fix(ipv4)!: TS and SEC options do not rebuild byte for byte (#1391, #1392, #1393)

[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort) — mypy clean on the 3 source files, isort clean on the new test; pylint not run
• make test passes, and a test case covers the change — scoped: leg protocols/internet, test_option_roundtrip_unit.py, tests/project
• Added a changelog entry — N/A, added centrally

What is the purpose of your pull request?

• fix — corrects a defect

---

Description of your pull request and other information

Closes #1391
Closes #1392
Closes #1393

• fix(ipv4): TS rebuild floors a float and loses 1 ms on ~1% of timestamps #1391: _make_opt_ts floored the inexact total_seconds() * 1000; all four paths now use td // timedelta(milliseconds=1).
• fix(ipv4): TS zeroes a trailing 1-3 octet partial slot on rebuild #1392: the tail is kept byte-exact rather than rejected: the owner's ruling is that every round trip must match, and LSR-style rejection would make a parseable option unparseable. TSOption.remainder changes from a zero-packing PaddingField to a BytesField (default b'').
• fix(ipv4): SEC rebuild rewrites a non-conforming Field Termination Indicator #1393: _read_opt_sec records each octet's indicator. _make_opt_sec writes them back when they cover every octet, and sets them by position otherwise. The warning stays.

Breaking: data TSOption gains a required remainder: bytes, and data SECOption gains a required termination: tuple[bool, ...].

Before → after, from from_data: 44080900 000003e9 → …3e8 / exact; 440b0900 00000005 aabbcc → …000000 / exact; 8204ab91 → 8204ab90 / exact.

Tests: new test_ipv4_ts_sec_roundtrip_unit.py has 5 tests and 18 subtests. With the 3 source files from origin/main, every test fails. With one fix undone at a time, only that issue's cases fail (11 for #1391, 4 for #1392, 3 for #1393). test_ipv4_unit.py adds the new fields in 4 direct constructions. Results: leg protocols/internet 557 tests, 0 failures; round-trip module 6 passed / 362 subtests; tests/project 399 passed, 1 skipped.

[JarryShaw]

Cross-review verdict on d04716c37: GOOD TO GO (Sonnet reviewed; author Opus).

• TS fuzz. Of 6,000 random options, the PR rebuilds 4,192 byte-exactly. On main, 2,218 of those mismatched (zeroed tail, 1 ms floor). Both trees reject the same 1,808 inputs at parse, so the PR adds no new raises. The 39 make() cases behave the same on both trees, and boundaries stay exact up to 2³²−1 ms.
• SEC fuzz. Of 6,000 random options, the PR rebuilds all 6,000 exactly. On main, 5,678 mismatched. A termination tuple of the wrong length falls back to positional bits and never raises.
• breaking is justified. Both data constructors gain a required field. Across 1,614 fixture frames, the only info difference from main is remainder=b'' on the two TS frames of options-ipv4.pcap.
• Tests and revert proof. Reverting the three source files fails the new module. protocols/internet passes 557/0. I re-ran the new module myself and got 5/0.

Follow-ups:

• The out-of-scope int('1.2.3.4') bug is confirmed on both trees and filed as fix(ipv4): make() rejects a TS timestamp dict keyed by address strings #1402.
• The other PaddingField remainders in schema/internet/ipv4.py (:318, :500, :534) may zero on rebuild in the same way. Nobody has probed them yet.

[github-actions]

Coverage: 89.43% (unit tier, Python 3.14, d04716c37, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	4	93.55%
pcapkit/const	18791	968	2352	869	90.90%
pcapkit/corekit	2018	88	628	24	94.78%
pcapkit/dumpkit	234	2	84	2	98.74%
pcapkit/foundation	2637	98	928	48	94.78%
pcapkit/interface	112	7	40	5	92.11%
pcapkit/protocols	16336	205	4328	167	98.16%
pcapkit/toolkit	539	74	168	3	84.58%
pcapkit/utilities	429	4	122	4	98.55%
pcapkit/vendor	4409	2342	1006	157	43.25%

Per-file detail: the coverage-html artifact of this run.