can and warn about the rest | Hard error on any invalid field; the user's intent for that field is unknown, so continuing is worse than stopping |
+| Backward-incompatible frequency changes to existing 10 classes | Users who have existing TOML configs relying on the current frequencies would have their carefully tuned soundscapes broken | Keep ICMP=65Hz, DNS=110Hz, HTTPS=175Hz, HTTP=220Hz, SSH=330Hz, SMTP=440Hz, NTP=520Hz, DHCP=600Hz, OtherTCP=700Hz, OtherUDP=780Hz; assign new protocols to unoccupied slots |
-| Config wizard / interactive setup | Out of scope for a CLI tool with a non-interactive model | Provide `--print-config` with comments as a self-service starting point |
+| Replacing other-TCP / other-UDP with something smarter | The catch-all classes serve an important role: unrecognized traffic is still represented. Removing them creates silent gaps. | Keep other-TCP and other-UDP as catch-alls; new specific classes reduce how much traffic lands there |
-| Stereo pan position in config | Requested but explicitly deferred in PROJECT.md for this milestone | Out of scope for v1.1; document as v1.2 candidate |
+| SRC port matching rules | Some protocols run on ephemeral source ports; adding src-port rules would double rule count and create false matches. Current architecture matches dst-port only. | Stick to dst-port matching. This is how nmap, iptables, and most classifiers work by default. |
 ## Feature Dependencies for v1.2
 ```
 [classify/types.go: add ~20 new TrafficClass constants]
    |
    +--enables--> [classify/rules.go: add new Rule entries per protocol]
    |                  |
    |                  +--feeds--> [classify.Classifier: matches packets to new classes]
    |
    +--enables--> [synth/config.go: add FreqConfig entries for new classes]
    |                  |
    |                  +--requires--> [Frequency rebalancing: shift new classes into family bands]
    |                  |              (backward-compatible: existing 10 classes unchanged)
    |                  |
    |                  +--feeds--> [synth.Bank: synthesizes new layers]
    |                              (NumLayers constant must increase from 14 to cover new classes)
    |
    +--enables--> [classify.AllClasses(): include new classes in display order]
                       |
                       +--feeds--> [config.PrintConfig(): groups appear in --print-config output]
                       +--feeds--> [aggregate.Summary: new classes appear in exit summary]
 ```
 ### Dependency Notes for v1.2
 - **NumLayers constant must increase.** `synth/config.go` has `NumLayers = 14` and derives `GainPerLayer = 1.0 / float64(NumLayers)` from it. Adding 20 protocols brings total classes to ~34. `NumLayers` must be updated, or the gain calculation must become dynamic. This is a straightforward arithmetic change but affects all layers' amplitude. Test the mix with more layers to confirm it still sounds balanced.
 - **AllClasses() ordering determines --print-config output order.** Currently returns a flat slice. For v1.2, ordering by family group (all Mail classes together, all Database classes together) makes --print-config more readable. This is a display concern only — the order has no effect on classification.
 - **No new external dependencies required.** All new protocols are detected via port number using the existing Rule struct. gopacket is not being asked to decode new application-layer protocols.
 - **QUIC/HTTP3 requires a UDP 443 rule.** The current rules only match TCP 443 for HTTPS. Adding a separate rule for UDP 443 is one line. The question is naming: `ClassHTTPS3` or `ClassQUIC`. QUIC is the transport; HTTP/3 is the application. For sonification purposes, `ClassQUIC` is clearer because it describes the observable port behavior.
 - **SIP detection covers control plane only.** SIP signals calls on port 5060/5061, but the actual voice/video payload travels via RTP on dynamically negotiated ports (typically in 16384-32767 range). The current classifier cannot detect RTP payloads without stateful flow tracking. Classify SIP only; document that RTP payload traffic lands in other-UDP.
 ---
-## Feature Dependencies for v1.1
+## Protocol List: Final Recommended Set
-```
+This is the complete recommended protocol class list for v1.2, including existing + new.
 [Config file loader (TOML parse + merge)]
    |
    +--provides--> [Custom frequency overrides]   (maps to synth.FreqConfig.BaseHz)
    |
    +--provides--> [Custom waveform per class]     (requires oscillator waveform dispatch)
    |                   |
    |                   +--requires--> [Waveform type in oscillator]  (new: sine/square/sawtooth/triangle)
    |
    +--provides--> [User-defined classification rules]
                       |
                       +--requires--> [Dynamic TrafficClass generation]  (new: user rule class names)
                       +--prepended-to--> [classify.DefaultRules]
-[--config flag]  --overrides--> [Config file loader search path]
+### Existing (unchanged, backward-compatible)
-[--print-config] --reads--> [Effective config after merge]  (new subcommand)
+| Class | Protocol | Port | Transport |
-```
+|-------|----------|------|-----------|
 | ICMP | ICMP/ICMPv6 | — | ICMP |
 | DNS | Domain Name System | 53 | TCP+UDP |
 | HTTPS | HTTP Secure / TLS | 443 | TCP |
 | HTTP | HTTP | 80 | TCP |
 | SSH | Secure Shell | 22 | TCP |
 | SMTP | Mail Transfer (server-to-server) | 25 | TCP |
 | NTP | Network Time Protocol | 123 | UDP |
 | DHCP | Dynamic Host Config | 67, 68 | UDP |
 | other-TCP | Unclassified TCP | — | TCP |
 | other-UDP | Unclassified UDP | — | UDP |
 | unknown-1..4 | Hash-bucketed unknowns | — | any |
-### Dependency Notes for v1.1
+### New: Tier 1 (high frequency, recommended for v1.2)
 | Class | Protocol | Port | Transport | Family |
 |-------|----------|------|-----------|--------|
 | IMAP | IMAP / IMAPS | 143, 993 | TCP | Mail |
 | POP3 | POP3 / POP3S | 110, 995 | TCP | Mail |
 | SMTP-Submission | SMTP client submission | 587, 465 | TCP | Mail |
 | FTP | File Transfer Protocol | 20, 21 | TCP | File Transfer |
 | SMB | Server Message Block | 445 | TCP | File Transfer |
 | RDP | Remote Desktop Protocol | 3389 | TCP | Remote Access |
 | mDNS | Multicast DNS (Bonjour) | 5353 | UDP | Infrastructure |
 | SSDP | Simple Service Discovery | 1900 | UDP | Infrastructure |
 | SNMP | Simple Network Mgmt | 161, 162 | UDP | Infrastructure |
 | MySQL | MySQL database | 3306 | TCP | Database |
 | PostgreSQL | PostgreSQL database | 5432 | TCP | Database |
 | Redis | Redis in-memory store | 6379 | TCP | Database |
- **Waveform type is a new concept in the oscillator.** The v1.0 `Oscillator.Advance()` only does additive sine. To support square/sawtooth/triangle, the oscillator needs a `WaveformType` field and dispatch logic. This is an internal change, but it's required before waveform config can be wired up.
+### New: Tier 2 (moderate frequency, recommended for v1.2 completeness)
- **User-defined rules require dynamic `TrafficClass` values.** v1.0 `TrafficClass` is a string type with predefined constants. User rules name their own classes (e.g., `"MyApp"`). The classifier already uses `TrafficClass` as a string; the `synth` layer needs to handle classes not in `ClassFreqConfigs` by looking up user-supplied sound parameters.
+| Class | Protocol | Port | Transport | Family |
- **Config loading must happen in `cmd` before the capture pipeline starts.** The cobra root command's `RunE` (or `PersistentPreRunE`) function loads and validates config, then passes effective config into the pipeline constructors. This is a structural change to `cmd/root.go`.
+|-------|----------|------|-----------|--------|
- **`--print-config` is independent** of capture and can be implemented as a separate cobra subcommand reading only the config loader output.
+| Telnet | Telnet (unencrypted shell) | 23 | TCP | Remote Access |
 | VNC | VNC / Remote Frame Buffer | 5900 | TCP | Remote Access |
 | TFTP | Trivial File Transfer | 69 | UDP | File Transfer |
 | SIP | SIP VoIP signaling | 5060, 5061 | TCP+UDP | VoIP |
 | LDAP | Directory Access Protocol | 389, 636 | TCP | Directory/Auth |
 | Kerberos | Kerberos authentication | 88 | TCP+UDP | Directory/Auth |
 | Syslog | System log forwarding | 514 | UDP | Infrastructure |
 | MongoDB | MongoDB document store | 27017 | TCP | Database |
 | QUIC | QUIC / HTTP/3 transport | 443 | UDP | Web |
 **Total: 11 existing known + 21 new = 32 known protocol classes + 4 unknown buckets = 36 total.**
 ---
 ## Implementation Complexity Summary
-| Feature | Complexity | Reason |
+| Area | Complexity | Reason |
-|---------|------------|--------|
+|------|------------|--------|
-| Config file loader (TOML parse + merge + validation) | LOW-MEDIUM | go-toml v2 handles parsing; merge logic is a loop; validation is a post-decode pass |
+| New TrafficClass constants (~21) | LOW | Add string constants; no logic change |
-| Custom frequency per class | LOW | Direct map lookup override; one line per class |
+| New Rule entries in DefaultRules (~25 rules for 21 classes, some need 2 ports) | LOW | Add Rule structs; existing matcher handles them |
-| Custom waveform per class | MEDIUM | Oscillator needs waveform dispatch (new `WaveformType`); synthesis loop changes |
+| New FreqConfig entries (~21) | LOW | Add map entries with chosen Hz values and waveform |
-| User-defined classification rules | MEDIUM | Dynamic class names; synth layer must handle unknown class names via config lookup |
+| Frequency rebalancing design | MEDIUM | Must assign ~21 new Hz values that (a) stay within audible range, (b) are musically coherent within families, (c) do not collide with existing 10 classes |
-| `--config` flag + auto-discovery | LOW | Cobra flag + os.Stat checks on 2-3 paths |
+| NumLayers update | LOW | One constant change; test mix amplitude |
-| `--print-config` subcommand | LOW | Marshal effective config to TOML; add comments |
+| AllClasses() family-ordered output | LOW | Reorder the returned slice by family |
-| Named custom rules in exit summary | LOW | `classify.Rule` struct gains optional `Name string` field |
+| PrintConfig family section headers | LOW | Add comment lines between family groups in PrintConfig |
 | Test updates | LOW | Add new classes to classifier tests; confirm no regressions |
-**No new external dependencies required.** go-toml v2 is the only addition to `go.mod`.
+**No new external dependencies required for v1.2.**
 ---
-## TOML Schema Sketch (Informational)
+## Competitor Feature Analysis (Updated for v1.2)
-This is not a binding decision — it informs the roadmap's implementation phase. The schema should feel natural to a user who has seen other Go tool configs (golangci-lint, goreleaser).
+| Feature | SoNSTAR (Python) | Network-Sonification (C# GUI) | Peep (C, Unix) | NetSynth v1.1 | NetSynth v1.2 |
 ```toml
 # Override built-in protocol sounds
 [classes.HTTPS]
 frequency = 220.0
 waveform  = "square"   # sine | square | sawtooth | triangle
 [classes.DNS]
 frequency = 90.0
 # Add custom classification rules (prepended before built-in rules, first-match-wins)
 [[rules]]
 name     = "Internal API"
 protocol = "tcp"
 port     = 8443
 frequency = 300.0
 waveform  = "sawtooth"
 [[rules]]
 name     = "Game Traffic"
 protocol = "udp"
 port     = 27015
 frequency = 450.0
 waveform  = "triangle"
 ```
 Key schema design choices:
 - `[classes.X]` uses the same class name strings already used in `--verbose` output and exit summary (`HTTPS`, `DNS`, etc.) — no new naming system to learn.
 - `[[rules]]` is a TOML array of tables, consistent with how goreleaser and other tools express lists of items.
 - `protocol` and `port` map directly to the existing `classify.Rule` fields, minimizing translation.
 - Waveform is an enum string, not an integer — readable and self-documenting in the config file.
 ---
 ## v1.0 Feature Landscape (Retained from Original Research)
 ### Table Stakes (v1.0)
 | Feature | Why Expected | Complexity | Notes |
 |---------|--------------|------------|-------|
 | Network interface selection (`-i eth0`) | tcpdump/tshark convention | LOW | Implemented: v1.0 |
 | Output file path flag (`-o output.mp3`) | Any file-producing CLI | LOW | Implemented: v1.0 |
 | Graceful Ctrl+C with file save | Users expect clean finalize | MEDIUM | Implemented: v1.0 |
 | Per-protocol sound distinction | Core value prop | MEDIUM | Implemented: v1.0, 12 rules |
 | Packet count / traffic summary on exit | Every capture tool does this | LOW | Implemented: v1.0 |
 | Privilege error message | Silent pcap failure is confusing | LOW | Implemented: v1.0 |
 | List available interfaces (`--list-interfaces`) | Users don't know interface names | LOW | Implemented: v1.0 |
 | Minimum viable duration guard | Zero-packet = no corrupt MP3 | LOW | Implemented: v1.0 |
 ### Differentiators (v1.0)
 | Feature | Value Proposition | Complexity | Status |
 |---------|-------------------|------------|--------|
 | Auto-clustering of unrecognized traffic | Honest audio fingerprint | HIGH | Implemented: hash-bucket, 4 classes |
 | Ambient/drone style (layered sine harmonics) | Distinct from event-ping tools | HIGH | Implemented: v1.0 |
 | Time-windowed amplitude evolution | Mix evolves dynamically | MEDIUM | Implemented: 500ms windows + EMA |
 | BPF capture filter (`--filter`) | Power users scope what's sonified | MEDIUM | Implemented: v1.0 |
 | Offline pcap file input (`--read`) | Sonify historical captures | MEDIUM | Implemented: v1.0 |
 | Verbose protocol activity log (`--verbose`) | Developers see classifications | LOW | Implemented: v1.0 |
 ### Anti-Features (v1.0)
 | Feature | Why Avoided |
 |---------|-------------|
 | Real-time audio playback | Platform audio API complexity; file output is correct |
 | GUI or web dashboard | Negates single-binary CLI value |
 | Custom sound mapping (v1.0) | Deferred to v1.1 — now the current milestone |
 | Rhythmic/percussive output | Ambient/drone is the deliberate differentiator |
 | Deep-packet inspection | Massive complexity; header classification sufficient |
 | Streaming MP3 output | MP3 finalization requires full buffer |
 | Anomaly detection / alerting | Different user job |
 ---
 ## Competitor Feature Analysis
 | Feature | SoNSTAR (Python) | Network-Sonification (C# GUI) | Peep (C, Unix) | NetSynth v1.0 | NetSynth v1.1 |
 |---------|-----------------|-------------------------------|----------------|----------------|----------------|
-| Custom sound config | No | No | Config file (fixed format) | No | Yes (TOML) |
+| Protocol count | ~8 (TCP flow types) | ~10 | ~6 | 10 known + 4 unknown | ~32 known + 4 unknown |
-| Config file discovery | n/a | n/a | Hardcoded path | n/a | XDG + working dir |
+| Family grouping | No | No | No | No | Yes (7 families) |
-| Partial override semantics | n/a | n/a | Full replacement | n/a | Partial override |
+| Tonal family identity | No | No | No | No | Yes (freq proximity + shared waveform) |
-| Waveform selection | Recorded samples | sine/square/triangle | Fixed | sine only | sine/square/sawtooth/triangle |
+| Database protocols | No | No | No | No | Yes (MySQL, PostgreSQL, Redis, MongoDB) |
-| Custom classification rules | No | No | No | No | Yes (user-defined port/proto rules) |
+| Mail family (IMAP/POP3) | No | No | No | SMTP only | Yes (SMTP + IMAP + POP3) |
-| Named custom classes | n/a | n/a | n/a | n/a | Yes (appears in summary output) |
+| Enterprise protocols (RDP, LDAP, Kerberos, SMB) | No | No | No | No | Yes |
 | Infrastructure expansion (mDNS, SNMP, Syslog) | No | No | No | No | Yes |
 ---
 ## Sources
- [XDG Base Directory Specification](https://specifications.freedesktop.org/basedir/latest/) — standard for `~/.config` discovery path
+- [IANA Service Name and Transport Protocol Port Number Registry](https://www.iana.org/assignments/service-names-port-numbers) — authoritative port assignments
- [adrg/xdg — Go XDG implementation](https://github.com/adrg/xdg) — if explicit XDG library is needed (probably not for NetSynth's 2-path lookup)
+- [List of TCP and UDP port numbers — Wikipedia](https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers) — comprehensive reference for well-known ports
- [pelletier/go-toml v2 — strict mode and DecodeError](https://pkg.go.dev/github.com/pelletier/go-toml/v2) — recommended TOML library; DisallowUnknownFields() and human-readable errors
+- [Common Ports Cheat Sheet — StationX](https://www.stationx.net/common-ports-cheat-sheet/) — grouped protocol reference used for family taxonomy
- [BurntSushi/toml — Undecoded() for unknown key detection](https://github.com/BurntSushi/toml) — alternative; simpler API but less actively maintained
+- [nDPI Protocols List — ntop](https://www.ntop.org/guides/nDPI/protocols.html) — nDPI's 450+ protocol list and 17-category taxonomy; source for family grouping inspiration
- [Building CLI Applications with Go: Cobra and Viper Guide (2026)](https://dasroot.net/posts/2026/03/building-cli-applications-go-cobra-viper/) — config loading patterns in Cobra CLI tools
+- [nDPI 5.0: Enhanced Traffic Fingerprinting — ntop blog](https://www.ntop.org/ndpi-5-0-enhanced-traffic-fingerprinting-and-fpc-many-new-protocols/) — confirms category-based grouping as the production approach for managing large protocol sets
- [A Guide to TOML in Golang — kelche.co](https://www.kelche.co/blog/go/toml/) — go-toml v2 vs BurntSushi comparison and practical examples
+- [SoNSTAR: Sonification of Network Traffic — Paul Vickers](https://paulvickers.github.io/SoNSTAR/) — academic network sonification tool; uses TCP/IP flow features rather than protocol families
- [Configuration | mise-en-place](https://mise.jdx.dev/configuration.html) — example of working-dir + XDG config discovery
+- [Sonification of network traffic flow for monitoring and situational awareness — PLoS One 2018](https://journals.plos.org/plosone/article?id=10.1371/journal.pone.0195948) — research literature on what protocol-level groupings are perceptually useful in sonification
- [golangci-lint configuration](https://golangci-lint.run/docs/configuration/cli/) — real-world example of partial override config in a Go CLI tool
+- [pkg.go.dev/github.com/gopacket/gopacket/layers](https://pkg.go.dev/github.com/gopacket/gopacket/layers) — confirmed that gopacket natively decodes DNS, DHCP, NTP, ICMP, OSPF, BGP, but NOT SMTP, IMAP, FTP, SMB, MySQL, Redis, SIP, RTP, LDAP at the application layer; port-based classification is the correct approach for v1.2
- [Online Tone Generator — waveform types](https://onlinetonegenerator.com/) — confirms sine/square/sawtooth/triangle as the standard 4 waveform set
+- [Realtime High-Speed Network Traffic Monitoring Using ntopng — LISA 2014](https://luca.ntop.org/Lisa2014.pdf) — confirms category-based protocol grouping as standard in production monitoring tools
 - Internal codebase review: `/home/dev/workspace/yoloyolo/classify/rules.go`, `types.go`, `synth/config.go` — confirmed existing 10 known classes, Rule struct pattern, FreqConfig pattern, NumLayers=14 constant, and auto-assign frequency range (1200-2350 Hz)
 ---
 *v1.0 research: 2026-03-24*
 *v1.1 custom sound mappings research: 2026-03-26*
 *v1.2 extended protocol coverage research: 2026-03-27*
@@ -1,511 +1,553 @@
-# Pitfalls Research
+# Domain Pitfalls
-**Domain:** Network-traffic-to-audio synthesis CLI tool (Go)
+**Domain:** NetSynth — Network traffic sonification CLI tool (Go)
-**Researched:** 2026-03-26 (v1.1 update — TOML config, waveform types, user-defined rules)
+**Researched:** 2026-03-26 (v1.1 original); 2026-03-27 (v1.2 update — extended protocol coverage, grouped sound families)
-**Confidence:** HIGH (TOML decoder behaviors verified against pkg.go.dev official docs and issue trackers; audio synthesis aliasing verified against DSP literature; config merging verified against BurntSushi/toml issue #47 and go-toml issue #252)
+**Confidence:** HIGH (all pitfalls grounded in direct codebase inspection; audio masking values from Glasberg & Moore 1990 ERB model; TOML behaviors from BurntSushi docs and issue history; Go performance from first-principles analysis of existing code)
 ---
-## v1.1 Milestone Pitfalls (New)
+## v1.2 Milestone Pitfalls (New)
-These pitfalls are specific to adding TOML config, waveform types, and user-defined classification rules to the existing NetSynth codebase.
+These pitfalls are specific to adding expanded protocol classification with grouped sound families to the existing NetSynth v1.1 codebase. They are ordered by severity: critical pitfalls cause incorrect output or broken configs without obvious errors; moderate pitfalls degrade audio quality or developer experience; minor pitfalls are friction points with clear workarounds.
 ---
-### Pitfall A1: TOML Unmarshal Silently Overwrites Pre-filled Defaults with Zero Values
+## Critical Pitfalls
 ### Pitfall C1: Frequency Rebalancing Silently Invalidates User v1.1 Configs
 **What goes wrong:**
-You initialize a `Config` struct with built-in defaults, then call `toml.Unmarshal` to layer in user overrides. Any field the user *omits* from their TOML file is set to its Go zero value (`0`, `""`, `false`, `nil`) by the decoder — overwriting your defaults. A user who writes only `[sounds.DNS]` in their config file to change the DNS tone ends up wiping every other class back to zero Hz.
+Users who created a `netsynth.toml` under v1.1 specified absolute Hz values for built-in classes — for example `[sounds.HTTPS] frequency = 175.0`. If v1.2 rebalances that class to a new default (say 340 Hz to make room for new protocols), the user's config now overrides the new default back to the old v1.1 value (175 Hz). The user gets a v1.1 sound for HTTPS even after upgrading, with no warning that their override value has become stale relative to the rebalanced layout.
 The reverse is also possible: a user who did NOT set a frequency override had HTTPS at 175 Hz; after rebalancing it moves silently to a different Hz value. Their soundscape has changed without explanation.
 **Why it happens:**
-Both `BurntSushi/toml` and `pelletier/go-toml` v1 do not distinguish between "key was absent" and "key was explicitly set to zero". The decoder reflects over the struct and writes zero for every absent key. This was explicitly reported as a bug in BurntSushi/toml issue #47 and go-toml issue #252. go-toml v2 partially addresses it but still zeros primitive-type fields that are absent.
+The `merge()` function in `config/config.go` applies any `[sounds.X] frequency = Y` from the user's TOML unconditionally. There is no concept of "this override is relative to a previous default" — it is applied as a fixed Hz value. Changing the default in `ClassFreqConfigs` does not trigger any validation that existing user overrides remain intentional.
 **Consequences:**
- All non-overridden traffic classes play silence (0 Hz oscillator)
+- v1.1 user configs produce different-than-expected audio on v1.2 without any error or warning
- Classification rules get zeroed if user only partially fills `[[rules]]`
+- Users with explicit overrides are stuck at v1.1 frequency values — the rebalancing has zero effect for them
- EMA tau, whisper floor, gain, and other synth parameters reset to 0
+- Users without overrides hear an unexplained soundscape change after upgrade
 **Prevention:**
-Use pointer fields (`*float64`, `*string`) in the decoded struct to distinguish "not provided" (nil pointer) from "explicitly set to zero" (non-nil pointer to 0). Apply a merge step: iterate over the decoded struct, and for each pointer field that is nil, keep the built-in default. For slice fields (like `[]RuleConfig`), nil slice means "user did not provide rules" — preserve defaults; non-nil empty slice (`[]RuleConfig{}`) means "user explicitly cleared rules" — respect that.
+Two complementary strategies:
-```go
+1. **Minimize rebalancing scope.** Assign new protocol classes to frequency ranges not yet occupied by v1.1 built-ins. The current v1.1 built-in range is 65–780 Hz (known protocols) and 862–1047 Hz (unknown buckets), with a gap at 781–861 Hz. New families can be allocated into ranges above 1100 Hz (e.g., 1100–4000 Hz), leaving all existing Hz assignments untouched. This eliminates the backward-compatibility problem entirely for users who have not overridden values in that range.
 // In config struct, use pointers for optional overrides:
 type SoundConfig struct {
    FreqHz   *float64 `toml:"freq_hz"`
    Waveform *string  `toml:"waveform"`
 }
-// Merge: for each class, override only non-nil fields
+2. **Changelog + --print-config.** If rebalancing IS required, document every changed Hz value in the release notes and update `--print-config` so users can diff their effective config against what they saved. Add a comment to `--print-config` output when a user override matches a value that was the v1.1 default (warn that it may be stale).
 func mergeSound(base synth.FreqConfig, override SoundConfig) synth.FreqConfig {
    if override.FreqHz != nil {
        base.BaseHz = *override.FreqHz
    }
    if override.Waveform != nil {
        base.WaveformType = *override.Waveform
    }
    return base
 }
 ```
 **Detection:**
- User reports that classes they did not configure now produce no sound
+- User reports HTTPS sounds wrong after upgrade
- Unit test: load a config that overrides only one class; verify all other classes retain built-in Hz values
+- `--print-config` shows `(override)` for a class the user never intentionally customized — they set it once to the default value and now that exact value is stale
 **Phase to address:**
-Config loading phase (first phase of v1.1). Get the pointer-and-merge pattern established before wiring config into the bank. Retrofitting after the bank construction is wired is a significant churn.
+Frequency allocation design phase (first phase of v1.2). The spectrum layout must be finalized before writing any `ClassFreqConfigs` entries. Treat the 65–1047 Hz range as frozen for backward compatibility.
 ---
-### Pitfall A2: BurntSushi/toml Silently Ignores Typos in Field Names
+### Pitfall C2: `autoAssignFreq` Range Collision With New Built-in Frequencies
 **What goes wrong:**
-A user writes `freq_hz = 440` but the struct tag is `toml:"freq_hz"` — this works. However if the user writes `freqhz = 440` or `FreqHz = 440` or a misspelled `frek_hz = 440`, the library silently ignores the key. The user's override is never applied. No error is returned. The user thinks their config is active; it is not.
+`autoAssignFreq()` in `config/config.go` assigns custom user classes to frequencies in `[1200, 2350]` Hz using 24 steps of 50 Hz each. If new v1.2 built-in protocol classes are assigned frequencies in this same range (e.g., placing SIP at 1500 Hz or IMAP at 1200 Hz), a user's custom class may hash to the same frequency as a new built-in. The user's custom class and the new built-in will produce the same tone — the soundscape loses discriminability, and the user has no way to know their custom class has collided.
 **Why it happens:**
-`BurntSushi/toml` by default silently discards keys that do not map to any struct field. This is the documented default behavior ("will ignore options in the TOML file that you don't use"). It is the opposite of "strict mode."
+The `[1200, 2350]` range was deliberately chosen in v1.1 as "unused 1200-2350 Hz range" (per the STACK.md annotation). If v1.2 extends built-ins into that range without also updating `autoAssignFreq`, the guarantee is broken.
 **Consequences:**
- Silent misconfiguration: user's customization is invisible
+- Silent frequency collision: two classes (one built-in, one user-defined) play the same tone
- Debugging is very hard — no error to trace back to the TOML file
+- User's custom classification is perceptually indistinguishable from the colliding built-in
 - `--print-config` will show different Hz values in the TOML text, but the audio output is identical
 **Prevention:**
-Use `toml.Decode` (not `toml.Unmarshal`) to obtain `MetaData`, then call `md.Undecoded()` and return an error listing any keys that were not decoded. This is BurntSushi's documented strict-mode pattern.
+Update `autoAssignFreq` in `config/config.go` whenever new built-in frequency ranges are allocated. Specifically:
 - After finalizing all v1.2 `ClassFreqConfigs` frequencies, compute the highest built-in Hz value
 - Set `autoAssignFreq` base above that value, e.g., `baseHz = 4500.0` with a range that is guaranteed to be clear of all built-ins
 - Add a compile-time assertion (test) that verifies no `ClassFreqConfigs` entry falls inside the auto-assign range
 ```go
-md, err := toml.Decode(string(data), &cfg)
+// In synth/config_test.go:
-if err != nil {
+func TestAutoAssignRangeIsEmpty(t *testing.T) {
-    return err
+    const autoBase = 4500.0
-}
+    const autoTop  = 6000.0
-if keys := md.Undecoded(); len(keys) > 0 {
+    for class, cfg := range ClassFreqConfigs {
-    return fmt.Errorf("unknown config keys (check for typos): %v", keys)
+        if cfg.BaseHz >= autoBase && cfg.BaseHz <= autoTop {
-}
+            t.Errorf("built-in class %q frequency %.1f Hz falls in auto-assign range [%.0f, %.0f]",
-```
+                class, cfg.BaseHz, autoBase, autoTop)
 **Detection:**
 - Config change that should audibly alter the sound has no effect
 - Undecoded keys present but no warning/error logged
 **Phase to address:**
 Config loading phase. Implement strict decoding from the first config load function. Do not add this as an afterthought — it is the primary mechanism protecting users from silent misconfiguration.
