docs: cut the root markdown documents to what a reader needs

[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort) — N/A, no Python changed
• make test passes, and a test case covers the change — I ran tests/project only (268 passed, 1 skipped, 864 subtests), not the full suite
• Added a changelog entry under docs/source/changelog/ and regenerated CHANGELOG.md, if the change is user-visible — N/A, prose only, no user-visible behaviour

What is the purpose of your pull request?

• fix — corrects a defect
• feat — adds a feature
• perf — changes performance, not behaviour
• refactor — changes neither behaviour nor performance
• test — tests only
• docs — documentation only
• ci — workflows or build tooling
• chore — anything else

---

Description of your pull request and other information

The root-markdown slice of #719, one of the per-directory PRs that issue asks for. −38 lines across three files.

Two counts were wrong, and they are wrong in different ways.

_make_data was said to be overridden in 28 protocol modules. Measured at runtime from ProtocolBase.__subclasses__(), 30 classes define it, one of which is ProtocolBase itself, across 29 distinct modules. Nothing pins that figure, so it will rot again — dropped rather than renumbered.

The _missing_ passage said "the 121 enumerations". The number is right and the noun is wrong: 130 enumerations exist under pcapkit.const, 122 define _missing_, and 121 of the 127 EnumRegistry subclasses do — the 122nd is CommandType, a non-registry. So this now reads "121 registries", agreeing with conventions/mint-criterion.rst, whose figures tests/project/test_conventions_doc_claims.py already measures.

The same sentence also claimed the fallback "resolves an unregistered value and registers it". It does not, for all but one registry: mint-criterion.rst records that exactly one _missing_ in the tree mints (CGAType's), while 114 unmint and six only range-check — and under pcapkit/const/, 111 files reference _unregistered_member against 3 referencing extend_enum. The registering claim is dropped. A cross-review caught this in the very sentence I had rewritten to assert agreement.

Citations are frozen. Per the ruling on #719 they are design rationale, not timed context. The #587/#597 multiset in CONTRIBUTING.md is byte-identical; the other three files carry none. Timed context is cut — "currently", "today", the older-commit-prefix narrative — while version-bounded support notes and the version table stay.

CODE_OF_CONDUCT.md is untouched, byte-identical to main. It is adapted Contributor Covenant 3.0 rather than verbatim — three passages are project-written (the reporting contacts, the SECURITY.md pointer, and a paragraph on why the four-rung ladder was kept) — so it is left alone for now rather than claimed as exempt upstream text. Sweeping its project-written parts is a residual slice of #719, not closed here.

Checked and found correct, so left alone: the make targets and flags, the 120/100 column stance, the Lint job's triggers and advisory continue-on-error, the changelog-drift gate, the make vermin redirect trap, and the README usage block — which I re-ran against the committed examples/captures/in.pcap with every printed value matching.

SECURITY.md's "1.4.x — current stable" was queried and is correct: v1.4.1.post2 is the newest of 143 non-prerelease releases, every 1.5.0 tag being a beta.

[JarryShaw]

NEEDS CHANGES at 3cec75378, fixed at 73af8234f — opus cross-review, a different model from the sonnet that drafted the slice. It re-derived every number in the PR and confirmed all of them; the findings were prose.

The one that matters landed on my own edit. The _missing_ sentence I reworded to agree with conventions/mint-criterion.rst still claimed the fallback "resolves an unregistered value and registers it". That page says the opposite for all but one registry: exactly one _missing_ in the tree mints, CGAType's, while 114 unmint and six only range-check. Verified independently — 111 files under pcapkit/const/ reference _unregistered_member, 3 reference extend_enum. So my agreement claim was half right, and the registering half is now gone.

Four SECURITY.md findings, all accepted:

• "A parser is never fully hardened against hostile input" replaced a project-scoped admission of incomplete work with a categorical claim, and left the following "some of it" with no antecedent. Restored as ongoing work.
• "not something the parser guarantees everywhere" contradicted "where a pcapkit exception was promised" three lines above. Back to "manages".
• "malformed or" had been dropped from the memory-bounding bullet; accidental malformation is a real expansion case.
• The closing line saying why the section exists at all was cut — rationale of the kind docs: sweep all prose for concision and accuracy, and drop timed context outside the changelog #719 protects. Restored.

One flagged uncertainty resolves the other way: SECURITY.md's "1.4.x — current stable" is correct. v1.4.1.post2 is the newest of 143 non-prerelease releases; every 1.5.0 tag is a beta.

Also corrected in the description: CODE_OF_CONDUCT.md is adapted Contributor Covenant 3.0, not verbatim — three passages are project-written — so "left alone" is the honest framing rather than "exempt as upstream". Still byte-identical to main.

Citations remain frozen at the new head, and tests/project is 268 passed / 1 skipped / 864 subtests. Delta re-review dispatched.

[JarryShaw]

GOOD TO GO at 30317895a — opus, third pass. The delta was one line (README.md:90, eight → nine) and it re-derived the count three independent ways: nine directories under pcapkit/ with an __init__.py, nine packages from pkgutil.iter_modules all importing cleanly, and nine subdirectories under docs/source/pcapkit/. It also swept the repo for any competing claim and found none beyond the one below.

One merge-order condition, and it is worth respecting. docs/source/index.rst carried the same wrong count and a list with only eight entries, vendor absent. Before this wave both documents said eight and were consistently wrong; this PR alone would make the README say nine while the page it links to says eight and lists eight — one click apart, which is worse than the shared error.

The reviewer could not read the sibling diff and flagged that as unverified, so I checked it myself: #1014 fixes both halves — the sentence now reads nine subpackages and a Vendor bullet is added, giving nine entries. So the condition is satisfied as long as #1011 and #1014 land in the same wave, or #1014 first. Nothing breaks if #1014 goes first and #1011 follows.

Everything from the first two passes stands and could not be disturbed by a one-line README change: the four _missing_ figures, the 29 _make_data modules, the #587/#597 freeze, CODE_OF_CONDUCT.md byte-identical at 9856 bytes, the headings-and-anchors check, and the release-list derivation. tests/project 268 passed / 1 skipped / 864 subtests at this head, and test_changelog_md.py does read README, so the change was not provably inert and was worth re-running.