log-foundry 0.10.2.dev22__tar.gz → 0.10.2.dev24__tar.gz

{log_foundry-0.10.2.dev22 → log_foundry-0.10.2.dev24}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: log-foundry
-Version: 0.10.2.dev22
+Version: 0.10.2.dev24
 Summary: Generate logs for your console and JSON events for downstream consumption.
 License-Expression: MIT
 License-File: LICENSE
@@ -669,7 +669,16 @@ in `CallbackSink`.
 #### Writing your own sink
 
 `Sink` is two required methods, `emit(batch)` and `close()`, plus two rules about *how* `emit`
-fails. They are not stylistic — the library's whole loss-reporting apparatus is built on them:
+fails and one about *when* it is called. They are not stylistic — the library's whole
+loss-reporting apparatus is built on them:
+
+- **Tolerate concurrent calls.** `emit` may run on more than one thread at once, and `close` may
+  be called while an `emit` is in flight. The worker drains on its own thread, but a level call
+  made with no active span emits synchronously on the *caller's* thread — which is any thread of
+  your application. If your sink holds mutable transport state (a stream it rebinds, a socket it
+  reuses, a connection with transaction scope), guard it with a `threading.Lock` held for the
+  whole operation that assumes exclusivity. If it holds none, you need do nothing. The library
+  cannot serialize this for you: it does not own the calling thread.
 
 - **Raise when you delivered none of the batch**, after your own retries are spent. That is the
   signal the worker's bounded retry and `health().failed_batches` depend on, and the one case where
@@ -685,29 +694,38 @@ never engages, `failed_batches` stays at zero, and `flush()` returns `True` whil
 lost.
 
 Optionally add `losses()` to report what you absorbed. It must never raise and must be safe to call
-while `emit` is running (`health()` is a poll):
+while `emit` is running (`health()` is a poll) — which means the counters need their own lock, kept
+separate from the transport one so a poll never waits on an in-flight send:
 
 ```python
+import threading
 from log_foundry.sinks.base import SinkDeliveryError, SinkLosses
 
 class MySink:
     def __init__(self) -> None:
         self._dropped = self._failed = 0
+        self._lock = threading.Lock()          # transport state
+        self._counter_lock = threading.Lock()  # counters only, never held across I/O
 
     def emit(self, batch: list[dict[str, object]]) -> None:
         delivered = 0
-        for chunk in self._chunks(batch):
-            if self._send(chunk):          # your own bounded retry
-                delivered += len(chunk)
-            else:
-                self._failed += len(chunk)
+        with self._lock:                       # your connection, socket or stream
+            for chunk in self._chunks(batch):
+                if self._send(chunk):          # your own bounded retry
+                    delivered += len(chunk)
+                else:
+                    with self._counter_lock:   # transport -> counter, never the reverse
+                        self._failed += len(chunk)
         if batch and not delivered:
             raise SinkDeliveryError(f"MySink delivered none of {len(batch)} event(s)")
 
     def losses(self) -> SinkLosses:
-        return SinkLosses(dropped=self._dropped, failed=self._failed)
+        with self._counter_lock:               # both fields from one instant
+            return SinkLosses(dropped=self._dropped, failed=self._failed)
 
-    def close(self) -> None: ...
+    def close(self) -> None:
+        with self._lock:                       # never release under an active writer
+            ...
 ```
 
 `losses()` is optional and probed by name, so a sink written before it existed keeps working and

{log_foundry-0.10.2.dev22 → log_foundry-0.10.2.dev24}/README.md

@@ -633,7 +633,16 @@ in `CallbackSink`.
 #### Writing your own sink
 
 `Sink` is two required methods, `emit(batch)` and `close()`, plus two rules about *how* `emit`
-fails. They are not stylistic — the library's whole loss-reporting apparatus is built on them:
+fails and one about *when* it is called. They are not stylistic — the library's whole
+loss-reporting apparatus is built on them:
+
+- **Tolerate concurrent calls.** `emit` may run on more than one thread at once, and `close` may
+  be called while an `emit` is in flight. The worker drains on its own thread, but a level call
+  made with no active span emits synchronously on the *caller's* thread — which is any thread of
+  your application. If your sink holds mutable transport state (a stream it rebinds, a socket it
+  reuses, a connection with transaction scope), guard it with a `threading.Lock` held for the
+  whole operation that assumes exclusivity. If it holds none, you need do nothing. The library
+  cannot serialize this for you: it does not own the calling thread.
 
