Problem: the tracking script sends JS errors to the public /collect (no auth); the gated POST /errors/collect exists but is never called, and the generated API key is never sent (audit: src/Analytics.ts ~3200-3263, src/router.ts:118-127, src/handlers/collect.ts ~518-543).
Scope: the error SDK posts to the gated endpoint with the project DSN/key (header or DSN), and the e:'error' branch of public /collect is removed or also requires the key.
Done when: errors only ingest with a valid project key.