diff --git a/.agents/skills/apm-integrations/references/orchestrion.md b/.agents/skills/apm-integrations/references/orchestrion.md
index 092303d1cb..0ce4b8e2cd 100644
--- a/.agents/skills/apm-integrations/references/orchestrion.md
+++ b/.agents/skills/apm-integrations/references/orchestrion.md
@@ -208,6 +208,95 @@ For integrations wrapping multiple methods, create a separate plugin class per m
 - `ctx.error` — thrown error (on error)
 - `ctx.currentStore` — set by `startSpan` in `bindStart`
 
+## Propagating Synchronous Errors From `bindStart`
+
+Subscribers on the prefix `:start` channel and `bindStore` transforms **cannot
+propagate a synchronous throw** to the caller of an orchestrion-wrapped
+function. Both are wrapped in `try { ... } catch (err) { process.nextTick(() =>
+triggerUncaughtException(err)); ... }` by Node's `diagnostics_channel` (see
+`lib/diagnostics_channel.js`'s `wrapStoreRun` and `publish`). The error
+surfaces async as an uncaught exception, **after** the wrapped fn has already
+run and the call has returned normally.
+
+The wrapper's own catch block, however, **does** rethrow:
+
+```js
+return ch.start.runStores(__apm$ctx, () => {
+  try {
+    const result = __apm$traced();
+    __apm$ctx.result = result;
+    return result;
+  } catch (err) {
+    __apm$ctx.error = err;
+    ch.error.publish(__apm$ctx);
+    throw err;                  // <- propagates the wrapped fn's error to the caller
+  } finally {
+    ch.end.publish(__apm$ctx);
+  }
+});
+```
+
+When a contract requires `assert.throws(() => wrapped(...))`-style synchronous
+propagation from a `:start` observer (the canonical case is AppSec WAF's
+`abortController.abort()` model), use the **Proxy-on-arguments pattern**:
+
+```js
+bindStart (ctx) {
+  // ... normal setup, span creation ...
+  const abortController = new AbortController()
+  if (startCh.hasSubscribers) {
+    startCh.publish({ abortController, args })       // subscribers run sync
+    if (abortController.signal.aborted) {
+      // ctx.arguments is the SAME array reference the wrapper spreads into
+      // the wrapped fn (__apm$wrapped.apply(this, ctx.arguments)). Replace
+      // arguments[0] with a Proxy whose getters throw AbortError. The
+      // wrapped fn's first property access (typically a destructure of args)
+      // triggers the trap → the wrapper's catch+rethrow propagates AbortError
+      // to the caller. Span lifecycle still completes via end.publish.
+      ctx.arguments[0] = new Proxy({}, {
+        get () { throw new AbortError('Aborted') },
+        has () { throw new AbortError('Aborted') },
+      })
+      ctx.ddAborted = true
+      return ctx.currentStore
+    }
+  }
+  // ... rest of bindStart ...
+}
+
+error (ctx) {
+  if (ctx.ddAborted) return                          // abort != error tag
+  // ... regular error handling ...
+}
+```
+
+Reference implementation: `packages/datadog-plugin-graphql/src/execute.js`
+(`apm:graphql:execute:start` contract).
+
+Why this works:
+- `ctx.arguments` and the rewriter's `__apm$arguments` are the same array
+  reference (confirmed by capturing the rewriter output: `const __apm$traced
+  = () => __apm$wrapped.apply(this, __apm$arguments)`).
+- The wrapped fn's body almost always touches `arguments[0]` on the first
+  statement (destructure, property read, validation). Any read triggers the
+  Proxy trap.
+- The orchestrion wrapper's `catch { ...; throw err }` propagates the thrown
+  error synchronously to the caller — confirmed in the rewriter template
+  (vendor's `code-transformer/index.js`, `wrapSync` function).
+- `:end` still fires in `finally`, so the plugin's `end(ctx)` runs as usual
+  and the span lifecycle completes cleanly. Combined with an `error(ctx)`
+  that no-ops when `ctx.ddAborted`, the span finishes with `error === 0`
+  (matches the abort contract).
+
+When NOT to use this:
+- If you control the wrapped fn (e.g., it's a method you can wrap with
+  shimmer on top of orchestrion), do that — clearer and avoids the
+  Proxy indirection.
+- If the wrapped fn might catch its own errors before they escape (some
+  user-resolver patterns do this), the AbortError won't propagate. Verify
+  the wrapped fn does NOT have a top-level `try/catch` around the
+  property access that triggers the trap.
+
 ## Common Issues
 
 ### Wrong filePath
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index cae9183df9..20ea7c6a6e 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -146,6 +146,11 @@
 /integration-tests/vitest/ @DataDog/ci-app-libraries
 /integration-tests/vitest.config.mjs @DataDog/ci-app-libraries
 /integration-tests/vitest.second-project.config.mjs @DataDog/ci-app-libraries
+/integration-tests/vitest.typecheck.config.mjs @DataDog/ci-app-libraries
+/integration-tests/tsconfig.typecheck.json @DataDog/ci-app-libraries
+/integration-tests/tsconfig.typecheck-fail.json @DataDog/ci-app-libraries
+/integration-tests/tsconfig.typecheck-test-management-fail.json @DataDog/ci-app-libraries
+/integration-tests/tsconfig.typecheck-test-management-file-fail.json @DataDog/ci-app-libraries
 /integration-tests/ci-visibility-intake.js @DataDog/ci-app-libraries
 /integration-tests/ci-visibility-intake.spec.js @DataDog/ci-app-libraries
 /integration-tests/CODEOWNERS @DataDog/ci-app-libraries
diff --git a/.github/actions/coverage/action.yml b/.github/actions/coverage/action.yml
index d01ceef7cd..3f481b05b4 100644
--- a/.github/actions/coverage/action.yml
+++ b/.github/actions/coverage/action.yml
@@ -1,9 +1,13 @@
 name: coverage
-description: Verify coverage output and upload it to Codecov and Datadog.
+description: >-
+  Verify a job's coverage output and stash it as an artifact. All Green collects every
+  `coverage-*` artifact, merges them per integration, and uploads the groups to Codecov and
+  Datadog — so a commit sends ~100 grouped reports instead of one per matrix cell, which kept
+  Codecov from silently dropping uploads past its per-commit ceiling.
 
 inputs:
   flags:
-    description: "Codecov flags value"
+    description: "Coverage flags — the grouping key All Green folds matrix cells by"
     required: false
   report-dir:
     description: "Coverage report directory (defaults to 'coverage')"
@@ -12,19 +16,13 @@ inputs:
 runs:
   using: composite
   steps:
-    # Retry once on failure to work around transient issues (e.g. flaky
-    # Codecov upload network calls).
-    - id: attempt
-      uses: ./.github/actions/coverage/upload
-      continue-on-error: true
-      with:
-        flags: ${{ inputs.flags }}
-        report-dir: ${{ inputs.report-dir }}
-    - if: steps.attempt.outcome == 'failure'
+    - name: Verify coverage output
       shell: bash
-      run: sleep 60
-    - if: steps.attempt.outcome == 'failure'
-      uses: ./.github/actions/coverage/upload
+      run: node scripts/verify-coverage.js --flags "${{ inputs.flags }}"
+
+    - name: Upload coverage artifact
+      if: always()
+      uses: ./.github/actions/upload-coverage-artifact
       with:
         flags: ${{ inputs.flags }}
         report-dir: ${{ inputs.report-dir }}
diff --git a/.github/actions/coverage/upload/action.yml b/.github/actions/coverage/upload/action.yml
deleted file mode 100644
index f74f03241d..0000000000
--- a/.github/actions/coverage/upload/action.yml
+++ /dev/null
@@ -1,51 +0,0 @@
-name: Coverage Upload
-description: Internal implementation; verify and upload coverage. Use `./.github/actions/coverage` instead.
-
-inputs:
-  flags:
-    description: "Codecov flags value"
-    required: false
-  report-dir:
-    description: "Coverage report directory (defaults to 'coverage')"
-    required: false
-    default: coverage
-
-runs:
-  using: composite
-  steps:
-    - name: Verify coverage output
-      shell: bash
-      run: node scripts/verify-coverage.js --flags "${{ inputs.flags }}"
-
-    # `master-coverage` is the flag .codecov.yml gates codecov/patch on. Attach
-    # it only on PRs targeting master so release-branch PRs auto-pass.
-    - name: Compute Codecov flags
-      id: codecov-flags
-      shell: bash
-      env:
-        JOB_FLAGS: ${{ inputs.flags }}
-        EVENT_NAME: ${{ github.event_name }}
-        BASE_REF: ${{ github.base_ref }}
-      run: |
-        flags="$JOB_FLAGS"
-        if [ "$EVENT_NAME" = "pull_request" ] && [ "$BASE_REF" = "master" ]; then
-          flags="${flags:+$flags,}master-coverage"
-        fi
-        echo "value=$flags" >> "$GITHUB_OUTPUT"
-
-    - name: Install gpg for Codecov validation
-      if: runner.os == 'Linux'
-      shell: bash
-      run: command -v gpg || sudo apt-get install -y gpg
-
-    - name: Upload coverage to Codecov
-      uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
-      with:
-        flags: ${{ steps.codecov-flags.outputs.value }}
-
-    - name: Upload coverage artifact
-      if: always()
-      uses: ./.github/actions/upload-coverage-artifact
-      with:
-        flags: ${{ inputs.flags }}
-        report-dir: ${{ inputs.report-dir }}
diff --git a/.github/actions/install/branch-diff/action.yml b/.github/actions/install/branch-diff/action.yml
index 1827f26d95..aafe85501e 100644
--- a/.github/actions/install/branch-diff/action.yml
+++ b/.github/actions/install/branch-diff/action.yml
@@ -7,7 +7,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+    - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.npm
         key: ${{ github.workflow }}-branch-diff-3.1.1
diff --git a/.github/actions/node/setup/action.yml b/.github/actions/node/setup/action.yml
index 745c7ba6fd..ef54965603 100644
--- a/.github/actions/node/setup/action.yml
+++ b/.github/actions/node/setup/action.yml
@@ -27,8 +27,10 @@ runs:
         }
         case "$VERSION" in
           eol)         version=16 ;;
-          oldest)      oldest_major=$(awk '/"node"/{match($0,/[0-9]+/);print substr($0,RSTART,RLENGTH);exit}' package.json)
-                      version=$(node_version "$oldest_major") ;;
+          # Pinned to 18 rather than derived from package.json engines.node: CI keeps testing the
+          # oldest version we still exercise (18) even though the shipped engines floor is now >=22.
+          # See the Widen engines.node for CI step below, which restores >=18 on the 18/20 legs.
+          oldest)      version=$(node_version 18) ;;
           maintenance) version=$(node_version 20) ;;
           active)      version=$(node_version 24) ;;
           latest)      version=${LATEST_VERSION:-$(node_version 26)}
@@ -44,6 +46,22 @@ runs:
         node-version: ${{ steps.node-version.outputs.version }}
         registry-url: ${{ inputs.registry-url || 'https://registry.npmjs.org' }}
 
+    # The shipped package.json pins engines.node to the supported runtime range, but CI keeps
+    # running the full suite on Node 18/20. Widen the field to >=18 for this checkout so the
+    # runtime guard and the withVersions test helper don't bail and silently skip those jobs.
+    # Gate on the major so this never runs on the ancient runtimes the guardrails-unsupported
+    # job installs (those must keep seeing the shipped >=22 so the guard aborts), and so the
+    # script is only ever parsed by a Node version new enough to run it.
+    - name: Widen engines.node for CI
+      shell: bash
+      run: |
+        MAJOR=$(node -e "process.stdout.write(String(parseInt(process.versions.node)))")
+        if [ "$MAJOR" = "18" ] || [ "$MAJOR" = "20" ]; then
+          node scripts/ci/widen-engines-for-ci.js
+        else
+          echo "Leaving engines.node unchanged on Node $(node -v) (only widened on Node 18/20)."
+        fi
+
     # Persist the resolved version so subsequent runs within this 60-minute window can reuse it.
     - name: Save resolved version
       if: steps.node-version-cache.outputs.cache-hit != 'true'
diff --git a/.github/actions/upload-coverage-artifact/action.yml b/.github/actions/upload-coverage-artifact/action.yml
index b29903dc8e..cbb4b9ed47 100644
--- a/.github/actions/upload-coverage-artifact/action.yml
+++ b/.github/actions/upload-coverage-artifact/action.yml
@@ -1,9 +1,9 @@
 name: Upload Coverage Artifact
-description: Upload coverage report as a GitHub Actions artifact for later collection
+description: Upload a job's LCOV report as a GitHub Actions artifact for All Green to collect and group.
 
 inputs:
   flags:
-    description: Coverage flags — used as artifact identifier and passed to Datadog on upload
+    description: Coverage flags — the grouping key All Green folds matrix cells by
     required: true
   report-dir:
     description: Coverage report directory
@@ -13,26 +13,38 @@ inputs:
 runs:
   using: composite
   steps:
+    # The reports live at `<report-dir>/node-<version>-<label>/{lcov.info,coverage-final.json}`, one
+    # level below `report-dir`, so the presence check has to recurse — a top-level-only probe finds
+    # nothing and silently skips the upload, which is what starved the Datadog coverage upload.
+    # Both formats ship: Codecov reads branch/function coverage from the istanbul JSON, Datadog from
+    # the lcov.
     - id: check
       shell: bash
       run: |
-        count=$(find "${{ inputs.report-dir }}" -maxdepth 1 -type f 2>/dev/null | wc -l | tr -d ' ')
-        echo "has_files=$([ "$count" -gt 0 ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
-    - if: steps.check.outputs.has_files == 'true'
+        count=$(find "${{ inputs.report-dir }}" \( -name lcov.info -o -name coverage-final.json \) -type f 2>/dev/null | wc -l | tr -d ' ')
+        echo "has_coverage=$([ "$count" -gt 0 ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
+    # The artifact name carries the grouping flag plus a per-cell suffix (`__<job>-<matrix-index>`)
+    # so matrix cells that share a flag — cypress varies `spec` outside its flag — upload distinct
+    # artifacts instead of clobbering each other under one name.
+    - if: github.actor != 'dependabot[bot]' && steps.check.outputs.has_coverage == 'true'
       id: upload
       continue-on-error: true
       uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
-        name: coverage-${{ inputs.flags }}
-        path: ${{ inputs.report-dir }}
+        name: coverage-${{ inputs.flags }}__${{ github.job }}-${{ strategy.job-index }}
+        path: |
+          ${{ inputs.report-dir }}/**/lcov.info
+          ${{ inputs.report-dir }}/**/coverage-final.json
         retention-days: 1
-    - if: steps.check.outputs.has_files == 'true' && steps.upload.outcome == 'failure'
+    - if: github.actor != 'dependabot[bot]' && steps.check.outputs.has_coverage == 'true' && steps.upload.outcome == 'failure'
       shell: bash
       run: sleep 10
-    - if: steps.check.outputs.has_files == 'true' && steps.upload.outcome == 'failure'
+    - if: github.actor != 'dependabot[bot]' && steps.check.outputs.has_coverage == 'true' && steps.upload.outcome == 'failure'
       uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
-        name: coverage-${{ inputs.flags }}
-        path: ${{ inputs.report-dir }}
-        overwrite: true
+        name: coverage-${{ inputs.flags }}__${{ github.job }}-${{ strategy.job-index }}
+        path: |
+          ${{ inputs.report-dir }}/**/lcov.info
+          ${{ inputs.report-dir }}/**/coverage-final.json
         retention-days: 1
+        overwrite: true
diff --git a/.github/chainguard/self.github.release.push-tags.sts.yaml b/.github/chainguard/self.github.release.push-tags.sts.yaml
index c69957e33c..4394bc806e 100644
--- a/.github/chainguard/self.github.release.push-tags.sts.yaml
+++ b/.github/chainguard/self.github.release.push-tags.sts.yaml
@@ -4,9 +4,9 @@ subject: repo:DataDog/dd-trace-js:environment:npm
 
 claim_pattern:
   event_name: (push|workflow_dispatch)
-  ref: refs/heads/(v[345]\.x|master)
+  ref: refs/heads/(v[3456]\.x|master)
   repository: DataDog/dd-trace-js
-  job_workflow_ref: DataDog/dd-trace-js/\.github/workflows/release\.yml@refs/heads/(v[345]\.x|master)
+  job_workflow_ref: DataDog/dd-trace-js/\.github/workflows/release\.yml@refs/heads/(v[3456]\.x|master)
 
 permissions:
   contents: write
diff --git a/.github/workflows/all-green.yml b/.github/workflows/all-green.yml
index 113a2ffe54..b49f9bd3f1 100644
--- a/.github/workflows/all-green.yml
+++ b/.github/workflows/all-green.yml
@@ -40,6 +40,12 @@ jobs:
           GITHUB_TOKEN: ${{ steps.octo-sts.outputs.token }}
           POLLING_INTERVAL: 1
           RETRIES: 20
+      # Sort every downloaded per-cell `coverage-*` artifact into one directory per integration under
+      # `coverage-upload/<group>/{lcov,json}/`. The reports are not merged here — both backends merge
+      # same-flag uploads server-side — so each cell's report passes through byte-for-byte. Codecov
+      # gets the istanbul JSON (carries branch/function coverage), Datadog gets the lcov.
+      - if: "!cancelled()"
+        run: node scripts/group-coverage.mjs
       - if: "!cancelled()"
         uses: ./.github/actions/dd-sts-api-key
         id: dd-sts
@@ -49,7 +55,54 @@ jobs:
         run: datadog-ci junit upload --service dd-trace-js-tests --auto-discovery junit-results
         env:
           DD_API_KEY: ${{ steps.dd-sts.outputs.api_key }}
+      # One Datadog upload per integration, flagged with the integration name so coverage is
+      # attributable in the Datadog UI the same way the Codecov flags attribute it. Datadog reads the
+      # lcov reports; it does not ingest istanbul's JSON.
       - if: "!cancelled()"
-        run: datadog-ci coverage upload coverage-results
+        run: |
+          set -o pipefail
+          shopt -s nullglob
+          # shellcheck disable=SC2016 # the inner shell must expand "$1", not the template.
+          printf '%s\0' coverage-upload/*/lcov/ | xargs -0 -r -P 10 -I {} \
+            bash -c 'datadog-ci coverage upload "$1" --flags "$(basename "$(dirname "$1")")"' _ {}
         env:
           DD_API_KEY: ${{ steps.dd-sts.outputs.api_key }}
+      # One Codecov upload per integration via the CLI directly — the codecov-action would re-validate
+      # and re-download the uploader once per group (~100×). Codecov reads branch/function coverage
+      # from the istanbul JSON, so the upload points at each group's `json/` subdirectory.
+      # `master-coverage` is the flag `.codecov.yml` gates `codecov/patch` on; attach it only on PRs
+      # targeting master so release-branch PRs auto-pass. The SHA/branch/PR are passed explicitly
+      # because All Green checks out the merge ref, not the head the other workflows reported coverage
+      # for. No token: the repo uploads tokenless (a Codecov token would have to be an org secret,
+      # which forks can't read).
+      - if: "!cancelled()"
+        run: |
+          commit_args=(--sha "$HEAD_SHA" --branch "$HEAD_BRANCH")
+          upload_args=(--sha "$HEAD_SHA")
+          if [ -n "$PR_NUMBER" ]; then
+            commit_args+=(--pr "$PR_NUMBER")
+            upload_args+=(--pr "$PR_NUMBER")
+          fi
+          master_flag=()
+          if [ "$GITHUB_EVENT_NAME" = "pull_request" ] && [ "$BASE_REF" = "master" ]; then
+            master_flag=(-F master-coverage)
+          fi
+          shopt -s nullglob
+          groups=(coverage-upload/*/json/)
+          [ ${#groups[@]} -gt 0 ] || exit 0
+          pip install --quiet codecov-cli
+          # create-commit and create-report set up the report once and must finish before any upload;
+          # only the do-upload fan-out is safe to parallelize.
+          codecovcli create-commit "${commit_args[@]}"
+          codecovcli create-report --sha "$HEAD_SHA"
+          set -o pipefail
+          # shellcheck disable=SC2016 # the inner shell must expand "$@"/"$dir", not the template.
+          printf '%s\0' "${groups[@]}" | xargs -0 -r -P 10 -I {} \
+            bash -c 'dir="$1"; shift; codecovcli do-upload "$@" --dir "$dir" -F "$(basename "$(dirname "$dir")")"' \
+              _ {} "${upload_args[@]}" "${master_flag[@]}"
+        env:
+          GITHUB_EVENT_NAME: ${{ github.event_name }}
+          BASE_REF: ${{ github.base_ref }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+          HEAD_BRANCH: ${{ github.head_ref || github.ref_name }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
diff --git a/.github/workflows/project.yml b/.github/workflows/project.yml
index 78835dc521..8ed66a7db3 100644
--- a/.github/workflows/project.yml
+++ b/.github/workflows/project.yml
@@ -19,7 +19,7 @@ jobs:
       - uses: ./.github/actions/node/latest
       - name: actionlint
         id: actionlint
-        uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8 # v2.1.2
+        uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2.2.0
         with:
           matcher: true
           fail-on-error: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b826335d65..4f3e2ee69a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -6,6 +6,7 @@ on:
       - v3.x
       - v4.x
       - v5.x
+      - v6.x
   workflow_dispatch:
 
 concurrency:
@@ -16,16 +17,17 @@ jobs:
   setup:
     if: github.event_name == 'push'
     runs-on: ubuntu-latest
-    # Space-separated npm dist-tags for each release line.
-    # The latest branch always gets "latest" prepended automatically.
+    # npm dist-tag for each release line.
+    # The latest branch always gets "latest" automatically.
     # Add a line here when creating a new release branch.
     env:
       DIST_TAGS: |
         v3.x latest-node14
         v4.x latest-node16
-        v5.x latest-node18 latest-node20
+        v5.x latest-node18
+        v6.x latest-node22
     outputs:
-      npm_tags: ${{ steps.compute.outputs.npm_tags }}
+      npm_tag: ${{ steps.compute.outputs.npm_tag }}
       is_latest: ${{ steps.compute.outputs.is_latest }}
     steps:
       - id: compute
@@ -47,18 +49,18 @@ jobs:
             | sort -V \
             | tail -1)
 
-          # Collect the tags defined for this branch (everything after the branch name)
-          branch_tags=$(echo "$DIST_TAGS" | awk -v b="$branch" '$1==b{$1=""; sub(/^ /,""); print}')
+          # Collect the tag defined for this branch (field after the branch name)
+          branch_tag=$(echo "$DIST_TAGS" | awk -v b="$branch" '$1==b{print $2}')
 
           if [ "$branch" = "$latest" ]; then
-            npm_tags="latest ${branch_tags:-latest-${branch%.x}}"
+            npm_tag="latest"
             is_latest="true"
           else
-            npm_tags="${branch_tags:-latest-${branch%.x}}"
+            npm_tag="${branch_tag:-latest-${branch%.x}}"
             is_latest="false"
           fi
 
-          echo "npm_tags=$npm_tags" >> "$GITHUB_OUTPUT"
+          echo "npm_tag=$npm_tag" >> "$GITHUB_OUTPUT"
           echo "is_latest=$is_latest" >> "$GITHUB_OUTPUT"
 
   publish:
@@ -88,28 +90,11 @@ jobs:
       - name: Publish
         run: |
           version="${{ fromJson(steps.pkg.outputs.json).version }}"
-          tags=(${{ needs.setup.outputs.npm_tags }})
-
-          # Exchange the GitHub OIDC token for an npm registry token so
-          # that npm publish and npm dist-tag add share the same auth.
-          # npm only runs this exchange internally for publish (oidc.js:141)
-          # and does not persist the token, so dist-tag add would fail
-          # without doing it explicitly here.
-          # Audience format and exchange endpoint from npm/lib/utils/oidc.js.
-          oidc_token=$(curl -sS -fH \
-            "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
-            "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=npm:registry.npmjs.org" \
-            | jq -r '.value')
-          npm_token=$(curl -sS -fX POST \
-            -H "Authorization: Bearer $oidc_token" \
-            -H "Content-Type: application/json" \
-            "https://registry.npmjs.org/-/npm/v1/oidc/token/exchange/package/dd-trace" \
-            | jq -r '.token')
-          export NODE_AUTH_TOKEN="$npm_token"
+          tag="${{ needs.setup.outputs.npm_tag }}"
 
           # Idempotent: skip publish if this version already exists so
-          # that a rerun after a partial failure can still repair dist-tags,
-          # git tags, release notes, and docs.
+          # that a rerun after a partial failure can still repair the git
+          # tag and release notes.
           if npm view "dd-trace@$version" version 2>/dev/null | grep -qF "$version"; then
             local_integrity=$(npm pack --dry-run --json 2>/dev/null | jq -r '.[0].integrity')
             published_integrity=$(npm view "dd-trace@$version" dist.integrity 2>/dev/null)
@@ -121,13 +106,8 @@ jobs:
             fi
             echo "Version $version already published with identical content, skipping npm publish"
           else
-            npm publish --tag "${tags[0]}"
+            npm publish --tag "$tag"
           fi
-
-          # Always reconcile all expected dist-tags.
-          for tag in "${tags[@]:1}"; do
-            npm dist-tag add "dd-trace@$version" "$tag"
-          done
       - name: Tag release
         run: |
           version="${{ fromJson(steps.pkg.outputs.json).version }}"
diff --git a/.github/workflows/test-optimization.yml b/.github/workflows/test-optimization.yml
index 6be2dc0107..fe2473ae25 100644
--- a/.github/workflows/test-optimization.yml
+++ b/.github/workflows/test-optimization.yml
@@ -60,7 +60,7 @@ jobs:
           echo "version=$PLAYWRIGHT_VERSION" >> $GITHUB_OUTPUT
           echo "Playwright version: $PLAYWRIGHT_VERSION"
       - name: Cache Playwright browsers
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.cache/ms-playwright
           key: playwright-browsers-${{ runner.os }}-${{ steps.playwright-version.outputs.version }}
@@ -413,7 +413,7 @@ jobs:
           fi
           echo "resolved=$RESOLVED" >> $GITHUB_OUTPUT
       - name: Cache Cypress binary
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.cache/Cypress
           key: cypress-binary-${{ steps.cypress-version.outputs.resolved }}
@@ -442,6 +442,7 @@ jobs:
           - vitest.core
           - vitest.test-management
           - vitest.advanced
+          - vitest.no-worker-init
     name: integration-vitest (node-${{ matrix.version }}, ${{ matrix.spec }})
     env:
       DD_SERVICE: dd-trace-js-integration-tests
diff --git a/.github/workflows/update-3rdparty-licenses.yml b/.github/workflows/update-3rdparty-licenses.yml
index 5623dfa5b2..cf49b8cb10 100644
--- a/.github/workflows/update-3rdparty-licenses.yml
+++ b/.github/workflows/update-3rdparty-licenses.yml
@@ -23,7 +23,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.14"
 
diff --git a/AGENTS.md b/AGENTS.md
index 99ae9ce812..16b70a8836 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -173,7 +173,7 @@ Separate groups with empty line, sort alphabetically within each:
 
 1. Node.js core modules (with `node:` prefix)
 2. Third-party modules
-3. Internal imports (by path proximity, then alpha)
+3. Internal imports (by path proximity, furthest first, then alpha)
 
 ### ECMAScript and Node.js API Standards
 
diff --git a/MIGRATING.md b/MIGRATING.md
index d21a0e3d80..089c8db9fb 100644
--- a/MIGRATING.md
+++ b/MIGRATING.md
@@ -4,7 +4,56 @@ This guide describes the steps to upgrade dd-trace from a major version to the
 next. If you are having any issues related to migrating, please feel free to
 open an issue or contact our [support](https://www.datadoghq.com/support/) team.
 
-## 5.0 to 6.0 (unreleased)
+## 5.0 to 6.0
+
+### Node 18 and 20 are no longer supported
+
+Node.js 18 reached EOL in April 2025 and Node.js 20 reached EOL in April 2026;
+neither is supported in v6. We highly recommend always keeping Node.js up to
+date regardless of our support policy.
+
+### Minimum versions bumped for test framework integrations
+
+Make sure to update any of the below frameworks to a v6 supported minimum version.
+
+| Framework  | v5 minimum | v6 minimum |
+| :---:      | :---:      | :---:      |
+| Jest       | 24.8.0     | 28.0.0     |
+| Mocha      | 5.2.0      | 8.0.0      |
+| Cypress    | 6.7.0      | 12.0.0     |
+| Playwright | 1.18.0     | 1.38.0     |
+
+### Nx service name default value
+
+The `NX_TASK_TARGET_PROJECT` environment variable set automatically by `nx`
+is now used as the default test service name `test.service` unless
+`DD_SERVICE` is explicitly set. On v5 this behavior required
+`DD_ENABLE_NX_SERVICE_NAME` to opt in. Remove the opt-in variable if you had
+it set; the behavior is now unconditional.
+
+### Lage test session name default value
+
+The `LAGE_PACKAGE_NAME` environment variable set automatically by `lage` is
+now used as the default test session name `test_session.name` unless
+`DD_TEST_SESSION_NAME` is explicitly set. On v5 this behavior required
+`DD_ENABLE_LAGE_PACKAGE_NAME=true` to opt in. Remove the opt-in variable if
+you had it set; the behavior is now unconditional.
+
+### CI test session `test_session.name` is now the trimmed command
+
+The `test_session.name` tag on test session spans now defaults to only the
+framework invocation (e.g. `jest`, `mocha`, `playwright test`, `cucumber-js`)
+rather than the full command line, when no explicit name is otherwise
+configured. The `test.command` tag is unaffected and still
+contains the full command. Update any monitors or dashboards that matched on
+`test_session.name` with the full command string.
+
+### OpenAI span resource name is now the normalized method name
+
+The `resource.name` on `openai.request` spans now uses a normalized,
+SDK-version-independent name (e.g. `createChatCompletion`) instead of the raw
+SDK method name (e.g. `chat.completions.create`). Update any monitors or
+dashboards that matched on the dotted v4 SDK method names.
 
 ### IAST security controls is env-only
 
@@ -113,6 +162,19 @@ The `ingestion: { sampleRate, rateLimit }` wrapper has been removed. Set
 `sampleRate` and `rateLimit` directly on the top-level `TracerOptions` object,
 or use `DD_TRACE_SAMPLE_RATE` / `DD_TRACE_RATE_LIMIT`.
 
+### GraphQL resolver `depth` no longer counts list indices
+
+The `graphql` plugin's `depth` option counted a resolver's full execution path,
+including the numeric list indices that `collapse` folds away. The same query
+therefore reached a different depth depending on whether `collapse` was enabled:
+a field one list-hop below the limit was instrumented with `collapse: false` and
+dropped with the default `collapse: true`.
+
+v6 counts only selection-set nesting (named fields) toward `depth`, so the limit
+tracks query structure rather than execution artifacts and is independent of
+`collapse`. At a given `depth`, a resolver nested under a list is now reached one
+level sooner than on v5's default. Lower `depth` to restore the previous cutoff.
+
 ## 4.0 to 5.0
 
 ### Node 16 is no longer supported
diff --git a/README.md b/README.md
index c434aeb846..067628e023 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # `dd-trace`: Node.js APM Tracer Library
 
-[![npm v5](https://img.shields.io/npm/v/dd-trace/latest?color=blue&label=dd-trace%40v5&logo=npm)](https://www.npmjs.com/package/dd-trace)
+[![npm v6](https://img.shields.io/npm/v/dd-trace/latest?color=blue&label=dd-trace%40v6&logo=npm)](https://www.npmjs.com/package/dd-trace)
 [![codecov](https://codecov.io/gh/DataDog/dd-trace-js/branch/master/graph/badge.svg)](https://codecov.io/gh/DataDog/dd-trace-js)
 
 <img align="right" src="https://user-images.githubusercontent.com/551402/208212084-1d0c07e2-4135-4c61-b2da-8f2fddbc66ed.png" alt="Bits the dog  JavaScript" width="200px"/>
@@ -28,30 +28,35 @@ Most of the documentation for `dd-trace` is available on these webpages:
 | [`v2`](https://github.com/DataDog/dd-trace-js/tree/v2.x) | ![npm v2](https://img.shields.io/npm/v/dd-trace/latest-node12?color=white&label=%20&style=flat-square) | `>= v12` | NO | NO | **EOL** | 2022-01-28     | 2023-08-15  |
 | [`v3`](https://github.com/DataDog/dd-trace-js/tree/v3.x) | ![npm v3](https://img.shields.io/npm/v/dd-trace/latest-node14?color=white&label=%20&style=flat-square) | `>= v14` | NO | YES | **EOL** | 2022-08-15     | 2024-05-15  |
 | [`v4`](https://github.com/DataDog/dd-trace-js/tree/v4.x) | ![npm v4](https://img.shields.io/npm/v/dd-trace/latest-node16?color=white&label=%20&style=flat-square) | `>= v16` | YES | YES | **EOL**     | 2023-05-12     | 2025-01-11     |
-| [`v5`](https://github.com/DataDog/dd-trace-js/tree/v5.x) | ![npm v5](https://img.shields.io/npm/v/dd-trace/latest?color=white&label=%20&style=flat-square)        | `>= v18` | YES | YES | **Current**     | 2024-01-11     | Unknown     |
+| [`v5`](https://github.com/DataDog/dd-trace-js/tree/v5.x) | ![npm v5](https://img.shields.io/npm/v/dd-trace/latest-node18?color=white&label=%20&style=flat-square)  | `>= v18` | YES | YES | **Maintenance** | 2024-01-11     | Unknown     |
+| [`v6`](https://github.com/DataDog/dd-trace-js/tree/v6.x) | ![npm v6](https://img.shields.io/npm/v/dd-trace/latest?color=white&label=%20&style=flat-square)         | `>= v22` | YES | YES | **Current**     | 2026-07-02     | Unknown     |
 
 * EOL = End-of-life
 * SSI = Single-Step Install
 
-We currently maintain one release line, namely `v5`.
+We currently maintain two release lines: `v6` (current) and `v5` (maintenance).
 
-For any new projects it is recommended to use the `v5` release line:
+For any new projects it is recommended to use the `v6` release line:
 
 ```sh
 $ npm install dd-trace
 $ yarn add dd-trace
 ```
 
-Existing projects that need to use EOL versions of Node.js may continue to use these older release lines.
-This is done by specifying the version when installing the package.
+Existing projects on `v5` may continue to use it during its maintenance window by pinning the major version:
+
+```sh
+$ npm install dd-trace@5
+$ yarn add dd-trace@5
+```
+
+Older EOL release lines are no longer maintained, but can still be pinned if needed:
 
 ```sh
 $ npm install dd-trace@4 # or whatever version you need
 $ yarn add dd-trace@4 # or whatever version you need
 ```
 
-Note, however, that the end-of-life release lines are no longer maintained and will not receive updates.
-
 Any backwards-breaking functionality that is introduced into the library will result in an increase of the major version of the library and therefore a new release line.
 Such releases are kept to a minimum to reduce the pain of upgrading the library.
 
diff --git a/benchmark/sirun/exporting-pipeline/index.js b/benchmark/sirun/exporting-pipeline/index.js
index 876dee63b0..6ccb059405 100644
--- a/benchmark/sirun/exporting-pipeline/index.js
+++ b/benchmark/sirun/exporting-pipeline/index.js
@@ -41,7 +41,10 @@ const exporter = { export (formatted) { exported += formatted.length; lastFormat
 const prioritySampler = new PrioritySampler()
 const config = {
   flushMinSpans: 100,
-  stats: { enabled: WITH_STATS },
+  stats: {
+    DD_TRACE_STATS_COMPUTATION_ENABLED: WITH_STATS,
+  },
+  appsec: {},
 }
 const sp = new SpanProcessor(exporter, prioritySampler, config)
 
@@ -94,6 +97,10 @@ trace.started = finished
 trace.finished = finished
 sp.process(finished[0])
 assert.equal(exported, 30, 'span processor did not format and export the chunk')
+// The stats variant must actually build the stats processor: a renamed config
+// key would otherwise leave it off and the variant would silently measure the
+// no-stats path, showing up as a spurious A/B improvement.
+assert.equal(Boolean(sp._stats), WITH_STATS, 'stats computation did not match the WITH_STATS variant')
 if (WITH_LINKS) {
   assert.ok(lastFormatted[0].meta['_dd.span_links'], 'span links were not formatted')
   assert.ok(lastFormatted[0].span_events?.length, 'span events were not formatted')
diff --git a/benchmark/sirun/llmobs-span-processor/index.js b/benchmark/sirun/llmobs-span-processor/index.js
index 2f62bc39fb..9c92d2939e 100644
--- a/benchmark/sirun/llmobs-span-processor/index.js
+++ b/benchmark/sirun/llmobs-span-processor/index.js
@@ -33,7 +33,9 @@ const OPERATIONS = Number(process.env.OPERATIONS)
 // event (meta/input/output by span kind, metrics, tags, error). This is the
 // per-span LLMObs hot path, uncovered by the existing llmobs writer bench.
 const processor = new LLMObsSpanProcessor({
-  llmobs: { enabled: true },
+  llmobs: {
+    DD_LLMOBS_ENABLED: true,
+  },
   version: '1.0.0',
   env: 'bench',
   service: 'llmobs-bench',
diff --git a/benchmark/sirun/plugin-graphql-long/meta.json b/benchmark/sirun/plugin-graphql-long/meta.json
index f35fe1ee3c..641061a633 100644
--- a/benchmark/sirun/plugin-graphql-long/meta.json
+++ b/benchmark/sirun/plugin-graphql-long/meta.json
@@ -11,7 +11,7 @@
       "env": { "WITH_TRACER": "1", "WITH_DEPTH": "0", "OPERATIONS": "1150" }
     },
     "with-depth-on-max": {
-      "env": { "WITH_TRACER": "1", "WITH_DEPTH": "4", "OPERATIONS": "530" }
+      "env": { "WITH_TRACER": "1", "WITH_DEPTH": "6", "OPERATIONS": "800" }
     },
     "with-depth-and-collapse-off": {
       "env": { "WITH_TRACER": "1", "WITH_DEPTH_AND_COLLAPSE": "4,0", "OPERATIONS": "210" }
diff --git a/ci/init.js b/ci/init.js
index f34e44ddc8..a06a3687ba 100644
--- a/ci/init.js
+++ b/ci/init.js
@@ -1,13 +1,14 @@
 'use strict'
 
 /* eslint-disable no-console */
-const tracer = require('../packages/dd-trace')
 const log = require('../packages/dd-trace/src/log')
 const { getEnvironmentVariable, getValueFromEnvSources } = require('../packages/dd-trace/src/config/helper')
+const { isTrue } = require('../packages/dd-trace/src/util')
 
 const PACKAGE_MANAGERS = ['npm', 'yarn', 'pnpm']
 const DEFAULT_FLUSH_INTERVAL = 5000
 const JEST_FLUSH_INTERVAL = 0
+const VITEST_NO_WORKER_INIT_ACTIVE_ENV = 'DD_TEST_OPT_VITEST_NO_WORKER_INIT_ACTIVE'
 const EXPORTER_MAP = {
   jest: 'jest_worker',
   cucumber: 'cucumber_worker',
@@ -78,10 +79,28 @@ if (isTestWorker) {
   }
 }
 
