[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort)
• make test passes, and a test case covers the change
• Added a changelog entry — N/A, centralised in chore(docs): centralise changelog entries for unreleased versions #2483

What is the purpose of your pull request?

• fix — corrects a defect
• feat — adds a feature
• perf — changes performance, not behaviour
• refactor — changes neither behaviour nor performance
• test — tests only
• docs — documentation only
• ci — workflows or build tooling
• release — bumps the version or rolls up a distribution
• chore — anything else
• const — regenerates constant or registry tables, members keeping their numeric values

---

Description of your pull request and other information

Closes #2516. Protocol._parse_next_layer held a trial parse's warnings only when the capture was shorter than the layer's length hint. A full-length layer that then raised still reported its SchemaWarnings before beholder replaced it with Raw, against #1580/#2308. One example is a mid-record TCP 443 segment: TLS's header read plus its SSLv2 fallback trial. #2339 had listed this case as left out.

• _parse_next_layer now holds whenever beholder is active, not only on a short capture. Its Note and warnings.rst say so.
• New test_trial_parse_full_length_2516_unit.py covers the repro, a cut SSLv2 hello, a raising TCP header under IPv4 and IPv6, and two controls. The fix(protocols): a trial next-layer parse that is replaced by Raw still emits its SchemaWarnings #1580 test is retargeted. 6 and 1 tests fail without the fix.
• Every sample capture gives the same warnings and chains as on main.

One behaviour change to confirm: along a kept chain, an outer layer's warnings now report after its inner layers'. The set of warnings and their source lines are unchanged. This will be raised as a question here once the review lands.

[JarryShaw]

Cross-review (Sonnet) at 8673e66a7: GOOD TO GO. The root cause was reproduced on 94185da93: _short_of_hint(TLS, 1032) is false, so neither the TLS header-read warning (-24687) nor the SSLv2-trial warning (-10844) was held. The new and retargeted tests fail on main and pass here. A 6000-case differential fuzz on main and this head, under both always and error, found: identical chains, no new warning anywhere, drops only where a layer was replaced by Raw, 5 cases reordered, and 548 Raw errors now carrying the real parse failure instead of warning text.

Non-blocking, to fold in as a follow-up commit unless this merges first: the half of the docstring about holding outside beholder has no test; two consecutive sentences in the Note use "it" for beholder; and the new test docstrings use timed words ("now", "as before").

[JarryShaw]

Decisions needed before merge:

Q1. Warning order along a kept chain. Each held block reports when its parse ends, so an outer layer's warning now comes after its inner layers'. Example: IPv4 with a bad Security option carrying a cut Shim6 header. The set of warnings and their source lines are unchanged; the fuzz found 5 reordered cases in 6000. Options: 1. accept it (it is documented in the Note and pinned by a test); 2. redesign nesting, which collides with the error-filter rule that test_error_filter_chains_match_holding_nothing pins. Recommendation: 1.

Q2. pcapkit/toolkit/pypcapfile.py _default_extension_header catches a raising trial "as beholder does" but never sets _beholding, so the trial's warnings still replay (reproduced: HIP b0ff89ff0042ff1c warns -16 and -32, then returns None). It returns a tuple, not a Raw. Options: 1. the #2308 rule applies, so set _beholding around that call in a separate change; 2. it does not apply there. Recommendation: 1, because the trial's result is discarded on raise exactly as a beholder replacement is.

[JarryShaw]

take your recommendations on both questoins

[JarryShaw]

Owner took both recommendations. Q1: the new warning order along a kept chain is accepted as documented. Q2: the #2308 rule applies to pypcapfile._default_extension_header, so it gets its own change, #2526. This PR is ready to merge as it stands. The review's three non-blocking nits ride along with #2526 so this verdict stays valid.

[github-actions]

Coverage: 93.94% (unit tier, Python 3.15, 8673e66a7, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	2	95.16%
pcapkit/const	20087	144	2710	125	98.78%
pcapkit/corekit	2605	74	818	37	96.52%
pcapkit/dumpkit	281	3	100	3	98.43%
pcapkit/foundation	3194	27	1112	31	98.65%
pcapkit/interface	138	4	52	3	96.32%
pcapkit/protocols	19906	213	5236	207	98.32%
pcapkit/toolkit	924	36	334	10	95.55%
pcapkit/utilities	502	7	144	5	98.14%
pcapkit/vendor	5009	2222	1148	182	52.31%

Per-file detail: the coverage-html artifact of this run.