zuvloop 0.0.2__tar.gz → 0.0.4__tar.gz

{zuvloop-0.0.2 → zuvloop-0.0.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: zuvloop
-Version: 0.0.2
+Version: 0.0.4
 Summary: A libuv event loop for asyncio, written in Zig.
 Project-URL: Source, https://github.com/Kludex/zuvloop
 Author-email: Marcelo Trylesinski <marcelotryle@gmail.com>
@@ -122,9 +122,11 @@ That's it. That's the migration. 🎉
 ## Observability
 
 zuvloop emits plain OpenTelemetry. The only runtime dependency is `opentelemetry-api` — not the
-SDK, nothing vendor-specific. Configure providers before starting the loop; zuvloop checks for them
-at each `run_forever()` entry. Until then the instruments are no-ops and slow-callback timing stays
-off.
+SDK, nothing vendor-specific. Providers can be configured before the loop starts or from inside
+it — `logfire.configure()` in `main()` works: zuvloop checks at each `run_forever()` entry and
+re-checks on its sampling interval (`loop.metrics_interval`, 10 seconds by default) while the
+loop runs. Until a provider is installed the instruments are no-ops and slow-callback timing
+stays off.
 
 Anything that speaks OpenTelemetry can collect it. For example, with
 <a href="https://logfire.pydantic.dev" target="_blank">Logfire</a>:
@@ -144,8 +146,8 @@ zuvloop.run(main())
 
 That's all — there is no zuvloop-specific setup. Spans and counters are emitted
 as events happen, and the loop gauges are sampled automatically while the loop
-runs (only when a real provider is installed, so an uninstrumented program never
-pays for sampling).
+runs (published only once a real provider is installed; without one the
+snapshot is dropped).
 
 You get:
 
@@ -193,7 +195,7 @@ zuvloop keeps its timer heap in native code and reads the clock directly, so mon
 returns and nothing else. A loop that needs a controllable clock should schedule against one
 explicitly.
 
-Also not implemented: `sendfile()` and `sock_sendfile()` raise `NotImplementedError`. Handles
+One more deliberate divergence: handles
 returned by `call_soon` implement the `asyncio.Handle` interface but are not instances of it:
 the base class is 56 bytes of storage such a handle never writes, measured at 2% of `call_soon`,
 which is the object the loop allocates more often than any other. `call_later` and `call_at`
@@ -209,6 +211,8 @@ $ uv pip install -e . --group dev
 $ uv run pytest
 $ uv run mypy
 $ uv run ruff check
+$ uv run ruff format --check
+$ ./scripts/check-zig  # requires ZLint 0.9.1 on PATH
 $ uv run --group bench python benchmarks/run.py
 ```
 
@@ -219,7 +223,7 @@ $ python scripts/build.py
 ```
 
 `vendor/libuv` is an unmodified upstream release tarball; see `vendor/README.md`. Update it with
-`./vendor/update-libuv.sh <version>`.
+`./vendor/update-libuv.sh <version> <sha256>`.
 
 ## License
 

{zuvloop-0.0.2 → zuvloop-0.0.4}/README.md

@@ -98,9 +98,11 @@ That's it. That's the migration. 🎉
 ## Observability
 
 zuvloop emits plain OpenTelemetry. The only runtime dependency is `opentelemetry-api` — not the
-SDK, nothing vendor-specific. Configure providers before starting the loop; zuvloop checks for them
-at each `run_forever()` entry. Until then the instruments are no-ops and slow-callback timing stays
-off.
+SDK, nothing vendor-specific. Providers can be configured before the loop starts or from inside
+it — `logfire.configure()` in `main()` works: zuvloop checks at each `run_forever()` entry and
+re-checks on its sampling interval (`loop.metrics_interval`, 10 seconds by default) while the
+loop runs. Until a provider is installed the instruments are no-ops and slow-callback timing
+stays off.
 
 Anything that speaks OpenTelemetry can collect it. For example, with
 <a href="https://logfire.pydantic.dev" target="_blank">Logfire</a>:
@@ -120,8 +122,8 @@ zuvloop.run(main())
 
 That's all — there is no zuvloop-specific setup. Spans and counters are emitted
 as events happen, and the loop gauges are sampled automatically while the loop
-runs (only when a real provider is installed, so an uninstrumented program never
-pays for sampling).
+runs (published only once a real provider is installed; without one the
+snapshot is dropped).
 
