docs(corekit): second-round pass over corekit, dumpkit, toolkit, utilities and interface prose (#719)

[JarryShaw]

Please follow the guide below

• You will be asked some questions, please read them carefully and answer honestly

• Put an x into all the boxes [ ] relevant to your pull request (like that [x])

• Use Preview tab to see how your pull request will actually look like

• Searched for similar pull requests

• Followed the coding style (make pylint, make mypy, make isort)

• make test passes, and a test case covers the change

• Added a changelog entry under docs/source/changelog/ and regenerated CHANGELOG.md, if the change is user-visible — N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

• fix — corrects a defect
• feat — adds a feature
• perf — changes performance, not behaviour
• refactor — changes neither behaviour nor performance
• test — tests only
• docs — documentation only
• ci — workflows or build tooling
• chore — anything else

---

Description of your pull request and other information

Second-round #719 pass over all 43 files in pcapkit/corekit/, dumpkit/, toolkit/, utilities/, interface/ and the three top-level modules, every file read in full; 26 changed. Docstrings and comments only.

• Cuts leftover timed context ("used to", "now", "since #nnn", PR-by-PR history), keeping each rationale as the present-tense hazard it guards against.
• Fixes claims the code contradicts, each probed: NullType's copy/deepcopy identity comes from the __new__ guard, not its copy hooks; the sentinel re-exports are one line, not three; Info is a Mapping, not a dict subclass; ProtoChain.__str__ returns colon-joined aliases; Method.get builds an unregistered member rather than minting; the NO_DEFAULT reload probe raises EnumKeyError; the __proto__ seed is at protocols/__init__.py:76; emoji is optional for the CLI; beholder re-parses the payload, not self._file; OSPF/RARP/DRARP are application-layer in all.py; PyShark tcp_traceflow returns trace data, not a tuple.
• Not run: pylint, mypy, isort, make test. Run: the modules under tests/{corekit,dumpkit,interface,toolkit,utilities,cli,project}, tests/test_docstring_contract.py, and tests/protocols/test_protocol_base_unit.py, one per process, all green. Sphinx -n on fresh output: no new warnings for these files, 17 fewer.
• Verbatim ports (utilities/compat.py, the werkzeug-based corekit/multidict.py) are untouched; their non-vendored prose was read and needs nothing.

AST guard (docstrings and bare-string statements stripped, compared to the merge base 62a79897c):

File	Identical
pcapkit/__init__.py	True
pcapkit/__main__.py	True
pcapkit/all.py	True
pcapkit/corekit/enum.py	True
pcapkit/corekit/fields/collections.py	True
pcapkit/corekit/fields/field.py	True
pcapkit/corekit/fields/ipaddress.py	True
pcapkit/corekit/fields/misc.py	True
pcapkit/corekit/fields/numbers.py	True
pcapkit/corekit/fields/strings.py	True
pcapkit/corekit/infoclass.py	True
pcapkit/corekit/io.py	True
pcapkit/corekit/module.py	True
pcapkit/corekit/protochain.py	True
pcapkit/corekit/sentinels.py	True
pcapkit/dumpkit/common.py	True
pcapkit/dumpkit/pcap.py	True
pcapkit/interface/misc.py	True
pcapkit/toolkit/dpkt.py	True
pcapkit/toolkit/pcapng.py	True
pcapkit/toolkit/pypcapfile.py	True
pcapkit/toolkit/pyshark.py	True
pcapkit/toolkit/scapy.py	True
pcapkit/utilities/__init__.py	True
pcapkit/utilities/decorators.py	True
pcapkit/utilities/exceptions.py	True

Part of #719.

[github-actions]

Coverage: 88.74% (unit tier, Python 3.14, bb89dd2df, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	4	93.55%
pcapkit/const	18757	1035	2342	846	90.23%
pcapkit/corekit	1874	91	578	22	94.33%
pcapkit/dumpkit	136	0	40	0	100.00%
pcapkit/foundation	2422	143	842	34	92.62%
pcapkit/interface	112	7	40	5	92.11%
pcapkit/protocols	15653	187	3942	162	98.19%
pcapkit/toolkit	487	71	144	3	84.15%
pcapkit/utilities	429	4	122	4	98.55%
pcapkit/vendor	4409	2359	1006	158	42.84%

Per-file detail: the coverage-html artifact of this run.

[JarryShaw]

Cross-review verdict on bb89dd2df: GOOD TO GO (ran on Sonnet; author Opus)

• AST guard: all 26 files are identical to the merge base once bare strings are stripped.
• Sentinels: a probed replica of the __new__ guard survives copy, deepcopy and pickle 2–5 without hooks; pickle 0 and 1 break it. NO_DEFAULT fails exactly pickle 0 and 1, as its docstring says.
• Info: it is a Mapping, not a dict.
• ProtoChain.__str__: it joins the aliases with :.
• Method.get('get'): it returns an unregistered member and len(Method) is unchanged.
• The NO_DEFAULT error text matches byte for byte.
• The __proto__ seed is at protocols/__init__.py:76.
• beholder: it re-parses _get_payload() as NoPayload on an EOF StructError and as Raw otherwise, which matches the new docstring.
• emoji: it is optional; EmojiWarning is raised and both print sites fall back to plain text.
• all.py: the OSPF and RARP comment is accurate, as are the pyshark/dpkt "PyShark packet" and return-type fixes.
• Tests: test_docstring_contract, test_protochain, test_decorators and test_pyshark_unit pass, one module per process.

Nit: in the EnumLookup.get docstring, one line is left long after the cut.

UNVERIFIED: no Sphinx run by the reviewer (the worker reports 17 fewer warnings than main, none new), and the "six in-library call sites" count was not recounted.