[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort)
• make test passes, and a test case covers the change
• Added a changelog entry — N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

• fix — bug fixes

---

Description of your pull request and other information

Closes #2108. advance() in pcapkit/corekit/io.py skips the rest of a record. It chose seek or read with isinstance(file, SeekableReader) or not file.seekable(). On Windows a pipe claims seekable() and its seek does nothing (CPython gh-86768), so the skip left the stream where it was.

• Reachable without the Extractor: both callers can get an unwrapped stream. Frame.__post_init__ and PCAPNG store the caller's stream as given, so Frame(pipe, …) and PCAPNG(pipe, …) bypass the wrapping fix(foundation): treat only a regular file's seekable() as trustworthy (#2097) #2104 added to Extractor. The engines only read the Extractor's wrapped _ifile.
• Fix: fix(foundation): treat only a regular file's seekable() as trustworthy (#2097) #2104's _can_seek() moves verbatim from extraction.py to io.py, where advance() uses it. extraction.py only changes its import.
• Test: test_io_advance_lying_pipe_2108_unit runs over a real os.pipe that claims to seek. It skips 10,000 octets on a raw and on a buffered pipe and expects b'next record' next. Without the fix both subtests read AAAA…. A second case pins that a regular file and a BytesIO still seek.
• Results: the io, PCAP-NG, no-EOF, non-seekable, fix(foundation): a Windows pipe passes seekable(), so its peeked octets are lost #2097, fix(corekit): SeekableReader reopens its NamedTemporaryFile by name, which Windows refuses #2098, fix(foundation): a record length above sys.maxsize crashes Frame.read with OverflowError on 32-bit-Py_ssize_t builds #1975 and tier tests pass on main with fix(corekit): let Windows reopen SeekableReader's buffer file (#2098) #2105 and fix(foundation): close the input when the Extractor constructor raises (#2100) #2106 merged. The rebase conflicted only in io.py's import block.

[JarryShaw]

GOOD TO GO at d6a6f3e52 (Sonnet review).

• The move: _can_seek is byte-identical to the copy it replaces. extraction.py only drops import stat and imports the function from corekit.io. There is no import cycle, and nothing else imported it.
• Callers: advance is called only from Frame and PCAPNG, which matches the description.
• Cost: _can_seek takes 2.24 µs per call against 0.13 µs before. advance runs only when a record declares more than was parsed, which happened 0 times extracting in.pcap, so whole-extraction time is unchanged within noise (3.13 ms against 3.07 ms). No caching needed.
• Test: with advance's old condition put back, both lying-pipe subtests fail. The io, PCAP-NG, fix(foundation): a record length above sys.maxsize crashes Frame.read with OverflowError on 32-bit-Py_ssize_t builds #1975 and fix(foundation): a Windows pipe passes seekable(), so its peeked octets are lost #2097 test files pass.
• UNVERIFIED: a real Windows pipe. The test simulates one.

[JarryShaw]

Ready to merge at d6a6f3e52.

• Review: the Sonnet review is GOOD TO GO.
• CI: every blocking check passed (Required checks passed SUCCESS). The 3.8–3.10 KTLO legs carry no warnings.
• Ordering: the tests/corekit plain-unittest ordering leg passed on a scratch merge into main, with test(corekit): the corekit plain-unittest ordering leg fails on main, and CI never runs it #2115's fix in. It ran 910 tests with 0 failures.

This closes #2108.

[github-actions]

Coverage: 91.54% (unit tier, Python 3.15, d6a6f3e52, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	2	95.16%
pcapkit/const	19599	880	2618	866	92.12%
pcapkit/corekit	2589	75	816	37	96.48%
pcapkit/dumpkit	282	3	102	3	98.44%
pcapkit/foundation	2936	23	1024	25	98.79%
pcapkit/interface	138	4	52	3	96.32%
pcapkit/protocols	17414	219	4574	185	98.14%
pcapkit/toolkit	869	36	298	10	95.20%
pcapkit/utilities	473	7	136	5	98.03%
pcapkit/vendor	4432	1988	1018	167	51.87%

Per-file detail: the coverage-html artifact of this run.