[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort)
• make test passes, and a test case covers the change
• Changelog entry: N/A — centralised in chore(docs): centralise changelog entries for unreleased versions #2483

What is the purpose of your pull request?

• refactor — changes neither behaviour nor performance

---

Description of your pull request and other information

IP and TCP reassembly now have their own analysis modules, in the shape of DTLS's dtls_handshake. pcapkit.foundation.analysis.ip.ip_datagram parses a reassembled datagram's payload by its payload protocol. pcapkit.foundation.analysis.tcp.tcp_datagram parses it by its port pair. Both return None for a strict, incomplete datagram. The names follow the owner's choice on #2581. IP.submit and TCP.submit build their Deferred from the same private helper, bound to the engine's own __protocol_type__, so a custom engine still parses with its own protocol. The docs note that exception wherever they say what packet holds.

Behaviour is unchanged. The differential runs over every sample capture, on the default, dpkt and scapy engines, with strict on and off, and is byte-identical: 8,100 IPv4, 6 IPv6 and 1,458 TCP datagrams, including pickle round trips. A Sonnet cross-review reproduced it independently and returned GOOD TO GO. Its nits are folded in. The new tests fail without the change.

Closes #2581

[JarryShaw]

GOOD TO GO at 7095786f8. A Sonnet cross-review of 276b09434 reproduced the byte-identical differential over all 138 engine and strict configurations, plus a synthetic fragmented case. It also confirmed that the unread packet pickles and that a custom engine's __protocol_type__ still dispatches. Its nits are folded in, and I checked the delta:

• packet is documented with the custom-protocol exception;
• the prose says "datagram" rather than "stream";
• the tests assert behaviour rather than wiring, and none check analyze.func;
• transport.py is untouched.

[JarryShaw]

Owner request, given in session and paraphrased: now that foundation.analysis has IP and TCP modules, the protocols' own analyze methods should point at them.

Today ip_datagram and tcp_datagram call IPv4.analyze, IPv6.analyze and TCP.analyze, which are ProtocolBase.analyze and Transport.analyze. The fix round reverses that: the parsing logic moves into pcapkit.foundation.analysis.ip and .tcp, and the protocol classes' analyze delegates to them. Signatures stay the same. A custom engine's __protocol_type__ override still wins, and output stays byte-identical across every engine.

If "the protocol itself" meant the reassembly classes' submit/Deferred wiring instead, say so and the round will follow that. The PR moves to review: needs-changes, and its running CI is cancelled.