 - **Raise when you delivered none of the batch**, after your own retries are spent. That is the
   signal the worker's bounded retry and `health().failed_batches` depend on, and the one case where
@@ -649,29 +658,38 @@ never engages, `failed_batches` stays at zero, and `flush()` returns `True` whil
 lost.
 
 Optionally add `losses()` to report what you absorbed. It must never raise and must be safe to call
-while `emit` is running (`health()` is a poll):
+while `emit` is running (`health()` is a poll) — which means the counters need their own lock, kept
+separate from the transport one so a poll never waits on an in-flight send:
 
 ```python
+import threading
 from log_foundry.sinks.base import SinkDeliveryError, SinkLosses
 
 class MySink:
     def __init__(self) -> None:
         self._dropped = self._failed = 0
+        self._lock = threading.Lock()          # transport state
+        self._counter_lock = threading.Lock()  # counters only, never held across I/O
 
     def emit(self, batch: list[dict[str, object]]) -> None:
         delivered = 0
-        for chunk in self._chunks(batch):
-            if self._send(chunk):          # your own bounded retry
-                delivered += len(chunk)
-            else:
-                self._failed += len(chunk)
+        with self._lock:                       # your connection, socket or stream
+            for chunk in self._chunks(batch):
+                if self._send(chunk):          # your own bounded retry
+                    delivered += len(chunk)
+                else:
+                    with self._counter_lock:   # transport -> counter, never the reverse
+                        self._failed += len(chunk)
         if batch and not delivered:
             raise SinkDeliveryError(f"MySink delivered none of {len(batch)} event(s)")
 
     def losses(self) -> SinkLosses:
-        return SinkLosses(dropped=self._dropped, failed=self._failed)
+        with self._counter_lock:               # both fields from one instant
+            return SinkLosses(dropped=self._dropped, failed=self._failed)
 
-    def close(self) -> None: ...
+    def close(self) -> None:
+        with self._lock:                       # never release under an active writer
+            ...
 ```
 
 `losses()` is optional and probed by name, so a sink written before it existed keeps working and

{log_foundry-0.10.2.dev22 → log_foundry-0.10.2.dev24}/pyproject.toml

@@ -20,7 +20,7 @@ dependencies = [
 ]
 
 # Optional features. Install with: pip install log-foundry[aws]
-version = "0.10.2.dev22"
+version = "0.10.2.dev24"
 
 [project.optional-dependencies]
 aws = ["boto3>=1.43.61"]              # SQSSink, SNSSink, KinesisSink, FirehoseSink

{log_foundry-0.10.2.dev22 → log_foundry-0.10.2.dev24}/src/log_foundry/sinks/_socket.py

@@ -3,10 +3,7 @@
 from __future__ import annotations
 
 import socket
-from typing import TYPE_CHECKING
-
-if TYPE_CHECKING:
-    import threading
+import threading
 
 from log_foundry import _diag
 from log_foundry.sinks._retry import wait
@@ -64,6 +61,14 @@ class SocketTransport:
     100-message batch against a dead destination is roughly 70 s of backoff on the single drain
     thread at the defaults. The wait is interruptible, so ``shutdown()`` cuts it short.
 
+    Sends are serialized on a lock (SPEC-028 FR-002). One TCP connection is shared by every
+    caller, and ``sendall`` gives no atomicity against a concurrent one: two interleaved calls
+    splice their bytes into the stream, which turns octet-counted syslog framing into a sequence
+    the receiver cannot resynchronize — it reads the next frame's length from the middle of the
+    previous frame's payload and is lost for the life of the connection. That the lock is held
+    across the backoff waits is deliberate; they are interruptible, so a ``shutdown()`` releases
+    it promptly.
+
     Attributes:
       failed: Messages abandoned past the reconnect-retry bound.
     """
@@ -103,11 +108,17 @@ class SocketTransport:
         self._max_retries = max(max_retries, 0)
         self._sock: socket.socket | None = None
         self.failed = 0
+        self._counter_lock = threading.Lock()
         self.stop_signal: threading.Event | None = None
+        self._lock = threading.Lock()
 
     def send_all(self, messages: list[bytes]) -> None:
         """Sends each pre-framed message, reconnecting on error (FR-005, FR-006).
 
