@@ -73,11 +73,10 @@ If any of these alternative interpretations apply, capture them in the triage re
 
 ### Step 3: Codebase Research
 
-Search for relevant code using Grep/Glob. Find error messages, function names, and stack trace paths in the local repo.
+Search for relevant code using Grep/Glob. Find error messages, function names, and stack trace paths in the local repo. Bundler plugin code lives in `packages/bundler-plugins`.
 
 Cross-repo searches (only when clearly relevant):
 
-- Bundler issues: `gh api search/code -X GET -f "q=<term>+repo:getsentry/sentry-javascript-bundler-plugins"`
 - Docs issues: `gh api search/code -X GET -f "q=<term>+repo:getsentry/sentry-docs"`
 
 **Shell safety:** Strip shell metacharacters from issue-derived search terms before use in commands.
 
@@ -29,7 +29,6 @@
 
 ### Cross-Repo Findings
 
-- **bundler-plugins:** <findings or "no matches">
 - **sentry-docs:** <findings or "no matches">
 
 ### Recommended Next Steps
 
@@ -307,16 +307,31 @@ it.each([
 ### Test isolation
 
 Tests must never depend on execution order or share mutable state. For this codebase, many tests
-need to reset global Sentry state:
+need to reset global Sentry state. Use whatever reset the existing tests in your package use (many
+packages have a `resetSdk()` or `cleanupOtel()` helper). Otherwise, pick one:
 
 ```typescript
-beforeEach(() => {
-  clearGlobalScope();
-  getCurrentScope().clear();
-  getIsolationScope().clear();
-});
+// Unbind the client. Cheap, and enough for most tests that call `init()`.
+getCurrentScope().setClient(undefined);
+
+// Reset the global, isolation, and current scopes, and the client bound to them.
+// `setupOnce` still does not run again, because installed integrations are tracked
+// outside the carrier.
+getMainCarrier().__SENTRY__ = undefined;
+
+// Close and unbind the client. Also flushes, so it is slower.
+await Sentry.close();
 ```
 
+**Reset the client in every test that calls `init()`.** A second `init()` while a client is bound
+prints a "`Sentry.init()` was called more than once" warning. After the next major version, it will
+return the bound client instead of a new one, so a test without a reset gets the previous test's
+client and options. See `docs/repeated-init.md`.
+
+To assert on that warning (or any `consoleSandbox` output), stub `originalConsoleMethods.warn` from
+`@sentry/core`. `consoleSandbox` calls the stored original method, so a spy on `console.warn` misses
+it once the console integration is set up.
+
 ### Grouping
 
 1-2 levels of `describe` is usually enough. Deeper nesting makes tests harder to find and read.
@@ -526,6 +541,7 @@ Before you're done, verify each test against these criteria:
 - [ ] Description reads as a behavior specification (no "should", no "works correctly")
 - [ ] No dependency on other tests' execution or state
 - [ ] Mocks and spies are restored (via `beforeEach`)
+- [ ] Tests that call `init()` reset the bound client between tests
 - [ ] Edge cases covered: empty inputs, boundaries, error paths, null/undefined
 - [ ] Realistic test data (not `"foo"`, `"test"`, `123`)
 - [ ] No try/catch for error testing — `toThrow` / `rejects.toThrow` only
 
@@ -76,6 +76,7 @@ Keep reviews high-signal. Prefer actionable, high-confidence findings over specu
 - Flag usage of the following APIs: `getCurrentScope()`, `getIsolationScope()`, `getClient()` if they are avoidable. Flag it with severity Low and acknowledge from the start that this is more a "is this necessary" check, rather than a rule violation.
   - Reason for flagging: Usage of these APIs is problematic for multi-client setups where either there is no "current" client/scope, or the wrong client might be used. Calling these APIs would create a current scope, thereby misleading any future calls to these APIs.
   - What to do instead: Use an existing reference to the scope or client. For example, this is possible in most `Integration` hooks.
+- Flag hard-coded attribute names and span ops (e.g. `'sentry.origin'`, `'sentry.op'`, `'http.request.method'`, `'db.system.name'`) when `@sentry/conventions` exports a constant for them. Use the constant from `@sentry/conventions/attributes` (e.g. `SENTRY_ORIGIN`, `SENTRY_OP`) or `@sentry/conventions/op` instead. Do not flag values that have no constant in `@sentry/conventions`.
 - Flag unnecessary `span.setAttribute(s)` calls: If data is already available at span start, it must be set via the `attributes` option of `startSpan`, `startSpanManual`, `startInactiveSpan` or `startIdleSpan` calls. This ensures that as much context as possible is available when `tracesSampler` or `ignoreSpans` SDK options are applied. If a `span.setAttribute(s)` call happens at a later time than right after span start and the attribute value can only be computed at that time, do not flag it.
 