 You get:
 
@@ -169,7 +171,7 @@ zuvloop keeps its timer heap in native code and reads the clock directly, so mon
 returns and nothing else. A loop that needs a controllable clock should schedule against one
 explicitly.
 
-Also not implemented: `sendfile()` and `sock_sendfile()` raise `NotImplementedError`. Handles
+One more deliberate divergence: handles
 returned by `call_soon` implement the `asyncio.Handle` interface but are not instances of it:
 the base class is 56 bytes of storage such a handle never writes, measured at 2% of `call_soon`,
 which is the object the loop allocates more often than any other. `call_later` and `call_at`
@@ -185,6 +187,8 @@ $ uv pip install -e . --group dev
 $ uv run pytest
 $ uv run mypy
 $ uv run ruff check
+$ uv run ruff format --check
+$ ./scripts/check-zig  # requires ZLint 0.9.1 on PATH
 $ uv run --group bench python benchmarks/run.py
 ```
 
@@ -195,7 +199,7 @@ $ python scripts/build.py
 ```
 
 `vendor/libuv` is an unmodified upstream release tarball; see `vendor/README.md`. Update it with
-`./vendor/update-libuv.sh <version>`.
+`./vendor/update-libuv.sh <version> <sha256>`.
 
 ## License
 

{zuvloop-0.0.2 → zuvloop-0.0.4}/pyproject.toml

@@ -1,14 +1,18 @@
 [build-system]
-requires = ["hatchling", "hatch-ziglang", "ziglang==0.16.0"]
+# hatch-ziglang is pinned exactly: it runs during the isolated wheel build and
+# invokes the native compiler, so a future version resolved from a lower bound
+# could execute unreviewed code into the wheels the publish job trusts. The
+# compiler is pinned for the same reason. Bump both deliberately.
+requires = ["hatchling", "hatch-vcs==0.5.0", "hatch-ziglang==0.2.1", "ziglang==0.16.0"]
 build-backend = "hatchling.build"
 
 [project]
 name = "zuvloop"
-version = "0.0.2"
 description = "A libuv event loop for asyncio, written in Zig."
 readme = "README.md"
 requires-python = ">=3.14"
 license = "MIT"
+dynamic = ["version"]
 # libuv is compiled into the extension, so its licence ships with the wheel.
 license-files = ["LICENSE", "vendor/libuv/LICENSE*"]
 authors = [{ name = "Marcelo Trylesinski", email = "marcelotryle@gmail.com" }]
@@ -40,6 +44,17 @@ dev = [
 bench = ["aiohttp", "httptools", "pytest-codspeed>=5", "uvicorn", "uvloop>=0.21"]
 docs = ["zensical"]
 
+[tool.hatch.version]
+source = "vcs"
+
+[tool.hatch.version.raw-options]
+# A tag is the version; commits after it are the next patch's dev builds, so an
+# untagged build can never claim to be the release. `no-local-version` drops the
+# `+<hash>` segment, which PyPI refuses on upload.
+version_scheme = "guess-next-dev"
+local_scheme = "no-local-version"
+fallback_version = "0.0.0"
+
 [tool.hatch.build.targets.wheel]
 packages = ["zuvloop"]
 

zuvloop-0.0.4/vendor/README.md

@@ -0,0 +1,17 @@
+# Vendored dependencies
+
+## libuv
+
+- Version: **1.51.0**
+- Source: <https://dist.libuv.org/dist/v1.51.0/libuv-v1.51.0.tar.gz>
+- SHA-256: `5f0557b90b1106de71951a3c3931de5e0430d78da1d9a10287ebc7a3f78ef8eb`
+
+The tree under `libuv/` is the upstream release tarball, extracted verbatim. **Never edit it.**
+Everything zuvloop adds lives in `zig/`, and `build.zig` compiles the vendored sources with the same
+defines and file lists as upstream's `CMakeLists.txt`.
+
+A weekly workflow checks for a new signed release, verifies its signer against
+`libuv-maintainer-keys.txt`, tests every supported target, and opens an update pull request. For a
+manual update, verify the checksum through an independent channel, then run
+`./vendor/update-libuv.sh <version> <sha256>` and re-check the file lists at the top of `build.zig`
+against the new `CMakeLists.txt`.

