@tracelog/capture-web 1.3.0 → 2.0.0

package/CHANGELOG.md

@@ -18,6 +18,30 @@ patch, and neither requires reading your code.
 Entries after 1.0.0 are drafted from the commits that touched this package and
 edited before release.
 
+## [2.0.0](https://github.com/nacorga/tracelog-sdk/compare/capture-web@1.3.1...capture-web@2.0.0) (2026-10-01)
+
+
+### ⚠ BREAKING CHANGES
+
+* **capture-core:** call TraceLog.consent.grant() on every load while the visitor's consent stands, not only when they accept.
+
+### Added
+
+* **capture-web:** calls before init are held ([b8d4fe5](https://github.com/nacorga/tracelog-sdk/commit/b8d4fe5e4bb104c2343aeceeb1b17f70d8cc697a))
+
+
+### Fixed
+
+* **capture-core:** a grant is not remembered across loads ([75d4cac](https://github.com/nacorga/tracelog-sdk/commit/75d4cac28055007553e36b97d4eef0dbabf27103))
+* **capture-web:** the verification mark follows its tab ([9653074](https://github.com/nacorga/tracelog-sdk/commit/9653074fb57ef5523a43a7fa6bc681f8b8a8814f))
+
+## [1.3.1](https://github.com/nacorga/tracelog-sdk/compare/capture-web@1.3.0...capture-web@1.3.1) (2026-09-30)
+
+
+### Fixed
+
+* **capture-core:** a send outlives the page that started it ([86faf5f](https://github.com/nacorga/tracelog-sdk/commit/86faf5f479a76d69f6413f9db82daae1482492df))
+
 ## [1.3.0](https://github.com/nacorga/tracelog-sdk/compare/capture-web@1.2.0...capture-web@1.3.0) (2026-09-27)
 
 

package/README.md

@@ -22,13 +22,13 @@ as they are served.
 <!-- x-release-please-start-version -->
 
 ```bash
-npm install --save-exact @tracelog/capture-web@1.3.0
+npm install --save-exact @tracelog/capture-web@2.0.0
 ```
 
 Without a build step, the same runtime as a script tag:
 
 ```html
-<script src="https://cdn.tracelog.io/v/1.3.0/tracelog.js"></script>
+<script src="https://cdn.tracelog.io/v/2.0.0/tracelog.js"></script>
 ```
 
 <!-- x-release-please-end -->
@@ -42,7 +42,7 @@ the floor before a release.
 Before consent is granted the runtime creates no identifiers, writes no storage,
 and sends no network traffic — none, not a reduced set. Consent is a state
 machine you drive; until it reaches `granted`, capture is inert. Denying keeps it
-inert without breaking the page.
+inert without breaking the page, and is remembered; a grant is not.
 
 ```js
 import TraceLog from "@tracelog/capture-web";
@@ -52,10 +52,16 @@ TraceLog.init({
   endpoint: "https://api.tracelog.io/v1/events",
 });
 
-// Only once your consent surface says yes:
+// When your consent surface says yes, and on every later load while
+// that consent stands:
 TraceLog.consent.grant();
 ```
 
+A grant lasts the page it was given on. Your consent surface keeps the
+visitor's answer and its expiry, so call `grant()` on each load where that
+answer is still yes; a grant that outlived it would capture a visitor whose
+consent has lapsed.
+
 A site that never calls `consent.grant()` captures nothing and costs its
 visitors nothing.
 
@@ -74,11 +80,17 @@ That is all of it, and it is what the major version protects.
 
 `init` also accepts `mode: "verification"`, which a distributed platform artifact
 declares for its platform's own test order. A site's own snippet never sets it —
-the runtime derives verification mode from the window that opened the page.
+the runtime derives verification mode from the window that opened the page, and
+once consent is granted there the tab keeps it (`sessionStorage`, `__tl.v`) for
+the site's next pages and the return from a payment taken elsewhere, to the same
+origin. A denial forgets it.
 