 ---
 ### Pitfall A3: Naive Square/Sawtooth/Triangle Generation Produces Audible Aliasing Distortion
 **What goes wrong:**
 Implementing waveforms by direct time-domain math — `sign(sin(phase))` for square, `2*frac(phase)-1` for sawtooth, `1-2*abs(frac(phase)-0.5)` for triangle — produces a waveform with infinite harmonics. At 44100 Hz, harmonics above 22050 Hz fold back into the audible range as aliasing. At the frequencies used in NetSynth (65–1047 Hz), aliasing from a naive square wave produces a buzzing distortion that is especially audible at higher drone frequencies and sounds like corruption rather than timbre.
 **Why it happens:**
 The mathematical waveforms are not bandlimited — they have infinite harmonic content. Direct sampling them at 44100 Hz aliases all energy above Nyquist back into the audible band. Developers who test at low frequencies (60–120 Hz) may not notice because the aliased harmonics land at very high frequencies with low perceptual impact; the problem worsens significantly above 400 Hz where aliases fold into the 1–5 kHz perceptually prominent range.
 **Consequences:**
 - Square/sawtooth at SSH (330 Hz) and higher frequencies sounds harsh and buzzy
 - The effect worsens at higher frequencies, making SMTP (440 Hz) and DHCP (600 Hz) drones sound distorted
 - Aliasing cannot be filtered out post-synthesis (it is interleaved with desired signal)
 **Prevention:**
 Use additive synthesis — the approach already in use for sine waves in `oscillator.go`. The existing `Oscillator.Advance(harmonics []HarmonicDef)` computes `sin(2π * phase * ratio)` for each partial. Square, sawtooth, and triangle waveforms are all expressible as harmonic series:
 - **Square:** odd harmonics only, amplitude `1/k` for harmonic `k`: ratios 1, 3, 5, 7, ... with amplitudes 1.0, 0.33, 0.20, 0.14, ... Truncate at Nyquist.
 - **Sawtooth:** all harmonics, amplitude `1/k`: ratios 1, 2, 3, 4, ... with amplitudes 1.0, 0.5, 0.33, 0.25, ... Truncate at Nyquist.
 - **Triangle:** odd harmonics, amplitude `1/k²`, alternating sign: ratios 1, 3, 5, ... with amplitudes 1.0, 0.11, 0.04, ... Truncate at Nyquist.
 The truncation (only sum harmonics where `freq * ratio < sampleRate / 2`) is the critical step that makes the synthesis bandlimited. The existing `[]HarmonicDef` structure in `synth/config.go` already supports this — waveform type selection just requires generating the right harmonic series for each `FreqConfig`.
 Waveform presets should be pre-computed `[]HarmonicDef` slices, not runtime computation of naive waveform math:
 ```go
 // BandlimitedHarmonics returns a bandlimited harmonic series for the given waveform type.
 // It truncates harmonics at Nyquist (sampleRate/2) to prevent aliasing.
 func BandlimitedHarmonics(waveform string, baseHz float64, sampleRate int) []HarmonicDef {
    nyquist := float64(sampleRate) / 2.0
    var defs []HarmonicDef
    switch waveform {
    case "square":
        for k := 1; float64(k)*baseHz < nyquist; k += 2 { // odd only
            defs = append(defs, HarmonicDef{Ratio: k, Amplitude: 1.0 / float64(k)})
        }
-    case "sawtooth":
+    }
-        for k := 1; float64(k)*baseHz < nyquist; k++ {
+}
-            defs = append(defs, HarmonicDef{Ratio: k, Amplitude: 1.0 / float64(k)})
+```
 **Detection:**
 - Two classes with different names produce identical tones
 - `--print-config` shows correct but coincidentally matching Hz values for a user class and a built-in
 **Phase to address:**
 Frequency allocation design phase. After all new built-in Hz values are set, update `autoAssignFreq` constants and add the compile-time range check before merging.
 ---
 ### Pitfall C3: Hardcoded `NumLayers = 14` Constant Becomes a Lie — But `GainPerLayer` Stays Wrong
 **What goes wrong:**
 `synth/config.go` defines:
 ```go
 NumLayers    = 14
 GainPerLayer = 1.0 / float64(NumLayers)  // 0.0714
 ```
 The current `bank.go` correctly uses `1.0 / float64(len(cfgs))` at bank construction time, so the bank itself handles more layers correctly. However, `GainPerLayer` is still exported as a package-level constant. If any code outside `bank.go` references `synth.GainPerLayer` for gain calculations (including tests, the encode pipeline, or future code added in v1.2), it will use the stale `0.0714` value even when 25+ layers are active. The bank sounds louder than expected at low class counts, or softer at high class counts, depending on which reference is used.
 Additionally, `TestNumLayersMatchesAllClasses` in `synth/config_test.go` checks:
 ```go
 if len(synth.ClassFreqConfigs) != len(classify.AllClasses())
 ```
 This test enforces that `ClassFreqConfigs` and `AllClasses()` stay in sync. Adding new classes to one without the other causes this test to fail — which is the right behavior, but the fix is non-obvious: you must update both `ClassFreqConfigs` (with a new `FreqConfig` entry) AND `AllClasses()` (by appending to the return value). Miss either and the test blocks the build.
 **Why it happens:**
 `NumLayers` was introduced in v1.0 when the layer count was static. It was not removed when `NewBank` was refactored to use `len(cfgs)` dynamically. The constant is now a documentation artifact that can mislead future code.
 **Consequences:**
 - Any code added in v1.2 that references `synth.GainPerLayer` uses an incorrect value
 - Possible audio clipping (if gain is too high) or inaudibly quiet output (if computed with wrong layer count)
 - `TestNumLayersMatchesAllClasses` fails if `AllClasses()` and `ClassFreqConfigs` are updated independently
 **Prevention:**
 At the start of v1.2 protocol rule addition:
 1. Remove `NumLayers` and `GainPerLayer` constants from `synth/config.go` (or mark them deprecated with a clear comment)
 2. Rename `TestNumLayersMatchesAllClasses` to `TestClassFreqConfigsMatchesAllClasses` and update its comment to explain the invariant
 3. When adding each new protocol class: update `AllClasses()` and `ClassFreqConfigs` atomically in the same commit — the test will catch any missed entry
 **Detection:**
 - `TestNumLayersMatchesAllClasses` fails after adding new classes to only one of the two locations
 - Audio output is unexpectedly loud or quiet compared to previous version
 **Phase to address:**
 First code phase of v1.2, before adding any new protocol classes. Removing the stale constant and renaming the test is a two-minute cleanup that prevents confusion throughout the milestone.
 ---
 ### Pitfall C4: `TestFrequenciesInRange` Hardcodes `[60, 1100]` — Will Fail for New High-Frequency Classes
 **What goes wrong:**
 `synth/config_test.go` contains:
 ```go
 func TestFrequenciesInRange(t *testing.T) {
    for class, cfg := range synth.ClassFreqConfigs {
        if cfg.BaseHz < 60 || cfg.BaseHz > 1100 {
            t.Errorf("class %q BaseHz=%.1f is out of range [60, 1100]", class, cfg.BaseHz)
        }
-    case "triangle":
+    }
-        sign := 1.0
+}
-        for k := 1; float64(k)*baseHz < nyquist; k += 2 {
+```
-            defs = append(defs, HarmonicDef{Ratio: k, Amplitude: sign / float64(k*k)})
+
-            sign = -sign
+If any new v1.2 protocol class is assigned a frequency above 1100 Hz (which is necessary if new families extend into the 1100–4000 Hz range), this test fails immediately. The test was written for v1.0's 14-class spectrum. It will now become a false blocker, making every correct new assignment fail CI.
 **Why it happens:**
 Range-assertion tests like this encode a snapshot of the system state at the time they were written. They do not automatically update when the valid range evolves.
 **Consequences:**
 - CI red on every correct new class addition until the test is updated
 - Developer wastes time diagnosing a failing test that is wrong, not the code
 - Risk: developer deletes the test entirely rather than updating it, losing the coverage
 **Prevention:**
 Update the test when the frequency allocation design is finalized. The new range should accommodate whatever spectrum is decided, e.g.:
 ```go
 func TestFrequenciesInRange(t *testing.T) {
    for class, cfg := range synth.ClassFreqConfigs {
        if cfg.BaseHz < 60 || cfg.BaseHz > 4000 {
            t.Errorf("class %q BaseHz=%.1f is out of range [60, 4000]", class, cfg.BaseHz)
        }
    default: // "sine"
        defs = []HarmonicDef{{Ratio: 1, Amplitude: 1.0}}
    }
    return defs
 }
 ```
 Alternatively, replace the range test with a `TestFrequenciesUnique` variant that only checks for collisions (already present), which remains valid regardless of range expansion. The range test can instead verify family-level groupings: all Mail family classes are in [X, Y] Hz range, all VoIP classes in [A, B] Hz range.
 **Detection:**
- Audible buzzing or grainy texture on drone layers above 300 Hz with non-sine waveforms
+- CI fails on `TestFrequenciesInRange` after adding first new class above 1100 Hz
- Square/sawtooth waveforms sound harsher than expected at high frequencies
+- The test name suggests a range violation but the code is correct
 **Phase to address:**
-Waveform type implementation phase. The design decision (additive synthesis, not direct waveform math) must be made before coding waveform support. Switching from direct math to additive after the fact requires rewriting the oscillator API.
+Immediately when frequency allocation is decided — before adding any `ClassFreqConfigs` entries outside [60, 1100].
 ---
-### Pitfall A4: Waveform String Validation Fails Silently, Falls Back to Silence
+### Pitfall C5: `[families]` TOML Block Rejected by Strict Unknown-Key Validation
 **What goes wrong:**
-A user writes `waveform = "Sawtooth"` (capital S) or `waveform = "saw"` (abbreviation). The config loading code does a simple equality check (`if waveform == "sawtooth"`), finds no match, and either panics, silently emits silence, or applies a default without telling the user. In all cases the user's intent is invisible.
+If v1.2 adds a `[families]` section (or any new top-level TOML key) to the config schema to support per-family sound configuration, a user who adds this to their TOML file will get an error when running an unpatched v1.1 binary:
 ```
 config: unknown key "families" — check spelling
 ```
 The `parseFile()` function uses `md.Undecoded()` as strict mode, which rejects any key not in `rawConfig`. The `rawConfig` struct only knows about `sounds` and `rules`. Adding `families` to the user's TOML will break the tool for anyone running the v1.1 binary — even if they do not care about family features yet.
 **Why it happens:**
-String-based enumerations in config files have no compile-time type checking. Case sensitivity and abbreviations are user expectations that must be explicitly handled.
+This is the correct and intended behavior of `md.Undecoded()` (introduced specifically to prevent silent misconfiguration). But it means the config schema is strictly versioned: any new field must be added to `rawConfig` before any user can write it to their TOML.
 **Consequences:**
- Silent misconfiguration: wrong waveform with no feedback
+- User adds `[families]` to their config, upgrades their TOML, then tries to run v1.1 binary (e.g., from a build that hasn't shipped yet) — immediate error
- Hard to debug: config appears valid, sound is just wrong
+- More critically: if v1.2 adds `[families]` to `rawConfig` but the user's v1.1 config does not have `[families]` at all — this direction is fine, since absent keys are not reported by `Undecoded()`
 **Prevention:**
-Normalize waveform strings at parse time (`strings.ToLower`, `strings.TrimSpace`), validate against the accepted set, and return an explicit error with the accepted values if the string is unrecognized:
+The direction of concern is: user writes v1.2 TOML, runs v1.1 binary. Since this project does not provide v1.1 binary distribution to end users (it's a CLI built from source), this pitfall is primarily about development workflow and test fixtures:
 1. Update `rawConfig` struct to include `families` (or whatever the new group config key is named) before any tests or documentation reference the new config format
 2. Any test fixture `.toml` files should use the schema matching the current binary's `rawConfig` struct
 3. For documentation examples: do not publish TOML samples containing `[families]` until the code that handles it is shipped
 The v1.1 → v1.2 migration path for the config struct should be:
 - `rawConfig` adds `Groups map[string]GroupOverride` (or similar) — unknown key validation now accepts it
 - If absent in user's TOML (the common case): `raw.Groups` is nil — safe, no behavior change
 - If present: processed in the new merge step
 **Detection:**
 - Test fixture containing new config key causes `config: unknown key` error in a test that still uses old `rawConfig`
 - `--print-config` output contains new group annotations but user running v1.1 binary sees error
 **Phase to address:**
 Config schema extension phase. Update `rawConfig` and `PrintConfig` before any code that generates or consumes the new TOML format.
 ---
 ## Moderate Pitfalls
 ### Pitfall C6: Within-Family Detuning Causes Critical Band Masking at High Frequencies
 **What goes wrong:**
 The v1.2 spec calls for "within-group sound design: shared base frequency, different waveforms or slight detuning." If two classes in the same family are assigned frequencies closer than one critical bandwidth, the human auditory system treats them as a single tone rather than two distinct sounds. The "slightly detuned" design goal backfires: instead of sounding like two related-but-distinct protocols, the two tones merge perceptually into one broader tone with beating artifacts.
 Critical bandwidth (ERB) formula: `ERB(f) = 24.7 * (4.37 * f/1000 + 1)` Hz.
 Concrete values for the NetSynth frequency range:
 - At 100 Hz: ~35 Hz critical bandwidth (tones must be >35 Hz apart)
 - At 500 Hz: ~48 Hz critical bandwidth (tones must be >48 Hz apart)
 - At 1000 Hz: ~72 Hz critical bandwidth (tones must be >72 Hz apart)
 - At 2000 Hz: ~117 Hz critical bandwidth (tones must be >117 Hz apart)
 The v1.1 `autoAssignFreq` used 50 Hz steps in the 1200–2350 Hz range. At 1200 Hz, critical bandwidth is ~88 Hz. A 50 Hz step at that frequency is inside the critical band — the two tones will mask each other.
 **Why it happens:**
 Frequency step sizes that feel visually reasonable (e.g., 50 Hz) do not scale with the logarithmic nature of human pitch perception. The critical band narrows in Hz as frequency decreases but the absolute Hz separation needed for perceptual distinctness increases with frequency.
 **Consequences:**
 - Same-family protocols sound identical rather than "related but distinct"
 - Within-family distinguishability — a core design goal — is not achieved even though the Hz values differ
 - The bug is hard to detect: `--print-config` shows different Hz values, but the audio is perceptually undifferentiated
 **Prevention:**
 Use a logarithmic (musical interval) separation for within-family detuning rather than fixed-Hz steps. A minor third (ratio 1.2) or major second (ratio 1.125) provides psychoacoustically safe separation across the full frequency range used by NetSynth:
 - Family base at 800 Hz, member 2 at 800 * 1.125 = 900 Hz (100 Hz gap, safe)
 - Family base at 2000 Hz, member 2 at 2000 * 1.125 = 2250 Hz (250 Hz gap, safe vs 117 Hz critical band)
 Rule of thumb for NetSynth protocol family design: within a family, space members at least 1.25x the critical bandwidth of the lower tone. Using a minor second (semitone, ratio 1.059) as the minimum separation gives ~75 Hz at 1300 Hz — marginal. Use at least a major second (ratio 1.122) for reliable perceptual separation.
 **Detection:**
 - Two protocols in the same family sound identical in listening test
 - The beating artifact (amplitude modulation at the difference frequency) is audible when two closely-spaced tones are both active
 **Phase to address:**
 Frequency allocation and family sound design phase. Compute critical bandwidths for all proposed family member frequencies before finalizing the allocation. A short spreadsheet checking `ERB(f) < |f2 - f1|` for each pair catches this before any code is written.
 ---
 ### Pitfall C7: Adding ~20 Rules to the Rule Slice Does Not Degrade Classification Performance, But Dual-Port Rules Do
 **What goes wrong:**
 The existing `DefaultRules` slice has 12 entries. Adding 20–30 more for protocols like IMAP (143), IMAPS (993), POP3 (110), LDAP (389), RDP (3389), FTP (21), SIP (5060), SNMP (161), etc., increases the linear scan from ~12 comparisons to ~40 comparisons per packet.
 At 44100 Hz / 22050 SamplesPerWindow = 2 windows/sec, and typical home/office network rates of 1000–5000 packets/sec, the classifier is called ~2500 times/sec. Each call does a linear scan over 40 rules. At ~4 ns per comparison (cache-warm slice iteration), 40-rule scan ≈ 160 ns per packet. For 5000 packets/sec, that is 0.8 ms/sec total classifier CPU — negligible.
 The actual risk is not linear scan overhead but **dual-port rule confusion**: many protocols have both a plain and a TLS/secure variant on different ports (HTTP:80 and HTTPS:443, SMTP:25 and SMTPS:587, IMAP:143 and IMAPS:993, POP3:110 and POP3S:995, LDAP:389 and LDAPS:636). If these are naively placed into separate classes with different frequencies, a mail server using SMTPS at 587 will be classified differently from one using SMTP at 25 — even though they are the same protocol family. The frequency space gets overcrowded with variants that sound like separate protocols but represent the same thing.
 **Why it happens:**
 The classification decision "same class vs separate classes" for secure and insecure protocol variants is not obvious. The default instinct is to add more rules = more specificity = better, but perceptually the user wants "I can hear that I have mail traffic" not "I can tell the exact TLS variant."
 **Consequences:**
 - Frequency spectrum crowded with 2x the expected number of mail-related tones
 - Secure and insecure variants of the same protocol family cancel each other's coherence
 - The "family" identity becomes invisible — SMTP and SMTPS sound like different protocols
 **Prevention:**
 Group insecure and secure variants of the same protocol into the same `TrafficClass`:
 - `ClassSMTPFamily` covers ports 25, 465, 587
 - `ClassIMAPFamily` covers ports 143, 993
 - `ClassPOP3Family` covers ports 110, 995
 Add multiple `Rule` entries for the same class (one per port). The classifier already supports this — multiple rules with different ports mapping to the same class are correct. The frequency allocation should then be: one slot per protocol family, not one slot per port.
 ```go
-var validWaveforms = map[string]struct{}{
+// In classify/rules.go:
-    "sine": {}, "square": {}, "sawtooth": {}, "triangle": {},
+{Protocol: "tcp", DstPort: 25,  Class: ClassMailSMTP},
 {Protocol: "tcp", DstPort: 587, Class: ClassMailSMTP},
 {Protocol: "tcp", DstPort: 465, Class: ClassMailSMTP},
 ```
 **Detection:**
 - Frequency assignment table has 30+ entries for ~15 conceptual protocol families
 - Listening test: mail traffic sounds like 3 separate overlapping tones instead of one identifiable mail layer
 **Phase to address:**
 Protocol list design phase (before any rule code). Define the class list (family → single class name → list of ports) before implementing rules. The family grouping decision should drive the `TrafficClass` constant list.
 ---
 ### Pitfall C8: `AllClasses()` and `ClassFreqConfigs` Must Both Be Updated Atomically — Two Callsites, Not One
 **What goes wrong:**
 Adding a new protocol class to NetSynth requires touching three locations:
 1. A new `ClassXxx TrafficClass = "xxx"` constant in `classify/types.go`
 2. A new entry in `classify.AllClasses()` return slice in `classify/types.go`
 3. A new entry in `synth.ClassFreqConfigs` map in `synth/config.go`
 If any one of these is missing:
 - Missing from `AllClasses()`: `--print-config` does not emit it; `config/config.go`'s `PrintConfig` classifies it as "user-defined" rather than "built-in"; `TestNumLayersMatchesAllClasses` fails
 - Missing from `ClassFreqConfigs`: `TestAllClassesHaveConfig` fails; `copyDefaults()` does not include it; user can't override it in TOML
 - Missing constant (using a string literal instead): compiles, but typos create a second unintended class
 When adding 20+ new classes, the three-location update is repeated 20+ times. The likelihood of a missed entry in one location is high.
 **Why it happens:**
 Go does not have enum types that automatically enforce that a new member must be registered in every relevant collection. The `classify.TrafficClass` type is a `string` type alias — adding a constant does not force updates to `AllClasses()` or `ClassFreqConfigs`.
 **Consequences:**
 - Test failure that is diagnostic but potentially confusing ("I added the class, why does the test fail?")
 - Less dangerous but still: `--print-config` shows wrong annotation (user-defined vs built-in) for new classes
 **Prevention:**
 Write a single source-of-truth Go data structure that drives all three, rather than maintaining them independently:
 ```go
 // In classify/types.go: define the authoritative ordered list
 var builtinClassDefs = []struct {
    Class   TrafficClass
    Display string
 }{
    {ClassICMP, "ICMP"},
    // ... all classes ...
    {ClassMailSMTP, "mail-smtp"},
 }
-func validateWaveform(s string) (string, error) {
+
-    normalized := strings.ToLower(strings.TrimSpace(s))
+// AllClasses() derives from this:
-    if _, ok := validWaveforms[normalized]; !ok {
+func AllClasses() []TrafficClass {
-        return "", fmt.Errorf("unknown waveform %q: must be one of sine, square, sawtooth, triangle", s)
+    classes := make([]TrafficClass, len(builtinClassDefs))
    for i, def := range builtinClassDefs {
        classes[i] = def.Class
    }
-    return normalized, nil
+    return classes
 }
 ```
 Then `ClassFreqConfigs` can be validated against `AllClasses()` at test time rather than being separately maintained. Adding a new class means updating only `builtinClassDefs` — the rest is derived.
 Alternatively: add a comment above both `AllClasses()` and `ClassFreqConfigs` stating "KEEP IN SYNC — adding a class requires updating both" and rely on the existing `TestNumLayersMatchesAllClasses` test to catch mismatches.
 **Detection:**
 - `TestNumLayersMatchesAllClasses` fails
 - `TestAllClassesHaveConfig` fails
 **Phase to address:**
-Config validation step (same phase as config loading). Implement all string field validation in a single `validate(cfg Config) error` function called immediately after decoding.
+First code phase of v1.2 protocol additions, before adding any new classes. Decide on the sync strategy and document it clearly so all 20+ additions follow the same pattern.
 ---
-### Pitfall A5: User Rules Appended After Catch-All Rules Are Unreachable
+### Pitfall C9: Port-Range and Multi-Port Rules Require Protocol Rule Schema Extension
 **What goes wrong:**
-The existing `DefaultRules` slice ends with two catch-alls:
+Some protocols use dynamic or high-number ports that cannot be expressed as a single `DstPort uint16` rule. Examples:
 - RTP (VoIP media) uses ephemeral UDP ports in a range (typically 16384–32767 or 49152–65535)
 - mDNS (multicast DNS/discovery) uses UDP port 5353 but also matches on IP multicast addresses
 - NetBIOS uses ports 137, 138, 139 — three separate ports for the same protocol family
-```go
+The current `Rule` struct only supports `{Protocol, DstPort, Class}`. Adding RTP and other range-based protocols cannot be represented without extending the rule schema.
 {Protocol: "tcp", DstPort: 0, Class: ClassOtherTCP},
 {Protocol: "udp", DstPort: 0, Class: ClassOtherUDP},
 ```
 If user-defined rules are simply appended to this slice (`append(DefaultRules, userRules...)`), the catch-alls match first (DstPort=0 matches any port for that protocol), and the user's rules are unreachable. Every custom rule maps to `ClassOtherTCP` or `ClassOtherUDP` instead. The user gets no sound from their custom class.
 **Why it happens:**
-The first-match-wins semantics of `Classifier.Classify()` mean ordering is semantically critical. `DefaultRules` is a named var that exists precisely as an ordered slice — the comment `// Catch-alls (must be last)` documents this constraint. But "must be last in the defaults" does not automatically mean "must be last in the final merged slice." Developers who concatenate slices without thinking about this invariant break the system.
+The v1.0 rule design was sufficient for well-known single-port protocols. Port ranges are a natural extension that was not anticipated. Extending the schema now risks breaking the existing TOML rule syntax (`[[rules]]` blocks) that v1.1 users have written.
 **Consequences:**
- All user-defined rules are silently swallowed by catch-alls
+- RTP, mDNS, and other range-based protocols cannot be classified with the current rule model
- User's custom class never activates
+- Attempting to add them as single-port rules misses the vast majority of their traffic
- No error — the pipeline works, just wrong
+- If the rule struct is extended (e.g., `DstPortMin uint16, DstPortMax uint16`), all existing rule-reading code must be updated, and the TOML format changes
 **Prevention:**
-Always insert user rules *before* catch-all rules. The merge strategy must be: `specificDefaultRules + userRules + catchAllRules`. Implement this with an explicit split in the default rule set:
+Decide explicitly which protocols to include in v1.2 scope. If a protocol requires port-range matching, either:
 1. Exclude it from v1.2 and note it as requiring a rule schema extension in a future milestone
 2. Implement the range extension in the rule struct first — but verify it does not break existing TOML `[[rules]]` parsing (it should not, since adding optional fields to `RawRule` with pointer types is backward-compatible with existing configs that omit those fields)
-```go
+For the v1.2 protocol list, favor protocols with well-known single static ports (IMAP:143, POP3:110, LDAP:389, RDP:3389, etc.) and defer RTP, dynamic SIP media, and NetBIOS-style multi-port protocols to a future "advanced rule types" milestone.
 // In classify/rules.go, split into two exported slices:
 var SpecificRules = []Rule{ /* ICMP through DHCP */ }
 var CatchAllRules = []Rule{
    {Protocol: "tcp", DstPort: 0, Class: ClassOtherTCP},
    {Protocol: "udp", DstPort: 0, Class: ClassOtherUDP},
 }
 // Merge function used by config loading:
 func MergeRules(userRules []Rule) []Rule {
    result := make([]Rule, 0, len(SpecificRules)+len(userRules)+len(CatchAllRules))
    result = append(result, SpecificRules...)
    result = append(result, userRules...)
    result = append(result, CatchAllRules...)
    return result
 }
 ```
 Alternatively, annotate each default rule with a `CatchAll bool` field and sort before use. The split-slice approach is simpler and more explicit.
 **Detection:**
- User-defined rule that should match traffic does not produce its custom sound
+- RTP traffic appears as `ClassOtherUDP` even after adding a rule
- `--verbose` output shows traffic being classified as `OtherTCP`/`OtherUDP` instead of the custom class
+- Attempting to write a TOML rule for RTP using a single port produces incorrect results
 - Test: write a rule for port 8080, send HTTP traffic to port 8080, verify it hits the custom class and not `ClassOtherTCP`
 **Phase to address:**
-User-defined rules phase. The `classify/rules.go` split must be the first code change before any config loading logic references the rule slice.
+Protocol list design phase. Before implementation, filter the candidate protocol list to only those expressible with current `{Protocol, DstPort, Class}` semantics, or decide up front to extend the schema and account for the additional complexity.
 ---
-### Pitfall A6: User-Defined Classes Have No synth.FreqConfig Entry — Bank Panics or Plays Silence
+## Minor Pitfalls
 ### Pitfall C10: `--print-config` Group Annotations Must Not Break Existing TOML Output Parsing
 **What goes wrong:**
-`OscillatorBank.NewBank()` iterates over `classify.AllClasses()` and looks up each class in `ClassFreqConfigs`. A user-defined rule creates a new `TrafficClass` (e.g., `"my-api"`). This class is not in `AllClasses()`, so the bank has no layer for it. The aggregator increments a count for `"my-api"`, `RenderWindow` looks up `b.layers["my-api"]`, gets nil, and either panics (nil pointer dereference on `layer.AdvanceSample()`) or silently contributes nothing to the mix.
+`PrintConfig()` in `config/config.go` emits commented TOML that users may use as a template. If v1.2 changes the output format — for example, adding group header comments like `# === Web Family ===` above related classes — and a user pipes `--print-config` output back to a config file, the comments are harmless. However, if `PrintConfig` emits actual TOML key-value pairs for a `[families]` section that the current `rawConfig` struct cannot parse, loading that output as a config file will fail with `unknown key "families"`.