-if (shouldInit) {
+const skipVitestWorkerInit = shouldSkipVitestWorkerInit()
+const tracer = skipVitestWorkerInit
+  ? {
+      init () {},
+      use () {},
+    }
+  : require('../packages/dd-trace')
+
+if (shouldInit && !skipVitestWorkerInit) {
   tracer.init(baseOptions)
   tracer.use('fs', false)
   tracer.use('child_process', false)
 }
 
 module.exports = tracer
+
+function shouldSkipVitestWorkerInit () {
+  return getValueFromEnvSources('DD_VITEST_WORKER') &&
+    isVitestNoWorkerInitActive()
+}
+
+function isVitestNoWorkerInitActive () {
+  // eslint-disable-next-line eslint-rules/eslint-process-env
+  return isTrue(process.env[VITEST_NO_WORKER_INIT_ACTIVE_ENV])
+}
diff --git a/ci/vitest-no-worker-init-setup.mjs b/ci/vitest-no-worker-init-setup.mjs
new file mode 100644
index 0000000000..af24be1f37
--- /dev/null
+++ b/ci/vitest-no-worker-init-setup.mjs
@@ -0,0 +1,430 @@
+import { realpathSync } from 'node:fs'
+import { relative } from 'node:path'
+import { performance } from 'node:perf_hooks'
+
+import { afterEach, beforeAll, beforeEach } from 'vitest'
+
+// Instrumentation-less worker setup for DD_EXPERIMENTAL_TEST_OPT_VITEST_NO_WORKER_INIT.
+// It applies Test Optimization execution changes without initializing dd-trace in Vitest workers.
+const VITEST_NO_WORKER_INIT_ACTIVE_ENV = 'DD_TEST_OPT_VITEST_NO_WORKER_INIT_ACTIVE'
+const isNoWorkerInitActive = getIsNoWorkerInitActive()
+const providedContext = isNoWorkerInitActive ? getProvidedContext() : {}
+const attemptToFixTests = providedContext.attemptToFixTests || {}
+const attemptToFixRetries = providedContext.attemptToFixRetries || 0
+const disabledTests = providedContext.disabledTests || {}
+const earlyFlakeDetectionRetries = providedContext.earlyFlakeDetectionRetries || 0
+const earlyFlakeDetectionRetryThresholds = Array.isArray(providedContext.earlyFlakeDetectionRetryThresholds)
+  ? providedContext.earlyFlakeDetectionRetryThresholds
+  : []
+const earlyFlakeDetectionSlowRetries = providedContext.earlyFlakeDetectionSlowRetries || {}
+const hasEarlyFlakeDetectionSlowRetries = Object.keys(earlyFlakeDetectionSlowRetries).length > 0
+const isEarlyFlakeDetectionEnabled = providedContext.isEarlyFlakeDetectionEnabled === true
+const knownTests = providedContext.knownTests || {}
+const modifiedFiles = providedContext.modifiedFiles || {}
+const quarantinedTests = providedContext.quarantinedTests || {}
+const repositoryRoot = realpath(providedContext.repositoryRoot || process.cwd())
+let setVitestTaskFn
+if (isNoWorkerInitActive) {
+  try {
+    // Vitest does not expose setFn from the public setup API; keep this optional for strict installers.
+    const vitestRunner = await import('@vitest/runner')
+    setVitestTaskFn = vitestRunner.setFn
+  } catch {}
+}
+const earlyFlakeDetectionRetriesByTask = new WeakMap()
+const earlyFlakeDetectionSkippedResults = new WeakMap()
+const earlyFlakeDetectionStartByTask = new WeakMap()
+const nextAttemptIndexByTask = new WeakMap()
+const realpaths = new Map()
+
+if (isNoWorkerInitActive) {
+  // eslint-disable-next-line no-empty-pattern
+  beforeAll(function ({}, suite) {
+    suite ||= arguments[0]
+    applyExecutionChanges(suite)
+  })
+
+  beforeEach(function ({ onTestFinished, task, skip }) {
+    const testSuite = getTestSuite(task)
+    const testName = getTestName(task)
+    const isAttemptToFixTest = attemptToFixTests[testSuite]?.[testName]
+    const isEarlyFlakeDetectionTestAttempt = isEarlyFlakeDetectionTest(testSuite, testName)
+    const isQuarantinedTest = quarantinedTests[testSuite]?.[testName] && !isAttemptToFixTest
+    const attemptIndex = getNextAttemptIndex(task)
+    if (attemptIndex > 0) {
+      recordTestOptimizationStatus(task, attemptIndex - 1)
+    }
+
+    if (disabledTests[testSuite]?.[testName] && !isAttemptToFixTest) {
+      skip('Skipped by Datadog Test Optimization')
+    } else if (isAttemptToFixTest && attemptIndex > 0) {
+      task.result.state = 'run'
+    } else if (isEarlyFlakeDetectionTestAttempt) {
+      const isSkippedRepeat = prepareEarlyFlakeDetectionAttempt(task, attemptIndex)
+      if (!isSkippedRepeat && attemptIndex > 0) {
+        task.result.state = 'run'
+      }
+    }
+
+    if (isAttemptToFixTest || isEarlyFlakeDetectionTestAttempt || isQuarantinedTest) {
+      onTestFinished(() => {
+        if (attemptIndex === getFinalAttemptIndex(task)) {
+          if (isAttemptToFixTest || isEarlyFlakeDetectionTestAttempt) {
+            recordTestOptimizationStatus(task, attemptIndex, true)
+          }
+          switchQuarantinedFinalFailure(task, attemptIndex)
+        }
+      })
+    }
+  })
+
+  afterEach(function ({ task }) {
+    const attemptIndex = task.meta.__ddTestOptCurrentAttemptIndex
+    if (restoreEarlyFlakeDetectionSkippedResult(task)) {
+      return
+    }
+    if (attemptIndex === getFinalAttemptIndex(task)) {
+      recordTestOptimizationStatus(task, attemptIndex)
+    }
+    switchQuarantinedFinalFailure(task, attemptIndex)
+  })
+}
+
+function applyExecutionChanges (suite) {
+  for (const task of suite?.tasks || []) {
+    if (task.type === 'suite') {
+      applyExecutionChanges(task)
+      continue
+    }
+
+    const testSuite = getTestSuite(task)
+    const testName = getTestName(task)
+    if (attemptToFixTests[testSuite]?.[testName]) {
+      task.retry = 0
+      task.repeats = attemptToFixRetries
+      task.meta.__ddTestOptAtfRetries = attemptToFixRetries
+    } else if (disabledTests[testSuite]?.[testName]) {
+      task.mode = 'skip'
+    } else if (isEarlyFlakeDetectionTest(testSuite, testName)) {
+      task.retry = 0
+      task.repeats = earlyFlakeDetectionRetries
+      task.meta.__ddTestOptEfdRetries = earlyFlakeDetectionRetries
+    }
+  }
+}
+
+function getNextAttemptIndex (task) {
+  const attemptIndex = nextAttemptIndexByTask.get(task) || 0
+  nextAttemptIndexByTask.set(task, attemptIndex + 1)
+  task.meta.__ddTestOptCurrentAttemptIndex = attemptIndex
+  return attemptIndex
+}
+
+function recordTestOptimizationStatus (task, attemptIndex = task.result?.repeatCount || 0, onlyIfNewErrors = false) {
+  const testSuite = getTestSuite(task)
+  const testName = getTestName(task)
+
+  if (attemptToFixTests[testSuite]?.[testName]) {
+    recordAttemptToFixStatus(task, attemptIndex, onlyIfNewErrors)
+  } else if (isEarlyFlakeDetectionTest(testSuite, testName)) {
+    recordEarlyFlakeDetectionStatus(task, attemptIndex, onlyIfNewErrors)
+  } else if (task.repeats > 0) {
+    recordManualRepeatStatus(task, attemptIndex)
+  }
+}
+
+function recordAttemptToFixStatus (task, attemptIndex, onlyIfNewErrors) {
+  if (onlyIfNewErrors && !hasNewErrors(task.meta.__ddTestOptAtfErrorCounts, attemptIndex, task)) {
+    return
+  }
+
+  task.meta.__ddTestOptAtfStatuses ||= []
+  task.meta.__ddTestOptAtfErrorCounts ||= []
+  task.meta.__ddTestOptAtfStatuses[attemptIndex] = getAttemptStatus(
+    task,
+    task.meta.__ddTestOptAtfErrorCounts,
+    attemptIndex
+  )
+  task.meta.__ddTestOptAtfErrorCounts[attemptIndex] = task.result?.errors?.length || 0
+
+  if (
+    attemptIndex === getAttemptToFixRetryCount(task) &&
+    task.meta.__ddTestOptAtfStatuses.includes('fail') &&
+    task.result?.state === 'pass'
+  ) {
+    task.result.state = 'fail'
+  }
+}
+
+function recordEarlyFlakeDetectionStatus (task, attemptIndex, onlyIfNewErrors) {
+  if (restoreEarlyFlakeDetectionSkippedResult(task)) {
+    return
+  }
+
+  const retryCount = earlyFlakeDetectionRetriesByTask.get(task)
+  if (retryCount !== undefined && attemptIndex > retryCount) {
+    return
+  }
+
+  if (onlyIfNewErrors && !hasNewErrors(task.meta.__ddTestOptEfdErrorCounts, attemptIndex, task)) {
+    return
+  }
+
+  if (!earlyFlakeDetectionRetriesByTask.has(task)) {
+    const retryCount = getEarlyFlakeDetectionRetryCount(task)
+    earlyFlakeDetectionRetriesByTask.set(task, retryCount)
+    task.repeats = retryCount
+    task.meta.__ddTestOptEfdRetries = retryCount
+    if (retryCount === 0 && hasEarlyFlakeDetectionSlowRetries) {
+      task.meta.__ddTestOptEfdAbortReason = 'slow'
+    }
+  }
+
+  task.meta.__ddTestOptEfdStatuses ||= []
+  task.meta.__ddTestOptEfdErrorCounts ||= []
+  task.meta.__ddTestOptEfdStatuses[attemptIndex] = getAttemptStatus(
+    task,
+    task.meta.__ddTestOptEfdErrorCounts,
+    attemptIndex
+  )
+  task.meta.__ddTestOptEfdErrorCounts[attemptIndex] = task.result?.errors?.length || 0
+
+  if (attemptIndex === getEarlyFlakeDetectionRetryCountForTask(task) &&
+    task.meta.__ddTestOptEfdStatuses.includes('pass')) {
+    task.result.state = 'pass'
+  }
+}
+
+function recordManualRepeatStatus (task, attemptIndex) {
+  task.meta.__ddTestOptRepeatStatuses ||= []
+  task.meta.__ddTestOptRepeatErrorCounts ||= []
+  task.meta.__ddTestOptRepeatStatuses[attemptIndex] = getManualRepeatStatus(
+    task,
+    task.meta.__ddTestOptRepeatErrorCounts,
+    attemptIndex
+  )
+  task.meta.__ddTestOptRepeatErrorCounts[attemptIndex] = task.result?.errors?.length || 0
+}
+
+function restoreEarlyFlakeDetectionSkippedResult (task) {
+  if (!task.meta.__ddTestOptEfdSkipCurrentAttempt) {
+    return false
+  }
+
+  delete task.meta.__ddTestOptEfdSkipCurrentAttempt
+  const skippedResult = earlyFlakeDetectionSkippedResults.get(task)
+  if (skippedResult) {
+    task.result = skippedResult
+    earlyFlakeDetectionSkippedResults.delete(task)
+  }
+  return true
+}
+
+function hasNewErrors (errorCounts, attemptIndex, task) {
+  const recordedErrorCount = errorCounts?.[attemptIndex]
+  const previousErrorCount = recordedErrorCount ?? getPreviousErrorCount(errorCounts, attemptIndex)
+  return (task.result?.errors?.length || 0) > previousErrorCount
+}
+
+function getFinalAttemptIndex (task) {
+  const testSuite = getTestSuite(task)
+  const testName = getTestName(task)
+
+  if (attemptToFixTests[testSuite]?.[testName]) {
+    return getAttemptToFixRetryCount(task)
+  }
+  if (isEarlyFlakeDetectionTest(testSuite, testName)) {
+    return getEarlyFlakeDetectionRetryCountForTask(task)
+  }
+  return task.repeats
+}
+
+function switchQuarantinedFinalFailure (task, attemptIndex) {
+  const testSuite = getTestSuite(task)
+  const testName = getTestName(task)
+  if (
+    !quarantinedTests[testSuite]?.[testName] ||
+    attemptToFixTests[testSuite]?.[testName] ||
+    task.result?.state !== 'fail'
+  ) {
+    return
+  }
+
+  const retryCount = task.result?.retryCount || 0
+  const retryLimit = task.retry || 0
+  if (retryCount < retryLimit || attemptIndex < getFinalAttemptIndex(task)) {
+    return
+  }
+
+  task.meta.__ddTestOptQuarantinedFailed = true
+  task.result.state = 'pass'
+}
+
+function getAttemptToFixRetryCount (task) {
+  return task.meta.__ddTestOptAtfRetries ?? task.repeats
+}
+
+function getEarlyFlakeDetectionRetryCountForTask (task) {
+  return earlyFlakeDetectionRetriesByTask.get(task) ?? task.meta.__ddTestOptEfdRetries ?? task.repeats
+}
+
+function getAttemptStatus (task, errorCounts, repeatCount) {
+  const errorCount = task.result?.errors?.length || 0
+  if (errorCount > getPreviousErrorCount(errorCounts, repeatCount)) {
+    return 'fail'
+  }
+  return task.result?.state === 'fail' ? 'fail' : 'pass'
+}
+
+function getManualRepeatStatus (task, errorCounts, repeatCount) {
+  const errorCount = task.result?.errors?.length || 0
+  return errorCount > getPreviousErrorCount(errorCounts, repeatCount) ? 'fail' : 'pass'
+}
+
+function getPreviousErrorCount (errorCounts, repeatCount) {
+  for (let index = repeatCount - 1; index >= 0; index--) {
+    if (errorCounts[index] !== undefined) {
+      return errorCounts[index]
+    }
+  }
+  return 0
+}
+
+function prepareEarlyFlakeDetectionAttempt (task, attemptIndex) {
+  if (attemptIndex === 0) {
+    earlyFlakeDetectionStartByTask.set(task, performance.now())
+    return false
+  }
+
+  let retryCount = earlyFlakeDetectionRetriesByTask.get(task)
+  if (retryCount === undefined) {
+    retryCount = getEarlyFlakeDetectionRetryCount(task)
+    earlyFlakeDetectionRetriesByTask.set(task, retryCount)
+    task.repeats = retryCount
+    task.meta.__ddTestOptEfdRetries = retryCount
+    if (retryCount === 0 && hasEarlyFlakeDetectionSlowRetries) {
+      task.meta.__ddTestOptEfdAbortReason = 'slow'
+    }
+  }
+
+  if (attemptIndex <= retryCount) {
+    earlyFlakeDetectionStartByTask.set(task, performance.now())
+    return false
+  }
+
+  if (!canReplaceVitestTaskFn()) {
+    earlyFlakeDetectionStartByTask.set(task, performance.now())
+    return false
+  }
+
+  if (task.result) {
+    earlyFlakeDetectionSkippedResults.set(task, {
+      ...task.result,
+      errors: task.result.errors?.slice(),
+    })
+  }
+  task.meta.__ddTestOptEfdSkipCurrentAttempt = true
+  replaceVitestTaskFn(task, noopTest)
+  return true
+}
+
+function getEarlyFlakeDetectionRetryCount (task) {
+  if (!hasEarlyFlakeDetectionSlowRetries) {
+    return earlyFlakeDetectionRetries
+  }
+
+  const executionStart = earlyFlakeDetectionStartByTask.get(task)
+  const duration = executionStart === undefined ? task.result?.duration ?? 0 : performance.now() - executionStart
+  for (const { key, limitMs } of earlyFlakeDetectionRetryThresholds) {
+    if (duration < limitMs) {
+      return earlyFlakeDetectionSlowRetries[key] ?? 0
+    }
+  }
+  return 0
+}
+
+function noopTest () {}
+
+/**
+ * Returns whether Vitest's private task function setter is available.
+ *
+ * @returns {boolean}
+ */
+function canReplaceVitestTaskFn () {
+  return typeof setVitestTaskFn === 'function'
+}
+
+/**
+ * Replaces the function Vitest runs for a task.
+ *
+ * @param {object} task
+ * @param {(...args: unknown[]) => unknown} testFn
+ */
+function replaceVitestTaskFn (task, testFn) {
+  setVitestTaskFn(task, testFn)
+}
+
+function isEarlyFlakeDetectionTest (testSuite, testName) {
+  if (!isEarlyFlakeDetectionEnabled || earlyFlakeDetectionRetries <= 0) return false
+  if (isModifiedTest(testSuite)) return true
+  const testsForSuite = knownTests[testSuite] || []
+  return !testsForSuite.includes(testName)
+}
+
+function isModifiedTest (testSuite) {
+  return modifiedFiles[testSuite]?.length > 0
+}
+
+function getTestSuite (task) {
+  let filepath = realpaths.get(task.file.filepath)
+  if (filepath === undefined) {
+    filepath = realpath(task.file.filepath)
+    realpaths.set(task.file.filepath, filepath)
+  }
+
+  return normalizePath(relative(repositoryRoot, filepath))
+}
+
+function realpath (filepath) {
+  try {
+    return realpathSync(filepath)
+  } catch {
+    return filepath
+  }
+}
+
+function getTestName (task) {
+  let testName = task.name
+  let currentTask = task.suite
+
+  while (currentTask) {
+    if (currentTask.name) {
+      testName = `${currentTask.name} ${testName}`
+    }
+    currentTask = currentTask.suite
+  }
+
+  return testName
+}
+
+function normalizePath (filepath) {
+  return filepath.replaceAll('\\', '/')
+}
+
+function getIsNoWorkerInitActive () {
+  try {
+    // eslint-disable-next-line eslint-rules/eslint-process-env
+    const value = process.env[VITEST_NO_WORKER_INIT_ACTIVE_ENV]
+    return value === '1' || value === 'true'
+  } catch {
+    return false
+  }
+}
+
+function getProvidedContext () {
+  try {
+    return globalThis.__vitest_worker__.providedContext._ddVitestWorkerSetup || {}
+  } catch {
+    return {}
+  }
+}
diff --git a/docs/test.ts b/docs/test.ts
index c866206fb8..fc987dfa51 100644
--- a/docs/test.ts
+++ b/docs/test.ts
@@ -230,7 +230,8 @@ const graphqlOptions: plugins.graphql = {
   hooks: {
     execute: (span?: Span, args?, res?) => { },
     validate: (span?: Span, document?, errors?) => { },
-    parse: (span?: Span, source?, document?) => { }
+    parse: (span?: Span, source?, document?) => { },
+    resolve: (span?: Span, field?) => { }
   }
 };
 
diff --git a/eslint-rules/eslint-config-names-sync.mjs b/eslint-rules/eslint-config-names-sync.mjs
index cafc034fc1..5f4a93e96d 100644
--- a/eslint-rules/eslint-config-names-sync.mjs
+++ b/eslint-rules/eslint-config-names-sync.mjs
@@ -132,7 +132,9 @@ function getSupportedConfigurationInfo (filePath) {
     const targets = new Set()
 
     for (const entry of entries) {
-      if (typeof entry.internalPropertyName === 'string') {
+      if (typeof entry.namespace === 'string') {
+        targets.add(`${entry.namespace}.${envName}`)
+      } else if (typeof entry.internalPropertyName === 'string') {
         targets.add(entry.internalPropertyName)
       }
 
diff --git a/eslint-rules/fixtures/config-names-sync/internal-env-and-ignored-names/supported-configurations.json b/eslint-rules/fixtures/config-names-sync/internal-env-and-ignored-names/supported-configurations.json
index 5e989725d9..dfaec3cd26 100644
--- a/eslint-rules/fixtures/config-names-sync/internal-env-and-ignored-names/supported-configurations.json
+++ b/eslint-rules/fixtures/config-names-sync/internal-env-and-ignored-names/supported-configurations.json
@@ -2,7 +2,7 @@
   "supportedConfigurations": {
     "DD_LLMOBS_ENABLED": [
       {
-        "internalPropertyName": "llmobs.enabled"
+        "namespace": "llmobs"
       }
     ],
     "DD_LLMOBS_ML_APP": [
diff --git a/eslint.config.mjs b/eslint.config.mjs
index de8e5f5fb6..9d79a8d1f1 100644
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -873,6 +873,11 @@ export default [
     },
   },
   {
+    // These fixture apps import dd-trace the way a customer does
+    // (`require('dd-trace')`), so dd-trace never appears in their own manifest.
+    // Both extraneous-require rules must be off; otherwise the rule fires
+    // whenever dd-trace happens to be resolvable locally (e.g. `yarn link`),
+    // even though CI's clean install keeps it unresolvable.
     name: 'dd-trace/tests/integration-and-resources',
     plugins: {
       import: eslintPluginImport,
@@ -890,6 +895,7 @@ export default [
     ],
     rules: {
       'import/no-extraneous-dependencies': 'off',
+      'n/no-extraneous-require': 'off',
     },
   },
   {
diff --git a/ext/tags.js b/ext/tags.js
index f4a8545f89..bba8933c5a 100644
--- a/ext/tags.js
+++ b/ext/tags.js
@@ -27,6 +27,8 @@ const tags = {
   HTTP_CLIENT_IP: 'http.client_ip',
   NETWORK_CLIENT_IP: 'network.client.ip',
 
+  GRPC_STATUS_CODE: 'grpc.status.code',
+
   // Messaging
 
   // DSM Specific
diff --git a/index.d.ts b/index.d.ts
index 7ad44fc878..87dbcb25f8 100644
--- a/index.d.ts
+++ b/index.d.ts
@@ -2491,6 +2491,18 @@ declare namespace tracer {
     typeResolver?: any,
     }
 
+    /** Context object passed to the `hooks.resolve` callback for each instrumented field. */
+    interface FieldContext {
+      /** The field name being resolved */
+      fieldName: string;
+      /** The dot-separated field path (e.g. `'user.address.city'`) */
+      path: string;
+      /** The error from the resolver, or `null` if it succeeded */
+      error: Error | null;
+      /** The value returned by the resolver (sync resolvers only; `undefined` for async) */
+      result: unknown;
+    }
+
     /**
      * This plugin automatically instruments the
      * [graphql](https://github.com/graphql/graphql-js) module.
@@ -2519,6 +2531,8 @@ declare namespace tracer {
       /**
        * The maximum depth of fields/resolvers to instrument. Set to `0` to only
        * instrument the operation or to `-1` to instrument all fields/resolvers.
+       * Counts selection-set nesting (named fields) only; list indices do not
+       * count toward the limit, regardless of `collapse`.
        *
        * @default -1
        */
@@ -2569,6 +2583,7 @@ declare namespace tracer {
         execute?: (span?: Span, args?: ExecutionArgs, res?: any) => void;
         validate?: (span?: Span, document?: any, errors?: any) => void;
         parse?: (span?: Span, source?: any, document?: any) => void;
+        resolve?: (span?: Span, field?: FieldContext) => void;
       }
     }
 
diff --git a/index.d.v5.ts b/index.d.v5.ts
index ed0c27ac37..e694c3e6ac 100644
--- a/index.d.v5.ts
+++ b/index.d.v5.ts
@@ -2625,6 +2625,18 @@ declare namespace tracer {
     typeResolver?: any,
     }
 
+    /** Context object passed to the `hooks.resolve` callback for each instrumented field. */
+    interface FieldContext {
+      /** The field name being resolved */
+      fieldName: string;
+      /** The dot-separated field path (e.g. `'user.address.city'`) */
+      path: string;
+      /** The error from the resolver, or `null` if it succeeded */
+      error: Error | null;
+      /** The value returned by the resolver (sync resolvers only; `undefined` for async) */
+      result: unknown;
+    }
+
     /**
      * This plugin automatically instruments the
      * [graphql](https://github.com/graphql/graphql-js) module.
@@ -2703,6 +2715,7 @@ declare namespace tracer {
         execute?: (span?: Span, args?: ExecutionArgs, res?: any) => void;
         validate?: (span?: Span, document?: any, errors?: any) => void;
         parse?: (span?: Span, source?: any, document?: any) => void;
+        resolve?: (span?: Span, field?: FieldContext) => void;
       }
     }
 
diff --git a/initialize.mjs b/initialize.mjs
index 9fda189d8c..df0ba5b6aa 100644
--- a/initialize.mjs
+++ b/initialize.mjs
@@ -19,7 +19,7 @@ import { isMainThread } from 'worker_threads'
 // This file must support Node.js 12.0.0 syntax
 
 import {
-  iitmExclusions,
+  iitmExclusionRegExp,
   load as hookLoad,
   resolve as hookResolve,
 } from './loader-hook.mjs'
@@ -67,8 +67,7 @@ const [NODE_MAJOR, NODE_MINOR] = process.versions.node.split('.').map(Number)
 const brokenLoaders = NODE_MAJOR === 18 && NODE_MINOR === 0
 
 export async function load (url, context, nextLoad) {
-  const iitmExclusionsMatch = iitmExclusions.some((exclusion) => exclusion.test(url))
-  const loadHook = (brokenLoaders || iitmExclusionsMatch) ? nextLoad : hookLoad
+  const loadHook = (brokenLoaders || iitmExclusionRegExp.test(url)) ? nextLoad : hookLoad
   return insertInit(await loadHook(url, context, nextLoad), url, context)
 }
 
@@ -78,8 +77,8 @@ if (isMainThread) {
   const require = Module.createRequire(import.meta.url)
   require('./init.js')
   if (Module.register) {
-    Module.register('./loader-hook.mjs', import.meta.url, {
-      data: { exclude: iitmExclusions },
-    })
+    // The loader builds its own include/exclude matcher in `initialize`, so no
+    // options need to cross the registration boundary.
+    Module.register('./loader-hook.mjs', import.meta.url)
   }
 }
diff --git a/integration-tests/ci-visibility/run-tinypool-with-vitest-env.mjs b/integration-tests/ci-visibility/run-tinypool-with-vitest-env.mjs
new file mode 100644
index 0000000000..cadebb61c7
--- /dev/null
+++ b/integration-tests/ci-visibility/run-tinypool-with-vitest-env.mjs
@@ -0,0 +1,19 @@
+import Tinypool from 'tinypool'
+
+const pool = new Tinypool({
+  filename: new URL('./tinypool-app/worker.js', import.meta.url).href,
+  env: {
+    ...process.env,
+    VITEST: 'true',
+  },
+})
+
+const result = await pool.run({ a: 4, b: 6 })
+// eslint-disable-next-line no-console
+console.log('result', result.sum)
+// eslint-disable-next-line no-console
+console.log('dd vitest worker', result.ddVitestWorker)
+
+// Make sure to destroy pool once it's not needed anymore
+// This terminates all pool's idle workers
+await pool.destroy()
diff --git a/integration-tests/ci-visibility/tinypool-app/worker.js b/integration-tests/ci-visibility/tinypool-app/worker.js
new file mode 100644
index 0000000000..b760739d25
--- /dev/null
+++ b/integration-tests/ci-visibility/tinypool-app/worker.js
@@ -0,0 +1,8 @@
+'use strict'
+
+module.exports = ({ a, b }) => {
+  return {
+    sum: a + b,
+    ddVitestWorker: process.env.DD_VITEST_WORKER,
+  }
+}
diff --git a/integration-tests/ci-visibility/vitest-tests-programmatic-api/run-no-worker-programmatic-api-collect-before-run.mjs b/integration-tests/ci-visibility/vitest-tests-programmatic-api/run-no-worker-programmatic-api-collect-before-run.mjs
new file mode 100644
index 0000000000..ca3ff60a43
--- /dev/null
+++ b/integration-tests/ci-visibility/vitest-tests-programmatic-api/run-no-worker-programmatic-api-collect-before-run.mjs
@@ -0,0 +1,34 @@
+import { startVitest } from 'vitest/node'
+
+const testFile = process.env.TEST_DIR || 'ci-visibility/vitest-tests/vitest-worker-env.mjs'
+
+async function runProgrammaticTests () {
+  let vitest
+  let didCollectWithoutFailures = false
+  try {
+    vitest = await startVitest('test', [], {
+      run: false,
+      test: {
+        environment: 'node',
+        pool: process.env.POOL_CONFIG || 'forks',
+      },
+      watch: false,
+    })
+
+    const testSpecifications = await vitest.globTestSpecifications([testFile])
+    await vitest.collectTests(testSpecifications)
+    didCollectWithoutFailures = true
+  } catch (error) {
+    process.stderr.write(`${error?.stack || error}\n`)
+    process.exitCode = 1
+  } finally {
+    if (vitest) {
+      await vitest.close()
+    }
+    if (didCollectWithoutFailures) {
+      process.exit(0)
+    }
+  }
+}
+
+runProgrammaticTests()
diff --git a/integration-tests/ci-visibility/vitest-tests-programmatic-api/run-programmatic-api-rerun.mjs b/integration-tests/ci-visibility/vitest-tests-programmatic-api/run-programmatic-api-rerun.mjs
new file mode 100644
index 0000000000..4568f922e4
--- /dev/null
+++ b/integration-tests/ci-visibility/vitest-tests-programmatic-api/run-programmatic-api-rerun.mjs
@@ -0,0 +1,26 @@
+import { createVitest } from 'vitest/node'
+
+async function runProgrammaticTests () {
+  let vitest
+  try {
+    vitest = await createVitest('test', {
+      test: {
+        environment: 'node',
+      },
+      watch: false,
+    })
+
+    await vitest.standalone()
+    await vitest.runTestFiles(['./test-programmatic-api-first.mjs'])
+    await vitest.runTestFiles(['./test-programmatic-api-second.mjs'])
+  } catch (error) {
+    process.stderr.write(`${error?.stack || error}\n`)
+    process.exitCode = 1
+  } finally {
+    if (vitest) {
+      await vitest.close()
+    }
+  }
+}
+
+runProgrammaticTests()
diff --git a/integration-tests/ci-visibility/vitest-tests-programmatic-api/test-programmatic-api-first.mjs b/integration-tests/ci-visibility/vitest-tests-programmatic-api/test-programmatic-api-first.mjs
new file mode 100644
index 0000000000..6bd7c397b4
--- /dev/null
+++ b/integration-tests/ci-visibility/vitest-tests-programmatic-api/test-programmatic-api-first.mjs
@@ -0,0 +1,7 @@
+import { describe, expect, test } from 'vitest'
+
+describe('programmatic api first run', () => {
+  test('can pass before a rerun', () => {
+    expect(1 + 1).toBe(2)
+  })
+})
diff --git a/integration-tests/ci-visibility/vitest-tests-programmatic-api/test-programmatic-api-second.mjs b/integration-tests/ci-visibility/vitest-tests-programmatic-api/test-programmatic-api-second.mjs
new file mode 100644
index 0000000000..d77088a975
--- /dev/null
+++ b/integration-tests/ci-visibility/vitest-tests-programmatic-api/test-programmatic-api-second.mjs
@@ -0,0 +1,7 @@
+import { describe, test } from 'vitest'
+
+describe('programmatic api second run', () => {
+  test('is disabled by Test Management', () => {
+    throw new Error('This test should have been disabled by Test Management.')
+  })
+})
diff --git a/integration-tests/ci-visibility/vitest-tests/failed-suite-hook.mjs b/integration-tests/ci-visibility/vitest-tests/failed-suite-hook.mjs
new file mode 100644
index 0000000000..10e933ca28
--- /dev/null
+++ b/integration-tests/ci-visibility/vitest-tests/failed-suite-hook.mjs
@@ -0,0 +1,11 @@
+import { beforeAll, describe, expect, test } from 'vitest'
+
+describe('failed suite hook', () => {
+  beforeAll(() => {
+    throw new Error('failed before all')
+  })
+
+  test('does not run the test body', () => {
+    expect(1 + 2).toBe(3)
+  })
+})
diff --git a/integration-tests/ci-visibility/vitest-tests/no-worker-suite-context-a-slow.mjs b/integration-tests/ci-visibility/vitest-tests/no-worker-suite-context-a-slow.mjs
new file mode 100644
index 0000000000..f58627ff84
--- /dev/null
+++ b/integration-tests/ci-visibility/vitest-tests/no-worker-suite-context-a-slow.mjs
@@ -0,0 +1,8 @@
+import { describe, expect, test } from 'vitest'
+
+describe('no-worker suite context slow', () => {
+  test('reports the slow suite test', async () => {
+    await new Promise(resolve => setTimeout(resolve, 20))
+    expect(1 + 2).toBe(3)
+  })
+})
diff --git a/integration-tests/ci-visibility/vitest-tests/no-worker-suite-context-b-fast.mjs b/integration-tests/ci-visibility/vitest-tests/no-worker-suite-context-b-fast.mjs
new file mode 100644
index 0000000000..7df12b6caf
--- /dev/null
+++ b/integration-tests/ci-visibility/vitest-tests/no-worker-suite-context-b-fast.mjs
@@ -0,0 +1,7 @@
+import { describe, expect, test } from 'vitest'
+
+describe('no-worker suite context fast', () => {
+  test('reports the fast suite test', () => {
+    expect(1 + 2).toBe(3)
+  })
+})
diff --git a/integration-tests/ci-visibility/vitest-tests/slow-failing-retry.mjs b/integration-tests/ci-visibility/vitest-tests/slow-failing-retry.mjs
new file mode 100644
index 0000000000..13eea975c6
--- /dev/null
+++ b/integration-tests/ci-visibility/vitest-tests/slow-failing-retry.mjs
@@ -0,0 +1,16 @@
+import { describe, expect, test } from 'vitest'
+
+let attempt = 0
+
+function wait (ms) {
+  return new Promise(resolve => setTimeout(resolve, ms))
+}
+
+describe('slow failing retry', () => {
+  test('does not double report final failed retry', async () => {
+    if (attempt++ > 0) {
+      await wait(200)
+    }
+    expect(1).to.equal(2)
+  })
+})
diff --git a/integration-tests/ci-visibility/vitest-tests/string-setup-file.mjs b/integration-tests/ci-visibility/vitest-tests/string-setup-file.mjs
new file mode 100644
index 0000000000..8d79db5043
--- /dev/null
+++ b/integration-tests/ci-visibility/vitest-tests/string-setup-file.mjs
@@ -0,0 +1 @@
+globalThis.__ddStringSetupFileLoaded = true
diff --git a/integration-tests/ci-visibility/vitest-tests/typecheck-fail.test-d.ts b/integration-tests/ci-visibility/vitest-tests/typecheck-fail.test-d.ts
new file mode 100644
index 0000000000..174f0f1256
--- /dev/null
+++ b/integration-tests/ci-visibility/vitest-tests/typecheck-fail.test-d.ts
@@ -0,0 +1,5 @@
+import { expectTypeOf, test } from 'vitest'
+
+test('typecheck can report failing assertion', () => {
+  expectTypeOf({ value: 'not ok' }).toEqualTypeOf<{ value: number }>()
+})
diff --git a/integration-tests/ci-visibility/vitest-tests/typecheck-test-management-fail.test-d.ts b/integration-tests/ci-visibility/vitest-tests/typecheck-test-management-fail.test-d.ts
new file mode 100644
index 0000000000..cbf7bdc793
--- /dev/null
+++ b/integration-tests/ci-visibility/vitest-tests/typecheck-test-management-fail.test-d.ts
@@ -0,0 +1,15 @@
+import { describe, expectTypeOf, test } from 'vitest'
+
+test('typecheck can report disabled failing assertion', () => {
+  expectTypeOf({ value: 'disabled fail' }).toEqualTypeOf<{ value: number }>()
+})
+
+test('typecheck can report quarantined failing assertion', () => {
+  expectTypeOf({ value: 'quarantined fail' }).toEqualTypeOf<{ value: number }>()
+})
+
+describe('typecheck nested failing suite', () => {
+  test('can report nested disabled failing assertion', () => {
+    expectTypeOf({ value: 'nested disabled fail' }).toEqualTypeOf<{ value: number }>()
+  })
+})
diff --git a/integration-tests/ci-visibility/vitest-tests/typecheck-test-management-file-fail.test-d.ts b/integration-tests/ci-visibility/vitest-tests/typecheck-test-management-file-fail.test-d.ts
new file mode 100644
index 0000000000..3ed1a94e38
--- /dev/null
+++ b/integration-tests/ci-visibility/vitest-tests/typecheck-test-management-file-fail.test-d.ts
@@ -0,0 +1,13 @@
+import { describe, expectTypeOf, test } from 'vitest'
+
+const fileLevelTypeError: number = 'file-level typecheck error'
+
+describe('typecheck container failing suite', () => {
+  test('can report disabled assertion with file-level error', () => {
+    expectTypeOf({ value: 'disabled pass' }).toEqualTypeOf<{ value: string }>()
+  })
+
+  test('can report quarantined assertion with file-level error', () => {
+    expectTypeOf({ value: 'quarantined pass' }).toEqualTypeOf<{ value: string }>()
+  })
+})
diff --git a/integration-tests/ci-visibility/vitest-tests/typecheck.test-d.ts b/integration-tests/ci-visibility/vitest-tests/typecheck.test-d.ts
new file mode 100644
index 0000000000..e075e872ab
--- /dev/null
+++ b/integration-tests/ci-visibility/vitest-tests/typecheck.test-d.ts
@@ -0,0 +1,31 @@
+import { describe, expectTypeOf, test } from 'vitest'
+
+test('typecheck can report type assertion', () => {
+  expectTypeOf({ value: 'ok' }).toEqualTypeOf<{ value: string }>()
+})
+
+test('typecheck can report disabled assertion', () => {
+  expectTypeOf({ value: 'disabled' }).toEqualTypeOf<{ value: string }>()
+})
+
+test('typecheck can report quarantined assertion', () => {
+  expectTypeOf({ value: 'quarantined' }).toEqualTypeOf<{ value: string }>()
+})
+
+test('typecheck can report attempt-to-fix assertion', () => {
+  expectTypeOf({ value: 'attempt-to-fix' }).toEqualTypeOf<{ value: string }>()
+})
+
+test.skip('typecheck can report skipped assertion', () => {
+  expectTypeOf({ value: 'skipped' }).toEqualTypeOf<{ value: string }>()
+})
+
+describe('typecheck nested suite', () => {
+  test('can report nested assertion', () => {
+    expectTypeOf({ value: 'nested' }).toEqualTypeOf<{ value: string }>()
+  })
+
+  test('can report nested disabled assertion', () => {
+    expectTypeOf({ value: 'nested disabled' }).toEqualTypeOf<{ value: string }>()
+  })
+})
diff --git a/integration-tests/ci-visibility/vitest-tests/uses-string-setup-file.mjs b/integration-tests/ci-visibility/vitest-tests/uses-string-setup-file.mjs
new file mode 100644
index 0000000000..e7c738096d
--- /dev/null
+++ b/integration-tests/ci-visibility/vitest-tests/uses-string-setup-file.mjs
@@ -0,0 +1,7 @@
+import { describe, expect, test } from 'vitest'
+
+describe('string setup file', () => {
+  test('keeps the configured setup file', () => {
+    expect(globalThis.__ddStringSetupFileLoaded).toBe(true)
+  })
+})
diff --git a/integration-tests/ci-visibility/vitest-tests/vitest-worker-env.mjs b/integration-tests/ci-visibility/vitest-tests/vitest-worker-env.mjs
index d8c1c4f97d..575603df34 100644
--- a/integration-tests/ci-visibility/vitest-tests/vitest-worker-env.mjs
+++ b/integration-tests/ci-visibility/vitest-tests/vitest-worker-env.mjs
@@ -1,7 +1,35 @@
 import { describe, expect, it } from 'vitest'
 
+function wait (ms) {
+  return new Promise(resolve => setTimeout(resolve, ms))
+}
+
 describe('vitest worker env', () => {
-  it('sets DD_VITEST_WORKER', () => {
+  it('sets DD_VITEST_WORKER', async () => {
+    if (process.env.WAIT_BEFORE_EXPECTATION_MS) {
+      await wait(Number(process.env.WAIT_BEFORE_EXPECTATION_MS))
+    }
+
     expect(process.env.DD_VITEST_WORKER).toBe('1')
+
+    if (process.env.EXPECT_DD_TEST_OPT_VITEST_NO_WORKER_INIT_ACTIVE) {
+      expect(process.env.DD_TEST_OPT_VITEST_NO_WORKER_INIT_ACTIVE).toBe('1')
+    }
+
+    if (process.env.EXPECT_DD_TEST_OPT_VITEST_NO_WORKER_INIT_INACTIVE) {
+      expect(process.env.DD_TEST_OPT_VITEST_NO_WORKER_INIT_ACTIVE).toBeUndefined()
+    }
+
+    if (process.env.EXPECT_NO_DD_TRACE_INIT) {
+      expect(globalThis._ddtrace).toBeUndefined()
+    }
+
+    if (process.env.EXPECT_DD_NODE_OPTIONS_STRIPPED) {
+      expect(process.env.NODE_OPTIONS || '').not.toMatch(/dd-trace\/(?:register\.js|ci\/init(?:\.js)?)/)
+    }
+
+    if (process.env.EXPECT_DD_NODE_OPTIONS_PRESERVED) {
+      expect(process.env.NODE_OPTIONS || '').toContain(process.env.EXPECT_DD_NODE_OPTIONS_PRESERVED)
+    }
   })
 })
diff --git a/integration-tests/code-origin/express-app.js b/integration-tests/code-origin/express-app.js
index 73166ea978..ce59fed22f 100644
--- a/integration-tests/code-origin/express-app.js
+++ b/integration-tests/code-origin/express-app.js
@@ -16,7 +16,7 @@ app.get('/config', (req, res) => {
   const config = tracer._tracer._config
   res.json({
     codeOriginEnabled: config.codeOriginForSpans.enabled,
-    remoteConfigEnabled: config.remoteConfig.enabled,
+    remoteConfigEnabled: config.remoteConfig.DD_REMOTE_CONFIGURATION_ENABLED,
   })
 })
 
diff --git a/integration-tests/code-origin/fastify-app.js b/integration-tests/code-origin/fastify-app.js
index 1b37424137..1ce60074ec 100644
--- a/integration-tests/code-origin/fastify-app.js
+++ b/integration-tests/code-origin/fastify-app.js
@@ -17,7 +17,7 @@ app.get('/config', (req, res) => {
   const config = tracer._tracer._config
   res.send({
     codeOriginEnabled: config.codeOriginForSpans.enabled,
-    remoteConfigEnabled: config.remoteConfig.enabled,
+    remoteConfigEnabled: config.remoteConfig.DD_REMOTE_CONFIGURATION_ENABLED,
   })
 })
 
diff --git a/integration-tests/cypress.config.js b/integration-tests/cypress.config.js
index 3f18cb567a..026718e78e 100644
--- a/integration-tests/cypress.config.js
+++ b/integration-tests/cypress.config.js
@@ -26,6 +26,34 @@ module.exports = defineConfig({
           return ddAfterSpec(...args)
         })
       }
+      if (process.env.CYPRESS_DD_BEFORE_EACH_NO_RESULT_ONCE) {
+        const ddTracePlugin = require('dd-trace/ci/cypress/plugin')
+        let ddBeforeEachCalls = 0
+
+        const wrappedOn = (event, handler) => {
+          if (event !== 'task' || !handler['dd:beforeEach']) {
+            on(event, handler)
+            return
+          }
+
+          const ddBeforeEach = handler['dd:beforeEach']
+          on('task', {
+            ...handler,
+            'dd:beforeEach': (test) => {
+              ddBeforeEachCalls++
+              // eslint-disable-next-line no-console
+              console.log(`[datadog:test] dd:beforeEach call ${ddBeforeEachCalls}`)
+              const result = ddBeforeEach(test)
+              if (ddBeforeEachCalls === 1) {
+                return null
+              }
+              return result
+            },
+          })
+        }
+
+        return ddTracePlugin(wrappedOn, config)
+      }
       if (process.env.CYPRESS_ENABLE_MANUAL_PLUGIN) {
         return require('dd-trace/ci/cypress/plugin')(on, config)
       }
diff --git a/integration-tests/cypress/cypress-itr.spec.js b/integration-tests/cypress/cypress-itr.spec.js
index 0f785106e3..926ce22486 100644
--- a/integration-tests/cypress/cypress-itr.spec.js
+++ b/integration-tests/cypress/cypress-itr.spec.js
@@ -4,6 +4,7 @@ const assert = require('node:assert/strict')
 const { exec } = require('node:child_process')
 const { once } = require('node:events')
 
+const semver = require('semver')
 const {
   sandboxCwd,
   useSandbox,
@@ -33,6 +34,7 @@ const oldestVersion = DD_MAJOR >= 6 ? '12.0.0' : '6.7.0'
 const version = requestedVersion === 'oldest' ? oldestVersion : requestedVersion
 const hookFile = 'dd-trace/loader-hook.mjs'
 const CYPRESS_RUN_HARD_TIMEOUT = 70_000
+const over12It = (version === 'latest' || semver.gte(version, '12.0.0')) ? it : it.skip
 
 function assertItrSkippingEnabledTags (events, expected) {
   const testSuite = events.find(event => event.type === 'test_suite_end').content
@@ -272,6 +274,73 @@ moduleTypes.forEach(({
         ])
       })
 
+      over12It('does not count ITR-skipped tests twice when retrying a missing dd:beforeEach result', async () => {
+        receiver.setSuitesToSkip([
+          {
+            type: 'test',
+            attributes: {
+              name: 'context passes',
+              suite: 'cypress/e2e/other.cy.js',
+            },
+          },
+          {
+            type: 'test',
+            attributes: {
+              name: 'basic pass suite can pass',
+              suite: 'cypress/e2e/basic-pass.js',
+            },
+          },
+        ])
+
+        const envVars = getCiVisAgentlessConfig(receiver.port)
+        let testOutput = ''
+
+        childProcess = exec(
+          testCommand,
+          {
+            cwd,
+            env: {
+              ...envVars,
+              CYPRESS_BASE_URL: webAppBaseUrl,
+              CYPRESS_DD_BEFORE_EACH_NO_RESULT_ONCE: '1',
+              SPEC_PATTERN: 'cypress/e2e/{basic-pass,other.cy}.js',
+            },
+          }
+        )
+        childProcess.stdout?.on('data', (data) => { testOutput += data })
+        childProcess.stderr?.on('data', (data) => { testOutput += data })
+
+        const eventsPromise = gatherCypressPayloads(receiver, childProcess, '/api/v2/citestcycle', payloads => {
+          const events = payloads.flatMap(({ payload }) => payload.events)
+          const skippedTest = events.find(event =>
+            event.content.resource === 'cypress/e2e/other.cy.js.context passes'
+          ).content
+          assert.strictEqual(skippedTest.meta[TEST_STATUS], 'skip')
+          assert.strictEqual(skippedTest.meta[TEST_SKIPPED_BY_ITR], 'true')
+
+          const skippedTestInOtherSpec = events.find(event =>
+            event.content.resource === 'cypress/e2e/basic-pass.js.basic pass suite can pass'
+          ).content
+          assert.strictEqual(skippedTestInOtherSpec.meta[TEST_STATUS], 'skip')
+          assert.strictEqual(skippedTestInOtherSpec.meta[TEST_SKIPPED_BY_ITR], 'true')
+
+          const testSession = events.find(event => event.type === 'test_session_end').content
+          assert.strictEqual(testSession.metrics[TEST_ITR_SKIPPING_COUNT], 2)
+
+          const testModule = events.find(event => event.type === 'test_module_end').content
+          assert.strictEqual(testModule.metrics[TEST_ITR_SKIPPING_COUNT], 2)
+        })
+
+        const [[exitCode]] = await Promise.all([
+          once(childProcess, 'exit'),
+          eventsPromise,
+        ])
+
+        assert.strictEqual(exitCode, 0, 'cypress process should exit successfully')
+        assert.match(testOutput, /\[datadog:test\] dd:beforeEach call 1/)
+        assert.match(testOutput, /\[datadog:test\] dd:beforeEach call 2/)
+      })
+
       it('does not skip tests if test skipping is disabled by the API', async () => {
         let hasRequestedSkippable = false
         receiver.setSettings({
diff --git a/integration-tests/cypress/cypress-reporting-instrumentation.spec.js b/integration-tests/cypress/cypress-reporting-instrumentation.spec.js
index 70cf1f6d14..37d3457f41 100644
--- a/integration-tests/cypress/cypress-reporting-instrumentation.spec.js
+++ b/integration-tests/cypress/cypress-reporting-instrumentation.spec.js
@@ -317,6 +317,54 @@ moduleTypes.forEach(({
       }
     })
 
