[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort)
• make test passes, and a test case covers the change
• Added a changelog entry — N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

• fix — bug fixes

---

Description of your pull request and other information

Closes #2090. examples/generators/options.py's _deadline.__exit__ cancels with alarm(0) and then restores the previous handler. On GraalPy a SIGALRM that fired just before the cancel can still be pending at that point. If the handler being restored is SIG_DFL, it then kills the process. This is the defect #2084 fixed in tests/_support.py (403117c98).

• Fix: set SIG_IGN between the cancel and the restore, which discards a pending signal.
• Test: test_a_firing_still_pending_as_the_deadline_cancels_is_discarded holds the signal pending with pthread_sigmask, so the ordering is forced. It fails without the fix ('handled': [14] != []) and skips where pthread_sigmask is missing, GraalPy included.
• Samples: make_samples.py gives byte-identical examples/captures/ with and without the fix.
• Results: the generator, option and round-trip test files pass on CPython 3.14.9.

[JarryShaw]

GOOD TO GO at 34af47986 (Sonnet review).

• Fix: the order is cancel → SIG_IGN → restore. _deadline.__exit__ never re-arms an enclosing deadline, and expire returns early once settled, so the ignore window drops nothing that should be delivered. The armed guard still covers the path where no alarm was armed.
• Test: with options.py reverted to 403117c98, the new test fails on its assertEqual and the other 14 still pass. With the fix, all 15 pass. Its finally unblocks the signal and confirms no timer is left.
• Coverage: git grep finds no other cancel-then-restore site besides tests/_support.py (fixed in test: a GraalPy xdist worker died during a SIGALRM TimeLimitTests case #2084) and this one.
• Not re-checked by the reviewer: the byte-identical captures. The author compared the sha256 of all examples/captures/ with and without the fix.

[github-actions]

Coverage: 91.54% (unit tier, Python 3.15, 34af47986, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	2	95.16%
pcapkit/const	19599	880	2618	866	92.12%
pcapkit/corekit	2565	71	812	37	96.56%
pcapkit/dumpkit	282	3	102	3	98.44%
pcapkit/foundation	2930	23	1022	25	98.79%
pcapkit/interface	138	4	52	3	96.32%
pcapkit/protocols	17414	219	4574	185	98.14%
pcapkit/toolkit	869	36	298	10	95.20%
pcapkit/utilities	473	7	136	5	98.03%
pcapkit/vendor	4432	1988	1018	167	51.87%

Per-file detail: the coverage-html artifact of this run.

[JarryShaw]

Ready to merge at 34af47986.

• Review: the Sonnet review is GOOD TO GO.
• CI: every blocking check passed (Required checks passed SUCCESS), and the 3.8–3.10 KTLO legs carry no warnings.
• Ordering: the protocols (rest) plain-unittest ordering leg passed, 1395 tests with 0 failures. That leg covers the changed test file.
• Base: the head is on current main (403117c98) and touches no file that ci(release): move the conda legs' shell into util/ scripts (#1967) #2089 or ci: put two trivial util/ steps back inline (#1967) #2092 edits.

Merging it closes #2090.