fix(core): [Callback Errors 8] Report dropped profiles - #6166

* collection: callback error handling

* fix(core): [Callback Errors 1] Report callback failures

Add the callback_error discard reason and use it when a beforeSend callback throws. Preserve before_send for callbacks that intentionally return null and retain item, span, and byte accounting.

Refs #6081
Co-Authored-By: Claude <noreply@anthropic.com>

* fix(core): [Callback Errors 2] Drop failed processor data

Stop processing and drop telemetry when an event processor throws. Record callback_error outcomes for every supported category instead of sending potentially partially processed data.

Refs #6081
Co-Authored-By: Claude <noreply@anthropic.com>

* fix(core): [Callback Errors 3] Drop failed breadcrumbs

Drop breadcrumbs when beforeBreadcrumb throws instead of storing the breadcrumb with exception details. Keep observer state unchanged and release the callback reentrancy guard for later additions.

Refs #6081
Co-Authored-By: Claude <noreply@anthropic.com>

* ref(core): [Callback Errors 2] Mark SDK-owned event processors

Add an internal marker to SDK event processors across core and integrations.
Keep customer processors and the backfilling marker independent so later
callback handling can distinguish ownership regardless of registration path.

Leave exception handling unchanged in this preparatory change.

Refs #6081
Co-Authored-By: Claude <noreply@anthropic.com>

* fix(core): [Callback Errors 3] Preserve SDK processor data

Use the internal processor marker to continue processing after SDK-owned
processor failures without recording callback_error losses. Keep customer
processor failures fail-closed across events, transactions, replays,
feedback, logs, and metrics.

Cover scope and options registration, continued callbacks and delivery,
logging without discard notifications, intentional drops, and span loss
accounting. Clarify the customer-only failure policy in the changelog.

Refs #6081
Co-Authored-By: Claude <noreply@anthropic.com>

* fix(core): [Callback Errors 5] Handle tracesSampler failures

Inherit the parent sampling decision when tracesSampler throws. Without a
parent decision, leave the trace unsampled instead of applying the static
tracesSampleRate, which can override the failed sampling policy.

Keep normal null-result fallback, profiling callbacks, and catch types
unchanged. Cover parent inheritance, backfilling, and static-rate bypass.

Refs #6081

Co-Authored-By: Claude <noreply@anthropic.com>

* changelog

Link the tracesSampler failure fallback entry to #6163 in the callback
error handling stack.

* fix(core): [Callback Errors 6] Handle profilesSampler failures

Disable profiling when profilesSampler throws instead of applying the
static profilesSampleRate or inheriting a parent profiling decision.
Preserve trace sampling metadata and normal null-result fallback.

Cover static-rate bypass, parent inheritance, and failures in both
samplers without changing existing catch types.

Refs #6081

Co-Authored-By: Claude <noreply@anthropic.com>

* changelog

Link the profilesSampler failure handling entry to #6164 in the callback
error handling stack.

* fix(core): [Callback Errors 7] Handle replay sampling failures

Skip replay capture when beforeErrorSampling throws instead of capturing
replay after a failed user filter. Continue sending the error event and
retain existing exception logging and catch types.

Cover handled errors, crashes, and successful replay capture after a
previous callback failure. Verify error delivery and failure logging.

Refs #6081
Co-Authored-By: Claude <noreply@anthropic.com>

* changelog

Link the beforeErrorSampling failure entry to PR #6165.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(core): [Callback Errors 8] Report dropped profiles

Record callback_error/profile when beforeSendTransaction or a customer
transaction processor throws and an attached profile is dropped. Notify
OnDiscardCallback through the same client-report accounting path.

Cover scope and options processors, absent profiles, and SDK processor
failures that retain profiles. Leave catch types, intentional drops,
and profile-file cleanup unchanged.

Refs #6081
Co-Authored-By: Claude <noreply@anthropic.com>

* changelog

Link the transaction profile loss accounting entry to PR #6166.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(integrations): [Callback Errors 9] Guard custom callbacks

Skip Android screenshot and view hierarchy capture when their callbacks
throw, while retaining the error event. Drop spans on beforeSpan failures
in OkHttp, OpenFeign, GraphQL, Ktor, and Apollo without disrupting requests
or replacing the original request error.

Preserve normal callback results and existing catch types. Finish failed
spans and retain request cleanup and breadcrumbs.

Add regression coverage for callback failures, partial mutations, original
request errors, asynchronous GraphQL results, and subsequent Android
captures. Correct callback wiring in the Ktor and screenshot test fixtures.

Verify 18 regression cases fail before the fix and pass afterward; all 454
tests in the affected suites pass, along with formatting and API checks.

Refs #6081

Co-Authored-By: Claude <noreply@anthropic.com>

* changelog

Link the Android capture and integration beforeSpan callback fixes to
Callback Errors 9 (#6167).

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(core): Drop transactions when tracesSampler fails

Replace parent-decision fallback after tracesSampler errors with an
unsampled decision and callback_error reports for the transaction and
root span. Preserve deliberate null-result fallback and existing catches.

Report callback errors directly in the sampler and retain existing
sample_rate and backpressure accounting, accepting duplicate loss reports
instead of adding discard-reason propagation. Cover core and OpenTelemetry
paths with regression tests and update the changelog.

Refs #6163
Co-Authored-By: Claude <noreply@anthropic.com>

* fix(integrations): Report beforeSpan callback losses

Record callback_error/span when a throwing beforeSpan callback drops a
sampled span in OkHttp, OpenFeign, GraphQL, Ktor, and Apollo. Use the
pre-callback sampling decision so partial callback mutations do not hide
losses, and leave unsampled spans and intentional null drops uncounted.

Add regression coverage for discard notifications, sampling states, and
intentional drops while preserving request and span completion behavior.

Refs #6167
Co-Authored-By: Claude <noreply@anthropic.com>

* docs(core): Document SDK backfilling processor marker

Clarify that SDK-owned backfilling processors must also use the Sentry
processor marker so callback error handling can identify their ownership.

Refs #6081
Co-Authored-By: Claude <noreply@anthropic.com>

* fix: Report profiles dropped with transactions

Record attached profiles as lost when transaction event processors or
beforeSendTransaction intentionally discard the transaction. Keep client
reports and discard callbacks aligned with dropped profile payloads.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(core): Report replay sampling callback errors

Record callback_error/replay when beforeErrorSampling throws while the replay
controller has an active replay ID. Do not report a loss when no replay is active.

Refs GH-6081
Co-Authored-By: Claude <noreply@anthropic.com>

* fix(apollo5): Handle beforeSpan callback failures

Drop spans when the Apollo 5 beforeSpan callback throws while preserving the GraphQL response. Report sampled spans as callback errors so client reports and discard callbacks remain accurate.

Co-Authored-By: Claude <noreply@anthropic.com>

* changelog

* fix(android): Handle feedback configurator failures

Keep the feedback form usable when an options configuration callback throws. Apply callback changes transactionally so partially mutated feedback options are discarded.

Co-Authored-By: Claude <noreply@anthropic.com>

* changelog

* fix(spring): Handle user provider failures

Keep requests running when a Spring user provider throws. Continue invoking later providers, but discard all provider-derived identity and install an empty user so inherited identity cannot leak into the event.

Co-Authored-By: Claude <noreply@anthropic.com>

* changelog

* fix(spring): Handle transaction name provider failures

Keep Spring requests and event capture running when a transaction name provider
throws. Use an unlabeled custom transaction as the privacy-safe fallback and
continue to later providers when resolving combined names.

Apply the same behavior across the Spring, Spring Jakarta, and Spring 7
integrations.

Co-Authored-By: Claude <noreply@anthropic.com>

* changelog

* test(apollo): Fix callback test lint violations

Use Kotlin's error helper in callback failure tests so Detekt accepts the
intentional IllegalStateException across Apollo 2, 3, and 4.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(spring): Include user provider name in error log

Identify which SentryUserProvider failed when multiple providers are configured, making callback failures actionable across all Spring variants.

Refs GH-6240
Co-Authored-By: Claude <noreply@anthropic.com>

* test(android): Verify configurator runs after configuration failure

Ensure a failed legacy configuration does not prevent the configurator
from receiving the original feedback options and applying its changes.

Co-Authored-By: Claude <noreply@anthropic.com>

* test(android): Verify configurator propagates fatal errors

Ensure fatal errors from the feedback options configurator are rethrown
instead of being handled as recoverable callback failures.

Co-Authored-By: Claude <noreply@anthropic.com>

* docs(changelog): Consolidate callback error fixes

Move the callback error handling entry back to Unreleased and group the related changes by impact so the full behavior change is documented in one place.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(callbacks): Handle nonfatal callback throwables

Catch nonfatal Throwable failures from newly guarded customer callbacks while continuing to propagate fatal JVM errors. This keeps callback isolation consistent without introducing new fatal-error swallowing.

Add regression coverage for nonfatal fallback behavior and fatal error propagation across the affected integrations.

Refs #6081

Co-Authored-By: Claude <noreply@anthropic.com>

* changelog

* fix(callbacks): Preserve Apollo 2 error handling

Keep Apollo 2's existing Exception boundary unchanged so non-Exception errors retain their released behavior. Limit the broader nonfatal Throwable handling to callback guards introduced by the unreleased stack.

Refs #6081

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>