+    over10It('retries when dd:beforeEach returns no result once', async () => {
+      const envVars = getCiVisAgentlessConfig(receiver.port)
+      let testOutput = ''
+
+      childProcess = exec(testCommand, {
+        cwd,
+        env: {
+          ...envVars,
+          CYPRESS_BASE_URL: webAppBaseUrl,
+          CYPRESS_DD_BEFORE_EACH_NO_RESULT_ONCE: '1',
+          SPEC_PATTERN: 'cypress/e2e/basic-pass.js',
+        },
+      })
+      childProcess.stdout?.on('data', (data) => { testOutput += data })
+      childProcess.stderr?.on('data', (data) => { testOutput += data })
+
+      const receiverPromise = receiver
+        .gatherPayloadsUntilChildExit(
+          childProcess,
+          ({ url }) => url.endsWith('/api/v2/citestcycle'),
+          (payloads) => {
+            const events = payloads
+              .flatMap(({ payload }) => payload.events)
+              .filter(event => event.type === 'test')
+            const passedTest = events.find(event =>
+              event.content.resource === 'cypress/e2e/basic-pass.js.basic pass suite can pass'
+            )
+
+            assertObjectContains(passedTest?.content, {
+              meta: {
+                [TEST_STATUS]: 'pass',
+                [TEST_FRAMEWORK]: 'cypress',
+              },
+            })
+          },
+          { hardTimeout: 60000 }
+        )
+
+      const [[exitCode]] = await Promise.all([
+        once(childProcess, 'exit'),
+        receiverPromise,
+      ])
+
+      assert.strictEqual(exitCode, 0, 'cypress process should exit successfully')
+      assert.match(testOutput, /\[datadog:test\] dd:beforeEach call 1/)
+      assert.match(testOutput, /\[datadog:test\] dd:beforeEach call 2/)
+    })
+
     over10It('preserves config returned from setupNodeEvents', async () => {
       const envVars = getCiVisAgentlessConfig(receiver.port)
 
diff --git a/integration-tests/esbuild/package.json b/integration-tests/esbuild/package.json
index 77865df969..65259e103c 100644
--- a/integration-tests/esbuild/package.json
+++ b/integration-tests/esbuild/package.json
@@ -29,6 +29,6 @@
     "express": "4.22.2",
     "knex": "3.2.10",
     "koa": "3.2.1",
-    "openai": "6.44.0"
+    "openai": "6.45.0"
   }
 }
diff --git a/integration-tests/tsconfig.typecheck-fail.json b/integration-tests/tsconfig.typecheck-fail.json
new file mode 100644
index 0000000000..fc4af06261
--- /dev/null
+++ b/integration-tests/tsconfig.typecheck-fail.json
@@ -0,0 +1,6 @@
+{
+  "extends": "./tsconfig.typecheck.json",
+  "include": [
+    "ci-visibility/vitest-tests/typecheck-fail.test-d.ts"
+  ]
+}
diff --git a/integration-tests/tsconfig.typecheck-test-management-fail.json b/integration-tests/tsconfig.typecheck-test-management-fail.json
new file mode 100644
index 0000000000..e50338f793
--- /dev/null
+++ b/integration-tests/tsconfig.typecheck-test-management-fail.json
@@ -0,0 +1,6 @@
+{
+  "extends": "./tsconfig.typecheck.json",
+  "include": [
+    "ci-visibility/vitest-tests/typecheck-test-management-fail.test-d.ts"
+  ]
+}
diff --git a/integration-tests/tsconfig.typecheck-test-management-file-fail.json b/integration-tests/tsconfig.typecheck-test-management-file-fail.json
new file mode 100644
index 0000000000..6953c19171
--- /dev/null
+++ b/integration-tests/tsconfig.typecheck-test-management-file-fail.json
@@ -0,0 +1,6 @@
+{
+  "extends": "./tsconfig.typecheck.json",
+  "include": [
+    "ci-visibility/vitest-tests/typecheck-test-management-file-fail.test-d.ts"
+  ]
+}
diff --git a/integration-tests/tsconfig.typecheck.json b/integration-tests/tsconfig.typecheck.json
new file mode 100644
index 0000000000..c425c4a75c
--- /dev/null
+++ b/integration-tests/tsconfig.typecheck.json
@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "skipLibCheck": true,
+    "strict": true,
+    "target": "ES2022",
+    "types": [
+      "vitest"
+    ]
+  },
+  "include": [
+    "ci-visibility/vitest-tests/typecheck.test-d.ts"
+  ]
+}
diff --git a/integration-tests/vitest.config.mjs b/integration-tests/vitest.config.mjs
index 6606fce124..1916d61b77 100644
--- a/integration-tests/vitest.config.mjs
+++ b/integration-tests/vitest.config.mjs
@@ -19,11 +19,31 @@ const config = {
     include: [
       process.env.TEST_DIR || 'ci-visibility/vitest-tests/test-visibility*',
     ],
-    pool: process.env.POOL_CONFIG || 'forks',
     reporters: ['default'],
   },
 }
 
+const poolConfig = process.env.POOL_CONFIG || 'forks'
+if (!process.env.USE_VITEST_DEFAULT_POOL) {
+  config.test.pool = poolConfig
+}
+
+if (process.env.NO_ISOLATE) {
+  config.test.isolate = false
+}
+
+if (process.env.POOL_NO_ISOLATE) {
+  config.test.poolOptions = {
+    [poolConfig]: {
+      isolate: false,
+    },
+  }
+}
+
+if (process.env.VITEST_SETUP_FILE) {
+  config.test.setupFiles = process.env.VITEST_SETUP_FILE
+}
+
 if (process.env.CUSTOM_SEQUENCER) {
   config.test.sequence = {
     sequencer: CustomSequencer,
@@ -44,6 +64,16 @@ if (process.env.PROJECT_POOL_CONFIG) {
   if (process.env.PROJECT_RETRY_CONFIG) {
     firstProjectConfig.retry = Number(process.env.PROJECT_RETRY_CONFIG)
   }
+  if (process.env.PROJECT_NO_ISOLATE) {
+    firstProjectConfig.isolate = false
+  }
+  if (process.env.PROJECT_POOL_NO_ISOLATE) {
+    firstProjectConfig.poolOptions = {
+      [firstProjectConfig.pool]: {
+        isolate: false,
+      },
+    }
+  }
   projectConfigs.push({ test: firstProjectConfig })
 
   if (process.env.SECOND_PROJECT_CONFIG_FILE) {
diff --git a/integration-tests/vitest.typecheck.config.mjs b/integration-tests/vitest.typecheck.config.mjs
new file mode 100644
index 0000000000..170be2cbfa
--- /dev/null
+++ b/integration-tests/vitest.typecheck.config.mjs
@@ -0,0 +1,42 @@
+import { defineConfig } from 'vite'
+
+const typecheckFixture = process.env.TYPECHECK_FAIL === 'true'
+  ? 'fail'
+  : process.env.TYPECHECK_TEST_MANAGEMENT_FAIL === 'true'
+    ? 'testManagementFail'
+    : process.env.TYPECHECK_TEST_MANAGEMENT_FILE_FAIL === 'true'
+      ? 'testManagementFileFail'
+      : 'default'
+
+const typecheckFixtures = {
+  default: {
+    typecheckFile: 'ci-visibility/vitest-tests/typecheck.test-d.ts',
+    tsconfig: 'tsconfig.typecheck.json',
+  },
+  fail: {
+    typecheckFile: 'ci-visibility/vitest-tests/typecheck-fail.test-d.ts',
+    tsconfig: 'tsconfig.typecheck-fail.json',
+  },
+  testManagementFail: {
+    typecheckFile: 'ci-visibility/vitest-tests/typecheck-test-management-fail.test-d.ts',
+    tsconfig: 'tsconfig.typecheck-test-management-fail.json',
+  },
+  testManagementFileFail: {
+    typecheckFile: 'ci-visibility/vitest-tests/typecheck-test-management-file-fail.test-d.ts',
+    tsconfig: 'tsconfig.typecheck-test-management-file-fail.json',
+  },
+}
+
+const { typecheckFile, tsconfig } = typecheckFixtures[typecheckFixture]
+
+export default defineConfig({
+  test: {
+    include: [],
+    typecheck: {
+      checker: 'tsc',
+      enabled: true,
+      include: [typecheckFile],
+      tsconfig,
+    },
+  },
+})
diff --git a/integration-tests/vitest/vitest.advanced.spec.js b/integration-tests/vitest/vitest.advanced.spec.js
index ab42de1c6d..50e925a896 100644
--- a/integration-tests/vitest/vitest.advanced.spec.js
+++ b/integration-tests/vitest/vitest.advanced.spec.js
@@ -54,6 +54,7 @@ versions.forEach((version) => {
   describe(`vitest@${version}`, () => {
     let cwd, receiver, childProcess, testOutput
     const vitestProjectsIt = version === 'latest' && NODE_MAJOR >= 20 ? it : it.skip
+    const latestVitestIt = version === 'latest' ? it : it.skip
 
     useSandbox([
       `vitest@${version}`,
@@ -315,6 +316,25 @@ versions.forEach((version) => {
       })
     })
 
+    it('does not mark application tinypool workers as Vitest workers', (done) => {
+      childProcess = exec('node ./ci-visibility/run-tinypool-with-vitest-env.mjs', {
+        cwd,
+        env: getCiVisAgentlessConfig(receiver.port),
+      })
+      childProcess.stdout?.on('data', (chunk) => {
+        testOutput += chunk.toString()
+      })
+      childProcess.stderr?.on('data', (chunk) => {
+        testOutput += chunk.toString()
+      })
+      childProcess.on('exit', (code) => {
+        assert.match(testOutput, /result 10/)
+        assert.match(testOutput, /dd vitest worker undefined/)
+        assert.strictEqual(code, 0)
+        done()
+      })
+    })
+
     context('programmatic api', () => {
       it('can report data using the vitest programmatic api', async () => {
         const eventsPromise = receiver
@@ -347,7 +367,7 @@ versions.forEach((version) => {
             env: {
               ...getCiVisAgentlessConfig(receiver.port),
               NODE_OPTIONS: '--import dd-trace/register.js -r dd-trace/ci/init',
-              TEST_DIR: './test-programmatic-api*',
+              TEST_DIR: './test-programmatic-api.mjs',
             },
           }
         )
@@ -357,6 +377,75 @@ versions.forEach((version) => {
           once(childProcess, 'exit'),
         ])
       })
+
+      latestVitestIt('refreshes metadata when the vitest programmatic api reruns different files', async () => {
+        const disabledTestName = 'programmatic api second run is disabled by Test Management'
+        receiver.setSettings({
+          test_management: {
+            enabled: true,
+          },
+        })
+        receiver.setTestManagementTests({
+          vitest: {
+            suites: {
+              'ci-visibility/vitest-tests-programmatic-api/test-programmatic-api-second.mjs': {
+                tests: {
+                  [disabledTestName]: {
+                    properties: {
+                      disabled: true,
+                    },
+                  },
+                },
+              },
+            },
+          },
+        })
+
+        const eventsPromise = receiver
+          .gatherPayloadsMaxTimeout(({ url }) => url === '/api/v2/citestcycle', payloads => {
+            const events = payloads.flatMap(({ payload }) => payload.events)
+            const tests = events
+              .filter(event => event.type === 'test')
+              .map(test => test.content)
+              .filter(test => test.meta[TEST_SOURCE_FILE].startsWith(
+                'ci-visibility/vitest-tests-programmatic-api/test-programmatic-api-'
+              ))
+
+            const testDetails = events
+              .filter(event => event.type === 'test')
+              .map(test => ({
+                name: test.content.meta[TEST_NAME],
+                sourceFile: test.content.meta[TEST_SOURCE_FILE],
+              }))
+            assert.strictEqual(tests.length, 2, inspect(testDetails))
+
+            const disabledTest = tests.find(test => test.meta[TEST_NAME] === disabledTestName)
+            assert.ok(disabledTest, inspect(tests.map(test => test.meta[TEST_NAME])))
+            assert.strictEqual(disabledTest.meta[TEST_STATUS], 'skip')
+            assert.strictEqual(disabledTest.meta[TEST_MANAGEMENT_IS_DISABLED], 'true')
+          })
+
+        childProcess = exec(
+          'node run-programmatic-api-rerun.mjs',
+          {
+            cwd: `${cwd}/ci-visibility/vitest-tests-programmatic-api`,
+            env: {
+              ...getCiVisAgentlessConfig(receiver.port),
+              NODE_OPTIONS: '--import dd-trace/register.js -r dd-trace/ci/init',
+              TEST_DIR: './test-programmatic-api-*',
+            },
+          }
+        )
+        childProcess.stdout.on('data', data => { testOutput += data })
+        childProcess.stderr.on('data', data => { testOutput += data })
+
+        const [[exitCode]] = await Promise.all([
+          once(childProcess, 'exit'),
+          eventsPromise,
+        ])
+
+        assert.strictEqual(exitCode, 0, testOutput)
+      })
     })
 
     // Coverage report upload only works for >=2.0.0 (when vitest has proper coverage support)
diff --git a/integration-tests/vitest/vitest.core.spec.js b/integration-tests/vitest/vitest.core.spec.js
index c952f1ce81..27a597f10e 100644
--- a/integration-tests/vitest/vitest.core.spec.js
+++ b/integration-tests/vitest/vitest.core.spec.js
@@ -1,8 +1,10 @@
 'use strict'
 
 const assert = require('node:assert/strict')
+const { exec, execSync } = require('node:child_process')
 const { once } = require('node:events')
-const { exec } = require('child_process')
+const fs = require('node:fs')
+const path = require('node:path')
 const { inspect } = require('node:util')
 const { assertObjectContains } = require('../helpers')
 
@@ -28,6 +30,7 @@ const {
   TEST_COMMAND,
   TEST_SOURCE_FILE,
   TEST_SOURCE_START,
+  TEST_IS_MODIFIED,
   TEST_IS_NEW,
   TEST_NAME,
   TEST_EARLY_FLAKE_ENABLED,
@@ -43,6 +46,10 @@ const {
   TEST_HAS_FAILED_ALL_RETRIES,
   TEST_RETRY_REASON_TYPES,
   TEST_HAS_DYNAMIC_NAME,
+  TEST_FINAL_STATUS,
+  TEST_MANAGEMENT_IS_ATTEMPT_TO_FIX,
+  TEST_MANAGEMENT_IS_DISABLED,
+  TEST_MANAGEMENT_IS_QUARANTINED,
   VITEST_POOL,
   TEST_IS_TEST_FRAMEWORK_WORKER,
   DD_CI_LIBRARY_CONFIGURATION_ERROR_SETTINGS,
@@ -62,6 +69,43 @@ const FLAKY_UNNECESSARY_RETRY_RESOURCE =
   'ci-visibility/vitest-tests/flaky-test-retries.mjs.flaky test retries does not retry if unnecessary'
 const linePctMatchRegex = /Lines\s+:\s+([\d.]+)%/
 
+function assertCompleteEventHierarchy (events, testOutput) {
+  const testSessionEvent = events.find(event => event.type === 'test_session_end')
+  const testModuleEvent = events.find(event => event.type === 'test_module_end')
+  const testSuiteEvent = events.find(event => event.type === 'test_suite_end')
+  const testEvents = events.filter(event => event.type === 'test')
+
+  assert.ok(testSessionEvent, testOutput)
+  assert.ok(testModuleEvent, testOutput)
+  assert.ok(testSuiteEvent, testOutput)
+  assert.ok(testEvents.length, testOutput)
+
+  const testSession = testSessionEvent.content
+  const testModule = testModuleEvent.content
+  const testSuite = testSuiteEvent.content
+  const tests = testEvents.map(event => event.content)
+  const testSessionId = testSession.test_session_id.toString()
+  const testModuleId = testModule.test_module_id.toString()
+  const testSuiteId = testSuite.test_suite_id.toString()
+
+  assert.strictEqual(testModule.test_session_id.toString(), testSessionId)
+  assert.strictEqual(testSuite.test_session_id.toString(), testSessionId)
+  assert.strictEqual(testSuite.test_module_id.toString(), testModuleId)
+
+  for (const test of tests) {
+    assert.strictEqual(test.test_session_id.toString(), testSessionId)
+    assert.strictEqual(test.test_module_id.toString(), testModuleId)
+    assert.strictEqual(test.test_suite_id.toString(), testSuiteId)
+  }
+
+  return {
+    testSession,
+    testModule,
+    testSuite,
+    tests,
+  }
+}
+
 // vitest@4.x requires Node.js >= 20
 const versions = NODE_MAJOR <= 18 ? ['1.6.0', '3.2.6'] : ['1.6.0', 'latest']
 
@@ -69,12 +113,15 @@ versions.forEach((version) => {
   describe(`vitest@${version}`, () => {
     let cwd, receiver, childProcess, testOutput
     const newerVitestIt = version === '1.6.0' ? it.skip : it
+    const typecheckIt = version === '1.6.0' ? it.skip : it
 
     useSandbox([
       `vitest@${version}`,
       `@vitest/coverage-istanbul@${version}`,
       `@vitest/coverage-v8@${version}`,
+      '@types/node',
       'tinypool',
+      'typescript',
     ], true)
 
     before(function () {
@@ -231,19 +278,13 @@ versions.forEach((version) => {
             )
 
             testEvents.forEach(test => {
-              // `threads` config will report directly. TODO: update this once we're testing vitest@>=4
-              if (poolConfig === 'forks') {
-                assert.strictEqual(test.content.meta[TEST_IS_TEST_FRAMEWORK_WORKER], 'true')
-              }
+              assert.strictEqual(test.content.meta[TEST_IS_TEST_FRAMEWORK_WORKER], 'true')
               assert.ok(test.content.metrics[DD_HOST_CPU_COUNT])
               assert.strictEqual(test.content.meta[DD_TEST_IS_USER_PROVIDED_SERVICE], 'false')
             })
 
             testSuiteEvents.forEach(testSuite => {
-              // `threads` config will report directly. TODO: update this once we're testing vitest@>=4
-              if (poolConfig === 'forks') {
-                assert.strictEqual(testSuite.content.meta[TEST_IS_TEST_FRAMEWORK_WORKER], 'true')
-              }
+              assert.strictEqual(testSuite.content.meta[TEST_IS_TEST_FRAMEWORK_WORKER], 'true')
               assert.strictEqual(
                 testSuite.content.meta[TEST_SOURCE_FILE].startsWith('ci-visibility/vitest-tests/test-visibility'),
                 true
@@ -256,7 +297,42 @@ versions.forEach((version) => {
       })
     })
 
-    newerVitestIt('sets DD_VITEST_WORKER in workers with pool=forks', async () => {
+    for (const workerPoolConfig of poolConfig) {
+      it(`sets DD_VITEST_WORKER in workers with pool=${workerPoolConfig}`, async () => {
+        const eventsPromise = receiver
+          .gatherPayloadsMaxTimeout(({ url }) => url === '/api/v2/citestcycle', (payloads) => {
+            const events = payloads.flatMap(({ payload }) => payload.events)
+            const test = events.find(event => event.type === 'test').content
+
+            assert.ok(test)
+            assert.strictEqual(test.meta[TEST_NAME], 'vitest worker env sets DD_VITEST_WORKER')
+            assert.strictEqual(test.meta[TEST_STATUS], 'pass')
+          }, 25000)
+
+        childProcess = exec(
+          './node_modules/.bin/vitest run',
+          {
+            cwd,
+            env: {
+              ...getCiVisAgentlessConfig(receiver.port),
+              NODE_OPTIONS: '--import dd-trace/register.js -r dd-trace/ci/init',
+              TEST_DIR: 'ci-visibility/vitest-tests/vitest-worker-env.mjs',
+              POOL_CONFIG: workerPoolConfig,
+              DD_SERVICE: undefined,
+            },
+          }
+        )
+
+        const [[code]] = await Promise.all([
+          once(childProcess, 'exit'),
+          eventsPromise,
+        ])
+
+        assert.strictEqual(code, 0)
+      })
+    }
+
+    newerVitestIt('sets DD_VITEST_WORKER in workers when a fork project has a threads root pool', async () => {
       const eventsPromise = receiver
         .gatherPayloadsMaxTimeout(({ url }) => url === '/api/v2/citestcycle', (payloads) => {
           const events = payloads.flatMap(({ payload }) => payload.events)
@@ -275,7 +351,8 @@ versions.forEach((version) => {
             ...getCiVisAgentlessConfig(receiver.port),
             NODE_OPTIONS: '--import dd-trace/register.js -r dd-trace/ci/init',
             TEST_DIR: 'ci-visibility/vitest-tests/vitest-worker-env.mjs',
-            POOL_CONFIG: 'forks',
+            POOL_CONFIG: 'threads',
+            PROJECT_POOL_CONFIG: 'forks',
             DD_SERVICE: undefined,
           },
         }
@@ -289,38 +366,486 @@ versions.forEach((version) => {
       assert.strictEqual(code, 0)
     })
 
-    newerVitestIt('sets DD_VITEST_WORKER in workers when a fork project has a threads root pool', async () => {
+    typecheckIt('can report typecheck tests', async () => {
       const eventsPromise = receiver
         .gatherPayloadsMaxTimeout(({ url }) => url === '/api/v2/citestcycle', (payloads) => {
           const events = payloads.flatMap(({ payload }) => payload.events)
-          const test = events.find(event => event.type === 'test').content
+          const {
+            testSession,
+            testModule,
+            testSuite,
+            tests,
+          } = assertCompleteEventHierarchy(events, testOutput)
+          const passedTest = tests.find(test =>
+            test.meta[TEST_NAME] === 'typecheck can report type assertion'
+          )
+          const skippedTest = tests.find(test =>
+            test.meta[TEST_NAME] === 'typecheck can report skipped assertion'
+          )
+          const nestedTest = tests.find(test =>
+            test.meta[TEST_NAME] === 'typecheck nested suite can report nested assertion'
+          )
 
-          assert.ok(test)
-          assert.strictEqual(test.meta[TEST_NAME], 'vitest worker env sets DD_VITEST_WORKER')
-          assert.strictEqual(test.meta[TEST_STATUS], 'pass')
+          assert.ok(passedTest, testOutput)
+          assert.ok(skippedTest, testOutput)
+          assert.ok(nestedTest, testOutput)
+
+          assert.strictEqual(testSession.meta[TEST_STATUS], 'pass')
+          assert.strictEqual(testModule.meta[TEST_STATUS], 'pass')
+          assert.strictEqual(testSuite.meta[TEST_STATUS], 'pass')
+          assert.strictEqual(testSuite.meta[TEST_SOURCE_FILE], 'ci-visibility/vitest-tests/typecheck.test-d.ts')
+          assert.strictEqual(passedTest.meta[TEST_STATUS], 'pass')
+          assert.strictEqual(passedTest.meta[TEST_SOURCE_FILE], 'ci-visibility/vitest-tests/typecheck.test-d.ts')
+          assert.strictEqual(skippedTest.meta[TEST_STATUS], 'skip')
+          assert.strictEqual(skippedTest.meta[TEST_SOURCE_FILE], 'ci-visibility/vitest-tests/typecheck.test-d.ts')
+          assert.strictEqual(nestedTest.meta[TEST_STATUS], 'pass')
+          assert.strictEqual(nestedTest.meta[TEST_SOURCE_FILE], 'ci-visibility/vitest-tests/typecheck.test-d.ts')
         }, 25000)
 
       childProcess = exec(
-        './node_modules/.bin/vitest run',
+        './node_modules/.bin/vitest run --config=./vitest.typecheck.config.mjs ' +
+          'ci-visibility/vitest-tests/typecheck.test-d.ts --reporter=verbose',
         {
           cwd,
           env: {
             ...getCiVisAgentlessConfig(receiver.port),
             NODE_OPTIONS: '--import dd-trace/register.js -r dd-trace/ci/init',
-            TEST_DIR: 'ci-visibility/vitest-tests/vitest-worker-env.mjs',
-            POOL_CONFIG: 'threads',
-            PROJECT_POOL_CONFIG: 'forks',
             DD_SERVICE: undefined,
           },
         }
       )
+      childProcess.stdout?.on('data', chunk => { testOutput += chunk.toString() })
+      childProcess.stderr?.on('data', chunk => { testOutput += chunk.toString() })
 
       const [[code]] = await Promise.all([
         once(childProcess, 'exit'),
         eventsPromise,
       ])
 
-      assert.strictEqual(code, 0)
+      assert.strictEqual(code, 0, testOutput)
+    })
+
+    typecheckIt('honors Known Tests metadata for typecheck tests', async () => {
+      receiver.setSettings({
+        early_flake_detection: {
+          enabled: true,
+          slow_test_retries: {
+            '5s': NUM_RETRIES_EFD,
+          },
+        },
+        known_tests_enabled: true,
+      })
+      receiver.setKnownTests({
+        vitest: {
+          'ci-visibility/vitest-tests/typecheck.test-d.ts': [
+            'typecheck can report type assertion',
+          ],
+        },
+      })
+
+      const eventsPromise = receiver
+        .gatherPayloadsMaxTimeout(({ url }) => url === '/api/v2/citestcycle', (payloads) => {
+          const events = payloads.flatMap(({ payload }) => payload.events)
+          const tests = events.filter(event => event.type === 'test').map(event => event.content)
+          const knownTest = tests.find(test =>
+            test.meta[TEST_NAME] === 'typecheck can report type assertion'
+          )
+          const newTest = tests.find(test =>
+            test.meta[TEST_NAME] === 'typecheck can report disabled assertion'
+          )
+
+          assert.ok(knownTest, testOutput)
+          assert.ok(newTest, testOutput)
+          assert.ok(!(TEST_IS_NEW in knownTest.meta))
+          assert.strictEqual(newTest.meta[TEST_IS_NEW], 'true')
+        }, 25000)
+
+      childProcess = exec(
+        './node_modules/.bin/vitest run --config=./vitest.typecheck.config.mjs ' +
+          'ci-visibility/vitest-tests/typecheck.test-d.ts --reporter=verbose',
+        {
+          cwd,
+          env: {
+            ...getCiVisAgentlessConfig(receiver.port),
+            NODE_OPTIONS: '--import dd-trace/register.js -r dd-trace/ci/init',
+            DD_SERVICE: undefined,
+          },
+        }
+      )
+      childProcess.stdout?.on('data', chunk => { testOutput += chunk.toString() })
+      childProcess.stderr?.on('data', chunk => { testOutput += chunk.toString() })
+
+      const [[code]] = await Promise.all([
+        once(childProcess, 'exit'),
+        eventsPromise,
+      ])
+
+      assert.strictEqual(code, 0, testOutput)
+    })
+
+    typecheckIt('honors Impacted Tests metadata for typecheck tests', async () => {
+      receiver.setSettings({ impacted_tests_enabled: true })
+
+      const branchName = `typecheck-impacted-${process.pid}`
+      execSync(`git checkout -b ${branchName}`, { cwd, stdio: 'ignore' })
+
+      try {
+        const typecheckFile = 'ci-visibility/vitest-tests/typecheck.test-d.ts'
+        fs.appendFileSync(path.join(cwd, typecheckFile), '\n// impacted typecheck test\n')
+        execSync(`git add ${typecheckFile}`, { cwd, stdio: 'ignore' })
+        execSync('git commit -m "modify typecheck test"', { cwd, stdio: 'ignore' })
+
+        const eventsPromise = receiver
+          .gatherPayloadsMaxTimeout(({ url }) => url === '/api/v2/citestcycle', (payloads) => {
+            const events = payloads.flatMap(({ payload }) => payload.events)
+            const tests = events.filter(event => event.type === 'test').map(event => event.content)
+            const impactedTest = tests.find(test =>
+              test.meta[TEST_NAME] === 'typecheck can report type assertion'
+            )
+
+            assert.ok(impactedTest, testOutput)
+            assert.strictEqual(impactedTest.meta[TEST_IS_MODIFIED], 'true')
+          }, 25000)
+
+        childProcess = exec(
+          './node_modules/.bin/vitest run --config=./vitest.typecheck.config.mjs ' +
+            'ci-visibility/vitest-tests/typecheck.test-d.ts --reporter=verbose',
+          {
+            cwd,
+            env: {
+              ...getCiVisAgentlessConfig(receiver.port),
+              NODE_OPTIONS: '--import dd-trace/register.js -r dd-trace/ci/init',
+              DD_SERVICE: undefined,
+              GITHUB_BASE_REF: '',
+            },
+          }
+        )
+        childProcess.stdout?.on('data', chunk => { testOutput += chunk.toString() })
+        childProcess.stderr?.on('data', chunk => { testOutput += chunk.toString() })
+
+        const [[code]] = await Promise.all([
+          once(childProcess, 'exit'),
+          eventsPromise,
+        ])
+
+        assert.strictEqual(code, 0, testOutput)
+      } finally {
+        execSync('git checkout -', { cwd, stdio: 'ignore' })
+        execSync(`git branch -D ${branchName}`, { cwd, stdio: 'ignore' })
+      }
+    })
+
+    typecheckIt('honors Test Management metadata for typecheck tests', async () => {
+      receiver.setSettings({ test_management: { enabled: true } })
+      receiver.setTestManagementTests({
+        vitest: {
+          suites: {
+            'ci-visibility/vitest-tests/typecheck.test-d.ts': {
+              tests: {
+                'typecheck can report disabled assertion': {
+                  properties: {
+                    disabled: true,
+                  },
+                },
+                'typecheck can report quarantined assertion': {
+                  properties: {
+                    quarantined: true,
+                  },
+                },
+                'typecheck can report attempt-to-fix assertion': {
+                  properties: {
+                    attempt_to_fix: true,
+                  },
+                },
+                'typecheck nested suite can report nested disabled assertion': {
+                  properties: {
+                    disabled: true,
+                  },
+                },
+              },
+            },
+          },
+        },
+      })
+
+      const eventsPromise = receiver
+        .gatherPayloadsMaxTimeout(({ url }) => url === '/api/v2/citestcycle', (payloads) => {
+          const events = payloads.flatMap(({ payload }) => payload.events)
+          const tests = events.filter(event => event.type === 'test').map(event => event.content)
+          const disabledTest = tests.find(test =>
+            test.meta[TEST_NAME] === 'typecheck can report disabled assertion'
+          )
+          const quarantinedTest = tests.find(test =>
+            test.meta[TEST_NAME] === 'typecheck can report quarantined assertion'
+          )
+          const attemptToFixTest = tests.find(test =>
+            test.meta[TEST_NAME] === 'typecheck can report attempt-to-fix assertion'
+          )
+          const nestedDisabledTest = tests.find(test =>
+            test.meta[TEST_NAME] === 'typecheck nested suite can report nested disabled assertion'
+          )
+
+          assert.ok(disabledTest, testOutput)
+          assert.ok(quarantinedTest, testOutput)
+          assert.ok(attemptToFixTest, testOutput)
+          assert.ok(nestedDisabledTest, testOutput)
+
+          assert.strictEqual(disabledTest.meta[TEST_STATUS], 'skip')
+          assert.strictEqual(disabledTest.meta[TEST_FINAL_STATUS], 'skip')
+          assert.strictEqual(disabledTest.meta[TEST_MANAGEMENT_IS_DISABLED], 'true')
+
+          assert.strictEqual(quarantinedTest.meta[TEST_STATUS], 'pass')
+          assert.strictEqual(quarantinedTest.meta[TEST_FINAL_STATUS], 'skip')
+          assert.strictEqual(quarantinedTest.meta[TEST_MANAGEMENT_IS_QUARANTINED], 'true')
+
+          assert.strictEqual(attemptToFixTest.meta[TEST_STATUS], 'pass')
+          assert.strictEqual(attemptToFixTest.meta[TEST_MANAGEMENT_IS_ATTEMPT_TO_FIX], 'true')
+
+          assert.strictEqual(nestedDisabledTest.meta[TEST_STATUS], 'skip')
+          assert.strictEqual(nestedDisabledTest.meta[TEST_FINAL_STATUS], 'skip')
+          assert.strictEqual(nestedDisabledTest.meta[TEST_MANAGEMENT_IS_DISABLED], 'true')
+        }, 25000)
+
+      childProcess = exec(
+        './node_modules/.bin/vitest run --config=./vitest.typecheck.config.mjs ' +
+          'ci-visibility/vitest-tests/typecheck.test-d.ts --reporter=verbose',
+        {
+          cwd,
+          env: {
+            ...getCiVisAgentlessConfig(receiver.port),
+            NODE_OPTIONS: '--import dd-trace/register.js -r dd-trace/ci/init',
+            DD_SERVICE: undefined,
+          },
+        }
+      )
+      childProcess.stdout?.on('data', chunk => { testOutput += chunk.toString() })
+      childProcess.stderr?.on('data', chunk => { testOutput += chunk.toString() })
+
+      const [[code]] = await Promise.all([
+        once(childProcess, 'exit'),
+        eventsPromise,
+      ])
+
+      assert.strictEqual(code, 0, testOutput)
+    })
+
+    typecheckIt('does not fail the typecheck run for Test Management managed failures', async () => {
+      receiver.setSettings({ test_management: { enabled: true } })
+      receiver.setTestManagementTests({
+        vitest: {
+          suites: {
+            'ci-visibility/vitest-tests/typecheck-test-management-fail.test-d.ts': {
+              tests: {
+                'typecheck can report disabled failing assertion': {
+                  properties: {
+                    disabled: true,
+                  },
+                },
+                'typecheck can report quarantined failing assertion': {
+                  properties: {
+                    quarantined: true,
+                  },
+                },
+                'typecheck nested failing suite can report nested disabled failing assertion': {
+                  properties: {
+                    disabled: true,
+                  },
+                },
+              },
+            },
+          },
+        },
+      })
+
+      const eventsPromise = receiver
+        .gatherPayloadsMaxTimeout(({ url }) => url === '/api/v2/citestcycle', (payloads) => {
+          const events = payloads.flatMap(({ payload }) => payload.events)
+          const testSession = events.find(event => event.type === 'test_session_end').content
+          const testModule = events.find(event => event.type === 'test_module_end').content
+          const testSuite = events.find(event => event.type === 'test_suite_end').content
+          const tests = events.filter(event => event.type === 'test').map(event => event.content)
+          const disabledTest = tests.find(test =>
+            test.meta[TEST_NAME] === 'typecheck can report disabled failing assertion'
+          )
+          const quarantinedTest = tests.find(test =>
+            test.meta[TEST_NAME] === 'typecheck can report quarantined failing assertion'
+          )
+          const nestedDisabledTest = tests.find(test =>
+            test.meta[TEST_NAME] === 'typecheck nested failing suite can report nested disabled failing assertion'
+          )
+
+          assert.ok(disabledTest, testOutput)
+          assert.ok(quarantinedTest, testOutput)
+          assert.ok(nestedDisabledTest, testOutput)
+          assert.strictEqual(testSession.meta[TEST_STATUS], 'pass')
+          assert.strictEqual(testModule.meta[TEST_STATUS], 'pass')
+          assert.strictEqual(testSuite.meta[TEST_STATUS], 'pass')
+
+          assert.strictEqual(disabledTest.meta[TEST_STATUS], 'skip')
+          assert.strictEqual(disabledTest.meta[TEST_FINAL_STATUS], 'skip')
+          assert.strictEqual(disabledTest.meta[TEST_MANAGEMENT_IS_DISABLED], 'true')
+
+          assert.strictEqual(quarantinedTest.meta[TEST_STATUS], 'fail')
+          assert.strictEqual(quarantinedTest.meta[TEST_FINAL_STATUS], 'skip')
+          assert.strictEqual(quarantinedTest.meta[TEST_MANAGEMENT_IS_QUARANTINED], 'true')
+
+          assert.strictEqual(nestedDisabledTest.meta[TEST_STATUS], 'skip')
+          assert.strictEqual(nestedDisabledTest.meta[TEST_FINAL_STATUS], 'skip')
+          assert.strictEqual(nestedDisabledTest.meta[TEST_MANAGEMENT_IS_DISABLED], 'true')
+        }, 25000)
+
+      childProcess = exec(
+        './node_modules/.bin/vitest run --config=./vitest.typecheck.config.mjs ' +
+          'ci-visibility/vitest-tests/typecheck-test-management-fail.test-d.ts --reporter=verbose',
+        {
+          cwd,
+          env: {
+            ...getCiVisAgentlessConfig(receiver.port),
+            NODE_OPTIONS: '--import dd-trace/register.js -r dd-trace/ci/init',
+            DD_SERVICE: undefined,
+            TYPECHECK_TEST_MANAGEMENT_FAIL: 'true',
+          },
+        }
+      )
+      childProcess.stdout?.on('data', chunk => { testOutput += chunk.toString() })
+      childProcess.stderr?.on('data', chunk => { testOutput += chunk.toString() })
+
+      const [[code]] = await Promise.all([
+        once(childProcess, 'exit'),
+        eventsPromise,
+      ])
+
+      assert.strictEqual(code, 0, testOutput)
+    })
+
+    typecheckIt('preserves file-level typecheck failures with Test Management managed tests', async () => {
+      receiver.setSettings({ test_management: { enabled: true } })
+      receiver.setTestManagementTests({
+        vitest: {
+          suites: {
+            'ci-visibility/vitest-tests/typecheck-test-management-file-fail.test-d.ts': {
+              tests: {
+                'typecheck container failing suite can report disabled assertion with file-level error': {
+                  properties: {
+                    disabled: true,
+                  },
+                },
+                'typecheck container failing suite can report quarantined assertion with file-level error': {
+                  properties: {
+                    quarantined: true,
+                  },
+                },
+              },
+            },
+          },
+        },
+      })
+
+      const eventsPromise = receiver
+        .gatherPayloadsMaxTimeout(({ url }) => url === '/api/v2/citestcycle', (payloads) => {
+          const events = payloads.flatMap(({ payload }) => payload.events)
+          const testSession = events.find(event => event.type === 'test_session_end').content
+          const testModule = events.find(event => event.type === 'test_module_end').content
+          const testSuite = events.find(event => event.type === 'test_suite_end').content
+          const tests = events.filter(event => event.type === 'test').map(event => event.content)
+          const disabledTest = tests.find(test =>
+            test.meta[TEST_NAME] ===
+              'typecheck container failing suite can report disabled assertion with file-level error'
+          )
+          const quarantinedTest = tests.find(test =>
+            test.meta[TEST_NAME] ===
+              'typecheck container failing suite can report quarantined assertion with file-level error'
+          )
+
+          assert.ok(disabledTest, testOutput)
+          assert.ok(quarantinedTest, testOutput)
+          assert.strictEqual(testSession.meta[TEST_STATUS], 'fail', testOutput)
+          assert.strictEqual(testModule.meta[TEST_STATUS], 'fail', testOutput)
+          assert.strictEqual(testSuite.meta[TEST_STATUS], 'fail', testOutput)
+          assert.strictEqual(testSuite.meta[ERROR_TYPE], 'TypeCheckError')
+          assert.ok(testSuite.meta[ERROR_MESSAGE])
+
+          assert.strictEqual(disabledTest.meta[TEST_STATUS], 'skip')
+          assert.strictEqual(disabledTest.meta[TEST_FINAL_STATUS], 'skip')
+          assert.strictEqual(disabledTest.meta[TEST_MANAGEMENT_IS_DISABLED], 'true')
+
+          assert.strictEqual(quarantinedTest.meta[TEST_STATUS], 'pass')
+          assert.strictEqual(quarantinedTest.meta[TEST_FINAL_STATUS], 'skip')
+          assert.strictEqual(quarantinedTest.meta[TEST_MANAGEMENT_IS_QUARANTINED], 'true')
+        }, 25000)
+
+      childProcess = exec(
+        './node_modules/.bin/vitest run --config=./vitest.typecheck.config.mjs ' +
+          'ci-visibility/vitest-tests/typecheck-test-management-file-fail.test-d.ts --reporter=verbose',
+        {
+          cwd,
+          env: {
+            ...getCiVisAgentlessConfig(receiver.port),
+            NODE_OPTIONS: '--import dd-trace/register.js -r dd-trace/ci/init',
+            DD_SERVICE: undefined,
+            TYPECHECK_TEST_MANAGEMENT_FILE_FAIL: 'true',
+          },
+        }
+      )
+      childProcess.stdout?.on('data', chunk => { testOutput += chunk.toString() })
+      childProcess.stderr?.on('data', chunk => { testOutput += chunk.toString() })
+
+      const [[code]] = await Promise.all([
+        once(childProcess, 'exit'),
+        eventsPromise,
+      ])
+
+      assert.strictEqual(code, 1, testOutput)
+    })
+
+    typecheckIt('can report failed typecheck tests', async () => {
+      const eventsPromise = receiver
+        .gatherPayloadsMaxTimeout(({ url }) => url === '/api/v2/citestcycle', (payloads) => {
+          const events = payloads.flatMap(({ payload }) => payload.events)
+          const {
+            testSession,
+            testModule,
+            testSuite,
+            tests,
+          } = assertCompleteEventHierarchy(events, testOutput)
+          const test = tests.find(test =>
+            test.meta[TEST_NAME] === 'typecheck can report failing assertion'
+          )
+
+          assert.ok(test, testOutput)
+
+          assert.strictEqual(testSession.meta[TEST_STATUS], 'fail')
+          assert.strictEqual(testModule.meta[TEST_STATUS], 'fail')
+          assert.strictEqual(testSuite.meta[TEST_STATUS], 'fail')
+          assert.strictEqual(testSuite.meta[TEST_SOURCE_FILE], 'ci-visibility/vitest-tests/typecheck-fail.test-d.ts')
+          assert.strictEqual(test.meta[TEST_STATUS], 'fail')
+          assert.strictEqual(test.meta[TEST_SOURCE_FILE], 'ci-visibility/vitest-tests/typecheck-fail.test-d.ts')
+          assert.strictEqual(test.meta[ERROR_TYPE], 'TypeCheckError')
+          assert.ok(test.meta[ERROR_MESSAGE])
+        }, 25000)
+
+      childProcess = exec(
+        './node_modules/.bin/vitest run --config=./vitest.typecheck.config.mjs ' +
+          'ci-visibility/vitest-tests/typecheck-fail.test-d.ts --reporter=verbose',
+        {
+          cwd,
+          env: {
+            ...getCiVisAgentlessConfig(receiver.port),
+            NODE_OPTIONS: '--import dd-trace/register.js -r dd-trace/ci/init',
+            DD_SERVICE: undefined,
+            TYPECHECK_FAIL: 'true',
+          },
+        }
+      )
+      childProcess.stdout?.on('data', chunk => { testOutput += chunk.toString() })
+      childProcess.stderr?.on('data', chunk => { testOutput += chunk.toString() })
+
+      const [[code]] = await Promise.all([
+        once(childProcess, 'exit'),
+        eventsPromise,
+      ])
+
+      assert.strictEqual(code, 1, testOutput)
     })
 
