[JarryShaw]

• Searched for similar pull requests
• Followed the coding style
• make test passes, and a test case covers the change
• Changelog entry: N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

• fix — bug fix

---

Description

Closes #2294.

• Problem: Integrity.rfcs tested the whole registry cell against UNKNOWN, but IANA spells the "no document" cell [UNSPECIFIED], brackets included — so it passed through unrendered, giving pcapkit.const.esp.integrity entries like AUTH_DES_MAC [UNSPECIFIED] (DEPRECATED [:rfc:8247]). Cipher.rfcs shares the same check.
• Fix: strip one pair of surrounding brackets before the UNKNOWN comparison, in both crawlers. The const file is regenerated by running the crawler against the live registry; cipher.py regenerates unchanged.
• Test: test_esp_unspecified_reference_2294_unit checks both crawlers' rfcs handling on bracketed and bare placeholders and renders the recorded registry into the committed integrity.py.
• Fail-without-fix: 11 failed on the pre-fix tree (10 placeholder subtests across both crawlers, plus the committed-file match). Passing on the head.

[JarryShaw]

Review: GOOD TO GO at 19136d4b5 (Sonnet). Confirmed against the live IANA registries: [UNSPECIFIED] exists exactly in Integrity rows 3/4, the fix strips exactly one bracket pair (28 edge cases checked, legitimately-bracketed cells like [RFC 4868] and [Matt_Ball] untouched), the regenerated const file matches a fresh crawl byte-for-byte, and Cipher's claimed no-op is real (same sha256 before/after). Mutation-verified: reverting either crawler's fix or the const file fails exactly its own assertion. Fail-without-fix: 11 failures on the pre-fix tree.
Added labels (bug/fix/const) and a fail-without-fix line to the body — the reviewer's only metadata gaps. One remaining nit (docstring past-tense wording, #1103 convention) has a fix dispatched.

[JarryShaw]

Rebased and amended 19136d4b5 → fe5dd8c93 (6 commits onto current origin/main, clean): reworded the test module docstring off the past-tense "so the test missed it" narrative into the #1103 sweep's present-tense/"Guards against" convention. Prose-only, verified with an AST diff (docstrings stripped) showing no code change. 3/3 tests pass.

All review findings now addressed.

[github-actions]

Coverage: 91.64% (unit tier, Python 3.15, fe5dd8c93, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	2	95.16%
pcapkit/const	19601	881	2620	867	92.12%
pcapkit/corekit	2596	74	818	37	96.51%
pcapkit/dumpkit	282	3	102	3	98.44%
pcapkit/foundation	3029	23	1050	25	98.82%
pcapkit/interface	138	4	52	3	96.32%
pcapkit/protocols	17455	218	4598	185	98.15%
pcapkit/toolkit	914	36	334	10	95.51%
pcapkit/utilities	502	7	144	5	98.14%
pcapkit/vendor	4434	1961	1018	167	52.49%

Per-file detail: the coverage-html artifact of this run.

[JarryShaw]

Ready to merge.

Review: GOOD TO GO (Sonnet) at fe5dd8c93.
CI: Required checks passed, 0 failures (only the non-blocking experimental GraalPy leg still pending, if at all).
Mergeable, 0 unresolved threads.