[JarryShaw]

Please follow the guide below

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort) — pylint/mypy/isort run on schema.py with the Makefile flags; no finding that origin/main does not already have
• make test passes, and a test case covers the change — the modules listed below, not the whole suite
• Added a changelog entry — N/A, added centrally

What is the purpose of your pull request?

• fix — corrects a defect

---

Description of your pull request and other information

Closes #1289
Closes #1291
Refs #1292 (the parse -> from_data remainder is #1380)

All three still reproduced on 13aa677be (after #1331). Fixes, all in protocols/schema/schema.py:

• fix(schema): Schema.pack drops the end-of-options padding length, so TCP and IPv4 rebuild shorter than their header says #1289 pack sets __option_padding__ after an OptionField to the part of the declared area left unfilled (the mirror of unpack). D3: tcp.pcap#1 44->43, many_interfaces#24/#52 44->43, IPv4 24->22 -> all equal.
• fix(schema): iterating a Schema yields keys that __getitem__ refuses, so dict(schema) and .items() raise KeyError #1291 __getitem__ serves every key __iter__ yields. D5: dict(TSOption) KeyError -> works.
• fix(schema): a SchemaField reads its declared span but packs only the bytes its nested schema consumed #1292 a direct SchemaField packs its whole declared span. Unread octets are re-emitted from the unpack buffer, otherwise zero-filled. D6: 0302eeee04 -> 030204 -> 0302eeee04. A from_dict(to_dict()) rebuild gives 0302000004: width kept, octets zeroed, because the dict has no slot for them. Protocol.from_data hits the same case, so the owner's parse -> from_data round trip still zero-fills; that is fix(schema): a SchemaField's unread octets are lost through from_data, so a direct SchemaField rebuilds zero-filled #1380, which also updates test_schema_field_keeps_declared_width (now commented as such). Fields behind a SwitchField are not changed: the PCAP-NG block selector declares the rest of the stream as its span. No fixture capture has a non-PCAP-NG SchemaField remainder (measured).

Contract changes: a bytes value shorter than a SchemaField's span now pads to the span (030704 becomes 0307000004), a behaviour change for user schemas. 'x' in schema and schema.get('x') now see post_process values. make() now pads an option area its options leave short.

Tests: new tests/protocols/schema/test_schema_roundtrip_unit.py 6 passed; with origin/main's schema.py 5 fail (the sixth is a guard that builtins stay unreadable). run_unittest_leg.py protocols/internet 529 tests OK; protocols --exclude protocols/internet 927 tests OK; tests/project 389 passed, 1 skipped; test_schema_unit.py 16 passed; test_option_roundtrip_unit.py 6 passed. Per-frame info over 1588 frames in 22 captures is identical to origin/main.

[JarryShaw]

Cross-review verdict on 96b32e369: NEEDS CHANGES — the closing keyword for #1292, not the code (Sonnet reviewed; author Opus).

#1292 is only half fixed. Parse → pack is now byte-exact (0302eeee04), but parse → from_data — the round trip the owner's ruling covers — still zero-fills the unread octets: Protocol.from_data (protocol.py:799-847) builds a fresh, never-unpacked schema, so it gives 0302000004, and test_schema_field_keeps_declared_width pins that. Change Closes #1292 to Refs #1292; the remainder is filed as #1380. Impact is user schemas only — none of the 446 shipped schema classes declares a SchemaField directly.

Held up:

• fix(schema): Schema.pack drops the end-of-options padding length, so TCP and IPv4 rebuild shorter than their header says #1289: tcp.pcap frame 1 and many_interfaces.pcapng frames 24/52 now rebuild exactly (44→43 confirmed); TCP NOP+EOOL+padding and empty option areas go from truncated to exact; bytes(P()) for all 27 constructible protocols and 15 TCP option combinations are identical to main.
• fix(schema): iterating a Schema yields keys that __getitem__ refuses, so dict(schema) and .items() raise KeyError #1291: no caller relied on the old behaviour; builtin, mangled and unknown keys still raise KeyError.
• The SwitchField exemption holds: 300 SchemaField.unpack calls over 22 captures, and every under-read is a PCAP-NG block.
• Blast radius: info identical to main across 8,247 layers; from_schema rebuilds improve 5,016→5,019; legs 529/0 and 927/0; tests/project 389 passed; revert proof 8 failed / 1 passed.

Also say in the body: a bytes value shorter than a SchemaField's span now pads to the span (030704 → 0307000004) — a behaviour change for user schemas.

[JarryShaw]

Round-2 verdict on 9d920e244: GOOD TO GO. I checked the delta from 96b32e369 myself. The only file touched is tests/protocols/schema/test_schema_roundtrip_unit.py, with three added comment lines on the 0302000004 assertion naming #1380 as the open half. No source changed. The body now reads Closes #1289, Closes #1291 and Refs #1292, with the from_data remainder pointed at #1380. It also states that a short bytes value pads to its SchemaField span (030704 → 0307000004). The round-1 verification carries over.

[github-actions]

Coverage: 88.98% (unit tier, Python 3.14, 9d920e244, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	4	93.55%
pcapkit/const	18777	1032	2348	843	90.27%
pcapkit/corekit	1949	84	606	20	94.91%
pcapkit/dumpkit	189	1	68	1	99.22%
pcapkit/foundation	2443	102	852	39	94.39%
pcapkit/interface	112	7	40	5	92.11%
pcapkit/protocols	16019	206	4182	177	98.06%
pcapkit/toolkit	539	74	168	3	84.58%
pcapkit/utilities	429	4	122	4	98.55%
pcapkit/vendor	4409	2359	1006	158	42.84%

Per-file detail: the coverage-html artifact of this run.