[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort)
• make test passes, and a test case covers the change
• Changelog entry: N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

• ci — workflows or build tooling

---

Description of your pull request and other information

Option 3 on #1954. The tests/project modules whose result does not depend on the interpreter ("project pins") now run once per push in project-tests, instead of on every matrix leg.

• tests/_tiers.py is_project_pin() is the one source of truth. A module counts as a pin unless it, or repository code it runs, imports pcapkit or branches on the interpreter version. The check is conservative and AST-based.
• project-tests runs the pins under pytest on every PR and every push to main, but not under gate-only. required-checks now requires it on every diff. The docs-only steps are unchanged.
• Every test/test-ktlo leg and every experimental.yml leg ignores the pins. Both workflows ask project_pin_paths() at run time, so no file keeps a list of pins.
• gate keeps the full suite, and the unittest-ordering project cell keeps the pins.
• Tier-guard tests check the workflow steps against the rule. workflows.rst gains a "Project Pins" section.

Locally the two halves partition tests/project with nothing lost or duplicated. The new and changed pins fail on main. Estimated saving: about 8–9 runner-minutes per code push, and about 3 minutes off the longest leg.

Closes #1954

[JarryShaw]

GOOD TO GO at 7f8788307. A Sonnet review tried to break it:

• project_pin_paths() returns the same pins on CPython 3.8 through 3.12 and 3.15. 3.7 can't parse it, but that leg already stops at install.
• A failed computation is loud: the leg emits an annotation and exits 1, and the experimental summary names the failed step.
• --collect-only partitions tests/project exactly, with nothing missing and nothing duplicated.
• Doctoring the workflows trips the guards. gate keeps the full suite, and gate-only skips project-tests.
• The tests pass, and actionlint finds nothing new.

I checked the ruleset: its required contexts are Required checks passed and the Compat legs, so the job rename is safe. All ten moved unit-tests.yml:N citations in workflows.rst and releasing.rst still point at the same lines. Disclosed trade-off: the pins that skip without tomllib no longer run on a pre-3.11 leg.

[JarryShaw]

The red Python 3.11, 3.13 and 3.14 legs are inherited from main, not caused by this PR. Each fails only the four test_sentinel_exports_unit.py::...test_conventions_doc_lists_every_sentinel_in_the_tree subtests, which also fail on main at c8c34a86f (#1957). The pins themselves passed on every leg that has finished. Once #1957's fix lands, a rerun of these legs should go green.

[JarryShaw]

#1957's fix is on main as b2cd14078, a test-only push. Re-running these legs reuses the old merge ref, so they would stay red until the branch picks up main. The four sentinel subtests are the only failures on them.

[github-actions]

Coverage: 90.07% (unit tier, Python 3.15, ae3a0dd23, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	2	20	2	96.77%
pcapkit/const	19597	881	2618	867	92.11%
pcapkit/corekit	2504	70	792	36	96.54%
pcapkit/dumpkit	276	3	100	3	98.40%
pcapkit/foundation	2916	164	1016	34	93.59%
pcapkit/interface	138	7	52	5	93.68%
pcapkit/protocols	17411	224	4580	189	98.10%
pcapkit/toolkit	872	177	298	8	77.18%
pcapkit/utilities	522	2	158	4	99.12%
pcapkit/vendor	4431	2341	1018	156	43.64%

Per-file detail: the coverage-html artifact of this run.

[JarryShaw]

GOOD TO GO at ae3a0dd23. The update from main is a clean merge: its diff against 7f8788307 is exactly b2cd14078 (#1957), with no conflict resolution. The sentinel test, the tier guard and the #1954 test pass (143 passed). A Sonnet delta review checked it.