     it('propagates test span context to HTTP requests and hooks during test execution', async () => {
diff --git a/integration-tests/vitest/vitest.no-worker-init.spec.js b/integration-tests/vitest/vitest.no-worker-init.spec.js
new file mode 100644
index 0000000000..85d19d093d
--- /dev/null
+++ b/integration-tests/vitest/vitest.no-worker-init.spec.js
@@ -0,0 +1,1187 @@
+'use strict'
+
+const assert = require('node:assert/strict')
+const fs = require('node:fs')
+const path = require('node:path')
+const { exec, execSync } = require('node:child_process')
+const { once } = require('node:events')
+const { inspect } = require('node:util')
+
+const {
+  sandboxCwd,
+  useSandbox,
+  getCiVisAgentlessConfig,
+  assertObjectContains,
+} = require('../helpers')
+const { FakeCiVisIntake } = require('../ci-visibility-intake')
+const noWorkerInit = require('../../packages/datadog-instrumentations/src/vitest-main-no-worker-init')
+const { testSuiteStartCh } = require('../../packages/datadog-instrumentations/src/vitest-util')
+const {
+  ERROR_MESSAGE,
+} = require('../../packages/dd-trace/src/constants')
+const {
+  DD_CAPABILITIES_AUTO_TEST_RETRIES,
+  DD_CAPABILITIES_EARLY_FLAKE_DETECTION,
+  DD_CAPABILITIES_FAILED_TEST_REPLAY,
+  DD_CAPABILITIES_IMPACTED_TESTS,
+  DD_CAPABILITIES_TEST_MANAGEMENT_ATTEMPT_TO_FIX,
+  DD_CAPABILITIES_TEST_MANAGEMENT_DISABLE,
+  DD_CAPABILITIES_TEST_MANAGEMENT_QUARANTINE,
+  EARLY_FLAKE_DETECTION_RETRY_THRESHOLDS,
+  TEST_EARLY_FLAKE_ABORT_REASON,
+  TEST_EARLY_FLAKE_ENABLED,
+  TEST_FINAL_STATUS,
+  TEST_HAS_FAILED_ALL_RETRIES,
+  TEST_IS_MODIFIED,
+  TEST_IS_NEW,
+  TEST_IS_RETRY,
+  TEST_IS_TEST_FRAMEWORK_WORKER,
+  TEST_MANAGEMENT_ATTEMPT_TO_FIX_PASSED,
+  TEST_MANAGEMENT_ENABLED,
+  TEST_MANAGEMENT_IS_ATTEMPT_TO_FIX,
+  TEST_MANAGEMENT_IS_DISABLED,
+  TEST_MANAGEMENT_IS_QUARANTINED,
+  TEST_NAME,
+  TEST_RETRY_REASON,
+  TEST_RETRY_REASON_TYPES,
+  TEST_SOURCE_FILE,
+  TEST_STATUS,
+  TEST_SUITE,
+} = require('../../packages/dd-trace/src/plugins/util/test')
+const { NODE_MAJOR } = require('../../version')
+
+const DEFAULT_NODE_OPTIONS = '--no-warnings --import dd-trace/register.js -r dd-trace/ci/init'
+const VITEST_NO_WORKER_INIT_REQUEST_ENV = 'DD_EXPERIMENTAL_TEST_OPT_VITEST_NO_WORKER_INIT'
+const SUPPORTED_VERSIONS = NODE_MAJOR <= 18 ? ['3.2.6'] : ['3.2.6', 'latest']
+const UNSUPPORTED_VERSION = '1.6.0'
+const UNSUPPORTED_VERSION_WARNING =
+  'DD_EXPERIMENTAL_TEST_OPT_VITEST_NO_WORKER_INIT is only supported for vitest >=3.2.6'
+const DISABLED_ISOLATE_WARNING =
+  'DD_EXPERIMENTAL_TEST_OPT_VITEST_NO_WORKER_INIT is ignored because Vitest isolate is disabled'
+
+function getEvents (payloads) {
+  return payloads.flatMap(({ payload }) => payload.events)
+}
+
+function getEventContents (events, type) {
+  return events.filter(event => event.type === type).map(event => event.content)
+}
+
+function assertEventCounts (events, expectedCounts) {
+  const eventTypes = events.map(event => event.type)
+  for (const [type, expectedCount] of Object.entries(expectedCounts)) {
+    assert.strictEqual(
+      getEventContents(events, type).length,
+      expectedCount,
+      inspect(eventTypes)
+    )
+  }
+}
+
+function sortStrings (strings) {
+  return strings.slice().sort((a, b) => a.localeCompare(b))
+}
+
+function getTestByName (tests, name) {
+  const test = tests.find(test => test.meta[TEST_NAME] === name)
+  assert.ok(test, `Could not find test ${name}. Found: ${inspect(tests.map(test => test.meta[TEST_NAME]))}`)
+  return test
+}
+
+function getTestsByName (tests, name) {
+  return tests
+    .filter(test => test.meta[TEST_NAME] === name)
+    .sort((a, b) => (a.start < b.start ? -1 : a.start > b.start ? 1 : 0))
+}
+
+function getNoWorkerInitEnv (receiver, extraEnv = {}) {
+  return {
+    ...getCiVisAgentlessConfig(receiver.port),
+    NODE_OPTIONS: DEFAULT_NODE_OPTIONS,
+    [VITEST_NO_WORKER_INIT_REQUEST_ENV]: 'true',
+    DD_SERVICE: undefined,
+    ...extraEnv,
+  }
+}
+
+function gatherCitestcyclePayloads (receiver, assertions) {
+  return receiver.gatherPayloadsMaxTimeout(
+    ({ url }) => url === '/api/v2/citestcycle',
+    payloads => assertions(getEvents(payloads))
+  )
+}
+
+describe('vitest no-worker init instrumentation selection', () => {
+  const workerPools = new Set(['forks', 'threads', 'vmForks', 'vmThreads'])
+  const options = {
+    isVitestWorkerPool: pool => workerPools.has(pool),
+  }
+  let originalRequested
+
+  beforeEach(() => {
+    originalRequested = process.env[VITEST_NO_WORKER_INIT_REQUEST_ENV]
+    process.env[VITEST_NO_WORKER_INIT_REQUEST_ENV] = 'true'
+  })
+
+  afterEach(() => {
+    if (originalRequested === undefined) {
+      delete process.env[VITEST_NO_WORKER_INIT_REQUEST_ENV]
+    } else {
+      process.env[VITEST_NO_WORKER_INIT_REQUEST_ENV] = originalRequested
+    }
+  })
+
+  describe('shouldUse', () => {
+    it('rejects runs when the feature was not requested', () => {
+      delete process.env[VITEST_NO_WORKER_INIT_REQUEST_ENV]
+
+      assert.strictEqual(noWorkerInit.shouldUse({ config: { pool: 'forks' } }, '3.2.6', undefined, options), false)
+    })
+
+    it('rejects vitest versions older than 3.2.6', () => {
+      assert.strictEqual(noWorkerInit.shouldUse({ config: { pool: 'forks' } }, '3.2.5', undefined, options), false)
+    })
+
+    for (const pool of ['forks', 'threads']) {
+      it(`accepts isolated ${pool} runs`, () => {
+        assert.strictEqual(noWorkerInit.shouldUse({ config: { pool } }, '3.2.6', undefined, options), true)
+      })
+    }
+
+    it('rejects root projects with isolate disabled', () => {
+      assert.strictEqual(
+        noWorkerInit.shouldUse({ config: { isolate: false, pool: 'forks' } }, '3.2.6', undefined, options),
+        false
+      )
+    })
+
+    it('rejects pool-specific isolate disabled configuration', () => {
+      assert.strictEqual(
+        noWorkerInit.shouldUse({
+          config: {
+            pool: 'threads',
+            poolOptions: {
+              threads: {
+                isolate: false,
+              },
+            },
+          },
+        }, '3.2.6', undefined, options),
+        false
+      )
+    })
+
+    it('rejects default pool-specific isolate disabled configuration', () => {
+      assert.strictEqual(
+        noWorkerInit.shouldUse({
+          config: {
+            poolOptions: {
+              forks: {
+                isolate: false,
+              },
+            },
+          },
+        }, '3.2.6', undefined, options),
+        false
+      )
+    })
+
+    it('rejects selected test specifications with isolate disabled', () => {
+      const project = {
+        config: {
+          isolate: false,
+          pool: 'forks',
+        },
+      }
+
+      assert.strictEqual(
+        noWorkerInit.shouldUse({ config: { pool: 'forks' } }, '3.2.6', [[project, { pool: 'forks' }]], options),
+        false
+      )
+    })
+
+    it('rejects selected test specifications with default pool-specific isolate disabled', () => {
+      const project = {
+        config: {},
+      }
+
+      assert.strictEqual(
+        noWorkerInit.shouldUse({
+          config: {
+            poolOptions: {
+              forks: {
+                isolate: false,
+              },
+            },
+          },
+        }, '3.2.6', [[project, {}]], options),
+        false
+      )
+    })
+
+    it('rejects mixed worker and non-worker selected test specifications', () => {
+      const workerProject = {
+        config: {
+          pool: 'forks',
+        },
+      }
+      const nonWorkerProject = {
+        config: {
+          pool: 'browser',
+        },
+      }
+
+      assert.strictEqual(
+        noWorkerInit.shouldUse({
+          config: {
+            pool: 'forks',
+          },
+        }, '3.2.6', [
+          [workerProject, { pool: 'forks' }],
+          [nonWorkerProject, { pool: 'browser' }],
+        ], options),
+        false
+      )
+    })
+
+    it('rejects selected test specifications with non-worker tuple pool overrides', () => {
+      const project = {
+        config: {
+          pool: 'forks',
+        },
+      }
+
+      assert.strictEqual(
+        noWorkerInit.shouldUse({ config: { pool: 'forks' } }, '3.2.6', [
+          [project, {}, { pool: 'browser' }],
+        ], options),
+        false
+      )
+    })
+  })
+
+  describe('configure', () => {
+    function getNoWorkerReporterContext () {
+      const rootProject = { _provided: {} }
+      return {
+        config: {},
+        reporters: [],
+        getRootProject () {
+          return rootProject
+        },
+      }
+    }
+
+    function configureNoWorkerReporter (ctx) {
+      noWorkerInit.configure(ctx, '3.2.6', undefined, {
+        knownTestsBySuite: {},
+        modifiedFiles: {},
+        repositoryRoot: '/repo',
+        testManagementTestsBySuite: {},
+        testSessionConfiguration: {},
+      }, {
+        getConfiguredEfdRetryCount: () => 2,
+        state: {
+          earlyFlakeDetectionNumRetries: 1,
+          earlyFlakeDetectionSlowTestRetries: { '5s': 2 },
+          isEarlyFlakeDetectionEnabled: true,
+          isEarlyFlakeDetectionFaulty: false,
+          testManagementAttemptToFixRetries: 0,
+        },
+      })
+    }
+
+    it('sends EFD retry thresholds to the no-worker setup context', () => {
+      const ctx = getNoWorkerReporterContext()
+
+      configureNoWorkerReporter(ctx)
+
+      assert.deepStrictEqual(
+        ctx.getRootProject()._provided._ddVitestWorkerSetup.earlyFlakeDetectionRetryThresholds,
+        EARLY_FLAKE_DETECTION_RETRY_THRESHOLDS
+      )
+    })
+
+    it('deactivates the no-worker reporter for reused contexts that fall back', () => {
+      const ctx = getNoWorkerReporterContext()
+      const testSuiteStarts = []
+      const onTestSuiteStart = context => testSuiteStarts.push(context.testSuiteAbsolutePath)
+      testSuiteStartCh.subscribe(onTestSuiteStart)
+
+      try {
+        configureNoWorkerReporter(ctx)
+        assert.strictEqual(ctx.reporters.length, 1)
+
+        ctx.reporters[0].onTestModuleStart({
+          id: 'first',
+          moduleId: '/repo/first.test.mjs',
+        })
+        noWorkerInit.deactivate(ctx)
+        ctx.reporters[0].onTestModuleStart({
+          id: 'second',
+          moduleId: '/repo/second.test.mjs',
+        })
+      } finally {
+        testSuiteStartCh.unsubscribe(onTestSuiteStart)
+      }
+
+      assert.deepStrictEqual(testSuiteStarts, ['/repo/first.test.mjs'])
+    })
+  })
+
+  describe('configureWorkerEnv', () => {
+    it('restores Datadog NODE_OPTIONS when no-worker mode falls back', () => {
+      const noWorkerEnv = noWorkerInit.configureWorkerEnv({
+        NODE_OPTIONS: DEFAULT_NODE_OPTIONS,
+      }, true)
+
+      assert.strictEqual(noWorkerEnv.NODE_OPTIONS, '--no-warnings')
+      assert.strictEqual(noWorkerEnv.DD_TEST_OPT_VITEST_NO_WORKER_INIT_ACTIVE, '1')
+
+      const workerEnv = noWorkerInit.configureWorkerEnv({
+        NODE_OPTIONS: noWorkerEnv.NODE_OPTIONS,
+      })
+
+      assert.strictEqual(workerEnv.NODE_OPTIONS, DEFAULT_NODE_OPTIONS)
+      assert.ok(!('DD_TEST_OPT_VITEST_NO_WORKER_INIT_ACTIVE' in workerEnv))
+    })
+  })
+})
+
+SUPPORTED_VERSIONS.forEach((version) => {
+  describe(`vitest@${version} no-worker init`, () => {
+    let cwd, receiver, childProcess, testOutput
+
+    useSandbox([
+      `vitest@${version}`,
+      'tinypool',
+    ], true)
+
+    before(function () {
+      cwd = sandboxCwd()
+    })
+
+    beforeEach(async function () {
+      childProcess = undefined
+      testOutput = ''
+      receiver = await new FakeCiVisIntake().start()
+    })
+
+    afterEach(async () => {
+      childProcess?.kill()
+      await receiver.stop()
+    })
+
+    async function runVitest (extraEnv = {}, command = './node_modules/.bin/vitest run') {
+      childProcess = exec(
+        command,
+        {
+          cwd,
+          env: getNoWorkerInitEnv(receiver, extraEnv),
+        }
+      )
+
+      childProcess.stdout.on('data', data => { testOutput += data })
+      childProcess.stderr.on('data', data => { testOutput += data })
+
+      const [exitCode] = await once(childProcess, 'exit')
+      return exitCode
+    }
+
+    for (const poolConfig of ['forks', 'threads']) {
+      it(`runs and reports tests without initializing dd-trace in ${poolConfig} workers`, async () => {
+        const payloadsPromise = gatherCitestcyclePayloads(receiver, events => {
+          assertEventCounts(events, {
+            test_session_end: 1,
+            test_module_end: 1,
+            test_suite_end: 1,
+            test: 1,
+          })
+
+          const [test] = getEventContents(events, 'test')
+          assert.strictEqual(test.meta[TEST_NAME], 'vitest worker env sets DD_VITEST_WORKER')
+          assert.strictEqual(test.meta[TEST_STATUS], 'pass')
+          assert.strictEqual(test.meta[TEST_IS_TEST_FRAMEWORK_WORKER], 'true')
+          assert.ok(
+            Number(test.duration) >= 100 * 1e6,
+            `Expected test duration to include Vitest execution time, got ${Number(test.duration) / 1e6}ms`
+          )
+        })
+
+        const exitCode = await Promise.all([
+          runVitest({
+            TEST_DIR: 'ci-visibility/vitest-tests/vitest-worker-env.mjs',
+            POOL_CONFIG: poolConfig,
+            EXPECT_DD_TEST_OPT_VITEST_NO_WORKER_INIT_ACTIVE: '1',
+            EXPECT_DD_NODE_OPTIONS_PRESERVED: '--no-warnings',
+            EXPECT_DD_NODE_OPTIONS_STRIPPED: '1',
+            EXPECT_NO_DD_TRACE_INIT: '1',
+            WAIT_BEFORE_EXPECTATION_MS: '100',
+          }),
+          payloadsPromise,
+        ]).then(([exitCode]) => exitCode)
+
+        assert.strictEqual(exitCode, 0, testOutput)
+      })
+    }
+
+    it('does not advertise Failed Test Replay capability in no-worker mode', async () => {
+      receiver.setSettings({
+        di_enabled: true,
+      })
+
+      const metadataPromise = receiver
+        .gatherPayloadsMaxTimeout(({ url }) => url === '/api/v2/citestcycle', payloads => {
+          const metadataDicts = payloads.flatMap(({ payload }) => payload.metadata)
+
+          assert.ok(metadataDicts.length > 0, `Expected ${metadataDicts.length} > 0`)
+          metadataDicts.forEach(metadata => {
+            assertObjectContains(metadata.test, {
+              [DD_CAPABILITIES_EARLY_FLAKE_DETECTION]: '1',
+              [DD_CAPABILITIES_AUTO_TEST_RETRIES]: '1',
+              [DD_CAPABILITIES_IMPACTED_TESTS]: '1',
+              [DD_CAPABILITIES_TEST_MANAGEMENT_QUARANTINE]: '1',
+              [DD_CAPABILITIES_TEST_MANAGEMENT_DISABLE]: '1',
+              [DD_CAPABILITIES_TEST_MANAGEMENT_ATTEMPT_TO_FIX]: '5',
+            })
+            assert.ok(
+              !Object.hasOwn(metadata.test, DD_CAPABILITIES_FAILED_TEST_REPLAY),
+              `Available keys: ${inspect(Object.keys(metadata.test))}`
+            )
+          })
+        })
+
+      const exitCode = await Promise.all([
+        runVitest({
+          TEST_DIR: 'ci-visibility/vitest-tests/vitest-worker-env.mjs',
+          POOL_CONFIG: 'forks',
+          EXPECT_DD_TEST_OPT_VITEST_NO_WORKER_INIT_ACTIVE: '1',
+          EXPECT_NO_DD_TRACE_INIT: '1',
+        }),
+        metadataPromise,
+      ]).then(([exitCode]) => exitCode)
+
+      assert.strictEqual(exitCode, 0, testOutput)
+    })
+
+    it('preserves no-worker env when the programmatic API collects tests', async () => {
+      const exitCode = await runVitest({
+        TEST_DIR: 'ci-visibility/vitest-tests/vitest-worker-env.mjs',
+        POOL_CONFIG: 'forks',
+        EXPECT_DD_TEST_OPT_VITEST_NO_WORKER_INIT_ACTIVE: '1',
+        EXPECT_DD_NODE_OPTIONS_STRIPPED: '1',
+        EXPECT_NO_DD_TRACE_INIT: '1',
+      }, 'node ci-visibility/vitest-tests-programmatic-api/run-no-worker-programmatic-api-collect-before-run.mjs')
+
+      assert.strictEqual(exitCode, 0, testOutput)
+      assert.match(testOutput, /1 passed/, testOutput)
+    })
+
+    it('reports multiple suites with the same parentage as worker instrumentation', async () => {
+      const expectedSuites = [
+        'ci-visibility/vitest-tests/no-worker-suite-context-a-slow.mjs',
+        'ci-visibility/vitest-tests/no-worker-suite-context-b-fast.mjs',
+      ]
+      const expectedTests = [
+        'no-worker suite context fast reports the fast suite test',
+        'no-worker suite context slow reports the slow suite test',
+      ]
+
+      const payloadsPromise = gatherCitestcyclePayloads(receiver, events => {
+        assertEventCounts(events, {
+          test_session_end: 1,
+          test_module_end: 1,
+          test_suite_end: 2,
+          test: 2,
+        })
+
+        const suites = getEventContents(events, 'test_suite_end')
+        const tests = getEventContents(events, 'test')
+        assert.deepStrictEqual(sortStrings(suites.map(suite => suite.meta[TEST_SOURCE_FILE])), expectedSuites)
+        assert.deepStrictEqual(sortStrings(tests.map(test => test.meta[TEST_NAME])), expectedTests)
+
+        const suitesBySourceFile = new Map(suites.map(suite => [suite.meta[TEST_SOURCE_FILE], suite]))
+        for (const test of tests) {
+          const suite = suitesBySourceFile.get(test.meta[TEST_SOURCE_FILE])
+          assert.ok(suite, `Could not find suite for ${test.meta[TEST_SOURCE_FILE]}`)
+          assert.strictEqual(test.meta[TEST_SUITE], test.meta[TEST_SOURCE_FILE])
+          assert.strictEqual(test.test_session_id.toString(), suite.test_session_id.toString())
+          assert.strictEqual(test.test_module_id.toString(), suite.test_module_id.toString())
+        }
+      })
+
+      const exitCode = await Promise.all([
+        runVitest({
+          TEST_DIR: 'ci-visibility/vitest-tests/no-worker-suite-context-*.mjs',
+          POOL_CONFIG: 'forks',
+        }),
+        payloadsPromise,
+      ]).then(([exitCode]) => exitCode)
+
+      assert.strictEqual(exitCode, 0, testOutput)
+    })
+
+    it('reports suite hook failures from the main-process reporter', async () => {
+      const payloadsPromise = gatherCitestcyclePayloads(receiver, events => {
+        assertEventCounts(events, {
+          test_session_end: 1,
+          test_module_end: 1,
+          test_suite_end: 1,
+        })
+
+        const [suite] = getEventContents(events, 'test_suite_end')
+        assert.strictEqual(suite.meta[TEST_STATUS], 'fail')
+        assert.match(suite.meta[ERROR_MESSAGE], /failed before all/)
+      })
+
+      const exitCode = await Promise.all([
+        runVitest({
+          TEST_DIR: 'ci-visibility/vitest-tests/failed-suite-hook.mjs',
+          POOL_CONFIG: 'forks',
+        }),
+        payloadsPromise,
+      ]).then(([exitCode]) => exitCode)
+
+      assert.strictEqual(exitCode, 1, testOutput)
+    })
+
+    it('preserves existing string setup files when injecting the no-worker setup file', async () => {
+      const payloadsPromise = gatherCitestcyclePayloads(receiver, events => {
+        assertEventCounts(events, {
+          test_session_end: 1,
+          test_module_end: 1,
+          test_suite_end: 1,
+          test: 1,
+        })
+
+        const [test] = getEventContents(events, 'test')
+        assert.strictEqual(test.meta[TEST_NAME], 'string setup file keeps the configured setup file')
+        assert.strictEqual(test.meta[TEST_STATUS], 'pass')
+      })
+
+      const exitCode = await Promise.all([
+        runVitest({
+          TEST_DIR: 'ci-visibility/vitest-tests/uses-string-setup-file.mjs',
+          POOL_CONFIG: 'forks',
+          VITEST_SETUP_FILE: 'ci-visibility/vitest-tests/string-setup-file.mjs',
+        }),
+        payloadsPromise,
+      ]).then(([exitCode]) => exitCode)
+
+      assert.strictEqual(exitCode, 0, testOutput)
+    })
+
+    for (const { name, env } of [
+      {
+        name: 'root isolate disabled',
+        env: {
+          NO_ISOLATE: '1',
+          POOL_CONFIG: 'forks',
+        },
+      },
+      {
+        name: 'root pool isolate disabled',
+        env: {
+          POOL_CONFIG: 'forks',
+          POOL_NO_ISOLATE: '1',
+        },
+      },
+      {
+        name: 'default pool isolate disabled',
+        env: {
+          USE_VITEST_DEFAULT_POOL: '1',
+          POOL_NO_ISOLATE: '1',
+        },
+      },
+      {
+        name: 'project isolate disabled',
+        env: {
+          PROJECT_NO_ISOLATE: '1',
+          PROJECT_POOL_CONFIG: 'forks',
+        },
+      },
+      {
+        name: 'project pool isolate disabled',
+        env: {
+          PROJECT_POOL_CONFIG: 'forks',
+          PROJECT_POOL_NO_ISOLATE: '1',
+        },
+      },
+    ]) {
+      it(`warns and falls back to worker instrumentation when ${name}`, async () => {
+        const payloadsPromise = gatherCitestcyclePayloads(receiver, events => {
+          assertEventCounts(events, {
+            test_session_end: 1,
+            test_module_end: 1,
+            test_suite_end: 1,
+            test: 1,
+          })
+
+          const [test] = getEventContents(events, 'test')
+          assert.strictEqual(test.meta[TEST_NAME], 'vitest worker env sets DD_VITEST_WORKER')
+          assert.strictEqual(test.meta[TEST_STATUS], 'pass')
+          assert.strictEqual(test.meta[TEST_IS_TEST_FRAMEWORK_WORKER], 'true')
+        })
+
+        const exitCode = await Promise.all([
+          runVitest({
+            TEST_DIR: 'ci-visibility/vitest-tests/vitest-worker-env.mjs',
+            DD_TRACE_DEBUG: 'true',
+            DD_TRACE_LOG_LEVEL: 'warn',
+            EXPECT_DD_TEST_OPT_VITEST_NO_WORKER_INIT_INACTIVE: '1',
+            ...env,
+          }),
+          payloadsPromise,
+        ]).then(([exitCode]) => exitCode)
+
+        assert.strictEqual(exitCode, 0, testOutput)
+        assert.match(testOutput, new RegExp(DISABLED_ISOLATE_WARNING), testOutput)
+      })
+    }
+
+    it('applies no-worker setup data for Test Management', async () => {
+      receiver.setSettings({
+        test_management: {
+          enabled: true,
+          attempt_to_fix_retries: 2,
+        },
+      })
+      receiver.setTestManagementTests({
+        vitest: {
+          suites: {
+            'ci-visibility/vitest-tests/test-disabled.mjs': {
+              tests: {
+                'disable tests can disable a test': {
+                  properties: {
+                    disabled: true,
+                  },
+                },
+              },
+            },
+            'ci-visibility/vitest-tests/test-quarantine.mjs': {
+              tests: {
+                'quarantine tests can quarantine a test': {
+                  properties: {
+                    quarantined: true,
+                  },
+                },
+              },
+            },
+            'ci-visibility/vitest-tests/test-attempt-to-fix.mjs': {
+              tests: {
+                'attempt to fix tests can attempt to fix a test': {
+                  properties: {
+                    attempt_to_fix: true,
+                  },
+                },
+              },
+            },
+          },
+        },
+      })
+
+      const payloadsPromise = gatherCitestcyclePayloads(receiver, events => {
+        assertEventCounts(events, {
+          test_session_end: 1,
+          test_module_end: 1,
+          test_suite_end: 3,
+          test: 7,
+        })
+
+        const tests = getEventContents(events, 'test')
+        const suites = getEventContents(events, 'test_suite_end')
+        const [testSession] = getEventContents(events, 'test_session_end')
+        assert.strictEqual(testSession.meta[TEST_MANAGEMENT_ENABLED], 'true')
+
+        const disabledTest = getTestByName(tests, 'disable tests can disable a test')
+        assert.strictEqual(disabledTest.meta[TEST_STATUS], 'skip')
+        assert.strictEqual(disabledTest.meta[TEST_MANAGEMENT_IS_DISABLED], 'true')
+
+        const quarantinedTest = getTestByName(tests, 'quarantine tests can quarantine a test')
+        assert.strictEqual(quarantinedTest.meta[TEST_STATUS], 'fail')
+        assert.strictEqual(quarantinedTest.meta[TEST_FINAL_STATUS], 'skip')
+        assert.strictEqual(quarantinedTest.meta[TEST_MANAGEMENT_IS_QUARANTINED], 'true')
+
+        const quarantinedSuite = suites.find(suite =>
+          suite.meta[TEST_SOURCE_FILE] === 'ci-visibility/vitest-tests/test-quarantine.mjs'
+        )
+        assert.ok(quarantinedSuite, inspect(suites.map(suite => suite.meta[TEST_SOURCE_FILE])))
+        assert.strictEqual(quarantinedSuite.meta[TEST_STATUS], 'pass')
+        assert.ok(!(ERROR_MESSAGE in quarantinedSuite.meta), inspect(quarantinedSuite.meta))
+
+        const attemptedToFixTests = getTestsByName(tests, 'attempt to fix tests can attempt to fix a test')
+        assert.strictEqual(attemptedToFixTests.length, 3)
+
+        attemptedToFixTests.forEach((test, index) => {
+          assert.strictEqual(test.meta[TEST_MANAGEMENT_IS_ATTEMPT_TO_FIX], 'true')
+          if (index === 0) {
+            assert.ok(!(TEST_IS_RETRY in test.meta))
+            return
+          }
+          assert.strictEqual(test.meta[TEST_IS_RETRY], 'true')
+          assert.strictEqual(test.meta[TEST_RETRY_REASON], TEST_RETRY_REASON_TYPES.atf)
+        })
+
+        const finalAttempt = attemptedToFixTests[attemptedToFixTests.length - 1]
+        assert.strictEqual(finalAttempt.meta[TEST_STATUS], 'fail')
+        assert.strictEqual(finalAttempt.meta[TEST_FINAL_STATUS], 'fail')
+        assert.strictEqual(finalAttempt.meta[TEST_HAS_FAILED_ALL_RETRIES], 'true')
+        assert.strictEqual(finalAttempt.meta[TEST_MANAGEMENT_ATTEMPT_TO_FIX_PASSED], 'false')
+      })
+
+      const exitCode = await Promise.all([
+        runVitest({
+          POOL_CONFIG: 'forks',
+          TEST_DIR: 'ci-visibility/vitest-tests/test-{disabled,quarantine,attempt-to-fix}.mjs',
+        }),
+        payloadsPromise,
+      ]).then(([exitCode]) => exitCode)
+
+      assert.strictEqual(exitCode, 1, testOutput)
+    })
+
+    it('does not skip disabled attempt-to-fix tests in no-worker mode', async () => {
+      receiver.setSettings({
+        test_management: {
+          enabled: true,
+          attempt_to_fix_retries: 2,
+        },
+      })
+      receiver.setTestManagementTests({
+        vitest: {
+          suites: {
+            'ci-visibility/vitest-tests/test-attempt-to-fix.mjs': {
+              tests: {
+                'attempt to fix tests can attempt to fix a test': {
+                  properties: {
+                    attempt_to_fix: true,
+                    disabled: true,
+                  },
+                },
+              },
+            },
+          },
+        },
+      })
+
+      const payloadsPromise = gatherCitestcyclePayloads(receiver, events => {
+        assertEventCounts(events, {
+          test_session_end: 1,
+          test_module_end: 1,
+          test_suite_end: 1,
+          test: 3,
+        })
+
+        const attemptedToFixTests = getTestsByName(
+          getEventContents(events, 'test'),
+          'attempt to fix tests can attempt to fix a test'
+        )
+        assert.strictEqual(attemptedToFixTests.length, 3)
+
+        attemptedToFixTests.forEach((test, index) => {
+          assert.strictEqual(test.meta[TEST_STATUS], 'fail')
+          assert.strictEqual(test.meta[TEST_MANAGEMENT_IS_ATTEMPT_TO_FIX], 'true')
+          assert.strictEqual(test.meta[TEST_MANAGEMENT_IS_DISABLED], 'true')
+          if (index === 0) {
+            assert.ok(!(TEST_IS_RETRY in test.meta))
+            return
+          }
+          assert.strictEqual(test.meta[TEST_IS_RETRY], 'true')
+          assert.strictEqual(test.meta[TEST_RETRY_REASON], TEST_RETRY_REASON_TYPES.atf)
+        })
+
+        const finalAttempt = attemptedToFixTests[attemptedToFixTests.length - 1]
+        assert.strictEqual(finalAttempt.meta[TEST_FINAL_STATUS], 'fail')
+        assert.strictEqual(finalAttempt.meta[TEST_HAS_FAILED_ALL_RETRIES], 'true')
+        assert.strictEqual(finalAttempt.meta[TEST_MANAGEMENT_ATTEMPT_TO_FIX_PASSED], 'false')
+      })
+
+      const exitCode = await Promise.all([
+        runVitest({
+          POOL_CONFIG: 'forks',
+          TEST_DIR: 'ci-visibility/vitest-tests/test-attempt-to-fix.mjs',
+        }),
+        payloadsPromise,
+      ]).then(([exitCode]) => exitCode)
+
+      assert.strictEqual(exitCode, 1, testOutput)
+    })
+
+    it('applies no-worker setup data for auto test retries', async () => {
+      receiver.setSettings({
+        itr_enabled: false,
+        code_coverage: false,
+        tests_skipping: false,
+        flaky_test_retries_enabled: true,
+        early_flake_detection: {
+          enabled: false,
+        },
+      })
+
+      const payloadsPromise = gatherCitestcyclePayloads(receiver, events => {
+        assertEventCounts(events, {
+          test_session_end: 1,
+          test_module_end: 1,
+          test_suite_end: 1,
+          test: 9,
+        })
+
+        const tests = getEventContents(events, 'test')
+        const eventuallyPassingTests = getTestsByName(
+          tests,
+          'flaky test retries can retry tests that eventually pass'
+        )
+        assert.strictEqual(eventuallyPassingTests.length, 4)
+        assert.ok(!(TEST_IS_RETRY in eventuallyPassingTests[0].meta), inspect(eventuallyPassingTests[0].meta))
+        for (const retryTest of eventuallyPassingTests.slice(1)) {
+          assert.strictEqual(retryTest.meta[TEST_IS_RETRY], 'true')
+          assert.strictEqual(retryTest.meta[TEST_RETRY_REASON], TEST_RETRY_REASON_TYPES.atr)
+        }
+        assert.strictEqual(eventuallyPassingTests[3].meta[TEST_STATUS], 'pass')
+        assert.strictEqual(eventuallyPassingTests[3].meta[TEST_FINAL_STATUS], 'pass')
+
+        const neverPassingTests = getTestsByName(tests, 'flaky test retries can retry tests that never pass')
+        assert.strictEqual(neverPassingTests.length, 4)
+        assert.ok(!(TEST_IS_RETRY in neverPassingTests[0].meta), inspect(neverPassingTests[0].meta))
+        for (const retryTest of neverPassingTests.slice(1)) {
+          assert.strictEqual(retryTest.meta[TEST_IS_RETRY], 'true')
+          assert.strictEqual(retryTest.meta[TEST_RETRY_REASON], TEST_RETRY_REASON_TYPES.atr)
+        }
+        assert.strictEqual(neverPassingTests[3].meta[TEST_STATUS], 'fail')
+        assert.strictEqual(neverPassingTests[3].meta[TEST_FINAL_STATUS], 'fail')
+        assert.strictEqual(neverPassingTests[3].meta[TEST_HAS_FAILED_ALL_RETRIES], 'true')
+
+        const unnecessaryRetryTest = getTestByName(tests, 'flaky test retries does not retry if unnecessary')
+        assert.ok(!(TEST_IS_RETRY in unnecessaryRetryTest.meta), inspect(unnecessaryRetryTest.meta))
+        assert.ok(!(TEST_RETRY_REASON in unnecessaryRetryTest.meta), inspect(unnecessaryRetryTest.meta))
+        assert.strictEqual(unnecessaryRetryTest.meta[TEST_FINAL_STATUS], 'pass')
+      })
+
+      const exitCode = await Promise.all([
+        runVitest({
+          DD_CIVISIBILITY_FLAKY_RETRY_COUNT: '3',
+          POOL_CONFIG: 'forks',
+          TEST_DIR: 'ci-visibility/vitest-tests/flaky-test-retries.mjs',
+        }),
+        payloadsPromise,
+      ]).then(([exitCode]) => exitCode)
+
+      assert.strictEqual(exitCode, 1, testOutput)
+    })
+
+    it('reports user configured Vitest retries as external retries in no-worker mode', async () => {
+      receiver.setSettings({
+        itr_enabled: false,
+        code_coverage: false,
+        tests_skipping: false,
+        flaky_test_retries_enabled: true,
+        early_flake_detection: {
+          enabled: false,
+        },
+      })
+
+      const payloadsPromise = gatherCitestcyclePayloads(receiver, events => {
+        assertEventCounts(events, {
+          test_session_end: 1,
+          test_module_end: 1,
+          test_suite_end: 1,
+          test: 5,
+        })
+
+        const tests = getEventContents(events, 'test')
+        const retriedTests = getTestsByName(tests, 'flaky test retries can retry tests that eventually pass')
+        assert.strictEqual(retriedTests.length, 2)
+        assert.ok(!(TEST_IS_RETRY in retriedTests[0].meta), inspect(retriedTests[0].meta))
+        assert.ok(!(TEST_RETRY_REASON in retriedTests[0].meta), inspect(retriedTests[0].meta))
+        assert.strictEqual(retriedTests[1].meta[TEST_IS_RETRY], 'true')
+        assert.strictEqual(retriedTests[1].meta[TEST_RETRY_REASON], TEST_RETRY_REASON_TYPES.ext)
+        assert.strictEqual(retriedTests[1].meta[TEST_FINAL_STATUS], 'fail')
+        assert.ok(!(TEST_HAS_FAILED_ALL_RETRIES in retriedTests[1].meta), inspect(retriedTests[1].meta))
+
+        const atrTaggedTests = tests.filter(test => test.meta[TEST_RETRY_REASON] === TEST_RETRY_REASON_TYPES.atr)
+        assert.strictEqual(atrTaggedTests.length, 0, inspect(atrTaggedTests.map(test => test.meta)))
+      })
+
+      const exitCode = await Promise.all([
+        runVitest({
+          DD_CIVISIBILITY_FLAKY_RETRY_COUNT: '3',
+          PROJECT_POOL_CONFIG: 'forks',
+          PROJECT_RETRY_CONFIG: '1',
+          TEST_DIR: 'ci-visibility/vitest-tests/flaky-test-retries.mjs',
+        }, './node_modules/.bin/vitest run --project project-pool'),
+        payloadsPromise,
+      ]).then(([exitCode]) => exitCode)
+
+      assert.strictEqual(exitCode, 1, testOutput)
+    })
+
+    it('does not double report delayed final failed Vitest retries in no-worker mode', async () => {
+      receiver.setSettings({
+        itr_enabled: false,
+        code_coverage: false,
+        tests_skipping: false,
+        flaky_test_retries_enabled: false,
+        early_flake_detection: {
+          enabled: false,
+        },
+      })
+
+      const payloadsPromise = gatherCitestcyclePayloads(receiver, events => {
+        assertEventCounts(events, {
+          test_session_end: 1,
+          test_module_end: 1,
+          test_suite_end: 1,
+          test: 2,
+        })
+
+        const retriedTests = getTestsByName(
+          getEventContents(events, 'test'),
+          'slow failing retry does not double report final failed retry'
+        )
+        assert.strictEqual(retriedTests.length, 2)
+        assert.ok(!(TEST_IS_RETRY in retriedTests[0].meta), inspect(retriedTests[0].meta))
+        assert.strictEqual(retriedTests[0].meta[TEST_STATUS], 'fail')
+        assert.ok(
+          Number(retriedTests[0].duration) < 100 * 1e6,
+          'Expected first attempt duration to exclude the delayed final retry, got ' +
+            `${Number(retriedTests[0].duration) / 1e6}ms`
+        )
+        assert.strictEqual(retriedTests[1].meta[TEST_IS_RETRY], 'true')
+        assert.strictEqual(retriedTests[1].meta[TEST_RETRY_REASON], TEST_RETRY_REASON_TYPES.ext)
+        assert.strictEqual(retriedTests[1].meta[TEST_STATUS], 'fail')
+        assert.strictEqual(retriedTests[1].meta[TEST_FINAL_STATUS], 'fail')
+        assert.ok(!(TEST_HAS_FAILED_ALL_RETRIES in retriedTests[1].meta), inspect(retriedTests[1].meta))
+      })
+
+      const exitCode = await Promise.all([
+        runVitest({
+          PROJECT_POOL_CONFIG: 'forks',
+          PROJECT_RETRY_CONFIG: '1',
+          TEST_DIR: 'ci-visibility/vitest-tests/slow-failing-retry.mjs',
+        }, './node_modules/.bin/vitest run --project project-pool'),
+        payloadsPromise,
+      ]).then(([exitCode]) => exitCode)
+
+      assert.strictEqual(exitCode, 1, testOutput)
+    })
+
+    it('applies no-worker setup data for impacted tests', async () => {
+      receiver.setSettings({
+        impacted_tests_enabled: true,
+        early_flake_detection: {
+          enabled: false,
+        },
+      })
+
+      execSync('git checkout -b no-worker-impacted-test', { cwd, stdio: 'ignore' })
+      fs.writeFileSync(
+        path.join(cwd, 'ci-visibility/vitest-tests/impacted-test.mjs'),
+        `import { describe, test, expect } from 'vitest'
+
+describe('impacted test', () => {
+  test('can impacted test', () => {
+    expect(2 + 2).to.equal(4)
+  })
+})
+`
+      )
+      execSync('git add ci-visibility/vitest-tests/impacted-test.mjs', { cwd, stdio: 'ignore' })
+      execSync('git commit -m "modify impacted test"', { cwd, stdio: 'ignore' })
+
+      try {
+        const payloadsPromise = gatherCitestcyclePayloads(receiver, events => {
+          assertEventCounts(events, {
+            test_session_end: 1,
+            test_module_end: 1,
+            test_suite_end: 1,
+            test: 1,
+          })
+
+          const tests = getEventContents(events, 'test')
+          const impactedTest = getTestByName(tests, 'impacted test can impacted test')
+          assert.strictEqual(impactedTest.meta[TEST_STATUS], 'pass')
+          assert.strictEqual(impactedTest.meta[TEST_IS_MODIFIED], 'true')
+          assert.ok(!(TEST_IS_NEW in impactedTest.meta), inspect(impactedTest.meta))
+          assert.ok(!(TEST_IS_RETRY in impactedTest.meta), inspect(impactedTest.meta))
+        })
+
+        const exitCode = await Promise.all([
+          runVitest({
+            GITHUB_BASE_REF: '',
+            POOL_CONFIG: 'forks',
+            TEST_DIR: 'ci-visibility/vitest-tests/impacted-test.mjs',
+          }),
+          payloadsPromise,
+        ]).then(([exitCode]) => exitCode)
+
+        assert.strictEqual(exitCode, 0, testOutput)
+      } finally {
+        execSync('git checkout -', { cwd, stdio: 'ignore' })
+        execSync('git branch -D no-worker-impacted-test', { cwd, stdio: 'ignore' })
+      }
+    })
+
+    it('applies no-worker setup data for early flake detection', async () => {
+      receiver.setSettings({
+        early_flake_detection: {
+          enabled: true,
+          slow_test_retries: {
+            '5s': 2,
+          },
+          faulty_session_threshold: 100,
+        },
+        known_tests_enabled: true,
+      })
+      receiver.setKnownTests({
+        vitest: {
+          'ci-visibility/vitest-tests/early-flake-detection.mjs': [
+            'early flake detection does not retry if it is not new',
+          ],
+        },
+      })
+
+      const payloadsPromise = gatherCitestcyclePayloads(receiver, events => {
+        const tests = getEventContents(events, 'test')
+        const [testSession] = getEventContents(events, 'test_session_end')
+        assert.strictEqual(testSession.meta[TEST_EARLY_FLAKE_ENABLED], 'true')
+
+        const alwaysPassTests = getTestsByName(tests, 'early flake detection can retry tests that always pass')
+        assert.strictEqual(alwaysPassTests.length, 3)
+        assert.strictEqual(alwaysPassTests[0].meta[TEST_IS_NEW], 'true')
+        assert.ok(!(TEST_IS_RETRY in alwaysPassTests[0].meta))
+        for (const retryTest of alwaysPassTests.slice(1)) {
+          assert.strictEqual(retryTest.meta[TEST_IS_NEW], 'true')
+          assert.strictEqual(retryTest.meta[TEST_IS_RETRY], 'true')
+          assert.strictEqual(retryTest.meta[TEST_RETRY_REASON], TEST_RETRY_REASON_TYPES.efd)
+        }
+
+        const knownTest = getTestByName(tests, 'early flake detection does not retry if it is not new')
+        assert.ok(!(TEST_IS_NEW in knownTest.meta))
+        assert.ok(!(TEST_IS_RETRY in knownTest.meta))
+      })
+
+      const exitCode = await Promise.all([
+        runVitest({
+          TEST_DIR: 'ci-visibility/vitest-tests/early-flake-detection.mjs',
+          POOL_CONFIG: 'forks',
+        }),
+        payloadsPromise,
+      ]).then(([exitCode]) => exitCode)
+
+      assert.strictEqual(exitCode, 0, testOutput)
+    })
+
+    it('keeps a failed slow EFD test failed when remaining repeats are no-ops', async () => {
+      receiver.setSettings({
+        early_flake_detection: {
+          enabled: true,
+          slow_test_retries: {
+            '5s': 0,
+            '10s': 2,
+          },
+          faulty_session_threshold: 100,
+        },
+        known_tests_enabled: true,
+      })
+      receiver.setKnownTests({ vitest: {} })
+
+      const payloadsPromise = gatherCitestcyclePayloads(receiver, events => {
+        const tests = getEventContents(events, 'test')
+        const [testSession] = getEventContents(events, 'test_session_end')
+        const retriedTests = getTestsByName(tests, 'early flake detection can retry tests that always pass')
+        assert.ok(retriedTests.length > 0, inspect(tests.map(test => test.meta[TEST_NAME])))
+        retriedTests.forEach(test => {
+          assert.strictEqual(test.meta[TEST_STATUS], 'fail', inspect(test.meta))
+        })
+        const finalTest = retriedTests[retriedTests.length - 1]
+        assert.strictEqual(finalTest.meta[TEST_FINAL_STATUS], 'fail')
+        assert.strictEqual(finalTest.meta[TEST_EARLY_FLAKE_ABORT_REASON], 'slow')
+        assert.ok(!(TEST_IS_RETRY in finalTest.meta), inspect(finalTest.meta))
+        assert.strictEqual(testSession.meta[TEST_STATUS], 'fail')
+      })
+
+      const exitCode = await Promise.all([
+        runVitest({
+          ALWAYS_FAIL: '1',
+          TEST_DIR: 'ci-visibility/vitest-tests/early-flake-detection.mjs',
+          POOL_CONFIG: 'forks',
+        }, './node_modules/.bin/vitest run -t "can retry tests that always pass"'),
+        payloadsPromise,
+      ]).then(([exitCode]) => exitCode)
+
+      assert.strictEqual(exitCode, 1, testOutput)
+    })
+  })
+})
+
+describe(`vitest@${UNSUPPORTED_VERSION} no-worker init`, () => {
+  let cwd, receiver, childProcess, testOutput
+
+  useSandbox([
+    `vitest@${UNSUPPORTED_VERSION}`,
+    'tinypool',
+  ], true)
+
+  before(function () {
+    cwd = sandboxCwd()
+  })
+
+  beforeEach(async function () {
+    childProcess = undefined
+    testOutput = ''
+    receiver = await new FakeCiVisIntake().start()
+  })
+
+  afterEach(async () => {
+    childProcess?.kill()
+    await receiver.stop()
+  })
+
+  async function runVitest (extraEnv = {}) {
+    childProcess = exec(
+      './node_modules/.bin/vitest run',
+      {
+        cwd,
+        env: getNoWorkerInitEnv(receiver, extraEnv),
+      }
+    )
+
+    childProcess.stdout.on('data', data => { testOutput += data })
+    childProcess.stderr.on('data', data => { testOutput += data })
+
+    const [exitCode] = await once(childProcess, 'exit')
+    return exitCode
+  }
+
+  for (const poolConfig of ['forks', 'threads']) {
+    it(`warns and falls back to worker instrumentation with pool=${poolConfig}`, async () => {
+      const payloadsPromise = gatherCitestcyclePayloads(receiver, events => {
+        assertEventCounts(events, {
+          test_session_end: 1,
+          test_module_end: 1,
+          test_suite_end: 1,
+          test: 1,
+        })
+
+        const [test] = getEventContents(events, 'test')
+        assert.strictEqual(test.meta[TEST_NAME], 'vitest worker env sets DD_VITEST_WORKER')
+        assert.strictEqual(test.meta[TEST_STATUS], 'pass')
+        assert.strictEqual(test.meta[TEST_IS_TEST_FRAMEWORK_WORKER], 'true')
+      })
+
+      const exitCode = await Promise.all([
+        runVitest({
+          TEST_DIR: 'ci-visibility/vitest-tests/vitest-worker-env.mjs',
+          POOL_CONFIG: poolConfig,
+          DD_TRACE_DEBUG: 'true',
+          DD_TRACE_LOG_LEVEL: 'warn',
+          EXPECT_DD_TEST_OPT_VITEST_NO_WORKER_INIT_INACTIVE: '1',
+        }),
+        payloadsPromise,
+      ]).then(([exitCode]) => exitCode)
+
+      assert.strictEqual(exitCode, 0, testOutput)
+      assert.match(testOutput, new RegExp(UNSUPPORTED_VERSION_WARNING), testOutput)
+    })
+  }
+})
diff --git a/loader-hook.mjs b/loader-hook.mjs
index c52e204c0a..5f363b9cde 100644
--- a/loader-hook.mjs
+++ b/loader-hook.mjs
@@ -13,12 +13,37 @@ import { isRelativeRequire } from './packages/datadog-instrumentations/src/helpe
 
