[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort)
• make test passes, and a test case covers the change
• Added a changelog entry — N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

• refactor — restructures code without changing behaviour

---

Description of your pull request and other information

The second PR for #2047 (owner's ruling: option (a)).

• ci: a failed KTLO leg turns main and pull requests red; report it as a warning and exit 0 #1672's KTLO guard reads helper annotations. The guard is commands() in test_ktlo_legs_stay_green_1672.py. It now also parses each util/ script a step runs for _actions.annotate/annotation calls: by attribute, by imported name or alias, with the level positional or level=. A literal level counts as itself, and a name maps to ${NAME}. An unreadable level becomes {?}, which fails the guard rather than passing.
  • Proof: seeding _actions.annotate('error', ...) into util/leg_summary.py fails the guard on every KTLO job (10 failures). The old guard missed it, and seeding 'warning' passes.
  • A gap closed: batch 1's pip_install.py already used the helper and was invisible to the old regex. It now reads as ${ANNOTATION_LEVEL}, which the guard allows.
• Moved onto the helper: the annotations batch 1 kept literal in apt_packages.py, leg_summary.py and coverage_report.py. They use escape=False where a script escapes its own way. main's copies and this PR's give byte-identical stdout, stderr, exit code, outputs and summary: 144/144 cases under /usr/bin/python3.7 and 144/144 under 3.14, across four locale settings.
• Tests: the guard, helper and apt tests, plus every test of the migrated scripts, all pass (90 passed for the first three). No existing assertion is weakened; the guard only gains reads.

[JarryShaw]

GOOD TO GO at b23faba24 (Sonnet cross-review).

• Guard: the reviewer seeded 19 forms into the KTLO summary script. Aliases, import _actions as A, print(_actions.annotation(...)) and import_module(...) calls are all caught. A level held in a constant, *args, **kw or a conditional reads as unreadable, so the guard fails safe. Nothing on main is flagged by mistake.
• Byte-identical: 143 adversarial cases under 3.7 and 3.14, 286 runs, 0 diffs.
• pip_install.py: confirmed invisible to the old guard. It now reads as ${ANNOTATION_LEVEL}, and every KTLO or experimental job that runs it is in LEVELLED.
• Assertions: the test diff only adds; nothing is weakened.

Known limits, not blocking: getattr(_actions, 'annotate')(...), binding the function to a variable, functools.partial, and from _actions import * still get past the guard. Each takes deliberate evasion, and no script uses any of them. The same is true on main of sys.stdout.write('::error::').

[JarryShaw]

Ordering check on b23faba24: the project leg (util/run_unittest_leg.py project) ran 1912 tests, OK (71 skipped). CI: 66 checks green, 0 failing. KTLO 3.8, 3.9 and 3.10 legs: 0 failing tests. Ready to merge.

[github-actions]

Coverage: 91.54% (unit tier, Python 3.15, b23faba24, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	2	95.16%
pcapkit/const	19599	881	2618	867	92.11%
pcapkit/corekit	2567	71	816	37	96.57%
pcapkit/dumpkit	282	3	102	3	98.44%
pcapkit/foundation	2930	23	1022	25	98.79%
pcapkit/interface	138	4	52	3	96.32%
pcapkit/protocols	17436	219	4582	185	98.15%
pcapkit/toolkit	872	36	298	10	95.21%
pcapkit/utilities	529	7	160	5	98.26%
pcapkit/vendor	4431	1995	1018	167	51.73%

Per-file detail: the coverage-html artifact of this run.