[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort)
• make test passes, and a test case covers the change
• Added a changelog entry — N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

• fix — bug fixes

---

Description of your pull request and other information

Closes #2100. When an engine raised out of Extractor.__init__ → run → record_frames, for example a FormatError on a packet block before any interface, only KeyboardInterrupt cleaned up. An input the Extractor had opened stayed open until GC, and on Windows that blocks deleting the file (WinError 32).

• Why not _cleanup(), as the issue proposed: for an unknown magic number, run() raises before _exeng exists, so _cleanup() would mask the FormatError with an AttributeError. It would also close a half-started engine and end a flow trace that never ran.
• Fix: the magic read and run() sit in a try that, on any exception, closes the input only if the Extractor owns it (the Extractor._cleanup closes the caller-supplied stream and leaks the file it opened itself #610 rule), detaches the finaliser, and re-raises. A second call is harmless.
• Test: test_extraction_constructor_raises_2100_unit records the handles the Extractor opens. Without the fix, the packet-block-before-interface case leaves its file open. It also pins that the unknown-format error is not masked and that a caller's file or stream stays open. test_extraction_ownership passes.

[JarryShaw]

GOOD TO GO at bcca8aefa (Sonnet review).

• Test: test_a_format_error_while_reading_frames_closes_the_input fails with extraction.py reverted and passes with the fix. Neighbouring tests pass.
• Why not _cleanup(): the reviewer swapped in self._cleanup() as a mutant. The unknown-format case then failed with AttributeError: … no attribute '_exeng', masking the FormatError.
• Propagation: a bare raise keeps the exception's type, message and traceback. The KeyboardInterrupt path still runs _cleanup() first, and the second close is idempotent.
• Remaining leak, not made worse by this PR: if the engine raises after _exeng exists, _exeng.close() is never called, so PyShark's temp capture stays open. Tracked separately.

[github-actions]

Coverage: 91.54% (unit tier, Python 3.15, bcca8aefa, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	2	95.16%
pcapkit/const	19599	880	2618	866	92.12%
pcapkit/corekit	2565	71	812	37	96.56%
pcapkit/dumpkit	282	3	102	3	98.44%
pcapkit/foundation	2936	23	1024	25	98.79%
pcapkit/interface	138	4	52	3	96.32%
pcapkit/protocols	17414	219	4574	185	98.14%
pcapkit/toolkit	869	36	298	10	95.20%
pcapkit/utilities	473	7	136	5	98.03%
pcapkit/vendor	4432	1988	1018	167	51.87%

Per-file detail: the coverage-html artifact of this run.

[JarryShaw]

Ready to merge at bcca8aefa.

• Review: the Sonnet review is GOOD TO GO.
• CI: every blocking check passed (Required checks passed SUCCESS). The 3.8–3.10 KTLO legs carry no warnings.
• Ordering: the tests/foundation plain-unittest ordering leg passed on a scratch merge into main: 713 tests, 0 failures.
• Base: the head is behind main only by test-only commits (aeb4aadd3, test(tier-guard): the xdist probe races latest_tier_paths on Windows, where the tier-guard lock is a no-op #2114) and the build-only dispatch workflows (c5081fbfe). Neither touches extraction.py, and the scratch merge was clean.

This closes #2100. #2107 (closing the engine too) follows once it merges.