@@ -20,7 +20,7 @@ faster. Pass `min_timeout_ms`, `max_timeout_ms` and `multiplier` to a
 
 * Uploads are retried on 408, 410, 429, 460, and 5xx except 501, 505 and 511.
 * A `Retry-After` header is honoured on any retryable response, not only 429. Numeric seconds and the RFC 7231 HTTP-date formats are both accepted, and the value is capped at `rate_limit_retry_after_cap`.
-* Responses carrying `Retry-After` are retried for up to `max_rate_limit_duration` and do not consume the retry count. Other failures use exponential backoff limited by `retries` and by `max_total_backoff_duration` as an upper bound.
+* Responses carrying `Retry-After` are retried for up to `max_rate_limit_duration` and do not consume the retry count. A `Retry-After` that will not fit in what is left of the budget ends the episode rather than being shortened: retrying inside the window the server asked for sends a request it has already declined to serve, and the budget would be spent by then anyway. `max_total_backoff_duration` works the same way. Other failures use exponential backoff limited by `retries` and by `max_total_backoff_duration` as an upper bound.
 * New options, all in seconds: `max_rate_limit_duration` (default 1800), `max_total_backoff_duration` (default 43200) and `rate_limit_retry_after_cap` (default 300).
 * Network errors are retried on the same schedule as failed responses, rather than dropping the batch.
 * A pending retry no longer delays shutdown.
 
@@ -37,12 +37,21 @@ def next_backoff_delay
 
         @retries_remaining -= 1
 
-        @backoff_start_time ||= monotonic_now
-        return spent('Max total backoff duration exceeded for batch') if elapsed?(@backoff_start_time, @max_total_backoff_duration)
+        # One reading for the budget test and the fit check below, as on the
+        # rate-limit path.
+        now = monotonic_now
+        @backoff_start_time ||= now
+
+        remaining = @max_total_backoff_duration - (now - @backoff_start_time)
+        return spent('Max total backoff duration exceeded for batch') if remaining <= 0
+
+        # A backoff longer than what is left of the budget is a wait whose attempt
+        # can never run, so there is nothing to schedule.
+        delay = @backoff_policy.next_interval.to_f / 1000
+        return spent('Backoff interval does not fit the remaining budget') if delay > remaining
 
-        delay_ms = @backoff_policy.next_interval
-        @logger.debug("Retrying request, #{@retries_remaining} retries left. Waiting #{delay_ms}ms")
-        delay_ms.to_f / 1000
+        @logger.debug("Retrying request, #{@retries_remaining} retries left. Waiting #{delay}s")
+        delay
       end
 
       def next_rate_limit_delay(retry_after, status_code)
@@ -58,10 +67,14 @@ def next_rate_limit_delay(retry_after, status_code)
         remaining = @max_rate_limit_duration - (now - @rate_limit_start_time)
         return spent('Max rate limit duration exceeded for batch') if remaining <= 0
 
-        # Clamped to what is left of the budget as well as to the cap: the check
-        # above runs before the wait, so without this a check passing just inside
-        # the budget would sleep a full Retry-After on top and overshoot it.
-        delay = [retry_after, @rate_limit_retry_after_cap, remaining].min
+        # Capped, then required to fit. Shortening the wait to fit would send the
+        # next request inside the window the server asked us to wait out — one it
+        # has already said it will not serve — and the budget is spent by then, so
+        # it would be the last attempt either way. Giving up loses the same batch
+        # and sends one request fewer at something already rate-limiting us.
+        delay = [retry_after, @rate_limit_retry_after_cap].min
+        return spent('Retry-After does not fit the remaining rate limit budget') if delay > remaining
+
         @logger.debug("Retry-After: #{delay}s on #{status_code}. Retrying after delay.")
         delay
       end
 
@@ -19,22 +19,30 @@ def budget(retries, intervals = nil)
       end
 
       describe '#next_rate_limit_delay' do
-        it 'clamps the delay to what is left of the budget' do
-          # The elapsed check runs before the wait, so without clamping a check
-          # passing just inside the budget sleeps a full Retry-After on top and
-          # overshoots it. Positioned one second from the end of whatever the budget
-          # is, rather than at a hardcoded elapsed time, so changing the default
-          # cannot quietly move this away from the edge it is testing.
+        it 'gives up rather than retrying inside the window the server asked for' do
+          # Shortening the wait to fit would send the next request before the time
+          # the server named, and the budget is spent by then, so it would be the
+          # last attempt either way. Positioned relative to the constant so changing
+          # the default cannot move this away from the edge it is testing.
           subject = budget(10)
           subject.instance_variable_set(
             :@rate_limit_start_time,
             Process.clock_gettime(Process::CLOCK_MONOTONIC) -
               (Defaults::Request::MAX_RATE_LIMIT_DURATION - 1)
           )
 
-          delay = subject.next_rate_limit_delay(60, 429)
+          expect(subject.next_rate_limit_delay(60, 429)).to be_nil
+        end
+
+        it 'honours a wait that does fit, in full' do
+          # "Never shorten" must not become "never wait".
+          subject = budget(10)
+          subject.instance_variable_set(
+            :@rate_limit_start_time,
+            Process.clock_gettime(Process::CLOCK_MONOTONIC) - 60
+          )
 
-          expect(delay).to be <= 2
+          expect(subject.next_rate_limit_delay(60, 429)).to eq(60)
         end
 
         it 'never returns a negative delay when the budget has just run out' do
@@ -72,18 +80,17 @@ def budget(retries, intervals = nil)
                                               "returned #{delay.inspect}, which sleep would reject"
         end
 
-        it 'returns a small positive delay at the very edge of the budget' do
+        it 'gives up at the very edge of the budget rather than returning a sliver' do
+          # 0.5s left against a 60s Retry-After: the wait cannot fit, so there is
+          # nothing useful to schedule.
           subject = budget(10)
           subject.instance_variable_set(
             :@rate_limit_start_time,
             Process.clock_gettime(Process::CLOCK_MONOTONIC) -
               (Defaults::Request::MAX_RATE_LIMIT_DURATION - 0.5)
           )
 
-          delay = subject.next_rate_limit_delay(60, 429)
-
-          expect(delay).to be > 0
-          expect(delay).to be <= 0.5
+          expect(subject.next_rate_limit_delay(60, 429)).to be_nil
         end
 
         it 'clamps the delay to the Retry-After cap' do
@@ -98,6 +105,21 @@ def budget(retries, intervals = nil)
         end
       end
 
+      describe 'the shipped defaults' do
+        it 'leaves room for more than one maximal Retry-After' do
+          # At parity the rate-limit path degenerates: one capped wait spends the
+          # whole budget, so the episode ends having made a single attempt. The cap
+          # also stops binding, because whatever is left of the budget is then always
+          # the smaller of the two.
+          budget_s = Defaults::Request::MAX_RATE_LIMIT_DURATION
+          cap_s = Defaults::Request::RATE_LIMIT_RETRY_AFTER_CAP
+
+          expect(budget_s).to be > cap_s,
+                              "budget #{budget_s}s against a #{cap_s}s cap leaves no room to retry"
+          expect(budget_s / cap_s).to be >= 2
+        end
+      end
+
       describe '#next_backoff_delay' do
         it 'grants exactly as many retries as configured' do
           # N means N. Decrementing before the exhaustion check spends one retry on