 Call `init` once per page load. The runtime is built on the first call and
 kept; a later call re-reads the key and the endpoint and rebuilds nothing else,
-so a mode or an acquisition the first call decided stands for the page.
+so a mode or an acquisition the first call decided stands for the page. A
+call made before it — a grant, a step, a conversion — is held, up to 100, and
+made once it has run. The runtime can hold only what reaches it: a page that
+imports it lazily holds what it calls before the import resolves.
 
 The application generates the exact calls your declared plan needs, so you never
 type a name TraceLog already knows.
@@ -105,8 +117,10 @@ An IP address is read once when the event arrives to derive a two-letter country
 code, then discarded.
 
 Events queue locally once consent allows, batch, and deliver with retry, backoff
-and circuit breaking. Delivery failure surfaces as a diagnosable condition,
-never as silent loss.
+and circuit breaking. A step is sent when it is taken, and every send uses
+`keepalive`, so a click that leaves the page — even for another site — does not
+cancel it. Delivery failure surfaces as a diagnosable condition, never as
+silent loss.
 
 ## Where it runs
 

package/dist/tracelog.esm.js

@@ -27,6 +27,14 @@ const RETRY_BASE_MS = 1000;
 const RETRY_CAP_MS = 60 * 1000;
 const CIRCUIT_FAILURE_THRESHOLD = 5;
 const CIRCUIT_PROBE_MS = 60 * 1000;
+/**
+ * What the browser lets `keepalive` bodies in flight add up to. Every send
+ * uses `keepalive`, so no navigation cancels one, and every send fits what is
+ * left of this beside the sends already in flight ([spec/capture.md]
+ * § Delivery). It is below the contract's `MAX_BATCH_BYTES`, so it is the
+ * batch budget too.
+ */
+const KEEPALIVE_BUDGET_BYTES = 64 * 1024;
 const EVENT_NAME_PATTERN = /^[a-z][a-z0-9_]{0,63}$/;
 const PUBLIC_KEY_PATTERN = /^tl_pk_[a-z2-7]{26}$/;
 /**
@@ -171,7 +179,12 @@ function isConversionValid(options) {
 function serializedBytes(value) {
     return textEncoder.encode(JSON.stringify(value)).byteLength;
 }
-function batchFrom(events) {
+/**
+ * As many events as fit `room`, oldest first. An event that alone exceeds the
+ * whole keepalive budget can never be sent; one that only exceeds what the
+ * sends in flight leave waits for them.
+ */
+function batchFrom(events, room) {
     const selected = [];
     const unsendable = [];
     for (const event of events) {
@@ -181,8 +194,9 @@ function batchFrom(events) {
             v: EVENT_ENVELOPE_VERSION,
             events: [...selected, event],
         };
-        if (serializedBytes(candidate) > MAX_BATCH_BYTES) {
-            if (selected.length === 0) {
+        const bytes = serializedBytes(candidate);
+        if (bytes > room) {
+            if (selected.length === 0 && bytes > KEEPALIVE_BUDGET_BYTES) {
                 unsendable.push(event);
                 continue;
             }
@@ -199,11 +213,13 @@ function createCaptureEngine(ports, acquisition) {
     let pending = [];
     let lastDeclaredName;
     /**
-     * Every send in flight, by count and by the union of their event ids: a
-     * page hide sends alongside one rather than wait for it, so there can be
-     * two, and each must leave the other's events alone.
+     * Every send in flight, by count, by bytes and by the union of their event
+     * ids: a step taken and a page hide send beside one rather than wait for
+     * it, so there can be several, each must leave the others' events alone,
+     * and together they stay within the keepalive budget.
      */
     let sendsInFlight = 0;
+    let bytesInFlight = 0;
     const inFlight = new Set();
     /**
      * The conversions this page emitted and holds for their tag sighting
@@ -329,6 +345,38 @@ function createCaptureEngine(ports, acquisition) {
