@zuplo/cli 7.7.7 → 7.7.9

package/node_modules/@posthog/core/src/logs/index.ts

@@ -1,11 +1,13 @@
 import type { LogAttributeValue } from '@posthog/types'
 import { buildOtlpLogRecord, buildOtlpLogsPayload, buildResourceAttributes } from './logs-utils'
 import { Logger, PostHogPersistedProperty } from '../types'
-import { isArray, raceWithTimeout, safeSetTimeout } from '../utils'
+import { isArray, raceWithTimeout } from '../utils'
+import { FlushTimer } from '../utils/flush-timer'
+import { RetryAfterWindow } from '../utils/retry-after'
+import { MAX_FLUSH_BACKOFF_MS, NO_JITTER, backoffDelayMs, drawJitter } from '../utils/backoff'
 import type { BufferedLogEntry, CaptureLogOptions, LogSdkContext, LogsHost, ResolvedPostHogLogsConfig } from './types'
 
 // Caps the retry backoff at 2^6 = 64× the flush interval.
-const MAX_FLUSH_BACKOFF_EXPONENT = 6
 
 export class PostHogLogs {
   private _maxBufferSize: number
@@ -17,7 +19,7 @@ export class PostHogLogs {
   // one record after each successful send so a one-off oversized payload
   // (e.g. a giant stack trace) doesn't permanently degrade throughput.
   private _maxBatchRecordsPerPost: number
-  private _flushTimer?: ReturnType<typeof safeSetTimeout>
+  private readonly _flushTimer = new FlushTimer(() => this._flushInBackground())
   // Serializes concurrent flushes — the second caller awaits the first rather
   // than racing it and double-sending the same head-of-queue records.
   private _flushPromise: Promise<void> | null = null
@@ -27,9 +29,12 @@ export class PostHogLogs {
   // A batch captures this when it is assembled, so it can tell that the records it is
   // holding no longer correspond to anything queued.
   private _queueGeneration = 0
+  // Every path that can start a send checks this, not just the retry timer.
+  private _retryAfter = new RetryAfterWindow()
   // Consecutive failed flushes; drives exponential backoff on the retry timer.
   // A successful flush resets it to 0.
   private _consecutiveFlushFailures = 0
+  private _flushJitter = NO_JITTER
 
   // Fixed-window rate cap. Tumbling (not sliding) for cheap arithmetic on the
   // hot path. Window rolls the first time `captureLog` fires after the window
@@ -83,7 +88,7 @@ export class PostHogLogs {
    * and clears it separately (the browser empties its in-memory store).
    */
   reset(): void {
-    this._clearFlushTimer()
+    this._flushTimer.clear()
     // `_flushPromise` is deliberately left alone: clearing it would let a second flush
     // run alongside the in-flight one. Retiring that flush is `clearQueue`'s job,
     // because the queue it holds belongs to the host, not to this state.
@@ -91,14 +96,28 @@ export class PostHogLogs {
     this._intervalLogCount = 0
     this._droppedWarned = false
     this._consecutiveFlushFailures = 0
+    this._flushJitter = NO_JITTER
+    this._retryAfter.reset()
     this._maxBatchRecordsPerPost = this._config.maxBatchRecordsPerPost
   }
 
   // Call when connectivity is restored: clear the failure backoff and flush now,
   // so records don't wait out a (possibly minutes-long) backoff delay after the
   // network returns. The host owns connectivity detection (web: `online` event).
+  // A `Retry-After` window survives this: the network coming back says nothing
+  // about the rate limit the endpoint set, and browsers fire `online` on every
+  // network handover.
   onReconnect(): void {
     this._consecutiveFlushFailures = 0
+    this._flushJitter = NO_JITTER
+    if (this._retryAfter.isOpen()) {
+      // The wait outlives the reconnect, but something still has to schedule
+      // the retry: an explicit `flush()` leaves no timer behind.
+      if (this._hasQueuedRecords()) {
+        this._armFlushTimer()
+      }
+      return
+    }
     this._flushInBackground()
   }
 
