#6087 fix(sentry): zero unused tracing, filter third-party noise, fix five error sources

Sentry quota + noise overhaul. Current usage: Spans 80M/5M ($300/mo overage) on performance traces nobody consumes, and Errors pegged at 50K/50K — the cap is why real issues get dropped at the gate.

Quota

• Per-route trace sampling replacing the flat 10%. The api app ingested ~800M spans/30d, 87% of it GET /api/auth/[...all] (session/JWT polling from every client) — diagnostic-free traffic that alone blew the span quota 16x ($300/mo overage). New shape: api uses a tracesSampler (auth routes 0, webhooks/jobs 25%, rest 5%), web/admin 5%, marketing/docs 1%, desktop/relay/host-service 0 (fleet clients and a byte proxy — errors matter there, traces don't). Estimated ~10–20M spans/mo of deliberately useful traces (error-linked traces, webhook/job debugging) instead of 800M accidental ones.
• The error-cap pressure is separately fixed by #6080 (relay tunnel noise was 66k of the 50k+ monthly error budget).

Structural noise prevention (browser apps)

• thirdPartyErrorFilterIntegration + applicationKey in web/marketing/docs/admin: build-tags our bundles and drops events whose stacks contain zero first-party frames — extension/wallet-injected errors (MetaMask, keplr, TronLink, Talisman, onMessage, sseError, …) stop ingesting, including from wallets that don't exist yet. Policy: errors from our code get fixed, never filtered.
• Small shared @superset/shared/sentry: ignoreErrors (ResizeObserver browser noise, user-initiated AbortError — fixes WEB-1M) + denyUrls (extension origins, productfruits). Also applied to the desktop renderer.

Error-source fixes

• Fixes WEB-2K: script-src now includes 'wasm-unsafe-eval' (wasm-only, NOT eval) — WASM instantiation on /oauth/consent was CSP-blocked for real users.
• Fixes API-1E: Slack assistant replies to read-only/archived/unjoined channels can never be delivered; the job now drops the event instead of 500ing (which made Slack redeliver it forever).
• Fixes API-11: one unmappable Linear workflow state no longer aborts the entire initial sync — the issue is skipped with a warning, matching the webhook path's policy (SUPER-237).
• Fixes MARKETING-1R / Fixes MARKETING-1Q: the blog/changelog OG-image handlers fetched the Inter font at module scope with no rejection handler — any transient failure became an unhandled rejection (724 events / 400+ users since Feb). Now a lazy cached loader that surfaces failures as handled route errors and self-heals on the next request.

Verification

Typecheck clean across api/web/marketing/docs/admin/desktop; Biome lint exits 0.

Notes

• WEB-1W (WebGL context loss in MeshGradient) deliberately deferred — it touches the same file as #6080; will follow after that merges.
• Server-side transient families (Neon fetch-failed, Linear upstream 5xx) are being archived until-escalating in Sentry rather than coded around: provider retries + idempotent inserts already self-heal them, and blanket DB retries risk duplicate writes.

https://claude.ai/code/session_01BQ71xVEeJRhAqiU4Dfc5Fs

---

Summary by cubic

Shifted Sentry to targeted tracing with per‑route sampling, added third‑party error filtering, and fixed noisy error sources. Cuts ~$300/mo in overage and frees error quota for real issues.

• New Features

  • Per-route trace sampling in api: 0 for /api/auth/*, 0.25 for webhooks/jobs, 0.05 default.
  • Low trace rates elsewhere: web/admin 0.05, docs/marketing 0.01, desktop 0.
  • Enabled thirdPartyErrorFilterIntegration with app keys (superset-web, superset-marketing, superset-docs, superset-admin) to drop events with only third‑party frames.
  • Added @superset/shared/sentry with SENTRY_IGNORE_ERRORS and SENTRY_DENY_URLS; applied to browser apps and desktop renderer.

• Bug Fixes

  • WEB-2K: Added 'wasm-unsafe-eval' to script-src so WASM can run on /oauth/consent.
  • Slack: Drop undeliverable replies to read‑only/archived/unjoined channels instead of 500s and retries.
  • Linear initial sync: Skip issues with unmappable states instead of aborting the sync (aligns with SUPER-237).
  • Marketing OG images: Lazy, cached Inter font loader, inlined per route, to avoid module‑scope unhandled rejections and self‑heal on next request.

Summary by CodeRabbit

• Bug Fixes

  • Linear initial synchronization now skips issues with unmapped statuses instead of aborting the entire sync.
  • Slack assistant messages targeting unavailable channels are marked undeliverable without repeated retries.
  • Marketing and changelog social preview images retry font loading after temporary failures.

• Improvements

  • Web content security settings now support WebAssembly features.
  • Error monitoring is more consistent across web, admin, documentation, marketing, API, and desktop apps, with improved filtering and targeted performance sampling.