 // This file must support Node.js 12.0.0 syntax
 
+const { builtinModules } = Module
 const regexpEscape = regexpEscapeModule.default
 const require = Module.createRequire(import.meta.url)
 let syncImportInTheMiddleHook
 
-// For some reason `getEnvironmentVariable` is not otherwise available to ESM.
-const env = configHelper.getEnvironmentVariable
+// The config helper's named exports aren't visible to ESM; destructure the default.
+const { getValueFromEnvSources } = configHelper
+
+// Substrings of resolved URLs that import-in-the-middle must never wrap: re-export
+// shims and internal helper graphs that break when proxied, plus iitm's own files
+// (via `middle`). One alternation so a single test() covers every excluded load.
+export const iitmExclusionRegExp = /middle|langsmith|openai\/_shims|openai\/resources\/chat\/completions\/messages|openai\/agents-core\/dist\/shims|@anthropic-ai\/sdk\/_shims/
+
+// Instrumented bare specifiers (`import 'express'`, builtins, symlinked or
+// workspace packages) match against the specifier (the Set); their files inside
+// node_modules match against the URL (the alternation). regexpEscape guards
+// against a regex metacharacter entering a package name.
+const includeModuleNames = new Set()
+let moduleNameAlternation = ''
+for (const moduleName of Object.keys(hooks)) {
+  // Relative hooks resolve outside node_modules and are not instrumented here.
+  if (isRelativeRequire(moduleName)) continue
+  includeModuleNames.add(moduleName)
+  // iitm matches a built-in by its node: specifier too, so mirror that and
+  // wrap `import 'node:crypto'` as well as `import 'crypto'`.
+  if (builtinModules.includes(moduleName)) includeModuleNames.add(`node:${moduleName}`)
+  if (moduleNameAlternation !== '') moduleNameAlternation += '|'
+  moduleNameAlternation += regexpEscape(moduleName)
+}
+
+const nodeModulesIncludeSource = `node_modules/(?:${moduleNameAlternation})/(?!node_modules).+`
 
 function initialize (data = {}) {
   prepareImportInTheMiddleOptions(data)
@@ -26,16 +51,59 @@ function initialize (data = {}) {
 }
 
 function prepareImportInTheMiddleOptions (data = {}) {
-  if (data.include == null) data.include = []
-  if (data.exclude == null) data.exclude = []
-
-  addInstrumentations(data)
-  addSecurityControls(data)
-  addExclusions(data)
+  // A consumer-owned shouldInclude predicate takes over the wrapping decision, so
+  // iitm ignores the include/exclude arrays. Building the matcher here keeps the
+  // synchronous and asynchronous loaders on one matching implementation.
+  data.shouldInclude = createShouldInclude(getValueFromEnvSources('DD_IAST_SECURITY_CONTROLS_CONFIGURATION'))
 
   return data
 }
 
+/**
+ * Builds the import-in-the-middle `shouldInclude(url, specifier)` predicate. iitm
+ * calls it for every resolved module and wraps the module when the result is
+ * truthy; supplying it replaces iitm's include/exclude list scan.
+ *
+ * @param {string} [securityControlsConfig] Raw `DD_IAST_SECURITY_CONTROLS_CONFIGURATION`;
+ *   each entry's module path is instrumented in addition to the hook table.
+ */
+function createShouldInclude (securityControlsConfig) {
+  const includeRegExp = new RegExp(buildIncludeSource(securityControlsConfig))
+
+  /**
+   * @param {string} url Resolved module URL (`file:`, `node:`, ...).
+   * @param {string} specifier Original import specifier.
+   */
+  return function shouldInclude (url, specifier) {
+    return (includeModuleNames.has(specifier) || includeRegExp.test(url)) && !iitmExclusionRegExp.test(url)
+  }
+}
+
+/**
+ * Appends each `DD_IAST_SECURITY_CONTROLS_CONFIGURATION` module path — the third
+ * `:`-separated segment of every `;`-separated `<type>:<marks>:<module>:<...>` entry —
+ * to the include alternation, escaped.
+ *
+ * @param {string} [securityControlsConfig] Raw `DD_IAST_SECURITY_CONTROLS_CONFIGURATION`.
+ */
+function buildIncludeSource (securityControlsConfig) {
+  if (!securityControlsConfig) return nodeModulesIncludeSource
+
+  let includeSource = nodeModulesIncludeSource
+  for (const entry of securityControlsConfig.split(';')) {
+    if (!entry) continue
+    const first = entry.indexOf(':')
+    if (first === -1) continue
+    const second = entry.indexOf(':', first + 1)
+    if (second === -1) continue
+    const third = entry.indexOf(':', second + 1)
+
+    const subpath = entry.slice(second + 1, third === -1 ? undefined : third).trim()
+    if (subpath) includeSource += `|${regexpEscape(subpath)}`
+  }
+  return includeSource
+}
+
 function load (url, context, nextLoad) {
   return rewriterLoader.load(url, context, (url, context) => origLoad(url, context, nextLoad))
 }
@@ -113,51 +181,4 @@ function registerSyncLoaderHooks (data = {}) {
   return true
 }
 
-function addInstrumentations (data) {
-  const instrumentations = Object.keys(hooks)
-
-  for (const moduleName of instrumentations) {
-    // Skip instrumentation hooks with relative module names
-    // since there is no current business need of instrumenting imports outside of the node_modules folder
-    if (!isRelativeRequire(moduleName)) {
-      data.include.push(new RegExp(`node_modules/${moduleName}/(?!node_modules).+`), moduleName)
-    }
-  }
-}
-
-function addSecurityControls (data) {
-  const raw = env('DD_IAST_SECURITY_CONTROLS_CONFIGURATION')
-  if (!raw) return
-  // Parse `;`-separated entries and take the 3rd `:`-separated segment.
-  // Expected form (per entry): `<...>:<...>:<subpath>:<...>`
-  const entries = raw.split(';')
-  for (const entry of entries) {
-    if (entry) {
-      const first = entry.indexOf(':')
-      if (first === -1) continue
-      const second = entry.indexOf(':', first + 1)
-      if (second === -1) continue
-      const third = entry.indexOf(':', second + 1)
-
-      const subpath = entry.slice(second + 1, third === -1 ? undefined : third).trim()
-      if (subpath) {
-        data.include.push(new RegExp(regexpEscape(subpath)))
-      }
-    }
-  }
-}
-
-function addExclusions (data) {
-  data.exclude.push(...iitmExclusions)
-}
-
-export const iitmExclusions = [
-  /middle/,
-  /langsmith/,
-  /openai\/_shims/,
-  /openai\/resources\/chat\/completions\/messages/,
-  /openai\/agents-core\/dist\/shims/,
-  /@anthropic-ai\/sdk\/_shims/,
-]
-
 export { initialize, load, registerSyncLoaderHooks, resolve }
diff --git a/nyc.config.js b/nyc.config.js
index e3d9c8a28b..d07861ee66 100644
--- a/nyc.config.js
+++ b/nyc.config.js
@@ -16,6 +16,10 @@ module.exports = {
   reporter: [
     'text',
     'lcov',
+    // Codecov reads branch and function coverage from istanbul's native JSON via its NodeProcessor;
+    // its lcov parser only ingests line hits. Datadog accepts the lcov, so All Green uploads each
+    // format to the backend that reads it best.
+    'json',
   ],
   include: [
     '**/ext/**/*.{js,mjs}',
diff --git a/package.json b/package.json
index c93ea63261..43ad4eb3ed 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "dd-trace",
-  "version": "5.110.0",
+  "version": "5.111.0",
   "description": "Datadog APM tracing client for JavaScript",
   "main": "index.js",
   "typings": "index.d.ts",
@@ -46,7 +46,7 @@
     "test:webpack:ci": "nyc --silent node init && nyc -- npm run test:webpack",
     "test:instrumentations": "mocha \"packages/datadog-instrumentations/test/@(${PLUGINS}).spec.js\"",
     "test:instrumentations:ci": "yarn services && nyc --silent node init && nyc -- npm run test:instrumentations",
-    "test:instrumentations:misc": "mocha \"packages/datadog-instrumentations/test/*/**/*.spec.js\"",
+    "test:instrumentations:misc": "mocha \"packages/datadog-instrumentations/test/*/**/*.spec.{js,mjs}\"",
     "test:instrumentations:misc:ci": "nyc --silent node init && nyc -- npm run test:instrumentations:misc",
     "test:core": "node scripts/mocha-parallel-files.js --expose-gc --timeout 30000 -- \"packages/datadog-core/test/**/*.spec.js\"",
     "test:core:ci": "nyc --silent node init && nyc -- npm run test:core",
@@ -104,7 +104,7 @@
     "test:integration:plugins:coverage": "yarn services && node ./integration-tests/coverage/run-suite.js \"packages/datadog-plugin-@(${PLUGINS})/test/integration-test/**/${SPEC:-*}*.spec.js\"",
     "test:unit:plugins": "mocha \"packages/datadog-instrumentations/test/@(${PLUGINS}).spec.js\" \"packages/datadog-plugin-@(${PLUGINS})/test/**/*.spec.js\" --exclude \"packages/datadog-plugin-@(${PLUGINS})/test/integration-test/**/*.spec.js\"",
     "test:release": "mocha \"scripts/release/**/*.spec.js\"",
-    "test:scripts": "mocha \"scripts/helpers/**/*.spec.js\"",
+    "test:scripts": "mocha \"scripts/helpers/**/*.spec.js\" \"scripts/*.spec.mjs\"",
     "test:shimmer": "mocha \"packages/datadog-shimmer/test/**/*.spec.js\"",
     "test:shimmer:ci": "nyc --silent node init && nyc -- npm run test:shimmer",
     "verify:workflow-job-names": "node scripts/verify-workflow-job-names.js",
@@ -164,7 +164,7 @@
   ],
   "dependencies": {
     "dc-polyfill": "^0.1.11",
-    "import-in-the-middle": "^3.1.0",
+    "import-in-the-middle": "^3.2.0",
     "opentracing": ">=0.14.7"
   },
   "optionalDependencies": {
@@ -192,7 +192,7 @@
     "@types/mocha": "^10.0.10",
     "@types/node": "^18.19.106",
     "@types/sinon": "^21.0.1",
-    "axios": "^1.18.0",
+    "axios": "^1.18.1",
     "benchmark": "^2.1.4",
     "body-parser": "^2.3.0",
     "bun": "1.3.14",
@@ -201,15 +201,15 @@
     "eslint": "^9.39.2",
     "eslint-plugin-cypress": "^6.4.1",
     "eslint-plugin-import": "^2.32.0",
-    "eslint-plugin-jsdoc": "^63.0.6",
+    "eslint-plugin-jsdoc": "^63.0.8",
     "eslint-plugin-mocha": "^11.3.0",
-    "eslint-plugin-n": "^18.1.0",
+    "eslint-plugin-n": "^18.2.0",
     "eslint-plugin-promise": "^7.3.0",
     "eslint-plugin-sonarjs": "^4.1.0",
     "eslint-plugin-unicorn": "^64.0.0",
     "express": "^5.1.0",
     "glob": "^10.4.5",
-    "globals": "^17.2.0",
+    "globals": "^17.7.0",
     "graphql": "*",
     "husky": "^9.1.7",
     "istanbul-lib-report": "^3.0.0",
@@ -227,7 +227,7 @@
     "proxyquire": "^2.1.3",
     "retry": "^0.13.1",
     "semifies": "^1.0.0",
-    "semver": "^7.8.4",
+    "semver": "^7.8.5",
     "sinon": "^22.0.0",
     "tiktoken": "^1.0.21",
     "typescript": "^6.0.3",
diff --git a/packages/datadog-instrumentations/src/fs.js b/packages/datadog-instrumentations/src/fs.js
index 0ab68bfe55..4001cc1455 100644
--- a/packages/datadog-instrumentations/src/fs.js
+++ b/packages/datadog-instrumentations/src/fs.js
@@ -88,8 +88,10 @@ addHook({ name: 'fs' }, fs => {
   const asyncMethods = Object.keys(paramsByMethod)
   const syncMethods = asyncMethods.map(name => `${name}Sync`)
 
-  massWrap(fs, asyncMethods, createWrapFunction())
-  massWrap(fs, syncMethods, createWrapFunction())
+  // Node 20 defines `fs.opendir` / `fs.opendirSync` as lazy accessor properties;
+  // `replaceGetter` resolves the method so the call is wrapped, not the accessor.
+  massWrap(fs, asyncMethods, createWrapFunction(), { replaceGetter: true })
+  massWrap(fs, syncMethods, createWrapFunction(), { replaceGetter: true })
   massWrap(fs.promises, asyncMethods, createWrapFunction('promises.'))
 
   wrap(fs.realpath, 'native', createWrapFunction('', 'realpath.native'))
@@ -355,15 +357,15 @@ function getMessage (operation, params, args, self) {
   return { operation, ...metadata }
 }
 
-function massWrap (target, methods, wrapper) {
+function massWrap (target, methods, wrapper, options) {
   for (const method of methods) {
-    wrap(target, method, wrapper)
+    wrap(target, method, wrapper, options)
   }
 }
 
-function wrap (target, method, wrapper) {
+function wrap (target, method, wrapper, options) {
   try {
-    shimmer.wrap(target, method, wrapper)
+    shimmer.wrap(target, method, wrapper, options)
   } catch {
     // skip unavailable method
   }
diff --git a/packages/datadog-instrumentations/src/graphql.js b/packages/datadog-instrumentations/src/graphql.js
index 35c8f1e42d..1e90d03cd8 100644
--- a/packages/datadog-instrumentations/src/graphql.js
+++ b/packages/datadog-instrumentations/src/graphql.js
@@ -1,515 +1,46 @@
 'use strict'
 
-const { AsyncLocalStorage } = require('node:async_hooks')
+const { addHook, getHooks } = require('./helpers/instrument')
 
-const shimmer = require('../../datadog-shimmer')
-const {
-  addHook,
-  channel,
-} = require('./helpers/instrument')
+// Orchestrion rewriter handles wrapping of:
+// - graphql: execute, parse, validate (CJS + ESM)
+// - @graphql-tools/executor: execute, normalizedExecutor (CJS + ESM)
+// See helpers/rewriter/instrumentations/graphql.js for the full config.
+//
+// The plugin (packages/datadog-plugin-graphql/src/execute.js) handles the
+// `apm:graphql:execute:start` AppSec/WAF contract from inside its bindStart:
+// publishing the channel synchronously runs subscribers, and an
+// `abortController.abort()` from a subscriber is observed by replacing
+// `ctx.arguments[0]` with an object whose getters throw AbortError. The
+// orchestrion-emitted wrapper's `catch { ...; throw err }` block propagates
+// that throw to the caller of graphql.execute. No outer wrap needed.
 
-const ddGlobal = globalThis[Symbol.for('dd-trace')]
-
-/** cached objects */
-
-// `contexts` is the fast resolver-side lookup; `executeCtx` is the fallback
-// when `contextValue` is a primitive and cannot key a WeakMap.
-const contexts = new WeakMap()
-const executeCtx = new AsyncLocalStorage()
-// Tracks normalized args already instrumented in an outer wrap so graphql-yoga
-// (which stacks `execute` + `normalizedExecutor`) only emits one span per call.
-const instrumentedArgs = new WeakSet()
-const documentSources = new WeakMap()
-const patchedResolvers = new WeakSet()
-const patchedTypes = new WeakSet()
-
-/** CHANNELS */
-
-// execute channels
-const startExecuteCh = channel('apm:graphql:execute:start')
-const finishExecuteCh = channel('apm:graphql:execute:finish')
-const executeErrorCh = channel('apm:graphql:execute:error')
-
-// resolve channels
-const startResolveCh = channel('apm:graphql:resolve:start')
-const finishResolveCh = channel('apm:graphql:resolve:finish')
-const updateFieldCh = channel('apm:graphql:resolve:updateField')
-const resolveErrorCh = channel('apm:graphql:resolve:error')
-
-// parse channels
-const parseStartCh = channel('apm:graphql:parser:start')
-const parseFinishCh = channel('apm:graphql:parser:finish')
-const parseErrorCh = channel('apm:graphql:parser:error')
-
-// validate channels
-const validateStartCh = channel('apm:graphql:validate:start')
-const validateFinishCh = channel('apm:graphql:validate:finish')
-const validateErrorCh = channel('apm:graphql:validate:error')
-
-class AbortError extends Error {
-  constructor (message) {
-    super(message)
-    this.name = 'AbortError'
-  }
-}
-
-const types = new Set(['query', 'mutation', 'subscription'])
-
-function getOperation (document, operationName) {
-  if (!document || !Array.isArray(document.definitions)) {
-    return
-  }
-
-  for (const definition of document.definitions) {
-    if (definition && types.has(definition.operation) && (!operationName || definition.name?.value === operationName)) {
-      return definition
-    }
-  }
+for (const hook of getHooks('graphql')) {
+  addHook(hook, exports => exports)
 }
 
-function normalizeArgs (args, defaultFieldResolver) {
-  if (args.length !== 1) return normalizePositional(args, defaultFieldResolver)
-
-  const original = args[0]
-  const normalized = {
-    ...original,
-    fieldResolver: wrapResolve(original.fieldResolver || defaultFieldResolver),
-  }
-
-  args[0] = normalized
-  return normalized
-}
-
-function normalizePositional (args, defaultFieldResolver) {
-  args[6] = wrapResolve(args[6] || defaultFieldResolver) // fieldResolver
-  args.length = Math.max(args.length, 7)
-
-  return {
-    schema: args[0],
-    document: args[1],
-    rootValue: args[2],
-    contextValue: args[3],
-    variableValues: args[4],
-    operationName: args[5],
-    fieldResolver: args[6],
-  }
-}
-
-// `WeakMap.set` throws `TypeError` on a non-object key; `get`/`has`/`delete`
-// silently miss. Skip the WeakMap entirely for non-keyable `contextValue`.
-function isWeakMapKey (value) {
-  return value !== null && typeof value === 'object'
+for (const hook of getHooks('@graphql-tools/executor')) {
+  addHook(hook, exports => exports)
 }
 
-function wrapParse (parse) {
-  return function (source) {
-    if (!parseStartCh.hasSubscribers) {
-      return parse.apply(this, arguments)
-    }
-
-    const ctx = { source }
-    return parseStartCh.runStores(ctx, () => {
-      try {
-        ctx.document = parse.apply(this, arguments)
-        const operation = getOperation(ctx.document)
-
-        if (!operation) return ctx.document
-
-        if (source) {
-          documentSources.set(ctx.document, source.body || source)
-        }
-        ctx.docSource = documentSources.get(ctx.document)
-
-        return ctx.document
-      } catch (err) {
-        void err.stack
-        ctx.error = err
-        parseErrorCh.publish(ctx)
-
-        throw err
-      } finally {
-        parseFinishCh.publish(ctx)
-      }
-    })
-  }
-}
-
-function wrapValidate (validate) {
-  return function (_schema, document, _rules, _typeInfo) {
-    if (!validateStartCh.hasSubscribers) {
-      return validate.apply(this, arguments)
-    }
-
-    const ctx = { docSource: documentSources.get(document), document }
-    return validateStartCh.runStores(ctx, () => {
-      let errors
-      try {
-        errors = validate.apply(this, arguments)
-        if (errors && errors[0]) {
-          ctx.error = errors[0]
-          validateErrorCh.publish(ctx)
-        }
-        return errors
-      } catch (err) {
-        void err.stack
-        ctx.error = err
-        validateErrorCh.publish(ctx)
-
-        throw err
-      } finally {
-        ctx.errors = errors
-        validateFinishCh.publish(ctx)
-      }
-    })
-  }
-}
-
-function wrapExecute (execute) {
-  return function (exe) {
-    const defaultFieldResolver = execute.defaultFieldResolver
-    return function () {
-      if (!startExecuteCh.hasSubscribers) {
-        return exe.apply(this, arguments)
-      }
-
-      // The outer wrap leaves its normalized args object in `arguments[0]`; on
-      // graphql-yoga's inner wrap that reference is already known here.
-      if (instrumentedArgs.has(arguments[0])) {
-        return exe.apply(this, arguments)
-      }
-
-      const args = normalizeArgs(arguments, defaultFieldResolver)
-      const schema = args.schema
-      const document = args.document
-      const source = documentSources.get(document)
-      const contextValue = args.contextValue
-      const keyable = isWeakMapKey(contextValue)
-      const operation = getOperation(document, args.operationName)
-
-      if (keyable && contexts.has(contextValue)) {
-        return exe.apply(this, arguments)
-      }
-
-      const ctx = {
-        operation,
-        args,
-        docSource: source,
-        source,
-        fields: new Map(),
-        abortController: new AbortController(),
-      }
-
-      // Only the object form leaves a stable single-object handle in
-      // `arguments[0]` for the inner wrap to see.
-      if (args === arguments[0]) instrumentedArgs.add(args)
-
-      return startExecuteCh.runStores(ctx, () => {
-        if (schema) {
-          wrapFields(schema._queryType)
-          wrapFields(schema._mutationType)
-        }
-
-        if (keyable) contexts.set(contextValue, ctx)
-
-        const finish = (err, res) => {
-          if (finishResolveCh.hasSubscribers) finishResolvers(ctx)
-
-          const error = err || (res && res.errors && res.errors[0])
-
-          if (error) {
-            ctx.error = error
-            executeErrorCh.publish(ctx)
-          }
-
-          ctx.res = res
-          if (keyable) contexts.delete(contextValue)
-          instrumentedArgs.delete(args)
-          finishExecuteCh.publish(ctx)
-        }
-
-        // Skip the ALS entry on the common object-`contextValue` path; the
-        // resolver reaches `ctx` via the WeakMap there.
-        return keyable
-          ? callInAsyncScope(exe, this, arguments, ctx.abortController, finish)
-          : executeCtx.run(ctx, () => callInAsyncScope(exe, this, arguments, ctx.abortController, finish))
-      })
-    }
-  }
-}
-
-function wrapResolve (resolve) {
-  if (typeof resolve !== 'function' || patchedResolvers.has(resolve)) return resolve
-
-  function resolveAsync (source, args, contextValue, info) {
-    if (!startResolveCh.hasSubscribers) return resolve.apply(this, arguments)
-
-    // `WeakMap.get(primitive)` returns `undefined`, so the fallback covers
-    // executes that ran with a primitive `contextValue`.
-    const ctx = contexts.get(contextValue) ?? executeCtx.getStore()
-
-    /* istanbul ignore if: resolver invoked outside execute(), so no per-execute ctx was registered */
-    if (!ctx) return resolve.apply(this, arguments)
-
-    const field = assertField(ctx, info, args)
-
-    if (ctx.abortController.signal.aborted) {
-      publishResolverFinish(field, null)
-      throw new AbortError('Aborted')
-    }
-
-    try {
-      const result = resolve.call(this, source, args, contextValue, info)
-      if (result !== null && typeof result?.then === 'function') {
-        return result.then(
-          res => {
-            publishResolverFinish(field, null)
-            return res
-          },
-          error => {
-            publishResolverFinish(field, error)
-            throw error
-          }
-        )
-      }
-      publishResolverFinish(field, null)
-      return result
-    } catch (error) {
-      publishResolverFinish(field, error)
-      throw error
-    }
-  }
-
-  patchedResolvers.add(resolveAsync)
-
-  return resolveAsync
-}
-
-/**
- * @param {{ ctx: object, error: unknown }} field
- * @param {unknown} error
- */
-function publishResolverFinish (field, error) {
-  const fieldCtx = field.ctx
-  fieldCtx.error = error
-  fieldCtx.field = field
-  updateFieldCh.publish(fieldCtx)
-}
-
-function callInAsyncScope (fn, thisArg, args, abortController, cb) {
-  if (abortController.signal.aborted) {
-    cb(null, null)
-    throw new AbortError('Aborted')
-  }
-
-  try {
-    const result = fn.apply(thisArg, args)
-    if (result !== null && typeof result?.then === 'function') {
-      return result.then(
-        res => {
-          cb(null, res)
-          return res
-        },
-        /* istanbul ignore next: graphql.execute() rejects only via custom executors (graphql-yoga / graphql-tools) */
-        error => {
-          cb(error)
-          throw error
-        }
-      )
-    }
-    cb(null, result)
-    return result
-  } catch (error) {
-    cb(error)
-    throw error
-  }
-}
-
-/**
- * @typedef {{ prev: PathNode | undefined, key: string | number }} PathNode
- *
- * @typedef {{ error: unknown, ctx: object }} TrackedField
- */
-
-/**
- * @param {{
- *   fields: Map<object, TrackedField>,
- *   collapse: boolean,
- *   collapsedFields?: Map<string, TrackedField>,
- *   pathCache?: Map<PathNode, string>,
- * }} rootCtx
- * @param {import('graphql').GraphQLResolveInfo} info
- * @param {Record<string, unknown>} args
- */
-function assertField (rootCtx, info, args) {
-  const path = info.path
-  const collapse = rootCtx.collapse
-
-  const cache = rootCtx.pathCache ??= new Map()
-  const prev = path.prev
-  const key = path.key
-  const segment = collapse && typeof key !== 'string' ? '*' : key
-
-  const pathString = prev === undefined
-    ? String(segment)
-    : (cache.get(prev) ?? buildCachedPathString(prev, cache, collapse)) + '.' + segment
-  cache.set(path, pathString)
-
-  const fieldCtx = {
-    rootCtx,
-    args,
-    path,
-    pathString,
-    fieldName: info.fieldName,
-    returnType: info.returnType,
-    fieldNode: info.fieldNodes[0],
-    variableValues: info.variableValues,
-  }
-  // Publish per resolver call, before the collapse / depth dedupe below.
-  // IAST mutates each call's own args object; if siblings 2..N skip the
-  // publish, those args objects never get tainted.
-  startResolveCh.publish(fieldCtx)
-
-  let collapsedFields
-  if (collapse) {
-    collapsedFields = rootCtx.collapsedFields ??= new Map()
-    const existing = collapsedFields.get(pathString)
-    // Subsequent siblings of a collapsed list share the first sibling's field
-    // so updateFieldCh fires for every call and the span's finishTime tracks
-    // the last sibling's completion, not the first.
-    if (existing !== undefined) return existing
-  }
-
-  const field = { error: null, ctx: fieldCtx }
-  rootCtx.fields.set(path, field)
-  if (collapsedFields !== undefined) collapsedFields.set(pathString, field)
-  return field
-}
-
-/**
- * Cold path for assertField. graphql-js inserts a synthetic array-index
- * node between a list field and its items, and that node never reaches a
- * resolver — so assertField has no chance to cache it. The first child of
- * the list item that hits the path cache lands here to walk and populate
- * back to a cached ancestor.
- *
- * @param {PathNode} path
- * @param {Map<PathNode, string>} cache
- * @param {boolean} collapse
- */
-function buildCachedPathString (path, cache, collapse) {
-  const key = path.key
-  const segment = collapse && typeof key !== 'string' ? '*' : key
-  const prev = path.prev
-
-  const pathString = prev === undefined
-    ? String(segment)
-    : (cache.get(prev) ?? buildCachedPathString(prev, cache, collapse)) + '.' + segment
-  cache.set(path, pathString)
-  return pathString
-}
-
-function wrapFields (type) {
-  if (!type || !type._fields || patchedTypes.has(type)) {
-    return
-  }
-
-  patchedTypes.add(type)
-
-  for (const field of Object.values(type._fields)) {
-    wrapFieldResolve(field)
-    wrapFieldType(field)
-  }
-}
-
-function wrapFieldResolve (field) {
-  if (!field || !field.resolve) return
-  field.resolve = wrapResolve(field.resolve)
-}
-
-function wrapFieldType (field) {
-  if (!field || !field.type) return
-
-  let unwrappedType = field.type
-
-  while (unwrappedType.ofType) {
-    unwrappedType = unwrappedType.ofType
-  }
-
-  wrapFields(unwrappedType)
-}
-
-function finishResolvers ({ fields }) {
-  for (const field of fields.values()) {
-    const fieldCtx = field.ctx
-    // A depth-gated field publishes startResolveCh for IAST/AppSec but the
-    // resolve plugin's start short-circuits before creating a span, so there
-    // is no span here to finish.
-    if (fieldCtx.currentStore === undefined) continue
-    fieldCtx.finishTime = field.finishTime
-    fieldCtx.field = field
-    if (field.error) {
-      fieldCtx.error = field.error
-      resolveErrorCh.publish(fieldCtx)
-    }
-    finishResolveCh.publish(fieldCtx)
-  }
-}
-
-// The CJS package root re-exports `execute` and `normalizedExecutor` as
-// non-configurable tslib `__exportStar` getters that shimmer cannot rewrite in
-// place, so the inner execute.js hook below carries CJS instead: graphql-yoga
-// (`normalizedExecutor`) and direct callers both funnel through that `execute`.
-// Under iitm (ESM) the namespace is settable and the inner-file hook never
-// matches the `esm/` path, so the root wrap is the only option there.
-addHook({ name: '@graphql-tools/executor', versions: ['>=0.0.14'] }, (executor, _version, isIitm) => {
-  /* istanbul ignore if: covered only by the graphql-yoga ESM integration test (subprocess) */
-  if (isIitm) {
-    shimmer.wrap(executor, 'execute', wrapExecute(executor))
-    shimmer.wrap(executor, 'normalizedExecutor', wrapExecute(executor))
-  }
-  return executor
-})
-
-addHook({ name: '@graphql-tools/executor', file: 'cjs/execution/execute.js', versions: ['>=0.0.14'] }, execute => {
-  shimmer.wrap(execute, 'execute', wrapExecute(execute))
-  return execute
-})
-
-// TODO(BridgeAR): graphql >=17.0.0-alpha.9 routes execute() through
-// experimentalExecuteIncrementally(), bypassing this hook. The same
-// function returns { initialResult, subsequentResults } for @defer /
-// @stream which callInAsyncScope does not handle — execute finishes
-// before the streamed payloads land.
-addHook({ name: 'graphql', file: 'execution/execute.js', versions: ['>=0.10'] }, execute => {
-  shimmer.wrap(execute, 'execute', wrapExecute(execute))
-  return execute
-})
-
-addHook({ name: 'graphql', file: 'language/parser.js', versions: ['>=0.10'] }, parser => {
-  shimmer.wrap(parser, 'parse', wrapParse)
-  return parser
-})
-
-addHook({ name: 'graphql', file: 'validation/validate.js', versions: ['>=0.10'] }, validate => {
-  shimmer.wrap(validate, 'validate', wrapValidate)
-
-  return validate
-})
+// Module-load hooks: capture references on ddGlobal for cross-plugin access
+// (read lazily inside each callback so agent.load() between mocha suites can
+// rebind globalThis[dd-trace] without us stashing a stale reference).
 
 addHook({ name: 'graphql', file: 'language/printer.js', versions: ['>=0.10'] }, printer => {
-  // HACK: It's possible `graphql` is loaded before `@apollo/gateway` so we
-  //       can't use a channel as the latter plugin would load after the publish
-  //       happened. Not sure how to handle this so for now use a global.
-  ddGlobal.graphql_printer = printer
+  const ddGlobal = globalThis[Symbol.for('dd-trace')]
+  if (ddGlobal) ddGlobal.graphql_printer = printer
   return printer
 })
 
 addHook({ name: 'graphql', file: 'language/visitor.js', versions: ['>=0.10'] }, visitor => {
-  ddGlobal.graphql_visitor = visitor
+  const ddGlobal = globalThis[Symbol.for('dd-trace')]
+  if (ddGlobal) ddGlobal.graphql_visitor = visitor
   return visitor
 })
 
 addHook({ name: 'graphql', file: 'utilities/index.js', versions: ['>=0.10'] }, utilities => {
-  ddGlobal.graphql_utilities = utilities
+  const ddGlobal = globalThis[Symbol.for('dd-trace')]
+  if (ddGlobal) ddGlobal.graphql_utilities = utilities
   return utilities
 })
diff --git a/packages/datadog-instrumentations/src/helpers/rewriter/instrumentations/graphql.js b/packages/datadog-instrumentations/src/helpers/rewriter/instrumentations/graphql.js
new file mode 100644
index 0000000000..a36c1d0500
--- /dev/null
+++ b/packages/datadog-instrumentations/src/helpers/rewriter/instrumentations/graphql.js
@@ -0,0 +1,201 @@
+'use strict'
+
+module.exports = [
+  {
+    module: {
+      name: 'graphql',
+      versionRange: '>=0.10',
+      filePath: 'execution/execute.js',
+    },
+    functionQuery: {
+      functionName: 'execute',
+      kind: 'Sync',
+    },
+    channelName: 'apm:graphql:execute',
+  },
+  {
+    module: {
+      name: 'graphql',
+      versionRange: '>=0.10',
+      filePath: 'execution/execute.mjs',
+    },
+    functionQuery: {
+      functionName: 'execute',
+      kind: 'Sync',
+    },
+    channelName: 'apm:graphql:execute',
+  },
+  {
+    module: {
+      name: 'graphql',
+      versionRange: '>=0.10',
+      filePath: 'language/parser.js',
+    },
+    functionQuery: {
+      functionName: 'parse',
+      kind: 'Sync',
+    },
+    channelName: 'apm:graphql:parser',
+  },
+  {
+    module: {
+      name: 'graphql',
+      versionRange: '>=0.10',
+      filePath: 'language/parser.mjs',
+    },
+    functionQuery: {
+      functionName: 'parse',
+      kind: 'Sync',
+    },
+    channelName: 'apm:graphql:parser',
+  },
+  {
+    module: {
+      name: 'graphql',
+      versionRange: '>=0.10',
+      filePath: 'validation/validate.js',
+    },
+    functionQuery: {
+      functionName: 'validate',
+      kind: 'Sync',
+    },
+    channelName: 'apm:graphql:validate',
+  },
+  {
+    module: {
+      name: 'graphql',
+      versionRange: '>=0.10',
+      filePath: 'validation/validate.mjs',
+    },
+    functionQuery: {
+      functionName: 'validate',
+      kind: 'Sync',
+    },
+    channelName: 'apm:graphql:validate',
+  },
+  // executeField / resolveField intentionally NOT instrumented here. Resolve spans
+  // are produced by wrapping user resolvers + the default field resolver at execute
+  // time (see packages/datadog-plugin-graphql/src/execute.js). That gives a zero-cost
+  // fast path when no subscribers are active, which per-field orchestrion hooks
+  // cannot offer (the publish is baked into graphql's compiled code).
+  {
+    module: {
+      name: '@graphql-tools/executor',
+      versionRange: '>=0.0.14',
+      filePath: 'cjs/execution/execute.js',
+    },
+    functionQuery: {
+      functionName: 'execute',
+      kind: 'Sync',
+    },
+    channelName: 'apm:graphql:execute',
+  },
+  {
+    module: {
+      name: '@graphql-tools/executor',
+      versionRange: '>=0.0.14',
+      filePath: 'esm/execution/execute.js',
+    },
+    functionQuery: {
+      functionName: 'execute',
+      kind: 'Sync',
+    },
+    channelName: 'apm:graphql:execute',
+  },
+  {
+    module: {
+      name: '@graphql-tools/executor',
+      versionRange: '>=0.0.14',
+      filePath: 'cjs/execution/normalizedExecutor.js',
+    },
+    functionQuery: {
+      functionName: 'normalizedExecutor',
+      kind: 'Sync',
+    },
+    channelName: 'apm:graphql:execute',
+  },
+  {
+    module: {
+      name: '@graphql-tools/executor',
+      versionRange: '>=0.0.14',
+      filePath: 'esm/execution/normalizedExecutor.js',
+    },
+    functionQuery: {
+      functionName: 'normalizedExecutor',
+      kind: 'Sync',
+    },
+    channelName: 'apm:graphql:execute',
+  },
+  {
+    module: {
+      name: 'graphql',
+      versionRange: '>=0.10',
+      filePath: 'language/printer.js',
+    },
+    functionQuery: {
+      functionName: '__module_export__',
+      kind: 'Sync',
+    },
+    channelName: 'dd:graphql:printer:load',
+  },
+  {
+    module: {
+      name: 'graphql',
+      versionRange: '>=0.10',
+      filePath: 'language/printer.mjs',
+    },
+    functionQuery: {
+      functionName: '__module_export__',
+      kind: 'Sync',
+    },
+    channelName: 'dd:graphql:printer:load',
+  },
+  {
+    module: {
+      name: 'graphql',
+      versionRange: '>=0.10',
+      filePath: 'language/visitor.js',
+    },
+    functionQuery: {
+      functionName: '__module_export__',
+      kind: 'Sync',
+    },
+    channelName: 'dd:graphql:visitor:load',
+  },
+  {
+    module: {
+      name: 'graphql',
+      versionRange: '>=0.10',
+      filePath: 'language/visitor.mjs',
+    },
+    functionQuery: {
+      functionName: '__module_export__',
+      kind: 'Sync',
+    },
+    channelName: 'dd:graphql:visitor:load',
+  },
+  {
+    module: {
+      name: 'graphql',
+      versionRange: '>=0.10',
+      filePath: 'utilities/index.js',
+    },
+    functionQuery: {
+      functionName: '__module_export__',
+      kind: 'Sync',
+    },
+    channelName: 'dd:graphql:utilities:load',
+  },
+  {
+    module: {
+      name: 'graphql',
+      versionRange: '>=0.10',
+      filePath: 'utilities/index.mjs',
+    },
+    functionQuery: {
+      functionName: '__module_export__',
+      kind: 'Sync',
+    },
+    channelName: 'dd:graphql:utilities:load',
+  },
+]
diff --git a/packages/datadog-instrumentations/src/helpers/rewriter/instrumentations/index.js b/packages/datadog-instrumentations/src/helpers/rewriter/instrumentations/index.js
index a37be387a4..e61db53e0b 100644
--- a/packages/datadog-instrumentations/src/helpers/rewriter/instrumentations/index.js
+++ b/packages/datadog-instrumentations/src/helpers/rewriter/instrumentations/index.js
@@ -4,6 +4,7 @@ module.exports = [
   ...require('./ai'),
   ...require('./azure-cosmos'),
   ...require('./bullmq'),
+  ...require('./graphql'),
   ...require('./langchain'),
   ...require('./langgraph'),
   ...require('./modelcontextprotocol-sdk'),
diff --git a/packages/datadog-instrumentations/src/mongoose.js b/packages/datadog-instrumentations/src/mongoose.js
index b5c6e5ab69..c0b765fac2 100644
--- a/packages/datadog-instrumentations/src/mongoose.js
+++ b/packages/datadog-instrumentations/src/mongoose.js
@@ -6,6 +6,12 @@ const { wrapThen } = require('./helpers/promise')
 
 const startCh = channel('datadog:mongoose:model:filter:start')
 const finishCh = channel('datadog:mongoose:model:filter:finish')
+// Bound around the deferred query execution. A subscriber returns the store that
+// stays active for the whole async scope that reaches the mongodb driver, so the
+// nested driver query can see the parent's analysis marker without it leaking
+// past the query. `runStores` enters the store only for that scope and restores
+// the parent on its own.
+const execCh = channel('datadog:mongoose:model:filter:exec')
 // this channel is for wrapping the callback of exec methods and handling store context
 const execStartCh = channel('apm:mongoose:exec:start')
 const execFinishCh = channel('apm:mongoose:exec:finish')
@@ -103,7 +109,13 @@ addHook({
         return startCh.runStores(ctx, () => {
           wrapCallbackIfExist(args, ctx)
 
-          const res = method.apply(this, args)
+          // A callback query executes synchronously inside `method.apply`, so the
+          // exec scope (and the deferred driver call it spawns) must be entered
+          // here. A promise query defers execution to a later `exec`/`then`, which
+          // is bound separately below.
+          const res = callbackWrapped
+            ? execCh.runStores(ctx, () => method.apply(this, args))
+            : method.apply(this, args)
 
           // if it is not callback, wrap exec method and its then
           if (!callbackWrapped) {
@@ -113,7 +125,7 @@ addHook({
                   wrapCallbackIfExist(args, ctx)
                 }
 