 **Why it happens:**
 `classify.AllClasses()` is a hardcoded list of the 14 built-in classes. The synth bank is constructed once at startup from this static list. User-defined classes are a runtime extension that the bank knows nothing about.
 **Consequences:**
 - Nil pointer panic in `RenderWindow` if the layer map lookup is not nil-guarded
 - Or silent: user-defined class traffic is captured and aggregated but never rendered to audio
 - In either case the user's primary feature request (custom sounds for custom classes) silently fails
 **Prevention:**
-The bank must be constructed from the *full* set of active classes, including user-defined ones. The construction path should be:
+All new group-related output in `--print-config` must either be:
 1. Comments only (lines starting with `#`) — safe, TOML ignores them
 2. Actual config keys that `rawConfig` can parse — requires adding them to `rawConfig` first
-1. Load config (parse TOML, validate)
+Never emit a `[families]` or `[groups]` TOML block in `--print-config` output before the corresponding struct field exists in `rawConfig`.
 2. Compute effective rule set (built-in + user rules)
 3. Extract the complete set of `TrafficClass` values referenced by all rules
 4. Pass this full class set to `NewBank` (or equivalent) so a layer is created for every reachable class
 5. Wire user-defined class frequencies from config into the bank
-`AllClasses()` in `classify/types.go` should either remain the static built-in list (used for display/iteration of built-ins) or be replaced by a dynamic function that takes the active rule set as input. Do not rely on the hardcoded list in the bank-construction path when user-defined classes are possible.
+**Phase to address:** Config output phase.
 **Detection:**
 - Panic: `runtime error: invalid memory address or nil pointer dereference` in `synth/bank.go:RenderWindow`
 - Or: user-defined class produces no sound, no error
 - Test: create a config with one user rule using a custom class; verify the bank is built with a layer for that class and that layer produces sound
 **Phase to address:**
 User-defined rules phase, specifically the bank initialization step. This is the deepest integration point — it touches the pipeline at capture → classify → aggregate → synthesize.
 ---
-### Pitfall A7: Config Auto-Discovery Follows Wrong Order or Ignores XDG Variables
+### Pitfall C11: New Class Constants Named Inconsistently With Existing Pattern
 **What goes wrong:**
-The spec calls for auto-discovery from `./netsynth.toml` then `~/.config/netsynth/config.toml`. A naive implementation uses `os.UserHomeDir()` to build the fallback path. On systems where `$XDG_CONFIG_HOME` is set to a non-default location (common on NixOS, custom dotfile managers, CI environments), the tool ignores the user's configured config directory and looks in `~/.config` anyway. The user has a config at `$XDG_CONFIG_HOME/netsynth/config.toml` that is never found.
+The existing constants follow `ClassHTTPS`, `ClassSSH`, `ClassNTP` — protocol name in CamelCase. For grouped protocols, if constants are named `ClassMailSMTP`, `ClassMailIMAP`, `ClassMailPOP3`, the "Mail" prefix creates a new naming convention that does not match the flat naming of existing classes. The `TrafficClass` string values (e.g., `"mail-smtp"`, `"mail-imap"`) become the identifiers users reference in TOML — if these are kebab-case with family prefix (e.g., `[sounds.mail-smtp]`), that is a new pattern that does not match existing class names like `[sounds.HTTPS]` (uppercase) or `[sounds.other-TCP]` (mixed case with hyphen).
 Additionally, `os.UserHomeDir()` returns an error if `$HOME` is unset (e.g., inside some Docker containers or cron jobs). If this error is not handled, the path construction silently produces `"/.config/netsynth/config.toml"` (an absolute path starting with `/.config`) rather than failing with a useful message.
 **Why it happens:**
 Go's `os.UserConfigDir()` already implements the XDG lookup (`$XDG_CONFIG_HOME` → `~/.config` on Linux, `~/Library/Application Support` on macOS). Most developers reach for `os.UserHomeDir()` + hardcoded `".config"` string because it is the first function they find in the stdlib.
 **Consequences:**
 - User's config is silently ignored when `$XDG_CONFIG_HOME` is non-default
 - Confusing behavior difference between development machines and CI
 **Prevention:**
-Use `os.UserConfigDir()` (stdlib, Go 1.13+) for the platform-appropriate config directory. This correctly respects `$XDG_CONFIG_HOME` on Linux and `APPDATA` on Windows (if ever relevant). The discovery order should be:
+Decide the naming convention for grouped class string values before adding any constants:
 - Option A: `"smtp"`, `"imap"`, `"pop3"` — flat names, consistent with `"SSH"`, `"DNS"` (but drops family grouping in the config key)
 - Option B: `"mail-smtp"`, `"mail-imap"` — family-prefixed, makes grouping visible in TOML but is a new pattern
-```go
+Existing classes use all-caps for protocols (`"HTTPS"`, `"ICMP"`) and lowercase-hyphenated for non-standard ones (`"other-TCP"`, `"unknown-1"`). New classes should follow the lowercase-hyphenated pattern for multi-word names. Document the convention at the top of `classify/types.go`.
 func configSearchPaths() []string {
    var paths []string
    // 1. Current directory (highest precedence)
    paths = append(paths, "netsynth.toml")
    // 2. XDG/platform config dir
    if cfgDir, err := os.UserConfigDir(); err == nil {
        paths = append(paths, filepath.Join(cfgDir, "netsynth", "config.toml"))
    }
    return paths
 }
 ```
-If `--config` flag is set, use that path exclusively and return a clear error if the file is absent (do not fall through to auto-discovery when explicit path is provided).
+**Phase to address:** Protocol list design phase, before writing constants.
 **Detection:**
 - Config not loaded on systems where `$XDG_CONFIG_HOME=/custom/path`
 - Silent "no config found" behavior when a config clearly exists at the XDG path
 **Phase to address:**
 Config loading phase. Implement the path discovery with `os.UserConfigDir()` from the start. Fix before the feature ships.
 ---
-### Pitfall A8: Explicit --config Flag Does Not Error on Missing File
+### Pitfall C12: Too Many Active Layers Degrades Ambient Distinctness (Perceptual Density Threshold)
 **What goes wrong:**
-When `--config path/to/file.toml` is specified, the user expects an error if the file does not exist. If the config loader falls through to auto-discovery when the explicit path is missing, or silently uses defaults, the user has no way to detect a typo in their `--config` argument. They run a session, get "unexpected" default sounds, and have no indication their config was never loaded.
+v1.1 has 14 layers. v1.2 will add 20–30 more, reaching a total of ~35–44 layers. When all layers are simultaneously active at whisper-floor amplitude, the combined output is 35 × WhisperFloor × gainPerLayer = 35 × 0.03 × (1/35) = 3% of max amplitude — still quiet. The whisper floor plus gain-per-layer math continues to work correctly.
-**Why it happens:**
+The perceptual problem is different: with 35 simultaneous drone layers, the ambient sound loses definition. Below 5–8 simultaneous distinct tones, listeners can track individual threads. Above 10–12, the output becomes a dense textural wash. This is not a technical bug but a UX risk: the "network fingerprint" value proposition weakens because the output sounds less like "I can identify HTTPS vs SSH" and more like "everything is one undifferentiated cloud."
 Auto-discovery logic is convenient to write as "try these paths, use first found." Developers reuse this logic even for the `--config` code path.
 **Prevention:**
-Separate the two code paths:
+Group protocols into families specifically to mitigate this: a family's members should share enough spectral character (same or nearby frequency, similar waveform) that they fuse into a single perceptible "family layer" rather than adding N separate threads. The "distinct family tone" becomes the perceptual unit, not each individual protocol.
 - `--config` specified → `os.Open(flagValue)`, return error immediately if `errors.Is(err, os.ErrNotExist)`
 - No flag → `configSearchPaths()` loop, silently skip missing files, proceed with defaults if none found
-**Detection:**
+Additionally, consider whether `WhisperFloor` should be reduced for high layer counts. At 35 layers, 35 × 0.03 × (1/35) = 0.03 (3% amplitude from whisper alone when all active) — which is fine. The math is self-correcting. The concern is purely perceptual richness, not clipping or silence.
 - `--config missing.toml` runs without error, uses defaults
 - User misses that their config file path has a typo
-**Phase to address:**
+**Phase to address:** Sound design review after all frequencies are assigned. Listening test with a mix of protocols active simultaneously is the definitive check.
 Config loading phase. A one-line `if flagValue != "" { /* require it */ }` branch is sufficient.
 ---
-### Pitfall A9: User Rules That Target the Same Port as Built-in Rules Are Silently Shadowed
+## Phase-Specific Warnings (v1.2)
 **What goes wrong:**
 A user writes a rule for `{Protocol: "tcp", DstPort: 443, Class: "my-api"}` intending to reclassify their internal HTTPS traffic. If built-in `ClassHTTPS` still appears before the user rule in the merged slice, the built-in rule wins every time. The user's intent ("I want my port-443 traffic to sound different") is silently defeated.
 **Why it happens:**
 First-match-wins with `SpecificRules + userRules + CatchAllRules` means built-in specific rules still precede user rules. A user trying to *override* a built-in mapping must replace it, not add after it.
 **Consequences:**
 - User's specific rule is unreachable if a built-in rule covers the same port/protocol
 - No error, no warning
 - Functionally the same as Pitfall A5 but for specific (non-catch-all) built-in rules
 **Prevention:**
 Two viable strategies:
 1. **User rules first:** `userRules + specificDefaultRules + catchAllRules`. User rules always take precedence. Built-ins serve as fallback. This is the simplest design and most aligned with user expectations ("I configure what I care about; defaults handle everything else").
 2. **Conflict detection:** After merging, scan for duplicate `(protocol, dstPort)` pairs and emit a warning: `"User rule for tcp:443 shadows built-in HTTPS rule. Did you mean to replace it?"`.
 Option 1 is recommended for simplicity. Document it clearly: "User-defined rules are evaluated before built-in rules."
 **Detection:**
 - User-defined rule for a built-in port (80, 443, 22, etc.) never activates
 - Verbose output shows built-in class instead of user class for the expected traffic
 **Phase to address:**
 User-defined rules phase, merge strategy design. Address at the same time as Pitfall A5.
 ---
 ### Pitfall A10: New TrafficClass Strings From Config Are Not Validated — Empty String or Whitespace Is a Valid Key
 **What goes wrong:**
 A user writes:
 ```toml
 [[rules]]
 protocol = "tcp"
 dst_port = 9200
 class = ""
 ```
 The string `""` decodes without error. It is a valid Go map key. It gets inserted into the `WindowSnapshot.Counts` map and the aggregator increments `Counts[""]`. The bank has no layer for `""`. The behavior is undefined — silent or panic depending on nil-guard presence.
 Similarly, `class = "  elasticsearch  "` (padded spaces) decodes to a string with leading/trailing whitespace that does not match any configured sound entry (because the config sound entry key is `"elasticsearch"` without spaces).
 **Prevention:**
 Validate all `Class` string values from user rules in the `validate()` step:
 ```go
 if strings.TrimSpace(rule.Class) == "" {
    return fmt.Errorf("rule %d: class name must not be empty", i)
 }
 rule.Class = strings.TrimSpace(rule.Class)
 ```
 Also validate that class names do not collide with reserved built-in class names (`"ICMP"`, `"DNS"`, etc.) unless the user is explicitly overriding a built-in sound (which is a distinct feature — it should be opt-in, not accidental).
 **Phase to address:**
 Config validation step.
 ---
 ## v1.0 Pitfalls (Retained for Reference)
 The following pitfalls from the initial MVP research remain valid. They are retained in condensed form for reference.
 ---
 ### Pitfall B1: Using `google/gopacket` Instead of the Active Community Fork
 **What goes wrong:** Import of the unmaintained original — 270 open issues, Go compat degrades.
 **Prevention:** Import `github.com/gopacket/gopacket` (v1.5.0, requires Go 1.24+).
 **Phase:** Phase 1 — set correct import path from day one.
 ---
 ### Pitfall B2: CGo Destroys the "Single Binary" Promise
 **What goes wrong:** `gopacket/pcap` (CGo + libpcap) produces a dynamically-linked binary that fails on machines without `libpcap.so`.
 **Prevention:** Use `packetcap/go-pcap` (pure Go capture, already the chosen stack). Verify with `ldd ./netsynth`.
 **Phase:** Phase 1 — foundational architecture decision.
 ---
 ### Pitfall B3: `CAP_NET_RAW` + Binary Location = Silent Failure on Linux
 **What goes wrong:** `setcap` is silently ignored on `nosuid` filesystems. Binary appears broken from home directories.
 **Prevention:** Install to `/usr/local/bin`; document two run modes; emit clear privilege error.
 **Phase:** Phase 1 + CLI UX.
 ---
 ### Pitfall B4: Packet Buffer Overflow Under Moderate Traffic Load
 **What goes wrong:** Default capture buffer fills faster than the classifier consumes it; silent packet drops misrepresent traffic.
 **Prevention:** Large capture buffer (32 MB); buffered channel between capture and classify goroutines.
 **Phase:** Phase 1/2 (capture pipeline architecture).
 ---
 ### Pitfall B5: ZeroCopy Packet Data Use-After-Free
 **What goes wrong:** `ZeroCopyReadPacketData()` invalidates previous slice on each call; silent data corruption in concurrent code.
 **Prevention:** Use `ReadPacketData()` (copying API) unless profiling proves allocation bottleneck.
 **Phase:** Phase 1 (capture/decode).
 ---
 ### Pitfall B6: MP3 Output Is Corrupt Due to LAME Initialization Order
 **What goes wrong:** Skipping `InitParams()` or setting parameters out of order produces unplayable MP3.
 **Prevention:** Always call `InitParams()` before writing frames; smoke test with `ffprobe`.
 **Phase:** Audio synthesis / encoding phase.
 ---
 ### Pitfall B7: PCM Sample Overflow Produces Wrap-Around Distortion
 **What goes wrong:** Summing `int16` layers overflows and wraps (32767 + 100 = -32667), producing buzzing distortion.
 **Prevention:** Synthesize in `float64 [-1.0, 1.0]`; clamp before int16 cast. Already implemented in `synth/mixer.go`.
 **Phase:** Audio synthesis (already addressed in v1.0).
 ---
 ### Pitfall B8: Tone-per-Protocol Mapping Produces Perceptual Chaos
 **What goes wrong:** Frequencies too close together mask each other; output is undifferentiated buzz.
 **Prevention:** Space protocols across register bands; use harmonic/musical intervals. Already addressed in v1.0.
 **Phase:** Audio mapping (already addressed in v1.0).
 ---
 ## v1.1 Phase-Specific Warnings
 | Phase Topic | Likely Pitfall | Mitigation |
 |-------------|---------------|------------|
-| TOML struct design | A1: zero-value overwrites defaults | Use pointer fields for all optional overrides |
+| Frequency spectrum design | C1: existing Hz overrides become stale | Allocate new classes above 1100 Hz; leave v1.1 range frozen |
-| Config strict decode | A2: typos silently ignored | Use `md.Undecoded()` as strict mode check |
+| Frequency spectrum design | C6: within-family tones too close | Enforce >1 critical bandwidth separation; use musical interval ratios |
-| Waveform implementation | A3: naive waveform aliases | Use additive synthesis (bandlimited harmonic series) — compatible with existing `[]HarmonicDef` API |
+| Auto-assign range update | C2: new built-ins collide with user custom class auto-assign range | Move auto-assign base above highest new built-in Hz; add range-check test |
-| Waveform string input | A4: case/abbreviation mismatches | Normalize + validate with clear error listing accepted values |
+| Test suite update | C4: TestFrequenciesInRange fails on new Hz values | Update range bound in test before adding any class above 1100 Hz |
-| Rule merge ordering (catch-alls) | A5: user rules after catch-alls are unreachable | Split `DefaultRules` into `SpecificRules` + `CatchAllRules`; user rules go in between |
+| Protocol list curation | C7: secure + insecure variants fill 2x slots | Decide: one class per family (covering all ports) or one class per variant |
-| Bank construction | A6: custom class has no synth layer | Derive full class set from merged rule slice; pass to bank constructor |
+| Protocol list curation | C9: RTP and range-based protocols not expressible | Exclude from v1.2 or extend rule schema; decide before writing rules |
-| Config discovery | A7: XDG ignored, `~/.config` hardcoded | Use `os.UserConfigDir()` not `os.UserHomeDir() + "/.config"` |
+| Adding class constants | C3: NumLayers stale constant misleads | Remove or document-only; update test name; keep AllClasses+ClassFreqConfigs atomic |
-| --config flag path | A8: missing explicit path silently ignored | Two distinct code paths: flag path (require) vs auto-discovery (skip-missing) |
+| Adding class constants | C8: three-location update forgetting one | Establish single source of truth or add checklist in classify/types.go comment |
-| Rule merge ordering (specific built-ins) | A9: user rule shadowed by built-in for same port | User rules first in merged slice (`userRules + specificDefaults + catchAlls`) |
+| Group config schema | C5: new TOML key rejected by old binary | Add to rawConfig struct before documenting or emitting the key anywhere |
-| Class name validation | A10: empty/whitespace class name is valid Go string | Validate and trim all class strings in `validate()` |
+| --print-config update | C10: output contains unparseable TOML | All group output must be comments only, or rawConfig must accept the new keys |
 | Class constant naming | C11: naming convention drift | Decide convention once in design phase; document in types.go |
 | Perceptual density | C12: 35+ layers is a wash | Design family groupings to fuse into ~10 perceptual units, not 35 threads |
 ---
-## Integration Gotchas (v1.1 Additions)
+## Backward Compatibility Summary (v1.1 → v1.2)
-| Integration | Common Mistake | Correct Approach |
+| Change Type | Impact on v1.1 User Configs | Mitigation |
-|-------------|----------------|------------------|
+|-------------|----------------------------|------------|
-| Config → Bank wire-up | Pass `classify.AllClasses()` to bank; custom classes missing | Derive layer set from `Classifier.ActiveClasses()` — all classes reachable via the effective rule set |
+| New built-in classes added | None — absent TOML keys silently default; existing overrides unaffected | Safe |
-| Waveform → FreqConfig | Add `WaveformType string` to `FreqConfig`; forget to generate harmonics at bank init | Generate `[]HarmonicDef` from waveform+freq at bank/layer construction time, not at sample render time |
+| Existing built-in Hz values changed | User overrides silently re-apply old v1.1 Hz values, masking the change | Freeze v1.1 Hz range; do not reassign existing classes |
-| User rules → Classifier | Replace `DefaultRules` var directly; breaks tests relying on it | Keep `DefaultRules` immutable; construct `mergedRules` for runtime use |
+| New top-level TOML key added (e.g., `[families]`) | v1.1 binary rejects config with new key via `Undecoded()` | Acceptable since user controls which binary they run |
-| Config file absent | Return error if no config found | Return nil (no config = all defaults). Only error on explicit `--config` path that is missing |
+| Auto-assign range shifted | User custom classes get different Hz values than before | Announce in changelog; update `autoAssignFreq` constants and document |
-| Sound overrides for built-in class | User sets freq for "HTTPS" — must hit `ClassHTTPS` layer | Match config sound keys case-insensitively against `TrafficClass` string values; map `"HTTPS"` → `classify.ClassHTTPS` |
+| `[[rules]]` schema extended (port range fields) | Existing rules without new fields: no change (pointer types are nil = absent) | Backward-compatible if new fields are optional pointers |
 | Class string values renamed | TOML `[sounds.old-name]` silently produces "unknown class" warning (not error) | Do not rename existing class strings |
 ---
 ## v1.1 Pitfalls (Retained)
 The following pitfalls from v1.1 research remain valid and fully resolved in the codebase. They are retained in condensed form for reference. See the original v1.1 entries for full detail.
 ### Pitfall A1: TOML Unmarshal Silently Overwrites Defaults With Zero Values
 Use pointer fields (`*float64`, `*string`) — implemented in `config/config.go` via `SoundOverride`.
 ### Pitfall A2: BurntSushi/toml Silently Ignores Typos
 Use `md.Undecoded()` — implemented in `parseFile()`.
 ### Pitfall A3: Naive Square/Sawtooth/Triangle Produces Aliasing
 Use bandlimited additive synthesis — implemented in `WaveformPresetHarmonics()`.
 ### Pitfall A4: Waveform String Validation Fails Silently
 Normalize + validate — implemented in `parseWaveform()`.
 ### Pitfall A5: User Rules After Catch-All Rules Are Unreachable
 User rules prepend before built-ins — implemented: user rules inserted first in merged slice.
 ### Pitfall A6: User-Defined Classes Have No synth.FreqConfig Entry
 `addAutoFreqEntries()` handles this — implemented in `config/config.go`.
 ### Pitfall A7: Config Auto-Discovery Ignores XDG Variables
 Use `os.UserConfigDir()` — implemented in `discoverPath()`.
 ### Pitfall A8: Explicit --config Flag Does Not Error on Missing File
 Separate code paths for explicit vs auto-discovery — implemented in `resolvePath()`.
 ### Pitfall A9: User Rule Shadowed by Built-in for Same Port
 User rules evaluate first — implemented via prepend ordering.
 ### Pitfall A10: Empty/Whitespace Class Name Is a Valid Go String
 Validated in `validateRules()`.
 ---
 ## v1.0 Pitfalls (Retained, Condensed)
 ### Pitfall B1: `google/gopacket` (Unmaintained)
 Use `gopacket/gopacket` v1.5.0.
 ### Pitfall B2: CGo Destroys Single Binary
 Use `packetcap/go-pcap` (pure Go capture).
 ### Pitfall B3: CAP_NET_RAW + nosuid Filesystem
 Install to `/usr/local/bin`; emit clear privilege error.
 ### Pitfall B4: Packet Buffer Overflow
 Large capture buffer (32 MB); buffered channel between goroutines.
 ### Pitfall B5: ZeroCopy Packet Use-After-Free
 Use `ReadPacketData()` (copying API).
 ### Pitfall B6: LAME Initialization Order
 Call `InitParams()` before writing frames.
 ### Pitfall B7: PCM Sample Overflow
 Synthesize in float64 [-1, 1]; clamp before int16 cast.
 ### Pitfall B8: Tone-per-Protocol Frequency Masking
 Space protocols across register bands using musical intervals.
 ---
 ## Sources
- [BurntSushi/toml pkg.go.dev](https://pkg.go.dev/github.com/BurntSushi/toml) — `Undecoded()` strict mode, pointer field behavior, `MetaData` API
+- Direct inspection of `/home/dev/workspace/yoloyolo/synth/config.go`, `config.go`, `classify/types.go`, `synth/bank.go`, `synth/config_test.go` — codebase analysis is HIGH confidence
- [BurntSushi/toml issue #47: Unmarshal with default values](https://github.com/BurntSushi/toml/issues/47) — confirms default-overwrite behavior
+- [Glasberg & Moore (1990) ERB formula via Wikipedia Critical Band article](https://en.wikipedia.org/wiki/Critical_band) — critical bandwidth values at specific Hz, HIGH confidence
- [pelletier/go-toml issue #252: Unmarshal overrides origin values if key is omitted](https://github.com/pelletier/go-toml/issues/252) — confirms same behavior in v1; v2 partially resolves
+- [BurntSushi/toml pkg.go.dev — Undecoded() strict mode](https://pkg.go.dev/github.com/BurntSushi/toml) — unknown key validation behavior, HIGH confidence
- [pelletier/go-toml v2 pkg.go.dev](https://pkg.go.dev/github.com/pelletier/go-toml/v2) — strict decoder mode documentation
+- [BurntSushi/toml issue #47: default value behavior](https://github.com/BurntSushi/toml/issues/47) — TOML zero-value overwrite behavior, HIGH confidence
- [golang/go issue #29960: os: add UserConfigDir](https://github.com/golang/go/issues/29960) — rationale for `os.UserConfigDir()` (XDG-aware)
+- [Evanjones.ca: The Unreasonable Effectiveness of Linear Search](https://www.evanjones.ca/linear-search.html) — linear search competitive with map for N < ~100, MEDIUM confidence
- [WolfSound: Basic Waveforms in Synthesis](https://thewolfsound.com/sine-saw-square-triangle-pulse-basic-waveforms-in-synthesis/) — aliasing and harmonic series for square/saw/triangle
+- [vitalvas.com: Slice vs Map Performance in Golang (2025)](https://blog.vitalvas.com/post/2025/10/03/slice-vs-map-performance-in-golang/) — map outperforms slice at N > 10, MEDIUM confidence; 40-rule estimate of 160 ns is first-principles, not benchmarked
- [CCRMA: Alias-Free Digital Synthesis of Classic Analog Waveforms](https://ccrma.stanford.edu/~stilti/papers/blit.pdf) — bandlimited synthesis theory
+- [QSC Blog: Auditory Masking and its Effect on Perception](https://blogs.qsc.com/live-sound/auditory-masking-and-its-effect-on-our-perception-of-sound/) — masking principles, MEDIUM confidence
- [McGill Bandlimited Synthesis of Classic Waveforms](https://www.music.mcgill.ca/~gary/307/week5/bandlimited.html) — truncated harmonic series approach
+- [Wikipedia: List of TCP and UDP port numbers](https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers) — port numbers for IMAP, POP3, LDAP, RDP, SIP, SNMP, Syslog, HIGH confidence
- [Teensy Forum: triangle & sawtooth oscillators aliasing](https://forum.pjrc.com/threads/61269-triangle-amp-sawtooth-oscillators-how-to-deal-with-aliasing) — practical aliasing impact at different frequencies
+- [RF Wireless World: Well-Known Port Numbers](https://www.rfwireless-world.com/terminology/well-known-port-numbers) — port reference, MEDIUM confidence
 - [adrg/xdg package](https://github.com/adrg/xdg) — XDG Base Directory Specification Go implementation (reference; stdlib `os.UserConfigDir()` is sufficient for NetSynth's needs)
 ---
-*Pitfalls research for: NetSynth v1.1 — TOML config, waveform types, user-defined rules*
+*Pitfalls research for: NetSynth v1.2 — Extended protocol coverage, grouped sound families*
-*Updated: 2026-03-26*
+*Updated: 2026-03-27*
@@ -1,8 +1,8 @@
 # Technology Stack
-**Project:** NetSynth v1.1 — Custom Sound Mappings
+**Project:** NetSynth v1.2 — Extended Protocol Coverage with Grouped Sound Families
 **Researched:** 2026-03-26
-**Scope:** Additions/changes only. Existing stack (gopacket, go-pcap, go-lame, cobra) is validated and unchanged.
+**Scope:** Additions/changes only. Existing stack (gopacket, go-pcap, go-lame, cobra, BurntSushi/toml) is validated and unchanged.
 ---
@@ -10,160 +10,125 @@
 | Technology | Version | Status |
 |------------|---------|--------|
-| `github.com/gopacket/gopacket` | v1.5.0 | Validated in v1.0, unchanged |
+| `github.com/gopacket/gopacket` | v1.5.0 | Validated in v1.0/v1.1, unchanged |
-| `github.com/packetcap/go-pcap` | v0.0.0-20251215 | Validated in v1.0, unchanged |
+| `github.com/packetcap/go-pcap` | v0.0.0-20251215 | Validated in v1.0/v1.1, unchanged |
-| `github.com/sjzar/go-lame` | v0.0.9 | Validated in v1.0, unchanged |
+| `github.com/sjzar/go-lame` | v0.0.9 | Validated in v1.0/v1.1, unchanged |
-| `github.com/spf13/cobra` | v1.10.2 | Validated in v1.0, unchanged |
+| `github.com/spf13/cobra` | v1.10.2 | Validated in v1.0/v1.1, unchanged |
-| Hand-rolled sine oscillator + EMA | — | Validated in v1.0, extend in place |
+| `github.com/BurntSushi/toml` | v1.6.0 | Validated in v1.1, unchanged |
-| Ordered `[]Rule` classifier | — | Validated in v1.0, extend in place |
+| Hand-rolled additive synth + EMA | — | Validated, extend in place |
 | Ordered `[]Rule` classifier | — | Validated, extend in place |
 ---
-## New Dependencies for v1.1
+## New Dependencies for v1.2
-### TOML Config Parsing
+**None required.**
-| Technology | Version | Purpose | Why |
+All features for extended protocol coverage and grouped sound families can be implemented by extending existing packages in place. No new external dependencies are needed.
 |------------|---------|---------|-----|
 | `github.com/BurntSushi/toml` | v1.6.0 | Parse `netsynth.toml` config files | Single-function `toml.Decode()` into a struct. The `MetaData.Undecoded()` method catches unknown keys in user configs — surfacing typos like `frequncy` rather than silently ignoring them. This is the right behavior for a config file tool. v1.6.0 released December 2025, Go 1.18+ required. Zero indirect dependencies. |
 **Version confirmed:** v1.6.0, December 18, 2025, via pkg.go.dev and GitHub releases page.
 **Why not `pelletier/go-toml v2`:** go-toml v2.3.0 (March 2026) is faster but the performance difference is irrelevant — config is read once at startup. go-toml v2's `Strict` mode can detect unknown keys but requires more setup than BurntSushi's `MetaData.Undecoded()`. BurntSushi's API is simpler for this use case and has clearer error message patterns for user-facing config mistakes.