             return;
         }
         emit(pendingEvent);
+        sendTaken();
+    }
+    /**
+     * A step, and a conversion that is not held, leaves when it is taken: a
+     * click that navigates to another site may fire no hide event at all, and a
+     * send started by the click itself is the one that arrives ([spec/capture.md]
+     * § Delivery). An open circuit keeps it queued for the probe.
+     */
+    function sendTaken() {
+        if (circuit !== "closed" || !PUBLIC_KEY_PATTERN.test(config.key))
+            return;
+        void sendNow();
+    }
+    /**
+     * Sends at once what is queued and in no send in flight, beside any send in
+     * flight, within what the keepalive budget has left.
+     */
+    async function sendNow() {
+        const queue = readQueue(ports.storage);
+        const ready = queue.events.filter((event) => !held.has(event.eventId) && !inFlight.has(event.eventId));
+        const { batch, unsendable } = batchFrom(ready, KEEPALIVE_BUDGET_BYTES - bytesInFlight);
+        dropUnsendable(queue, unsendable);
+        if (batch.events.length > 0)
+            await deliver(batch);
+    }
+    function dropUnsendable(queue, unsendable) {
+        if (unsendable.length === 0)
+            return;
+        const dropped = new Set(unsendable.map((event) => event.eventId));
+        queue.events = queue.events.filter((event) => !dropped.has(event.eventId));
+        addDrop(queue, "invalid_event", unsendable.length);
+        writeQueue(ports.storage, queue);
     }
     /**
      * Gives each held conversion whose window has closed — or every one, at
@@ -381,11 +429,21 @@ function createCaptureEngine(ports, acquisition) {
         }
         return Math.max(0, earliest - now);
     }
-    async function flush(keepalive = false) {
-        release(keepalive);
+    async function flush(hidden = false) {
+        release(hidden);
         if (!initialized || consentState !== "granted")
             return;
-        if (sendsInFlight > 0 && !keepalive)
+        /**
+         * A page being hidden gets no later chance, so it sends what no send in
+         * flight carries at once, whatever the circuit's state, and the answer is
+         * read as any other's.
+         */
+        if (hidden) {
+            if (PUBLIC_KEY_PATTERN.test(config.key))
+                await sendNow();
+            return;
+        }
+        if (sendsInFlight > 0)
             return;
         const queue = readQueue(ports.storage);
         const ready = queue.events.filter((event) => !held.has(event.eventId) && !inFlight.has(event.eventId));
@@ -397,17 +455,6 @@ function createCaptureEngine(ports, acquisition) {
             }
             return;
         }
-        /**
-         * A page being hidden gets no later chance, so it sends what no send in
-         * flight carries at once, whatever the circuit's state, and the answer is
-         * read as any other's.
-         */
-        if (sendsInFlight > 0) {
-            const { batch } = batchFrom(ready);
-            if (batch.events.length > 0)
-                await deliver(batch, true);
-            return;
-        }
         const now = ports.clock.now().getTime();
         if (circuit === "open") {
             if (now < nextProbeAt) {
@@ -416,35 +463,32 @@ function createCaptureEngine(ports, acquisition) {
             }
             circuit = "half_open";
         }
-        const { batch, unsendable } = batchFrom(ready);
-        if (unsendable.length > 0) {
-            const dropped = new Set(unsendable.map((event) => event.eventId));
-            queue.events = queue.events.filter((event) => !dropped.has(event.eventId));
-            addDrop(queue, "invalid_event", unsendable.length);
-            writeQueue(ports.storage, queue);
-        }
+        const { batch, unsendable } = batchFrom(ready, KEEPALIVE_BUDGET_BYTES);
+        dropUnsendable(queue, unsendable);
         if (batch.events.length === 0) {
             scheduleFlush(FLUSH_INTERVAL_MS);
             return;
         }
-        await deliver(batch, keepalive);
+        await deliver(batch);
     }
     /**
      * One send, and its answer. It removes from the stored queue exactly what
      * it carried, by its own read, filter and write at the moment it settles,
      * so a send beside it keeps what it delivered.
      */
-    async function deliver(batch, keepalive) {
+    async function deliver(batch) {
         const carried = new Set(batch.events.map((event) => event.eventId));
+        const bytes = serializedBytes(batch);
         for (const eventId of carried)
             inFlight.add(eventId);
         sendsInFlight += 1;
+        bytesInFlight += bytes;
         try {
             const response = await ports.transport.send({
                 endpoint: config.endpoint,
                 key: config.key,
                 batch,
-                keepalive,
+                keepalive: true,
             });
             if (response.status >= 200 && response.status < 300) {
                 const currentQueue = readQueue(ports.storage);
@@ -496,6 +540,7 @@ function createCaptureEngine(ports, acquisition) {
             for (const eventId of carried)
                 inFlight.delete(eventId);
             sendsInFlight -= 1;
+            bytesInFlight -= bytes;
         }
     }
     const engine = {
@@ -505,27 +550,33 @@ function createCaptureEngine(ports, acquisition) {
                 endpoint: options.endpoint ?? "/v1/events",
             };
             initialized = true;
+            /**
+             * Only a denial is remembered; a grant is the integrator's on every load
+             * while consent stands, so it never outlives the banner that gave it
+             * ([spec/capture.md] § Consent first). A grant an earlier runtime
+             * stored is deleted. A second init keeps the decision this page made.
+             */
+            if (consentState !== "unknown")
+                return;
             const storedConsent = safeGet(ports.storage, CONSENT_KEY);
-            consentState =
-                storedConsent === "granted" || storedConsent === "denied"
-                    ? storedConsent
-                    : "unknown";
-            if (consentState === "granted") {
-                ports.sightings?.start();
-                scheduleFlush(FLUSH_INTERVAL_MS);
-            }
+            if (storedConsent === "denied")
+                consentState = "denied";
+            else if (storedConsent !== null)
+                safeRemove(ports.storage, CONSENT_KEY);
         },
         consent: {
             grant() {
                 if (!initialized)
                     return;
                 consentState = "granted";
-                safeSet(ports.storage, CONSENT_KEY, "granted");
+                safeRemove(ports.storage, CONSENT_KEY);
                 ports.sightings?.start();
                 const buffered = pending;
                 pending = [];
                 for (const pendingEvent of buffered)
                     emit(pendingEvent, true);
+                if (buffered.length > 0)
+                    sendTaken();
                 scheduleFlush(FLUSH_INTERVAL_MS);
             },
             deny() {
@@ -871,6 +922,8 @@ function createTagSightingPort() {
     };
 }
 const WEB_PUBLIC_KEY_PATTERN = /^tl_pk_[a-z2-7]{26}$/;
+/** The tab's verification nonce, in `sessionStorage`, written at the grant. */
+const VERIFICATION_KEY = "__tl.v";
 class MemoryStorage {
     constructor() {
         this.values = new Map();
@@ -891,6 +944,20 @@ let engine;
 let verification;
 let configValid = false;
 let listenersInstalled = false;
+/**
+ * Calls made before `init`, made in order once it has run, up to the same 100
+ * the engine holds before consent; past that they are dropped
+ * ([spec/capture.md] § Consent first).
+ */
+let early = [];
+/** True when there is no engine yet, and the call was held, or dropped. */
+function heldForInit(call) {
+    if (engine !== undefined)
+        return false;
+    if (early.length < PRE_CONSENT_CAP)
+        early.push(call);
+    return true;
+}
 function browserStorage() {
     try {
         return window.localStorage;
@@ -899,11 +966,39 @@ function browserStorage() {
         return new MemoryStorage();
     }
 }
+/**
+ * A page opened from a verification session carries the marker and has an
+ * opener. Once consent is granted there, the tab keeps the nonce, so the mark
+ * follows it to the site's next pages and back from a payment taken
+ * elsewhere, to the same origin ([spec/capture.md] § Verification mode).
+ */
 function verificationMode() {
     const nonce = new URL(window.location.href).searchParams.get("__tl_verify");
-    return nonce !== null && nonce.length > 0 && window.opener !== null
-        ? { nonce, opener: window.opener }
-        : undefined;
+    if (nonce !== null && nonce.length > 0 && window.opener !== null) {
+        return { nonce, opener: window.opener };
+    }
+    let kept = null;
+    try {
+        kept = window.sessionStorage.getItem(VERIFICATION_KEY);
+    }
+    catch {
+        // An unreadable tab storage keeps no mark.
+    }
+    return kept === null || kept.length === 0
+        ? undefined
+        : { nonce: kept, opener: window.opener };
+}
+function keepVerification(keep) {
+    try {
+        if (!keep)
+            window.sessionStorage.removeItem(VERIFICATION_KEY);
+        else if (verification !== undefined) {
+            window.sessionStorage.setItem(VERIFICATION_KEY, verification.nonce);
+        }
+    }
+    catch {
+        // A tab that cannot keep it marks this page only.
+    }
 }
 function landingPage() {
     const url = new URL(window.location.href);
@@ -958,7 +1053,7 @@ function isEndpointValid(endpoint) {
     }
 }
 function reportDiagnostic() {
-    if (verification === undefined)
+    if (verification === undefined || verification.opener === null)
         return;
     verification.opener.postMessage({
         type: "tracelog:diag",
@@ -1055,17 +1150,28 @@ function init(options) {
         ...(options.endpoint === undefined ? {} : { endpoint }),
     });
     installListeners();
+    const held = early;
+    early = [];
+    for (const call of held)
+        call();
     reportDiagnostic();
 }
 const TraceLog = {
     init,
     consent: {
         grant() {
+            if (heldForInit(() => TraceLog.consent.grant()))
+                return;
             engine?.consent.grant();
+            if (engine?.consent.state() === "granted")
+                keepVerification(true);
             reportDiagnostic();
         },
         deny() {
+            if (heldForInit(() => TraceLog.consent.deny()))
+                return;
             engine?.consent.deny();
+            keepVerification(false);
             reportDiagnostic();
         },
         state() {
@@ -1073,10 +1179,14 @@ const TraceLog = {
         },
     },
     step(name, context) {
+        if (heldForInit(() => TraceLog.step(name, context)))
+            return;
         engine?.step(name, context);
         reportDiagnostic();
     },
     conversion(name, options) {
+        if (heldForInit(() => TraceLog.conversion(name, options)))
+            return;
         engine?.conversion(name, options);
         reportDiagnostic();
     },

package/dist/tracelog.iife.js

@@ -28,6 +28,14 @@ const RETRY_BASE_MS = 1000;
 const RETRY_CAP_MS = 60 * 1000;
 const CIRCUIT_FAILURE_THRESHOLD = 5;
 const CIRCUIT_PROBE_MS = 60 * 1000;
+/**
+ * What the browser lets `keepalive` bodies in flight add up to. Every send
+ * uses `keepalive`, so no navigation cancels one, and every send fits what is
+ * left of this beside the sends already in flight ([spec/capture.md]
+ * § Delivery). It is below the contract's `MAX_BATCH_BYTES`, so it is the
+ * batch budget too.
+ */
+const KEEPALIVE_BUDGET_BYTES = 64 * 1024;
 const EVENT_NAME_PATTERN = /^[a-z][a-z0-9_]{0,63}$/;
 const PUBLIC_KEY_PATTERN = /^tl_pk_[a-z2-7]{26}$/;
 /**
@@ -172,7 +180,12 @@ function isConversionValid(options) {
 function serializedBytes(value) {
     return textEncoder.encode(JSON.stringify(value)).byteLength;
 }
-function batchFrom(events) {
+/**
+ * As many events as fit `room`, oldest first. An event that alone exceeds the
+ * whole keepalive budget can never be sent; one that only exceeds what the
+ * sends in flight leave waits for them.
+ */
+function batchFrom(events, room) {
     const selected = [];
     const unsendable = [];
     for (const event of events) {
@@ -182,8 +195,9 @@ function batchFrom(events) {
             v: EVENT_ENVELOPE_VERSION,
             events: [...selected, event],
         };
-        if (serializedBytes(candidate) > MAX_BATCH_BYTES) {
-            if (selected.length === 0) {
+        const bytes = serializedBytes(candidate);
+        if (bytes > room) {
+            if (selected.length === 0 && bytes > KEEPALIVE_BUDGET_BYTES) {
                 unsendable.push(event);
                 continue;
             }
@@ -200,11 +214,13 @@ function createCaptureEngine(ports, acquisition) {
     let pending = [];
     let lastDeclaredName;
     /**
-     * Every send in flight, by count and by the union of their event ids: a
-     * page hide sends alongside one rather than wait for it, so there can be
-     * two, and each must leave the other's events alone.
+     * Every send in flight, by count, by bytes and by the union of their event
+     * ids: a step taken and a page hide send beside one rather than wait for
+     * it, so there can be several, each must leave the others' events alone,
+     * and together they stay within the keepalive budget.
      */
     let sendsInFlight = 0;
+    let bytesInFlight = 0;
     const inFlight = new Set();
     /**
      * The conversions this page emitted and holds for their tag sighting
@@ -330,6 +346,38 @@ function createCaptureEngine(ports, acquisition) {
             return;
         }
         emit(pendingEvent);
+        sendTaken();
+    }
+    /**
+     * A step, and a conversion that is not held, leaves when it is taken: a
+     * click that navigates to another site may fire no hide event at all, and a
+     * send started by the click itself is the one that arrives ([spec/capture.md]
+     * § Delivery). An open circuit keeps it queued for the probe.
+     */
+    function sendTaken() {
+        if (circuit !== "closed" || !PUBLIC_KEY_PATTERN.test(config.key))
+            return;
+        void sendNow();
+    }
+    /**
+     * Sends at once what is queued and in no send in flight, beside any send in
+     * flight, within what the keepalive budget has left.
+     */
+    async function sendNow() {
+        const queue = readQueue(ports.storage);
+        const ready = queue.events.filter((event) => !held.has(event.eventId) && !inFlight.has(event.eventId));
+        const { batch, unsendable } = batchFrom(ready, KEEPALIVE_BUDGET_BYTES - bytesInFlight);
+        dropUnsendable(queue, unsendable);
+        if (batch.events.length > 0)
+            await deliver(batch);
+    }
+    function dropUnsendable(queue, unsendable) {
+        if (unsendable.length === 0)
+            return;
+        const dropped = new Set(unsendable.map((event) => event.eventId));
+        queue.events = queue.events.filter((event) => !dropped.has(event.eventId));
+        addDrop(queue, "invalid_event", unsendable.length);
+        writeQueue(ports.storage, queue);
     }
     /**
      * Gives each held conversion whose window has closed — or every one, at
@@ -382,11 +430,21 @@ function createCaptureEngine(ports, acquisition) {
         }
         return Math.max(0, earliest - now);
     }
-    async function flush(keepalive = false) {
-        release(keepalive);
+    async function flush(hidden = false) {
+        release(hidden);
         if (!initialized || consentState !== "granted")
             return;
-        if (sendsInFlight > 0 && !keepalive)
+        /**
+         * A page being hidden gets no later chance, so it sends what no send in
+         * flight carries at once, whatever the circuit's state, and the answer is
+         * read as any other's.
+         */
+        if (hidden) {
+            if (PUBLIC_KEY_PATTERN.test(config.key))
+                await sendNow();
+            return;
+        }
+        if (sendsInFlight > 0)
             return;
         const queue = readQueue(ports.storage);
         const ready = queue.events.filter((event) => !held.has(event.eventId) && !inFlight.has(event.eventId));
@@ -398,17 +456,6 @@ function createCaptureEngine(ports, acquisition) {
             }
             return;
         }
-        /**
-         * A page being hidden gets no later chance, so it sends what no send in
-         * flight carries at once, whatever the circuit's state, and the answer is
-         * read as any other's.
-         */
-        if (sendsInFlight > 0) {
-            const { batch } = batchFrom(ready);
-            if (batch.events.length > 0)
-                await deliver(batch, true);
-            return;
-        }
         const now = ports.clock.now().getTime();
         if (circuit === "open") {
             if (now < nextProbeAt) {
@@ -417,35 +464,32 @@ function createCaptureEngine(ports, acquisition) {
             }
             circuit = "half_open";
         }
-        const { batch, unsendable } = batchFrom(ready);
-        if (unsendable.length > 0) {
-            const dropped = new Set(unsendable.map((event) => event.eventId));
-            queue.events = queue.events.filter((event) => !dropped.has(event.eventId));
-            addDrop(queue, "invalid_event", unsendable.length);
-            writeQueue(ports.storage, queue);
-        }
+        const { batch, unsendable } = batchFrom(ready, KEEPALIVE_BUDGET_BYTES);
+        dropUnsendable(queue, unsendable);
         if (batch.events.length === 0) {
             scheduleFlush(FLUSH_INTERVAL_MS);
             return;
         }
-        await deliver(batch, keepalive);
+        await deliver(batch);
     }
     /**
      * One send, and its answer. It removes from the stored queue exactly what
      * it carried, by its own read, filter and write at the moment it settles,
      * so a send beside it keeps what it delivered.
      */
-    async function deliver(batch, keepalive) {
+    async function deliver(batch) {
         const carried = new Set(batch.events.map((event) => event.eventId));
+        const bytes = serializedBytes(batch);
         for (const eventId of carried)
             inFlight.add(eventId);
         sendsInFlight += 1;
+        bytesInFlight += bytes;
         try {
             const response = await ports.transport.send({
                 endpoint: config.endpoint,
                 key: config.key,
                 batch,
-                keepalive,
+                keepalive: true,
             });
             if (response.status >= 200 && response.status < 300) {
                 const currentQueue = readQueue(ports.storage);
@@ -497,6 +541,7 @@ function createCaptureEngine(ports, acquisition) {
             for (const eventId of carried)
                 inFlight.delete(eventId);
             sendsInFlight -= 1;
+            bytesInFlight -= bytes;
         }
     }
     const engine = {
@@ -506,27 +551,33 @@ function createCaptureEngine(ports, acquisition) {
                 endpoint: options.endpoint ?? "/v1/events",
             };
             initialized = true;
+            /**
+             * Only a denial is remembered; a grant is the integrator's on every load
+             * while consent stands, so it never outlives the banner that gave it
+             * ([spec/capture.md] § Consent first). A grant an earlier runtime
+             * stored is deleted. A second init keeps the decision this page made.
+             */
+            if (consentState !== "unknown")
+                return;
             const storedConsent = safeGet(ports.storage, CONSENT_KEY);
-            consentState =
-                storedConsent === "granted" || storedConsent === "denied"
-                    ? storedConsent
-                    : "unknown";
-            if (consentState === "granted") {
-                ports.sightings?.start();
-                scheduleFlush(FLUSH_INTERVAL_MS);
-            }
+            if (storedConsent === "denied")
+                consentState = "denied";
+            else if (storedConsent !== null)
+                safeRemove(ports.storage, CONSENT_KEY);
         },
         consent: {
             grant() {
                 if (!initialized)
                     return;
                 consentState = "granted";
-                safeSet(ports.storage, CONSENT_KEY, "granted");
+                safeRemove(ports.storage, CONSENT_KEY);
                 ports.sightings?.start();
                 const buffered = pending;
                 pending = [];
                 for (const pendingEvent of buffered)
                     emit(pendingEvent, true);
