youknowone · Nov 4, 2026 · Nov 5, 2026 · Nov 7, 2026 · Nov 7, 2026 · Nov 7, 2026
diff --git a/Lib/test/test_cmd_line.py b/Lib/test/test_cmd_line.py
@@ -562,7 +562,6 @@ def test_unmached_quote(self):
         self.assertRegex(err.decode('ascii', 'ignore'), 'SyntaxError')
         self.assertEqual(b'', out)
 
-    @unittest.expectedFailure  # TODO: RUSTPYTHON
     @force_not_colorized
     def test_stdout_flush_at_shutdown(self):
         # Issue #5319: if stdout.flush() fails at shutdown, an error should

diff --git a/crates/common/src/lock/thread_mutex.rs b/crates/common/src/lock/thread_mutex.rs
@@ -8,7 +8,7 @@ use core::{
     ptr::NonNull,
     sync::atomic::{AtomicUsize, Ordering},
 };
-use lock_api::{GetThreadId, GuardNoSend, RawMutex};
+use lock_api::{GetThreadId, GuardNoSend, RawMutex, RawMutexTimed};
 
 // based off ReentrantMutex from lock_api
 
@@ -175,6 +175,30 @@ impl<R: RawMutex, G: GetThreadId, T: ?Sized> ThreadMutex<R, G, T> {
     }
 }
 
+impl<R: RawMutexTimed, G: GetThreadId, T: ?Sized> ThreadMutex<R, G, T> {
+    /// Wait at most `timeout`, wrapping only the blocking acquisition.
+    pub fn try_lock_for_wrapped<F: FnOnce(&dyn Fn() -> bool) -> bool>(
+        &self,
+        timeout: R::Duration,
+        wrap_fn: F,
+    ) -> Result<ThreadMutexGuard<'_, R, G, T>, TryLockThreadError>
+    where
+        R::Duration: Copy,
+    {
+        match self
+            .raw
+            .lock_internal(|| wrap_fn(&|| self.raw.mutex.try_lock_for(timeout)))
+        {
+            Some(true) => Ok(ThreadMutexGuard {
+                mu: self,
+                marker: PhantomData,
+            }),
+            Some(false) => Err(TryLockThreadError::Other),
+            None => Err(TryLockThreadError::Current),
+        }
+    }
+}
+
 #[derive(Clone, Copy)]
 pub enum TryLockThreadError {
     /// Failed to lock because mutex was already locked on another thread.
@@ -353,3 +377,36 @@ impl<R: RawMutex, G: GetThreadId, T: ?Sized + fmt::Debug> fmt::Debug
         fmt::Debug::fmt(&**self, f)
     }
 }
+
+#[cfg(test)]
+#[cfg(feature = "threading")]
+mod tests {
+    use super::TryLockThreadError;
+    use crate::lock::PyThreadMutex;
+    use core::time::Duration;
+
+    #[test]
+    fn timed_lock_preserves_ownership() {
+        let mutex = PyThreadMutex::new(0);
+        let guard = mutex.lock().unwrap();
+        assert!(matches!(
+            mutex.try_lock_for_wrapped(Duration::ZERO, |_| panic!("reentrant wait")),
+            Err(TryLockThreadError::Current)
+        ));
+        std::thread::scope(|scope| {
+            scope.spawn(|| {
+                assert!(matches!(
+                    mutex.try_lock_for_wrapped(Duration::from_millis(1), |wait| wait()),
+                    Err(TryLockThreadError::Other)
+                ));
+            });
+        });
+        drop(guard);
+        let mut guard = mutex
+            .try_lock_for_wrapped(Duration::ZERO, |wait| wait())
+            .unwrap_or_else(|_| panic!("unlocked mutex"));
+        *guard = 1;
+        drop(guard);
+        assert_eq!(*mutex.lock().unwrap(), 1);
+    }
+}
diff --git a/crates/host_env/src/readline.rs b/crates/host_env/src/readline.rs
@@ -197,6 +197,84 @@ impl<H: Helper> Readline<H> {
     }
 }
 