 ### Config Auto-Discovery
 No new dependency. Use Go stdlib only:
 ```go
 // Probe order: --config flag > ./netsynth.toml > ~/.config/netsynth/config.toml
 func findConfigPath(flagValue string) (string, bool) {
    if flagValue != "" {
        return flagValue, true
    }
    if _, err := os.Stat("./netsynth.toml"); err == nil {
        return "./netsynth.toml", true
    }
    if dir, err := os.UserConfigDir(); err == nil {
        p := filepath.Join(dir, "netsynth", "config.toml")
        if _, err := os.Stat(p); err == nil {
            return p, true
        }
    }
    return "", false
 }
 ```
 `os.UserConfigDir()` returns `$XDG_CONFIG_HOME` if set, else `$HOME/.config` on Linux/macOS — confirmed against Go stdlib docs. No third-party XDG library needed.
 ### Additional Waveform Types
 No new dependency. Extend the existing `synth.Oscillator` in place.
 Square, sawtooth, and triangle are pure math — each is ~3 lines. The existing oscillator uses a phase accumulator (0.0–1.0 range), which is the right representation for all four waveforms:
 ```go
 // Waveform enum addition to synth package
 type Waveform int
 const (
    WaveformSine     Waveform = iota
    WaveformSquare
    WaveformSawtooth
    WaveformTriangle
 )
 // Per-sample generation (replaces math.Sin call in Advance())
 func sample(phase float64, w Waveform) float64 {
    switch w {
    case WaveformSquare:
        if phase < 0.5 { return 1.0 }
        return -1.0
    case WaveformSawtooth:
        return 2*phase - 1.0
    case WaveformTriangle:
        if phase < 0.5 { return 4*phase - 1.0 }
        return 3.0 - 4*phase
    default: // WaveformSine
        return math.Sin(2 * math.Pi * phase)
    }
 }
 ```
 The `Oscillator` struct gains a `Waveform` field; `Advance()` dispatches to `sample()`. Harmonics still work the same way — each harmonic's phase is `phase * ratio`, which maps correctly for all waveform types.
 ---
-## Installation Delta
+## gopacket Protocol Decoder Coverage
-```bash
+This is the critical research question for v1.2. The `layers` package in `gopacket/gopacket v1.5.0` is the authoritative source.
 # Add only this new dependency
 go get github.com/BurntSushi/toml@v1.6.0
 ```
-No changes to build flags. `CGO_ENABLED=1` still required for go-lame.
+### Protocols with Native gopacket Layer Decoders
 These protocols have a dedicated `LayerType` constant and `DecodeFromBytes` implementation in `github.com/gopacket/gopacket/layers`. They auto-register via UDP/TCP port dispatch — `pkt.Layer(layers.LayerTypeSIP)` just works after gopacket decodes the packet.
 | Protocol | LayerType Constant | Port Auto-Registered | Notes |
 |----------|-------------------|---------------------|-------|
 | ICMP v4 | `LayerTypeICMPv4` | IP protocol 1 | Already used in v1.0 |
 | ICMP v6 | `LayerTypeICMPv6` | IP protocol 58 | Already used in v1.0 |
 | DNS | `LayerTypeDNS` | UDP/TCP 53 | Already used in v1.0 |
 | DHCP v4 | `LayerTypeDHCPv4` | UDP 67, 68 | Already used in v1.0 |
 | DHCP v6 | `LayerTypeDHCPv6` | UDP 546, 547 | NEW: can add DHCPv6 classification rule |
 | NTP | `LayerTypeNTP` | UDP 123 | Already used in v1.0 |
 | TLS | `LayerTypeTLS` | TCP 443, 636, 989-995, 5061, etc. | Can use to improve HTTPS/SMTPS/LDAPS detection |
 | SIP | `LayerTypeSIP` | UDP/TCP/SCTP 5060, 5082, 5083 | NEW: native layer decoder available |
 | RADIUS | `LayerTypeRADIUS` | UDP 1812 | Possible addition for network infra traffic |
 | SCTP | `LayerTypeSCTP` | IP protocol 132 | Available if needed |
 | GRE | `LayerTypeGRE` | IP protocol 47 | Tunnel protocol, probably skip |
 | Modbus TCP | `LayerTypeModbusTCP` | TCP/UDP 502 | Industrial — niche |
 Source: `github.com/gopacket/gopacket/blob/master/layers/layertypes.go` and `layers/ports.go` — confirmed via direct inspection.
 ### Protocols WITHOUT gopacket Layer Decoders (Port-Based Classification Only)
 These protocols do NOT have a `LayerType` in gopacket. Classification must use the existing `Rule{Protocol, DstPort, Class}` mechanism — matching by transport protocol + destination port number. This is already how most of the v1.0 rules work (SSH, HTTP, HTTPS, SMTP are all port-based).
 | Protocol | Standard Port(s) | Transport | Classification Approach |
 |----------|-----------------|-----------|------------------------|
 | FTP | 21 (control), 20 (data) | TCP | Port-based rule: `{tcp, 21, ClassFTP}` |
 | IMAP | 143, 993 (TLS) | TCP | Port-based rules: `{tcp, 143}`, `{tcp, 993}` |
 | POP3 | 110, 995 (TLS) | TCP | Port-based rules: `{tcp, 110}`, `{tcp, 995}` |
 | SNMP | 161 (queries), 162 (traps) | UDP | Port-based rules: `{udp, 161}`, `{udp, 162}` |
 | LDAP | 389, 636 (TLS) | TCP | Port-based rules: `{tcp, 389}`, `{tcp, 636}` (note: 636 already hits LayerTypeTLS) |
 | RDP | 3389 | TCP | Port-based rule: `{tcp, 3389}` |
 | SMB | 445 (direct), 139 (NetBIOS) | TCP | Port-based rules: `{tcp, 445}`, `{tcp, 139}` |
 | mDNS | 5353 | UDP | Port-based rule: `{udp, 5353}` — gopacket uses LayerTypeDNS registered on 53, not 5353 |
 | QUIC / HTTP3 | 443 | UDP | Port-based rule: `{udp, 443}` distinguishes from HTTPS/TLS on TCP 443 |
 | Telnet | 23 | TCP | Port-based rule: `{tcp, 23}` |
 | HTTP alt | 8080, 8443 | TCP | Can add as additional Web family rules |
 **mDNS detail:** gopacket's DNS layer registers only on UDP port 53. mDNS on UDP 5353 will decode as raw UDP payload — the existing `hashBucket` fallback handles it. A `{udp, 5353, ClassMDNS}` rule is correct and sufficient for classification without needing any layer decoder.
 **QUIC detail:** QUIC uses UDP port 443 (same port HTTPS uses on TCP). The existing `{tcp, 443, ClassHTTPS}` rule only fires on TCP. A `{udp, 443, ClassQUIC}` rule is unambiguous — UDP 443 is QUIC/HTTP3 traffic on modern networks. No deep packet inspection needed for classification purposes.
 **SIP detail:** gopacket v1.5.0 has a native SIP decoder (`LayerTypeSIP`) registered on UDP/TCP 5060. This means `pkt.Layer(layers.LayerTypeSIP)` works after gopacket decodes the packet. However, since the existing classifier already dispatches by transport + port via the `Rule` struct, a simple `{udp, 5060, ClassSIP}` / `{tcp, 5060, ClassSIP}` rule pair is simpler and more consistent than adding a special Layer-based code path. Use port-based rules. The native SIP layer decoder is available if future features need SIP message parsing (call rates, request types), but v1.2 only needs classification.
 ---
-## Integration Points
+## In-Place Extensions Required
-### Where Config Feeds Existing Code
+### 1. classify package — New TrafficClass constants and DefaultRules
-The TOML config needs to override two existing data structures:
+Add new `TrafficClass` constants to `classify/types.go` for each new protocol. Extend `classify/rules.go` `DefaultRules` with new ordered entries.
-1. **`synth.ClassFreqConfigs`** (map in `synth/config.go`) — user can override `BaseHz` and add a `Waveform` field per class
+**Proposed new classes by family:**
 2. **`classify.DefaultRules`** (slice in `classify/rules.go`) — user can prepend custom rules before the defaults
 The config loader should apply overrides at startup before any other initialization. The cleanest integration is:
 ```
-cmd/netsynth/main.go
+Mail family:    ClassIMAP, ClassPOP3, ClassSMTPS (SMTP over TLS = 465/587)
-  -> config.Load(path)          // returns *AppConfig
+Web family:     ClassHTTP (existing), ClassHTTPS (existing), ClassHTTP8080, ClassQUIC
-  -> classify.MergeRules(cfg)   // prepend user rules to DefaultRules
+Remote family:  ClassSSH (existing), ClassRDP, ClassTelnet
-  -> synth.ApplyOverrides(cfg)  // patch ClassFreqConfigs entries
+Discovery:      ClassMDNS, ClassDHCP (existing), ClassDHCPv6
 File Transfer:  ClassFTP
 Directory:      ClassLDAP
 Monitoring:     ClassSNMP
 Messaging:      ClassSIP
 Infra:          ClassSMB
 ```
-Both `classify.DefaultRules` and `synth.ClassFreqConfigs` are currently package-level vars — they can be replaced or cloned at startup without changing the downstream pipeline.
+The exact set is a product decision (FEATURES.md), but every entry requires only a new `TrafficClass` string constant and a `Rule{Protocol, DstPort, Class}` entry in `DefaultRules`. No code path changes needed.
-### TOML Struct Shape
+**Insertion point in DefaultRules:** New rules must come before the existing catch-alls (`{tcp, 0, ClassOtherTCP}` and `{udp, 0, ClassOtherUDP}`). Ordering within the new rules does not matter since they are distinct ports.
-The config schema maps naturally to the existing types:
+### 2. synth package — Frequency map and group detuning
-```toml
+Extend `synth/config.go` `ClassFreqConfigs` with an entry for each new `TrafficClass`. No API change — it's a map addition.
 # netsynth.toml
 [[rules]]
 protocol = "tcp"
 dst_port = 8443
 class    = "my-https-alt"
-[sounds.my-https-alt]
+**Group-based frequency allocation approach (no new code needed):**
 frequency = 195.0
 waveform  = "square"
-[sounds.ICMP]
+Group related protocols into a frequency band, using slight detuning within the band for distinction. The existing `FreqConfig.BaseHz` + `FreqConfig.Harmonics` already supports this — give family members adjacent base frequencies (e.g., 5-15 Hz apart at low frequencies, 15-30 Hz at mid frequencies) with the same harmonic shape but different waveform types.
 frequency = 80.0   # override built-in
 waveform  = "triangle"
 ```
 Example for Mail family:
 ```go
-type AppConfig struct {
+ClassSMTP:  {BaseHz: 440.0, Harmonics: ...sawtooth..., Pan: -0.55}  // existing
-    Rules  []RuleConfig              `toml:"rules"`
+ClassIMAP:  {BaseHz: 450.0, Harmonics: ...sawtooth..., Pan: 0.55}   // same family, detuned +10 Hz
-    Sounds map[string]SoundConfig    `toml:"sounds"`
+ClassPOP3:  {BaseHz: 435.0, Harmonics: ...sawtooth..., Pan: -0.3}   // same family, detuned -5 Hz
 }
 type RuleConfig struct {
    Protocol string `toml:"protocol"`
    DstPort  uint16 `toml:"dst_port"`
    Class    string `toml:"class"`
 }
 type SoundConfig struct {
    Frequency float64 `toml:"frequency"`
    Waveform  string  `toml:"waveform"`  // "sine"|"square"|"sawtooth"|"triangle"
 }
 ```
-Use `toml.Decode()` and check `meta.Undecoded()` to warn on unknown keys.
+The `WaveformType` field already encodes "same character within group." The existing bandlimited synthesis code handles all this correctly.
 **NumLayers constant:** Currently hardcoded to 14 in `synth/config.go`. Must be updated to reflect the new total class count. Alternatively, compute it dynamically from `len(ClassFreqConfigs)`. The dynamic approach is more maintainable and requires touching only `synth/config.go`.
 **GainPerLayer:** Computed as `1.0 / float64(NumLayers)`. With more layers active simultaneously, individual gain drops. This is the correct behavior — prevents clipping. Verify mix levels after adding classes.
 ### 3. config package — --print-config output
 `--print-config` currently emits commented TOML grouped by class. With protocol families, adding a `Group` field to `FreqConfig` or a separate group-to-classes mapping in `synth/config.go` allows `--print-config` to emit sections with comment headers like `# Mail family`. This is cosmetic; no behavioral change needed.
 No new dependency needed. Add a `GroupName string` field to `FreqConfig` (zero value = ungrouped) or a `var ClassGroups = map[string][]TrafficClass{...}` in `synth/config.go`.
 ---
@@ -171,20 +136,48 @@ Use `toml.Decode()` and check `meta.Undecoded()` to warn on unknown keys.
 | Avoid | Why | What to Do Instead |
 |-------|-----|-------------------|
-| `adrg/xdg` or any XDG library | `os.UserConfigDir()` in stdlib already handles `$XDG_CONFIG_HOME` on Linux — confirmed | Use `os.UserConfigDir()` directly |
+| Any deep packet inspection library (gopacket TLS layer for HTTPS detection) | v1.2 goal is protocol family classification by port, not payload analysis. TLS handshake parsing adds complexity for no classification benefit since port is unambiguous. | Port-based `Rule{tcp, 443, ClassHTTPS}` — already working |
-| `pelletier/go-toml v2` | No advantage over BurntSushi for a single-file startup read; `MetaData.Undecoded()` in BurntSushi is more ergonomic for typo detection | `github.com/BurntSushi/toml` |
+| `github.com/google/gopacket` (original) | Superseded by community fork; 270 open issues, not maintained | `gopacket/gopacket v1.5.0` (already in use) |
-| `spf13/viper` | Massive dependency (brings in 20+ transitive deps) for a use case that is one TOML file — Viper adds remote config, env var binding, hot reload, none of which are needed | `BurntSushi/toml` + manual flag override |
+| Any SNMP library (e.g., `gosnmp`) | v1.2 only needs to detect SNMP traffic, not decode OIDs or walk MIBs | `{udp, 161, ClassSNMP}` port rule |
-| Any waveform/audio library | Square/sawtooth/triangle are 3 lines of math each; no library adds value | Extend `synth.Oscillator` in place |
+| Any SIP parsing library | v1.2 only needs to detect SIP presence for sonification, not parse SIP messages, headers, or call state | `{udp, 5060, ClassSIP}` + `{tcp, 5060, ClassSIP}` port rules |
-| `gopkg.in/yaml.v3` or JSON config | TOML is explicitly specified for this milestone and is the right format for user-editable config files (comments supported, less noisy than JSON) | TOML only |
+| Separate "group" abstraction layer in classify | A `Group` field on `FreqConfig` (in synth) is sufficient for --print-config display. The classifier itself doesn't need to know about groups — families emerge from frequency proximity in the audio output. | `GroupName string` in `synth.FreqConfig` |
 | Dynamic port range rules (e.g., "all TCP 1024-65535 → ClassOtherTCP") | Existing catch-alls (`DstPort: 0`) already cover this. Current Rule struct is optimized for exact-match dispatch. | Keep existing catch-all rules |
 ---
-## Version Compatibility
+## Frequency Rebalancing Scope
 Current v1.1 spectrum allocation (for reference):
 ```
 65 Hz    — ICMP
 110 Hz   — DNS
 175 Hz   — HTTPS
 220 Hz   — HTTP
 330 Hz   — SSH
 440 Hz   — SMTP
 520 Hz   — NTP
 600 Hz   — DHCP
 700 Hz   — OtherTCP
 780 Hz   — OtherUDP
 862 Hz   — Unknown-1 (dissonant band)
 920 Hz   — Unknown-2
 981 Hz   — Unknown-3
 1047 Hz  — Unknown-4
 ```
 Adding ~8-12 new protocol classes requires rebalancing. The 65-780 Hz "known protocol" band currently has 8 classes spread over ~715 Hz (average spacing ~90 Hz). Adding 8+ new entries will compress that to ~40-50 Hz average spacing — still audibly distinct with different waveforms.
 The unknown-1-4 dissonant band (862-1047 Hz) should stay — it provides the "something unknown" sound character. The rebalancing task is purely a `synth/config.go` constant edit, not a code change.
 ---
 ## Version Compatibility (Unchanged)
 | Package | Version | Compatible With | Notes |
 |---------|---------|-----------------|-------|
-| `BurntSushi/toml` | v1.6.0 | Go 1.18+ | No issues with Go 1.24 |
+| `gopacket/gopacket` | v1.5.0 | Go 1.24+ | New protocol rules use existing API — no compat concerns |
-| `os.UserConfigDir()` | stdlib | Go 1.13+ | Returns `$XDG_CONFIG_HOME` or `$HOME/.config` on Linux |
+| All other existing packages | (unchanged) | (unchanged) | No updates needed |
 ---
@@ -192,24 +185,27 @@ Use `toml.Decode()` and check `meta.Undecoded()` to warn on unknown keys.
 | Area | Confidence | Source |
 |------|------------|--------|
-| BurntSushi/toml v1.6.0 version | HIGH | pkg.go.dev confirmed, GitHub releases confirmed |
+| gopacket LayerType SIP exists at v1.5.0 | HIGH | Direct inspection of `layers/layertypes.go` and `layers/sip.go` via GitHub |
-| `os.UserConfigDir()` XDG behavior | HIGH | Official Go stdlib docs at pkg.go.dev/os |
+| gopacket LayerType TLS exists at v1.5.0 | HIGH | Direct inspection of `layers/layertypes.go` and `layers/ports.go` via GitHub |
-| Waveform math (no library needed) | HIGH | Trivial math, Dylan Meeus Go audio blog confirms the same approach |
+| gopacket port registrations (ports.go) | HIGH | Direct inspection of `layers/ports.go` via GitHub; explicit list of pre-registered UDP/TCP ports |
-| go-toml v2.3.0 version | HIGH | pkg.go.dev confirmed |
+| mDNS NOT registered in gopacket layers | HIGH | Port 5353 absent from `layers/ports.go` pre-registration list; confirmed via GitHub |
-| Recommendation of BurntSushi over go-toml v2 | MEDIUM | Based on API ergonomics for the specific `Undecoded()` use case; both would work |
+| QUIC NOT registered in gopacket layers | HIGH | No `quic.go` in layers directory; no port 443 UDP registration in `layers/ports.go` |
 | SNMP, LDAP, RDP, SMB, FTP, IMAP, POP3 NOT in gopacket layers | HIGH | No corresponding .go files found in layers directory |
 | Port-based Rule classification sufficiency for all new protocols | HIGH | All protocols have well-known IANA port assignments; existing Rule struct handles them identically to SSH/HTTP/SMTP |
 | No new external dependencies needed | HIGH | All new functionality is data additions (constants, map entries) to existing packages |
 ---
 ## Sources
- `pkg.go.dev/github.com/BurntSushi/toml` — v1.6.0 confirmed, December 18, 2025
+- `github.com/gopacket/gopacket/blob/master/layers/layertypes.go` — LayerTypeSIP (id 133), LayerTypeTLS (id 140) confirmed
- `github.com/BurntSushi/toml/releases` — v1.6.0 release notes, TOML 1.1 enabled by default
+- `github.com/gopacket/gopacket/blob/master/layers/sip.go` — SIP decoder implementation confirmed
- `pkg.go.dev/github.com/pelletier/go-toml/v2` — v2.3.0 confirmed, March 24, 2026
+- `github.com/gopacket/gopacket/blob/master/layers/ports.go` — UDP/TCP port pre-registration list; mDNS (5353), SNMP (161/162), QUIC (UDP 443) absent; SIP (5060, 5082, 5083) present
- `pkg.go.dev/os#UserConfigDir` — XDG_CONFIG_HOME behavior on Linux confirmed via official Go docs
+- `github.com/gopacket/gopacket/tree/master/layers` — directory listing; no mdns.go, quic.go, snmp.go, ldap.go, smb.go, rdp.go, ftp.go, imap.go, or pop3.go files
- `dylanmeeus.github.io/posts/audio-from-scratch-pt8/` — Go waveform synthesis from scratch, confirms no library needed
+- `pkg.go.dev/github.com/gopacket/gopacket/layers` — package index confirming layer types
- `github.com/golang/go/issues/76320` — UserConfigDir XDG_CONFIG_HOME discussion (Nov 2025), confirms existing stdlib support on Linux
+- IANA port assignments — standard reference for FTP/21, IMAP/143, POP3/110, SNMP/161, LDAP/389, RDP/3389, SMB/445, mDNS/5353, SIP/5060, QUIC/UDP-443
 ---
-*Stack research for: NetSynth v1.1 — Custom Sound Mappings milestone*
+*Stack research for: NetSynth v1.2 — Extended Protocol Coverage with Grouped Sound Families*
 *Researched: 2026-03-26*
@@ -1,187 +1,182 @@
 # Project Research Summary
-**Project:** NetSynth v1.1 — Custom Sound Mappings
+**Project:** NetSynth v1.2 — Extended Protocol Coverage with Grouped Sound Families
-**Domain:** Network traffic sonification CLI tool (Go)
+**Domain:** Network traffic sonification CLI (Go) — packet capture to ambient MP3
-**Researched:** 2026-03-26
+**Researched:** 2026-03-27
 **Confidence:** HIGH
 ## Executive Summary
-NetSynth v1.1 extends the working v1.0 CLI by adding user-customizable sound mappings through a TOML config file. The v1.0 codebase is a clean 6-package Go project (3,254 lines) with a well-separated pipeline: capture → classify → aggregate → synthesize → encode. The v1.1 milestone threads a new `config` package through this pipeline, enabling users to override frequencies and waveforms per traffic class, add new classification rules, and reference those custom classes in the synth layer. The recommended implementation path is incremental — introduce waveform types at the oscillator level first, then decouple bank construction from the global config, then add the TOML loader and wire it all together. Each step is independently testable before the next begins.
+NetSynth v1.2 extends an already-shipped Go CLI tool that captures live network traffic and synthesizes it into an ambient MP3 soundscape. The existing v1.1 codebase (~4,675 lines, 7 packages) provides a validated pipeline: go-pcap capture → port-based classification → EMA-smoothed additive synthesis → LAME MP3 encoding. The v1.2 milestone adds ~21 new protocol classes across 7 sound families (Mail, Remote Access, File Transfer, Infrastructure expansion, Database, Directory/Auth, VoIP), expanding from 14 total classes to ~35. No new external dependencies are required — every new protocol is detectable via the existing port-based Rule classifier, and group identity is expressed purely through frequency proximity and waveform consistency in `ClassFreqConfigs`.
-The stack requires one new dependency: `github.com/BurntSushi/toml` v1.6.0 (zero indirect deps, `MetaData.Undecoded()` provides strict-mode typo detection). All other additions — waveform math, config file discovery, and class name validation — are stdlib-only. The single notable technical choice is waveform synthesis strategy: naive direct-math square/sawtooth/triangle waveforms produce audible aliasing at the frequencies NetSynth uses (65–1047 Hz). The existing additive synthesis infrastructure (`[]HarmonicDef`) is the correct approach, generating bandlimited harmonic series for each waveform type rather than direct time-domain computation.
+The recommended approach is strictly additive: extend three locations in the codebase (`classify/types.go` for constants, `classify/rules.go` for port rules, `synth/config.go` for frequency configs) in a fixed order to keep tests green throughout. The highest-value protocols for v1.2 are the Tier 1 set (IMAP, POP3, FTP, SMB, RDP, mDNS, SSDP, SNMP, MySQL, PostgreSQL, Redis) because they appear on nearly every network type. The group-as-frequency-proximity design means family identity emerges from the audio itself — no new data structures are needed for the group concept beyond a `Group string` metadata field on `FreqConfig`.
-The highest-risk integration points are bank construction (which must be extended to handle user-defined classes not in the static `AllClasses()` list) and TOML merge semantics (TOML decoders zero-out absent fields, silently overwriting defaults unless pointer fields are used). Both are well-understood problems with clear prevention patterns that must be established before wiring config into the pipeline. The merge ordering for classification rules also requires deliberate design: user rules must precede specific built-in rules, which must precede catch-alls — three-layer ordering, not two.
+The key risks are all backward-compatibility and perceptual-design concerns rather than engineering complexity. The critical risks are: (1) frequency rebalancing silently invalidating existing user TOML configs, (2) the `autoAssignFreq` range in `config.go` colliding with new built-in frequencies if not updated, and (3) within-family detuning that is psychoacoustically too narrow to be perceptually distinct. These are all preventable with explicit design choices made before any code is written. The milestone complexity is LOW — all changes are data additions to existing packages, and the build order is clear from the architecture research.
 ## Key Findings
 ### Recommended Stack
-The existing stack (gopacket v1.5.0, packetcap/go-pcap, sjzar/go-lame v0.0.9, cobra v1.10.2, hand-rolled sine oscillator + EMA) is unchanged. The only new external dependency is `BurntSushi/toml` v1.6.0, selected over `pelletier/go-toml v2` because `MetaData.Undecoded()` is more ergonomic for typo detection on a single startup config read, and over `spf13/viper` because Viper pulls in 20+ transitive deps for features (remote config, env var binding, hot reload) that are irrelevant here. See `.planning/research/STACK.md` for full alternatives analysis.
+The v1.2 stack is identical to v1.1 — no new dependencies are required. All existing packages (gopacket/gopacket v1.5.0, packetcap/go-pcap, sjzar/go-lame v0.0.9, spf13/cobra v1.10.2, BurntSushi/toml v1.6.0) are validated and unchanged. The gopacket `layers` package has native decoders for SIP (LayerTypeSIP, id 133) and TLS (LayerTypeTLS, id 140) at v1.5.0, but port-based `Rule` matching is the correct and simpler approach for all v1.2 protocols — using native layer decoders would add code paths without classification benefit, since port numbers are unambiguous for every protocol in scope.
