@@ -109,7 +109,7 @@ registry is one enumeration per transport protocol sharing a memberless base.
    :members:
    :undoc-members:
    :show-inheritance:
-   :special-members: __new__, __repr__, __str__, __int__, __eq__, __registry__, __canonical__
+   :special-members: __new__, __repr__, __str__, __int__, __eq__, __hash__, __registry__, __canonical__
 
 .. module:: pcapkit.const.reg.apptype.tcp
 
 
@@ -14,6 +14,7 @@ which reconstructs fragmented TCP packets back to origin.
 
    .. automethod:: reassembly
    .. automethod:: submit
+   .. automethod:: _make_ports
 
    .. autoattribute:: __protocol_name__
    .. autoattribute:: __protocol_type__
 
@@ -12,13 +12,14 @@
 if TYPE_CHECKING:
     from typing import Callable, Optional
 
+    from pcapkit.const.reg.apptype import TCP as AppType_TCP
     from pcapkit.const.reg.transtype import TransType
     from pcapkit.foundation.reassembly.data.ip import Datagram as IP_Datagram
     from pcapkit.foundation.reassembly.data.tcp import Datagram as TCP_Datagram
     from pcapkit.protocols.protocol import ProtocolBase
 
 # registry key an analyser dispatches a reassembled payload on; see ``Deferred``
-_KT = TypeVar('_KT', 'TransType', 'tuple[int, int]')
+_KT = TypeVar('_KT', 'TransType', 'tuple[AppType_TCP, AppType_TCP]')
 
 
 class Completion(EnumLookup, StrEnum):
@@ -148,23 +149,37 @@ class Deferred(Generic[_KT]):
       :meth:`Protocol.analyze <pcapkit.protocols.protocol.Protocol.analyze>`,
       which looks the next layer up by protocol registry number.
     * :meth:`TCP.submit <pcapkit.foundation.reassembly.tcp.TCP.submit>` builds a
-      ``Deferred[tuple[int, int]]``. It passes a ``(source, destination)`` port
-      pair, because :meth:`Transport.analyze
+      ``Deferred[tuple[AppType_TCP, AppType_TCP]]``. It passes a
+      ``(source, destination)`` port pair, because :meth:`Transport.analyze
       <pcapkit.protocols.transport.transport.Transport.analyze>` overrides that
       parameter to one: a reassembled transport-layer payload carries no
       protocol number, so its application protocol is inferred from the ports.
 
-    Those are the two cases the type parameter is constrained to. The pairing
-    the regression actually produced -- a port pair handed to an analyser
-    declared over :class:`~pcapkit.const.reg.transtype.TransType` -- is
-    rejected, which is the direction a real mismatch takes and the one
+    Those are the two cases the type parameter is constrained to. Both are
+    *named registry values* rather than one named value and one pair of bare
+    port numbers: a port is a member of
+    :class:`~pcapkit.const.reg.apptype.tcp.TCP` here -- the per-transport
+    registry itself, not the base
+    :class:`~pcapkit.const.reg.apptype.apptype.AppType`, since that is what
+    :meth:`TCP._make_ports <pcapkit.foundation.reassembly.tcp.TCP._make_ports>`
+    really answers with -- so what the deferred analysis dispatches on is of a
+    piece with what the eager path dispatches on at
+    :attr:`TCP.src <pcapkit.protocols.transport.tcp.TCP.src>`, whichever
+    reassembler built it. (Of a piece, not identical: for an *unassigned* port
+    the two paths build equal members by different routes, which
+    ``TCP.submit``'s own docstring records.)
+
+    The pairing the regression actually produced -- a port pair handed to an
+    analyser declared over :class:`~pcapkit.const.reg.transtype.TransType` --
+    is rejected, which is the direction a real mismatch takes and the one
     :issue:`2417` was about.
 