+        The lock spans the whole call, not each message: it also guards ``_sock``, which a
+        reconnect rebinds, so releasing between messages would let another thread send on a
+        socket this one is about to reset (SPEC-028 FR-002).
+
         Args:
           messages: The exact bytes to put on the wire, one call per message.
 
@@ -121,10 +132,11 @@ class SocketTransport:
             would re-send the messages that already landed, and an empty call is a no-op rather
             than a total failure.
         """
-        delivered = 0
-        for message in messages:
-            if self._send_one(message):
-                delivered += 1
+        with self._lock:
+            delivered = 0
+            for message in messages:
+                if self._send_one(message):
+                    delivered += 1
         if messages and delivered == 0:
             raise SinkDeliveryError(
                 f"SocketTransport delivered none of {len(messages)} message(s)"
@@ -142,12 +154,16 @@ class SocketTransport:
         Raises:
           None.
         """
-        return SinkLosses(dropped=0, failed=self.failed)
+        with self._counter_lock:
+            return SinkLosses(dropped=0, failed=self.failed)
 
     def close(self) -> None:
         """Closes the held socket, if any (FR-005, FR-012).
 
-        Idempotent.
+        Idempotent, and takes the send lock so it never closes the socket out from under an
+        in-flight ``send_all`` (SPEC-028 FR-002). ``_reset`` does not take the lock itself,
+        because ``_send_one`` calls it while ``send_all`` already holds one — the lock is
+        deliberately not re-entrant, so that path must stay the only unlocked caller.
 
         Args:
           None.
@@ -158,7 +174,8 @@ class SocketTransport:
         Raises:
           None.
         """
-        self._reset()
+        with self._lock:
+            self._reset()
 
     def _send_one(self, message: bytes) -> bool:
         """Sends one message within the retry bound.
@@ -190,7 +207,8 @@ class SocketTransport:
                 if attempt < self._max_retries:
                     wait(_BACKOFF_BASE * (2**attempt), self.stop_signal)
                     continue
-                self.failed += 1
+                with self._counter_lock:
+                    self.failed += 1
                 _diag.lost(
                     "message",
                     1,

{log_foundry-0.10.2.dev22 → log_foundry-0.10.2.dev24}/src/log_foundry/sinks/base.py

@@ -57,11 +57,32 @@ class Sink(Protocol):
     ``None`` is the same answer as having no method at all, which is what keeps a third-party
     sink written against the pre-SPEC-026 interface satisfying this one. :func:`read_losses` is
     the probe.
+
+    "Safe to call during an emit" is a concurrency requirement once :meth:`emit` is (SPEC-028
+    FR-003). The shipped sinks keep their loss counters under a **dedicated** lock, separate
+    from whatever guards their transport: an increment is a read-modify-write that Python does
+    not promise is atomic, and the pair read must come from one instant rather than straddling
+    another thread's increments. It is deliberately not the transport lock — ``health()`` is
+    the call an operator makes when a destination is already hanging, and sharing one lock
+    would make that poll wait for an in-flight emit and its retry backoff. Where a sink holds
+    both, the order is always transport then counter, never the reverse.
     """
 
     def emit(self, batch: list[dict[str, object]]) -> None:
         """Ships a batch of serialized event dicts.
 
+        **May be called concurrently from more than one thread, and must tolerate it**
+        (SPEC-028 FR-001). The background worker drains on its own thread, and a level call
+        made with no active span emits synchronously on the *caller's* thread (arch §12), which
+        may be any of the application's — an audit observed one sink object entered by two
+        application threads and the worker at once. An implementation holding mutable transport
+        state, such as a stream it rebinds, a reused socket or a connection with transaction
+        scope, must serialize access to it for the whole span of the operation that assumes
+        exclusivity. One that holds no such state need do nothing.
+
+        This is a requirement on implementations, not a promise the library serializes on their
+        behalf. It cannot: the orphan path runs on a thread the library does not own.
+
         Raise when the batch delivered nothing and it was non-empty — the worker's bounded
         retry and ``health().failed_batches`` depend on that signal, and a retry there cannot
         duplicate anything (SPEC-026 FR-001). Raise after the sink's own retries are spent, so
@@ -88,6 +109,13 @@ class Sink(Protocol):
     def close(self) -> None:
         """Flushes and releases any resources.
 
+        **May be called while an ``emit`` is in flight on another thread** (SPEC-028 FR-001).
+        It must therefore either wait for that emit or become a no-op, and must never release a
+        resource a concurrent ``emit`` is about to use — a half-released transport is worse than
+        an unreleased one, because the emit then fails against a closed handle instead of
+        succeeding. Taking the same lock ``emit`` takes satisfies this; so does an idempotent
+        guard checked under that lock.
+
         Args:
           None.
 

{log_foundry-0.10.2.dev22 → log_foundry-0.10.2.dev24}/src/log_foundry/sinks/clickhouse.py

@@ -3,10 +3,8 @@
 from __future__ import annotations
 
 import json
-from typing import TYPE_CHECKING, Any
-
-if TYPE_CHECKING:
-    import threading
+import threading
+from typing import Any
 
 from log_foundry import _diag
 from log_foundry.sinks._chunk import chunk_list, valid_identifier
@@ -42,6 +40,12 @@ class ClickHouseSink:
     columns plus the full event as a ``String`` column, inserted in a single call per chunk. The
     sink is write-only, and the worst-case delay (SPEC-027 FR-005) is ``max_retries``
     interruptible waits per chunk, 0.7 s at the defaults.
+
+    The driver requirement satisfied (SPEC-028 FR-002): a ``clickhouse-connect`` client holds
+    per-session state across an insert and the project does not publish it as safe to share
+    between threads, so this sink serializes its use rather than assuming otherwise. A lock is
+    the conservative reading — one client per thread would be the alternative, and that is the
+    connection-pool design FR-002 puts out of scope.
     """
 
     def __init__(
@@ -81,6 +85,8 @@ class ClickHouseSink:
         self.stop_signal: threading.Event | None = None
         self.failed = 0
         self._closed = False
+        self._lock = threading.Lock()
+        self._counter_lock = threading.Lock()
         self._owns_client = client is None
         if client is None:
             import clickhouse_connect  # type: ignore[import-not-found]
@@ -93,6 +99,9 @@ class ClickHouseSink:
     def losses(self) -> SinkLosses:
         """Reports rows in a chunk abandoned past the retry bound (SPEC-026 FR-002).
 
+        Reads under the counter lock rather than the emit lock (SPEC-028 FR-003), so a poll
+        never waits on an in-flight insert and its backoff.
+
         Args:
           None.
 
@@ -102,7 +111,8 @@ class ClickHouseSink:
         Raises:
           None.
         """
-        return SinkLosses(dropped=0, failed=self.failed)
+        with self._counter_lock:
+            return SinkLosses(dropped=0, failed=self.failed)
 
     def emit(self, batch: list[dict[str, object]]) -> None:
         """Inserts each chunk as one columnar call, retrying on failure (FR-002).
@@ -122,16 +132,18 @@ class ClickHouseSink:
         if not batch:
             return
         chunks = inserted = 0
-        for chunk in chunk_list(batch, self._chunk_size):
-            chunks += 1
-            inserted += self._insert([self._row(event) for event in chunk])
+        with self._lock:
+            for chunk in chunk_list(batch, self._chunk_size):
+                chunks += 1
+                inserted += self._insert([self._row(event) for event in chunk])
         if chunks and not inserted:
             raise SinkDeliveryError(f"ClickHouseSink inserted none of {chunks} chunk(s)")
 
     def close(self) -> None:
         """Closes the client only if the sink owns it (FR-005).
 
-        Idempotent.
+        Idempotent, and takes the emit lock so the client is never closed mid-insert
+        (SPEC-028 FR-002).
 
         Args:
           None.
@@ -142,11 +154,12 @@ class ClickHouseSink:
         Raises:
           Exception: Whatever the client raises on close.
         """
-        if self._closed:
-            return
-        if self._owns_client:
-            self.client.close()
-        self._closed = True
+        with self._lock:
+            if self._closed:
+                return
+            if self._owns_client:
+                self.client.close()
+            self._closed = True
 
     def _row(self, event: dict[str, object]) -> list[object]:
         """Builds one row: the extracted columns, then the whole event as JSON.
@@ -182,7 +195,8 @@ class ClickHouseSink:
                 if attempt < self.max_retries:
                     wait(_BACKOFF_BASE * (2**attempt), self.stop_signal)
                     continue
-                self.failed += len(rows)
+                with self._counter_lock:
+                    self.failed += len(rows)
                 _diag.lost(
                     "row",
                     len(rows),

{log_foundry-0.10.2.dev22 → log_foundry-0.10.2.dev24}/src/log_foundry/sinks/elasticsearch.py