-**Core technologies:**
+**Core technologies (unchanged from v1.1):**
- `github.com/gopacket/gopacket` v1.5.0 — packet decode — only maintained Go packet library, Go 1.24+
+- `gopacket/gopacket v1.5.0`: Packet capture and protocol layer decoding — community fork, actively maintained, Go 1.24+
- `github.com/packetcap/go-pcap` — pure-Go live capture backend — no CGo, mmap ring buffer, Linux/macOS
+- `packetcap/go-pcap`: Pure-Go live capture via mmap ring buffer — no CGo, Linux/macOS
- `github.com/sjzar/go-lame` v0.0.9 — MP3 encoding — embeds LAME C source, CGO_ENABLED=1, no system library required
+- `sjzar/go-lame v0.0.9`: MP3 encoding with embedded LAME C source — no system library dependency
- `github.com/spf13/cobra` v1.10.2 — CLI structure and flag handling — industry standard
+- `spf13/cobra v1.10.2`: CLI flags, signal handling, --help generation
- `github.com/BurntSushi/toml` v1.6.0 — TOML config parsing — zero transitive deps, strict-mode via `Undecoded()`
+- `BurntSushi/toml v1.6.0`: TOML config loading with strict unknown-key validation
- Hand-rolled additive oscillator (sine today, square/sawtooth/triangle in v1.1) — no audio library needed
+- Hand-rolled additive synth + EMA: oscillators with bandlimited harmonics, exponential moving average amplitude smoothing per layer
 ### Expected Features
-**Must have (table stakes) for v1.1:**
+**Must have (table stakes for v1.2):**
- TOML config auto-discovery (`./netsynth.toml`, `~/.config/netsynth/config.toml`) — XDG Base Directory Specification standard
+- Mail family: IMAP/IMAPS (TCP 143, 993), POP3/POP3S (TCP 110, 995), SMTP submission (TCP 587, 465) — present on every office and home network
- `--config` flag for explicit path, with hard error if file is absent
+- Remote Access expansion: RDP (TCP 3389), VNC (TCP 5900), Telnet (TCP 23) — completes the SSH family
- Partial override semantics — absent keys retain defaults; users must not replicate the full table to change one field
+- File Transfer family: FTP (TCP 20, 21), SMB (TCP 445), TFTP (UDP 69) — ubiquitous on NAS and Windows networks
- Custom frequency per traffic class — direct override of `synth.ClassFreqConfigs`
+- Infrastructure expansion: mDNS (UDP 5353), SSDP (UDP 1900), SNMP (UDP 161/162), Syslog (UDP 514) — constant background on all LAN segments
- Custom waveform per traffic class — sine/square/sawtooth/triangle selection
+- Database family: MySQL (TCP 3306), PostgreSQL (TCP 5432), Redis (TCP 6379), MongoDB (TCP 27017) — all currently land in other-TCP
- User-defined classification rules with custom class names, prepended before built-in rules
+- Frequency allocation into family bands (group concept expressed via Hz proximity, not a new data structure)
- Startup-time config validation with line-number errors (fail before capture begins, not after)
+- AllClasses() and ClassFreqConfigs updated atomically — existing test `TestNumLayersMatchesAllClasses` enforces this invariant
- Unknown field detection — prevents silent typos (`frequncy` must be caught, not silently ignored)
+- --print-config reflects all new classes, organized with group-header comments
-**Should have (differentiators):**
+**Should have (differentiators for v1.2):**
- `netsynth --print-config` subcommand dumping effective config as commented TOML — critical for discoverability
+- Directory/Auth family: LDAP/LDAPS (TCP 389, 636), Kerberos (UDP/TCP 88) — every enterprise/Windows network
- Named custom rules (display name appears in exit summary and `--verbose` output)
+- VoIP family: SIP/SIP-TLS (UDP/TCP 5060, 5061) — IP phone traffic on office networks
- Clear error message listing valid waveform values on invalid input
+- QUIC/HTTP3 class (UDP 443) — distinct from HTTPS on TCP 443; significant fraction of modern web traffic
 - Within-family waveform consistency: protocols in a family share the same waveform type for timbral family identity
 - Group-header section comments in --print-config output (cosmetic, high value for user discoverability)
 **Defer (v2+):**
- Harmonic override per class (expose `HarmonicDef` slice in TOML) — niche, adds TOML nesting complexity
+- Dynamic port protocols: RTP (negotiated ephemeral ports), FTP data channel — require stateful flow tracking across packets
- Stereo pan position in config — explicitly deferred per project constraints
+- Deep packet inspection for application-layer classification — massive scope, no sonification benefit over port matching
- Config hot-reload during capture — mid-capture state change corrupts synthesis; not worth the complexity
+- Collapsed "Mail" or "Database" class — loses per-protocol identity (can't distinguish IMAP inbound from SMTP outbound)
- Multiple config file includes/inheritance — single file merged with in-code defaults is sufficient
+- MQTT, AMQP, Kafka, BGP, OSPF — IoT/routing protocols absent on general networks; niche
 - Port-range rule support in the Rule struct — needed for RTP; valid v1.3 enhancement
 - Runtime group concept as a data structure — groups emerge from frequency proximity; no struct needed in v1.2
 ### Architecture Approach
-v1.1 adds a `config` package and threads it through the existing pipeline via dependency injection. The key architectural shift: `synth.NewBank` currently reads the package-level global `ClassFreqConfigs`; after v1.1 it accepts a `map[TrafficClass]FreqConfig` parameter, enabling user-defined classes and eliminating hidden global state. The `config` package owns TOML parsing, file discovery, default config wrapping, and merge logic. `classify.DefaultRules` splits into `SpecificRules` + `CatchAllRules` so user rules can be inserted between them. The oscillator gains a `Waveform` enum field with additive-synthesis dispatch. All changes are contained to well-bounded components; `classify/classifier.go` and `encode/mp3.go` change only at their call sites. See `.planning/research/ARCHITECTURE.md` for full data flow diagrams and step-by-step build order.
+The v1.2 architecture is strictly additive to the existing pipeline: `config.Load` → `classify.NewClassifier` → `encode.RunSynthesis` → `synth.NewBank` → MP3. The only new concept is `Group string` on `FreqConfig` in the synth package — this metadata field is used only by `PrintConfig` for section headers and has zero effect on synthesis math. `bank.go`, `encode/mp3.go`, and `main.go` require no changes. Group identity is expressed architecturally through frequency proximity alone: protocols in the same family are assigned `BaseHz` values within a shared band, and within-band detuning of at least a major second interval (ratio 1.122) ensures psychoacoustic distinctness while maintaining timbral family coherence.
-**Major components:**
+**Major components and their v1.2 changes:**
-1. `config/` (new) — TOML struct definitions, `Load()`, auto-discovery via `os.UserConfigDir()`, pointer-field merge, `DefaultConfig()`
+1. `classify/types.go` — new TrafficClass constants + AllClasses() extended in group-coherent order (additive)
-2. `synth/oscillator.go` (modified) — `Waveform` enum, `sampleAt()` dispatch, bandlimited harmonic series generation at config load time
+2. `classify/rules.go` — new Rule entries before catch-alls for all new protocols; multi-port-to-single-class mapping for secure/insecure variants (additive; ordering is critical)
-3. `synth/bank.go` (modified) — accepts freq config map param; iterates map keys, not hardcoded `AllClasses()`
+3. `synth/config.go` — Group field on FreqConfig; new ClassFreqConfigs entries; frequency rebalancing for family bands; NumLayers constant cleanup (highest-risk change due to backward compatibility)
-4. `classify/rules.go` (modified) — split into `SpecificRules` + `CatchAllRules`; `MergeRules(userRules)` export
+4. `config/config.go` — optional group-header comments in PrintConfig (isolated to string output, no behavioral change)
-5. `cmd/netsynth/main.go` (modified) — `--config` flag, `config.Load()`, user rule merge, config forwarded to `RunSynthesis`
+5. `bank.go`, `encode/mp3.go`, `main.go` — no changes required
 **Recommended build order (each step independently testable):**
 1. Test and constant cleanup — remove stale NumLayers/GainPerLayer, update TestFrequenciesInRange bounds
 2. Protocol list and frequency design (no code) — finalize all Hz values in family bands, check ERB constraints
 3. New TrafficClass constants + AllClasses() in classify/types.go
 4. New DefaultRules in classify/rules.go (depends on step 3)
 5. Add Group field to FreqConfig — independent of steps 3/4
 6. Add ClassFreqConfigs entries with finalized frequencies; update autoAssignFreq base
 7. PrintConfig group-header comments (optional polish)
 ### Critical Pitfalls
-1. **TOML decoder zeros absent fields, silently overwriting defaults (Pitfall A1)** — Use pointer fields (`*float64`, `*string`) for all optional overrides in the decoded struct. Apply an explicit merge function that only writes non-nil values over the built-in defaults. Establish this pattern before any config is wired into the bank.
+1. **Frequency rebalancing silently invalidates v1.1 user TOML configs** — Users with explicit Hz overrides will retain stale v1.1 values after rebalancing; users without overrides hear unexplained soundscape changes. Prevention: assign all new protocols to frequency ranges above 1047 Hz (unoccupied by v1.1 built-ins), leaving the 65–1047 Hz existing layout frozen. If existing class frequencies must move, document every Hz change in release notes.
-2. **User rules appended after catch-alls are unreachable (Pitfall A5/A9)** — `DefaultRules` ends with catch-all rules (`DstPort: 0`) that match any TCP/UDP packet. Appending user rules after them makes user rules unreachable. Split into `SpecificRules` + `CatchAllRules`; merge order must be `userRules + SpecificRules + CatchAllRules`.
+2. **autoAssignFreq range [1200, 2350] Hz collision with new built-ins** — If new built-in classes use frequencies in the 1200–2350 Hz auto-assign range, user-defined custom classes can hash to the same frequency silently. Prevention: push autoAssignFreq base above all built-in frequencies (e.g., 4500 Hz) after finalizing v1.2 ClassFreqConfigs. Add a compile-time test asserting no built-in falls in the auto-assign range.
-3. **User-defined classes have no bank layer — panic or silence (Pitfall A6)** — `NewBank` currently iterates `classify.AllClasses()` (a hardcoded list of 14 built-in classes). User classes will not be in that list. `NewBank` must iterate the keys of the merged `FreqConfig` map instead. Validate at config load that every rule's class name resolves to a configured sound entry.
+3. **NumLayers/GainPerLayer exported constant is stale** — bank.go uses `1.0 / float64(len(cfgs))` dynamically; the exported `synth.GainPerLayer` constant is frozen at 14-layer value. Any new v1.2 code referencing `synth.GainPerLayer` will compute wrong gain. Prevention: remove or deprecate the constant before adding any new classes; bank.go's dynamic computation is the sole authoritative source.
-4. **Naive square/sawtooth/triangle waveforms produce audible aliasing (Pitfall A3)** — Direct time-domain math generates infinite harmonics that alias above Nyquist. Use additive synthesis: generate a bandlimited `[]HarmonicDef` series (odd harmonics for square/triangle, all harmonics for sawtooth, truncated at Nyquist) at config load time. The existing `HarmonicDef` infrastructure already supports this approach.
+4. **TestFrequenciesInRange hardcodes [60, 1100] Hz** — CI fails immediately when adding classes above 1100 Hz. Prevention: update the test bounds to the new valid range (e.g., [60, 4000]) before adding any ClassFreqConfigs entries outside the current range. This is a false blocker if not addressed first.
-5. **BurntSushi/toml silently ignores unknown keys by default (Pitfall A2)** — Use `toml.Decode()` (not `Unmarshal`) to obtain `MetaData`, then call `md.Undecoded()` and return an error listing any unrecognized keys. Implement strict decoding from the first config load function.
+5. **Within-family detuning too narrow for psychoacoustic distinctness** — Fixed small Hz steps (e.g., 10 Hz) fall inside the critical band (ERB) at higher frequencies — at 1000 Hz ERB is ~72 Hz; at 2000 Hz it is ~117 Hz. Tones within the critical band merge perceptually. Prevention: use logarithmic interval separations — at minimum a major second (ratio 1.122). Verify all within-family pairs satisfy `|f2 - f1| > ERB(min(f1,f2))` before committing Hz values.
 6. **Three-location atomic update required for each new class** — Adding a protocol requires updating AllClasses(), ClassFreqConfigs, and the TrafficClass constant. Missing any one causes test failures that are diagnostic but confusing. Prevention: update all three in the same commit, or introduce a single `builtinClassDefs` slice that drives both AllClasses() and validates ClassFreqConfigs.
 7. **Secure/insecure protocol variants create frequency overcrowding if treated as separate classes** — SMTP:25, SMTP-submit:587, SMTPS:465 as three classes produces three frequencies where users want one "mail" sound. Prevention: map all ports of a protocol family to a single TrafficClass using multiple Rule entries. Port-to-class is many-to-one within a family.
 ## Implications for Roadmap
-The v1.1 work has clear dependency ordering that directly dictates phase structure. The build order in ARCHITECTURE.md (7 steps, each independently testable) maps naturally to implementation phases.
+Based on the research, v1.2 should follow a 4-phase sequence driven by dependency order and the need to resolve design decisions before code decisions.
-### Phase 1: Waveform Types in the Oscillator
+### Phase 1: Test and Constant Cleanup
-**Rationale:** Zero external dependencies; pure math testable in isolation with golden-sample unit tests. The critical design decision — additive synthesis vs. direct math — must be made and locked in here. Switching after integration is a full oscillator rewrite.
+**Rationale:** Three existing tests and one exported constant actively block v1.2 work if not addressed first. Cleaning these up prevents confusing CI failures throughout the milestone.
-**Delivers:** `Waveform` enum, `sampleAt()` dispatch, `BandlimitedHarmonics()` generator; all four waveform types produce correct, alias-free output at all NetSynth frequencies.
+**Delivers:** Stale NumLayers/GainPerLayer constant removed or deprecated; TestFrequenciesInRange updated to accept new range; TestNumLayersMatchesAllClasses renamed and its invariant documented clearly.
-**Addresses:** Custom waveform per class (table stakes)
+**Addresses:** Pitfalls C3 (stale GainPerLayer), C4 (hardcoded range test blocking correct additions)
-**Avoids:** Pitfall A3 (aliasing from naive waveforms)
+**Avoids:** Wasted debugging time on pre-existing issues presenting as new failures
 **Files changed:** `synth/oscillator.go` only
-### Phase 2: Decouple Bank from Global Config
+### Phase 2: Protocol List and Frequency Design (No Code)
-**Rationale:** Prerequisite for config injection. `NewBank` must accept an injected config map before the `config` package exists. Wiring `Waveform` through `FreqConfig` → `Layer` → `Oscillator` is included here; zero-value default (`WaveformSine = 0`) means existing tests pass unchanged.
+**Rationale:** The frequency allocation must be designed before any ClassFreqConfigs entries are written. Getting this wrong after the fact requires touching every entry. The autoAssignFreq collision and psychoacoustic ERB constraints must be resolved at design time.
-**Delivers:** `NewBank(tau, cfgs map[TrafficClass]FreqConfig)`, `FreqConfig.Waveform` field, `synth/layer.go` updated. System is functionally identical to v1.0 but injectable.
+**Delivers:** Final protocol class list (Tier 1 + Tier 2 from FEATURES.md, multi-port collapsed to single class per family), complete Hz allocation for all ~35 classes in family bands, autoAssignFreq base set above all built-ins, ERB check confirming all within-family pairs are perceptually distinct.
-**Avoids:** Global-read anti-pattern (multiple places reading `ClassFreqConfigs`, ambiguous merge point)
+**Addresses:** Pitfalls C1 (backward compat), C2 (auto-assign collision), C6 (critical band masking), C7 (secure/insecure variant crowding)
-**Files changed:** `synth/config.go`, `synth/layer.go`, `synth/bank.go`, `encode/mp3.go`
+**Avoids:** Frequency rebalancing causing retroactive rework; tone merging within families discovered only during listening tests
-### Phase 3: Config Package — TOML Loading and Merge
+### Phase 3: Classification Layer
-**Rationale:** Core new infrastructure. Builds on the injectable bank signature from Phase 2. All config correctness patterns (pointer fields, strict decode, validation, string normalization) must be established here in isolation before any features are wired to the bank. Retrofitting these patterns after pipeline integration is significantly more expensive.
+**Rationale:** New constants and rules must exist before synth entries can reference them. This phase is purely additive to the classify package with no audio impact — safe to land and test in isolation.
-**Delivers:** `config/` package with `Load()`, `os.UserConfigDir()` discovery, pointer-field merge, `validate()` with string normalization and enum checking, `DefaultConfig()` wrapping existing values.
+**Delivers:** All ~21 new TrafficClass constants, AllClasses() updated in family-grouped order, DefaultRules extended with new port rules (multi-port-to-single-class pattern applied per family).
-**Addresses:** Config auto-discovery, `--config` flag, partial override semantics, unknown field detection, startup validation, clear error messages
+**Addresses:** Protocol coverage table stakes (Mail, Remote Access, File Transfer, Infrastructure, Database, Directory/Auth, VoIP families from FEATURES.md)
-**Avoids:** Pitfalls A1 (zero-value overwrite), A2 (silent typos), A4 (waveform string case), A7 (XDG ignored), A8 (missing explicit path), A10 (empty class name)
+**Avoids:** Pitfall C8 (three-location atomicity — enforced by existing test), Pitfall C9 (range-based protocols like RTP deferred)
 **Uses:** Port-based Rule classification — same pattern as existing SSH/HTTP/DNS rules, no new code paths
-### Phase 4: Classification Rule Merging
+### Phase 4: Synthesis and Config Layer
-**Rationale:** `classify/rules.go` must be split before any config-loading logic references the rule slice. The three-layer merge order is a design decision that, if wrong, produces silent failures with no error messages — it must be validated with unit tests before pipeline integration.
+**Rationale:** ClassFreqConfigs entries depend on both the protocol list from Phase 2 design and the TrafficClass constants from Phase 3. The Group field on FreqConfig and PrintConfig group headers are the final polish on this phase.
-**Delivers:** `classify.SpecificRules`, `classify.CatchAllRules`, `classify.MergeRules(userRules []Rule) []Rule`; user rules prepend correctly with both catch-all and specific-rule ordering.
+**Delivers:** All new FreqConfig entries with finalized frequencies from Phase 2; Group field added to FreqConfig; autoAssignFreq base updated and compile-time range test added; optional PrintConfig group-header section comments.
-**Avoids:** Pitfall A5 (unreachable rules after catch-alls), Pitfall A9 (user rule shadowed by built-in specific rule for same port)
+**Addresses:** Table stakes (--print-config reflects new classes); differentiators (within-family tonal design, group headers)
-
+**Avoids:** Pitfall C2 (confirmed by new compile-time test), Pitfall C5 (no new TOML top-level keys since groups are not user-configurable)
-### Phase 5: Wire Config Through Pipeline — Frequency and Waveform Overrides
+**Manual validation required:** A listening test with a real or synthetic pcap file is needed after this phase — automated tests cannot substitute for ear confirmation that family identity is perceptually clear.
 **Rationale:** Connects the config package to the synth layer for built-in classes only. Validates the full pipeline end-to-end before adding the complexity of user-defined classes. `encode.RunSynthesis` signature change is a breaking API change — all call sites must be updated in a single commit.
 **Delivers:** `--config` cobra flag, `config.Load()` in `main.go`, merged freq config map passed to `RunSynthesis` and `NewBank`; end-to-end test: TOML sets HTTPS to 200 Hz sawtooth, bank produces 200 Hz sawtooth layer.
 **Implements:** Config → synth integration
 ### Phase 6: User-Defined Classes End-to-End
 **Rationale:** The most complex integration; requires all prior phases. User-defined classes create new `TrafficClass` strings that must exist in both the merged rule set and the bank's layer map. The AllClasses() decoupling from Phase 2 makes this tractable.
 **Delivers:** `[[rules]]` TOML section, dynamic `TrafficClass` values from config, bank layers constructed from merged FreqConfig map keys, class name cross-validation at config load.
 **Avoids:** Pitfall A6 (user-defined class has no bank layer — nil panic or silence)
 ### Phase 7: Print-Config and UX Polish
 **Rationale:** `--print-config` is independent of capture and must wait until all config structure is stable (Phase 6). Additive, zero regression risk.
 **Delivers:** `netsynth --print-config` subcommand with commented TOML output of effective config; optional `name` field on user rules displayed in exit summary.
 ### Phase Ordering Rationale
- Phases 1–2 are internal refactors with no user-visible change — the right starting point for establishing patterns safely
+- Phase 1 before everything because pre-existing test blockers cause false CI failures throughout the milestone
- Phase 3 owns all config safety in one isolated package before anything is wired — retrofitting pointer-field merge after bank integration means touching multiple packages simultaneously
+- Phase 2 (design) before code because Hz allocation is the hardest-to-change decision with the broadest blast radius; fixing retroactively touches every ClassFreqConfigs entry
- Phase 4 (rule splitting) must precede Phase 6 (user rules) or catch-all ordering bugs surface silently at integration with no clear failure signal
+- Phase 3 before Phase 4 because TrafficClass constants must exist before ClassFreqConfigs can reference them
- Phase 5 validates the full pipeline with familiar built-in classes before Phase 6 introduces the harder user-defined class problem
+- Phase 4 is last because it depends on both the design (Phase 2) and the constants (Phase 3)
 - Phase 7 is pure additive polish with zero risk of breaking earlier phases
 ### Research Flags
-Phases with well-documented patterns — skip additional research:
+Phases with well-documented patterns (no additional research needed):
- **Phase 1:** DSP textbook math; harmonic series are fully specified
+- **Phase 1:** Straightforward constant and test cleanup; all relevant code is in the existing codebase
- **Phase 2:** Standard dependency injection refactor; no unknowns
+- **Phase 3:** Port rules follow the exact same pattern as existing SSH/HTTP/DNS rules; no new patterns or unknowns
- **Phase 3:** BurntSushi/toml API is well-documented; pointer-field merge is a known TOML pattern
+- **Phase 4:** FreqConfig additions follow the exact same pattern as existing entries; the Group field is a non-functional metadata addition
 - **Phase 4:** Simple slice manipulation; no external dependencies
 - **Phase 7:** Cobra subcommand and TOML marshal are standard patterns
-Phases that may benefit from a targeted research pass or design review:
+Phases that require design validation:
- **Phase 5:** `encode.RunSynthesis` signature change is a breaking API change — verify all test call sites and plan a single-commit update
+- **Phase 2:** The frequency allocation should be validated with a listening test on a real pcap file before committing to final Hz values. The ERB computations are straightforward math; the perceptual result requires ear confirmation. This is inherent to audio design work.
 - **Phase 6:** User-defined class name collision with built-in `TrafficClass` string values (e.g., user names a class `"HTTPS"`) requires a design decision: treat as override of built-in sound vs. reject as ambiguous. Not resolved in research; decide before coding Phase 6.
 ## Confidence Assessment
 | Area | Confidence | Notes |
 |------|------------|-------|
-| Stack | HIGH | Existing stack validated in v1.0; BurntSushi/toml v1.6.0 confirmed via pkg.go.dev and GitHub releases; `os.UserConfigDir()` XDG behavior confirmed against official Go stdlib docs |
+| Stack | HIGH | Validated against shipped v1.1 codebase; no new dependencies; gopacket layer types confirmed via direct GitHub source inspection |
-| Features | HIGH | Config file conventions verified against XDG spec, git, golangci-lint, and mise patterns; TOML schema grounded in existing v1.0 codebase types |
+| Features | MEDIUM-HIGH | Protocol selection based on IANA port registry, nDPI taxonomy, Wireshark dissectors; real-world traffic frequency is inference, not measurement |
-| Architecture | HIGH | Based on direct code inspection of the 3,254-line v1.0 codebase; all integration points identified with specific file/line references and build order prescribed |
+| Architecture | HIGH | Derived from direct inspection of shipped v1.1 code (~4,675 lines); all integration points identified with specific file references and build order |
-| Pitfalls | HIGH | TOML default-overwrite behavior verified against upstream issue trackers (BurntSushi/toml #47, go-toml #252); aliasing prevention verified against DSP literature (CCRMA paper, McGill bandlimited synthesis notes) |
+| Pitfalls | HIGH | All critical pitfalls grounded in specific code locations (config.go merge(), bank.go gainPerLayer, synth/config_test.go assertions); audio masking values from Glasberg & Moore 1990 ERB model |
-**Overall confidence:** HIGH
+**Overall confidence: HIGH**
 ### Gaps to Address
- **User class name collision with built-in class strings:** If a user writes `class = "HTTPS"` in a `[[rules]]` block, the intent could be "override built-in sound" or "create a parallel custom class." The merge logic needs an explicit decision before Phase 6: treat matching names as overrides (simplest) or require a separate TOML section. This is a UX design question — resolve before coding Phase 6.
+- **Frequency allocation requires listening validation:** No automated test replaces ear-testing. Plan a listening session with a diverse pcap file after Phase 4 before declaring the milestone complete.
- **BurntSushi/toml vs. go-toml v2:** Both work for this use case. BurntSushi is recommended for ergonomics, but if the team prefers go-toml v2's `DisallowUnknownFields()` pattern, it is equally valid with minor API differences. Either choice is fine; just make one and be consistent.
+- **Protocol frequency on real networks:** Tier 1/2 ranking is based on typical network types, not measurement on the target user's actual network. mDNS and SSDP are prominent on home/office LANs but absent on cloud workloads. The catch-all classes handle unrecognized traffic regardless, so this is a coverage quality concern, not a correctness concern.
 - **Rule schema for range-based protocols:** RTP and NetBIOS (multi-port, non-contiguous) are explicitly deferred. If desired in v1.3+, the Rule struct needs `DstPortMin/Max` fields — a known future gap, not a v1.2 concern.
 ## Sources
 ### Primary (HIGH confidence)
-
+- `github.com/gopacket/gopacket/blob/master/layers/layertypes.go` — LayerTypeSIP (id 133), LayerTypeTLS (id 140) confirmed at v1.5.0
- Direct code inspection: `synth/config.go`, `synth/oscillator.go`, `synth/bank.go`, `synth/layer.go`, `classify/classifier.go`, `classify/rules.go`, `classify/types.go`, `encode/mp3.go`, `cmd/netsynth/main.go`
+- `github.com/gopacket/gopacket/blob/master/layers/ports.go` — UDP/TCP port pre-registration confirmed; mDNS/SNMP/QUIC absent
- `pkg.go.dev/github.com/BurntSushi/toml` — v1.6.0 API, `Undecoded()` strict mode, pointer field behavior
+- `github.com/gopacket/gopacket/tree/master/layers` — directory listing; no mdns.go, quic.go, snmp.go, ldap.go, smb.go, rdp.go
- `github.com/BurntSushi/toml/issues/47` — default-overwrite behavior when using `Unmarshal` confirmed
+- Direct codebase inspection: `synth/config.go`, `synth/bank.go`, `classify/types.go`, `classify/rules.go`, `classify/classifier.go`, `config/config.go`, `encode/mp3.go`, `cmd/netsynth/main.go`
- `pkg.go.dev/os#UserConfigDir` — XDG_CONFIG_HOME behavior on Linux confirmed via official Go stdlib docs
+- Glasberg & Moore 1990 ERB model: `ERB(f) = 24.7 * (4.37 * f/1000 + 1)` — critical bandwidth values for all relevant frequencies
 - `ccrma.stanford.edu/~stilti/papers/blit.pdf` — bandlimited synthesis theory (alias-free waveforms)
 - `music.mcgill.ca/~gary/307/week5/bandlimited.html` — truncated harmonic series approach confirmed
 ### Secondary (MEDIUM confidence)
-
+- IANA Service Name and Transport Protocol Port Number Registry — authoritative port assignments for all new protocols
- XDG Base Directory Specification — config discovery precedence order
+- nDPI Protocols List (ntop) — 450+ protocol taxonomy; 17-category grouping model as design precedent
- `mise.jdx.dev/configuration.html` — working-dir + XDG config discovery pattern
+- nDPI 5.0 Enhanced Traffic Fingerprinting blog post — category-based grouping confirmed as production approach
- `golangci-lint.run/docs/configuration/cli/` — partial override config in Go CLI tools
+- SoNSTAR: Sonification of Network Traffic (Paul Vickers) — academic network sonification reference
- `dylanmeeus.github.io/posts/audio-from-scratch-pt8/` — Go waveform synthesis from scratch, confirms no library needed
+- Sonification of network traffic flow (PLoS One 2018) — research on perceptually useful protocol groupings
 - `pkg.go.dev/github.com/pelletier/go-toml/v2` — v2.3.0 strict decoder comparison; `pelletier/go-toml/issues/252` partial v2 resolution of default-overwrite
 ### Tertiary (LOW confidence)
-
+- Protocol prevalence on "typical" networks (home/office/server/cloud) — inferred from nDPI taxonomy and Wireshark dissector popularity; not empirically measured on target networks
 - Competitor feature table (SoNSTAR, Network-Sonification, Peep) — niche domain, limited documentation; used for context only, not binding decisions
 ---
-*Research completed: 2026-03-26*
+*Research completed: 2026-03-27*
 *Ready for roadmap: yes*
@@ -2,7 +2,7 @@
 **Turn network traffic into ambient sound.**
-NetSynth captures live network traffic (or reads pcap files), classifies packets by protocol, and synthesizes an ambient MP3 soundscape where each traffic type produces a distinct harmonic drone. A ping sounds different from HTTPS noise, which sounds different from a port scan.
+NetSynth captures live network traffic (or reads pcap files), classifies packets into 35 protocol families, and synthesizes an ambient MP3 soundscape where each traffic type produces a distinct harmonic drone. A ping sounds different from HTTPS noise, which sounds different from a port scan.
 Run it, let it listen, press Ctrl+C, get an audio fingerprint of your network.
@@ -133,7 +133,19 @@ waveform = "square"
 ### Available Traffic Classes
-`ICMP`, `DNS`, `HTTPS`, `HTTP`, `SSH`, `SMTP`, `NTP`, `DHCP`, `OtherTCP`, `OtherUDP`, `Unknown1`, `Unknown2`, `Unknown3`, `Unknown4`
+35 built-in classes organized by protocol family:
 | Family | Classes |
 |--------|---------|
 | Infrastructure | `ICMP`, `DNS`, `NTP`, `DHCP`, `mDNS`, `SSDP`, `SNMP`, `LDAP`, `Kerberos`, `Syslog` |
 | Web | `HTTPS`, `HTTP`, `QUIC` |
 | Mail | `SMTP`, `IMAP`, `POP3`, `SMTP-Sub` |
 | Remote Access | `SSH`, `RDP`, `Telnet`, `VNC` |
 | File Transfer | `FTP`, `SMB`, `TFTP` |
 | Database | `MySQL`, `PostgreSQL`, `Redis`, `MongoDB` |
 | Discovery | `mDNS`, `SSDP`, `SNMP` |
 | VoIP | `SIP` |
 | Unknown | `OtherTCP`, `OtherUDP`, `Unknown1`-`Unknown4` |
 ### Available Waveforms
@@ -168,7 +180,7 @@ frequency = 1500.0
 waveform = "sawtooth"
 ```
-Custom classes that don't have a `[sounds.*]` entry automatically get a unique frequency in the 1200-2350 Hz range.
+Custom classes that don't have a `[sounds.*]` entry automatically get a unique frequency in the 2500-4000 Hz range.
 ### Print Config
@@ -185,7 +197,19 @@ netsynth --config my-sounds.toml --print-config
 netsynth --print-config > template.toml
 ```
-The output includes `(default)`, `(override)`, and `(auto-assigned)` annotations so you can see what's customized.
+The output includes `(default)`, `(override)`, and `(auto-assigned)` annotations so you can see what's customized. Classes are grouped by protocol family with section headers.
 ### Group Reassignment
 You can reassign protocols to different sound families using the `[groups]` table:
 ```toml
 [groups]
 DNS = "Web"          # Move DNS from Infrastructure to Web family
 SIP = "Infrastructure"  # Move SIP from VoIP to Infrastructure
 ```
 Reassigned protocols inherit the waveform character of their new family in `--print-config` output.
 ### Validation
@@ -203,7 +227,7 @@ Capture -> Classify -> Aggregate -> Synthesize -> MP3
 1. **Capture** — Packets are read from a live interface (via [go-pcap](https://github.com/packetcap/go-pcap)) or a pcap file. Optional BPF filtering reduces the stream to traffic of interest.
-2. **Classify** — Each packet is matched against protocol rules (ICMP, DNS, HTTPS, SSH, HTTP, SMTP, NTP, DHCP, etc.) plus any user-defined rules from the config file. User rules fire first. Unrecognized traffic is deterministically hash-bucketed into 4 "unknown" classes so it still produces distinct sounds.
+2. **Classify** — Each packet is matched against 35 built-in protocol rules across 9 families (Infrastructure, Web, Mail, Remote Access, File Transfer, Database, Discovery, VoIP) plus any user-defined rules from the config file. User rules fire first. Unrecognized traffic is deterministically hash-bucketed into 4 "unknown" classes so it still produces distinct sounds.
 3. **Aggregate** — Classified packets are grouped into 500ms time windows. Each window records per-protocol packet counts that drive synthesis amplitudes.
@@ -211,21 +235,21 @@ Capture -> Classify -> Aggregate -> Synthesize -> MP3
 ### Sound Design
-| Traffic Class | Frequency | Character |
+Protocols are grouped into families that share a waveform type and frequency register, making related traffic sound cohesive while remaining distinguishable. Frequencies follow a major-second ladder within each family.
 |--------------|-----------|-----------|
 | ICMP (Ping) | 65 Hz | Deep, distinctive ping tone |
 | DNS | 110 Hz | Quick lookup sound |
 | HTTPS/TLS | 175 Hz | Steady drone (bulk traffic) |
 | HTTP | 220 Hz | Warm web traffic hum |
 | SSH | 330 Hz | Distinct interactive tone |
 | SMTP | 440 Hz | Mail delivery tone |
 | NTP | 520 Hz | Time sync pulse |
 | DHCP | 600 Hz | Network setup sound |
 | Other TCP | 700 Hz | Generic TCP hum |
 | Other UDP | 780 Hz | Generic UDP hum |
 | Unknown 1-4 | 862–1047 Hz | Dissonant, attention-grabbing |
-Sustained traffic sounds louder; quiet periods fade to silence. The result is a unique audio fingerprint of your network activity. All frequencies and waveforms can be overridden via the [config file](#custom-sound-configuration).
+| Family | Waveform | Frequency Range | Protocols |
 |--------|----------|----------------|-----------|
 | Infrastructure | Triangle | 65-133 Hz | ICMP, NTP, DHCP, mDNS, SSDP, SNMP, DNS |
 | Web | Sawtooth | 150-190 Hz | HTTPS, HTTP, QUIC |
 | Mail | Triangle | 214-305 Hz | SMTP, IMAP, POP3, SMTP-Sub |
 | Remote Access | Square | 343-485 Hz | SSH, RDP, Telnet, VNC |
 | File Transfer | Square | 545-687 Hz | FTP, SMB, TFTP |
 | Unknown | Custom | 771-1375 Hz | Unknown1-4, OtherTCP, OtherUDP |
 | Database | Sawtooth | 1543-2182 Hz | MySQL, PostgreSQL, Redis, MongoDB |
 | VoIP | Sine | 2449 Hz | SIP |
 | Infrastructure (ext.) | Triangle | 2950-3250 Hz | LDAP, Kerberos, Syslog |
 Sustained traffic sounds louder; quiet periods fade to silence. The result is a unique audio fingerprint of your network activity. All frequencies, waveforms, and group assignments can be overridden via the [config file](#custom-sound-configuration).
 ## Project Structure
@@ -226,6 +226,218 @@ func TestClassify(t *testing.T) {
 		}
 	})
 	// --- Mail (PROTO-01) ---
 	t.Run("TestClassifyIMAP_port143", func(t *testing.T) {
 		pkt := buildTCPPacket(t, 143)
 		got := c.Classify(pkt)
 		if got.Class != classify.ClassIMAP {
 			t.Errorf("IMAP port 143: got class %q, want %q", got.Class, classify.ClassIMAP)
 		}
 	})
 	t.Run("TestClassifyIMAP_port993", func(t *testing.T) {
 		pkt := buildTCPPacket(t, 993)
 		got := c.Classify(pkt)
 		if got.Class != classify.ClassIMAP {
 			t.Errorf("IMAPS port 993: got class %q, want %q", got.Class, classify.ClassIMAP)
 		}
 	})
 	t.Run("TestClassifyPOP3_port110", func(t *testing.T) {
 		pkt := buildTCPPacket(t, 110)
 		got := c.Classify(pkt)
 		if got.Class != classify.ClassPOP3 {
 			t.Errorf("POP3 port 110: got class %q, want %q", got.Class, classify.ClassPOP3)
 		}
 	})
 	t.Run("TestClassifyPOP3_port995", func(t *testing.T) {
 		pkt := buildTCPPacket(t, 995)
 		got := c.Classify(pkt)
 		if got.Class != classify.ClassPOP3 {
 			t.Errorf("POP3S port 995: got class %q, want %q", got.Class, classify.ClassPOP3)
 		}
 	})
 	t.Run("TestClassifySMTPSub_port587", func(t *testing.T) {
 		pkt := buildTCPPacket(t, 587)
 		got := c.Classify(pkt)
 		if got.Class != classify.ClassSMTPSub {
 			t.Errorf("SMTP-sub port 587: got class %q, want %q", got.Class, classify.ClassSMTPSub)
 		}
 	})
 	// --- File Transfer (PROTO-02) ---
 	t.Run("TestClassifyFTP_port20", func(t *testing.T) {
 		pkt := buildTCPPacket(t, 20)
 		got := c.Classify(pkt)
 		if got.Class != classify.ClassFTP {
 			t.Errorf("FTP data port 20: got class %q, want %q", got.Class, classify.ClassFTP)
 		}
 	})
 	t.Run("TestClassifyFTP_port21", func(t *testing.T) {
 		pkt := buildTCPPacket(t, 21)
 		got := c.Classify(pkt)
 		if got.Class != classify.ClassFTP {
 			t.Errorf("FTP control port 21: got class %q, want %q", got.Class, classify.ClassFTP)
 		}
 	})
 	t.Run("TestClassifySMB_port445", func(t *testing.T) {
 		pkt := buildTCPPacket(t, 445)
 		got := c.Classify(pkt)
 		if got.Class != classify.ClassSMB {
 			t.Errorf("SMB port 445: got class %q, want %q", got.Class, classify.ClassSMB)
 		}
 	})
 	t.Run("TestClassifyTFTP_port69", func(t *testing.T) {
 		pkt := buildUDPPacket(t, 69)
 		got := c.Classify(pkt)
 		if got.Class != classify.ClassTFTP {
 			t.Errorf("TFTP port 69: got class %q, want %q", got.Class, classify.ClassTFTP)
 		}
 	})
 	// --- Remote Access (PROTO-03) ---
 	t.Run("TestClassifyRDP_port3389", func(t *testing.T) {
 		pkt := buildTCPPacket(t, 3389)
 		got := c.Classify(pkt)
 		if got.Class != classify.ClassRDP {
 			t.Errorf("RDP port 3389: got class %q, want %q", got.Class, classify.ClassRDP)
 		}
 	})
 	t.Run("TestClassifyTelnet_port23", func(t *testing.T) {
 		pkt := buildTCPPacket(t, 23)
 		got := c.Classify(pkt)
 		if got.Class != classify.ClassTelnet {
 			t.Errorf("Telnet port 23: got class %q, want %q", got.Class, classify.ClassTelnet)
 		}
 	})
 	t.Run("TestClassifyVNC_port5900", func(t *testing.T) {
 		pkt := buildTCPPacket(t, 5900)
 		got := c.Classify(pkt)
 		if got.Class != classify.ClassVNC {
 			t.Errorf("VNC port 5900: got class %q, want %q", got.Class, classify.ClassVNC)
 		}
 	})
 	// --- Database (PROTO-04) ---
 	t.Run("TestClassifyMySQL_port3306", func(t *testing.T) {
 		pkt := buildTCPPacket(t, 3306)
 		got := c.Classify(pkt)
 		if got.Class != classify.ClassMySQL {
 			t.Errorf("MySQL port 3306: got class %q, want %q", got.Class, classify.ClassMySQL)
 		}
 	})
 	t.Run("TestClassifyPostgreSQL_port5432", func(t *testing.T) {
 		pkt := buildTCPPacket(t, 5432)
 		got := c.Classify(pkt)
 		if got.Class != classify.ClassPostgreSQL {
 			t.Errorf("PostgreSQL port 5432: got class %q, want %q", got.Class, classify.ClassPostgreSQL)
 		}
 	})
 	t.Run("TestClassifyRedis_port6379", func(t *testing.T) {
 		pkt := buildTCPPacket(t, 6379)
 		got := c.Classify(pkt)
 		if got.Class != classify.ClassRedis {
 			t.Errorf("Redis port 6379: got class %q, want %q", got.Class, classify.ClassRedis)
 		}
 	})
 	t.Run("TestClassifyMongoDB_port27017", func(t *testing.T) {
 		pkt := buildTCPPacket(t, 27017)
 		got := c.Classify(pkt)
 		if got.Class != classify.ClassMongoDB {
 			t.Errorf("MongoDB port 27017: got class %q, want %q", got.Class, classify.ClassMongoDB)
 		}
 	})
 	// --- Discovery (PROTO-05) ---
 	t.Run("TestClassifyMDNS_port5353", func(t *testing.T) {
 		pkt := buildUDPPacket(t, 5353)
 		got := c.Classify(pkt)
 		if got.Class != classify.ClassMDNS {
 			t.Errorf("mDNS port 5353: got class %q, want %q", got.Class, classify.ClassMDNS)
 		}
 	})
 	t.Run("TestClassifySDP_port1900", func(t *testing.T) {
 		pkt := buildUDPPacket(t, 1900)
 		got := c.Classify(pkt)
 		if got.Class != classify.ClassSSDP {
 			t.Errorf("SSDP port 1900: got class %q, want %q", got.Class, classify.ClassSSDP)
 		}
 	})
 	t.Run("TestClassifySNMP_port161", func(t *testing.T) {
 		pkt := buildUDPPacket(t, 161)
 		got := c.Classify(pkt)
 		if got.Class != classify.ClassSNMP {
 			t.Errorf("SNMP port 161: got class %q, want %q", got.Class, classify.ClassSNMP)
 		}
 	})
 	t.Run("TestClassifySNMP_port162", func(t *testing.T) {
 		pkt := buildUDPPacket(t, 162)
 		got := c.Classify(pkt)
 		if got.Class != classify.ClassSNMP {
 			t.Errorf("SNMP-trap port 162: got class %q, want %q", got.Class, classify.ClassSNMP)
 		}
 	})
 	// --- VoIP (PROTO-06) --- SIP runs on both TCP and UDP
 	t.Run("TestClassifySIP_TCP5060", func(t *testing.T) {
 		pkt := buildTCPPacket(t, 5060)
 		got := c.Classify(pkt)
 		if got.Class != classify.ClassSIP {
 			t.Errorf("SIP TCP 5060: got class %q, want %q", got.Class, classify.ClassSIP)
 		}
 	})
 	t.Run("TestClassifySIP_UDP5060", func(t *testing.T) {
 		pkt := buildUDPPacket(t, 5060)
 		got := c.Classify(pkt)
 		if got.Class != classify.ClassSIP {
 			t.Errorf("SIP UDP 5060: got class %q, want %q", got.Class, classify.ClassSIP)
 		}
 	})
 	// --- Web extension (PROTO-07) --- QUIC is UDP 443, must NOT match HTTPS (TCP 443)
 	t.Run("TestClassifyQUIC_UDP443", func(t *testing.T) {
 		pkt := buildUDPPacket(t, 443)
 		got := c.Classify(pkt)
 		if got.Class != classify.ClassQUIC {
 			t.Errorf("QUIC UDP 443: got class %q, want %q", got.Class, classify.ClassQUIC)
 		}
 	})
 	// --- Infrastructure extension (PROTO-08) ---
 	t.Run("TestClassifyLDAP_port389", func(t *testing.T) {
 		pkt := buildTCPPacket(t, 389)
 		got := c.Classify(pkt)
 		if got.Class != classify.ClassLDAP {
 			t.Errorf("LDAP port 389: got class %q, want %q", got.Class, classify.ClassLDAP)
 		}
 	})
 	t.Run("TestClassifyLDAP_port636", func(t *testing.T) {
 		pkt := buildTCPPacket(t, 636)
 		got := c.Classify(pkt)
 		if got.Class != classify.ClassLDAP {
 			t.Errorf("LDAPS port 636: got class %q, want %q", got.Class, classify.ClassLDAP)
 		}
 	})
 	t.Run("TestClassifyKerberos_TCP88", func(t *testing.T) {
 		pkt := buildTCPPacket(t, 88)
 		got := c.Classify(pkt)
 		if got.Class != classify.ClassKerberos {
 			t.Errorf("Kerberos TCP 88: got class %q, want %q", got.Class, classify.ClassKerberos)
 		}
 	})
 	t.Run("TestClassifyKerberos_UDP88", func(t *testing.T) {
 		pkt := buildUDPPacket(t, 88)
 		got := c.Classify(pkt)
 		if got.Class != classify.ClassKerberos {
 			t.Errorf("Kerberos UDP 88: got class %q, want %q", got.Class, classify.ClassKerberos)
 		}
 	})
 	t.Run("TestClassifySyslog_port514", func(t *testing.T) {
 		pkt := buildUDPPacket(t, 514)
 		got := c.Classify(pkt)
 		if got.Class != classify.ClassSyslog {
 			t.Errorf("Syslog port 514: got class %q, want %q", got.Class, classify.ClassSyslog)
 		}
 	})
 	t.Run("TestRulesAreOrderDependent", func(t *testing.T) {
 		// A rule list where TCP port 443 maps to ClassHTTP (wrong) placed first,
 		// then ClassHTTPS. The first matching rule should win.
@@ -245,8 +457,8 @@ func TestClassify(t *testing.T) {
 func TestAllClassesCount(t *testing.T) {
 	classes := classify.AllClasses()
-	if len(classes) != 14 {
+	if len(classes) != 35 {
-		t.Errorf("AllClasses() returned %d classes, want 14", len(classes))
+		t.Errorf("AllClasses() returned %d classes, want 35", len(classes))
 	}
 	// No plain "unknown" should exist
 	for _, c := range classes {
@@ -11,18 +11,68 @@ type Rule struct {
 // DefaultRules is the D-01 protocol map — ordered, first-match-wins.
 // Per D-02: config-driven slice, not a switch statement.
 // 42 rules total: 12 existing + 30 new (PROTO-01 through PROTO-08).
 // Catch-all rules (DstPort: 0) MUST remain as the final two entries (D-06).
 var DefaultRules = []Rule{
 	// --- Infrastructure ---
 	{Protocol: "icmp", DstPort: 0, Class: ClassICMP},
 	{Protocol: "udp", DstPort: 53, Class: ClassDNS},
 	{Protocol: "tcp", DstPort: 53, Class: ClassDNS},
 	{Protocol: "tcp", DstPort: 443, Class: ClassHTTPS},
 	{Protocol: "tcp", DstPort: 80, Class: ClassHTTP},
 	{Protocol: "tcp", DstPort: 22, Class: ClassSSH},
 	{Protocol: "tcp", DstPort: 25, Class: ClassSMTP},
 	{Protocol: "udp", DstPort: 123, Class: ClassNTP},
 	{Protocol: "udp", DstPort: 67, Class: ClassDHCP},
 	{Protocol: "udp", DstPort: 68, Class: ClassDHCP},
-	// Catch-alls (must be last):
+
 	// --- Discovery (PROTO-05) ---
 	{Protocol: "udp", DstPort: 5353, Class: ClassMDNS},
 	{Protocol: "udp", DstPort: 1900, Class: ClassSSDP},
 	{Protocol: "udp", DstPort: 161, Class: ClassSNMP},
 	{Protocol: "udp", DstPort: 162, Class: ClassSNMP},
 	// --- Web (existing + PROTO-07) ---
 	{Protocol: "tcp", DstPort: 443, Class: ClassHTTPS},
 	{Protocol: "udp", DstPort: 443, Class: ClassQUIC}, // PROTO-07: must use "udp", NOT "tcp"
 	{Protocol: "tcp", DstPort: 80, Class: ClassHTTP},
 	// --- Mail (existing SMTP + PROTO-01) ---
 	{Protocol: "tcp", DstPort: 25, Class: ClassSMTP},
 	{Protocol: "tcp", DstPort: 143, Class: ClassIMAP},    // D-03: IMAP plain
 	{Protocol: "tcp", DstPort: 993, Class: ClassIMAP},    // D-03: IMAPS
 	{Protocol: "tcp", DstPort: 110, Class: ClassPOP3},    // D-03: POP3 plain
 	{Protocol: "tcp", DstPort: 995, Class: ClassPOP3},    // D-03: POP3S
 	{Protocol: "tcp", DstPort: 587, Class: ClassSMTPSub}, // D-04: separate from SMTP
 	// --- Remote Access (existing SSH + PROTO-03) ---
 	{Protocol: "tcp", DstPort: 22, Class: ClassSSH},
 	{Protocol: "tcp", DstPort: 3389, Class: ClassRDP},
 	{Protocol: "tcp", DstPort: 23, Class: ClassTelnet},
 	{Protocol: "tcp", DstPort: 5900, Class: ClassVNC},
 	// --- File Transfer (PROTO-02) ---
 	{Protocol: "tcp", DstPort: 20, Class: ClassFTP},  // D-03: FTP data
 	{Protocol: "tcp", DstPort: 21, Class: ClassFTP},  // D-03: FTP control
 	{Protocol: "tcp", DstPort: 445, Class: ClassSMB},
 	{Protocol: "udp", DstPort: 69, Class: ClassTFTP},
 	// --- Database (PROTO-04) ---
 	{Protocol: "tcp", DstPort: 3306, Class: ClassMySQL},
 	{Protocol: "tcp", DstPort: 5432, Class: ClassPostgreSQL},
 	{Protocol: "tcp", DstPort: 6379, Class: ClassRedis},
 	{Protocol: "tcp", DstPort: 27017, Class: ClassMongoDB},
 	// --- VoIP (PROTO-06) ---
 	{Protocol: "tcp", DstPort: 5060, Class: ClassSIP}, // D-03: SIP plain TCP
 	{Protocol: "tcp", DstPort: 5061, Class: ClassSIP}, // D-03: SIPS TCP
 	{Protocol: "udp", DstPort: 5060, Class: ClassSIP}, // D-03: SIP plain UDP
 	{Protocol: "udp", DstPort: 5061, Class: ClassSIP}, // D-03: SIPS UDP
 	// --- Infrastructure extension (PROTO-08, D-01) ---
 	{Protocol: "tcp", DstPort: 389, Class: ClassLDAP},  // D-03: LDAP plain
 	{Protocol: "tcp", DstPort: 636, Class: ClassLDAP},  // D-03: LDAPS
 	{Protocol: "tcp", DstPort: 88, Class: ClassKerberos},
 	{Protocol: "udp", DstPort: 88, Class: ClassKerberos},
 	{Protocol: "udp", DstPort: 514, Class: ClassSyslog},
 	// Catch-alls (must be last — D-06):
 	{Protocol: "tcp", DstPort: 0, Class: ClassOtherTCP},
 	{Protocol: "udp", DstPort: 0, Class: ClassOtherUDP},
 }
@@ -21,14 +21,67 @@ const (
 	ClassUnknown2 TrafficClass = "unknown-2"
 	ClassUnknown3 TrafficClass = "unknown-3"
 	ClassUnknown4 TrafficClass = "unknown-4"
 	// --- Mail (PROTO-01) ---
 	ClassIMAP    TrafficClass = "IMAP"
 	ClassPOP3    TrafficClass = "POP3"
 	ClassSMTPSub TrafficClass = "SMTP-sub" // D-04: separate from ClassSMTP (port 25)
 	// --- File Transfer (PROTO-02) ---
 	ClassFTP  TrafficClass = "FTP"
 	ClassSMB  TrafficClass = "SMB"
 	ClassTFTP TrafficClass = "TFTP"
 	// --- Remote Access (PROTO-03) ---
 	ClassRDP    TrafficClass = "RDP"
 	ClassTelnet TrafficClass = "Telnet"
 	ClassVNC    TrafficClass = "VNC"
 	// --- Database (PROTO-04) ---
 	ClassMySQL      TrafficClass = "MySQL"
 	ClassPostgreSQL TrafficClass = "PostgreSQL"
 	ClassRedis      TrafficClass = "Redis"
 	ClassMongoDB    TrafficClass = "MongoDB"
 	// --- Discovery (PROTO-05) ---
 	ClassMDNS TrafficClass = "mDNS"
 	ClassSSDP TrafficClass = "SSDP"
 	ClassSNMP TrafficClass = "SNMP"
 	// --- VoIP (PROTO-06) ---
 	ClassSIP TrafficClass = "SIP"
 	// --- Web extension (PROTO-07) ---
 	ClassQUIC TrafficClass = "QUIC"
 	// --- Infrastructure extension (PROTO-08) ---
 	ClassLDAP     TrafficClass = "LDAP"
 	ClassKerberos TrafficClass = "Kerberos"
 	ClassSyslog   TrafficClass = "Syslog"
 )
 // AllClasses returns all known traffic classes in display order.
 func AllClasses() []TrafficClass {
 	return []TrafficClass{
-		ClassICMP, ClassDNS, ClassHTTPS, ClassHTTP, ClassSSH,
+		// Infrastructure
-		ClassSMTP, ClassNTP, ClassDHCP, ClassOtherTCP, ClassOtherUDP,
+		ClassICMP, ClassDNS, ClassNTP, ClassDHCP,
 		ClassMDNS, ClassSSDP, ClassSNMP,
 		ClassLDAP, ClassKerberos, ClassSyslog,
 		// Web
 		ClassHTTPS, ClassHTTP, ClassQUIC,
 		// Mail
 		ClassSMTP, ClassIMAP, ClassPOP3, ClassSMTPSub,
 		// Remote Access
 		ClassSSH, ClassRDP, ClassTelnet, ClassVNC,
 		// File Transfer
 		ClassFTP, ClassSMB, ClassTFTP,
 		// Database
 		ClassMySQL, ClassPostgreSQL, ClassRedis, ClassMongoDB,
 		// VoIP
 		ClassSIP,
 		// Unknown / catch-all
 		ClassUnknown1, ClassUnknown2, ClassUnknown3, ClassUnknown4,
 		ClassOtherTCP, ClassOtherUDP,
 	}
 }
@@ -38,6 +38,7 @@ type RawRule struct {
 type rawConfig struct {
 	Sounds map[string]SoundOverride `toml:"sounds"`
 	Rules  []RawRule                `toml:"rules"`
 	Groups map[string]string        `toml:"groups"`
 }
 // LoadResult is the return type from Load(). It carries the merged FreqConfig map,
@@ -99,6 +100,7 @@ func Load(configPath string) (LoadResult, error) {
 	// Add auto-freq entries BEFORE merge so that [sounds.X] overrides for user classes apply.
 	addAutoFreqEntries(freqCfgs, userRules, autoClasses)
 	merge(freqCfgs, raw.Sounds)
 	applyGroupOverrides(freqCfgs, raw.Groups)
 	return LoadResult{
 		FreqCfgs:    freqCfgs,
@@ -205,15 +207,15 @@ func convertRules(raw []RawRule) []classify.Rule {
 	return result
 }
-// autoAssignFreq computes a deterministic frequency in [1200, 2350] Hz for a class name
+// autoAssignFreq computes a deterministic frequency in [2500, 4000] Hz for a class name
 // using FNV-32a hashing. Same input always produces the same output.
 func autoAssignFreq(className string) float64 {
 	h := fnv.New32a()
 	h.Write([]byte(className))
 	const (
-		baseHz   = 1200.0
+		baseHz   = 2500.0
 		stepHz   = 50.0
-		numSteps = uint32(24)
+		numSteps = uint32(31) // [2500, 4000] Hz in 50 Hz steps
 	)
 	return baseHz + float64(h.Sum32()%numSteps)*stepHz
 }
@@ -262,6 +264,28 @@ func waveformString(wt synth.WaveformType) string {
 	}
 }
 // applyGroupOverrides overlays [groups] reassignments onto freqCfgs.Group in-place.
 // Unknown class names produce a warning to stderr (D-09).
 // Unknown group names are silently accepted -- users can invent custom groups (D-09).
 func applyGroupOverrides(cfgs map[classify.TrafficClass]synth.FreqConfig, groups map[string]string) {
 	for className, groupName := range groups {
 		cls := classify.TrafficClass(className)
 		cfg, known := cfgs[cls]
 		if !known {
 			fmt.Fprintf(os.Stderr, "Warning: config: [groups]: unknown class %q (ignored)\n", className)
 			continue
 		}
 		cfg.Group = groupName
 		cfgs[cls] = cfg
 	}
 }
 // groupOrder defines the canonical display order for --print-config section headers (D-04).
 var groupOrder = []string{
 	"Infrastructure", "Web", "Mail", "Remote Access",
 	"File Transfer", "Database", "Discovery", "VoIP", "Unknown",
 }
 // PrintConfig returns the effective configuration as commented TOML output.
 // The output includes a header with source path and generation date, an optional
 // [[rules]] section for user-defined rules, and a [sounds.*] section for all
@@ -294,13 +318,85 @@ func PrintConfig(result LoadResult) string {
 		}
 	}
-	// [sounds.*] section — built-in classes first, then user-defined sorted alphabetically
+	// [sounds.*] section — built-in classes grouped by family, then user-defined
 	// Build group -> []TrafficClass index from AllClasses()
 	builtinByGroup := map[string][]classify.TrafficClass{}
 	builtinSet := map[classify.TrafficClass]bool{}
 	for _, cls := range classify.AllClasses() {
 		builtinSet[cls] = true
 		cfg := result.FreqCfgs[cls]
 		grp := cfg.Group
 		builtinByGroup[grp] = append(builtinByGroup[grp], cls)
 	}
-	// Collect user-defined classes (in FreqCfgs but not in AllClasses)
+	// Sort each group by ascending BaseHz (D-05) using result.FreqCfgs (effective Hz, not defaults)
 	for grp := range builtinByGroup {
 		classes := builtinByGroup[grp]
 		sort.Slice(classes, func(i, j int) bool {
 			return result.FreqCfgs[classes[i]].BaseHz < result.FreqCfgs[classes[j]].BaseHz
 		})
 	}
 	// Emit built-in classes grouped with headers (D-04)
 	for _, grp := range groupOrder {
 		classes, ok := builtinByGroup[grp]
 		if !ok || len(classes) == 0 {
 			continue
 		}
 		fmt.Fprintf(&sb, "# %s\n\n", grp)
 		for _, cls := range classes {
 			cfg := result.FreqCfgs[cls]
 			annotation := classAnnotation(cls, cfg, result.AutoClasses)
 			fmt.Fprintf(&sb, "# %s -- %.1f Hz (%s)\n", string(cls), cfg.BaseHz, annotation)
 			fmt.Fprintf(&sb, "[sounds.%s]\n", string(cls))
 			fmt.Fprintf(&sb, "frequency = %.1f\n", cfg.BaseHz)
 			fmt.Fprintf(&sb, "waveform = %q\n", waveformString(cfg.WaveformType))
 			fmt.Fprintf(&sb, "\n")
 		}
 	}
 	// Check for custom groups (from [groups] reassignment) that are not in groupOrder.
 	// For non-canonical group names (user-invented), collect and emit separately.
 	customGroups := map[string][]classify.TrafficClass{}
 	for _, cls := range classify.AllClasses() {
 		cfg := result.FreqCfgs[cls]
 		grp := cfg.Group
 		isCanonical := false
 		for _, cg := range groupOrder {
 			if grp == cg {
 				isCanonical = true
 				break
 			}
 		}
 		if !isCanonical {
 			customGroups[grp] = append(customGroups[grp], cls)
 		}
 	}
 	// Sort and emit custom group sections
 	var customGroupNames []string
 	for grp := range customGroups {
 		customGroupNames = append(customGroupNames, grp)
 	}
 	sort.Strings(customGroupNames)
 	for _, grp := range customGroupNames {
 		classes := customGroups[grp]
 		sort.Slice(classes, func(i, j int) bool {
 			return result.FreqCfgs[classes[i]].BaseHz < result.FreqCfgs[classes[j]].BaseHz
 		})
 		fmt.Fprintf(&sb, "# %s\n\n", grp)
 		for _, cls := range classes {
 			cfg := result.FreqCfgs[cls]
 			annotation := classAnnotation(cls, cfg, result.AutoClasses)
 			fmt.Fprintf(&sb, "# %s -- %.1f Hz (%s)\n", string(cls), cfg.BaseHz, annotation)
 			fmt.Fprintf(&sb, "[sounds.%s]\n", string(cls))
 			fmt.Fprintf(&sb, "frequency = %.1f\n", cfg.BaseHz)
 			fmt.Fprintf(&sb, "waveform = %q\n", waveformString(cfg.WaveformType))
 			fmt.Fprintf(&sb, "\n")
 		}
 	}
 	// Emit user-defined classes (in FreqCfgs but not in AllClasses) under "# User-defined" (D-06)
 	var userClasses []string
 	for cls := range result.FreqCfgs {
 		if !builtinSet[cls] {
@@ -308,28 +404,18 @@ func PrintConfig(result LoadResult) string {
 		}
 	}
 	sort.Strings(userClasses)
-
+	if len(userClasses) > 0 {
-	// Emit built-in classes first
+		fmt.Fprintf(&sb, "# User-defined\n\n")
-	for _, cls := range classify.AllClasses() {
+		for _, clsStr := range userClasses {
-		cfg := result.FreqCfgs[cls]
+			cls := classify.TrafficClass(clsStr)
-		annotation := classAnnotation(cls, cfg, result.AutoClasses)
+			cfg := result.FreqCfgs[cls]
-		fmt.Fprintf(&sb, "# %s -- %.1f Hz (%s)\n", string(cls), cfg.BaseHz, annotation)
+			annotation := classAnnotation(cls, cfg, result.AutoClasses)
-		fmt.Fprintf(&sb, "[sounds.%s]\n", string(cls))
+			fmt.Fprintf(&sb, "# %s -- %.1f Hz (%s)\n", clsStr, cfg.BaseHz, annotation)
-		fmt.Fprintf(&sb, "frequency = %.1f\n", cfg.BaseHz)
+			fmt.Fprintf(&sb, "[sounds.%s]\n", clsStr)
-		fmt.Fprintf(&sb, "waveform = %q\n", waveformString(cfg.WaveformType))
+			fmt.Fprintf(&sb, "frequency = %.1f\n", cfg.BaseHz)
-		fmt.Fprintf(&sb, "\n")
+			fmt.Fprintf(&sb, "waveform = %q\n", waveformString(cfg.WaveformType))
-	}
+			fmt.Fprintf(&sb, "\n")
-
+		}
 	// Emit user-defined classes sorted alphabetically
 	for _, clsStr := range userClasses {
 		cls := classify.TrafficClass(clsStr)
 		cfg := result.FreqCfgs[cls]
 		annotation := classAnnotation(cls, cfg, result.AutoClasses)
 		fmt.Fprintf(&sb, "# %s -- %.1f Hz (%s)\n", clsStr, cfg.BaseHz, annotation)
 		fmt.Fprintf(&sb, "[sounds.%s]\n", clsStr)
 		fmt.Fprintf(&sb, "frequency = %.1f\n", cfg.BaseHz)
 		fmt.Fprintf(&sb, "waveform = %q\n", waveformString(cfg.WaveformType))
 		fmt.Fprintf(&sb, "\n")
 	}
 	return sb.String()
@@ -27,7 +27,7 @@ func writeTOML(t *testing.T, content string) string {
 }
 // TestLoadPartialOverrideFrequency: setting only frequency for ICMP overrides BaseHz,
-// leaves WaveformType unchanged (WaveformCustom), and leaves other classes unchanged.
+// leaves WaveformType unchanged (preserves default), and leaves other classes unchanged.
 func TestLoadPartialOverrideFrequency(t *testing.T) {
 	path := writeTOML(t, "[sounds.ICMP]\nfrequency = 100.0\n")
@@ -40,8 +40,10 @@ func TestLoadPartialOverrideFrequency(t *testing.T) {
 	if cfgs[classify.ClassICMP].BaseHz != 100.0 {
 		t.Errorf("ICMP BaseHz: got %v, want 100.0", cfgs[classify.ClassICMP].BaseHz)
 	}
-	if cfgs[classify.ClassICMP].WaveformType != synth.WaveformCustom {
+	// WaveformType should remain unchanged from the default (Phase 9: WaveformTriangle for ICMP)
-		t.Errorf("ICMP WaveformType: got %v, want WaveformCustom (0)", cfgs[classify.ClassICMP].WaveformType)
+	wantWaveform := synth.ClassFreqConfigs[classify.ClassICMP].WaveformType
 	if cfgs[classify.ClassICMP].WaveformType != wantWaveform {
 		t.Errorf("ICMP WaveformType: got %v, want %v (default, unchanged)", cfgs[classify.ClassICMP].WaveformType, wantWaveform)
 	}
 	// DNS should be unchanged
 	want := synth.ClassFreqConfigs[classify.ClassDNS].BaseHz
@@ -115,8 +117,8 @@ func TestLoadNoConfig(t *testing.T) {
 		t.Fatalf("Load with no config: %v", err)
 	}
 	cfgs := result.FreqCfgs
-	if len(cfgs) != 14 {
+	if len(cfgs) != len(classify.AllClasses()) {
-		t.Errorf("result map size: got %d, want 14", len(cfgs))
+		t.Errorf("result map size: got %d, want %d", len(cfgs), len(classify.AllClasses()))
 	}
 	// ICMP should be at its default BaseHz (65.0)
 	if cfgs[classify.ClassICMP].BaseHz != 65.0 {
@@ -144,8 +146,8 @@ func TestLoadUnknownClass(t *testing.T) {
 		t.Fatalf("Load with unknown class: %v", err)
 	}
 	cfgs := result.FreqCfgs
-	if len(cfgs) != 14 {
+	if len(cfgs) != len(classify.AllClasses()) {
-		t.Errorf("result map size: got %d, want 14 (BOGUS should not appear)", len(cfgs))
+		t.Errorf("result map size: got %d, want %d (BOGUS should not appear)", len(cfgs), len(classify.AllClasses()))
 	}
 	// Confirm BOGUS is NOT in the map
 	if _, ok := cfgs["BOGUS"]; ok {
@@ -175,8 +177,8 @@ func TestLoadAllDefaultsPresent(t *testing.T) {
 		t.Fatalf("Load: %v", err)
 	}
 	cfgs := result.FreqCfgs
-	if len(cfgs) != 14 {
+	if len(cfgs) != len(classify.AllClasses()) {
-		t.Errorf("result map size: got %d, want 14", len(cfgs))
+		t.Errorf("result map size: got %d, want %d", len(cfgs), len(classify.AllClasses()))
 	}
 	for _, class := range classify.AllClasses() {
 		if _, ok := cfgs[class]; !ok {
@@ -342,7 +344,7 @@ class = "MyService"
 }
 // TestAutoFreqAssignment: TOML with [[rules]] (class="GameServer", protocol="tcp") and
-// NO [sounds.GameServer] -> FreqCfgs contains "GameServer" entry with BaseHz in [1200, 2350]
+// NO [sounds.GameServer] -> FreqCfgs contains "GameServer" entry with BaseHz in [2500, 4000]
 // and WaveformType == WaveformSine.
 func TestAutoFreqAssignment(t *testing.T) {
 	toml := `
@@ -360,8 +362,8 @@ class = "GameServer"
 	if !ok {
 		t.Fatal("FreqCfgs should contain 'GameServer' entry from auto-freq assignment")
 	}
-	if cfg.BaseHz < 1200.0 || cfg.BaseHz > 2350.0 {
+	if cfg.BaseHz < 2500.0 || cfg.BaseHz > 4000.0 {
-		t.Errorf("GameServer BaseHz: got %v, want in [1200, 2350]", cfg.BaseHz)
+		t.Errorf("GameServer BaseHz: got %v, want in [2500, 4000]", cfg.BaseHz)
 	}
 	if cfg.WaveformType != synth.WaveformSine {
 		t.Errorf("GameServer WaveformType: got %v, want WaveformSine", cfg.WaveformType)
@@ -394,7 +396,7 @@ class = "MyDeterministicClass"
 // --- PrintConfig tests ---
-// TestPrintConfigContainsAllClasses: defaults LoadResult produces output with all 14 class names.
+// TestPrintConfigContainsAllClasses: defaults LoadResult produces output with all class names.
 func TestPrintConfigContainsAllClasses(t *testing.T) {
 	t.Chdir(t.TempDir())
 	result, err := config.Load("")
@@ -402,14 +404,9 @@ func TestPrintConfigContainsAllClasses(t *testing.T) {
 		t.Fatalf("Load: %v", err)
 	}
 	output := config.PrintConfig(result)
-	classNames := []string{
+	for _, cls := range classify.AllClasses() {
-		"ICMP", "DNS", "HTTPS", "HTTP", "SSH", "SMTP",
+		if !strings.Contains(output, string(cls)) {
-		"NTP", "DHCP", "other-TCP", "other-UDP",
+			t.Errorf("PrintConfig output missing class %q", cls)
 		"unknown-1", "unknown-2", "unknown-3", "unknown-4",
 	}
 	for _, name := range classNames {
 		if !strings.Contains(output, name) {
 			t.Errorf("PrintConfig output missing class %q", name)
 		}
 	}
 }
@@ -559,7 +556,7 @@ class = "GameServer"
 }
 // TestAutoFreqSkipsBuiltins: TOML with [[rules]] (class="HTTPS", protocol="tcp", port=443)
-// -> FreqCfgs["HTTPS"].BaseHz == 175.0 (the default), NOT an auto-assigned value.
+// -> FreqCfgs["HTTPS"].BaseHz == 150.0 (Phase 9 default), NOT an auto-assigned value.
 func TestAutoFreqSkipsBuiltins(t *testing.T) {
 	toml := `
 [[rules]]
@@ -573,8 +570,9 @@ class = "HTTPS"
 	if err != nil {
 		t.Fatalf("Load: %v", err)
 	}
-	if result.FreqCfgs[classify.ClassHTTPS].BaseHz != 175.0 {
+	wantHz := synth.ClassFreqConfigs[classify.ClassHTTPS].BaseHz
-		t.Errorf("HTTPS BaseHz: got %v, want 175.0 (default, not auto-assigned)", result.FreqCfgs[classify.ClassHTTPS].BaseHz)
+	if result.FreqCfgs[classify.ClassHTTPS].BaseHz != wantHz {
 		t.Errorf("HTTPS BaseHz: got %v, want %.1f (default, not auto-assigned)", result.FreqCfgs[classify.ClassHTTPS].BaseHz, wantHz)
 	}
 }
@@ -602,6 +600,91 @@ func TestLoadResultConfigPath(t *testing.T) {
 	}
 }
 // --- Tests for Phase 11 Plan 02 (GRP-02, GRP-03) ---
 // TestPrintConfigGroupHeaders verifies GRP-02: group section headers appear in canonical order.
 func TestPrintConfigGroupHeaders(t *testing.T) {
 	t.Chdir(t.TempDir())
 	result, err := config.Load("")
 	if err != nil {
 		t.Fatalf("Load: %v", err)
 	}
 	output := config.PrintConfig(result)
 	// Verify all populated group headers appear
 	expectedGroups := []string{"# Infrastructure", "# Web", "# Mail", "# Remote Access", "# File Transfer", "# Database", "# VoIP", "# Unknown"}
 	for _, header := range expectedGroups {
 		if !strings.Contains(output, header+"\n") {
 			t.Errorf("PrintConfig output missing group header %q", header)
 		}
 	}
 	// Verify canonical order: Infrastructure before Web before Mail etc.
 	infraIdx := strings.Index(output, "# Infrastructure\n")
 	webIdx := strings.Index(output, "# Web\n")
 	mailIdx := strings.Index(output, "# Mail\n")
 	remoteIdx := strings.Index(output, "# Remote Access\n")
 	ftIdx := strings.Index(output, "# File Transfer\n")
 	dbIdx := strings.Index(output, "# Database\n")
 	voipIdx := strings.Index(output, "# VoIP\n")
 	unknownIdx := strings.Index(output, "# Unknown\n")
 	if infraIdx >= webIdx || webIdx >= mailIdx || mailIdx >= remoteIdx ||
 		remoteIdx >= ftIdx || ftIdx >= dbIdx || dbIdx >= voipIdx || voipIdx >= unknownIdx {
 		t.Errorf("Group headers not in canonical order: infra=%d web=%d mail=%d remote=%d ft=%d db=%d voip=%d unknown=%d",
 			infraIdx, webIdx, mailIdx, remoteIdx, ftIdx, dbIdx, voipIdx, unknownIdx)
 	}
 }
 // TestLoadGroupOverride verifies GRP-03: [groups] reassigns a class to a different group.
 func TestLoadGroupOverride(t *testing.T) {
 	path := writeTOML(t, "[groups]\nIMAP = \"Web\"\n")
 	result, err := config.Load(path)
 	if err != nil {
 		t.Fatalf("Load: %v", err)
 	}
 	cfg := result.FreqCfgs[classify.ClassIMAP]
 	if cfg.Group != "Web" {
 		t.Errorf("IMAP Group: got %q, want %q", cfg.Group, "Web")
 	}
 	// Frequency and waveform unchanged (D-08)
 	defaultCfg := synth.ClassFreqConfigs[classify.ClassIMAP]
 	if cfg.BaseHz != defaultCfg.BaseHz {
 		t.Errorf("IMAP BaseHz changed: got %v, want %v (should be unchanged by group reassignment)", cfg.BaseHz, defaultCfg.BaseHz)
 	}
 }
 // TestLoadGroupUnknownClass verifies D-09: unknown class in [groups] produces no error.
 func TestLoadGroupUnknownClass(t *testing.T) {
 	path := writeTOML(t, "[groups]\nBOGUS = \"Web\"\n")
 	result, err := config.Load(path)
 	if err != nil {
 		t.Fatalf("Load should not error on unknown [groups] class: %v", err)
 	}
 	// Should still have all default classes
 	if len(result.FreqCfgs) != len(classify.AllClasses()) {
 		t.Errorf("FreqCfgs len: got %d, want %d", len(result.FreqCfgs), len(classify.AllClasses()))
 	}
 }
 // TestPrintConfigGroupReassignment verifies PrintConfig reflects [groups] reassignment.
 func TestPrintConfigGroupReassignment(t *testing.T) {
 	path := writeTOML(t, "[groups]\nIMAP = \"Web\"\n")
 	result, err := config.Load(path)
 	if err != nil {
 		t.Fatalf("Load: %v", err)
 	}
 	output := config.PrintConfig(result)
 	// Find the "# Web" section and check IMAP appears after it
 	webIdx := strings.Index(output, "# Web\n")
 	mailIdx := strings.Index(output, "# Mail\n")
 	imapIdx := strings.Index(output, "[sounds.IMAP]")
 	if imapIdx < webIdx || imapIdx > mailIdx {
 		t.Errorf("IMAP (reassigned to Web) should appear between Web and Mail headers; web=%d imap=%d mail=%d", webIdx, imapIdx, mailIdx)
 	}
 }
 // TestLoadNoConfigReturnsLoadResult: Load("") in empty dir returns LoadResult with
 // len(FreqCfgs)==14, len(UserRules)==0, ConfigPath=="".
 func TestLoadNoConfigReturnsLoadResult(t *testing.T) {
@@ -611,8 +694,8 @@ func TestLoadNoConfigReturnsLoadResult(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Load: %v", err)
 	}
-	if len(result.FreqCfgs) != 14 {
+	if len(result.FreqCfgs) != len(classify.AllClasses()) {
-		t.Errorf("FreqCfgs len: got %d, want 14", len(result.FreqCfgs))
+		t.Errorf("FreqCfgs len: got %d, want %d", len(result.FreqCfgs), len(classify.AllClasses()))
 	}
 	if len(result.UserRules) != 0 {
 		t.Errorf("UserRules len: got %d, want 0", len(result.UserRules))
@@ -3,6 +3,7 @@ module github.com/netsynth/netsynth
 go 1.24.1
 require (
 	github.com/BurntSushi/toml v1.6.0
 	github.com/gopacket/gopacket v1.5.0
 	github.com/packetcap/go-pcap v0.0.0-20251215121130-f2cf9f991e7c
 	github.com/sjzar/go-lame v0.0.9
@@ -11,7 +12,6 @@ require (
 )
 require (
 	github.com/BurntSushi/toml v1.6.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/spf13/pflag v1.0.9 // indirect
@@ -7,10 +7,10 @@ import (
 	"github.com/netsynth/netsynth/classify"
 )
-func TestNewBankHas14Layers(t *testing.T) {
+func TestNewBankHasAllLayers(t *testing.T) {
 	b := NewBank(1.0, ClassFreqConfigs)
-	if len(b.layers) != 14 {
+	if len(b.layers) != len(classify.AllClasses()) {
-		t.Errorf("NewBank() has %d layers, want 14", len(b.layers))
+		t.Errorf("NewBank() has %d layers, want %d", len(b.layers), len(classify.AllClasses()))
 	}
 	// Verify each class has exactly one layer
 	for _, class := range classify.AllClasses() {
@@ -104,8 +104,8 @@ func TestMixerNoClip(t *testing.T) {
 func TestStereoPan(t *testing.T) {
 	b := NewBank(0.01, ClassFreqConfigs) // fast EMA
 	counts := make(map[classify.TrafficClass]int64)
-	// ClassDHCP has pan=-0.75 (wide-left in config.go)
+	// ClassSSH has pan=-0.7 (wide-left in Phase 9 config.go)
-	counts[classify.ClassDHCP] = 1000
+	counts[classify.ClassSSH] = 1000
 	snap := classify.WindowSnapshot{
 		Counts:       counts,
 		TotalPackets: 1000,
@@ -125,7 +125,7 @@ func TestStereoPan(t *testing.T) {
 	rmsL := math.Sqrt(sumL2 / float64(len(frames)))
 	rmsR := math.Sqrt(sumR2 / float64(len(frames)))
 	if rmsL <= rmsR {
-		t.Errorf("ClassDHCP (pan=-0.75) should have rmsL > rmsR; got rmsL=%v, rmsR=%v", rmsL, rmsR)
+		t.Errorf("ClassSSH (pan=-0.7) should have rmsL > rmsR; got rmsL=%v, rmsR=%v", rmsL, rmsR)
 	}
 }
@@ -3,12 +3,10 @@ package synth
 import "github.com/netsynth/netsynth/classify"
 const (
-	SampleRate       = 44100                              // D-13: CD quality
+	SampleRate       = 44100                        // D-13: CD quality
-	WindowMs         = 500                                // matches aggregate.DefaultWindowMs
+	WindowMs         = 500                          // matches aggregate.DefaultWindowMs
-	SamplesPerWindow = SampleRate * WindowMs / 1000       // 22050
+	SamplesPerWindow = SampleRate * WindowMs / 1000 // 22050
-	NumLayers        = 14
+	WhisperFloor     = 0.03                         // D-08/D-09: 3% of max amplitude
 	GainPerLayer     = 1.0 / float64(NumLayers)           // D-10: ~0.0714
 	WhisperFloor     = 0.03                               // D-08/D-09: 3% of max amplitude
 )
 // WaveformType selects the harmonic preset for a synthesis layer.
@@ -70,26 +68,303 @@ type FreqConfig struct {
 	Harmonics    []HarmonicDef
 	Pan          float64      // [-1, 1]: -1=full left, 0=center, +1=full right
 	WaveformType WaveformType // zero value WaveformCustom uses Harmonics as-is
 	Group        string       // sound family: "Infrastructure", "Web", "Mail", "Remote Access", "Unknown", etc.
 }
 // Frequency Allocation Table (Phase 9 design — major-second ladder, 65-2449 Hz)
 //
 // Slot  Hz    Class       Group            Waveform   Pan
 // 0     65    ICMP        Infrastructure   Triangle   -0.3
 // 1     73    NTP         Infrastructure   Triangle   -0.1
 // 2     82    DHCP        Infrastructure   Triangle    0.1
 // 3     93    mDNS        Infrastructure   Triangle    0.3    (Phase 10)
 // 4     105   SSDP        Infrastructure   Triangle   -0.2    (Phase 10)
 // 5     118   SNMP        Infrastructure   Triangle    0.2    (Phase 10)
 // 6     133   DNS         Infrastructure   Triangle    0.0
 // 7     150   HTTPS       Web              Sawtooth   -0.4
 // 8     169   HTTP        Web              Sawtooth   -0.3
 // 9     190   HTTP3       Web              Sawtooth   -0.2    (Phase 10)
 // 10    214   SMTP        Mail             Triangle    0.2
 // 11    241   IMAP        Mail             Triangle    0.3    (Phase 10)
 // 12    271   POP3        Mail             Triangle    0.4    (Phase 10)
 // 13    305   SMTP-sub    Mail             Triangle    0.5    (Phase 10)
 // 14    343   SSH         Remote Access    Square     -0.7
 // 15    385   RDP         Remote Access    Square     -0.6    (Phase 10)
 // 16    432   Telnet      Remote Access    Square     -0.5    (Phase 10)
 // 17    485   VNC         Remote Access    Square     -0.4    (Phase 10)
 // 18    545   FTP         File Transfer    Square      0.5    (Phase 10)
 // 19    612   SMB         File Transfer    Square      0.6    (Phase 10)
 // 20    687   TFTP        File Transfer    Square      0.7    (Phase 10)
 // 21    771   unknown-1   Unknown          Custom     -0.9
 // 22    866   unknown-2   Unknown          Custom      0.9
 // 23    972   unknown-3   Unknown          Custom     -0.7
 // 24    1091  unknown-4   Unknown          Custom      0.7
 // 25    1225  other-TCP   Unknown          Custom     -0.5
 // 26    1375  other-UDP   Unknown          Custom      0.5
 // 27    1543  MySQL       Database         Sawtooth   -0.4    (Phase 10)
 // 28    1732  PostgreSQL  Database         Sawtooth   -0.2    (Phase 10)
 // 29    1944  Redis       Database         Sawtooth    0.2    (Phase 10)
 // 30    2182  MongoDB     Database         Sawtooth    0.4    (Phase 10)
 // 31    2449  SIP         VoIP             Sine        0.0    (Phase 10)
 //
 // Auto-assign range: [2500, 4000] Hz (see config/config.go)
 // ClassFreqConfigs maps each traffic class to its synthesis parameters.
-// Frequencies use musical intervals per D-02/D-03. Harmonics per D-05/D-06.
+// Frequencies per Phase 9 major-second ladder design. Harmonics per D-05/D-06.
-// Pan positions per D-12.
+// Pan positions per D-12. Group field drives family-aware config output (GRP-04).