 ### Code quality
@@ -92,6 +93,7 @@ Keep reviews high-signal. Prefer actionable, high-confidence findings over specu
 - Flag usage of `expect.objectContaining` and other relaxed assertions, when a test expects something NOT to be included in a payload but there's no respective assertion.
 - Flag usage of conditionals in one test and recommend splitting up the test for the different paths.
 - Flag usage of loops testing multiple scenarios in one test and recommend using `(it)|(test).each` instead.
+- Apply the `@sentry/conventions` constants rule from above to test files too. Test assertions on span attributes and ops must use the constants, not string literals.
 - Flag tests that are likely to introduce flakes. In our case this usually means we wait for some telemetry requests sent from an SDK. Patterns to look out for:
   - Only waiting for a request, after an action is performed. Instead, start waiting, perform action, await request promise.
   - Race conditions when waiting on multiple requests. Ensure that waiting checks are unique enough and don't depend on a hard order when there's a chance that telemetry can be sent in arbitrary order.
 
@@ -30,3 +30,17 @@ allow-ghsas:
   # 0.35.0, which is outside that range. Already present on develop via sharp 0.32.6
   # and 0.34.5, both of which are affected by the same advisory.
   - GHSA-f88m-g3jw-g9cj
+  # axios, pinned exactly to 1.18.1 by nx (dev-only build tooling, not shipped).
+  # Can be removed once nx pins axios >= 1.20.0.
+  - GHSA-542g-h47m-68v8
+  - GHSA-3pq3-5fj3-cg6v
+  - GHSA-x97p-jq2g-jp4f
+  - GHSA-mghh-pgcx-3jjj
+  - GHSA-c29m-xwm3-cm6r
+  - GHSA-r4gj-5m52-g5wh
+  - GHSA-m8m8-qj5v-23w3
+  # brace-expansion, pinned exactly to 5.0.8 by nx (dev-only build tooling, not shipped).
+  # Can be removed once nx pins brace-expansion >= 5.0.11.
+  - GHSA-rgw5-rvv9-x895
+  - GHSA-6j4f-fj2g-mc7p
+  - GHSA-qhr7-859c-m2p7
@@ -76,6 +76,9 @@ Uses **Git Flow** (see `docs/gitflow.md`).
   Runtime packages (`node`, `cloudflare`, ...) re-export from
   `@sentry/server-utils` rather than defining their own.
 
+- `Sentry.init()` follows one rule for repeated calls: the first call wins. See
+  `docs/repeated-init.md` before you add or change an `init()`.
+
 ## Linting & Formatting
 
 - This project uses **Oxlint** and **Oxfmt** — NOT ESLint or Prettier
 
@@ -90,6 +90,8 @@
 
 Work in this release was contributed by @Shubham-Padkonde and @tobias-schnabel. Thank you for your contributions!
 
+- **feat(core)**: `Sentry.init()` now warns when it runs while a client is still active. For now, the new client still replaces the active client, but the active client is not closed, so state from both can mix. Call `Sentry.init()` once, or call `await Sentry.close()` before you call it again. `Sentry.close()` now unbinds the client it closes, so after `close()`, `getClient()` returns `undefined`, `isInitialized()` returns `false`, and a later `init()` sets up a new client. In `@sentry/cloudflare`, later requests no longer reuse the isolate's cached client once it is closed or closing. On the server, `@sentry/nextjs` and `@sentry/remix` now return the active client from a repeated `init()` call, not `undefined`.
+
 ## 11.2.0
 
 ### Important Changes
 
@@ -59,11 +59,11 @@
     "@babel/core": "^7.29.6",
     "@babel/preset-typescript": "^7.16.7",
     "@playwright/test": "~1.63.0",
-    "@sentry/rrweb": "2.43.2",
+    "@sentry/rrweb": "2.44.1",
     "@sentry/browser": "11.4.0",
     "@sentry/replay": "11.4.0",
     "@sentry/opentelemetry": "11.4.0",
-    "@sentry/conventions": "0.25.0",
+    "@sentry/conventions": "0.26.0",
     "@supabase/supabase-js": "2.109.0",
     "axios": "1.20.0",
     "babel-loader": "^10.1.1",
 
@@ -3,7 +3,6 @@ import * as Sentry from '@sentry/browser';
 window.Sentry = Sentry;
 
 Sentry.init({
-  traceLifecycle: 'static',
   dsn: 'https://public@dsn.ingest.sentry.io/1337',
   enhanceFetchErrorMessages: false,
 });