+                if (buffered.length > 0)
+                    sendTaken();
                 scheduleFlush(FLUSH_INTERVAL_MS);
             },
             deny() {
@@ -872,6 +923,8 @@ function createTagSightingPort() {
     };
 }
 const WEB_PUBLIC_KEY_PATTERN = /^tl_pk_[a-z2-7]{26}$/;
+/** The tab's verification nonce, in `sessionStorage`, written at the grant. */
+const VERIFICATION_KEY = "__tl.v";
 class MemoryStorage {
     constructor() {
         this.values = new Map();
@@ -892,6 +945,20 @@ let engine;
 let verification;
 let configValid = false;
 let listenersInstalled = false;
+/**
+ * Calls made before `init`, made in order once it has run, up to the same 100
+ * the engine holds before consent; past that they are dropped
+ * ([spec/capture.md] § Consent first).
+ */
+let early = [];
+/** True when there is no engine yet, and the call was held, or dropped. */
+function heldForInit(call) {
+    if (engine !== undefined)
+        return false;
+    if (early.length < PRE_CONSENT_CAP)
+        early.push(call);
+    return true;
+}
 function browserStorage() {
     try {
         return window.localStorage;
@@ -900,11 +967,39 @@ function browserStorage() {
         return new MemoryStorage();
     }
 }
+/**
+ * A page opened from a verification session carries the marker and has an
+ * opener. Once consent is granted there, the tab keeps the nonce, so the mark
+ * follows it to the site's next pages and back from a payment taken
+ * elsewhere, to the same origin ([spec/capture.md] § Verification mode).
+ */
 function verificationMode() {
     const nonce = new URL(window.location.href).searchParams.get("__tl_verify");
-    return nonce !== null && nonce.length > 0 && window.opener !== null
-        ? { nonce, opener: window.opener }
-        : undefined;
+    if (nonce !== null && nonce.length > 0 && window.opener !== null) {
+        return { nonce, opener: window.opener };
+    }
+    let kept = null;
+    try {
+        kept = window.sessionStorage.getItem(VERIFICATION_KEY);
+    }
+    catch {
+        // An unreadable tab storage keeps no mark.
+    }
+    return kept === null || kept.length === 0
+        ? undefined
+        : { nonce: kept, opener: window.opener };
+}
+function keepVerification(keep) {
+    try {
+        if (!keep)
+            window.sessionStorage.removeItem(VERIFICATION_KEY);
+        else if (verification !== undefined) {
+            window.sessionStorage.setItem(VERIFICATION_KEY, verification.nonce);
+        }
+    }
+    catch {
+        // A tab that cannot keep it marks this page only.
+    }
 }
 function landingPage() {
     const url = new URL(window.location.href);
@@ -959,7 +1054,7 @@ function isEndpointValid(endpoint) {
     }
 }
 function reportDiagnostic() {
-    if (verification === undefined)
+    if (verification === undefined || verification.opener === null)
         return;
     verification.opener.postMessage({
         type: "tracelog:diag",
@@ -1056,17 +1151,28 @@ function init(options) {
         ...(options.endpoint === undefined ? {} : { endpoint }),
     });
     installListeners();
+    const held = early;
+    early = [];
+    for (const call of held)
+        call();
     reportDiagnostic();
 }
 const TraceLog = {
     init,
     consent: {
         grant() {
+            if (heldForInit(() => TraceLog.consent.grant()))
+                return;
             engine?.consent.grant();
+            if (engine?.consent.state() === "granted")
+                keepVerification(true);
             reportDiagnostic();
         },
         deny() {
+            if (heldForInit(() => TraceLog.consent.deny()))
+                return;
             engine?.consent.deny();
+            keepVerification(false);
             reportDiagnostic();
         },
         state() {
@@ -1074,10 +1180,14 @@ const TraceLog = {
         },
     },
     step(name, context) {
+        if (heldForInit(() => TraceLog.step(name, context)))
+            return;
         engine?.step(name, context);
         reportDiagnostic();
     },
     conversion(name, options) {
+        if (heldForInit(() => TraceLog.conversion(name, options)))
+            return;
         engine?.conversion(name, options);
         reportDiagnostic();
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tracelog/capture-web",
-  "version": "1.3.0",
+  "version": "2.0.0",
   "description": "The TraceLog browser capture runtime: consent-first, pinned per version.",
   "keywords": [
     "conversion",
@@ -45,8 +45,8 @@
     "access": "public"
   },
   "devDependencies": {
-    "@tracelog/capture-core": "1.3.0",
-    "@tracelog/event-contract": "1.3.0"
+    "@tracelog/capture-core": "2.0.0",
+    "@tracelog/event-contract": "2.0.0"
   },
   "scripts": {
     "build": "tsc -p tsconfig.build.json && node build.mjs",