     Rejecting the *reverse* pairing is not guaranteed by mypy alone, for a
     reason outside this class: |aenum|_ ships no type stubs, so under
     ``ignore_missing_imports`` the ``aenum.IntEnum`` base of
     :class:`~pcapkit.const.reg.transtype.TransType` resolves to ``Any``. A
-    ``TransType`` is therefore accepted where a ``tuple[int, int]`` is
+    ``TransType`` is therefore accepted where a
+    ``tuple[AppType_TCP, AppType_TCP]`` is
     expected, and a ``Deferred[TransType]`` built over the port-pair analyser
     type-checks clean. That is a gap in the dependency's type coverage rather
     than in the constraint, which would bite both ways were ``TransType`` fully
 
@@ -19,6 +19,7 @@
 
     from typing_extensions import TypeAlias
 
+    from pcapkit.const.reg.apptype import TCP as AppType_TCP
     from pcapkit.protocols.protocol import ProtocolBase
 
 _AT = TypeVar('_AT', 'IPv4Address', 'IPv6Address')
@@ -84,7 +85,26 @@ def __init__(self, bufid: 'BufferID', dsn: 'int', ack: 'int', num: 'int', syn: '
 
 @info_final
 class DatagramID(Info, Generic[_AT]):
-    """Data model for :term:`TCP <reasm.tcp.datagram>` original packet identifier."""
+    """Data model for :term:`TCP <reasm.tcp.datagram>` original packet identifier.
+
+    Note:
+        The ports here stay bare :obj:`int` port numbers, where the pair
+        :meth:`TCP.submit <pcapkit.foundation.reassembly.tcp.TCP.submit>` hands
+        :class:`~pcapkit.foundation.reassembly.data.data.Deferred` is one of
+        :class:`~pcapkit.const.reg.apptype.tcp.TCP` members
+        (:issue:`2417`). The two are not the same thing to name: this is the
+        flow's identity, split out of :data:`BufferID`, which every
+        :mod:`pcapkit.toolkit` adapter builds from a plain port number -- the
+        native ones by reading :attr:`AppType.port
+        <pcapkit.const.reg.apptype.apptype.AppType.port>` off the parsed header,
+        the third-party ones from whatever their own engine exposes -- and which
+        is then used as a :class:`dict` key and dumped as part of the report.
+        The deferred pair is a *dispatch* key for
+        :meth:`Transport.analyze
+        <pcapkit.protocols.transport.transport.Transport.analyze>`, which is
+        what gains from carrying the service name.
+
+    """
 
     #: Source address.
     src: 'tuple[_AT, int]'
@@ -150,7 +170,7 @@ class Datagram(DeferredPacket, Info, Generic[_AT]):
         # :class:`~pcapkit.foundation.reassembly.data.ip.Datagram`, which applies
         # here identically: ``strict=False`` reports an incomplete payload buffer as
         # one contiguous ``bytes`` and analyses it.
-        def __init__(self, completed: 'Completion', id: 'DatagramID[_AT]', index: 'tuple[int, ...]', header: 'bytes', payload: 'bytes | tuple[bytes, ...]', packet: 'Optional[ProtocolBase | Deferred[tuple[int, int]]]', conflict: 'tuple[tuple[int, int], ...]') -> 'None': ...  # pylint: disable=unused-argument,super-init-not-called,multiple-statements,line-too-long,redefined-builtin
+        def __init__(self, completed: 'Completion', id: 'DatagramID[_AT]', index: 'tuple[int, ...]', header: 'bytes', payload: 'bytes | tuple[bytes, ...]', packet: 'Optional[ProtocolBase | Deferred[tuple[AppType_TCP, AppType_TCP]]]', conflict: 'tuple[tuple[int, int], ...]') -> 'None': ...  # pylint: disable=unused-argument,super-init-not-called,multiple-statements,line-too-long,redefined-builtin
 
 
 @info_final
 
@@ -12,6 +12,7 @@
 import math
 from typing import TYPE_CHECKING
 
+from pcapkit.const.reg.apptype import TransportProtocol as Enum_TransportProtocol
 from pcapkit.foundation.reassembly.data.data import Completion, Deferred
 from pcapkit.foundation.reassembly.data.tcp import (HOLE_OPEN_BOUND, Buffer, BufferID, Datagram,
                                                     DatagramID, Fragment, HoleDescriptor, Packet)
@@ -21,6 +22,8 @@
 if TYPE_CHECKING:
     from typing import Type
 