-                const execResult = originalExec.apply(this, args)
+                const execResult = execCh.runStores(ctx, () => originalExec.apply(this, args))
 
                 if (callbackWrapped || typeof execResult?.then !== 'function') {
                   return execResult
diff --git a/packages/datadog-instrumentations/src/vitest-main-no-worker-init.js b/packages/datadog-instrumentations/src/vitest-main-no-worker-init.js
new file mode 100644
index 0000000000..a0277c783f
--- /dev/null
+++ b/packages/datadog-instrumentations/src/vitest-main-no-worker-init.js
@@ -0,0 +1,1293 @@
+'use strict'
+
+const path = require('node:path')
+
+const satisfies = require('../../../vendor/dist/semifies')
+
+const { getValueFromEnvSources } = require('../../dd-trace/src/config/helper')
+const log = require('../../dd-trace/src/log')
+const {
+  DYNAMIC_NAME_RE,
+  EARLY_FLAKE_DETECTION_RETRY_THRESHOLDS,
+  getTestSuitePath,
+  logAttemptToFixTestExecution,
+  recordAttemptToFixExecution,
+} = require('../../dd-trace/src/plugins/util/test')
+const {
+  getTestName,
+  getTypeTasks,
+  getWorkspaceProject,
+  isFlakyTestRetriesEnabledForTask,
+  setProvidedContext,
+  testErrorCh,
+  testFinishTimeCh,
+  testPassCh,
+  testSkipCh,
+  testStartCh,
+  testSuiteErrorCh,
+  testSuiteFinishCh,
+  testSuiteStartCh,
+} = require('./vitest-util')
+
+// No-worker-init instrumentation for DD_EXPERIMENTAL_TEST_OPT_VITEST_NO_WORKER_INIT.
+// When enabled, Vitest workers do not initialize dd-trace, so this main-process instrumentation
+// takes over some worker responsibilities, including test span creation and lifecycle reporting.
+const mainProcessReporterStates = new WeakMap()
+const loggedAttemptToFixTests = new Set()
+
+const DATADOG_TEST_OPTIMIZATION_BOOTSTRAPS = new Set([
+  'dd-trace/register.js',
+  'dd-trace/ci/init',
+  'dd-trace/ci/init.js',
+])
+const DATADOG_TEST_OPTIMIZATION_NODE_OPTION_FLAGS = new Set(['--import', '--require', '-r'])
+const VITEST_NO_WORKER_INIT_ACTIVE_ENV = 'DD_TEST_OPT_VITEST_NO_WORKER_INIT_ACTIVE'
+const VITEST_NO_WORKER_INIT_REQUEST_ENV = 'DD_EXPERIMENTAL_TEST_OPT_VITEST_NO_WORKER_INIT'
+const VITEST_NO_WORKER_INIT_MINIMUM_VERSION = '3.2.6'
+const VITEST_DEFAULT_POOL = 'forks'
+const VITEST_NO_WORKER_INIT_SETUP_FILE = path.join(
+  __dirname,
+  '..',
+  '..',
+  '..',
+  'ci',
+  'vitest-no-worker-init-setup.mjs'
+)
+const VITEST_NO_WORKER_INIT_ISOLATE_WARNING =
+  `${VITEST_NO_WORKER_INIT_REQUEST_ENV} is ignored because Vitest isolate is disabled. ` +
+  'The lighter Vitest worker path only works when each test file runs in an isolated worker.'
+const NODE_OPTIONS_QUOTE_RE = /[\s"\\]/
+let hasWarnedDisabledIsolate = false
+let hasWarnedUnsupportedVersion = false
+let nodeOptionsBeforeNoWorkerInit
+
+function noop () {}
+
+function isRequested () {
+  return getValueFromEnvSources(VITEST_NO_WORKER_INIT_REQUEST_ENV) === true
+}
+
+function shouldUse (ctx, frameworkVersion, testSpecifications, options) {
+  if (!isRequested()) return false
+  if (!isSupportedVersion(frameworkVersion)) {
+    warnUnsupportedVersion(frameworkVersion)
+    return false
+  }
+
+  const config = ctx?.config
+  if (!config) return false
+
+  const { isVitestWorkerPool } = options
+  if (Array.isArray(testSpecifications)) {
+    return shouldUseForTestSpecifications(config, testSpecifications, isVitestWorkerPool)
+  }
+
+  const pool = getEffectiveConfigPool(config)
+  if (!isNoWorkerInitPool(pool, isVitestWorkerPool)) return false
+  if (getEffectiveConfigIsolate(config, pool) === false) {
+    warnDisabledIsolate()
+    return false
+  }
+
+  return true
+}
+
+function isSupportedVersion (frameworkVersion) {
+  return !!frameworkVersion && satisfies(frameworkVersion, `>=${VITEST_NO_WORKER_INIT_MINIMUM_VERSION}`)
+}
+
+function warnUnsupportedVersion (frameworkVersion) {
+  if (hasWarnedUnsupportedVersion) return
+
+  hasWarnedUnsupportedVersion = true
+  log.warn(
+    '%s is only supported for vitest >=%s. Falling back to normal Vitest worker instrumentation for vitest %s.',
+    VITEST_NO_WORKER_INIT_REQUEST_ENV,
+    VITEST_NO_WORKER_INIT_MINIMUM_VERSION,
+    frameworkVersion || 'unknown'
+  )
+}
+
+function warnDisabledIsolate () {
+  if (hasWarnedDisabledIsolate) return
+
+  hasWarnedDisabledIsolate = true
+  log.warn(VITEST_NO_WORKER_INIT_ISOLATE_WARNING)
+}
+
+function shouldUseForTestSpecifications (config, testSpecifications, isVitestWorkerPool) {
+  const defaultPool = getEffectiveConfigPool(config)
+  let hasNoWorkerInitSpecification = false
+  let hasNonWorkerSpecification = false
+
+  for (const testSpecification of testSpecifications) {
+    const pool = getEffectiveTestSpecificationPool(testSpecification, defaultPool)
+    if (!isNoWorkerInitPool(pool, isVitestWorkerPool)) {
+      hasNonWorkerSpecification = true
+      continue
+    }
+
+    const defaultIsolate = getEffectiveConfigIsolate(config, pool)
+    if (getEffectiveTestSpecificationIsolate(testSpecification, pool, defaultIsolate) === false) {
+      warnDisabledIsolate()
+      return false
+    }
+
+    hasNoWorkerInitSpecification = true
+  }
+
+  return hasNoWorkerInitSpecification && !hasNonWorkerSpecification
+}
+
+function isNoWorkerInitPool (pool, isVitestWorkerPool) {
+  return pool === undefined || isVitestWorkerPool(pool)
+}
+
+function configure (ctx, frameworkVersion, testSpecifications, setupData, options) {
+  const { getConfiguredEfdRetryCount, state } = options
+  addSetupFileToVitestConfigs(ctx, VITEST_NO_WORKER_INIT_SETUP_FILE, testSpecifications)
+
+  const {
+    knownTestsBySuite,
+    modifiedFiles,
+    repositoryRoot,
+    testManagementTestsBySuite,
+    testSessionConfiguration,
+  } = setupData
+
+  setProvidedContext(ctx, {
+    _ddVitestWorkerSetup: {
+      attemptToFixRetries: state.testManagementAttemptToFixRetries,
+      attemptToFixTests: getSelectedTestManagementTests(testManagementTestsBySuite, 'isAttemptToFix'),
+      disabledTests: getSelectedTestManagementTests(testManagementTestsBySuite, 'isDisabled'),
+      earlyFlakeDetectionRetries: getConfiguredEfdRetryCount(
+        state.earlyFlakeDetectionSlowTestRetries,
+        state.earlyFlakeDetectionNumRetries
+      ),
+      earlyFlakeDetectionRetryThresholds: EARLY_FLAKE_DETECTION_RETRY_THRESHOLDS,
+      earlyFlakeDetectionSlowRetries: state.earlyFlakeDetectionSlowTestRetries,
+      isEarlyFlakeDetectionEnabled: state.isEarlyFlakeDetectionEnabled && !state.isEarlyFlakeDetectionFaulty,
+      knownTests: knownTestsBySuite || {},
+      modifiedFiles: modifiedFiles || {},
+      quarantinedTests: getSelectedTestManagementTests(testManagementTestsBySuite, 'isQuarantined'),
+      repositoryRoot: repositoryRoot || process.cwd(),
+    },
+  }, 'Could not send Vitest worker setup context, so no-worker execution changes will not work.')
+
+  installMainProcessReporter(ctx, frameworkVersion, testSessionConfiguration || {}, setupData, state)
+}
+
+function deactivate (ctx) {
+  const installedReporterState = mainProcessReporterStates.get(ctx)
+  if (installedReporterState) {
+    installedReporterState.isActive = false
+  }
+}
+
+function configureWorkerEnv (workerEnv, shouldSkipWorkerInit = false) {
+  if (!shouldSkipWorkerInit) {
+    delete workerEnv[VITEST_NO_WORKER_INIT_ACTIVE_ENV]
+    restoreDatadogTestOptimizationNodeOptions(workerEnv)
+    return workerEnv
+  }
+
+  workerEnv[VITEST_NO_WORKER_INIT_ACTIVE_ENV] = '1'
+  rememberDatadogTestOptimizationNodeOptions(workerEnv.NODE_OPTIONS)
+
+  const nodeOptions = removeDatadogTestOptimizationNodeOptions(workerEnv.NODE_OPTIONS)
+  if (nodeOptions) {
+    workerEnv.NODE_OPTIONS = nodeOptions
+  } else {
+    delete workerEnv.NODE_OPTIONS
+  }
+  return workerEnv
+}
+
+function rememberDatadogTestOptimizationNodeOptions (nodeOptions) {
+  if (hasDatadogTestOptimizationNodeOptions(nodeOptions)) {
+    nodeOptionsBeforeNoWorkerInit = nodeOptions
+  }
+}
+
+function restoreDatadogTestOptimizationNodeOptions (workerEnv) {
+  if (!nodeOptionsBeforeNoWorkerInit || hasDatadogTestOptimizationNodeOptions(workerEnv.NODE_OPTIONS)) return
+
+  const strippedNodeOptions = removeDatadogTestOptimizationNodeOptions(nodeOptionsBeforeNoWorkerInit)
+  if (workerEnv.NODE_OPTIONS === strippedNodeOptions || (!workerEnv.NODE_OPTIONS && !strippedNodeOptions)) {
+    workerEnv.NODE_OPTIONS = nodeOptionsBeforeNoWorkerInit
+  }
+}
+
+function addSetupFileToVitestConfigs (ctx, setupFile, testSpecifications) {
+  const configs = getNoWorkerInitVitestConfigs(ctx, testSpecifications)
+
+  for (const config of configs) {
+    if (!config) continue
+
+    if (config.setupFiles === undefined) {
+      config.setupFiles = []
+    } else if (typeof config.setupFiles === 'string') {
+      config.setupFiles = [config.setupFiles]
+    }
+
+    if (!config.setupFiles.includes(setupFile)) {
+      config.setupFiles.push(setupFile)
+    }
+  }
+}
+
+function getNoWorkerInitVitestConfigs (ctx, testSpecifications) {
+  const configs = new Set()
+  if (Array.isArray(testSpecifications)) {
+    let shouldAddRootConfig = false
+    for (const testSpecification of testSpecifications) {
+      const project = getTestSpecificationProject(testSpecification)
+      const config = safeConfig(project)
+      if (config) {
+        addNoWorkerInitConfig(configs, config)
+      } else {
+        shouldAddRootConfig = true
+      }
+    }
+
+    if (!shouldAddRootConfig && configs.size > 0) {
+      return configs
+    }
+  }
+
+  addNoWorkerInitConfig(configs, safeConfig(ctx))
+  addNoWorkerInitConfig(configs, safeConfig(safeWorkspaceProject(ctx)))
+  return configs
+}
+
+function addNoWorkerInitConfig (configs, config) {
+  if (config) configs.add(config)
+}
+
+function getSelectedTestManagementTests (testManagementTestsBySuite, propertyName) {
+  if (!testManagementTestsBySuite) return {}
+
+  const selectedTests = {}
+  for (const [testSuite, tests] of Object.entries(testManagementTestsBySuite)) {
+    for (const [testName, properties] of Object.entries(tests)) {
+      if (properties?.[propertyName]) {
+        selectedTests[testSuite] ||= {}
+        selectedTests[testSuite][testName] = true
+      }
+    }
+  }
+  return selectedTests
+}
+
+function installMainProcessReporter (ctx, frameworkVersion, testSessionConfiguration, testOptimizationData, state) {
+  if (!ctx?.reporters) return
+
+  const reporterState = {
+    frameworkVersion,
+    isActive: true,
+    state,
+    testSessionConfiguration,
+    testOptimizationData,
+  }
+  const installedReporterState = mainProcessReporterStates.get(ctx)
+  if (installedReporterState) {
+    Object.assign(installedReporterState, reporterState)
+    return
+  }
+
+  mainProcessReporterStates.set(ctx, reporterState)
+  ctx.reporters.push(createMainProcessReporter(reporterState))
+}
+
+function createMainProcessReporter (reporterState) {
+  const testSuiteContexts = new Map()
+  const finishedTestModules = new Set()
+  const taskAttemptStatuses = new Map()
+  const tasksWithRecordedFinalAttempt = new Set()
+
+  return {
+    onTestModuleStart (testModule) {
+      if (!isActive()) return
+
+      startTestSuite(testModule)
+    },
+
+    onTestModuleEnd (testModule) {
+      if (!isActive()) return
+
+      return reportTestModule(testModule)
+    },
+
+    onTestCaseResult (testCase) {
+      if (!isActive()) return
+
+      const task = getTestCaseTask(testCase)
+      recordFinalTaskAttemptResult(task)
+    },
+
+    onTaskUpdate (packs, events) {
+      if (!isActive()) return
+      if (!events) return
+
+      for (const event of events) {
+        if (event[1] === 'test-retried') {
+          recordTaskAttemptStatus(event[0], 'fail', getTaskUpdateAttemptCount(event[0], packs))
+        }
+      }
+    },
+
+    onFinished (files) {
+      if (!isActive()) return
+      if (!files) return
+
+      for (const file of files) {
+        const testModule = createTestModuleFromFile(file)
+        if (!finishedTestModules.has(file.id)) {
+          reportTestModule(testModule)
+        }
+      }
+    },
+  }
+
+  function isActive () {
+    return reporterState.isActive === true
+  }
+
+  function recordTaskAttemptStatus (taskId, status, attemptCount) {
+    let statuses = taskAttemptStatuses.get(taskId)
+    if (!statuses) {
+      statuses = []
+      taskAttemptStatuses.set(taskId, statuses)
+    }
+    if (attemptCount !== undefined && statuses.length >= attemptCount) return
+
+    if (tasksWithRecordedFinalAttempt.has(taskId)) {
+      statuses.splice(-1, 0, status)
+      return
+    }
+    statuses.push(status)
+  }
+
+  function recordFinalTaskAttemptResult (task) {
+    const statuses = taskAttemptStatuses.get(task.id)
+    if (!statuses) return
+
+    const attemptCount = getRepeatedAttemptCount(task, statuses)
+    if (statuses.length < attemptCount) {
+      statuses.push(getFinalRepeatedTaskStatus(task))
+      tasksWithRecordedFinalAttempt.add(task.id)
+    }
+  }
+
+  function reportTestModule (testModule) {
+    const testModuleId = getTestModuleId(testModule)
+    const testModuleTask = getTestModuleTask(testModule)
+    finishedTestModules.add(testModuleId)
+    const testSuiteCtx = testSuiteContexts.get(testModuleId) || startTestSuite(testModule)
+    const testTasks = getTypeTasks(testModuleTask.tasks)
+    const testReports = []
+    let testSuiteError
+
+    for (const task of testTasks) {
+      const testReport = getTestReport(task, testSuiteCtx.currentStore)
+      testReports.push(testReport)
+
+      for (const attempt of testReport.nonFinalAttempts) {
+        reportTestAttempt(testReport, attempt)
+      }
+    }
+
+    for (const testReport of testReports) {
+      const error = reportFinalTestAttempt(testReport)
+      testSuiteError ||= error
+    }
+
+    const suiteTaskError = getSuiteTaskError(testModuleTask)
+    recomputeTaskState(testModuleTask)
+    const testSuiteResult = testModuleTask.result
+    if (testSuiteResult?.errors?.length) {
+      testSuiteError = testSuiteResult.errors[0]
+    } else if (suiteTaskError) {
+      testSuiteError = suiteTaskError
+    }
+
+    if (testSuiteError) {
+      testSuiteCtx.error = testSuiteError
+      testSuiteErrorCh.runStores(testSuiteCtx, () => {})
+    }
+
+    testSuiteFinishCh.publish({
+      status: getDatadogStatus(testSuiteResult),
+      deferFlush: true,
+      onFinish: noop,
+      ...testSuiteCtx.currentStore,
+    })
+    testSuiteContexts.delete(testModuleId)
+  }
+
+  function startTestSuite (testModule) {
+    const { frameworkVersion, testSessionConfiguration } = reporterState
+    const testModuleId = getTestModuleId(testModule)
+    const testSuiteCtx = {
+      testSuiteAbsolutePath: getTestModuleFilepath(testModule),
+      frameworkVersion,
+      testSessionId: testSessionConfiguration.testSessionId,
+      testModuleId: testSessionConfiguration.testModuleId,
+      testCommand: testSessionConfiguration.testCommand,
+      repositoryRoot: testSessionConfiguration.repositoryRoot,
+      codeOwnersEntries: testSessionConfiguration.codeOwnersEntries,
+      isTestFrameworkWorker: true,
+      isVitestNoWorkerInitActive: true,
+    }
+    testSuiteStartCh.runStores(testSuiteCtx, () => {})
+    testSuiteContexts.set(testModuleId, testSuiteCtx)
+    return testSuiteCtx
+  }
+
+  function getTestReport (task, testSuiteStore) {
+    const result = task.result
+    const testSuiteAbsolutePath = task.file?.filepath
+    const testName = getTestName(task)
+    const testProperties = getMainProcessTestProperties(task, testSuiteAbsolutePath, testName)
+    const { state } = reporterState
+    let status = getDatadogStatus(result)
+
+    if (task.meta?.__ddTestOptQuarantinedFailed && testProperties.isQuarantined && !testProperties.isAttemptToFix) {
+      status = 'fail'
+    }
+
+    if (testProperties.isAttemptToFix && task.meta?.__ddTestOptAtfStatuses?.length) {
+      return getRepeatedTestReport(task, testName, testSuiteAbsolutePath, testProperties, status, {
+        errorCounts: task.meta.__ddTestOptAtfErrorCounts,
+        finalStatus: getAttemptToFixFinalStatus,
+        state,
+        statuses: task.meta.__ddTestOptAtfStatuses,
+        testSuiteStore,
+        type: 'attempt_to_fix',
+      })
+    }
+
+    if (testProperties.isEarlyFlakeDetection && task.meta?.__ddTestOptEfdStatuses?.length) {
+      return getRepeatedTestReport(task, testName, testSuiteAbsolutePath, testProperties, status, {
+        errorCounts: task.meta.__ddTestOptEfdErrorCounts,
+        finalStatus: getEarlyFlakeDetectionFinalStatus,
+        state,
+        statuses: task.meta.__ddTestOptEfdStatuses,
+        testSuiteStore,
+        type: 'early_flake_detection',
+      })
+    }
+
+    if (!testProperties.isAttemptToFix && task.meta?.__ddTestOptRepeatStatuses?.length) {
+      return getRepeatedTestReport(task, testName, testSuiteAbsolutePath, testProperties, status, {
+        errorCounts: task.meta.__ddTestOptRepeatErrorCounts,
+        finalStatus: () => status,
+        state,
+        statuses: task.meta.__ddTestOptRepeatStatuses,
+        testSuiteStore,
+        type: 'external',
+      })
+    }
+
+    const attemptStatuses = taskAttemptStatuses.get(task.id)
+    if (!testProperties.isAttemptToFix && !testProperties.isEarlyFlakeDetection && attemptStatuses?.length > 1) {
+      return getRepeatedTestReport(task, testName, testSuiteAbsolutePath, testProperties, status, {
+        finalStatus: () => status,
+        state,
+        statuses: attemptStatuses,
+        testSuiteStore,
+        type: 'external',
+      })
+    }
+
+    if (!testProperties.isAttemptToFix && task.result?.repeatCount > 0) {
+      return getRepeatedTestReport(task, testName, testSuiteAbsolutePath, testProperties, status, {
+        finalStatus: () => status,
+        state,
+        statuses: getRepeatedTaskStatuses(task, status),
+        testSuiteStore,
+        type: 'external',
+      })
+    }
+
+    if (testProperties.isAttemptToFix) {
+      logAttemptToFixTestExecution(testProperties.testSuite, testName, loggedAttemptToFixTests)
+    }
+
+    if (testProperties.isDisabled && !testProperties.isAttemptToFix) {
+      status = 'skip'
+      if (result) result.state = 'skip'
+    } else if (testProperties.isQuarantined && status === 'fail' && !testProperties.isAttemptToFix) {
+      result.state = 'pass'
+    }
+
+    const errors = result?.errors || []
+    const finalErrorIndex = status === 'fail' ? errors.length - 1 : -1
+    const nonFinalAttempts = []
+
+    if (status !== 'skip') {
+      for (let index = 0; index < errors.length; index++) {
+        if (index === finalErrorIndex) continue
+        nonFinalAttempts.push({
+          error: errors[index],
+          isRetry: index > 0,
+          status: 'fail',
+        })
+      }
+    }
+
+    return {
+      errors,
+      nonFinalAttempts,
+      state,
+      status,
+      task,
+      testName,
+      testProperties,
+      testSuiteAbsolutePath,
+      testSuiteStore,
+    }
+  }
+
+  function getMainProcessTestProperties (task, testSuiteAbsolutePath, testName) {
+    const { state, testOptimizationData, testSessionConfiguration } = reporterState
+    const testProperties = testOptimizationData.testPropertiesByFilepath?.[testSuiteAbsolutePath]
+    const testSuite = testProperties?.testSuite || getTestSuitePath(
+      testSuiteAbsolutePath,
+      testSessionConfiguration.repositoryRoot || process.cwd()
+    )
+    const knownTests = testProperties?.knownTests
+    const testManagementProperties = testProperties?.testManagementTests?.[testName] || {}
+    const isAttemptToFix = testManagementProperties.isAttemptToFix
+    const isNew = !!(
+      !isAttemptToFix &&
+      state.isKnownTestsEnabled &&
+      knownTests &&
+      !state.isEarlyFlakeDetectionFaulty &&
+      !knownTests.includes(testName)
+    )
+    const isModified = testProperties?.isModified === true
+    const { flakyTestRetriesConfiguration } = testOptimizationData
+    const isFlakyTestRetries = !!flakyTestRetriesConfiguration && isFlakyTestRetriesEnabledForTask({
+      isFlakyTestRetriesEnabled: state.isFlakyTestRetriesEnabled,
+      flakyTestRetriesIncludesUnnamedProject: flakyTestRetriesConfiguration.includesUnnamedProject,
+      flakyTestRetriesProjectNames: flakyTestRetriesConfiguration.projectNames,
+    }, task)
+
+    return {
+      isAttemptToFix,
+      isDisabled: testManagementProperties.isDisabled,
+      isEarlyFlakeDetection: (isNew || isModified) && state.isEarlyFlakeDetectionEnabled,
+      isFlakyTestRetries,
+      isQuarantined: testManagementProperties.isQuarantined,
+      isModified,
+      isNew,
+      testSuite,
+      hasDynamicName: isNew && DYNAMIC_NAME_RE.test(testName),
+    }
+  }
+}
+
+function getTaskUpdateAttemptCount (taskId, packs) {
+  if (!packs) return
+
+  for (const pack of packs) {
+    if (pack[0] === taskId) {
+      return getRepeatedAttemptCount({
+        id: taskId,
+        result: pack[1],
+        meta: pack[2],
+      }, [])
+    }
+  }
+}
+
+function createTestModuleFromFile (file) {
+  return {
+    id: file.id,
+    moduleId: file.filepath,
+    project: file.project,
+    projectName: file.projectName,
+    task: file,
+  }
+}
+
+function getTestModuleId (testModule) {
+  return testModule.id || getTestModuleFilepath(testModule)
+}
+
+function getTestModuleTask (testModule) {
+  if (testModule.task?.tasks) {
+    return testModule.task
+  }
+
+  const task = createTaskFromReportedTask(testModule)
+  task.file = task
+  return task
+}
+
+function getTestCaseTask (testCase) {
+  if (testCase.task) {
+    return testCase.task
+  }
+
+  return createTaskFromReportedTask(testCase, {
+    filepath: getTestModuleFilepath(testCase.module),
+    projectName: getTestModuleProjectName(testCase.module),
+  })
+}
+
+function createTaskFromReportedTask (reportedTask, file, suite) {
+  const task = {
+    id: reportedTask.id,
+    type: reportedTask.type,
+    name: reportedTask.name || reportedTask.relativeModuleId || reportedTask.moduleId,
+    mode: reportedTask.options?.mode,
+    meta: getReportedTaskMeta(reportedTask),
+    result: getReportedTaskResult(reportedTask),
+    file,
+    suite,
+  }
+
+  if (reportedTask.type === 'module') {
+    task.filepath = reportedTask.moduleId
+    task.projectName = getTestModuleProjectName(reportedTask)
+  }
+
+  const children = getReportedTaskChildren(reportedTask)
+  if (children) {
+    task.tasks = []
+    const taskFile = file || task
+    const childSuite = task.type === 'suite' ? task : undefined
+    for (const child of children) {
+      task.tasks.push(createTaskFromReportedTask(child, taskFile, childSuite))
+    }
+  }
+
+  return task
+}
+
+function getReportedTaskChildren (reportedTask) {
+  const children = reportedTask.children
+  if (!children) return
+
+  if (typeof children.array === 'function') {
+    return children.array()
+  }
+
+  if (Array.isArray(children)) {
+    return children
+  }
+
+  return [...children]
+}
+
+function getReportedTaskMeta (reportedTask) {
+  if (typeof reportedTask.meta === 'function') {
+    return reportedTask.meta()
+  }
+
+  return reportedTask.meta || {}
+}
+
+function getReportedTaskResult (reportedTask) {
+  let result
+  if (typeof reportedTask.result === 'function') {
+    result = reportedTask.result()
+  } else if (typeof reportedTask.state === 'function') {
+    result = {
+      errors: typeof reportedTask.errors === 'function' ? reportedTask.errors() : undefined,
+      state: reportedTask.state(),
+    }
+  } else {
+    result = reportedTask.result
+  }
+
+  const diagnostic = typeof reportedTask.diagnostic === 'function'
+    ? reportedTask.diagnostic()
+    : undefined
+
+  return {
+    duration: diagnostic?.duration,
+    errors: result?.errors,
+    note: result?.note,
+    repeatCount: diagnostic?.repeatCount,
+    retryCount: diagnostic?.retryCount,
+    state: result?.state,
+  }
+}
+
+function getTestModuleFilepath (testModule) {
+  return testModule.moduleId || testModule.task?.filepath || testModule.filepath
+}
+
+function getTestModuleProjectName (testModule) {
+  return normalizeProjectName(
+    testModule.projectName || getProjectName(testModule.project) || testModule.task?.projectName ||
+      testModule.task?.file?.projectName
+  )
+}
+
+function getRepeatedTestReport (task, testName, testSuiteAbsolutePath, testProperties, status, options) {
+  const result = task.result
+  const errors = result?.errors || []
+  const { errorCounts, finalStatus, state, statuses, testSuiteStore, type } = options
+  const finalAttemptStatus = finalStatus(statuses)
+  const hasFailure = finalAttemptStatus === 'fail'
+  const attempts = []
+  const attemptCount = getRepeatedAttemptCount(task, statuses)
+  let errorIndex = 0
+  let previousErrorCount = 0
+
+  if (type === 'attempt_to_fix') {
+    logAttemptToFixTestExecution(testProperties.testSuite, testName, loggedAttemptToFixTests)
+  }
+
+  for (let index = 0; index < attemptCount; index++) {
+    const isFinalAttempt = index === attemptCount - 1
+    const attemptStatus = statuses[index] || 'pass'
+    const nextErrorCount = errorCounts?.[index]
+    const error = attemptStatus === 'fail'
+      ? errors[nextErrorCount === undefined ? errorIndex : previousErrorCount] || errors[errorIndex] || errors[0]
+      : undefined
+    if (nextErrorCount !== undefined) {
+      previousErrorCount = nextErrorCount
+    } else if (attemptStatus === 'fail') {
+      errorIndex++
+    }
+    const attempt = {
+      attemptToFixFailed: type === 'attempt_to_fix' && isFinalAttempt && hasFailure,
+      earlyFlakeAbortReason: type === 'early_flake_detection' && isFinalAttempt
+        ? task.meta?.__ddTestOptEfdAbortReason
+        : undefined,
+      error,
+      finalStatus: isFinalAttempt ? finalAttemptStatus : undefined,
+      hasFailedAllRetries: hasFailedAllManagedRetries(
+        task,
+        testProperties,
+        type,
+        statuses,
+        isFinalAttempt,
+        hasFailure
+      ),
+      isRetry: index > 0,
+      status: attemptStatus,
+    }
+    if (type === 'attempt_to_fix') {
+      attempt.attemptToFixPassed = isFinalAttempt && !hasFailure
+    } else if (type === 'early_flake_detection') {
+      attempt.isRetryReasonEfd = index > 0
+    }
+    attempts.push(attempt)
+  }
+
+  return {
+    errors,
+    finalAttempt: attempts[attempts.length - 1],
+    nonFinalAttempts: attempts.slice(0, -1),
+    state,
+    status,
+    task,
+    testName,
+    testProperties,
+    testSuiteAbsolutePath,
+    testSuiteStore,
+  }
+}
+
+/**
+ * Returns whether a final failed attempt exhausted Datadog-managed retries.
+ *
+ * @param {{
+ *   meta?: { __ddTestOptEfdRetries?: number },
+ *   repeats?: number,
+ *   result?: { retryCount?: number }
+ * }} task
+ * @param {{ isFlakyTestRetries?: boolean }} testProperties
+ * @param {'attempt_to_fix'|'early_flake_detection'|'external'} type
+ * @param {string[]} statuses
+ * @param {boolean} isFinalAttempt
+ * @param {boolean} hasFailure
+ * @returns {boolean}
+ */
+function hasFailedAllManagedRetries (task, testProperties, type, statuses, isFinalAttempt, hasFailure) {
+  if (!isFinalAttempt || !hasFailure || statuses.length === 0 || !statuses.every(status => status === 'fail')) {
+    return false
+  }
+
+  if (type === 'attempt_to_fix') {
+    return true
+  }
+
+  if (type === 'early_flake_detection') {
+    return (task.meta?.__ddTestOptEfdRetries || 0) > 0
+  }
+
+  return testProperties.isFlakyTestRetries === true && (task.result?.retryCount || 0) > 0
+}
+
+function getRepeatedAttemptCount (task, statuses) {
+  const retries = task.meta?.__ddTestOptAtfRetries ?? task.meta?.__ddTestOptEfdRetries ??
+    Math.max(task.result?.retryCount || 0, task.repeats || 0)
+  return Math.max(statuses.length, retries + 1)
+}
+
+function getAttemptToFixFinalStatus (statuses) {
+  return statuses.includes('fail') ? 'fail' : 'pass'
+}
+
+function getEarlyFlakeDetectionFinalStatus (statuses) {
+  return statuses.includes('pass') ? 'pass' : 'fail'
+}
+
+function getRepeatedTaskStatuses (task, status) {
+  const repeatedStatuses = []
+  const repeatCount = task.result?.repeatCount || 0
+  for (let index = 0; index <= repeatCount; index++) {
+    repeatedStatuses.push(status)
+  }
+  return repeatedStatuses
+}
+
+function reportFinalTestAttempt (testReport) {
+  const {
+    errors,
+    status,
+    task,
+    testName,
+    testProperties,
+    testSuiteAbsolutePath,
+    testSuiteStore,
+  } = testReport
+
+  if (status === 'skip') {
+    testSkipCh.publish({
+      testName,
+      testSuiteAbsolutePath,
+      isNew: testProperties.isNew,
+      isDisabled: testProperties.isDisabled,
+      isTestFrameworkWorker: true,
+      ...testSuiteStore,
+    })
+    return
+  }
+
+  const result = task.result
+  const finalStatus = getFinalTestStatus(testReport)
+  const finalAttempt = testReport.finalAttempt
+
+  if (status === 'fail') {
+    const error = errors[errors.length - 1] || errors[0]
+    reportTestAttempt(testReport, finalAttempt || {
+      error,
+      finalStatus,
+      hasFailedAllRetries: hasFailedAllManagedRetries(
+        task,
+        testProperties,
+        'external',
+        ['fail'],
+        true,
+        true
+      ),
+      isRetry: errors.length > 1 || (result?.retryCount || 0) > 0 || (result?.repeatCount || 0) > 0,
+      status: 'fail',
+    })
+    return finalStatus === 'skip' ? undefined : error
+  }
+
+  reportTestAttempt(testReport, finalAttempt || {
+    finalStatus,
+    isRetry: errors.length > 0 || (result?.retryCount || 0) > 0 || (result?.repeatCount || 0) > 0,
+    status: 'pass',
+  })
+}
+
+function reportTestAttempt (testReport, attempt) {
+  const {
+    state,
+    task,
+    testName,
+    testProperties,
+    testSuiteAbsolutePath,
+    testSuiteStore,
+  } = testReport
+  const result = task.result
+  const status = attempt.status
+  const testCtx = {
+    currentStore: testSuiteStore,
+    testName,
+    testSuiteAbsolutePath,
+    isRetry: attempt.isRetry,
+    isNew: testProperties.isNew,
+    hasDynamicName: testProperties.hasDynamicName,
+    isAttemptToFix: testProperties.isAttemptToFix,
+    isDisabled: testProperties.isDisabled,
+    isQuarantined: testProperties.isQuarantined,
+    isModified: testProperties.isModified,
+    isRetryReasonEfd: attempt.isRetryReasonEfd,
+    isRetryReasonAttemptToFix: testProperties.isAttemptToFix && attempt.isRetry,
+    isRetryReasonAtr: !testProperties.isAttemptToFix && !testProperties.isEarlyFlakeDetection &&
+      testProperties.isFlakyTestRetries,
+    isTestFrameworkWorker: true,
+  }
+  if (testProperties.isAttemptToFix) {
+    recordAttemptToFixExecution(state.attemptToFixExecutions, {
+      testSuite: testProperties.testSuite,
+      testName,
+      status,
+      isDisabled: testProperties.isDisabled,
+      isQuarantined: testProperties.isQuarantined,
+    })
+  }
+  if (testProperties.hasDynamicName) {
+    state.newTestsWithDynamicNames.add(`${testProperties.testSuite} › ${testName}`)
+  }
+  if (attempt.attemptToFixPassed) {
+    testCtx.attemptToFixPassed = true
+  } else if (attempt.attemptToFixFailed) {
+    testCtx.attemptToFixFailed = true
+  }
+  testStartCh.runStores(testCtx, () => {})
+  testCtx.status = status
+  testCtx.task = task
+  if (
+    status === 'pass' &&
+    !attempt.isRetry &&
+    isFinalTestAttempt(testReport, attempt) &&
+    result?.duration !== undefined
+  ) {
+    testCtx.duration = result.duration
+  }
+  testFinishTimeCh.runStores(testCtx, () => {})
+
+  if (status === 'pass') {
+    testPassCh.publish({
+      task,
+      earlyFlakeAbortReason: attempt.earlyFlakeAbortReason,
+      finalStatus: attempt.finalStatus,
+      ...testCtx.currentStore,
+    })
+    return
+  }
+
+  testErrorCh.publish({
+    duration: shouldUseTaskDurationForFailure(testReport, attempt) ? result?.duration : undefined,
+    error: attempt.error,
+    earlyFlakeAbortReason: attempt.earlyFlakeAbortReason,
+    finalStatus: attempt.finalStatus,
+    hasFailedAllRetries: attempt.hasFailedAllRetries,
+    attemptToFixFailed: attempt.attemptToFixFailed,
+    ...testCtx.currentStore,
+  })
+}
+
+function isFinalTestAttempt (testReport, attempt) {
+  return attempt.finalStatus !== undefined || testReport.finalAttempt === undefined
+}
+
+function shouldUseTaskDurationForFailure (testReport, attempt) {
+  return !attempt.isRetry && attempt.finalStatus !== undefined && testReport.finalAttempt === undefined
+}
+
+function getFinalTestStatus (testReport) {
+  const testProperties = testReport.testProperties
+  if (testProperties.isAttemptToFix) {
+    return testReport.finalAttempt?.finalStatus
+  }
+  if (testProperties.isDisabled || testProperties.isQuarantined) {
+    return 'skip'
+  }
+  return testReport.status
+}
+
+function getDatadogStatus (result) {
+  const state = result?.state
+  if (state === 'pass' || state === 'passed') return 'pass'
+  if (state === 'fail' || state === 'failed') return 'fail'
+  return 'skip'
+}
+
+function getFinalRepeatedTaskStatus (task) {
+  return task.meta?.__ddTestOptQuarantinedFailed ? 'fail' : getDatadogStatus(task.result)
+}
+
+function getSuiteTaskError (task) {
+  const suiteTasks = getTypeTasks(task.tasks || [], 'suite')
+  for (const suiteTask of suiteTasks) {
+    if (suiteTask.result?.state === 'fail' && suiteTask.result?.errors?.length) {
+      return suiteTask.result.errors[0]
+    }
+  }
+}
+
+function recomputeTaskState (task) {
+  if (!task.tasks) {
+    return getDatadogStatus(task.result)
+  }
+
+  const hasErrors = task.result?.errors?.length > 0
+  let hasFailed = false
+  let hasPassed = false
+
+  for (const child of task.tasks) {
+    const childStatus = recomputeTaskState(child)
+    hasFailed ||= childStatus === 'fail'
+    hasPassed ||= childStatus === 'pass'
+  }
+
+  const status = hasErrors || hasFailed ? 'fail' : hasPassed ? 'pass' : 'skip'
+  task.result ||= {}
+  task.result.state = status
+  return status
+}
+
+function removeDatadogTestOptimizationNodeOptions (nodeOptions) {
+  if (!nodeOptions) return nodeOptions
+
+  const tokens = splitNodeOptions(nodeOptions)
+  const filteredTokens = []
+  for (let index = 0; index < tokens.length; index++) {
+    const token = tokens[index]
+    const valueSeparator = token.indexOf('=')
+    if (valueSeparator !== -1) {
+      const flag = token.slice(0, valueSeparator)
+      const value = token.slice(valueSeparator + 1)
+      if (shouldRemoveNodeOption(flag, value)) {
+        continue
+      }
+    }
+
+    if (token.startsWith('-r') && token.length > 2 && isDatadogTestOptimizationBootstrap(token.slice(2))) {
+      continue
+    }
+
+    if (
+      DATADOG_TEST_OPTIMIZATION_NODE_OPTION_FLAGS.has(token) &&
+      isDatadogTestOptimizationBootstrap(tokens[index + 1])
+    ) {
+      index++
+      continue
+    }
+
+    filteredTokens.push(token)
+  }
+
+  return serializeNodeOptions(filteredTokens)
+}
+
+function hasDatadogTestOptimizationNodeOptions (nodeOptions) {
+  if (!nodeOptions) return false
+
+  const tokens = splitNodeOptions(nodeOptions)
+  for (let index = 0; index < tokens.length; index++) {
+    const token = tokens[index]
+    const valueSeparator = token.indexOf('=')
+    if (valueSeparator !== -1) {
+      const flag = token.slice(0, valueSeparator)
+      const value = token.slice(valueSeparator + 1)
+      if (shouldRemoveNodeOption(flag, value)) {
+        return true
+      }
+    }
+
+    if (token.startsWith('-r') && token.length > 2 && isDatadogTestOptimizationBootstrap(token.slice(2))) {
+      return true
+    }
+
+    if (
+      DATADOG_TEST_OPTIMIZATION_NODE_OPTION_FLAGS.has(token) &&
+      isDatadogTestOptimizationBootstrap(tokens[index + 1])
+    ) {
+      return true
+    }
+  }
+  return false
+}
+
+function shouldRemoveNodeOption (flag, value) {
+  return DATADOG_TEST_OPTIMIZATION_NODE_OPTION_FLAGS.has(flag) &&
+    isDatadogTestOptimizationBootstrap(value)
+}
+
+function isDatadogTestOptimizationBootstrap (value) {
+  if (!value) return false
+
+  const normalizedValue = value.replaceAll('\\', '/')
+  if (DATADOG_TEST_OPTIMIZATION_BOOTSTRAPS.has(normalizedValue)) return true
+
+  for (const bootstrap of DATADOG_TEST_OPTIMIZATION_BOOTSTRAPS) {
+    if (normalizedValue.endsWith(`/node_modules/${bootstrap}`)) return true
+  }
+  return false
+}
+
+function splitNodeOptions (nodeOptions) {
+  const tokens = []
+  let token = ''
+  let quote
+
+  for (let index = 0; index < nodeOptions.length; index++) {
+    const char = nodeOptions[index]
+
+    if (quote) {
+      if (char === '\\' && nodeOptions[index + 1] === quote) {
+        token += quote
+        index++
+        continue
+      }
+
+      if (char === quote) {
+        quote = undefined
+      } else {
+        token += char
+      }
+      continue
+    }
+
+    if (char === '"' || char === "'") {
+      quote = char
+      continue
+    }
+
+    if (char === ' ' || char === '\n' || char === '\t') {
+      if (token) {
+        tokens.push(token)
+        token = ''
+      }
+      continue
+    }
+
+    token += char
+  }
+
+  if (token) {
+    tokens.push(token)
+  }
+  return tokens
+}
+
+function serializeNodeOptions (tokens) {
+  const serializedTokens = []
+  for (const token of tokens) {
+    if (NODE_OPTIONS_QUOTE_RE.test(token)) {
+      serializedTokens.push(JSON.stringify(token))
+    } else {
+      serializedTokens.push(token)
+    }
+  }
+  return serializedTokens.join(' ')
+}
+
+function getTestSpecificationProject (testSpecification) {
+  if (Array.isArray(testSpecification)) {
+    return testSpecification[0]
+  }
+  return testSpecification?.project
+}
+
+function getTestSpecificationFile (testSpecification) {
+  if (Array.isArray(testSpecification)) {
+    return testSpecification[1]
+  }
+  return testSpecification
+}
+
+function getTestSpecificationOptions (testSpecification) {
+  if (Array.isArray(testSpecification)) {
+    return testSpecification[2]
+  }
+  return testSpecification
+}
+
+function getTestSpecificationPool (testSpecification) {
+  const options = getTestSpecificationOptions(testSpecification)
+  const file = getTestSpecificationFile(testSpecification)
+  const project = getTestSpecificationProject(testSpecification)
+  return options?.pool ||
+    file?.pool ||
+    testSpecification?.pool ||
+    project?.config?.pool ||
+    project?.serializedConfig?.pool ||
+    project?.pool
+}
+
+function getEffectiveTestSpecificationPool (testSpecification, defaultPool) {
+  return getTestSpecificationPool(testSpecification) || defaultPool
+}
+
+/**
+ * Resolves Vitest's default worker pool when the user did not configure one.
+ *
+ * @param {{ pool?: string }|undefined} config
+ * @returns {string}
+ */
+function getEffectiveConfigPool (config) {
+  return config?.pool || VITEST_DEFAULT_POOL
+}
+
+function getPoolOptionsIsolate (config, pool) {
+  if (!pool) return
+
+  return config?.poolOptions?.[pool]?.isolate
+}
+
+function getEffectiveConfigIsolate (config, pool) {
+  return getPoolOptionsIsolate(config, pool) ?? config?.isolate
+}
+
+function getTestSpecificationIsolate (testSpecification, pool) {
+  const options = getTestSpecificationOptions(testSpecification)
+  const file = getTestSpecificationFile(testSpecification)