+/// A nested readline must fail rather than consume the outer call's input.
+#[derive(Debug)]
+pub struct ReentrantReadline;
+
+#[derive(PartialEq, Eq)]
+struct TerminalIdentity {
+    streams: StreamIdentity,
+}
+
+#[cfg(unix)]
+type StreamIdentity = (libc::dev_t, libc::ino_t, libc::dev_t);
+#[cfg(windows)]
+type StreamIdentity = [usize; 2];
+#[cfg(not(any(unix, windows)))]
+type StreamIdentity = ();
+
+impl TerminalIdentity {
+    fn current() -> io::Result<Self> {
+        #[cfg(unix)]
+        let streams = {
+            let mut stat = core::mem::MaybeUninit::<libc::stat>::uninit();
+            // Only an input change invalidates read-ahead. Unix rustyline uses
+            // fd 1 directly, so an output-only change needs no new editor.
+            if unsafe { libc::fstat(0, stat.as_mut_ptr()) } != 0 {
+                return Err(io::Error::last_os_error());
+            }
+            let stat = unsafe { stat.assume_init() };
+            (stat.st_dev, stat.st_ino, stat.st_rdev)
+        };
+        #[cfg(windows)]
+        let streams = {
+            use windows_sys::Win32::System::Console::{STD_INPUT_HANDLE, STD_OUTPUT_HANDLE};
+            // Windows rustyline caches both handles, but has no read-ahead
+            // buffer (ConsoleRawReader::unbuffer returns None).
+            [
+                crate::winapi::get_std_handle(STD_INPUT_HANDLE)?.unwrap_or_default() as usize,
+                crate::winapi::get_std_handle(STD_OUTPUT_HANDLE)?.unwrap_or_default() as usize,
+            ]
+        };
+        #[cfg(not(any(unix, windows)))]
+        let streams = ();
+        Ok(Self { streams })
+    }
+}
+
+struct InputReader {
+    identity: TerminalIdentity,
+    reader: Readline<()>,
+}
+
+// stdin is process-wide, not thread-local. Retain read-ahead when the next
+// input() runs on another thread, and serialize the terminal's raw-mode guards.
+// A reentrant mutex plus a fallible borrow rejects same-thread recursion without
+// deadlocking. The reader contains no Python references or interpreter helper.
+static INPUT_READER: parking_lot::ReentrantMutex<core::cell::RefCell<Option<InputReader>>> =
+    parking_lot::ReentrantMutex::new(core::cell::RefCell::new(None));
+
+/// Read an interactive input line with the process's retained terminal reader.
+/// The VM must detach while waiting for both the lock and terminal input.
+pub fn input_readline(prompt: &str) -> Result<ReadlineResult, ReentrantReadline> {
+    let guard = INPUT_READER.lock();
+    let mut slot = guard.try_borrow_mut().map_err(|_| ReentrantReadline)?;
+    let identity = match TerminalIdentity::current() {
+        Ok(identity) => identity,
+        Err(error) => return Ok(ReadlineResult::Io(error)),
+    };
+    if slot
+        .as_ref()
+        .is_none_or(|reader| reader.identity != identity)
+    {
+        *slot = Some(InputReader {
+            identity,
+            reader: Readline::new(()),
+        });
+    }
+    Ok(slot.as_mut().unwrap().reader.readline(prompt))
+}
+
 /// Borrow the shared buffered stdin for one physical read. The caller retains
 /// partial bytes across EINTR and checks signals after this lock is released.
 pub fn stdio_readline_bytes(prompt: &str, line: &mut Vec<u8>) -> io::Result<usize> {
@@ -229,6 +307,16 @@ fn read_line_bytes(reader: &mut impl io::BufRead, line: &mut Vec<u8>) -> io::Res
 