+    from pcapkit.const.reg.apptype import TCP as AppType_TCP
+
 __all__ = ['TCP']
 
 
@@ -653,6 +656,85 @@ def _merge_overlap(gap: 'list[tuple[int, int]]', old: 'bytes', new: 'bytes',
             index = stop
         return bytes(merged), conflicts
 
+    @staticmethod
+    def _make_ports(bufid: 'BufferID') -> 'tuple[AppType_TCP, AppType_TCP]':
+        """The flow's ``(source, destination)`` ports, as application types.
+
+        Arguments:
+            bufid: :term:`buffer <reasm.tcp.buffer>` identifier, whose positions
+                ``1`` and ``3`` are the source and destination ports.
+
+        Returns:
+            The pair :meth:`submit` hands
+            :class:`~pcapkit.foundation.reassembly.data.data.Deferred`, i.e. what
+            :meth:`Transport.analyze
+            <pcapkit.protocols.transport.transport.Transport.analyze>` dispatches
+            the reassembled payload on (:issue:`2417`). Typed as the
+            *per-transport* registry :class:`~pcapkit.const.reg.apptype.tcp.TCP`
+            rather than as the base
+            :class:`~pcapkit.const.reg.apptype.apptype.AppType`, because that is
+            what it really is: ``proto=tcp`` sends
+            :meth:`AppType.get <pcapkit.const.reg.apptype.apptype.AppType.get>`
+            through :meth:`AppType._dispatch
+            <pcapkit.const.reg.apptype.apptype.AppType._dispatch>` to the TCP
+            registry, and ``type(...) is TCP`` holds of the member it answers
+            with -- measured, for a registered port and an unassigned one alike.
+            :meth:`Transport.analyze
+            <pcapkit.protocols.transport.transport.Transport.analyze>` keeps the
+            base in its own signature, since it is the one method
+            :class:`~pcapkit.protocols.transport.udp.UDP` and
+            :class:`~pcapkit.protocols.transport.sctp.SCTP` share, and each of
+            them would name a different registry.
+
+        Important:
+            Every port a 16-bit header field can hold resolves to a member, so
+            this raises for nothing that can come off the wire:
+            :meth:`AppType.get <pcapkit.const.reg.apptype.apptype.AppType.get>`
+            answers an assignment with its canonical service, a port inside a
+            documented IANA span with that span's label (``reserved`` for ``0``),
+            and one in no span at all with an unregistered ``unknown`` member --
+            never :obj:`None`, and without growing the registry (:issue:`860`).
+            It rejects a port outside ``0``-``65535`` and a non-:obj:`int`.
+
+            A :obj:`bool` is rejected by :meth:`Transport._make_port
+            <pcapkit.protocols.transport.transport.Transport._make_port>` rather
+            than by ``get``, which is the reason to go through it here and not
+            call ``get`` directly: :obj:`bool` is an :obj:`int` subclass, so
+            ``AppType.get(True, proto=tcp)`` resolves ``True`` as port ``1`` and
+            answers ``<TCP.tcpmux: 1 [tcp]>`` -- measured -- where ``_make_port``
+            raises, which is what closed :issue:`2287`. Calling ``get`` straight
+            would reopen it. None of the three can come out of a TCP header
+            either way; what ``_make_port`` also buys is idempotence, so a
+            ``bufid`` already holding a member passes through untouched.
+
+        Note:
+            The resolution is reached through
+            :class:`~pcapkit.protocols.transport.tcp.TCP` rather than through
+            :attr:`self.protocol
+            <pcapkit.foundation.reassembly.reassembly.ReassemblyBase.protocol>`,
+            which is what :meth:`submit` reads the analyser itself off. That is
+            deliberate: ``__protocol_type__`` is an extension point, and an
+            analyser plugged into it need only define ``analyze`` -- it is not
+            required to be a
+            :class:`~pcapkit.protocols.transport.transport.Transport` subclass
+            and so need not have ``_make_port`` at all, which reaching it
+            through ``self.protocol`` would turn into an
+            :exc:`AttributeError`. What a TCP port *means* belongs to the TCP
+            protocol either way, not to whatever consumes the payload, which is
+            also why the transport below is named outright rather than read off
+            the analyser.
+
+        """
+        # NOTE: ``_make_port`` is protected, and reached from outside its own
+        # class as :meth:`SCTP._decode_next_layer
+        # <pcapkit.protocols.transport.sctp.SCTP._decode_next_layer>` reaches
+        # ``ProtocolBase._decode_next_layer``. Duplicating it here instead would
+        # put a second port normaliser beside the maker path's, free to drift
+        # from it; it is idempotent, so a ``bufid`` that already holds a member
+        # passes through unchanged.
+        return (TCP_Protocol._make_port(bufid[1], Enum_TransportProtocol.tcp),  # pylint: disable=protected-access
+                TCP_Protocol._make_port(bufid[3], Enum_TransportProtocol.tcp))  # pylint: disable=protected-access
+
     def submit(self, buf: 'Buffer', *, bufid: 'BufferID',  # type: ignore[override] # pylint: disable=arguments-differ
                timeout: 'bool' = False) -> 'list[Datagram]':
         """Submit reassembled payload.
@@ -667,6 +749,34 @@ def submit(self, buf: 'Buffer', *, bufid: 'BufferID',  # type: ignore[override]
         Returns:
             Reassembled :term:`packets <reasm.tcp.datagram>`.
 