@@ -98,10 +98,11 @@ class ElasticsearchSink(HTTPSink):
         Raises:
           None.
         """
-        return SinkLosses(
-            dropped=self.dropped_oversized,
-            failed=self.failed + self.item_errors + self.dropped_unadjudicated,
-        )
+        with self._counter_lock:
+            return SinkLosses(
+                dropped=self.dropped_oversized,
+                failed=self.failed + self.item_errors + self.dropped_unadjudicated,
+            )
 
     def _parse_bulk_response(self, payload: bytes, sent: int) -> bool:
         """Counts rejected items and reports whether the response proves nothing was indexed.
@@ -139,7 +140,8 @@ class ElasticsearchSink(HTTPSink):
         items = usable_results(data.get("items"))
         errors = sum(1 for item in items if _has_error(item))
         if len(items) != sent or not errors:
-            self.dropped_unadjudicated += sent
+            with self._counter_lock:
+                self.dropped_unadjudicated += sent
             _diag.lost(
                 "event",
                 sent,
@@ -148,7 +150,8 @@ class ElasticsearchSink(HTTPSink):
                 f"not retried",
             )
             return False
-        self.item_errors += errors
+        with self._counter_lock:
+            self.item_errors += errors
         _diag.lost("bulk item", errors, f"{type(self).__name__}, rejected by the server")
         return errors == sent
 

{log_foundry-0.10.2.dev22 → log_foundry-0.10.2.dev24}/src/log_foundry/sinks/eventhubs.py

@@ -3,10 +3,8 @@
 from __future__ import annotations
 
 import json
-from typing import TYPE_CHECKING, Any
-
-if TYPE_CHECKING:
-    import threading
+import threading
+from typing import Any
 
 from log_foundry import _diag
 from log_foundry.sinks._retry import wait
@@ -69,6 +67,7 @@ class AzureEventHubsSink:
         self.stop_signal: threading.Event | None = None
         self.failed = 0
         self.dropped_oversized = 0
+        self._counter_lock = threading.Lock()
 
     def losses(self) -> SinkLosses:
         """Reports oversized drops and events in a batch abandoned past the bound (FR-002).
@@ -82,7 +81,8 @@ class AzureEventHubsSink:
         Raises:
           None.
         """
-        return SinkLosses(dropped=self.dropped_oversized, failed=self.failed)
+        with self._counter_lock:
+            return SinkLosses(dropped=self.dropped_oversized, failed=self.failed)
 
     def emit(self, batch: list[dict[str, object]]) -> None:
         """Packs events into batches within the size limit and sends each (FR-009).
@@ -118,7 +118,8 @@ class AzureEventHubsSink:
                 delivered += self._send(current)
             current = self.producer.create_batch()
             if not _try_add(current, data):
-                self.dropped_oversized += 1
+                with self._counter_lock:
+                    self.dropped_oversized += 1
                 _diag.lost("event", 1, "AzureEventHubsSink, too large for an empty 1 MB batch")
         if len(current) > 0:
             attempted += 1
@@ -167,7 +168,8 @@ class AzureEventHubsSink:
                 if attempt < self.max_retries:
                     wait(_BACKOFF_BASE * (2**attempt), self.stop_signal)
                     continue
-                self.failed += len(event_batch)
+                with self._counter_lock:
+                    self.failed += len(event_batch)
                 _diag.lost(
                     "event",
                     len(event_batch),

{log_foundry-0.10.2.dev22 → log_foundry-0.10.2.dev24}/src/log_foundry/sinks/file.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import json
 import os
+import threading
 import time
 from typing import TextIO
 
@@ -22,8 +23,12 @@ class FileSink:
 
     Not every deployment ships to a cloud queue; local dev, debugging, air-gapped hosts and
     simple archival just want events on the local disk. Writes are synchronous stdlib calls
-    only, and a single-process, single-worker-thread writer is assumed (arch §9) — cross-process
-    coordination is out of scope.
+    only.
+
+    Writers within the process are serialized on a lock, because ``emit`` may be called
+    concurrently (SPEC-028 FR-002) — this module claimed a single worker thread until that spec
+    measured the orphan path emitting on application threads at the same time. Cross-*process*
+    coordination remains out of scope: two processes appending to one path are on their own.
     """
 
     def __init__(self, path: str, *, encoding: str = "utf-8") -> None:
@@ -47,10 +52,16 @@ class FileSink:
         self._encoding = encoding
         self._stream: TextIO = open(path, "a", encoding=encoding)
         self._closed = False
+        self._lock = threading.Lock()
 
     def emit(self, batch: list[dict[str, object]]) -> None:
         """Writes every event as one newline-terminated ``json.dumps`` line, then flushes.
 
