fix(audience): guard SendBatch against overlapping timer ticks

System.Threading.Timer does not serialise callbacks — with a 5s flush
interval and HTTP requests that can run up to the 30s timeout, a slow
network stacks six overlapping callbacks, each on its own ThreadPool
thread blocked inside SendBatchAsync.

Gate SendBatch with Interlocked.CompareExchange so subsequent ticks
return in microseconds while a send is in flight. The guard is cleared
in finally so a throw inside GetResult or RescheduleSendTimer still
releases the next tick, and defensively in Shutdown so a WaitOne that
times out on a still-running callback cannot strand the flag at 1
across an Init/Shutdown cycle.

Exposes SendBatch via an internal testing hook so the guard can be
exercised without a real timer; the new test blocks the HTTP handler,
fires an overlapping tick, and asserts only one request reaches the
wire.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ImmutableJeffrey

src/Packages/Audience/Runtime/ImmutableAudience.cs

@@ -26,6 +26,13 @@ public static class ImmutableAudience
         private static volatile bool _initialized;
         private static readonly object _initLock = new object();
 
+        // Guard against overlapping timer ticks. System.Threading.Timer fires
+        // callbacks on independent ThreadPool threads and does not serialise
+        // them; without this gate, a slow SendBatchAsync (up to the HTTP
+        // timeout) would stack on every interval tick, each tick holding its
+        // own thread blocked on a pending request.
+        private static int _sendInFlight;
+
         // AudienceUnityHooks sets this at SubsystemRegistration so Unity studios
         // can omit PersistentDataPath from AudienceConfig and Init will fill it
         // from Application.persistentDataPath. Non-Unity callers must still set
@@ -484,6 +491,12 @@ public static void Shutdown()
                 _sendTimer = null;
             }
 
+            // Clear the in-flight guard in case the WaitOne above timed out
+            // with a SendBatch callback still running: without this, a later
+            // Init would leave _sendInFlight stranded at 1 and suppress every
+            // tick of the new timer.
+            Interlocked.Exchange(ref _sendInFlight, 0);
+
             _queue?.Shutdown();
 
             // Best-effort final send, capped so a slow network can't hang quit.
@@ -553,6 +566,10 @@ internal static void ResetState()
 
         internal static void FlushQueueToDiskForTesting() => _queue?.FlushSync();
 
+        // Invokes the timer callback body directly so the overlapping-tick
+        // guard can be exercised without a real timer.
+        internal static void SendBatchForTesting() => SendBatch();
+
         // -----------------------------------------------------------------
         // Private
         // -----------------------------------------------------------------
@@ -578,23 +595,36 @@ private static void Enqueue(Dictionary<string, object>? msg)
 
         private static void SendBatch()
         {
-            var transport = _transport;
-            if (transport == null) return;
+            // CAS in the guard before doing any work; a previous tick still
+            // running means skip entirely, including the reschedule — the
+            // in-flight tick will reschedule on its own finally path.
+            if (Interlocked.CompareExchange(ref _sendInFlight, 1, 0) != 0)
+                return;
 
-            if (!transport.IsInBackoffWindow)
+            try
             {
-                try
-                {
-                    transport.SendBatchAsync().ConfigureAwait(false).GetAwaiter().GetResult();
-                }
-                catch (Exception ex)
+                var transport = _transport;
+                if (transport == null) return;
+
+                if (!transport.IsInBackoffWindow)
                 {
-                    // ThreadPool timer thread; no caller above to catch.
-                    Log.Warn($"SendBatch unexpected exception: {ex.GetType().Name}: {ex.Message}");
+                    try
+                    {
+                        transport.SendBatchAsync().ConfigureAwait(false).GetAwaiter().GetResult();
+                    }
+                    catch (Exception ex)
+                    {
+                        // ThreadPool timer thread; no caller above to catch.
+                        Log.Warn($"SendBatch unexpected exception: {ex.GetType().Name}: {ex.Message}");
+                    }
                 }
-            }
 
-            RescheduleSendTimer(transport);
+                RescheduleSendTimer(transport);
+            }
+            finally
+            {
+                Interlocked.Exchange(ref _sendInFlight, 0);
+            }
         }
 
         // Realigns the timer to NextAttemptAt so we don't repoll through a long backoff window.

src/Packages/Audience/Tests/Runtime/ImmutableAudienceTests.cs

@@ -850,5 +850,56 @@ public void FullToAnonymous_FutureTracksOmitUserId()
             Assert.IsFalse(trackFiles[0].ContainsKey("userId"),
                 "Track under Anonymous consent must not carry userId");
         }
+
+        // -----------------------------------------------------------------
+        // SendBatch — overlapping timer tick guard
+        // -----------------------------------------------------------------
+
+        [Test]
+        public void SendBatch_ConcurrentTicks_OnlyOneReachesTransport()
+        {
+            var handler = new BlockingHandler();
+            var config = MakeConfig();
+            config.HttpHandler = handler;
+
+            ImmutableAudience.Init(config);
+            ImmutableAudience.Track("event_to_send");
+            ImmutableAudience.FlushQueueToDiskForTesting();
+
+            // Kick off one SendBatch on a worker — it will block inside the
+            // handler until we signal, holding _sendInFlight = 1.
+            var blocked = Task.Run(() => ImmutableAudience.SendBatchForTesting());
+
+            // Give the worker enough time to enter the handler's SendAsync.
+            Assert.IsTrue(handler.EnteredSendAsync.Wait(TimeSpan.FromSeconds(2)),
+                "first SendBatch should have reached the HTTP handler");
+
+            // Second tick while the first is still in flight — must return
+            // immediately without issuing another request.
+            ImmutableAudience.SendBatchForTesting();
+
+            // Release the blocked send and let it finish.
+            handler.Release.Set();
+            Assert.IsTrue(blocked.Wait(TimeSpan.FromSeconds(5)),
+                "blocked SendBatch should finish after release");
+
+            Assert.AreEqual(1, handler.RequestCount,
+                "overlapping tick must not issue a second HTTP request");
+        }
+
+        private class BlockingHandler : HttpMessageHandler
+        {
+            public readonly ManualResetEventSlim EnteredSendAsync = new ManualResetEventSlim(false);
+            public readonly ManualResetEventSlim Release = new ManualResetEventSlim(false);
+            public int RequestCount;
+
+            protected override async Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken ct)
+            {
+                Interlocked.Increment(ref RequestCount);
+                EnteredSendAsync.Set();
+                await Task.Run(() => Release.Wait(ct), ct).ConfigureAwait(false);
+                return new HttpResponseMessage(HttpStatusCode.ServiceUnavailable);
+            }
+        }
     }
 }