@@ -248,7 +267,7 @@ export class PostHogLogs {
   }
 
   private async _flushInner(): Promise<void> {
-    this._clearFlushTimer()
+    this._flushTimer.clear()
 
     let queue = this._instance.getPersistedProperty<BufferedLogEntry[]>(PostHogPersistedProperty.LogsQueue) ?? []
     if (queue.length === 0) {
@@ -292,12 +311,22 @@ export class PostHogLogs {
       if (outcome.kind === 'too-large' && batch.length > 1) {
         this._maxBatchRecordsPerPost = Math.max(1, Math.floor(batch.length / 2))
         this._logger.warn(
-          `Received 413 when sending logs batch of size ${batch.length}, reducing batch size to ${this._maxBatchRecordsPerPost}`
+          `Logs batch of size ${batch.length} was too large for the ingestion endpoint, reducing batch size to ${this._maxBatchRecordsPerPost}`
         )
         // Don't advance the queue — retry the same records with the smaller cap.
         continue
       }
 
+      // Not on the background wrapper: every lifecycle hook takes `flush()`,
+      // which does not go through it.
+      this._retryAfter.record(outcome)
+
+      // Outright, not through the ratchet: a timer a mid-flight capture armed
+      // is measured against a window this outcome may just have closed.
+      if (this._flushTimer.pending) {
+        this._flushTimer.arm(Math.max(this._flushIntervalMs, this._retryAfter.remainingMs()))
+      }
+
       if (outcome.kind === 'retry-later') {
         // Transient failure: keep records in the queue for the next flush cycle
         // and surface the error so the caller can log/react.
@@ -305,13 +334,15 @@ export class PostHogLogs {
       }
 
       // ok | fatal | too-large-with-batch-of-1 → records are leaving the
-      // queue. 'fatal' and size-1 413s are dropped so we don't spin on the
-      // same record forever. Surface the size-1 413 explicitly so a single
+      // queue. 'fatal' and size-1 refusals are dropped so we don't spin on the
+      // same record forever. Surface the size-1 refusal explicitly so a single
       // oversized record (e.g. a giant body field) is visible in logs
       // instead of silently disappearing.
       if (outcome.kind === 'too-large') {
+        // Reached either from a 413 or from the size the SDK measured before
+        // sending, so the message names neither.
         this._logger.warn(
-          'Dropping a single log record after 413 with batch size 1 — the record is larger than the server cap and cannot be split further.'
+          'Dropping a single log record with batch size 1 — the record is larger than the server cap and cannot be split further.'
         )
       } else if (outcome.kind === 'ok' && this._maxBatchRecordsPerPost < this._config.maxBatchRecordsPerPost) {
         // Linear recovery: each healthy send pushes the cap back up by 1
@@ -364,34 +395,40 @@ export class PostHogLogs {
     this._instance.setPersistedProperty(PostHogPersistedProperty.LogsQueue, queue)
 
     // Flush trigger: drain now rather than waiting for the timer. The queue may
-    // grow past this up to the eviction cap while the flush is in flight.
-    if (queue.length >= this._maxBufferSize) {
+    // grow past this up to the eviction cap while the flush is in flight. Not
+    // while the endpoint has asked us to wait: the size trigger is the dominant
+    // one on a busy host, so sending here would ignore the window entirely.
+    if (queue.length >= this._maxBufferSize && !this._retryAfter.isOpen()) {
       this._flushInBackground()
       return
     }
 
-    // Arm one timer at a time; re-arming within the window would push the flush out.
+    // Arm one timer at a time; re-arming on every enqueue would push the flush out.
     this._armFlushTimer()
   }
 
   // Arms the flush timer if none is pending. One-shot: the callback clears the
   // handle so the next enqueue (or a flush that left records) schedules again.
-  private _armFlushTimer(delayMs: number = this._flushIntervalMs): void {
-    if (this._flushTimer) {
+  private _armFlushTimer(): void {
+    if (this._flushTimer.pending) {
       return
     }
-    this._flushTimer = safeSetTimeout(() => {
-      this._flushTimer = undefined
-      this._flushInBackground()
-    }, delayMs)
+    // Floored by any open window: `flush()` leaves no timer behind, so a
+    // capture after one arrives here.
+    this._flushTimer.arm(Math.max(this._flushIntervalMs, this._retryAfter.remainingMs()))
   }
 
   // Retry delay after a flush that left records: the first retry is at the base
-  // interval, then exponential backoff (capped) so a sustained outage isn't
-  // retried every interval.
+  // interval, then exponential backoff so a sustained outage isn't retried every
+  // interval. Jitter is drawn once per failure and reused, so two delays taken
+  // for the same failure cannot disagree.
   private _nextFlushDelay(): number {
-    const exponent = Math.min(Math.max(0, this._consecutiveFlushFailures - 1), MAX_FLUSH_BACKOFF_EXPONENT)
-    return this._flushIntervalMs * 2 ** exponent
+    // A floor, not a replacement: the header never retries us sooner than our
+    // own backoff would have.
+    return Math.max(
+      backoffDelayMs(this._flushIntervalMs, this._consecutiveFlushFailures, this._flushJitter, MAX_FLUSH_BACKOFF_MS),
+      this._retryAfter.remainingMs()
+    )
   }
 
   private _hasQueuedRecords(): boolean {
@@ -410,7 +447,7 @@ export class PostHogLogs {
    * fetchRetryDelay)`, which can exceed the caller's shutdown SLA.
    */
   async shutdown(timeoutMs?: number): Promise<void> {
-    this._clearFlushTimer()
+    this._flushTimer.clear()
     const flushPromise = this.flush().catch(() => {
       // Best-effort: a logs-flush failure during shutdown is not actionable
       // and must not prevent the rest of shutdown from running. Errors are
@@ -449,9 +486,11 @@ export class PostHogLogs {
       .then(
         () => {
           this._consecutiveFlushFailures = 0
+          this._flushJitter = NO_JITTER
         },
         (err) => {
           this._consecutiveFlushFailures++
+          this._flushJitter = drawJitter()
           this._logger.error('PostHog logs flush failed:', err)
         }
       )
@@ -460,15 +499,8 @@ export class PostHogLogs {
         // sit undelivered on a quiet page; re-arm so the timer retries them, backing
         // off on consecutive failures.
         if (!this._instance.isDisabled && this._hasQueuedRecords()) {
-          this._armFlushTimer(this._nextFlushDelay())
+          this._flushTimer.armNoEarlierThan(this._nextFlushDelay())
         }
       })
   }
-
-  private _clearFlushTimer(): void {
-    if (this._flushTimer) {
-      clearTimeout(this._flushTimer)
-      this._flushTimer = undefined
-    }
-  }
 }

package/node_modules/@posthog/core/src/logs/logs-utils.ts

@@ -12,7 +12,7 @@ import type { LogSdkContext, ResolvedPostHogLogsConfig } from './types'
 import { isNullish, isNumber, isUndefined } from '../utils'
 import { sanitizeString, UNSERIALIZABLE_VALUE } from '../utils/json-utils'
 import { toOtlpKeyValueList } from '../utils/otlp-any-value'
-import { buildOtlpResourceAttributes } from '../utils/otlp-resource'
+import { buildOtlpResourceAttributes, toOtlpResourceKeyValueList } from '../utils/otlp-resource'
 
 // ============================================================================
 // Severity mapping
@@ -206,7 +206,7 @@ export function buildOtlpLogsPayload(
   return {
     resourceLogs: [
       {
-        resource: { attributes: toOtlpKeyValueList(resourceAttributes) },
+        resource: { attributes: toOtlpResourceKeyValueList(resourceAttributes) },
         scopeLogs: [
           {
             scope: { name: scopeName, version: scopeVersion },

package/node_modules/@posthog/core/src/logs/types.ts

@@ -128,8 +128,8 @@ export interface PostHogLogsConfig {
 
   /**
    * Max records per outbound POST. Keeps each request under the server's
-   * 2 MB cap. On a 413 response, the SDK halves this value, retries the
-   * same records, then ramps back up by 1 per healthy send. A 413 on a
+   * request body cap. On a 413 response, the SDK halves this value, retries
+   * the same records, then ramps back up by 1 per healthy send. A 413 on a
    * single-record batch drops the record (it's larger than the server can
    * accept regardless of batch size). Default: 50 (RN) / 100 (browser).
    */

package/node_modules/@posthog/core/src/metrics/index.spec.ts

@@ -50,6 +50,9 @@ describe('PostHogMetrics', () => {
     vi.useFakeTimers()
     mockInstance = createMockInstance()
     logger = createMockLogger()
+    // Retry delays carry jitter; pinned to its midpoint so every timing
+    // assertion here measures the backoff itself and cannot flake.
+    vi.spyOn(Math, 'random').mockReturnValue(0.5)
   })
 
   afterEach(() => {
@@ -243,6 +246,263 @@ describe('PostHogMetrics', () => {
       expect(mockInstance._sendMetricsBatch).toHaveBeenCalledTimes(1)
     })
 
+    it('keeps flushing on the interval while captures keep arriving', async () => {
+      // Every capture arms the timer, and metrics have no size trigger to fall
+      // back on: re-arming a pending one would stop the window ever being sent.
+      const metrics = createMetrics({ flushIntervalMs: 10_000 })
+
+      for (let i = 0; i < 60; i++) {
+        metrics.count('orders_created', 1)
+        await vi.advanceTimersByTimeAsync(1000)
+      }
+
+      expect(mockInstance._sendMetricsBatch).toHaveBeenCalled()
+    })
+
+    it('waits out Retry-After even when a flush timer is already pending', async () => {
+      // The capture arms a timer at the flush interval; the failed flush then asks
+      // for far longer. The pending timer must not fire first.
+      const instance = createMockInstance({
+        _sendMetricsBatch: vi.fn((): Promise<SendMetricsBatchOutcome> =>
+          Promise.resolve({ kind: 'retry-later', error: new Error('429'), retryAfterMs: 300_000 })
+        ),
+      })
+      const metrics = createMetrics({ flushIntervalMs: 10_000 }, instance)
+      metrics.count('orders_created', 1)
+      await metrics.flush()
+      expect(instance._sendMetricsBatch).toHaveBeenCalledTimes(1)
+
+      await vi.advanceTimersByTimeAsync(11_000)
+      expect(instance._sendMetricsBatch).toHaveBeenCalledTimes(1)
+
+      await vi.advanceTimersByTimeAsync(300_000)
+      expect(instance._sendMetricsBatch).toHaveBeenCalledTimes(2)
+    })
+
+    it('clears Retry-After on an outcome that is not a retry', async () => {
+      // Only a retriable outcome carries a wait. A stale one left set here would
+      // pin every later flush at the server's old window forever.
+      const outcomes: SendMetricsBatchOutcome[] = [
+        { kind: 'retry-later', error: new Error('429'), retryAfterMs: 300_000 },
+        { kind: 'fatal', error: new Error('400') },
+      ]
+      const instance = createMockInstance({
+        _sendMetricsBatch: vi.fn(() => Promise.resolve(outcomes.shift() ?? { kind: 'ok' })),
+      })
+      const metrics = createMetrics({ flushIntervalMs: 10_000 }, instance)
+      metrics.count('orders_created', 1)
+      await metrics.flush()
+
+      // The wait elapses, the retry lands a 400, and that ends the wait.
+      await vi.advanceTimersByTimeAsync(300_000)
+      expect(instance._sendMetricsBatch).toHaveBeenCalledTimes(2)
+
+      metrics.count('orders_created', 1)
+      await vi.advanceTimersByTimeAsync(10_000)
+      expect(instance._sendMetricsBatch).toHaveBeenCalledTimes(3)
+    })
+
+    it('keeps the Retry-After window when a batch is refused for size', async () => {
+      // `too-large` is a verdict on the body's size — the SDK's own or a 413 —
+      // so it says nothing about the endpoint's rate limit. Ending the wait on
+      // it lets the next refusal install a fresh window, pushing the retry out
+      // past the deadline the endpoint actually named — observed here as the
+      // flush landing at 300s rather than at 310s.
+      const outcomes: SendMetricsBatchOutcome[] = [
+        { kind: 'retry-later', error: new Error('429'), retryAfterMs: 300_000 },
+        { kind: 'too-large' },
+        { kind: 'retry-later', error: new Error('429'), retryAfterMs: 300_000 },
+      ]
+      const instance = createMockInstance({
+        _sendMetricsBatch: vi.fn(() => Promise.resolve(outcomes.shift() ?? { kind: 'ok' })),
+      })
+      const metrics = createMetrics({ flushIntervalMs: 1000 }, instance)
+      metrics.count('orders_created', 1)
+      await metrics.flush()
+      expect(instance._sendMetricsBatch).toHaveBeenCalledTimes(1)
+
+      await vi.advanceTimersByTimeAsync(10_000)
+      await metrics.flush()
+      metrics.count('orders_created', 1)
+      await metrics.flush()
+      expect(instance._sendMetricsBatch).toHaveBeenCalledTimes(3)
+
+      await vi.advanceTimersByTimeAsync(295_000)
+      expect(instance._sendMetricsBatch).toHaveBeenCalledTimes(4)
+    })
+
+    it('closes the window at the ceiling for a host out-pacing it', async () => {
+      // Each refusal sliding the deadline would keep `_nextFlushDelay` pinned at
+      // the full window, so the flush cadence would never recover.
+      const instance = createMockInstance({
+        _sendMetricsBatch: vi.fn((): Promise<SendMetricsBatchOutcome> =>
+          Promise.resolve({ kind: 'retry-later', error: new Error('429'), retryAfterMs: 30_000 })
+        ),
+      })
+      const metrics = createMetrics({ flushIntervalMs: 60_000 }, instance)
+      metrics.count('orders_created', 1)
+      await metrics.flush()
+      expect(instance._sendMetricsBatch).toHaveBeenCalledTimes(1)
+
+      // Sampled: whether a given moment falls inside a window is timing
+      // dependent, but it must fall outside one sometimes.
+      let sawWindowClosed = false
+      for (let i = 0; i < 70; i++) {
+        await vi.advanceTimersByTimeAsync(5000)
+        // Sampled before the flush: a flush that finds the window closed opens
+        // a fresh one, so sampling after it would always look open.
+        if ((metrics as any)._retryAfter.remainingMs() === 0) {
+          sawWindowClosed = true
+        }
+        metrics.count('orders_created', 1)
+        await metrics.flush()
+      }
+      expect(sawWindowClosed).toBe(true)
+    })
+
+    it('does not install a Retry-After that lands after reset', async () => {
+      let settle: ((outcome: SendMetricsBatchOutcome) => void) | undefined
+      const instance = createMockInstance({
+        _sendMetricsBatch: vi.fn(
+          (): Promise<SendMetricsBatchOutcome> =>
+            new Promise((resolve) => {
+              settle = resolve
+            })
+        ),
+      })
+      const metrics = createMetrics({ flushIntervalMs: 1000 }, instance)
+      metrics.count('orders_created', 1)
+      await vi.advanceTimersByTimeAsync(1000)
+      expect(instance._sendMetricsBatch).toHaveBeenCalledTimes(1)
+
+      metrics.reset()
+
+      // Settle first: the capture that arms the next timer must not find a
+      // window belonging to the client that was just torn down.
+      settle?.({ kind: 'retry-later', error: new Error('429'), retryAfterMs: 300_000 })
+      await vi.advanceTimersByTimeAsync(0)
+
+      metrics.count('orders_created', 1)
+      await vi.advanceTimersByTimeAsync(1000)
+      expect(instance._sendMetricsBatch).toHaveBeenCalledTimes(2)
+    })
+
+    it('drops a Retry-After wait on reset', async () => {
+      const instance = createMockInstance({
+        _sendMetricsBatch: vi.fn((): Promise<SendMetricsBatchOutcome> =>
+          Promise.resolve({ kind: 'retry-later', error: new Error('429'), retryAfterMs: 300_000 })
+        ),
+      })
+      const metrics = createMetrics({ flushIntervalMs: 10_000 }, instance)
+      metrics.count('orders_created', 1)
+      await metrics.flush()
+
+      metrics.reset()
+      metrics.count('orders_created', 1)
+      await vi.advanceTimersByTimeAsync(10_000)
+      expect(instance._sendMetricsBatch).toHaveBeenCalledTimes(2)
+    })
+
+    it('does not restart a served-out wait for a sample captured mid-retry', async () => {
+      // A deadline, not a duration. The retry's timer has already fired, so the
+      // capture below is the one that arms the next timer — and it sees the
+      // wait still set, because the send it belongs to has not settled. Holding
+      // a duration here re-arms for the whole window a second time and leaves
+      // the sample 300s behind on an endpoint that has already recovered.
+      let settleRetry: ((outcome: SendMetricsBatchOutcome) => void) | undefined
+      let call = 0
+      const instance = createMockInstance({
+        _sendMetricsBatch: vi.fn((): Promise<SendMetricsBatchOutcome> => {
+          call++
+          if (call === 1) {
+            return Promise.resolve({ kind: 'retry-later', error: new Error('429'), retryAfterMs: 300_000 })
+          }
+          return new Promise<SendMetricsBatchOutcome>((resolve) => {
+            settleRetry = resolve
+          })
+        }),
+      })
+      const metrics = createMetrics({ flushIntervalMs: 10_000 }, instance)
+      metrics.count('orders_created', 1)
+      await vi.advanceTimersByTimeAsync(10_000)
+      expect(instance._sendMetricsBatch).toHaveBeenCalledTimes(1)
+
+      // The wait elapses and the retry goes out, but hangs.
+      await vi.advanceTimersByTimeAsync(300_000)
+      expect(instance._sendMetricsBatch).toHaveBeenCalledTimes(2)
+
+      metrics.count('orders_created', 1)
+      settleRetry?.({ kind: 'ok' })
+      await vi.advanceTimersByTimeAsync(0)
+
+      // One interval, not another window.
+      await vi.advanceTimersByTimeAsync(10_000)
+      expect(instance._sendMetricsBatch).toHaveBeenCalledTimes(3)
+    })
+
+    it('keeps its own interval when the endpoint asks for less', async () => {
+      const instance = createMockInstance({
+        _sendMetricsBatch: vi.fn((): Promise<SendMetricsBatchOutcome> =>
+          Promise.resolve({ kind: 'retry-later', error: new Error('503'), retryAfterMs: 10 })
+        ),
+      })
+      const metrics = createMetrics({ flushIntervalMs: 10_000 }, instance)
+      metrics.count('orders_created', 1)
+      await vi.advanceTimersByTimeAsync(10_000)
+      expect(instance._sendMetricsBatch).toHaveBeenCalledTimes(1)
+
+      await vi.advanceTimersByTimeAsync(1000)
+      expect(instance._sendMetricsBatch).toHaveBeenCalledTimes(1)
+
+      await vi.advanceTimersByTimeAsync(10_000)
+      expect(instance._sendMetricsBatch).toHaveBeenCalledTimes(2)
+    })
+
+    it('sends on an explicit flush inside the window', async () => {
+      // Lifecycle drains (RN background, shutdown) must not become no-ops for
+      // the length of a window; metrics has no `force` escape hatch.
+      const outcomes: SendMetricsBatchOutcome[] = [
+        { kind: 'retry-later', error: new Error('429'), retryAfterMs: 300_000 },
+      ]
+      const instance = createMockInstance({
+        _sendMetricsBatch: vi.fn((): Promise<SendMetricsBatchOutcome> =>
+          Promise.resolve(outcomes.shift() ?? { kind: 'ok' })
+        ),
+      })
+      const metrics = createMetrics({ flushIntervalMs: 10_000 }, instance)
+      metrics.count('orders_created', 1)
+      await vi.advanceTimersByTimeAsync(10_000)
+      expect(instance._sendMetricsBatch).toHaveBeenCalledTimes(1)
+
+      metrics.count('orders_created', 1)
+      await metrics.flush()
+      expect(instance._sendMetricsBatch).toHaveBeenCalledTimes(2)
+    })
+
+    it('ends the wait when a later failure names none', async () => {
+      const outcomes: SendMetricsBatchOutcome[] = [
+        { kind: 'retry-later', error: new Error('429'), retryAfterMs: 300_000 },
+        { kind: 'retry-later', error: new Error('503') },
+      ]
+      const instance = createMockInstance({
+        _sendMetricsBatch: vi.fn((): Promise<SendMetricsBatchOutcome> =>
+          Promise.resolve(outcomes.shift() ?? { kind: 'ok' })
+        ),
+      })
+      const metrics = createMetrics({ flushIntervalMs: 10_000 }, instance)
+      metrics.count('orders_created', 1)
+      await vi.advanceTimersByTimeAsync(10_000)
+      expect(instance._sendMetricsBatch).toHaveBeenCalledTimes(1)
+
+      await vi.advanceTimersByTimeAsync(300_000)
+      expect(instance._sendMetricsBatch).toHaveBeenCalledTimes(2)
+
+      // Off the 300s window and back on our own backoff: two consecutive
+      // failures, so one doubling of the interval rather than another 300s.
+      await vi.advanceTimersByTimeAsync(20_000)
+      expect(instance._sendMetricsBatch).toHaveBeenCalledTimes(3)
+    })
+
     it('does not send when the window is empty', async () => {
       createMetrics({ flushIntervalMs: 5000 })
       await vi.advanceTimersByTimeAsync(15000)
@@ -519,4 +779,48 @@ describe('PostHogMetrics', () => {
       expect(optedOutInstance._sendMetricsBatch).not.toHaveBeenCalled()
     })
   })
+
+  it('does not hold a later capture at a window a successful flush already closed', async () => {
+    let sends = 0
+    mockInstance._sendMetricsBatch = vi.fn(async (): Promise<SendMetricsBatchOutcome> => {
+      sends += 1
+      return sends === 1 ? { kind: 'retry-later', error: new Error('429'), retryAfterMs: 300_000 } : { kind: 'ok' }
+    })
+    const metrics = createMetrics({ flushIntervalMs: 5000 })
+
+    metrics.count('a', 1)
+    await vi.advanceTimersByTimeAsync(5000)
+    await metrics.flush()
+    const closedAt = Date.now()
+
+    metrics.count('b', 1)
+    await vi.advanceTimersByTimeAsync(5000)
+
+    expect(mockInstance._sendMetricsBatch).toHaveBeenCalledTimes(3)
+    expect(Date.now() - closedAt).toBeLessThanOrEqual(5000)
+  })
+
+  it('releases a series captured mid-flush once that flush closes the window', async () => {
+    const metrics = createMetrics({ flushIntervalMs: 10_000 })
+    let sends = 0
+    mockInstance._sendMetricsBatch = vi.fn(async (): Promise<SendMetricsBatchOutcome> => {
+      sends += 1
+      if (sends === 1) {
+        return { kind: 'retry-later', error: new Error('429'), retryAfterMs: 300_000 }
+      }
+      await Promise.resolve()
+      if (sends === 2) {
+        metrics.count('mid', 1)
+      }
+      return { kind: 'ok' }
+    })
+
+    metrics.count('a', 1)
+    await vi.advanceTimersByTimeAsync(10_000)
+    await vi.advanceTimersByTimeAsync(10_000)
+    await metrics.flush()
+
+    await vi.advanceTimersByTimeAsync(10_000)
+    expect(mockInstance._sendMetricsBatch).toHaveBeenCalledTimes(3)
+  })
 })