[JarryShaw]

Please follow the guide below

• You will be asked some questions, please read them carefully and answer honestly

• Put an x into all the boxes [ ] relevant to your pull request (like that [x])

• Use Preview tab to see how your pull request will actually look like

• Searched for similar pull requests

• Followed the coding style (make pylint, make mypy, make isort)

• make test passes, and a test case covers the change

• Added a changelog entry under docs/source/changelog/ and regenerated CHANGELOG.md, if the change is user-visible — N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

Tick the commit type your subject line carries.

• fix — corrects a defect
• feat — adds a feature
• perf — changes performance, not behaviour
• refactor — changes neither behaviour nor performance
• test — tests only
• docs — documentation only
• ci — workflows or build tooling
• release — bumps the version or rolls up a distribution
• chore — anything else

---

Description of your pull request and other information

Closes #1559.

ProtocolBase._lookup_next_layer (pcapkit/protocols/protocol.py:2183-2184) wrote the resolved class over a registered ModuleDescriptor. The fix resolves through ModuleDescriptor.klass, which reads sys.modules, on every lookup and writes nothing back, as the docstring already said it should. Six assertions that pinned the write-back now check the entry stays a descriptor. All six, plus the new tests, fail with the fix reverted.

Cost: a hit went from ~145 ns to ~294 ns. http.pcap resolves 4695 descriptors per extract(), about 0.7 ms on ~700 ms (0.1%). Interleaved wall-clock medians (main → fix): http.pcap 704.6 → 705.1 ms over 18 runs; tcp, ipv6, many_interfaces and test.pcap stayed within ±1%.

Behaviour change: Internet.register(TransType.UDP, UDP) used to warn "already registered" before any parse but not after a parse had reached UDP. It now warns both times. Pinned by test_registering_a_dispatched_code_warns_alike_before_and_after_a_parse.

Prose corrected: the docstrings in schema/link/ethernet.py and corekit/module.py (the count is re-measured: 296 resolutions on many_interfaces.pcapng, 48 of them fallbacks), test_dispatch_default_resolution_unit.py, and the 1.5.0 changelog entry, with CHANGELOG.md regenerated. test_layer_placement_unit.py drops isolate_modules(self), which only the write-back needed. Run last after its class's other tests, the test passes under pytest and plain unittest, and fails on main's protocol.py.

Known follow-ups, not fixed here: the same reload staleness exists at pcapkit/foundation/extraction.py:1354-1461 (__reassembly__/__traceflow__/__output__ write-backs), pcapkit/protocols/protocol.py:986 and pcapkit/protocols/misc/pcapng.py:1027-1035 (register-time resolution).

[JarryShaw]

Verdict: GOOD TO GO at 6c135cd59. Cross-reviewed on Sonnet; the author ran Opus.

• The fix works. After a TransType.UDP hit, importlib.reload of the UDP module is picked up by the next lookup; on main the old class came back. I snapshotted the 7 next-layer registries and ran extract() over the 23 sample captures. On this head 0 entries changed. On main, 15 descriptors turned into classes (9 in Internet, 3 in Link, and 1 each in Frame, PCAPNG and TCP). I re-checked a subset myself: 0 of 24 Link/Internet entries changed.
• The behaviour change covers every next-layer registry, not just UDP. Re-registering a code that has already been dispatched now warns both before and after a parse; on main it warned 1 then 0. Nothing in the repo relied on the silent re-register.
• Fail-before: all six flipped assertions fail on main's protocol.py. test_protocol_base_unit.py:339 was masked by :265 in the same test, and fails once :265 is neutralised. None of them is weakened.
• Cost: a hit takes 306–315 ns, up from 156–160 ns. Paired in-process runs put extract() on http.pcap at +3.1 ms (+0.46%), and a 12× capture at +0.38%.
• Tests: these all pass: internet 475, link 89, application 242, transport 243, misc 230, top-level protocol tests, registry 43, interface 20, and the plain-unittest leg (1234 tests, 0 failures). tests/project/test_changelog_md.py passes too.

Non-blocking nits:

• The 1.5.0 entry says the cost is "not measurable in extract() wall clock". Measured paired, it is about +0.4–0.5%, so "under 1%" would be accurate.
• The PR body describes the change for Internet/UDP only.

[github-actions]

Coverage: 90.02% (unit tier, Python 3.14, 6c135cd59, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	4	93.55%
pcapkit/const	18795	842	2356	756	92.09%
pcapkit/corekit	2240	67	722	34	96.32%
pcapkit/dumpkit	258	2	90	2	98.85%
pcapkit/foundation	2766	129	980	47	94.23%
pcapkit/interface	108	7	36	5	91.67%
pcapkit/protocols	16993	230	4546	191	98.02%
pcapkit/toolkit	635	98	198	5	83.31%
pcapkit/utilities	431	4	124	4	98.56%
pcapkit/vendor	4409	2342	1006	157	43.25%

Per-file detail: the coverage-html artifact of this run.