+        The lock covers the whole batch rather than each line (SPEC-028 FR-002). A text stream
+        does not promise that one ``write`` is atomic against another, so per-line locking could
+        still interleave two events' bytes; batch-wide locking also keeps a batch contiguous in
+        the file, which is what makes the output readable.
+
         Args:
           batch: The events to write.
 
@@ -60,13 +71,17 @@ class FileSink:
         Raises:
           OSError: If the write or flush fails (FR-001).
         """
-        for event in batch:
-            self._stream.write(json.dumps(event) + "\n")
-        self._stream.flush()
+        with self._lock:
+            for event in batch:
+                self._stream.write(json.dumps(event) + "\n")
+            self._stream.flush()
 
     def close(self) -> None:
         """Flushes and closes the file handle, with a second call a no-op (FR-001).
 
+        Taking the same lock ``emit`` takes means a close waits for an in-flight write rather
+        than pulling the stream out from under it (SPEC-028 FR-002).
+
         Args:
           None.
 
@@ -76,11 +91,12 @@ class FileSink:
         Raises:
           OSError: If the flush or close fails.
         """
-        if self._closed:
-            return
-        self._stream.flush()
-        self._stream.close()
-        self._closed = True
+        with self._lock:
+            if self._closed:
+                return
+            self._stream.flush()
+            self._stream.close()
+            self._closed = True
 
 
 class RotatingFileSink:
@@ -95,6 +111,11 @@ class RotatingFileSink:
     count, and opens a fresh active file — a backup count of zero keeps none, simply replacing
     the active file. No event is lost across a rotation, because the rotate happens before the
     pending event is written and the event lands in the fresh file.
+
+    A rotation rebinds the active stream, so it is the sink where concurrent writers did real
+    damage: a second thread mid-``emit`` could write to the handle rotation had just closed, or
+    to the pre-rotation file it had already renamed away. Both are serialized on a lock
+    (SPEC-028 FR-002).
     """
 
     def __init__(
@@ -136,10 +157,16 @@ class RotatingFileSink:
         self._size = os.path.getsize(path) if os.path.exists(path) else 0
         self._next_rollover = self._schedule_next()
         self._closed = False
+        self._lock = threading.Lock()
 
     def emit(self, batch: list[dict[str, object]]) -> None:
         """Appends each event, rotating first whenever a size or time trigger fires (FR-002).
 
+        The lock spans the whole batch, so the decide-rotate-write-account sequence is
+        indivisible (SPEC-028 FR-002). Guarding only ``_rotate`` would not be enough: the
+        ``_should_rotate`` check and the write that follows it must see the same stream, or a
+        rotation between them sends the line to a closed handle.
+
         Args:
           batch: The events to write.
 
@@ -149,18 +176,23 @@ class RotatingFileSink:
         Raises:
           OSError: If a write, flush or rotation fails.
         """
-        for event in batch:
-            line = json.dumps(event) + "\n"
-            data = len(line.encode(self._encoding))
-            if self._should_rotate(data):
-                self._rotate()
-            self._stream.write(line)
-            self._size += data
-        self._stream.flush()
+        with self._lock:
+            for event in batch:
+                line = json.dumps(event) + "\n"
+                data = len(line.encode(self._encoding))
+                if self._should_rotate(data):
+                    self._rotate()
+                self._stream.write(line)
+                self._size += data
+            self._stream.flush()
 
     def close(self) -> None:
         """Flushes and closes the active handle, with a second call a no-op (FR-002).
 
+        Taking the same lock ``emit`` takes means a close waits for an in-flight write, and in
+        particular never lands between a rotation and the write it was making room for
+        (SPEC-028 FR-002).
+
         Args:
           None.
 
@@ -170,11 +202,12 @@ class RotatingFileSink:
         Raises:
           OSError: If the flush or close fails.
         """
-        if self._closed:
-            return
-        self._stream.flush()
-        self._stream.close()
-        self._closed = True
+        with self._lock:
+            if self._closed:
+                return
+            self._stream.flush()
+            self._stream.close()
+            self._closed = True
 
     @staticmethod
     def _rollover_seconds(when: str | None, interval: int) -> float | None: