fix: make timeout and total_timeout mean what they say

[simonx1]

Three defects, one subject: how long a call can actually take.

timeout didn't bound the request. Only open_timeout and read_timeout were set. Net::HTTP's write timeout kept its own default — 60 seconds in the runtimes I checked — so a request whose body stalled on the way out ran twelve times longer than timeout: 5 promised, and past the 30s total_timeout as well. The TLS handshake had no limit of its own either.

Net::HTTP.new("example.com", 443).write_timeout   # => 60

Net::WriteTimeout was not in TIMEOUT_EXCEPTIONS, so the one failure that gap produces was classified as a plain TransportError and never retried, whatever retry_timeouts said. (It's a Timeout::Error < RuntimeError, so it was caught by the generic rescue StandardError and passed straight through.)

total_timeout was documented as a budget "across attempts and delays" but was only consulted around the sleeps. An attempt already in flight ran to its own timeout regardless, so the real worst case was the budget plus a full attempt.

The fix

• Set all four Net::HTTP timeouts: open, ssl, read, write.
• Add Net::WriteTimeout to TIMEOUT_EXCEPTIONS.
• Give each attempt the smaller of timeout and the remaining budget, so one slow attempt cannot outlive the whole call. An attempt that would start with nothing left raises TimeoutError instead of running.
• budget_exceeded? compares with >=: a delay landing exactly on the deadline has spent the whole budget, and the attempt after it would have had zero seconds.
• Validate timeout: at construction — timeout: "5" used to fail inside Net::HTTP on the first request.

Handing an attempt its budget needs a way to tell the transport, so the contract grows an optional timeout: keyword. A transport that doesn't declare one is called exactly as before, so existing custom transports keep working — there's a test for that.

Tests

test/deadline_test.rb, 14 cases: budget clamping across attempts, the exact-deadline boundary, write-timeout retry and opt-out, backwards compatibility of the three-keyword transport, and a stubbed check that all four Net::HTTP timeouts are set. Suite green on 3.2.11 / 3.3.8 / 3.4.8.

---

One of a series from a security and API-coverage audit. Branches are independent, each off main.

🤖 Generated with Claude Code