 #[cfg(test)]
 mod tests {
+    #[test]
+    fn nested_input_is_rejected_before_touching_the_terminal() {
+        let guard = super::INPUT_READER.lock();
+        let _active_reader = guard.borrow_mut();
+        assert!(matches!(
+            super::input_readline(""),
+            Err(super::ReentrantReadline)
+        ));
+    }
+
     use super::read_line_bytes;
     use std::io::{self, BufRead, Read};
 

diff --git a/crates/vm/src/exceptions.rs b/crates/vm/src/exceptions.rs
@@ -194,12 +194,7 @@ impl VirtualMachine {
     /// Display `exc` through `traceback._print_exception_bltin`, falling back
     /// to the native printer writing to `file`.
     pub(crate) fn display_exception_to(&self, file: &PyObject, exc: &Py<PyBaseException>) {
-        if let Ok(print_exception) = self
-            .import("traceback", 0)
-            .and_then(|traceback| traceback.get_attr("_print_exception_bltin", self))
-            && print_exception.is_callable()
-            && print_exception.call((exc.to_owned(),), self).is_ok()
-        {
+        if self.try_display_exception_to(file, exc.as_object()) {
             return;
         }
         if self
@@ -212,6 +207,19 @@ impl VirtualMachine {
         let _ = self.call_method(file, "flush", ());
     }
 
+    /// Try the shared Python formatter with the caller's retained output file.
+    /// Reporting paths provide their own native fallback if it is unavailable.
+    pub(crate) fn try_display_exception_to(&self, file: &PyObject, exc: &PyObject) -> bool {
+        self.import("traceback", 0)
+            .and_then(|traceback| traceback.get_attr("_print_exception_bltin", self))
+            .is_ok_and(|print_exception| {
+                print_exception.is_callable()
+                    && print_exception
+                        .call((exc.to_owned(), file.to_owned()), self)
+                        .is_ok()
+            })
+    }
+
     pub fn write_exception<W: Write>(
         &self,
         output: &mut W,

diff --git a/crates/vm/src/stdlib/_io.rs b/crates/vm/src/stdlib/_io.rs
@@ -1795,6 +1795,63 @@ mod _io {
         }
     }
 
+    #[cfg(feature = "threading")]
+    fn shutdown_buffer_description(
+        class_name: &str,
+        raw: Option<PyObjectRef>,
+        vm: &VirtualMachine,
+    ) -> String {
+        // Fatal diagnostics must not acquire an I/O lock or invoke user code.
+        // Inspect dictionary entries directly, avoiding custom attribute,
+        // equality, and repr implementations even on unusual raw streams.
+        // Limit diagnostic metadata; standard stream names are short and are
+        // among the first attributes installed on their FileIO objects.
+        let name = raw.and_then(|raw| raw.dict()).and_then(|dict| {
+            dict.into_iter().take(16).find_map(|(key, value)| {
+                let key = key.downcast_ref::<PyStr>()?;
+                if key.as_wtf8() != "name" || !value.class().is(vm.ctx.types.str_type) {
+                    return None;
+                }
+                let name = value.downcast_ref::<PyStr>()?;
+                if name.byte_len() > 1024 {
+                    return None;
+                }
+                PyStr::repr(name, vm).ok()
+            })
+        });
+        match name {
+            Some(name) => format!("<_io.{class_name} name={name}>"),
+            None => format!("<_io.{class_name}>"),
+        }
+    }
+
+    #[cfg(feature = "threading")]
+    fn shutdown_io_lock<'a, T>(
+        mutex: &'a PyThreadMutex<T>,
+        vm: &VirtualMachine,
+        reentrant_error: &'static str,
+        describe: impl FnOnce() -> String,
+    ) -> PyResult<PyThreadMutexGuard<'a, T>> {
+        use crate::common::lock::TryLockThreadError;
+        // Daemon threads may have parked permanently while owning this lock.
+        // Match _enter_buffered_busy's one-second grace period, including for
+        // RustPython's additional TextIOWrapper lock.
+        match mutex.try_lock_for_wrapped(core::time::Duration::from_secs(1), |wait| {
+            vm.allow_threads(wait)
+        }) {
+            Ok(guard) => Ok(guard),
+            Err(TryLockThreadError::Current) => Err(vm.new_runtime_error(reentrant_error)),
+            Err(TryLockThreadError::Other) => {
+                let message = format!(
+                    "Fatal Python error: _enter_buffered_busy: could not acquire lock for {} at interpreter shutdown, possibly due to daemon threads\n",
+                    describe()
+                );
+                let _ = crate::host_env::crt_fd::write_noraise(2, message.as_bytes());
+                crate::host_env::os::abort()
+            }
+        }
+    }
+
     #[pyclass]
     trait BufferedMixin: PyPayload + StaticType {
         const CLASS_NAME: &'static str;
@@ -1808,6 +1865,21 @@ mod _io {
         fn finalizing(&self) -> &AtomicBool;
 
         fn lock(&self, vm: &VirtualMachine) -> PyResult<PyThreadMutexGuard<'_, BufferedData>> {
+            #[cfg(feature = "threading")]
+            if vm.state.finalizing.load(Ordering::Acquire) {
+                return shutdown_io_lock(
+                    self.data(),
+                    vm,
+                    "reentrant call inside buffered io",
+                    || {
+                        shutdown_buffer_description(
+                            Self::CLASS_NAME,
+                            self.raw_cell().load_owned(),
+                            vm,
+                        )
+                    },
+                );
+            }
             self.data()
                 .lock_wrapped(|do_lock| vm.allow_threads(do_lock))
                 .ok_or_else(|| vm.new_runtime_error("reentrant call inside buffered io"))
@@ -3216,6 +3288,25 @@ mod _io {
             &self,
             vm: &VirtualMachine,
         ) -> PyResult<PyThreadMutexGuard<'_, Option<TextIOData>>> {
+            #[cfg(feature = "threading")]
+            if vm.state.finalizing.load(Ordering::Acquire) {
+                return shutdown_io_lock(&self.data, vm, "reentrant call inside textio", || {
+                    let Some(buffer) = self.buffer.load_owned() else {
+                        return "<_io.TextIOWrapper>".to_owned();
+                    };
+                    let (class_name, raw) =
+                        if let Some(buffer) = buffer.downcast_ref::<BufferedWriter>() {
+                            (BufferedWriter::CLASS_NAME, buffer.raw.load_owned())
+                        } else if let Some(buffer) = buffer.downcast_ref::<BufferedReader>() {
+                            (BufferedReader::CLASS_NAME, buffer.raw.load_owned())
+                        } else if let Some(buffer) = buffer.downcast_ref::<BufferedRandom>() {
+                            (BufferedRandom::CLASS_NAME, buffer.raw.load_owned())
+                        } else {
+                            return format!("<{}>", buffer.class().slot_name());
+                        };
+                    shutdown_buffer_description(class_name, raw, vm)
+                });
+            }
             self.data
                 .lock_wrapped(|do_lock| vm.allow_threads(do_lock))
                 .ok_or_else(|| vm.new_runtime_error("reentrant call inside textio"))

diff --git a/crates/vm/src/stdlib/builtins.rs b/crates/vm/src/stdlib/builtins.rs
@@ -26,7 +26,7 @@ mod builtins {
         },
         protocol::{PyIter, PyIterReturn},
         py_io,
-        readline::{Readline, ReadlineResult},
+        readline::ReadlineResult,
         types::PyComparisonOp,
         vm::compile_mode::{CompileStart, CompilerFlags, compile_future_features_from_flags},
     };
@@ -907,8 +907,10 @@ mod builtins {
 
         if use_rustyline {
             let prompt = prompt_str.unwrap();
-            let mut readline = Readline::new(());
-            match readline.readline(prompt) {
+            let result = vm
+                .allow_threads(|| crate::readline::input_readline(prompt))
+                .map_err(|_| vm.new_runtime_error("can't re-enter readline"))?;
+            match result {
                 ReadlineResult::Line(s) => {
                     let result = vm.ctx.new_str(s);
                     vm.audit("builtins.input/result", || (result.clone(),))?;