zuvloop-0.0.4/vendor/libuv-maintainer-keys.txt

@@ -0,0 +1,12 @@
+# Full fingerprint and libuv git tag containing the public key.
+# Keep this trust root in sync with https://github.com/libuv/libuv/blob/v1.x/MAINTAINERS.md.
+D77B1E34243FBAF05F8E9CC34F55C8C846AB89B9 pubkey-bnoordhuis
+94AE36675C464D64BAFA68DD7434390BDBE9B9C5 pubkey-cjihrig
+57353E0DBDAAA7E839B66A1AFF47D5E4AD8B4FDC pubkey-cjihrig-kb
+AEAD0A4B686767751A0E4AEF34A25FB128246514 pubkey-vtjnash
+CFBB9CA9A5BEAFD70E2B3C5A79A67C55A3679C8B pubkey2022-vtjnash
+5804F9998A922AFBA39847A0718350906134887F github:erw7
+C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C pubkey-richardlau
+612F0EAD9401622379DF4402F28C3C8DA33C03BE pubkey-santigimeno
+FDF519364458319FA8233DC9410E5553AE9BC059 pubkey-saghul
+AEFC279A0C9306767E5829A1251CA676820DC7F3 pubkey-trevnorris

zuvloop-0.0.4/vendor/update-libuv.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# Replace vendor/libuv with a pristine upstream release tarball.
+set -euo pipefail
+
+version="${1:?usage: update-libuv.sh <version> <sha256>, e.g. 1.51.0 5f0557...}"
+checksum="${2:?supply the SHA-256 published for libuv ${version}}"
+if [[ ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+    echo "invalid libuv version: $version" >&2
+    exit 2
+fi
+if [[ ! "$checksum" =~ ^[[:xdigit:]]{64}$ ]]; then
+    echo "invalid SHA-256: $checksum" >&2
+    exit 2
+fi
+here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+url="https://dist.libuv.org/dist/v${version}/libuv-v${version}.tar.gz"
+
+tmp="$(mktemp -d)"
+trap 'rm -rf "$tmp"' EXIT
+
+curl -fsSL "$url" -o "$tmp/libuv.tar.gz"
+printf '%s  %s\n' "$checksum" "$tmp/libuv.tar.gz" | shasum -a 256 -c -
+tar xzf "$tmp/libuv.tar.gz" -C "$tmp"
+rm -rf "$here/libuv"
+mv "$tmp/libuv-v${version}" "$here/libuv"
+
+sed -i.bak -E "s/\*\*[0-9]+\.[0-9]+\.[0-9]+\*\*/**${version}**/; s|dist/v[0-9]+\.[0-9]+\.[0-9]+/libuv-v[0-9]+\.[0-9]+\.[0-9]+|dist/v${version}/libuv-v${version}|g; s|SHA-256: \`[[:xdigit:]]{64}\`|SHA-256: \`${checksum}\`|" "$here/README.md"
+if ! grep -Fq -- "- Version: **${version}**" "$here/README.md" ||
+    ! grep -Fq -- "dist/v${version}/libuv-v${version}.tar.gz" "$here/README.md" ||
+    ! grep -Fq -- "SHA-256: \`${checksum}\`" "$here/README.md"; then
+    mv "$here/README.md.bak" "$here/README.md"
+    echo "failed to update vendor/README.md; check its format" >&2
+    exit 1
+fi
+rm -f "$here/README.md.bak"
+
+echo "vendored libuv ${version} from ${url}"
+echo "now diff vendor/libuv/CMakeLists.txt against the source lists in build.zig"