+  const project = getTestSpecificationProject(testSpecification)
+  return getPoolOptionsIsolate(options, pool) ??
+    getPoolOptionsIsolate(file, pool) ??
+    getPoolOptionsIsolate(project?.config, pool) ??
+    getPoolOptionsIsolate(project?.serializedConfig, pool) ??
+    getPoolOptionsIsolate(project, pool) ??
+    getPoolOptionsIsolate(testSpecification, pool) ??
+    options?.isolate ??
+    file?.isolate ??
+    project?.config?.isolate ??
+    project?.serializedConfig?.isolate ??
+    project?.isolate ??
+    testSpecification?.isolate
+}
+
+function getEffectiveTestSpecificationIsolate (testSpecification, pool, defaultIsolate) {
+  const isolate = getTestSpecificationIsolate(testSpecification, pool)
+  return isolate === undefined ? defaultIsolate : isolate
+}
+
+function getProjectName (project) {
+  return normalizeProjectName(project?.name || project?.config?.name || project?.test?.name)
+}
+
+function normalizeProjectName (name) {
+  if (typeof name === 'string') return name
+
+  const label = name?.label
+  return typeof label === 'string' ? label : undefined
+}
+
+function safeConfig (project) {
+  let config
+  try {
+    config = project?.config
+  } catch {}
+  return config
+}
+
+function safeWorkspaceProject (ctx) {
+  let project
+  try {
+    project = getWorkspaceProject(ctx)
+  } catch {}
+  return project
+}
+
+module.exports = {
+  configure,
+  deactivate,
+  configureWorkerEnv,
+  shouldUse,
+}
diff --git a/packages/datadog-instrumentations/src/vitest-main.js b/packages/datadog-instrumentations/src/vitest-main.js
new file mode 100644
index 0000000000..588ce66f86
--- /dev/null
+++ b/packages/datadog-instrumentations/src/vitest-main.js
@@ -0,0 +1,1567 @@
+'use strict'
+
+const path = require('node:path')
+const { fileURLToPath } = require('node:url')
+const { MessagePort } = require('node:worker_threads')
+
+const shimmer = require('../../datadog-shimmer')
+const log = require('../../dd-trace/src/log')
+const {
+  VITEST_WORKER_TRACE_PAYLOAD_CODE,
+  VITEST_WORKER_LOGS_PAYLOAD_CODE,
+  getMaxEfdRetryCount,
+  collectTestOptimizationSummariesFromTraces,
+  logTestOptimizationSummary,
+  getTestOptimizationRequestResults,
+  getTestSuitePath,
+  isModifiedTest,
+} = require('../../dd-trace/src/plugins/util/test')
+const { addHook } = require('./helpers/instrument')
+const noWorkerInit = require('./vitest-main-no-worker-init')
+const {
+  testStartCh,
+  testPassCh,
+  testErrorCh,
+  testSkipCh,
+  testSuiteStartCh,
+  testSuiteFinishCh,
+  testSuiteErrorCh,
+  testSessionStartCh,
+  testSessionFinishCh,
+  testSessionConfigurationCh,
+  libraryConfigurationCh,
+  knownTestsCh,
+  isEarlyFlakeDetectionFaultyCh,
+  testManagementTestsCh,
+  modifiedFilesCh,
+  workerReportTraceCh,
+  workerReportLogsCh,
+  codeCoverageReportCh,
+  findExportByName,
+  getChannelPromise,
+  getTypeTasks,
+  getWorkspaceProject,
+  setProvidedContext,
+  getVitestTestProperties,
+} = require('./vitest-util')
+
+const newTestsWithDynamicNames = new Set()
+const attemptToFixExecutions = new Map()
+const workerProcesses = new WeakSet()
+const mainProcessSetupStates = new WeakMap()
+const coverageWrappedProviders = new WeakSet()
+const finishWrappedContexts = new WeakSet()
+let isFlakyTestRetriesEnabled = false
+let flakyTestRetriesCount = 0
+let isEarlyFlakeDetectionEnabled = false
+let earlyFlakeDetectionNumRetries = 0
+let earlyFlakeDetectionSlowTestRetries = {}
+let isEarlyFlakeDetectionFaulty = false
+let isKnownTestsEnabled = false
+let isTestManagementTestsEnabled = false
+let isImpactedTestsEnabled = false
+let testManagementAttemptToFixRetries = 0
+let isDiEnabled = false
+let testCodeCoverageLinesTotal
+let coverageRootDir
+let isSessionStarted = false
+let isVitestNoWorkerInitActive = false
+let vitestPool = null
+let isMessagePortWrapped = false
+const tinyPoolClassWrappers = new WeakMap()
+
+function getConfiguredEfdRetryCount (slowTestRetries, fallbackRetryCount) {
+  if (!slowTestRetries || !Object.keys(slowTestRetries).length) {
+    return fallbackRetryCount
+  }
+  return getMaxEfdRetryCount(slowTestRetries)
+}
+
+function getTestCommand () {
+  return `vitest ${process.argv.slice(2).join(' ')}`
+}
+
+function isValidKnownTests (receivedKnownTests) {
+  return !!receivedKnownTests.vitest
+}
+
+function isReporterPackage (vitestPackage) {
+  return vitestPackage.B?.name === 'BaseSequencer'
+}
+
+function isReporterPackageNew (vitestPackage) {
+  return vitestPackage.e?.name === 'BaseSequencer'
+}
+
+function isReporterPackageNewest (vitestPackage) {
+  return vitestPackage.h?.name === 'BaseSequencer'
+}
+
+function getBaseSequencerExport (vitestPackage) {
+  return findExportByName(vitestPackage, 'BaseSequencer')
+}
+
+function isCliApiPackage (vitestPackage) {
+  return !!findExportByName(vitestPackage, 'startVitest')
+}
+
+function getVitestExport (vitestPackage) {
+  return findExportByName(vitestPackage, 'Vitest')
+}
+
+function getTypecheckerExport (vitestPackage) {
+  return findExportByName(vitestPackage, 'Typechecker')
+}
+
+function getForksPoolWorkerExport (vitestPackage) {
+  return findExportByName(vitestPackage, 'ForksPoolWorker')
+}
+
+function getThreadsPoolWorkerExport (vitestPackage) {
+  return findExportByName(vitestPackage, 'ThreadsPoolWorker')
+}
+
+function getSessionStatus (state) {
+  if (state.getCountOfFailedTests() > 0) {
+    return 'fail'
+  }
+  if (state.pathsSet.size === 0) {
+    return 'skip'
+  }
+  return 'pass'
+}
+
+function getTestFilepathsFromSpecifications (testSpecifications) {
+  if (!Array.isArray(testSpecifications) || !testSpecifications.length) {
+    return
+  }
+
+  return testSpecifications.map(testSpecification => {
+    const testFile = Array.isArray(testSpecification) ? testSpecification[1] : testSpecification
+    return testFile?.moduleId || testFile?.filepath || testFile
+  })
+}
+
+function getTestSpecificationsKey (testSpecifications) {
+  if (!Array.isArray(testSpecifications) || !testSpecifications.length) return
+
+  const keyParts = []
+  for (const testSpecification of testSpecifications) {
+    const testFile = Array.isArray(testSpecification) ? testSpecification[1] : testSpecification
+    const testFilepath = testFile?.moduleId || testFile?.filepath || testFile
+    if (!testFilepath) continue
+
+    const projectName = getProjectName(getTestSpecificationProject(testSpecification)) || ''
+    const pool = getTestSpecificationPool(testSpecification) || ''
+    keyParts.push(`${projectName}\0${pool}\0${testFilepath}`)
+  }
+
+  if (!keyParts.length) return
+
+  keyParts.sort()
+  return keyParts.join('\0')
+}
+
+function getTestFilepaths (ctx, testSpecifications) {
+  const testFilepaths = getTestFilepathsFromSpecifications(testSpecifications)
+  if (testFilepaths) {
+    return testFilepaths
+  }
+
+  const getFilePaths = ctx.getTestFilepaths || ctx._globTestFilepaths
+  return getFilePaths.call(ctx)
+}
+
+/**
+ * @typedef {{
+ *   isAttemptToFix?: boolean,
+ *   isDisabled?: boolean,
+ *   isQuarantined?: boolean
+ * }} VitestTestManagementProperties
+ *
+ * @typedef {{
+ *   testSuite?: string,
+ *   knownTests?: string[],
+ *   testManagementTests?: Record<string, VitestTestManagementProperties>,
+ *   isModified?: boolean
+ * }} VitestTestProperties
+ */
+
+/**
+ * Normalize a Vitest test file path to the test suite path used by Test Optimization APIs.
+ *
+ * @param {string} testFilepath
+ * @param {string} repositoryRoot
+ * @returns {string}
+ */
+function getNormalizedTestSuitePath (testFilepath, repositoryRoot) {
+  const testSuiteAbsolutePath = path.isAbsolute(testFilepath) ? testFilepath : path.join(repositoryRoot, testFilepath)
+  return getTestSuitePath(testSuiteAbsolutePath, repositoryRoot)
+}
+
+/**
+ * Build simplified Test Management metadata grouped by normalized test suite path.
+ *
+ * @param {{ vitest?: { suites?: Record<string, { tests?: Record<string, { properties?: {
+ *   attempt_to_fix?: boolean,
+ *   disabled?: boolean,
+ *   quarantined?: boolean
+ * } }> }> } }} testManagementTests
+ * @returns {Record<string, Record<string, VitestTestManagementProperties>>}
+ */
+function getTestManagementTestsBySuite (testManagementTests) {
+  const testManagementTestsBySuite = {}
+  const suites = testManagementTests?.vitest?.suites
+  if (!suites) return testManagementTestsBySuite
+
+  for (const [testSuite, suite] of Object.entries(suites)) {
+    const tests = suite?.tests
+    if (!tests) continue
+
+    const testsByName = {}
+    let hasTests = false
+    for (const [testName, test] of Object.entries(tests)) {
+      const properties = test?.properties
+      const testProperties = {
+        isAttemptToFix: properties?.attempt_to_fix,
+        isDisabled: properties?.disabled,
+        isQuarantined: properties?.quarantined,
+      }
+      testsByName[testName] = testProperties
+      hasTests = true
+    }
+    if (hasTests) {
+      testManagementTestsBySuite[testSuite] = testsByName
+    }
+  }
+
+  return testManagementTestsBySuite
+}
+
+/**
+ * Build a set-like object for test suites modified in the current pull request diff.
+ *
+ * @param {Record<string, number[]>|undefined} modifiedFiles
+ * @returns {Record<string, boolean>}
+ */
+function getImpactedTestSuites (modifiedFiles) {
+  const impactedTestSuites = {}
+  if (!modifiedFiles) return impactedTestSuites
+
+  for (const testSuite of Object.keys(modifiedFiles)) {
+    if (isModifiedTest(testSuite, 0, 0, modifiedFiles, 'vitest')) {
+      impactedTestSuites[testSuite] = true
+    }
+  }
+
+  return impactedTestSuites
+}
+
+/**
+ * Build the worker-ready test metadata map keyed by Vitest's absolute filepath.
+ *
+ * @param {string[]} testFilepaths
+ * @param {string} repositoryRoot
+ * @param {Record<string, string[]>|undefined} knownTestsBySuite
+ * @param {Record<string, Record<string, VitestTestManagementProperties>>|undefined} testManagementTestsBySuite
+ * @param {Record<string, boolean>|undefined} impactedTestSuites
+ * @returns {Record<string, VitestTestProperties>}
+ */
+function getTestPropertiesByFilepath (
+  testFilepaths,
+  repositoryRoot,
+  knownTestsBySuite,
+  testManagementTestsBySuite,
+  impactedTestSuites
+) {
+  const testPropertiesByFilepath = {}
+  if (!Array.isArray(testFilepaths)) return testPropertiesByFilepath
+
+  for (const testFilepath of testFilepaths) {
+    if (typeof testFilepath !== 'string') continue
+
+    const testSuite = getNormalizedTestSuitePath(testFilepath, repositoryRoot)
+    const testProperties = { testSuite }
+    const hasProperties = knownTestsBySuite !== undefined ||
+      testManagementTestsBySuite !== undefined ||
+      impactedTestSuites !== undefined
+
+    if (knownTestsBySuite) {
+      testProperties.knownTests = knownTestsBySuite[testSuite] || []
+    }
+    if (testManagementTestsBySuite) {
+      testProperties.testManagementTests = testManagementTestsBySuite[testSuite] || {}
+    }
+    if (impactedTestSuites?.[testSuite]) {
+      testProperties.isModified = true
+    }
+
+    if (hasProperties) {
+      testPropertiesByFilepath[testFilepath] = testProperties
+    }
+  }
+
+  return testPropertiesByFilepath
+}
+
+function wrapCoverageProvider (ctx) {
+  const { coverageProvider } = ctx
+  if (!coverageProvider?.generateCoverage || coverageWrappedProviders.has(coverageProvider)) {
+    return
+  }
+  coverageWrappedProviders.add(coverageProvider)
+
+  // Capture coverage root directory from config (default is 'coverage' in cwd)
+  try {
+    const coverageConfig = ctx.config?.coverage
+    const reportsDirectory = coverageConfig?.reportsDirectory || 'coverage'
+    const rootDir = ctx.config?.root || process.cwd()
+    coverageRootDir = path.isAbsolute(reportsDirectory) ? reportsDirectory : path.join(rootDir, reportsDirectory)
+  } catch {
+    // Fallback to cwd if we can't get config
+    coverageRootDir = process.cwd()
+  }
+
+  shimmer.wrap(coverageProvider, 'generateCoverage', generateCoverage => async function () {
+    const totalCodeCoverage = await generateCoverage.apply(this, arguments)
+
+    try {
+      testCodeCoverageLinesTotal = totalCodeCoverage.getCoverageSummary().lines.pct
+    } catch {
+      // ignore errors
+    }
+    return totalCodeCoverage
+  })
+}
+
+function wrapSessionFinish (ctx) {
+  if (finishWrappedContexts.has(ctx)) {
+    return
+  }
+  finishWrappedContexts.add(ctx)
+
+  shimmer.wrap(ctx, 'exit', getFinishWrapper)
+  shimmer.wrap(ctx, 'close', getFinishWrapper)
+}
+
+function resetLibraryConfig () {
+  isFlakyTestRetriesEnabled = false
+  flakyTestRetriesCount = 0
+  isEarlyFlakeDetectionEnabled = false
+  earlyFlakeDetectionNumRetries = 0
+  earlyFlakeDetectionSlowTestRetries = {}
+  isEarlyFlakeDetectionFaulty = false
+  isDiEnabled = false
+  isKnownTestsEnabled = false
+  isTestManagementTestsEnabled = false
+  isImpactedTestsEnabled = false
+  testManagementAttemptToFixRetries = 0
+}
+
+function applyLibraryConfig (libraryConfig) {
+  isFlakyTestRetriesEnabled = libraryConfig.isFlakyTestRetriesEnabled
+  flakyTestRetriesCount = libraryConfig.flakyTestRetriesCount
+  isEarlyFlakeDetectionEnabled = libraryConfig.isEarlyFlakeDetectionEnabled
+  earlyFlakeDetectionNumRetries = libraryConfig.earlyFlakeDetectionNumRetries
+  earlyFlakeDetectionSlowTestRetries = libraryConfig.earlyFlakeDetectionSlowTestRetries ?? {}
+  isEarlyFlakeDetectionFaulty = false
+  isDiEnabled = libraryConfig.isDiEnabled
+  isKnownTestsEnabled = libraryConfig.isKnownTestsEnabled
+  isTestManagementTestsEnabled = libraryConfig.isTestManagementEnabled
+  testManagementAttemptToFixRetries = libraryConfig.testManagementAttemptToFixRetries
+  isImpactedTestsEnabled = libraryConfig.isImpactedTestsEnabled
+}
+
+function resetMainProcessProvidedContext (ctx) {
+  setProvidedContext(ctx, {
+    _ddIsDiEnabled: false,
+    _ddIsEarlyFlakeDetectionEnabled: false,
+    _ddEarlyFlakeDetectionNumRetries: 0,
+    _ddEarlyFlakeDetectionSlowTestRetries: {},
+    _ddIsFlakyTestRetriesEnabled: false,
+    _ddFlakyTestRetriesCount: 0,
+    _ddFlakyTestRetriesIncludesUnnamedProject: false,
+    _ddFlakyTestRetriesProjectNames: undefined,
+    _ddIsImpactedTestsEnabled: false,
+    _ddIsKnownTestsEnabled: false,
+    _ddIsTestManagementTestsEnabled: false,
+    _ddTestManagementAttemptToFixRetries: 0,
+    _ddTestPropertiesByFilepath: {},
+  }, 'Could not reset Test Optimization context for workers.')
+}
+
+async function runMainProcessSetup (ctx, frameworkVersion, testSpecifications, shouldInstallNoWorkerInit) {
+  if (!testSessionFinishCh.hasSubscribers) {
+    return
+  }
+
+  let repositoryRoot = process.cwd()
+  let testSessionConfiguration
+  let testFilepaths
+  let shouldSendTestProperties = false
+  let testPropertiesByFilepath
+  let knownTests
+  let knownTestsBySuite
+  let testManagementTests
+  let testManagementTestsBySuite
+  let modifiedFiles
+  let impactedTestSuites
+  const getCurrentTestFilepaths = async () => {
+    if (testFilepaths === undefined) {
+      testFilepaths = await getTestFilepaths(ctx, testSpecifications)
+    }
+    return testFilepaths
+  }
+
+  try {
+    const { err, libraryConfig } = await getChannelPromise(libraryConfigurationCh, frameworkVersion, {
+      isVitestNoWorkerInitActive: shouldInstallNoWorkerInit,
+    })
+    if (err) {
+      resetLibraryConfig()
+    } else {
+      applyLibraryConfig(libraryConfig)
+    }
+  } catch {
+    resetLibraryConfig()
+  }
+
+  resetMainProcessProvidedContext(ctx)
+
+  if (testSessionConfigurationCh.hasSubscribers) {
+    testSessionConfiguration = await getChannelPromise(testSessionConfigurationCh, frameworkVersion)
+    const {
+      testSessionId,
+      testModuleId,
+      testCommand,
+      repositoryRoot: receivedRepositoryRoot,
+      codeOwnersEntries,
+    } = testSessionConfiguration
+    repositoryRoot = receivedRepositoryRoot || repositoryRoot
+    if (!shouldInstallNoWorkerInit) {
+      setProvidedContext(ctx, {
+        _ddTestSessionId: testSessionId,
+        _ddTestModuleId: testModuleId,
+        _ddTestCommand: testCommand,
+        _ddRepositoryRoot: repositoryRoot,
+        _ddCodeOwnersEntries: codeOwnersEntries,
+      }, 'Could not send test session configuration to workers.')
+    }
+  }
+
+  const {
+    knownTestsResponse,
+    testManagementTestsResponse,
+  } = await getTestOptimizationRequestResults({
+    isKnownTestsEnabled,
+    isTestManagementTestsEnabled,
+    getKnownTests: () => getChannelPromise(knownTestsCh),
+    getTestManagementTests: () => getChannelPromise(testManagementTestsCh),
+  })
+
+  const flakyTestRetriesConfiguration = configureFlakyTestRetries(ctx, testSpecifications)
+  if (flakyTestRetriesConfiguration) {
+    setProvidedContext(ctx, {
+      _ddIsFlakyTestRetriesEnabled: isFlakyTestRetriesEnabled,
+      _ddFlakyTestRetriesCount: flakyTestRetriesCount,
+      _ddFlakyTestRetriesIncludesUnnamedProject: flakyTestRetriesConfiguration.includesUnnamedProject,
+      _ddFlakyTestRetriesProjectNames: flakyTestRetriesConfiguration.projectNames,
+    }, 'Could not send library configuration to workers.')
+  }
+
+  if (isKnownTestsEnabled) {
+    const currentKnownTestsResponse = knownTestsResponse || await getChannelPromise(knownTestsCh)
+    if (currentKnownTestsResponse.err) {
+      isEarlyFlakeDetectionEnabled = false
+    } else {
+      knownTests = currentKnownTestsResponse.knownTests
+      const currentTestFilepaths = await getCurrentTestFilepaths()
+
+      if (isValidKnownTests(knownTests)) {
+        isEarlyFlakeDetectionFaultyCh.publish({
+          knownTests: knownTests.vitest,
+          testFilepaths: currentTestFilepaths,
+          onDone: (isFaulty) => {
+            isEarlyFlakeDetectionFaulty = isFaulty
+          },
+        })
+        if (isEarlyFlakeDetectionFaulty) {
+          isEarlyFlakeDetectionEnabled = false
+          log.warn('New test detection is disabled because the number of new tests is too high.')
+        } else {
+          knownTestsBySuite = knownTests.vitest
+          shouldSendTestProperties = true
+          if (!shouldInstallNoWorkerInit) {
+            setProvidedContext(ctx, {
+              _ddIsKnownTestsEnabled: isKnownTestsEnabled,
+              _ddIsEarlyFlakeDetectionEnabled: isEarlyFlakeDetectionEnabled,
+              _ddEarlyFlakeDetectionNumRetries:
+                getConfiguredEfdRetryCount(earlyFlakeDetectionSlowTestRetries, earlyFlakeDetectionNumRetries),
+              _ddEarlyFlakeDetectionSlowTestRetries: earlyFlakeDetectionSlowTestRetries,
+            }, 'Could not send known tests to workers so Early Flake Detection will not work.')
+          }
+        }
+      } else {
+        isEarlyFlakeDetectionFaulty = true
+        isEarlyFlakeDetectionEnabled = false
+      }
+    }
+  }
+
+  if (!shouldInstallNoWorkerInit && isDiEnabled) {
+    setProvidedContext(ctx, {
+      _ddIsDiEnabled: isDiEnabled,
+    }, 'Could not send Dynamic Instrumentation configuration to workers.')
+  }
+
+  if (isTestManagementTestsEnabled) {
+    const { err, testManagementTests: receivedTestManagementTests } =
+      testManagementTestsResponse || await getChannelPromise(testManagementTestsCh)
+    if (err) {
+      isTestManagementTestsEnabled = false
+      log.error('Could not get test management tests.')
+    } else {
+      testManagementTests = receivedTestManagementTests
+      testManagementTestsBySuite = getTestManagementTestsBySuite(receivedTestManagementTests)
+      shouldSendTestProperties = true
+      if (!shouldInstallNoWorkerInit) {
+        setProvidedContext(ctx, {
+          _ddIsTestManagementTestsEnabled: isTestManagementTestsEnabled,
+          _ddTestManagementAttemptToFixRetries: testManagementAttemptToFixRetries,
+        }, 'Could not send test management tests to workers so Test Management will not work.')
+      }
+    }
+  }
+
+  if (isImpactedTestsEnabled) {
+    const modifiedFilesResponse = await getChannelPromise(modifiedFilesCh)
+    const { err } = modifiedFilesResponse
+    if (err) {
+      log.error('Could not get modified tests.')
+    } else {
+      modifiedFiles = modifiedFilesResponse.modifiedFiles
+      impactedTestSuites = getImpactedTestSuites(modifiedFiles)
+      shouldSendTestProperties = true
+      if (!shouldInstallNoWorkerInit) {
+        setProvidedContext(ctx, {
+          _ddIsImpactedTestsEnabled: isImpactedTestsEnabled,
+        }, 'Could not send modified tests to workers so Impacted Tests will not work.')
+      }
+    }
+  }
+
+  if (shouldSendTestProperties) {
+    testPropertiesByFilepath = getTestPropertiesByFilepath(
+      await getCurrentTestFilepaths(),
+      repositoryRoot,
+      knownTestsBySuite,
+      testManagementTestsBySuite,
+      impactedTestSuites
+    )
+    if (!shouldInstallNoWorkerInit) {
+      setProvidedContext(ctx, {
+        _ddTestPropertiesByFilepath: testPropertiesByFilepath,
+      }, 'Could not send test properties to workers so some Test Optimization features will not work.')
+    }
+  }
+
+  if (shouldInstallNoWorkerInit) {
+    noWorkerInit.configure(ctx, frameworkVersion, testSpecifications, {
+      knownTests,
+      knownTestsBySuite,
+      modifiedFiles,
+      repositoryRoot,
+      flakyTestRetriesConfiguration,
+      testManagementTests,
+      testManagementTestsBySuite,
+      testPropertiesByFilepath: testPropertiesByFilepath || {},
+      testSessionConfiguration,
+    }, {
+      getConfiguredEfdRetryCount,
+      state: getNoWorkerInitState(),
+    })
+  }
+
+  wrapCoverageProvider(ctx)
+  wrapSessionFinish(ctx)
+  return shouldInstallNoWorkerInit
+}
+
+function getNoWorkerInitState () {
+  return {
+    attemptToFixExecutions,
+    earlyFlakeDetectionNumRetries,
+    earlyFlakeDetectionSlowTestRetries,
+    isEarlyFlakeDetectionEnabled,
+    isEarlyFlakeDetectionFaulty,
+    isFlakyTestRetriesEnabled,
+    isKnownTestsEnabled,
+    newTestsWithDynamicNames,
+    testManagementAttemptToFixRetries,
+  }
+}
+
+function ensureMainProcessSetup (ctx, frameworkVersion, testSpecifications, shouldDeactivateOnFallback = false) {
+  const shouldInstallNoWorkerInit = shouldUseNoWorkerInit(ctx, frameworkVersion, testSpecifications)
+  const specificationsKey = getTestSpecificationsKey(testSpecifications)
+  let setupState = mainProcessSetupStates.get(ctx)
+  if (shouldDeactivateOnFallback && setupState?.shouldInstallNoWorkerInit && !shouldInstallNoWorkerInit) {
+    noWorkerInit.deactivate(ctx)
+  }
+  if (
+    !setupState ||
+    setupState.specificationsKey !== specificationsKey ||
+    setupState.shouldInstallNoWorkerInit !== shouldInstallNoWorkerInit
+  ) {
+    setupState = {
+      setupPromise: runMainProcessSetup(ctx, frameworkVersion, testSpecifications, shouldInstallNoWorkerInit),
+      shouldInstallNoWorkerInit,
+      specificationsKey,
+    }
+    mainProcessSetupStates.set(ctx, setupState)
+  }
+  return setupState.setupPromise
+}
+
+function shouldUseNoWorkerInit (ctx, frameworkVersion, testSpecifications) {
+  return noWorkerInit.shouldUse(ctx, frameworkVersion, testSpecifications, {
+    hasVitestWorkerPoolTestSpecification,
+    isVitestWorkerPool,
+  })
+}
+
+function configureFlakyTestRetries (ctx, testSpecifications) {
+  if (!isFlakyTestRetriesEnabled || flakyTestRetriesCount <= 0) return
+
+  let configured = false
+  let includesUnnamedProject = false
+  const projectNames = []
+  for (const { config, projectName } of getVitestProjectConfigs(ctx, testSpecifications)) {
+    if (!config.retry) {
+      config.retry = flakyTestRetriesCount
+      configured = true
+      if (projectName) {
+        projectNames.push(projectName)
+      } else {
+        includesUnnamedProject = true
+      }
+    }
+  }
+
+  if (!configured) return
+
+  return {
+    includesUnnamedProject,
+    projectNames,
+  }
+}
+
+function getVitestProjectConfigs (ctx, testSpecifications) {
+  const entries = []
+
+  addTestSpecificationConfigs(entries, testSpecifications)
+  if (entries.length > 0) {
+    return entries
+  }
+
+  const selectedProjectNames = getSelectedProjectNames()
+  addSelectedInlineProjectConfigs(entries, safeConfig(ctx), selectedProjectNames)
+  addSelectedRuntimeProjectConfigs(entries, ctx?.projects, selectedProjectNames)
+  if (entries.length > 0) {
+    return entries
+  }
+
+  if (Array.isArray(ctx?.projects)) {
+    for (const project of ctx.projects) {
+      addConfig(entries, safeConfig(project), getProjectName(project))
+    }
+    if (entries.length > 0) {
+      return entries
+    }
+  }
+
+  addConfig(entries, safeConfig(ctx))
+  addConfig(entries, safeConfig(safeWorkspaceProject(ctx)))
+
+  return entries
+}
+
+function addTestSpecificationConfigs (entries, testSpecifications) {
+  if (!Array.isArray(testSpecifications)) return
+
+  for (const testSpecification of testSpecifications) {
+    const project = getTestSpecificationProject(testSpecification)
+    addConfig(entries, safeConfig(project), getProjectName(project))
+  }
+}
+
+function addSelectedInlineProjectConfigs (entries, rootConfig, selectedProjectNames) {
+  if (selectedProjectNames.length === 0 || !Array.isArray(rootConfig?.projects)) return
+
+  for (const project of rootConfig.projects) {
+    const config = getInlineProjectConfig(project)
+    const projectName = getProjectName(project)
+    if (selectedProjectNames.includes(projectName)) {
+      addConfig(entries, config, projectName)
+    }
+  }
+}
+
+function addSelectedRuntimeProjectConfigs (entries, projects, selectedProjectNames) {
+  if (selectedProjectNames.length === 0 || !Array.isArray(projects)) return
+
+  for (const project of projects) {
+    const projectName = getProjectName(project)
+    if (selectedProjectNames.includes(projectName)) {
+      addConfig(entries, safeConfig(project), projectName)
+    }
+  }
+}
+
+function getSelectedProjectNames () {
+  const names = []
+  for (let index = 0; index < process.argv.length; index++) {
+    const argument = process.argv[index]
+    if (argument === '--project' && process.argv[index + 1]) {
+      names.push(process.argv[index + 1])
+      index++
+    } else if (argument.startsWith('--project=')) {
+      names.push(argument.slice('--project='.length))
+    }
+  }
+  return names
+}
+
+function getInlineProjectConfig (project) {
+  return project?.test || project
+}
+
+function getProjectName (project) {
+  return normalizeProjectName(project?.name || project?.config?.name || project?.test?.name)
+}
+
+function normalizeProjectName (name) {
+  if (typeof name === 'string') return name
+
+  const label = name?.label
+  return typeof label === 'string' ? label : undefined
+}
+
+function addConfig (entries, config, projectName) {
+  if (config && !entries.some(entry => entry.config === config || (projectName && entry.projectName === projectName))) {
+    entries.push({ config, projectName })
+  }
+}
+
+function safeConfig (project) {
+  let config
+  try {
+    config = project?.config
+  } catch {}
+  return config
+}
+
+function safeWorkspaceProject (ctx) {
+  let project
+  try {
+    project = getWorkspaceProject(ctx)
+  } catch {}
+  return project
+}
+
+function getSortWrapper (sort, frameworkVersion) {
+  return async function () {
+    await ensureMainProcessSetup(this.ctx, frameworkVersion, arguments[0])
+    return sort.apply(this, arguments)
+  }
+}
+
+function getFinishWrapper (exitOrClose) {
+  let isClosed = false
+  return async function () {
+    if (isClosed) { // needed because exit calls close
+      return exitOrClose.apply(this, arguments)
+    }
+    isClosed = true
+
+    if (!testSessionFinishCh.hasSubscribers) {
+      return exitOrClose.apply(this, arguments)
+    }
+
+    let onFinish
+
+    const flushPromise = new Promise(resolve => {
+      onFinish = resolve
+    })
+    const failedSuites = this.state.getFailedFilepaths()
+    let error
+    if (failedSuites.length) {
+      error = new Error(`Test suites failed: ${failedSuites.length}.`)
+    }
+
+    testSessionFinishCh.publish({
+      status: getSessionStatus(this.state),
+      testCodeCoverageLinesTotal,
+      error,
+      isEarlyFlakeDetectionEnabled,
+      isEarlyFlakeDetectionFaulty,
+      isTestManagementTestsEnabled,
+      vitestPool,
+      isVitestNoWorkerInitActive,
+      onFinish,
+    })
+
+    logTestOptimizationSummary({ attemptToFixExecutions, newTestsWithDynamicNames })
+
+    await flushPromise
+
+    // If coverage was generated, publish coverage report channel for upload
+    if (coverageRootDir && codeCoverageReportCh.hasSubscribers) {
+      await new Promise((resolve) => {
+        codeCoverageReportCh.publish({ rootDir: coverageRootDir, onDone: resolve })
+      })
+    }
+
+    return exitOrClose.apply(this, arguments)
+  }
+}
+
+function getCliOrStartVitestWrapper (frameworkVersion) {
+  return function (oldCliOrStartVitest) {
+    return function (...args) {
+      if (!testSessionStartCh.hasSubscribers || isSessionStarted) {
+        return oldCliOrStartVitest.apply(this, args)
+      }
+      isSessionStarted = true
+      testSessionStartCh.publish({ command: getTestCommand(), frameworkVersion })
+      return oldCliOrStartVitest.apply(this, args)
+    }
+  }
+}
+
+function isForkPool (pool) {
+  return pool === 'forks' || pool === 'vmForks'
+}
+
+function isThreadPool (pool) {
+  return pool === 'threads' || pool === 'vmThreads'
+}
+
+function isVitestWorkerPool (pool) {
+  return isForkPool(pool) || isThreadPool(pool)
+}
+
+function getTestSpecificationProject (testSpecification) {
+  if (Array.isArray(testSpecification)) {
+    return testSpecification[0]
+  }
+  return testSpecification?.project
+}
+
+function getTestSpecificationOptions (testSpecification) {
+  if (Array.isArray(testSpecification)) {
+    return testSpecification[2]
+  }
+  return testSpecification
+}
+
+function getTestSpecificationPool (testSpecification) {
+  const options = getTestSpecificationOptions(testSpecification)
+  const project = getTestSpecificationProject(testSpecification)
+  return options?.pool || project?.config?.pool || project?.serializedConfig?.pool || project?.pool ||
+    testSpecification?.pool
+}
+
+function hasVitestWorkerPoolTestSpecification (testSpecifications) {
+  if (!Array.isArray(testSpecifications)) {
+    return false
+  }
+
+  for (const testSpecification of testSpecifications) {
+    if (isVitestWorkerPool(getTestSpecificationPool(testSpecification))) {
+      return true
+    }
+  }
+
+  return false
+}
+
+function shouldMarkVitestWorkerEnv (pool, testSpecifications, shouldSkipWorkerInit) {
+  if (!shouldSkipWorkerInit) {
+    return isVitestWorkerPool(pool) || hasVitestWorkerPoolTestSpecification(testSpecifications) ||
+      (!testSpecifications && pool === undefined)
+  }
+
+  return isVitestWorkerPool(pool) || pool === undefined || hasVitestWorkerPoolTestSpecification(testSpecifications)
+}
+
+function markVitestWorkerEnv (ctx, testSpecifications, shouldSkipWorkerInit = false) {
+  const config = ctx?.config
+  isVitestNoWorkerInitActive = shouldSkipWorkerInit
+  if (!config || !shouldMarkVitestWorkerEnv(config.pool, testSpecifications, shouldSkipWorkerInit)) {
+    return
+  }
+  config.env = getVitestWorkerEnv(config.env, shouldSkipWorkerInit)
+}
+
+function wrapVitestRunFiles (Vitest, frameworkVersion) {
+  if (!Vitest?.prototype?.runFiles) {
+    return
+  }
+
+  shimmer.wrap(Vitest.prototype, 'runFiles', runFiles => async function (testSpecifications) {
+    const shouldSkipWorkerInit = await ensureMainProcessSetup(this, frameworkVersion, testSpecifications, true)
+    markVitestWorkerEnv(this, testSpecifications, shouldSkipWorkerInit)
+    return runFiles.apply(this, arguments)
+  })
+
+  if (Vitest.prototype.collectTests) {
+    shimmer.wrap(Vitest.prototype, 'collectTests', collectTests => function (testSpecifications) {
+      const shouldSkipWorkerInit = shouldUseNoWorkerInit(this, frameworkVersion, testSpecifications)
+      markVitestWorkerEnv(this, testSpecifications, shouldSkipWorkerInit)
+      return collectTests.apply(this, arguments)
+    })
+  }
+}
+
+function getTypecheckTaskStatus (task) {
+  const state = task.result?.state
+  if (state === 'fail') return 'fail'
+  if (state === 'skip' || task.mode === 'skip' || task.mode === 'todo') return 'skip'
+  return 'pass'
+}
+
+/**
+ * Return whether a typecheck suite name represents the synthetic file-level suite.
+ *
+ * @param {string|undefined} suiteName
+ * @param {string} testSuiteAbsolutePath
+ * @returns {boolean}
+ */
+function isTypecheckFileSuiteName (suiteName, testSuiteAbsolutePath) {
+  if (!suiteName || !testSuiteAbsolutePath) return false
+
+  const normalizedSuiteName = path.normalize(suiteName).replaceAll('\\', '/')
+  const normalizedSuitePath = path.normalize(testSuiteAbsolutePath).replaceAll('\\', '/')
+
+  return normalizedSuitePath === normalizedSuiteName || normalizedSuitePath.endsWith(`/${normalizedSuiteName}`)
+}
+
+/**
+ * Return a typecheck test name with describe/suite prefixes and without the file-level suite prefix.
+ *
+ * @param {object} task
+ * @param {string} testSuiteAbsolutePath
+ * @returns {string}
+ */
+function getTypecheckTestName (task, testSuiteAbsolutePath) {
+  let testName = task.name || task.fullTestName
+  let currentTask = task.suite
+
+  while (currentTask) {
+    if (currentTask.name && !isTypecheckFileSuiteName(currentTask.name, testSuiteAbsolutePath)) {
+      testName = `${currentTask.name} ${testName}`
+    }
+    currentTask = currentTask.suite
+  }
+
+  return testName
+}
+
+/**
+ * Return Test Optimization metadata prepared in Vitest's main process setup.
+ *
+ * @param {object|undefined} ctx
+ * @returns {{ testPropertiesByFilepath: object }}
+ */
+function getMainProcessProvidedContext (ctx) {
+  try {
+    const workspaceProject = getWorkspaceProject(ctx)
+    const providedContext = workspaceProject.getProvidedContext?.() || workspaceProject._provided || {}
+
+    return {
+      testPropertiesByFilepath: providedContext._ddTestPropertiesByFilepath || {},
+    }
+  } catch {
+    return {
+      testPropertiesByFilepath: {},
+    }
+  }
+}
+
+/**
+ * Return the Vitest context that owns a Typechecker instance.
+ *
+ * @param {object} typechecker
+ * @returns {object|undefined}
+ */
+function getTypecheckerVitestContext (typechecker) {
+  return typechecker.ctx || typechecker.project?.vitest
+}
+
+/**
+ * Apply Test Management result semantics to Vitest's returned typecheck task result.
+ *
+ * @param {object} task
+ * @param {string} status
+ * @param {{
+ *   isAttemptToFix: boolean,
+ *   isDisabled: boolean,
+ *   isQuarantined: boolean
+ * }} testManagement
+ */
+function updateTypecheckTaskResultForTestManagement (task, status, testManagement) {
+  const { isAttemptToFix, isDisabled, isQuarantined } = testManagement
+  if (isAttemptToFix || !task.result) return
+
+  if (isDisabled) {
+    task.mode = 'skip'
+    task.result.state = 'skip'
+    task.result.errors = []
+    return
+  }
+
+  if (isQuarantined && status === 'fail') {
+    task.result.state = 'pass'
+    task.result.errors = []
+  }
+}
+
+/**
+ * Recompute suite/file typecheck results after Test Management rewrites child test results.
+ *
+ * @param {object} task
+ * @returns {string}
+ */
+function updateTypecheckTaskTreeResult (task) {
+  if (!Array.isArray(task.tasks)) return getTypecheckTaskStatus(task)
+
+  let hasPassedTest = false
+  let hasSkippedTest = false
+  for (const childTask of task.tasks) {
+    const status = updateTypecheckTaskTreeResult(childTask)
+    if (status === 'fail') {
+      task.result = {
+        ...task.result,
+        state: 'fail',
+      }
+      return 'fail'
+    }
+    if (status === 'skip') {
+      hasSkippedTest = true
+    } else {
+      hasPassedTest = true
+    }
+  }
+
+  if (task.result?.errors?.length) return 'fail'
+  if (!hasPassedTest && !hasSkippedTest) return getTypecheckTaskStatus(task)
+
+  task.result = {
+    ...task.result,
+    state: hasPassedTest ? 'pass' : 'skip',
+    errors: [],
+  }
+  return task.result.state
+}
+
+/**
+ * Recompute the aggregate typecheck result after Test Management rewrites file results.
+ *
+ * @param {{
+ *   files?: object[],
+ *   errors?: object[],
+ *   diagnostics?: object[],
+ *   sourceErrors?: object[],
+ *   state?: string
+ * }} result
+ * @returns {boolean}
+ */
+function updateTypecheckResult (result) {
+  if (result.sourceErrors?.length) return false
+
+  let hasPassedFile = false
+  let hasSkippedFile = false
+  for (const file of result.files) {
+    const status = getTypecheckTaskStatus(file)
+    if (status === 'fail') return false
+    if (status === 'skip') {
+      hasSkippedFile = true
+    } else {
+      hasPassedFile = true
+    }
+  }
+
+  if (!hasPassedFile && !hasSkippedFile) return false
+
+  result.state = hasPassedFile ? 'pass' : 'skip'
+  result.errors = []
+  result.diagnostics = []
+  result.sourceErrors = []
+  return true
+}
+
+/**
+ * Clear Vitest's typechecker exit code after all typecheck failures were handled by Test Management.
+ *
+ * @param {{ process?: { exitCode?: number|null } }} typechecker
+ */
+function clearTypecheckerExitCode (typechecker) {
+  if (typechecker?.process?.exitCode == null) return
+
+  typechecker.process.exitCode = 0
+}
+
+function reportTypecheckTest (task, testSuiteAbsolutePath, providedContext) {
+  const testName = getTypecheckTestName(task, testSuiteAbsolutePath)
+  const testProperties = getVitestTestProperties(providedContext, testSuiteAbsolutePath, testName)
+  const isAttemptToFix = testProperties.isAttemptToFix === true
+  const isDisabled = testProperties.isDisabled === true
+  const isQuarantined = testProperties.isQuarantined === true
+  const isModified = testProperties.isModified === true
+  const isSkippedByTestManagement = !isAttemptToFix && isDisabled
+  const status = getTypecheckTaskStatus(task)
+
+  if (status === 'skip' || isSkippedByTestManagement) {
+    testSkipCh.publish({
+      testName,
+      testSuiteAbsolutePath,
+      isNew: testProperties.isNew,
+      isDisabled,
+    })
+    updateTypecheckTaskResultForTestManagement(task, status, { isAttemptToFix, isDisabled, isQuarantined })
+    return
+  }
+
+  const ctx = {
+    testName,
+    testSuiteAbsolutePath,
+    isRetry: false,
+    isNew: testProperties.isNew,
+    hasDynamicName: false,
+    mightHitProbe: false,
+    isAttemptToFix,
+    isDisabled,
+    isQuarantined,
+    isModified,
+  }
+  testStartCh.runStores(ctx, () => {})
+
+  const finalStatus = !isAttemptToFix && isQuarantined ? 'skip' : undefined
+  if (status === 'fail') {
+    testErrorCh.publish({
+      error: task.result?.errors?.[0],
+      finalStatus,
+      ...ctx.currentStore,
+    })
+  } else {
+    testPassCh.publish({
+      task,
+      finalStatus,
+      ...ctx.currentStore,
+    })
+  }
+  updateTypecheckTaskResultForTestManagement(task, status, { isAttemptToFix, isDisabled, isQuarantined })
+}
+
+async function reportTypecheckFile (file, sessionConfiguration, frameworkVersion, providedContext) {
+  const testSuiteAbsolutePath = file.filepath
+  const testSuiteCtx = {
+    testSuiteAbsolutePath,
+    frameworkVersion,
+    testSessionId: sessionConfiguration.testSessionId,
+    testModuleId: sessionConfiguration.testModuleId,
