What Does This Do

When APM tracing is disabled (DD_APM_TRACING_ENABLED=false, i.e. standalone ASM), this stamps the _dd.apm.enabled:0 billing marker on the root-most span(s) of every exported trace chunk at export time (CoreTracer.write), instead of setting it once on the local root span at creation (Config.getLocalRootSpanTags()).

For each exported chunk:

• Fast path — if the trace's local root (the service-entry span) is part of the chunk, the marker is stamped on it directly (the common case, matching the previous behavior).
• Fallback — for a chunk flushed without its local root (a partial flush, or an orphaned subtree), the marker is stamped on every span whose parent is absent from the chunk, i.e. the span(s) that top the chunk.

This deliberately does not rely on span ordering: the local root is not necessarily the first span in finish order for asynchronous frameworks.

Motivation

Standalone ASM customers rely on _dd.apm.enabled:0 to opt out of APM host billing: the intake bills a trace chunk unless at least one of its spans carries the marker.

Previously the marker lived only on the trace's local root span, on the assumption that the local root is present in every exported chunk. That assumption breaks in two ways:

• A child span outlives its local root — the root flushes in one chunk (marked), while the long-lived child (e.g. a delayed outbound http.request) flushes later, alone, in a separate chunk with no marker.
• An HTTP client call creates an inferred, in-process service-entry span for a different service that never received the tag (see APPSEC-69334).

In both cases the intake charges APM host billing for an ASM-only service. Making the decision at chunk-export time — the one place that unambiguously knows chunk boundaries — guarantees every exported chunk carries the marker. This mirrors the equivalent Node.js fix (dd-trace-js#9483).

Additional Notes

The marker is now stamped after the sampling decision and only when APM tracing is disabled, so there is no effect on the default (APM-enabled) hot path. The fallback's array allocation and sort run only in the cold path (APM disabled + a multi-span chunk exported without its local root).

Covered at two levels:

• ApmTracingDisabledChunkMarkerTest (dd-trace-core) — a deterministic unit reproduction of the split-chunk case, a positive single-chunk control that isolates chunk-splitting as the cause, and a case where the local root is not first in finish order (guarding against marking merely chunk.get(0)).
• A new /late-outbound endpoint and smoke test in the apm-tracing-disabled module that exercises a real delayed outbound child flushed alone in its own chunk.

Contributor Checklist

• Format the title according to the contribution guidelines
• Assign the type: and (comp: or inst:) labels in addition to any other useful labels
• Avoid using close, fix, or any linking keywords when referencing an issue
• Update the CODEOWNERS file on source file addition, migration, or deletion — n/a (no ownership change)
• Update public documentation with any new configuration flags or behaviors — n/a (no new config)

Jira ticket: APPSEC-69334