+        Important:
+            The ``(source, destination)`` pair handed to
+            :class:`~pcapkit.foundation.reassembly.data.data.Deferred` is a pair
+            of :class:`~pcapkit.const.reg.apptype.tcp.TCP` members rather than
+            of the bare port numbers :data:`BufferID` holds (:issue:`2417`), so
+            a deferred analysis dispatches on the named service rather than on a
+            number. The resolution is :meth:`Transport._make_port
+            <pcapkit.protocols.transport.transport.Transport._make_port>`, so it
+            is the one the maker path uses and cannot drift from it. See
+            :meth:`_make_ports` for why it is reached through
+            :class:`~pcapkit.protocols.transport.tcp.TCP` rather than through
+            :attr:`self.protocol
+            <pcapkit.foundation.reassembly.reassembly.ReassemblyBase.protocol>`.
+
+            For a *registered* port that is the very member
+            :attr:`TCP.src <pcapkit.protocols.transport.tcp.TCP.src>` reads off
+            a parsed header. For an unassigned one the two are **equal but not
+            identical**, and not even equally named: the parse path builds its
+            member through :meth:`EnumField._unregistered_member
+            <pcapkit.corekit.fields.numbers.EnumField._unregistered_member>`,
+            whose ``.name`` is ``'<unassigned>'``, where ``get`` builds its own,
+            named ``'unknown'`` -- measured on port ``50000``. Both are real
+            members of the same registry carrying the same :attr:`AppType.port
+            <pcapkit.const.reg.apptype.apptype.AppType.port>`, which is what
+            every reader of this pair goes on to use, so the distinction costs
+            nothing here; it is recorded because "the same member the header
+            carries" would be an overstatement of it.
+
         """
         datagram = []  # type: list[Datagram] # reassembled datagram
 
@@ -751,7 +861,8 @@ def submit(self, buf: 'Buffer', *, bufid: 'BufferID',  # type: ignore[override]
                         index=tuple(buffer.ind),
                         header=buf.hdr,
                         payload=bytes(payload),
-                        packet=Deferred(self.protocol.analyze, (bufid[1], bufid[3]), bytes(payload)),
+                        packet=Deferred(self.protocol.analyze,
+                                        self._make_ports(bufid), bytes(payload)),
                         conflict=conflict,
                     )
                     datagram.append(packet)
 
@@ -132,21 +132,76 @@ def register(cls, code: 'int', protocol: 'ModuleDescriptor[ProtocolBase] | Type[
         cls.__proto__[code] = entry
 
     @classmethod
-    def analyze(cls, ports: 'tuple[int, int]', payload: 'bytes', **kwargs: 'Any') -> 'ProtocolBase':  # type: ignore[override] # pylint: disable=arguments-renamed
+    def analyze(cls, ports: 'tuple[Enum_AppType, Enum_AppType]', payload: 'bytes', **kwargs: 'Any') -> 'ProtocolBase':  # type: ignore[override] # pylint: disable=arguments-renamed
         """Analyse packet payload.
 
