Every request produces a nested span tree: tRPC procedure → controller → use case → repository → Payload op. Errors are captured at the throw site closest to the cause, never at the boundary that translates them.
+HTTP transaction (auto, @sentry/nextjs)
+└── tRPC procedure span (auto, sentry trpc integration)
+ └── controller span (op="controller", DI-wrapped)
+ └── use-case span (op="use-case", DI-wrapped)
+ └── repository span (op="repository", explicit startSpan)
+ └── Payload Local API call (auto, @sentry/node http)captureException fires)| Layer | Captures | Doesn't capture |
|---|---|---|
| Repository | +Infra / Payload errors that originate here | +Bubbled errors | +
| Use case | +Business-rule violations originated in this body | +Errors from repos (already captured) | +
| Controller | +InputParseError from safeParse failure |
+ Anything else | +
defineErrorMiddleware |
+ Nothing — maps domain → TRPCError only | +— | +
Every error captured by SentryLogger.captureException gets a non-enumerable __sentryReported = true property. A second capture call for the same error returns early. This means each error surfaces in Sentry exactly once, regardless of how many layers it passes through.
sendDefaultPii: false — every Sentry.init(). CI grep gate.beforeSend scrubber strips email / password / token / cookie / authorization / ipaddress keys (substring match).beforeSendTransaction scrubber strips PII query params from URLs.setUser accepts only { id }. Stripping wrapper warns in dev when other keys passed.[redacted-ip].Plan 10 added two new symbols to the per-feature container — TRACER and LOGGER — bound by a separate Rule 0 in bindAll() that's orthogonal to the repo binding mode. The DSN env var decides Sentry vs Noop; USE_DEV_SEED / NODE_ENV decide real vs mock repos.
INSTRUMENTATION_SYMBOLS.TRACERBound by either bindNoopInstrumentation or bindSentryInstrumentation to NoopTracer or SentryTracer. Decided by Rule 0: DSN env present → Sentry; otherwise Noop.
INSTRUMENTATION_SYMBOLS.LOGGERSame rule, same lifecycle. NoopLogger in the absence of a DSN; SentryLogger when DSN is set. The Sentry adapter applies the __sentryReported double-report guard internally — call sites don't manage the flag.
bindAll()
+ └─ resolveInstrumentation() ← Rule 0 (DSN check)
+ └─ Noop or Sentry binders ← bind to sharedContainer
+ └─ bindProductionX(config, tracer, logger)
+ └─ feature container also binds TRACER + LOGGER
+ └─ withSpan(tracer, ...) at every use case + controllerWhy per-feature containers also get the binding: repository classes resolve TRACER/LOGGER through the container; controllers and use cases receive instrumentation via the bind-time wrapper instead.
+