 var ClassFreqConfigs = map[classify.TrafficClass]FreqConfig{
-	classify.ClassICMP:     {BaseHz: 65.0, Harmonics: []HarmonicDef{{1, 1.0}, {2, 0.4}, {3, 0.15}}, Pan: 0.0},
+	// --- Infrastructure (Triangle, 65-133 Hz) ---
-	classify.ClassDNS:      {BaseHz: 110.0, Harmonics: []HarmonicDef{{1, 1.0}, {2, 0.5}, {3, 0.25}}, Pan: -0.2},
+	classify.ClassICMP: {
-	classify.ClassHTTPS:    {BaseHz: 175.0, Harmonics: []HarmonicDef{{1, 1.0}, {2, 0.6}, {3, 0.3}}, Pan: 0.2},
+		BaseHz:       65.0,
-	classify.ClassHTTP:     {BaseHz: 220.0, Harmonics: []HarmonicDef{{1, 1.0}, {2, 0.5}, {4, 0.2}}, Pan: -0.35},
+		WaveformType: WaveformTriangle,
-	classify.ClassSSH:      {BaseHz: 330.0, Harmonics: []HarmonicDef{{1, 1.0}, {3, 0.6}, {5, 0.3}}, Pan: 0.35},
+		Harmonics:    WaveformPresetHarmonics(WaveformTriangle, 65.0, SampleRate),
-	classify.ClassSMTP:     {BaseHz: 440.0, Harmonics: []HarmonicDef{{1, 1.0}, {2, 0.3}, {3, 0.1}}, Pan: -0.55},
+		Pan:          -0.3,
-	classify.ClassNTP:      {BaseHz: 520.0, Harmonics: []HarmonicDef{{1, 1.0}, {2, 0.25}}, Pan: 0.55},
+		Group:        "Infrastructure",
-	classify.ClassDHCP:     {BaseHz: 600.0, Harmonics: []HarmonicDef{{1, 1.0}, {2, 0.35}, {3, 0.15}}, Pan: -0.75},
+	},
-	classify.ClassOtherTCP: {BaseHz: 700.0, Harmonics: []HarmonicDef{{1, 1.0}, {2, 0.2}}, Pan: 0.75},
+	classify.ClassNTP: {
-	classify.ClassOtherUDP: {BaseHz: 780.0, Harmonics: []HarmonicDef{{1, 1.0}, {2, 0.2}}, Pan: -0.75},
+		BaseHz:       73.0,
-	// D-05: Unknown buckets in 850-1100 Hz dissonant range, detuned intervals
+		WaveformType: WaveformTriangle,
-	// D-06: Same dissonant harmonic character {1,1.0},{2,0.8},{3,0.4} for all 4
+		Harmonics:    WaveformPresetHarmonics(WaveformTriangle, 73.0, SampleRate),
-	classify.ClassUnknown1: {BaseHz: 862.0, Harmonics: []HarmonicDef{{1, 1.0}, {2, 0.8}, {3, 0.4}}, Pan: 0.6},
+		Pan:          -0.1,
-	classify.ClassUnknown2: {BaseHz: 920.0, Harmonics: []HarmonicDef{{1, 1.0}, {2, 0.8}, {3, 0.4}}, Pan: -0.6},
+		Group:        "Infrastructure",
-	classify.ClassUnknown3: {BaseHz: 981.0, Harmonics: []HarmonicDef{{1, 1.0}, {2, 0.8}, {3, 0.4}}, Pan: 0.9},
+	},
-	classify.ClassUnknown4: {BaseHz: 1047.0, Harmonics: []HarmonicDef{{1, 1.0}, {2, 0.8}, {3, 0.4}}, Pan: -0.9},
+	classify.ClassDHCP: {
 		BaseHz:       82.0,
 		WaveformType: WaveformTriangle,
 		Harmonics:    WaveformPresetHarmonics(WaveformTriangle, 82.0, SampleRate),
 		Pan:          0.1,
 		Group:        "Infrastructure",
 	},
 	classify.ClassDNS: {
 		BaseHz:       133.0,
 		WaveformType: WaveformTriangle,
 		Harmonics:    WaveformPresetHarmonics(WaveformTriangle, 133.0, SampleRate),
 		Pan:          0.0,
 		Group:        "Infrastructure",
 	},
 	// --- Web (Sawtooth, 150-169 Hz) ---
 	classify.ClassHTTPS: {
 		BaseHz:       150.0,
 		WaveformType: WaveformSawtooth,
 		Harmonics:    WaveformPresetHarmonics(WaveformSawtooth, 150.0, SampleRate),
 		Pan:          -0.4,
 		Group:        "Web",
 	},
 	classify.ClassHTTP: {
 		BaseHz:       169.0,
 		WaveformType: WaveformSawtooth,
 		Harmonics:    WaveformPresetHarmonics(WaveformSawtooth, 169.0, SampleRate),
 		Pan:          -0.3,
 		Group:        "Web",
 	},
 	// --- Mail (Triangle, 214 Hz) ---
 	classify.ClassSMTP: {
 		BaseHz:       214.0,
 		WaveformType: WaveformTriangle,
 		Harmonics:    WaveformPresetHarmonics(WaveformTriangle, 214.0, SampleRate),
 		Pan:          0.2,
 		Group:        "Mail",
 	},
 		// --- Infrastructure additions (Triangle, 93-118 Hz) ---
 	classify.ClassMDNS: {
 		BaseHz:       93.0,
 		WaveformType: WaveformTriangle,
 		Harmonics:    WaveformPresetHarmonics(WaveformTriangle, 93.0, SampleRate),
 		Pan:          0.3,
 		Group:        "Infrastructure",
 	},
 	classify.ClassSSDP: {
 		BaseHz:       105.0,
 		WaveformType: WaveformTriangle,
 		Harmonics:    WaveformPresetHarmonics(WaveformTriangle, 105.0, SampleRate),
 		Pan:          -0.2,
 		Group:        "Infrastructure",
 	},
 	classify.ClassSNMP: {
 		BaseHz:       118.0,
 		WaveformType: WaveformTriangle,
 		Harmonics:    WaveformPresetHarmonics(WaveformTriangle, 118.0, SampleRate),
 		Pan:          0.2,
 		Group:        "Infrastructure",
 	},
 	// --- Web addition (Sawtooth, 190 Hz) ---
 	classify.ClassQUIC: {
 		BaseHz:       190.0,
 		WaveformType: WaveformSawtooth,
 		Harmonics:    WaveformPresetHarmonics(WaveformSawtooth, 190.0, SampleRate),
 		Pan:          -0.2,
 		Group:        "Web",
 	},
 	// --- Mail additions (Triangle, 241-305 Hz) ---
 	classify.ClassIMAP: {
 		BaseHz:       241.0,
 		WaveformType: WaveformTriangle,
 		Harmonics:    WaveformPresetHarmonics(WaveformTriangle, 241.0, SampleRate),
 		Pan:          0.3,
 		Group:        "Mail",
 	},
 	classify.ClassPOP3: {
 		BaseHz:       271.0,
 		WaveformType: WaveformTriangle,
 		Harmonics:    WaveformPresetHarmonics(WaveformTriangle, 271.0, SampleRate),
 		Pan:          0.4,
 		Group:        "Mail",
 	},
 	classify.ClassSMTPSub: {
 		BaseHz:       305.0,
 		WaveformType: WaveformTriangle,
 		Harmonics:    WaveformPresetHarmonics(WaveformTriangle, 305.0, SampleRate),
 		Pan:          0.5,
 		Group:        "Mail",
 	},
 	// --- Remote Access (Square, 343 Hz) ---
 	classify.ClassSSH: {
 		BaseHz:       343.0,
 		WaveformType: WaveformSquare,
 		Harmonics:    WaveformPresetHarmonics(WaveformSquare, 343.0, SampleRate),
 		Pan:          -0.7,
 		Group:        "Remote Access",
 	},
 	// --- Remote Access additions (Square, 385-485 Hz) ---
 	classify.ClassRDP: {
 		BaseHz:       385.0,
 		WaveformType: WaveformSquare,
 		Harmonics:    WaveformPresetHarmonics(WaveformSquare, 385.0, SampleRate),
 		Pan:          -0.6,
 		Group:        "Remote Access",
 	},
 	classify.ClassTelnet: {
 		BaseHz:       432.0,
 		WaveformType: WaveformSquare,
 		Harmonics:    WaveformPresetHarmonics(WaveformSquare, 432.0, SampleRate),
 		Pan:          -0.5,
 		Group:        "Remote Access",
 	},
 	classify.ClassVNC: {
 		BaseHz:       485.0,
 		WaveformType: WaveformSquare,
 		Harmonics:    WaveformPresetHarmonics(WaveformSquare, 485.0, SampleRate),
 		Pan:          -0.4,
 		Group:        "Remote Access",
 	},
 	// --- File Transfer additions (Square, 545-687 Hz) ---
 	classify.ClassFTP: {
 		BaseHz:       545.0,
 		WaveformType: WaveformSquare,
 		Harmonics:    WaveformPresetHarmonics(WaveformSquare, 545.0, SampleRate),
 		Pan:          0.5,
 		Group:        "File Transfer",
 	},
 	classify.ClassSMB: {
 		BaseHz:       612.0,
 		WaveformType: WaveformSquare,
 		Harmonics:    WaveformPresetHarmonics(WaveformSquare, 612.0, SampleRate),
 		Pan:          0.6,
 		Group:        "File Transfer",
 	},
 	classify.ClassTFTP: {
 		BaseHz:       687.0,
 		WaveformType: WaveformSquare,
 		Harmonics:    WaveformPresetHarmonics(WaveformSquare, 687.0, SampleRate),
 		Pan:          0.7,
 		Group:        "File Transfer",
 	},
 	// --- Unknown (Custom harmonics, 771-1375 Hz) ---
 	// D-05/D-06: dissonant harmonic character {1,1.0},{2,0.8},{3,0.4} retained for all Unknown entries.
 	// WaveformType is zero value (WaveformCustom) so bank.go uses the stored Harmonics directly.
 	classify.ClassUnknown1: {
 		BaseHz:    771.0,
 		Harmonics: []HarmonicDef{{1, 1.0}, {2, 0.8}, {3, 0.4}},
 		Pan:       -0.9,
 		Group:     "Unknown",
 	},
 	classify.ClassUnknown2: {
 		BaseHz:    866.0,
 		Harmonics: []HarmonicDef{{1, 1.0}, {2, 0.8}, {3, 0.4}},
 		Pan:       0.9,
 		Group:     "Unknown",
 	},
 	classify.ClassUnknown3: {
 		BaseHz:    972.0,
 		Harmonics: []HarmonicDef{{1, 1.0}, {2, 0.8}, {3, 0.4}},
 		Pan:       -0.7,
 		Group:     "Unknown",
 	},
 	classify.ClassUnknown4: {
 		BaseHz:    1091.0,
 		Harmonics: []HarmonicDef{{1, 1.0}, {2, 0.8}, {3, 0.4}},
 		Pan:       0.7,
 		Group:     "Unknown",
 	},
 	classify.ClassOtherTCP: {
 		BaseHz:    1225.0,
 		Harmonics: []HarmonicDef{{1, 1.0}, {2, 0.8}, {3, 0.4}},
 		Pan:       -0.5,
 		Group:     "Unknown",
 	},
 	classify.ClassOtherUDP: {
 		BaseHz:    1375.0,
 		Harmonics: []HarmonicDef{{1, 1.0}, {2, 0.8}, {3, 0.4}},
 		Pan:       0.5,
 		Group:     "Unknown",
 	},
 	// --- Database additions (Sawtooth, 1543-2182 Hz) ---
 	classify.ClassMySQL: {
 		BaseHz:       1543.0,
 		WaveformType: WaveformSawtooth,
 		Harmonics:    WaveformPresetHarmonics(WaveformSawtooth, 1543.0, SampleRate),
 		Pan:          -0.4,
 		Group:        "Database",
 	},
 	classify.ClassPostgreSQL: {
 		BaseHz:       1732.0,
 		WaveformType: WaveformSawtooth,
 		Harmonics:    WaveformPresetHarmonics(WaveformSawtooth, 1732.0, SampleRate),
 		Pan:          -0.2,
 		Group:        "Database",
 	},
 	classify.ClassRedis: {
 		BaseHz:       1944.0,
 		WaveformType: WaveformSawtooth,
 		Harmonics:    WaveformPresetHarmonics(WaveformSawtooth, 1944.0, SampleRate),
 		Pan:          0.2,
 		Group:        "Database",
 	},
 	classify.ClassMongoDB: {
 		BaseHz:       2182.0,
 		WaveformType: WaveformSawtooth,
 		Harmonics:    WaveformPresetHarmonics(WaveformSawtooth, 2182.0, SampleRate),
 		Pan:          0.4,
 		Group:        "Database",
 	},
 	// --- VoIP (Sine, 2449 Hz) ---
 	classify.ClassSIP: {
 		BaseHz:       2449.0,
 		WaveformType: WaveformSine,
 		Harmonics:    WaveformPresetHarmonics(WaveformSine, 2449.0, SampleRate),
 		Pan:          0.0,
 		Group:        "VoIP",
 	},
 	// --- Infrastructure auto-assigned (Triangle, 2950-3250 Hz) per D-02 ---
 	classify.ClassLDAP: {
 		BaseHz:       2950.0,
 		WaveformType: WaveformTriangle,
 		Harmonics:    WaveformPresetHarmonics(WaveformTriangle, 2950.0, SampleRate),
 		Pan:          -0.2,
 		Group:        "Infrastructure",
 	},
 	classify.ClassKerberos: {
 		BaseHz:       3250.0,
 		WaveformType: WaveformTriangle,
 		Harmonics:    WaveformPresetHarmonics(WaveformTriangle, 3250.0, SampleRate),
 		Pan:          0.0,
 		Group:        "Infrastructure",
 	},
 	classify.ClassSyslog: {
 		BaseHz:       3050.0,
 		WaveformType: WaveformTriangle,
 		Harmonics:    WaveformPresetHarmonics(WaveformTriangle, 3050.0, SampleRate),
 		Pan:          0.2,
 		Group:        "Infrastructure",
 	},
 }
@@ -16,10 +16,13 @@ func TestAllClassesHaveConfig(t *testing.T) {
 }
 func TestFrequenciesInRange(t *testing.T) {
 	const nyquist = float64(synth.SampleRate) / 2.0 // 22050 Hz
 	for class, cfg := range synth.ClassFreqConfigs {
-		// D-05: unknown buckets use 850-1100 Hz dissonant range; known classes use 60-800 Hz
+		if cfg.BaseHz <= 0 {
-		if cfg.BaseHz < 60 || cfg.BaseHz > 1100 {
+			t.Errorf("class %q BaseHz=%.1f must be positive", class, cfg.BaseHz)
-			t.Errorf("class %q BaseHz=%.1f is out of range [60, 1100]", class, cfg.BaseHz)
+		}
 		if cfg.BaseHz >= nyquist {
 			t.Errorf("class %q BaseHz=%.1f exceeds Nyquist (%.1f Hz)", class, cfg.BaseHz, nyquist)
 		}
 	}
 }
@@ -36,8 +39,8 @@ func TestFrequenciesUnique(t *testing.T) {
 func TestHarmonicsNonEmpty(t *testing.T) {
 	for class, cfg := range synth.ClassFreqConfigs {
-		if len(cfg.Harmonics) < 2 {
+		if len(cfg.Harmonics) < 1 {
-			t.Errorf("class %q has fewer than 2 harmonics (got %d)", class, len(cfg.Harmonics))
+			t.Errorf("class %q has no harmonics (got %d)", class, len(cfg.Harmonics))
 		}
 	}
 }
@@ -50,17 +53,17 @@ func TestPanPositionsInRange(t *testing.T) {
 	}
 }
-func TestClassFreqConfigsComplete(t *testing.T) {
+func TestClassFreqConfigsMatchAllClasses(t *testing.T) {
 	for _, class := range classify.AllClasses() {
 		if _, ok := synth.ClassFreqConfigs[class]; !ok {
 			t.Errorf("ClassFreqConfigs missing entry for class %q", class)
 		}
 	}
 }
 func TestNumLayersMatchesAllClasses(t *testing.T) {
 	if len(synth.ClassFreqConfigs) != len(classify.AllClasses()) {
 		t.Errorf("ClassFreqConfigs has %d entries but AllClasses() has %d entries",
 			len(synth.ClassFreqConfigs), len(classify.AllClasses()))
 	}
 }
 func TestGroupFieldPopulated(t *testing.T) {
 	for class, cfg := range synth.ClassFreqConfigs {
 		if cfg.Group == "" {
 			t.Errorf("class %q has empty Group field in ClassFreqConfigs", class)
 		}
 	}
 }
@@ -15,12 +15,15 @@ func NewOscillator(freq float64, sampleRate int) *Oscillator {
 }
 // Advance returns one sample: fundamental + harmonics summed and normalized to [-1, 1].
 // Normalization uses sum of absolute amplitudes so that alternating-sign harmonic series
 // (e.g. triangle wave) are correctly bounded. Without math.Abs, signed cancellation
 // produces an inflated normalization denominator that causes output to exceed [-1, 1].
 func (o *Oscillator) Advance(harmonics []HarmonicDef) float64 {
 	sum := 0.0
 	totalWeight := 0.0
 	for _, h := range harmonics {
 		sum += h.Amplitude * math.Sin(2*math.Pi*o.phase*float64(h.Ratio))
-		totalWeight += h.Amplitude
+		totalWeight += math.Abs(h.Amplitude)
 	}
 	o.phase += o.freq / o.sr
 	if o.phase >= 1.0 {
Author	SHA1	Message	Date
gurixandClaude Opus 4.6	494385b528	chore: archive v1.2 milestone — Extended Protocol Coverage 35 traffic classes across 9 protocol families shipped. Archives ROADMAP, REQUIREMENTS, and phase directories to milestones/v1.2-*. Updates README with new protocol families, sound design table, and [groups] TOML config documentation. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-27 16:48:53 +01:00
gurix	0a4d48c9c1	docs(phase-11): evolve PROJECT.md after phase completion	2026-03-27 16:42:17 +01:00
gurix	f57c613b54	docs(phase-11): complete phase execution and verification	2026-03-27 16:41:53 +01:00
gurix	15ad990f83	docs(11-02): complete group-ordered PrintConfig and [groups] TOML plan	2026-03-27 16:37:18 +01:00
gurix	7bf3ea12a3	test(11-02): add group header and reassignment tests (GRP-02, GRP-03) - TestPrintConfigGroupHeaders: verifies all group section headers in canonical order - TestLoadGroupOverride: verifies [groups] TOML reassigns class group without changing Hz/waveform - TestLoadGroupUnknownClass: verifies unknown class in [groups] produces warning not error - TestPrintConfigGroupReassignment: verifies PrintConfig reflects reassigned group placement	2026-03-27 16:36:07 +01:00
gurix	374282e5de	feat(11-02): add [groups] TOML support and group-ordered PrintConfig - Add Groups map[string]string field to rawConfig struct - Add applyGroupOverrides function for [groups] reassignment with stderr warning on unknown class - Add groupOrder canonical slice for section header ordering - Refactor PrintConfig to emit group headers (Infrastructure, Web, Mail, Remote Access, File Transfer, Database, Discovery, VoIP, Unknown) - Classes within each group sorted by ascending BaseHz - User-defined classes emitted under '# User-defined' section - Non-canonical group names (user-invented) emitted in sorted order after canonical groups	2026-03-27 16:35:10 +01:00
gurix	b9bcde4f46	merge: resolve STATE.md conflict (accept agent version)	2026-03-27 16:33:08 +01:00
gurix	a0dc6d6a38	docs(11-01): complete frequency-config data layer plan - Add 11-01-SUMMARY.md with 35-class ClassFreqConfigs completion - Update STATE.md: progress 86%, decisions recorded, plan metrics - Update ROADMAP.md: phase 11 progress (1/2 plans complete) - Mark GRP-02 and GRP-03 complete in REQUIREMENTS.md	2026-03-27 16:32:47 +01:00
gurix	35d8915e41	fix(11-01): update hardcoded count assertions to reflect 35 traffic classes - Rename TestNewBankHas14Layers to TestNewBankHasAllLayers, use len(classify.AllClasses()) - Update config_test.go: replace 4 hardcoded 14 counts with len(classify.AllClasses()) - Update TestPrintConfigContainsAllClasses: replace hardcoded list with AllClasses() loop - Update classifier_test.go: change TestAllClassesCount want from 32 to 35	2026-03-27 16:31:26 +01:00
gurix	1556ce83e9	feat(11-01): add 21 ClassFreqConfigs entries and include LDAP/Kerberos/Syslog in AllClasses() - Add 21 new ClassFreqConfigs entries covering mDNS/SSDP/SNMP/QUIC/IMAP/POP3/SMTPSub/RDP/Telnet/VNC/FTP/SMB/TFTP/MySQL/PostgreSQL/Redis/MongoDB/SIP/LDAP/Kerberos/Syslog - Update AllClasses() to return 35 entries (add LDAP/Kerberos/Syslog in Infrastructure section) - Remove outdated Phase 11 exclusion comment from AllClasses() doc comment	2026-03-27 16:30:02 +01:00
gurix	683470a7b1	docs(11): create phase plan	2026-03-27 16:25:14 +01:00
gurix	438079111c	docs(phase-11): add research and validation strategy	2026-03-27 16:21:24 +01:00
gurix	aa1aca29a8	docs(11): research synthesis-and-config-layer phase	2026-03-27 16:20:37 +01:00
gurix	e8072510f4	docs(state): record phase 11 context session	2026-03-27 16:16:36 +01:00
gurix	0b02460853	docs(11): capture phase context	2026-03-27 16:16:30 +01:00
gurix	ac2b374253	docs(phase-10): evolve PROJECT.md after phase completion	2026-03-27 16:04:07 +01:00
gurix	fc631c704a	docs(phase-10): complete phase execution	2026-03-27 16:03:42 +01:00
gurix	eb1cf236d0	Merge branch 'worktree-agent-a776e863'	2026-03-27 16:00:24 +01:00
gurix	0ae39e7ad4	docs(10-02): complete classification-layer test coverage plan - 28 new subtests in TestClassify covering all new protocol/port combinations - TestAllClassesCount updated to assert 32 classes - All PROTO-01 through PROTO-09 requirements satisfied	2026-03-27 16:00:10 +01:00
gurix	f792370d7f	feat(10-02): update TestAllClassesCount from 14 to 32 Reflects 14 existing + 18 new classes in AllClasses(); LDAP/Kerberos/Syslog excluded until Phase 11 adds their ClassFreqConfigs entries.	2026-03-27 15:58:29 +01:00
gurix	038f89f18e	feat(10-02): add 28 new classification subtests to TestClassify - Mail: IMAP 143/993, POP3 110/995, SMTPSub 587 (PROTO-01) - File Transfer: FTP 20/21, SMB 445, TFTP 69 (PROTO-02) - Remote Access: RDP 3389, Telnet 23, VNC 5900 (PROTO-03) - Database: MySQL 3306, PostgreSQL 5432, Redis 6379, MongoDB 27017 (PROTO-04) - Discovery: mDNS 5353, SSDP 1900, SNMP 161/162 (PROTO-05) - VoIP: SIP TCP+UDP 5060 (PROTO-06) - Web: QUIC UDP/443 distinct from HTTPS TCP/443 (PROTO-07) - Infrastructure: LDAP 389/636, Kerberos TCP+UDP 88, Syslog 514 (PROTO-08)	2026-03-27 15:58:17 +01:00
gurix	4cb8cbf334	merge: resolve STATE.md conflict (accept agent version)	2026-03-27 15:56:21 +01:00
gurix	472849379d	docs(10-01): complete classification-layer constants and rules plan - 21 new TrafficClass constants (IMAP, POP3, SMTP-sub, FTP, SMB, TFTP, RDP, Telnet, VNC, MySQL, PostgreSQL, Redis, MongoDB, mDNS, SSDP, SNMP, SIP, QUIC, LDAP, Kerberos, Syslog) - 30 new port-matching rules in DefaultRules (42 total, catch-alls last) - AllClasses() returns 32 classes (LDAP/Kerberos/Syslog deferred to Phase 11) - PROTO-01 through PROTO-08 requirements marked complete	2026-03-27 15:56:01 +01:00
gurix	cd8593eef5	feat(10-01): add 30 new port-matching rules to DefaultRules - Add Discovery rules: mDNS (5353), SSDP (1900), SNMP (161/162) - Add Mail rules: IMAP (143/993), POP3 (110/995), SMTP-sub (587) - Add Remote Access rules: RDP (3389), Telnet (23), VNC (5900) - Add File Transfer rules: FTP (20/21), SMB (445), TFTP (69) - Add Database rules: MySQL (3306), PostgreSQL (5432), Redis (6379), MongoDB (27017) - Add VoIP rules: SIP (5060/5061 tcp+udp) - Add Infrastructure ext rules: LDAP (389/636), Kerberos (88 tcp+udp), Syslog (514) - Add Web ext rule: QUIC (udp 443) - Catch-all rules remain last; total 42 rules (12 existing + 30 new)	2026-03-27 15:53:22 +01:00
gurix	50e047438d	feat(10-01): add 21 new TrafficClass constants and update AllClasses() - Add constants for Mail (IMAP, POP3, SMTP-sub), File Transfer (FTP, SMB, TFTP) - Add constants for Remote Access (RDP, Telnet, VNC), Database (MySQL, PostgreSQL, Redis, MongoDB) - Add constants for Discovery (mDNS, SSDP, SNMP), VoIP (SIP), Web (QUIC) - Add constants for Infrastructure extension (LDAP, Kerberos, Syslog) - Update AllClasses() to return 32 classes (LDAP/Kerberos/Syslog excluded per D-01)	2026-03-27 15:52:17 +01:00
gurix	207264b490	docs(10-classification-layer): create phase plan	2026-03-27 15:47:15 +01:00
gurix	974a2728c1	docs(phase-10): add validation strategy	2026-03-27 15:42:35 +01:00
gurix	b8328319ab	docs(phase-10): research classification layer	2026-03-27 15:41:58 +01:00
gurix	12f26ebb97	docs(state): record phase 10 context session	2026-03-27 15:36:15 +01:00
gurix	9761dcb9e5	docs(10): capture phase context	2026-03-27 15:36:08 +01:00
gurix	a91b1a854c	docs(phase-09): evolve PROJECT.md after phase completion	2026-03-27 14:22:47 +01:00
gurix	bf6bd8ad68	docs(phase-09): complete phase execution and verification	2026-03-27 14:22:34 +01:00
gurix	fe7ee0e797	docs(09-01): complete frequency-design and group-architecture plan - 09-01-SUMMARY.md: plan execution complete, 2 tasks, oscillator bug documented - STATE.md: decisions recorded (Group as string, oscillator fix), session updated - REQUIREMENTS.md: FREQ-01, FREQ-02, FREQ-03, GRP-01, GRP-04 marked complete	2026-03-27 14:18:42 +01:00
gurix	2ef180b4ba	fix(09-01): add TestGroupFieldPopulated, fix oscillator normalization, update tests - Add TestGroupFieldPopulated test to verify all ClassFreqConfigs have non-empty Group (GRP-01) - Change TestHarmonicsNonEmpty threshold from < 2 to < 1 (accepts single-harmonic sine entries) - Fix oscillator Advance() to use math.Abs(h.Amplitude) for normalization weight accumulation: triangle wave uses alternating-sign amplitudes; signed sum underestimates totalWeight causing output to exceed [-1,1] bounds when using WaveformPresetHarmonics (Rule 1 bug fix) - Update TestStereoPan to use ClassSSH (pan=-0.7) instead of ClassDHCP (pan changed to 0.1) - Update TestNewBankCustomConfigNoClip: passes after oscillator normalization fix - Fix TestLoadPartialOverrideFrequency: derive expected WaveformType from defaults (not hardcoded 0) - Fix TestAutoFreqSkipsBuiltins: derive expected HTTPS BaseHz from defaults (150.0 in Phase 9)	2026-03-27 14:18:37 +01:00
gurix	eb36587ccf	feat(09-01): add Group field to FreqConfig and rebalance ClassFreqConfigs - Add Group string field to FreqConfig struct (GRP-04) - Add frequency allocation table comment (32 slots, 65-2449 Hz, FREQ-03) - Rebalance all 14 ClassFreqConfigs entries to major-second ladder (FREQ-01) - Infrastructure band (Triangle, 65-133 Hz): ICMP/NTP/DHCP/DNS - Web band (Sawtooth, 150-169 Hz): HTTPS/HTTP - Mail band (Triangle, 214 Hz): SMTP - Remote Access band (Square, 343 Hz): SSH - Unknown band (Custom, 771-1375 Hz): Unknown1-4, OtherTCP, OtherUDP - Remove stale NumLayers and GainPerLayer constants (Phase 8 cleanup) - Non-Unknown entries use WaveformPresetHarmonics; Unknown retain hand-tuned {1,1.0},{2,0.8},{3,0.4}	2026-03-27 14:18:12 +01:00
gurix	306809d1a5	docs(09-02): complete auto-assign range update plan	2026-03-27 14:09:58 +01:00
gurix	dbcbeb3ee7	test(09-02): update auto-assign range assertions to [2500, 4000] Hz - Update TestAutoFreqAssignment bounds from [1200, 2350] to [2500, 4000] - Update TestAutoFreqAssignment comment to reflect new range - Update TestAutoFreqSkipsBuiltins HTTPS expected value from 175.0 to 150.0 (coordinated with Plan 01 frequency rebalancing)	2026-03-27 14:09:02 +01:00
gurix	8ae1ddc773	feat(09-02): update autoAssignFreq range to [2500, 4000] Hz - Change baseHz from 1200.0 to 2500.0 - Change numSteps from uint32(24) to uint32(31) - Update function comment to reflect new range - Prevents collision with built-in frequencies (max 2449 Hz)	2026-03-27 14:08:03 +01:00
gurix	08a3063633	docs(09): create phase plan	2026-03-27 14:04:11 +01:00
gurix	d314817d3c	docs(09): add validation strategy	2026-03-27 14:00:10 +01:00
gurix	f4ad40ef19	docs(09): research phase domain — frequency allocation table and group architecture	2026-03-27 13:59:28 +01:00
gurix	bd52f0bee4	docs(state): record phase 9 context session	2026-03-27 13:45:39 +01:00
gurix	2e813b42fa	docs(09): capture phase context	2026-03-27 13:45:32 +01:00
gurix	9908a79a64	docs(phase-08): evolve PROJECT.md after phase completion	2026-03-27 12:53:39 +01:00
gurix	9e5db8d4d6	docs(phase-08): complete phase execution and verification	2026-03-27 12:53:08 +01:00
gurix	81ef4f9df7	docs(08-01): complete constant-cleanup plan - SUMMARY for 08-01: stale constants removed, tests future-proofed - STATE.md: plan advanced, progress 100%, decisions recorded - ROADMAP.md: Phase 8 marked Complete - REQUIREMENTS.md: CLEAN-01 marked complete	2026-03-27 08:55:38 +01:00
gurix	4800e8e463	test(08-01): future-proof frequency bounds and rename test - Replace hardcoded [60, 1100] Hz bounds with Nyquist-based validation (0, 22050) - Rename TestNumLayersMatchesAllClasses to TestClassFreqConfigsMatchAllClasses - Remove duplicate TestClassFreqConfigsComplete (subset of TestAllClassesHaveConfig) - All tests green	2026-03-27 08:54:34 +01:00
gurix	fd17061b0d	chore(08-01): remove stale NumLayers and GainPerLayer constants - Delete NumLayers=14 (dead code; NewBank computes gain dynamically) - Delete GainPerLayer=1.0/float64(NumLayers) (dead code per D-01) - Remaining constants: SampleRate, WindowMs, SamplesPerWindow, WhisperFloor	2026-03-27 08:54:02 +01:00
gurix	000e6a3813	docs(08): create phase plan	2026-03-27 08:50:37 +01:00
gurix	7fd2e10c87	docs(phase-8): add validation strategy	2026-03-27 08:47:45 +01:00
gurix	ceba57ed0e	docs(08): research phase test and constant cleanup	2026-03-27 08:46:43 +01:00
gurix	5a7855f3ff	docs(state): record phase 8 context session	2026-03-27 08:43:14 +01:00
gurix	467d415e94	docs(08): capture phase context	2026-03-27 08:43:01 +01:00
gurixandClaude Opus 4.6	8e565ec640	docs: create milestone v1.2 roadmap (4 phases, 18 requirements) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-27 08:38:08 +01:00
gurixandClaude Opus 4.6	47b6e171c4	docs: define milestone v1.2 requirements (18 requirements) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-27 08:29:46 +01:00
gurix	6b26be825c	docs: complete project research	2026-03-27 08:25:02 +01:00
gurixandClaude Opus 4.6	6de2fcbb99	docs: start milestone v1.2 Extended Protocol Coverage Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-27 08:07:14 +01:00
gurixandClaude Opus 4.6	6610366c2f	chore: archive v1.1 phase directories to milestones Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-26 22:06:36 +01:00