         Args:
-            ports: Source & destination port numbers.
+            ports: Source & destination ports, as the application types
+                :meth:`_make_port` resolves them to -- what
+                :attr:`TCP.src <pcapkit.protocols.transport.tcp.TCP.src>` and
+                :attr:`TCP.dst <pcapkit.protocols.transport.tcp.TCP.dst>` read
+                off a parsed header, resolved the same way.
             payload: Packet payload.
             **kwargs: Arbitrary keyword arguments.
 
         Returns:
             Parsed payload as a :class:`~pcapkit.protocols.protocol.Protocol`
             instance.
 
+        Important:
+            The annotation names the **base** registry rather than one
+            transport's own, because this is the single method
+            :class:`~pcapkit.protocols.transport.tcp.TCP`,
+            :class:`~pcapkit.protocols.transport.udp.UDP` and
+            :class:`~pcapkit.protocols.transport.sctp.SCTP` share, and each
+            resolves its ports in a different one --
+            :class:`~pcapkit.const.reg.apptype.tcp.TCP` for the first, and so
+            on. A caller that knows which transport it has gets the narrower
+            type from whatever handed it the pair, e.g.
+            :meth:`TCP._make_ports
+            <pcapkit.foundation.reassembly.tcp.TCP._make_ports>`.
+
+            A bare :obj:`int` port still resolves, so the tightened annotation
+            is a declaration of what callers should pass rather than a new
+            rejection -- the method predates 1.5.0, and a member and the port it
+            carries are the same key of an :obj:`int`-keyed mapping anyway:
+            :meth:`AppType.__hash__
+            <pcapkit.const.reg.apptype.apptype.AppType.__hash__>` is its port's
+            and :meth:`AppType.__eq__
+            <pcapkit.const.reg.apptype.apptype.AppType.__eq__>` compares against
+            it. So the port chosen below is tested against :attr:`__proto__`
+            exactly as it arrived, and the chosen one is unwrapped to the
+            :obj:`int` key the registry declares only when it is a member --
+            through :meth:`AppType.__int__
+            <pcapkit.const.reg.apptype.apptype.AppType.__int__>`, i.e.
+            :attr:`AppType.port
+            <pcapkit.const.reg.apptype.apptype.AppType.port>`. Reading
+            ``.port`` unconditionally would have made the :obj:`int` case an
+            :exc:`AttributeError`, and unwrapping unconditionally would have
+            changed what anything *else* does here: :func:`int` of :obj:`None`
+            raises where the lookup used to fall back to
+            :class:`~pcapkit.protocols.misc.raw.Raw`, and :func:`int` of
+            ``'80'`` would dispatch a :class:`str` nobody registered.
+
+            Nothing is written back on a miss either way, so a payload on an
+            unregistered port does not grow a process-wide registry -- see
+            :meth:`ProtocolBase._lookup_registry
+            <pcapkit.protocols.protocol.ProtocolBase._lookup_registry>`.
+
+        .. versionchanged:: 1.5.0
+
+           ``ports`` is a pair of
+           :class:`~pcapkit.const.reg.apptype.apptype.AppType` members rather
+           than of bare :obj:`int` port numbers, so that the one caller that
+           reaches this method -- :meth:`TCP.submit
+           <pcapkit.foundation.reassembly.tcp.TCP.submit>`, through
+           :class:`~pcapkit.foundation.reassembly.data.data.Deferred` -- hands
+           over the same named ports a parsed header carries (:issue:`2417`).
+
         """
+        port = ports[0] if ports[0] in cls.__proto__ else ports[1]
         protocol = cls._lookup_next_layer(
-            cls.__proto__, ports[0] if ports[0] in cls.__proto__ else ports[1])
+            cls.__proto__, int(port) if isinstance(port, Enum_AppType) else port)
 
         payload_io = io.BytesIO(payload)
         try: