Work is isolated in sentry-observability, qb-sentry-hooks, cbq-sentry-hooks, boxlang-sentry-hooks, and CommuniArts worktree 084b. No production deployment or hosted workflow dispatch was performed.
Start CommandBox on an isolated port with the module test-harness webroot and /moduleroot/sentry alias. Install ColdBox/TestBox and module dependencies with CommandBox. Start node test-harness/support/receiver.mjs (loopback 60320). Set SENTRY_CBQ_SOURCE to the owning cbq checkout to include its focused hook specs. Run tests/telemetry-runner.cfm and tests/runner.cfm?directory=&bundles=tests.specs.SentryTests,tests.specs.SentryWiringTests&reporter=json. Receiver /state contains decoded JSON items and base64 binary items, while /reset can simulate delay/status/category limits. The browser feedback.html fixture uses synthetic data only. Run npm --prefix browser test and npm --prefix browser run build. Native query smoke is separate from capability-selected automatic instrumentation.
The harness and CommuniArts server run BoxLang 1.18.0+66 (build 2026-10-02), despite CommandBox's engine target metadata saying 1.18.6+62. Java is Temurin 21.0.10+7 arm64, Runwar 6.1.8. Lucee targeted listener verification uses 6.2.8.20, Java 21.0.10 and Runwar 5.2.7. The BoxLang upstream JUnit source build includes the new event; the application runtime has not consumed that runtime build.
Transport checks exercise Unicode/real binary lengths, matching receipts, 429 category limits, unavailable ingestion, pending bounds and shutdown. Span checks cover malformed/all-zero headers, trusted parent sampling/baggage, nesting, failures, isolation, exact-origin propagation, completion once, redirect cleanup, manual/native de-duplication, zero/false/empty cached values, and Lucee listener composition. Queue tests include completion on another thread, timeout followed by late exit, synchronous observer exceptions, bulk enqueue failures, and an actual asynchronous cbq timeout. Hook JUnit tests preserve exception identity/correlation and cached event identity without introducing new DDL.
Browser tests cover screenshot privacy, unsaved values, protected pages, capture deadlines, replay races, navigation cancellation, stale object URLs, eligibility and rejected-delivery retry. A Chromium generic widget capture produced a 1426x1051 PNG (61,900 bytes): visible edited note retained, synthetic displayed password and explicit masked content absent. Decoded real SDK replay payloads also excluded those secrets. Sentry played the uploaded replay and seeking reached 00:10 in the 14-second recording. CommuniArts sign-in to password recovery navigation rendered on communiarts.localhost:60321, with initial sentry-trace metadata and no anonymous feedback eligibility.
The CommuniArts Developer plan showed 5M spans, 5GB logs, 5GB application metrics, 1GB attachments, and one Cron monitor. No trial/billing changes were made. Synthetic traffic used sentry-verification and no application/customer records.
Backend trace e8b904f3221b4924a4817a69472cebe3 was indexed with http.server, db.query, http.client, cache.get and queue.process spans. A structured log and sentry.verification.requests counter were indexed with that trace. All three envelopes received HTTP acceptance. Browser trace 55ad848cf4ce4b7e94bba8888bafe4d3 included document LCP 68ms, FCP 68ms, and TTFB 13.3ms. Replay 787f30f633f44fd9b75a0f7269542f4f was indexed under sentry-verification, played, and sought. Synthetic browser feedback received matching ingestion acceptance and is visible as COMMUNIARTS-FRONTEND-C in Spam. Its provider PNG preserves the unsaved synthetic note and masks the displayed password; the feedback links to the replay above. Cross-project trace 0167f55b73064debb5e26914c5f74c67 connects frontend http.client 8c13e6b93b3d8fc1 to backend http.server 5ce5ba73ca5b49eb.
Focused success does not establish deployment readiness. Full hosted CI, browser matrices, Adobe CF/older Lucee compatibility, comprehensive queue retry/release/chain/batch/provider matrices, profiling and production traffic remain deferred. Native BoxLang caught direct-query errors require the proposed runtime release; qb hooks and withQuerySpan cover the current application. Browser SDK support determines which vitals are emitted: INP needs qualifying interactions and CLS needs layout shifts; absence of those in a static synthetic page is not failure.
The existing Sentry-built Queries, Queues, and Caches dashboards recognize the synthetic spans. Queries groups SQL as SELECT %s and shows duration/throughput. Queues shows destination synthetic, processing count and 1ms average wait. Caches shows the verification transaction, hit/miss ratio and throughput. These are actual dashboard rows, separate from HTTP acceptance and Explore indexing. No dashboard definitions, billing, trial, or feedback classifications were changed. A fresh backend trace cf17d77abbe443a385a38a2364c8c2f9 received three accepted envelopes and was indexed with all five operation types.
Aligned the decorator's hashed cache.key with Sentry's array convention; only this bounded scalar array is permitted through the span filter. Logs/metrics continue to use scalar typed attributes, and bindings, results and arbitrary arrays remain excluded. Queue retries use messaging.message.retry.count, and publish spans include the assigned message ID. Cache value size remains omitted rather than inspecting or serializing values. The focused telemetry suites pass 17/17 and existing error/API wiring passes 27/27 on BoxLang 1.18.0+66. This follow-up did not remap the optional three cbq harness specs; their earlier results remain the earlier evidence.
CommuniArts consumes published qb 14.1.0 and cbq 7.0.2. Its rollback-scoped request spec also verifies a caught direct PostgreSQL failure through withQuerySpan, alongside qb success/failure and wrapper de-duplication: four completed spans, correct failure statuses and restored parent scope. It passes 1/1 on the current runtime, without installing the unmerged BoxLang PR.
A temporary synthetic account signed in through the normal CommuniArts login, qualified through the existing selected-user feature flag, and captured an unsaved organization form. No organization was created. The local receiver accepted matching feedback event 08673e8bf20e4e12a199bd7433d11717 with a 1426x1051, 119,281-byte PNG and replay ad8a1c68fa9041b2a29c830838f7b036. Decoded real SDK replay data retained ordinary form content and excluded the fixture password and feedback dialog message.
The separate real-provider build produced feedback COMMUNIARTS-FRONTEND-D with event 0d2099487b3f4671b590f5f1a28d86f9, PNG attachment 24796233267 (121,012 bytes, 1426x1051), replay 471eb33a7047486e8f85b21b80f70393 and trace 09d9f62ef0464848a08e6899dfda9b45. The downloaded provider PNG preserves both unsaved form values. Sentry replay playback and seeking to 00:55 work. The report is not spam; Sentry's generated title describes a failure, but the original message explicitly states this is synthetic and no organization was created. Document-load metrics include LCP 1392ms, FCP 1228ms, TTFB 578ms and CLS 0.0442. Nine focused CommuniArts Vitest files pass 67/67; the targeted build passes at 518.6 KiB initial gzip. The fixture account, feature selection and temporary verification endpoint were removed; the subsequent guest page has no feedback trigger.
A separate keyboard-input replay 6daa9882747e417c8ed48fc59ecf133f retains the unsaved organization name and subdomain at its final 00:53 frame. Opening feedback uploaded that replay without submitting another message or screenshot. Playback seeking was checked through Sentry's visible replay controls.
The full CommuniArts Vitest sweep also exposed existing pageMetadata registry and kiosk CheckIn sharing-payload mismatches in untouched files. Focused observability/feedback specs are the acceptance proof for this change; do not present them as a complete JavaScript-suite pass.
Native Lucee 6.2.8.20 PostgreSQL verification passed success, caught failure, composed SQL transformation, cached result metadata, and manual/native de-duplication (six spans). Without a caller-supplied result option, Lucee supplies only executionTime, so cache status is unknown rather than incorrectly reported as a database round trip. This Lucee runtime bypassed global listeners for query-of-queries; use the manual wrapper for that coverage.
Earlier focused results: module telemetry and cbq hook specs 20/20; existing module API/wiring 27/27; browser companion 28/28; CommuniArts backend integration and unit specs 26/26; CommuniArts focused feedback/tracing Vitest 70/70. The complete CommuniArts Vitest run passed 803 and failed the two pre-existing contracts noted above. That application build passed its initial JavaScript gzip budget at 518.3 KiB.
Queue regression checks also verify worker-start timestamps, wait time excluding processing, retry counts, cancellation after worker exit, and persisted chain propagation after callback scope cleanup. The package build produced a source ZIP including browser source/package metadata and bundled assets, excluding node_modules and installed modules. Cleanup was verified against an external symlink sentinel.
Native BoxLang/CFML captureFeedback with the captured 61,900-byte PNG received HTTP 200 for event 14625ba2371241fbb0f651fcfe3e80e2. Sentry indexed attachment 24792376268 as sentry-verification.png, image/png, 61,900 bytes; this confirms binary attachment recognition independently of the HTTP receipt. Browser feedback visibility and replay playback were verified in the frontend project; the native feedback entry itself was not inspected in the backend feedback UI.
Standalone browser spans also use beforeSendSpan sanitization, including clients supplied by consumers. This removes interaction selectors and unapproved attributes even when the SDK sends a span outside a transaction envelope.
An untargeted qb harness run also passed 3,356 specs, failed one timestamp/default-value expectation (UTC versus local time), and errored on 28 specs using unavailable evaluate/isBoxLang/URL encoding helpers or toStartWith matchers in this harness. These broader compatibility checks are not qualified; the explicitly selected failure-hook specs passed 2/2. No complete qb-suite pass is claimed.
Standalone Web Vitals retain numeric measurements, safe pageload linkage, and the browser-provided user agent needed for scoring; element selectors, media URLs, and arbitrary custom attributes remain excluded.
The failing head 39865b9 had three infrastructure problems: the workflow did not start the local envelope receiver, the root harness referenced the sentry mapping before creating it, and the tests application called a BoxLang-only environment BIF on CFML engines. The workflow now starts and checks the receiver, retains its log as an artifact, and probes a non-throwing health template with HTTP failure detection. Environment lookup uses Java System.getenv. Formatting uses CommandBox CFFormat 0.21.0 in both local and CI checks, with no automatic formatting commits.
The local engine runs also exposed module compatibility issues. Adobe rejects local declarations that reuse argument names and direct indexing of a struct literal. Lucee rejects slicing an empty pending array and returns false for every() on an empty array. Transport now handles an empty flush explicitly. Adobe on Java 21 cannot reflect on non-exported JDK HTTP implementation classes; JavaHttp invokes methods declared on exported HTTP/Future interfaces instead. This requires no extra JVM access flags or consumer JAR. The public-interface approach follows the Java Method invocation contract.
Queue cleanup iterates a Java key array rather than relying on engine-specific entrySet iteration. Metadata lookup guards missing keys explicitly. Observer catches increment a thread-safe diagnostic count exposed by getObservationFailureCount(), without exporting exception contents or invoking telemetry recursively. Regression specs assert zero observer failures during timeout/retry and chained publication. The cross-thread fixture holds the original observer in a Java AtomicReference because Adobe copies CFML thread arguments. The query-listener fixture uses an actual caught exception rather than an artificial exception struct.
With ColdBox 7.5.2+27 and TestBox 3.2.0, the default harness passes 45/45 on BoxLang 1.18.0+66, Lucee 6.2.8.20, and Adobe CF 2023 update 25 (2023,0,25,330977), using Java 21.0.10+7. Checks include real Unicode/binary transport, delivery receipts, rejection, rate limits, unavailable ingestion, bounded waits, empty shutdown, and queue scope/completion regressions. The legacy TestBox reporter identifies BoxLang as Lucee 6.0.0; the actual BoxLang version above comes from the runtime startup log.
ColdBox 6.11.0+20 also passes 45/45 on Lucee 6.2.8.20. Runtime version was checked through the active controller rather than inferred from dependency files. Repeating CFFormat produces no tracked changes; a deliberately unformatted directory fixture is rejected with exit code 1.
The fresh local Adobe engine needed the zip and debugger packages already configured by CI, plus Commons IO 2.4 copied from an installed Adobe distribution into this isolated engine to restore CF file operations. That engine adjustment is separate from the module source; this local Adobe result does not qualify a pristine runtime artifact. The additional Adobe/ColdBox 6 run remained unqualified: after a framework-switch restart, the local engine lost its hot-installed package state and failed during compiler bootstrap, before module tests. Its cached earlier run was excluded after checking the active controller version. Full hosted matrix results remain separate until the repaired commit runs. CommuniArts, browser assets, provider state, and production deployment were not changed by this repair.
The first repaired CI head a721025 passed formatting and the BoxLang, Lucee 6, Adobe 2018, and Adobe 2021 jobs. It exposed Lucee 5's compiler failure for a catch nested inside a finally block, plus Adobe 2023's missing Commons IO when a synthetic Windows path triggered its virtual filesystem. Span wrappers now call a separate best-effort completion helper, retain original callback results/exceptions and scope restoration, and count completion failures. Source context accepts local files via java.io.File and skips source/function parsing for missing files; it does not load a CF virtual filesystem for foreign trace paths. Existing Windows-path coverage asserts empty source context, and the function-name fixture uses a real readable template and checks its source lines. The added completion-failure regression raises the default suite to 46 specs. Local Lucee 5.4.8.2 and Adobe 2023 update 25 pass 46/46 with ColdBox 7.5.2. The health probe retains an error response body when failing to improve startup diagnostics.