[JarryShaw]

Please follow the guide below

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort) — not run; comments and docstrings only
• make test passes, and a test case covers the change — per-module runs below; prose only
• Added a changelog entry — N/A, added centrally

What is the purpose of your pull request?

• docs — documentation only

---

Description of your pull request and other information

Part of #1103. Protocols slice: 18 wave-touched files read, 2 changed.

• application/http.py: two _guess_version comments said the HTTP/2 fall-through accepts any self-consistent nine-octet buffer. It is now gated by _test_http2_frame. The fault-injection measurement is scoped to the ungated arm: no HTTP/1 start line passes the gate, because its octet 3 is never a frame type 0-9.
• protocol.py: the _parse_next_layer note said the captured octets are all of file_. The code uses min(length, len(file_)).

Tests: test_http_guess_http2_1141_unit 5 passed; test_http_unit 65 passed; test_next_layer_short_header_unit 7 passed; test_protocol_base_unit 15 passed; tests/project 389 passed, 1 skipped.

File	AST unchanged
pcapkit/protocols/application/http.py	True
pcapkit/protocols/protocol.py	True

[JarryShaw]

Cross-review verdict on 68c573bab: GOOD TO GO (ran on Sonnet; author Opus). Labelled review: good-to-go.

• HTTP/2 arm: the wording matches _test_http2_frame (http.py:61) and the gate at :450.
• Fault-injection sentence: the rescoping is honest. Octet 3 of every HTTP/1 start line probed is 0x20 or above, so it can never be a frame type 0–9. The rationale for not suppressing StructError on arm 1 still stands, because suppressing it would erase StructError.eof.
• protocol.py: "the first length of file_, or all of it when it holds fewer" is exactly captured = min(length, len(file_)) (:1870). All three callers default length to len(file_), so it is never None.
• No code change: the docstring-stripped AST is unchanged for both files. Note that the guard table's True for protocol.py means docstring-stripped.
• No churn and no timed context.
• Tests: test_http_unit 65 passed, test_protocol_base_unit 15 passed, tests/project 389 passed.
• Unverified: the historical mislabel itself was not reproduced, since the reviewer's mock of arm 1 did not take. The sentence describes it as a past measurement, not as current behaviour.

[github-actions]

Coverage: 88.89% (unit tier, Python 3.14, 68c573bab, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	4	93.55%
pcapkit/const	18757	1034	2342	845	90.24%
pcapkit/corekit	1878	91	580	22	94.34%
pcapkit/dumpkit	142	0	42	0	100.00%
pcapkit/foundation	2442	102	852	39	94.38%
pcapkit/interface	112	7	40	5	92.11%
pcapkit/protocols	15707	188	3974	163	98.19%
pcapkit/toolkit	487	65	144	1	85.42%
pcapkit/utilities	429	4	122	4	98.55%
pcapkit/vendor	4409	2359	1006	158	42.84%

Per-file detail: the coverage-html artifact of this run.