{zuvloop-0.0.2 → zuvloop-0.0.4}/zig/addr.zig

@@ -35,6 +35,7 @@ fn tupleItem(t: *py.Object, i: c.Py_ssize_t) py.Error!*py.Object {
 pub fn fromPython(family: c_int, address: *py.Object, out: *Storage) py.Error!c_int {
     out.* = .{};
     if (family == AF_UNIX) {
+        // SAFETY: each accepted address type assigns path, and every other type returns.
         var path: [*c]const u8 = undefined;
         var len: c.Py_ssize_t = 0;
         if (c.PyUnicode_Check(address) != 0) {
@@ -146,9 +147,9 @@ pub fn same(a: *const posix.sockaddr, a_len: c_int, b: *const posix.sockaddr, b_
         const x: *const posix.sockaddr.in6 = @ptrCast(@alignCast(a));
         const y: *const posix.sockaddr.in6 = @ptrCast(@alignCast(b));
         if (x.port != y.port or !std.mem.eql(u8, &x.addr, &y.addr)) return false;
-        // asyncio compares tuples, so it wants the scope stated rather than
-        // treating a zero as a wildcard.
-        return x.scope_id == y.scope_id;
+        // asyncio compares the complete tuples, so both ancillary fields must
+        // be stated exactly rather than treating zero as a wildcard.
+        return x.flowinfo == y.flowinfo and x.scope_id == y.scope_id;
     }
     return false;
 }

{zuvloop-0.0.2 → zuvloop-0.0.4}/zig/datagram.zig

@@ -392,6 +392,7 @@ fn sendto(self_obj: *py.Object, args: []const ?*py.Object, nargs: usize, kwnames
         return py.errValue("sendto() requires an address on an unconnected transport");
     }
 
+    // SAFETY: PyObject_GetBuffer initializes view or returns an error.
     var view: c.Py_buffer = undefined;
     if (c.PyObject_GetBuffer(args[0].?, &view, c.PyBUF_SIMPLE) < 0) return py.Error.Python;
     defer c.PyBuffer_Release(&view);
@@ -596,12 +597,13 @@ pub fn makeDatagram(self_obj: *py.Object, args: []const ?*py.Object) py.Error!*p
     self.flags |= OPEN;
     uv.setData(self.udp(), self);
 
-    if (uv.uv_udp_open(self.udp(), fd) < 0) {
+    const status = uv.uv_udp_open(self.udp(), fd);
+    if (status < 0) {
         // libuv never took the descriptor, so the caller still owns it.
         self.flags &= ~OPEN;
         py.incref(obj);
         uv.uv_close(uv.asHandle(self.udp()), onOpenFailed);
-        return py.errUv(uv.uv_udp_open(self.udp(), fd));
+        return py.errUv(status);
     }
 
     py.incref(obj);
@@ -704,11 +706,11 @@ var methods = [_]c.PyMethodDef{
 };
 
 var slots = [_]c.PyType_Slot{
-    .{ .slot = c.Py_tp_dealloc, .pfunc = @constCast(@ptrCast(&dealloc)) },
-    .{ .slot = c.Py_tp_traverse, .pfunc = @constCast(@ptrCast(&traverse)) },
-    .{ .slot = c.Py_tp_clear, .pfunc = @constCast(@ptrCast(&clear_)) },
+    .{ .slot = c.Py_tp_dealloc, .pfunc = @ptrCast(@constCast(&dealloc)) },
+    .{ .slot = c.Py_tp_traverse, .pfunc = @ptrCast(@constCast(&traverse)) },
+    .{ .slot = c.Py_tp_clear, .pfunc = @ptrCast(@constCast(&clear_)) },
     .{ .slot = c.Py_tp_methods, .pfunc = @ptrCast(&methods) },
-    .{ .slot = c.Py_tp_doc, .pfunc = @constCast(@ptrCast("A libuv-backed datagram transport.")) },
+    .{ .slot = c.Py_tp_doc, .pfunc = @ptrCast(@constCast("A libuv-backed datagram transport.")) },
     .{ .slot = 0, .pfunc = null },
 };
 

{zuvloop-0.0.2 → zuvloop-0.0.4}/zig/dns.zig

@@ -36,7 +36,9 @@ const Request = struct {
     prev: ?*Request = null,
     next: ?*Request = null,
     hints: std.c.addrinfo = std.mem.zeroes(std.c.addrinfo),
+    // SAFETY: request construction fills this array before libuv receives it.
     host: [max_host]u8 = undefined,
+    // SAFETY: request construction fills this array before libuv receives it.
     service: [32]u8 = undefined,
 
     inline fn addrReq(self: *Request) *uv.GetAddrInfo {
@@ -117,6 +119,7 @@ pub fn traverse(st: *loopmod.State, visitproc: c.visitproc, arg: ?*anyopaque) c_
 fn copyZ(dst: []u8, value: *py.Object, what: [:0]const u8) py.Error!?[*:0]const u8 {
     if (py.isNone(value)) return null;
     var len: c.Py_ssize_t = 0;
+    // SAFETY: each accepted Python type assigns src, and every other type returns.
     var src: [*c]const u8 = undefined;
     if (c.PyUnicode_Check(value) != 0) {
         src = c.PyUnicode_AsUTF8AndSize(value, &len) orelse return py.Error.Python;
@@ -368,6 +371,8 @@ fn resolveLiteral(hints: *const std.c.addrinfo, host: ?[*:0]const u8, service: ?
         port = std.fmt.parseInt(u16, text, 10) catch return null;
     }
 
+    // SAFETY: inet_pton initializes the address and the successful branch fills
+    // the remaining sockaddr fields before storage is read.
     var storage: addr.Storage = undefined;
     const family = hints.family;
     if (family == std.c.AF.INET or family == std.c.AF.UNSPEC) {

{zuvloop-0.0.2 → zuvloop-0.0.4}/zig/handle.zig

@@ -17,6 +17,7 @@ const inline_args = 3;
 const arg_alloc = std.heap.c_allocator;
 
 pub const CANCELLED: u32 = 1 << 0;
+const RUNNING: u32 = 1 << 1;
 
 pub const Handle = extern struct {
     ob_base: c.PyObject,
@@ -86,6 +87,14 @@ pub fn create(
 pub fn run(self: *Handle) void {
     if (self.isCancelled()) return;
     const callback = self.callback orelse return;
+    self.flags |= RUNNING;
+    defer {
+        self.flags &= ~RUNNING;
+        if (self.isCancelled()) {
+            clearArgs(self);
+            py.clear(&self.callback);
+        }
+    }
     invoke(@ptrCast(self), self.loop, callback, self.argv(), self.nargs, self.context.?);
 }
 
@@ -168,8 +177,12 @@ fn cancel(self_obj: *py.Object) py.Error!*py.Object {
     const self: *Handle = @ptrCast(@alignCast(self_obj));
     if (!self.isCancelled()) {
         self.flags |= CANCELLED;
-        clearArgs(self);
-        py.clear(&self.callback);
+        // Vectorcall borrows these references. A callback may cancel its own
+        // handle, so release them when run() regains control instead.
+        if (self.flags & RUNNING == 0) {
+            clearArgs(self);
+            py.clear(&self.callback);
+        }
     }
     return py.noneRef();
 }
@@ -179,7 +192,6 @@ fn cancelled(self_obj: *py.Object) py.Error!*py.Object {
     return py.boolRef(self.isCancelled());
 }
 
-
 fn getCallback(self_obj: ?*py.Object, _: ?*anyopaque) callconv(.c) ?*py.Object {
     const self: *Handle = @ptrCast(@alignCast(self_obj.?));
     return py.newref(self.callback orelse py.none());
@@ -243,7 +255,6 @@ var handle_spec = c.PyType_Spec{
     .slots = &handle_slots,
 };
 
-
 pub fn register(module: *py.Object) py.Error!void {
     handle_type = @ptrCast(c.PyType_FromModuleAndSpec(module, &handle_spec, null) orelse return py.Error.Python);
     if (c.PyModule_AddObjectRef(module, "Handle", @ptrCast(handle_type)) < 0) return py.Error.Python;

{zuvloop-0.0.2 → zuvloop-0.0.4}/zig/loop.zig

@@ -904,7 +904,7 @@ fn dealloc(obj: ?*py.Object) callconv(.c) void {
         if (needs_close) {
             st.ready.deinit();
             st.timers.deinit();
-            }
+        }
         // The flush list owns one Python reference per transport regardless of
         // how the loop reached deallocation, including partially completed
         // explicit close paths.
@@ -951,8 +951,12 @@ fn traverse(obj: ?*py.Object, visitproc: c.visitproc, arg: ?*anyopaque) callconv
             if (r != 0) return r;
             transport = owned.owner_next;
         }
-        r = dns.traverse(st, visitproc, arg);
-        if (r != 0) return r;
+        // Once close hands resolver requests to the native reaper, their
+        // futures are gone and the request list mutates without the GIL.
+        if (!isReaping(st)) {
+            r = dns.traverse(st, visitproc, arg);
+            if (r != 0) return r;
+        }
         r = pollermod.traverse(st, visitproc, arg);
         if (r != 0) return r;
     }

{zuvloop-0.0.2 → zuvloop-0.0.4}/zig/process.zig

@@ -347,11 +347,11 @@ var methods = [_]c.PyMethodDef{
 };
 
 var slots = [_]c.PyType_Slot{
-    .{ .slot = c.Py_tp_dealloc, .pfunc = @constCast(@ptrCast(&dealloc)) },
-    .{ .slot = c.Py_tp_traverse, .pfunc = @constCast(@ptrCast(&traverse)) },
-    .{ .slot = c.Py_tp_clear, .pfunc = @constCast(@ptrCast(&clear_)) },
+    .{ .slot = c.Py_tp_dealloc, .pfunc = @ptrCast(@constCast(&dealloc)) },
+    .{ .slot = c.Py_tp_traverse, .pfunc = @ptrCast(@constCast(&traverse)) },
+    .{ .slot = c.Py_tp_clear, .pfunc = @ptrCast(@constCast(&clear_)) },
     .{ .slot = c.Py_tp_methods, .pfunc = @ptrCast(&methods) },
-    .{ .slot = c.Py_tp_doc, .pfunc = @constCast(@ptrCast("A libuv-backed child process.")) },
+    .{ .slot = c.Py_tp_doc, .pfunc = @ptrCast(@constCast("A libuv-backed child process.")) },
     .{ .slot = 0, .pfunc = null },
 };
 

{zuvloop-0.0.2 → zuvloop-0.0.4}/zig/transport.zig

@@ -136,12 +136,12 @@ pub const Transport = extern struct {
 
 var handle_offset: usize = 0;
 
-/// A queued write: the libuv request, the buffer views keeping the caller's
-/// memory alive, and the vector libuv reads from - all in one allocation.
+/// A queued write: the libuv request, immutable buffer views, and the vector
+/// libuv reads from - all in one allocation.
 ///
-/// Retaining views rather than copying is what makes a large `write()` free:
-/// the exporter stays alive (and, for a bytearray, locked against resizing)
-/// until libuv reports the write complete.
+/// An exact `bytes` object is retained without copying. Every other exporter is
+/// snapshotted first, so its view owns immutable bytes rather than caller memory;
+/// either way the backing object stays alive until libuv reports completion.
 ///
 /// The request does not take another Python reference to `transport`. The
 /// loop-owned handle reference remains alive until `onClosed`, and libuv runs
@@ -178,6 +178,23 @@ fn releaseViews(views: []c.Py_buffer) void {
     for (views) |*view| c.PyBuffer_Release(view);
 }
 
+/// Hold immutable bytes directly; snapshot every other exporter before write()
+/// returns so queued I/O cannot observe later mutations by the caller.
+fn acquireWriteView(data: *py.Object, view: *c.Py_buffer) py.Error!void {
+    if (c.PyBytes_CheckExact(data) != 0) {
+        if (c.PyObject_GetBuffer(data, view, c.PyBUF_SIMPLE) < 0) return py.Error.Python;
+        return;
+    }
+
+    // SAFETY: PyObject_GetBuffer initializes source or returns an error.
+    var source: c.Py_buffer = undefined;
+    if (c.PyObject_GetBuffer(data, &source, c.PyBUF_SIMPLE) < 0) return py.Error.Python;
+    defer c.PyBuffer_Release(&source);
+    const snapshot = c.PyBytes_FromStringAndSize(@ptrCast(source.buf), source.len) orelse return py.Error.Python;
+    defer py.decref(snapshot);
+    if (c.PyObject_GetBuffer(snapshot, view, c.PyBUF_SIMPLE) < 0) return py.Error.Python;
+}
+
 // ---------------------------------------------------------------------------
 // protocol dispatch
 
@@ -550,9 +567,13 @@ fn queueWrite(self: *Transport, bufs: []const uv.Buf, views: []c.Py_buffer) py.E
 /// Whether a write may proceed, releasing `views` if it may not.
 ///
 /// A close only drops the data; raising would turn an ordinary shutdown race
-/// into an exception. `write_eof()` is the caller's mistake and each entry point
-/// rejects it earlier, so an empty write is an error too.
+/// into an exception. `write_eof()` is the caller's mistake, and must be checked
+/// here too because acquiring an iterable or buffer can reenter the transport.
 fn acceptsWrite(self: *Transport, views: []c.Py_buffer) py.Error!bool {
+    if (self.flags & EOF_WRITTEN != 0) {
+        releaseViews(views);
+        return py.errRuntime("Cannot write after write_eof()");
+    }
     if (self.flags & (CONN_LOST | CLOSING) != 0) {
         releaseViews(views);
         return false;
@@ -875,8 +896,9 @@ pub fn startReadingMethod(self_obj: *py.Object) py.Error!*py.Object {
 
 fn write(self_obj: *py.Object, data: *py.Object) py.Error!*py.Object {
     const self = asTransport(self_obj);
+    // SAFETY: acquireWriteView initializes the only element or returns an error.
     var views = [_]c.Py_buffer{undefined};
-    if (c.PyObject_GetBuffer(data, &views[0], c.PyBUF_SIMPLE) < 0) return py.Error.Python;
+    try acquireWriteView(data, &views[0]);
     if (self.flags & EOF_WRITTEN != 0) {
         c.PyBuffer_Release(&views[0]);
         return py.errRuntime("Cannot call write() after write_eof()");
@@ -912,12 +934,12 @@ fn writelines(self_obj: *py.Object, data: *py.Object) py.Error!*py.Object {
             return py.Error.Python;
         };
         // The buffer view keeps the exporter alive, so the item reference can go.
-        const acquired = c.PyObject_GetBuffer(item, &views[filled], c.PyBUF_SIMPLE);
-        py.decref(item);
-        if (acquired < 0) {
+        acquireWriteView(item, &views[filled]) catch {
+            py.decref(item);
             releaseViews(views[0..filled]);
             return py.Error.Python;
-        }
+        };
+        py.decref(item);
         bufs[filled] = .{ .base = @ptrCast(views[filled].buf), .len = @intCast(views[filled].len) };
     }
     try submitWrite(self, bufs, views);
@@ -1005,6 +1027,10 @@ fn forceCloseMethod(self_obj: *py.Object, exc: *py.Object) py.Error!*py.Object {
     return py.noneRef();
 }
 
+fn getProtocolPaused(self_obj: ?*py.Object, _: ?*anyopaque) callconv(.c) ?*py.Object {
+    return py.boolRef(asTransport(self_obj.?).flags & PROTOCOL_PAUSED != 0);
+}
+
 // ---------------------------------------------------------------------------
 // construction
 
@@ -1225,12 +1251,19 @@ var methods = [_]c.PyMethodDef{
     py.sentinel,
 };
 
+// asyncio's name for this state; its sendfile machinery reads it off transports.
+var getsets = [_]c.PyGetSetDef{
+    .{ .name = "_protocol_paused", .get = getProtocolPaused, .set = null, .doc = "Whether flow control has paused the protocol.", .closure = null },
+    .{ .name = null, .get = null, .set = null, .doc = null, .closure = null },
+};
+
 var slots = [_]c.PyType_Slot{
     .{ .slot = c.Py_tp_dealloc, .pfunc = @ptrCast(@constCast(&dealloc)) },
     .{ .slot = c.Py_tp_traverse, .pfunc = @ptrCast(@constCast(&traverse)) },
     .{ .slot = c.Py_tp_clear, .pfunc = @ptrCast(@constCast(&clear_)) },
     .{ .slot = c.Py_tp_repr, .pfunc = @ptrCast(@constCast(&repr)) },
     .{ .slot = c.Py_tp_methods, .pfunc = @ptrCast(&methods) },
+    .{ .slot = c.Py_tp_getset, .pfunc = @ptrCast(&getsets) },
     .{ .slot = c.Py_tp_doc, .pfunc = @ptrCast(@constCast("A libuv-backed stream transport.")) },
     .{ .slot = 0, .pfunc = null },
 };