+    testCommand: sessionConfiguration.testCommand,
+    repositoryRoot: sessionConfiguration.repositoryRoot,
+    codeOwnersEntries: sessionConfiguration.codeOwnersEntries,
+  }
+  testSuiteStartCh.runStores(testSuiteCtx, () => {})
+
+  for (const task of getTypeTasks(file.tasks)) {
+    reportTypecheckTest(task, testSuiteAbsolutePath, providedContext)
+  }
+  updateTypecheckTaskTreeResult(file)
+
+  const testSuiteError = file.result?.errors?.[0]
+  if (testSuiteError) {
+    testSuiteCtx.error = testSuiteError
+    testSuiteErrorCh.runStores(testSuiteCtx, () => {})
+  }
+
+  let onFinish
+  const onFinishPromise = new Promise(resolve => {
+    onFinish = resolve
+  })
+  testSuiteFinishCh.publish({
+    status: getTypecheckTaskStatus(file),
+    onFinish,
+    ...testSuiteCtx.currentStore,
+  })
+  await onFinishPromise
+}
+
+async function reportTypecheckResults (result, frameworkVersion, ctx, typechecker) {
+  if (!testSuiteFinishCh.hasSubscribers) return
+  if (!Array.isArray(result?.files)) return
+
+  if (ctx) {
+    await ensureMainProcessSetup(ctx, frameworkVersion, result.files)
+  }
+  const providedContext = getMainProcessProvidedContext(ctx)
+  const sessionConfiguration = testSessionConfigurationCh.hasSubscribers
+    ? await getChannelPromise(testSessionConfigurationCh, frameworkVersion)
+    : {}
+
+  await Promise.all(result.files.map(file => reportTypecheckFile(
+    file,
+    sessionConfiguration,
+    frameworkVersion,
+    providedContext
+  )))
+  if (updateTypecheckResult(result)) {
+    clearTypecheckerExitCode(typechecker)
+  }
+}
+
+function wrapTypechecker (Typechecker, frameworkVersion) {
+  if (!Typechecker?.prototype?.prepareResults) return
+
+  shimmer.wrap(Typechecker.prototype, 'prepareResults', prepareResults => async function () {
+    const result = await prepareResults.apply(this, arguments)
+    await reportTypecheckResults(result, frameworkVersion, getTypecheckerVitestContext(this), this)
+    return result
+  })
+}
+
+function getTypecheckerWrapper (vitestPackage, frameworkVersion) {
+  const typechecker = getTypecheckerExport(vitestPackage)
+  if (typechecker) {
+    wrapTypechecker(typechecker.value, frameworkVersion)
+  }
+  return vitestPackage
+}
+
+function getCreateCliWrapper (vitestPackage, frameworkVersion) {
+  const createCliExport = findExportByName(vitestPackage, 'createCLI')
+  if (!createCliExport) {
+    return vitestPackage
+  }
+  shimmer.wrap(vitestPackage, createCliExport.key, getCliOrStartVitestWrapper(frameworkVersion))
+
+  return vitestPackage
+}
+
+function threadHandler (thread) {
+  const { runtime } = thread
+  let workerProcess
+  if (runtime === 'child_process') {
+    vitestPool = 'child_process'
+    workerProcess = thread.process
+  } else if (runtime === 'worker_threads') {
+    vitestPool = 'worker_threads'
+    workerProcess = thread.thread
+  } else {
+    vitestPool = 'unknown'
+  }
+  if (!workerProcess) {
+    log.error('Vitest error: could not get process or thread from TinyPool#run')
+    return
+  }
+
+  if (workerProcesses.has(workerProcess)) {
+    return
+  }
+  workerProcesses.add(workerProcess)
+  workerProcess.on('message', (message) => {
+    if (message.__tinypool_worker_message__ && message.data) {
+      handleWorkerReport(message.interprocessCode, message.data)
+    }
+  })
+}
+
+function isVitestTinypoolOptions (options) {
+  if (options?.env?.VITEST !== 'true' || typeof options.filename !== 'string') return false
+
+  let filename = options.filename
+  if (filename.startsWith('file:')) {
+    try {
+      filename = fileURLToPath(filename)
+    } catch {
+      return false
+    }
+  }
+
+  const workerPath = path.normalize(filename)
+  const workerDir = path.dirname(workerPath)
+  const packageDir = path.dirname(workerDir)
+
+  return path.basename(workerPath) === 'worker.js' &&
+    path.basename(workerDir) === 'dist' &&
+    path.basename(packageDir) === 'vitest'
+}
+
+function markVitestTinypoolOptions (options) {
+  if (!isVitestTinypoolOptions(options)) return
+
+  options.env = getVitestWorkerEnv(options.env, isVitestNoWorkerInitActive)
+}
+
+function getVitestWorkerEnv (env = {}, shouldSkipWorkerInit = false) {
+  return noWorkerInit.configureWorkerEnv({
+    ...env,
+    DD_VITEST_WORKER: '1',
+  }, shouldSkipWorkerInit)
+}
+
+function wrapTinyPoolRun (TinyPool) {
+  if (!TinyPool?.prototype?.run) return
+
+  shimmer.wrap(TinyPool.prototype, 'run', run => async function () {
+    // We have to do this before and after because the threads list gets recycled, that is, the processes are re-created
+    // eslint-disable-next-line unicorn/no-array-for-each
+    this.threads.forEach(threadHandler)
+    const runResult = await run.apply(this, arguments)
+    // eslint-disable-next-line unicorn/no-array-for-each
+    this.threads.forEach(threadHandler)
+    return runResult
+  })
+}
+
+function wrapTinyPoolClass (TinyPool) {
+  if (typeof TinyPool !== 'function') return TinyPool
+
+  const wrappedTinyPool = tinyPoolClassWrappers.get(TinyPool)
+  if (wrappedTinyPool) return wrappedTinyPool
+
+  class DatadogTinyPool extends TinyPool {
+    constructor (options) {
+      markVitestTinypoolOptions(options)
+      super(options)
+    }
+  }
+
+  tinyPoolClassWrappers.set(TinyPool, DatadogTinyPool)
+  wrapTinyPoolRun(DatadogTinyPool)
+
+  return DatadogTinyPool
+}
+
+function wrapTinyPool (TinyPool) {
+  if (typeof TinyPool === 'function') {
+    return wrapTinyPoolClass(TinyPool)
+  }
+
+  const defaultTinyPool = wrapTinyPoolClass(TinyPool?.default)
+  if (defaultTinyPool) {
+    TinyPool.default = defaultTinyPool
+  }
+
+  const namedTinyPool = TinyPool?.Tinypool === TinyPool?.default
+    ? defaultTinyPool
+    : wrapTinyPoolClass(TinyPool?.Tinypool)
+  if (namedTinyPool) {
+    TinyPool.Tinypool = namedTinyPool
+  }
+
+  return TinyPool
+}
+
+function getWrappedOn (on) {
+  return function (event, callback) {
+    if (event !== 'message') {
+      return on.apply(this, arguments)
+    }
+    // `arguments[1]` is the callback function, which
+    // we modify to intercept our messages to not interfere
+    // with vitest's own messages
+    arguments[1] = shimmer.wrapFunction(callback, callback => function (message) {
+      if (message.type !== 'Buffer' && Array.isArray(message)) {
+        const [interprocessCode, data] = message
+        if (handleWorkerReport(interprocessCode, data)) {
+          // If we execute the callback vitest crashes, as the message is not supported
+          return
+        }
+      }
+      return callback.apply(this, arguments)
+    })
+    return on.apply(this, arguments)
+  }
+}
+
+function handleWorkerReport (interprocessCode, data) {
+  if (interprocessCode === VITEST_WORKER_TRACE_PAYLOAD_CODE) {
+    collectTestOptimizationSummariesFromTraces(data, {
+      newTestsWithDynamicNames,
+      attemptToFixExecutions,
+    })
+    workerReportTraceCh.publish(data)
+    return true
+  }
+
+  if (interprocessCode === VITEST_WORKER_LOGS_PAYLOAD_CODE) {
+    workerReportLogsCh.publish(data)
+    return true
+  }
+
+  return false
+}
+
+function wrapMessagePortOn () {
+  if (isMessagePortWrapped) return
+
+  isMessagePortWrapped = true
+  shimmer.wrap(MessagePort.prototype, 'on', getWrappedOn)
+  shimmer.wrap(MessagePort.prototype, 'addListener', getWrappedOn)
+}
+
+function getStartVitestWrapper (cliApiPackage, frameworkVersion) {
+  if (!isCliApiPackage(cliApiPackage)) {
+    return cliApiPackage
+  }
+  const startVitestExport = findExportByName(cliApiPackage, 'startVitest')
+  shimmer.wrap(cliApiPackage, startVitestExport.key, getCliOrStartVitestWrapper(frameworkVersion))
+  wrapMessagePortOn()
+
+  const vitest = getVitestExport(cliApiPackage)
+  if (vitest) {
+    wrapVitestRunFiles(vitest.value, frameworkVersion)
+  }
+
+  const forksPoolWorker = getForksPoolWorkerExport(cliApiPackage)
+  if (forksPoolWorker) {
+    // function is async
+    shimmer.wrap(forksPoolWorker.value.prototype, 'start', start => function (...args) {
+      vitestPool = 'child_process'
+      this.env = getVitestWorkerEnv(this.env, isVitestNoWorkerInitActive)
+
+      return start.apply(this, args)
+    })
+    shimmer.wrap(forksPoolWorker.value.prototype, 'on', getWrappedOn)
+  }
+
+  const threadsPoolWorker = getThreadsPoolWorkerExport(cliApiPackage)
+  if (threadsPoolWorker) {
+    // function is async
+    shimmer.wrap(threadsPoolWorker.value.prototype, 'start', start => function (...args) {
+      vitestPool = 'worker_threads'
+      this.env = getVitestWorkerEnv(this.env, isVitestNoWorkerInitActive)
+      return start.apply(this, args)
+    })
+    shimmer.wrap(threadsPoolWorker.value.prototype, 'on', getWrappedOn)
+  }
+  return cliApiPackage
+}
+
+addHook({
+  name: 'tinypool',
+  // version from tinypool@0.8 was used in vitest@1.6.0
+  versions: ['>=0.8.0'],
+}, (TinyPool) => {
+  return wrapTinyPool(TinyPool)
+})
+
+// There are multiple index* files across different versions of vitest,
+// so we check for the existence of BaseSequencer to determine if we are in the right file
+addHook({
+  name: 'vitest',
+  versions: ['>=1.6.0 <2.0.0'],
+  filePattern: 'dist/vendor/index.*',
+}, (vitestPackage) => {
+  if (isReporterPackage(vitestPackage)) {
+    shimmer.wrap(vitestPackage.B.prototype, 'sort', getSortWrapper)
+  }
+
+  return vitestPackage
+})
+
+addHook({
+  name: 'vitest',
+  versions: ['>=2.0.0 <2.0.5'],
+  filePattern: 'dist/vendor/index.*',
+}, (vitestPackage) => {
+  if (isReporterPackageNew(vitestPackage)) {
+    shimmer.wrap(vitestPackage.e.prototype, 'sort', getSortWrapper)
+  }
+
+  return vitestPackage
+})
+
+addHook({
+  name: 'vitest',
+  versions: ['>=2.0.5 <2.1.0'],
+  filePattern: 'dist/chunks/index.*',
+}, (vitestPackage) => {
+  if (isReporterPackageNewest(vitestPackage)) {
+    shimmer.wrap(vitestPackage.h.prototype, 'sort', getSortWrapper)
+  }
+
+  return vitestPackage
+})
+
+addHook({
+  name: 'vitest',
+  versions: ['>=3.2.0 <4.0.0'],
+  filePattern: 'dist/chunks/typechecker.*',
+}, getTypecheckerWrapper)
+
+addHook({
+  name: 'vitest',
+  versions: ['>=4.0.0'],
+  filePattern: 'dist/chunks/index.*',
+}, getTypecheckerWrapper)
+
+addHook({
+  name: 'vitest',
+  versions: ['>=2.1.0 <3.0.0'],
+  filePattern: 'dist/chunks/RandomSequencer.*',
+}, (randomSequencerPackage) => {
+  shimmer.wrap(randomSequencerPackage.B.prototype, 'sort', getSortWrapper)
+  return randomSequencerPackage
+})
+
+addHook({
+  name: 'vitest',
+  versions: ['>=3.0.9'],
+  filePattern: 'dist/chunks/coverage.*',
+}, (coveragePackage) => {
+  const baseSequencer = getBaseSequencerExport(coveragePackage)
+  if (baseSequencer) {
+    shimmer.wrap(baseSequencer.value.prototype, 'sort', getSortWrapper)
+  }
+  return coveragePackage
+})
+
+addHook({
+  name: 'vitest',
+  versions: ['>=3.0.0 <3.0.9'],
+  filePattern: 'dist/chunks/resolveConfig.*',
+}, (resolveConfigPackage) => {
+  shimmer.wrap(resolveConfigPackage.B.prototype, 'sort', getSortWrapper)
+  return resolveConfigPackage
+})
+
+// Can't specify file because compiled vitest includes hashes in their files
+// Following 3 wrappers are for test session start
+addHook({
+  name: 'vitest',
+  versions: ['>=1.6.0 <2.0.5'],
+  filePattern: 'dist/vendor/cac.*',
+}, getCreateCliWrapper)
+
+addHook({
+  name: 'vitest',
+  versions: ['>=2.0.5'],
+  filePattern: 'dist/chunks/cac.*',
+}, getCreateCliWrapper)
+
+addHook({
+  name: 'vitest',
+  versions: ['>=1.6.0 <2.0.5'],
+  filePattern: 'dist/vendor/cli-api.*',
+}, getStartVitestWrapper)
+
+addHook({
+  name: 'vitest',
+  versions: ['>=2.0.5'],
+  filePattern: 'dist/chunks/cli-api.*',
+}, getStartVitestWrapper)
diff --git a/packages/datadog-instrumentations/src/vitest-util.js b/packages/datadog-instrumentations/src/vitest-util.js
new file mode 100644
index 0000000000..d061703d8e
--- /dev/null
+++ b/packages/datadog-instrumentations/src/vitest-util.js
@@ -0,0 +1,249 @@
+'use strict'
+
+const log = require('../../dd-trace/src/log')
+const { channel } = require('./helpers/instrument')
+
+// test hooks
+const testStartCh = channel('ci:vitest:test:start')
+const testFinishTimeCh = channel('ci:vitest:test:finish-time')
+const testPassCh = channel('ci:vitest:test:pass')
+const testErrorCh = channel('ci:vitest:test:error')
+const testSkipCh = channel('ci:vitest:test:skip')
+const testFnCh = channel('ci:vitest:test:fn')
+
+// test suite hooks
+const testSuiteStartCh = channel('ci:vitest:test-suite:start')
+const testSuiteFinishCh = channel('ci:vitest:test-suite:finish')
+const testSuiteErrorCh = channel('ci:vitest:test-suite:error')
+
+// test session hooks
+const testSessionStartCh = channel('ci:vitest:session:start')
+const testSessionFinishCh = channel('ci:vitest:session:finish')
+const testSessionConfigurationCh = channel('ci:vitest:session:configuration')
+const libraryConfigurationCh = channel('ci:vitest:library-configuration')
+const knownTestsCh = channel('ci:vitest:known-tests')
+const isEarlyFlakeDetectionFaultyCh = channel('ci:vitest:is-early-flake-detection-faulty')
+const testManagementTestsCh = channel('ci:vitest:test-management-tests')
+const modifiedFilesCh = channel('ci:vitest:modified-files')
+
+const workerReportTraceCh = channel('ci:vitest:worker-report:trace')
+const workerReportLogsCh = channel('ci:vitest:worker-report:logs')
+const codeCoverageReportCh = channel('ci:vitest:coverage-report')
+
+function findExportByName (pkg, name) {
+  for (const [key, value] of Object.entries(pkg)) {
+    if (value?.name === name) {
+      return { key, value }
+    }
+  }
+}
+
+function getChannelPromise (channelToPublishTo, frameworkVersion, payload) {
+  return new Promise(resolve => {
+    channelToPublishTo.publish({ ...payload, onDone: resolve, frameworkVersion })
+  })
+}
+
+function getTestRunnerExport (testPackage) {
+  return findExportByName(testPackage, 'VitestTestRunner') || findExportByName(testPackage, 'TestRunner')
+}
+
+function getTypeTasks (fileTasks, type = 'test') {
+  const typeTasks = []
+
+  function getTasks (tasks) {
+    for (const task of tasks) {
+      if (task.type === type) {
+        typeTasks.push(task)
+      } else if (task.tasks) {
+        getTasks(task.tasks)
+      }
+    }
+  }
+
+  getTasks(fileTasks)
+
+  return typeTasks
+}
+
+function getTestName (task) {
+  let testName = task.name
+  let currentTask = task.suite
+
+  while (currentTask) {
+    if (currentTask.name) {
+      testName = `${currentTask.name} ${testName}`
+    }
+    currentTask = currentTask.suite
+  }
+
+  return testName
+}
+
+function getWorkspaceProject (ctx) {
+  return ctx.getCoreWorkspaceProject
+    ? ctx.getCoreWorkspaceProject()
+    : ctx.getRootProject()
+}
+
+function setProvidedContext (ctx, values, warningMessage) {
+  try {
+    Object.assign(getWorkspaceProject(ctx)._provided, values)
+  } catch {
+    log.warn(warningMessage)
+  }
+}
+
+function getProvidedContext () {
+  try {
+    const {
+      _ddIsEarlyFlakeDetectionEnabled,
+      _ddIsDiEnabled,
+      _ddTestPropertiesByFilepath: testPropertiesByFilepath,
+      _ddEarlyFlakeDetectionNumRetries: numRepeats,
+      _ddEarlyFlakeDetectionSlowTestRetries: slowTestRetries,
+      _ddIsKnownTestsEnabled: isKnownTestsEnabled,
+      _ddIsTestManagementTestsEnabled: isTestManagementTestsEnabled,
+      _ddTestManagementAttemptToFixRetries: testManagementAttemptToFixRetries,
+      _ddIsFlakyTestRetriesEnabled: isFlakyTestRetriesEnabled,
+      _ddFlakyTestRetriesCount: flakyTestRetriesCount,
+      _ddFlakyTestRetriesIncludesUnnamedProject: flakyTestRetriesIncludesUnnamedProject,
+      _ddFlakyTestRetriesProjectNames: flakyTestRetriesProjectNames,
+      _ddIsImpactedTestsEnabled: isImpactedTestsEnabled,
+      _ddTestSessionId: testSessionId,
+      _ddTestModuleId: testModuleId,
+      _ddTestCommand: testCommand,
+      _ddRepositoryRoot: repositoryRoot,
+      _ddCodeOwnersEntries: codeOwnersEntries,
+    } = globalThis.__vitest_worker__.providedContext
+
+    return {
+      isDiEnabled: _ddIsDiEnabled,
+      isEarlyFlakeDetectionEnabled: _ddIsEarlyFlakeDetectionEnabled,
+      testPropertiesByFilepath,
+      numRepeats,
+      slowTestRetries: slowTestRetries ?? {},
+      isKnownTestsEnabled,
+      isTestManagementTestsEnabled,
+      testManagementAttemptToFixRetries,
+      isFlakyTestRetriesEnabled,
+      flakyTestRetriesCount: flakyTestRetriesCount ?? 0,
+      flakyTestRetriesIncludesUnnamedProject,
+      flakyTestRetriesProjectNames,
+      isImpactedTestsEnabled,
+      testSessionId,
+      testModuleId,
+      testCommand,
+      repositoryRoot,
+      codeOwnersEntries,
+    }
+  } catch {
+    log.error('Vitest workers could not parse provided context, so some features will not work.')
+    return {
+      isDiEnabled: false,
+      isEarlyFlakeDetectionEnabled: false,
+      testPropertiesByFilepath: {},
+      numRepeats: 0,
+      slowTestRetries: {},
+      isKnownTestsEnabled: false,
+      isTestManagementTestsEnabled: false,
+      testManagementAttemptToFixRetries: 0,
+      isFlakyTestRetriesEnabled: false,
+      flakyTestRetriesCount: 0,
+      flakyTestRetriesIncludesUnnamedProject: false,
+      flakyTestRetriesProjectNames: undefined,
+      isImpactedTestsEnabled: false,
+      testSessionId: undefined,
+      testModuleId: undefined,
+      testCommand: undefined,
+      repositoryRoot: undefined,
+      codeOwnersEntries: undefined,
+    }
+  }
+}
+
+function isFlakyTestRetriesEnabledForTask (providedContext, task) {
+  if (!providedContext.isFlakyTestRetriesEnabled) return false
+
+  const { flakyTestRetriesProjectNames } = providedContext
+  if (!Array.isArray(flakyTestRetriesProjectNames)) return true
+
+  const projectName = task.file?.projectName
+  if (!projectName) {
+    return providedContext.flakyTestRetriesIncludesUnnamedProject === true
+  }
+
+  return flakyTestRetriesProjectNames.includes(projectName)
+}
+
+/**
+ * Return the main-prepared Test Optimization metadata for a Vitest test.
+ *
+ * @param {{ testPropertiesByFilepath?: Record<string, {
+ *   testSuite?: string,
+ *   knownTests?: string[],
+ *   testManagementTests?: Record<string, {
+ *     isAttemptToFix?: boolean,
+ *     isDisabled?: boolean,
+ *     isQuarantined?: boolean
+ *   }>,
+ *   isModified?: boolean
+ * }> }} providedContext
+ * @param {string} testSuiteAbsolutePath
+ * @param {string} testName
+ * @returns {{
+ *   testSuite?: string,
+ *   isNew: boolean,
+ *   isModified: boolean,
+ *   isAttemptToFix?: boolean,
+ *   isDisabled?: boolean,
+ *   isQuarantined?: boolean
+ * }}
+ */
+function getVitestTestProperties (providedContext, testSuiteAbsolutePath, testName) {
+  const testProperties = providedContext.testPropertiesByFilepath?.[testSuiteAbsolutePath]
+  const knownTests = testProperties?.knownTests
+  const testManagementProperties = testProperties?.testManagementTests?.[testName] || {}
+
+  return {
+    testSuite: testProperties?.testSuite,
+    isNew: Array.isArray(knownTests) ? !knownTests.includes(testName) : false,
+    isModified: testProperties?.isModified === true,
+    isAttemptToFix: testManagementProperties.isAttemptToFix,
+    isDisabled: testManagementProperties.isDisabled,
+    isQuarantined: testManagementProperties.isQuarantined,
+  }
+}
+
+module.exports = {
+  testStartCh,
+  testFinishTimeCh,
+  testPassCh,
+  testErrorCh,
+  testSkipCh,
+  testFnCh,
+  testSuiteStartCh,
+  testSuiteFinishCh,
+  testSuiteErrorCh,
+  testSessionStartCh,
+  testSessionFinishCh,
+  testSessionConfigurationCh,
+  libraryConfigurationCh,
+  knownTestsCh,
+  isEarlyFlakeDetectionFaultyCh,
+  testManagementTestsCh,
+  modifiedFilesCh,
+  workerReportTraceCh,
+  workerReportLogsCh,
+  codeCoverageReportCh,
+  findExportByName,
+  getChannelPromise,
+  getTestRunnerExport,
+  getTypeTasks,
+  getTestName,
+  getWorkspaceProject,
+  setProvidedContext,
+  getProvidedContext,
+  isFlakyTestRetriesEnabledForTask,
+  getVitestTestProperties,
+}
diff --git a/packages/datadog-instrumentations/src/vitest-worker.js b/packages/datadog-instrumentations/src/vitest-worker.js
new file mode 100644
index 0000000000..ee93561c51
--- /dev/null
+++ b/packages/datadog-instrumentations/src/vitest-worker.js
@@ -0,0 +1,753 @@
+'use strict'
+
+// Capture real timers at module load time, before any test can install fake timers.
+const realSetTimeout = setTimeout
+
+const { performance } = require('node:perf_hooks')
+
+const shimmer = require('../../datadog-shimmer')
+const {
+  DYNAMIC_NAME_RE,
+  getEfdRetryCount,
+  recordAttemptToFixExecution,
+  logAttemptToFixTestExecution,
+} = require('../../dd-trace/src/plugins/util/test')
+const { addHook } = require('./helpers/instrument')
+const {
+  testStartCh,
+  testFinishTimeCh,
+  testPassCh,
+  testErrorCh,
+  testSkipCh,
+  testFnCh,
+  testSuiteStartCh,
+  testSuiteFinishCh,
+  testSuiteErrorCh,
+  findExportByName,
+  getTestRunnerExport,
+  getTypeTasks,
+  getTestName,
+  getProvidedContext,
+  isFlakyTestRetriesEnabledForTask,
+  getVitestTestProperties,
+} = require('./vitest-util')
+
+const BREAKPOINT_HIT_GRACE_PERIOD_MS = 400
+
+const taskToCtx = new WeakMap()
+const taskToTestProperties = new WeakMap()
+const taskToStatuses = new WeakMap()
+const taskToReportedErrorCount = new WeakMap()
+const attemptToFixTaskToStatuses = new WeakMap()
+const originalHookFns = new WeakMap()
+const newTasks = new WeakSet()
+const dynamicNameTasks = new WeakSet()
+const disabledTasks = new WeakSet()
+const quarantinedTasks = new WeakSet()
+const attemptToFixTasks = new WeakSet()
+const modifiedTasks = new WeakSet()
+const efdDeterminedRetries = new WeakMap()
+const efdSlowAbortedTasks = new WeakSet()
+const efdExecutionStartByTask = new WeakMap()
+const efdSkippedRetryResults = new WeakMap()
+const attemptToFixExecutions = new Map()
+const loggedAttemptToFixTests = new Set()
+let isRetryReasonEfd = false
+let isRetryReasonAttemptToFix = false
+const switchedStatuses = new WeakSet()
+let vitestGetFn = null
+let vitestSetFn = null
+let vitestGetHooks = null
+
+function waitForHitProbe () {
+  return new Promise(resolve => {
+    realSetTimeout(() => {
+      resolve()
+    }, BREAKPOINT_HIT_GRACE_PERIOD_MS)
+  })
+}
+
+function getVitestTestStatus (test, retryCount) {
+  if (test.result.state !== 'fail' && (!test.repeats || (test.retry ?? 0) === retryCount)) {
+    return 'pass'
+  }
+  return 'fail'
+}
+
+function getFinalAttemptToFixStatus (task, state, isSwitchedStatus, testCtx) {
+  if (isSwitchedStatus && attemptToFixTasks.has(task) && testCtx?.status) {
+    return testCtx.status
+  }
+
+  return state === 'fail' ? 'fail' : 'pass'
+}
+
+/**
+ * Return the normalized test suite path prepared by the main process for a Vitest task.
+ *
+ * @param {{ file: { filepath: string } }} task
+ * @returns {string}
+ */
+function getTaskTestSuite (task) {
+  return taskToTestProperties.get(task)?.testSuite || task.file.filepath
+}
+
+function recordFinalAttemptToFixExecution (task, status, providedContext) {
+  const statuses = attemptToFixTaskToStatuses.get(task)
+  if (statuses && statuses.length <= providedContext.testManagementAttemptToFixRetries) {
+    statuses.push(status)
+  }
+
+  recordAttemptToFixExecution(attemptToFixExecutions, {
+    testSuite: getTaskTestSuite(task),
+    testName: getTestName(task),
+    status,
+    isDisabled: disabledTasks.has(task),
+    isQuarantined: quarantinedTasks.has(task),
+  })
+}
+
+function disableFrameworkRetries (task) {
+  task.retry = 0
+}
+
+function getCurrentAttemptTestError (task, errors) {
+  if (!errors?.length) return
+
+  const previousErrorCount = taskToReportedErrorCount.get(task) ?? 0
+  const testError = errors[previousErrorCount] ?? errors[0]
+  taskToReportedErrorCount.set(task, errors.length)
+  return testError
+}
+
+function wrapTestScopedFn (task, fn) {
+  return shimmer.wrapFunction(fn, fn => function (...args) {
+    return testFnCh.runStores(taskToCtx.get(task), () => fn.apply(this, args))
+  })
+}
+
+function wrapBeforeEachCleanupResult (task, result) {
+  if (typeof result === 'function') {
+    return wrapTestScopedFn(task, result)
+  }
+
+  if (result && typeof result.then === 'function') {
+    return result.then(cleanupFn => wrapBeforeEachCleanupResult(task, cleanupFn))
+  }
+
+  return result
+}
+
+function wrapVitestTestRunner (VitestTestRunner) {
+  // `onBeforeRunTask` is run before any repetition or attempt is run
+  // `onBeforeRunTask` is an async function
+  shimmer.wrap(VitestTestRunner.prototype, 'onBeforeRunTask', onBeforeRunTask => function (task) {
+    const testName = getTestName(task)
+
+    const providedContext = getProvidedContext()
+    const {
+      isEarlyFlakeDetectionEnabled,
+      isKnownTestsEnabled,
+      numRepeats,
+      isTestManagementTestsEnabled,
+      testManagementAttemptToFixRetries,
+      isImpactedTestsEnabled,
+    } = providedContext
+    const testProperties = getVitestTestProperties(providedContext, task.file.filepath, testName)
+    taskToTestProperties.set(task, testProperties)
+
+    if (isTestManagementTestsEnabled) {
+      const {
+        isAttemptToFix,
+        isDisabled,
+        isQuarantined,
+      } = testProperties
+      if (isAttemptToFix) {
+        isRetryReasonAttemptToFix = task.repeats !== testManagementAttemptToFixRetries
+        disableFrameworkRetries(task)
+        task.repeats = testManagementAttemptToFixRetries
+        attemptToFixTasks.add(task)
+        attemptToFixTaskToStatuses.set(task, [])
+      }
+      if (isQuarantined) {
+        quarantinedTasks.add(task)
+      }
+      if (isDisabled) {
+        disabledTasks.add(task)
+        if (!attemptToFixTasks.has(task)) {
+          // we only actually skip if the test is not being attempted to be fixed
+          task.mode = 'skip'
+        }
+      }
+    }
+
+    if (isImpactedTestsEnabled && testProperties.isModified) {
+      if (isEarlyFlakeDetectionEnabled) {
+        isRetryReasonEfd = true
+        disableFrameworkRetries(task)
+        task.repeats = numRepeats
+      }
+      modifiedTasks.add(task)
+      taskToStatuses.set(task, [])
+    }
+
+    if (isKnownTestsEnabled && testProperties.isNew && !attemptToFixTasks.has(task)) {
+      if (isEarlyFlakeDetectionEnabled && !modifiedTasks.has(task)) {
+        isRetryReasonEfd = true
+        disableFrameworkRetries(task)
+        task.repeats = numRepeats
+      }
+      newTasks.add(task)
+      taskToStatuses.set(task, [])
+      if (DYNAMIC_NAME_RE.test(testName)) {
+        dynamicNameTasks.add(task)
+      }
+    }
+
+    return onBeforeRunTask.apply(this, arguments)
+  })
+
+  // `onAfterRunTask` is run after all repetitions or attempts are run
+  // `onAfterRunTask` is an async function
+  shimmer.wrap(VitestTestRunner.prototype, 'onAfterRunTask', onAfterRunTask => function (task) {
+    const { isEarlyFlakeDetectionEnabled, isTestManagementTestsEnabled } = getProvidedContext()
+
+    if (isTestManagementTestsEnabled) {
+      const isAttemptingToFix = attemptToFixTasks.has(task)
+      const isQuarantined = quarantinedTasks.has(task)
+
+      if (isAttemptingToFix) {
+        const statuses = attemptToFixTaskToStatuses.get(task)
+        if (task.result.state === 'pass' && statuses?.includes('fail')) {
+          switchedStatuses.add(task)
+          task.result.state = 'fail'
+        }
+      }
+
+      if (!isAttemptingToFix && isQuarantined) {
+        if (task.result.state === 'fail') {
+          switchedStatuses.add(task)
+        }
+        task.result.state = 'pass'
+      }
+    }
+
+    if (isEarlyFlakeDetectionEnabled && taskToStatuses.has(task) && !attemptToFixTasks.has(task)) {
+      const statuses = taskToStatuses.get(task)
+      // If the test has passed at least once, we consider it passed
+      if (statuses.includes('pass')) {
+        if (task.result.state === 'fail') {
+          switchedStatuses.add(task)
+        }
+        task.result.state = 'pass'
+      }
+    }
+
+    return onAfterRunTask.apply(this, arguments)
+  })
+
+  // test start (only tests that are not marked as skip or todo)
+  // `onBeforeTryTask` is run for every repetition and attempt of the test
+  shimmer.wrap(VitestTestRunner.prototype, 'onBeforeTryTask', onBeforeTryTask => async function (task, retryInfo) {
+    if (!testPassCh.hasSubscribers && !testErrorCh.hasSubscribers && !testSkipCh.hasSubscribers) {
+      return onBeforeTryTask.apply(this, arguments)
+    }
+    const testName = getTestName(task)
+    let isNew = false
+    const providedContext = getProvidedContext()
+    const {
+      isKnownTestsEnabled,
+      isEarlyFlakeDetectionEnabled,
+      isDiEnabled,
+      slowTestRetries,
+    } = providedContext
+
+    if (isKnownTestsEnabled) {
+      isNew = newTasks.has(task)
+    }
+
+    const { retry: numAttempt, repeats: numRepetition } = retryInfo
+    const isEfdManagedTask = isEarlyFlakeDetectionEnabled && taskToStatuses.has(task) && !attemptToFixTasks.has(task)
+
+    if (isEfdManagedTask && numRepetition > 0 && !efdDeterminedRetries.has(task)) {
+      const previousExecutionStart = efdExecutionStartByTask.get(task)
+      const duration = previousExecutionStart === undefined
+        ? task.result?.duration ?? 0
+        : performance.now() - previousExecutionStart
+      const retryCount = getEfdRetryCount(duration, slowTestRetries)
+      efdDeterminedRetries.set(task, retryCount)
+      task.repeats = retryCount
+      if (retryCount === 0) {
+        efdSlowAbortedTasks.add(task)
+      }
+    }
+
+    const efdRetryCount = efdDeterminedRetries.get(task)
+    if (isEfdManagedTask && efdRetryCount !== undefined && numRepetition > efdRetryCount) {
+      if (task.result) {
+        efdSkippedRetryResults.set(task, {
+          ...task.result,
+          errors: task.result.errors?.slice(),
+        })
+      }
+      if (vitestSetFn) {
+        const noop = function () {}
+        noop.__ddTraceWrapped = true
+        vitestSetFn(task, noop)
+      }
+      return onBeforeTryTask.apply(this, arguments)
+    }
+    if (isEfdManagedTask) {
+      efdExecutionStartByTask.set(task, performance.now())
+    }
+
+    // We finish the previous test here because we know it has failed already
+    if (numAttempt > 0) {
+      const shouldWaitForHitProbe = isDiEnabled && numAttempt > 1
+      if (shouldWaitForHitProbe) {
+        await waitForHitProbe()
+      }
+
+      const promises = {}
+      const shouldSetProbe = isDiEnabled && numAttempt === 1
+      const ctx = taskToCtx.get(task)
+      const testError = getCurrentAttemptTestError(task, task.result?.errors)
+      if (ctx) {
+        testErrorCh.publish({
+          error: testError,
+          shouldSetProbe,
+          promises,
+          ...ctx.currentStore,
+        })
+        // We wait for the probe to be set
+        if (promises.setProbePromise) {
+          await promises.setProbePromise
+        }
+      }
+    }
+
+    const lastExecutionStatus = task.result.state
+    const isAtf = attemptToFixTasks.has(task)
+    const shouldTrackStatuses = isEarlyFlakeDetectionEnabled || isAtf
+    const shouldFlipStatus = isEarlyFlakeDetectionEnabled || isAtf
+    const statuses = isAtf ? attemptToFixTaskToStatuses.get(task) : taskToStatuses.get(task)
+
+    // These clauses handle task.repeats, whether EFD is enabled or not
+    // The only thing that EFD does is to forcefully pass the test if it has passed at least once
+    if (numRepetition > 0 && numRepetition < task.repeats) { // it may or may have not failed
+      // Here we finish the earlier iteration,
+      // as long as it's not the _last_ iteration (which will be finished normally)
+
+      const ctx = taskToCtx.get(task)
+      if (ctx) {
+        if (lastExecutionStatus === 'fail') {
+          const testError = getCurrentAttemptTestError(task, task.result?.errors)
+          testErrorCh.publish({ error: testError, ...ctx.currentStore })
+        } else {
+          testPassCh.publish({ task, ...ctx.currentStore })
+        }
+        if (shouldTrackStatuses && statuses) {
+          statuses.push(lastExecutionStatus)
+        }
+        if (shouldFlipStatus) {
+          // If we don't "reset" the result.state to "pass", once a repetition fails,
+          // vitest will always consider the test as failed, so we can't read the actual status
+          // This means that we change vitest's behavior:
+          // if the last attempt passes, vitest would consider the test as failed
+          // but after this change, it will consider the test as passed
+          task.result.state = 'pass'
+        }
+      }
+    } else if (numRepetition === task.repeats) {
+      if (shouldTrackStatuses && statuses) {
+        statuses.push(lastExecutionStatus)
+      }
+
+      const ctx = taskToCtx.get(task)
+      if (lastExecutionStatus === 'fail') {
+        const testError = getCurrentAttemptTestError(task, task.result?.errors)
+        testErrorCh.publish({ error: testError, ...ctx.currentStore })
+      } else {
+        testPassCh.publish({ task, ...ctx.currentStore })
+      }
+      if (shouldFlipStatus) {
+        task.result.state = 'pass'
+      }
+    }
+
+    const isRetryReasonAtr = numAttempt > 0 &&
+      isFlakyTestRetriesEnabledForTask(providedContext, task) &&
+      !isRetryReasonAttemptToFix &&
+      !isRetryReasonEfd
+
+    const ctx = {
+      testName,
+      testSuiteAbsolutePath: task.file.filepath,
+      isRetry: numAttempt > 0 || numRepetition > 0,
+      isRetryReasonEfd,
+      isRetryReasonAttemptToFix: isRetryReasonAttemptToFix && numRepetition > 0,
+      isNew,
+      hasDynamicName: dynamicNameTasks.has(task),
+      mightHitProbe: isDiEnabled && numAttempt > 0,
+      isAttemptToFix: attemptToFixTasks.has(task),
+      isDisabled: disabledTasks.has(task),
+      isQuarantined: quarantinedTasks.has(task),
+      isRetryReasonAtr,
+      isModified: modifiedTasks.has(task),
+    }
+    taskToCtx.set(task, ctx)
+
+    if (attemptToFixTasks.has(task)) {
+      logAttemptToFixTestExecution(
+        getTaskTestSuite(task),
+        testName,
+        loggedAttemptToFixTests
+      )
+    }
+
+    testStartCh.runStores(ctx, () => {})
+
+    // Wrap the test function so it runs inside the test span context.
+    // Without this, HTTP requests during test execution become orphaned root spans.
+    if (vitestGetFn && vitestSetFn) {
+      const originalFn = vitestGetFn(task)
+      if (originalFn && !originalFn.__ddTraceWrapped) {
+        const wrappedFn = wrapTestScopedFn(task, originalFn)
+        wrappedFn.__ddTraceWrapped = true
+        vitestSetFn(task, wrappedFn)
+      }
+    }
+
+    // Wrap beforeEach/afterEach hooks so they also run inside the test span context.
+    // In vitest 4+, hooks are in a WeakMap accessed via getHooks(). In older versions, they're on suite.hooks.
+    let currentSuite = task.suite
+    while (currentSuite) {
+      const hooks = vitestGetHooks ? vitestGetHooks(currentSuite) : currentSuite.hooks
+      if (hooks) {
+        for (const hookType of ['beforeEach', 'afterEach']) {
+          const hookArray = hooks[hookType]
+          if (!hookArray) continue
+          for (let i = 0; i < hookArray.length; i++) {
+            const currentFn = hookArray[i]
+            const originalFn = originalHookFns.get(currentFn) || currentFn
+            const wrappedFn = shimmer.wrapFunction(originalFn, fn => function (...args) {
+              const result = testFnCh.runStores(taskToCtx.get(task), () => fn.apply(this, args))
+
+              if (hookType === 'beforeEach') {
+                return wrapBeforeEachCleanupResult(task, result)
+              }
+
+              return result
+            })
+            originalHookFns.set(wrappedFn, originalFn)
+            hookArray[i] = wrappedFn
+          }
+        }
+      }
+      currentSuite = currentSuite.suite
+    }
+
+    return onBeforeTryTask.apply(this, arguments)
+  })
+
+  // test finish (only passed tests)
+  shimmer.wrap(VitestTestRunner.prototype, 'onAfterTryTask', onAfterTryTask =>
+    async function (task, retryInfo) {
+      if (!testPassCh.hasSubscribers && !testErrorCh.hasSubscribers && !testSkipCh.hasSubscribers) {
+        return onAfterTryTask.apply(this, arguments)
+      }
+      const result = await onAfterTryTask.apply(this, arguments)
+
+      const {
+        isEarlyFlakeDetectionEnabled,
+        testManagementAttemptToFixRetries,
+        slowTestRetries,
+      } = getProvidedContext()
+
+      const status = getVitestTestStatus(task, retryInfo.retry)
+      const ctx = taskToCtx.get(task)
+
+      const { isDiEnabled } = getProvidedContext()
+
+      if (efdSkippedRetryResults.has(task)) {
+        task.result = efdSkippedRetryResults.get(task)
+        efdSkippedRetryResults.delete(task)
+        return result
+      }
+
+      if (isDiEnabled && retryInfo.retry > 1) {
+        await waitForHitProbe()
+      }
+
+      if (
+        isEarlyFlakeDetectionEnabled &&
+        (retryInfo.repeats ?? 0) === 0 &&
+        taskToStatuses.has(task) &&
+        !attemptToFixTasks.has(task) &&
+        !efdDeterminedRetries.has(task)
+      ) {
+        const executionStart = efdExecutionStartByTask.get(task)
+        const duration = executionStart === undefined ? task.result?.duration ?? 0 : performance.now() - executionStart
+        const retryCount = getEfdRetryCount(duration, slowTestRetries)
+        efdDeterminedRetries.set(task, retryCount)
+        task.repeats = retryCount
+        if (retryCount === 0) {
+          efdSlowAbortedTasks.add(task)
+        }
+      }
+
+      let attemptToFixPassed = false
+      let attemptToFixFailed = false
+      if (attemptToFixTasks.has(task)) {
+        const statuses = attemptToFixTaskToStatuses.get(task)
+        if (statuses.length === testManagementAttemptToFixRetries) {
+          if (status === 'pass' && statuses.every(status => status === 'pass')) {
+            attemptToFixPassed = true
+          } else if (status === 'fail' || statuses.includes('fail')) {
+            attemptToFixFailed = true
+          }
+        }
+      }
+
+      if (ctx) {
+        // We don't finish here because the test might fail in a later hook (afterEach)
+        ctx.status = status
+        ctx.task = task
+        ctx.attemptToFixPassed = attemptToFixPassed
+        ctx.attemptToFixFailed = attemptToFixFailed
+        testFinishTimeCh.runStores(ctx, () => {})
+      }
+
+      return result
+    })
+}
+
+function captureRunnerFunctions (pkg) {
+  if (vitestGetFn) return
+  const getFnExport = findExportByName(pkg, 'getFn')
+  const setFnExport = findExportByName(pkg, 'setFn')
+  if (getFnExport && setFnExport) {
+    vitestGetFn = getFnExport.value
+    vitestSetFn = setFnExport.value
+  }
+  const getHooksExport = findExportByName(pkg, 'getHooks')
+  if (getHooksExport) {
+    vitestGetHooks = getHooksExport.value
+  }
+}
+
+addHook({
+  name: 'vitest',
+  versions: ['>=4.0.0'],
+  filePattern: 'dist/chunks/test.*',
+}, (testPackage) => {
+  const testRunner = getTestRunnerExport(testPackage)
+  if (!testRunner) {
+    return testPackage
+  }
+
+  captureRunnerFunctions(testPackage)
+  wrapVitestTestRunner(testRunner.value)
+
+  return testPackage
+})
+
+addHook({
+  name: '@vitest/runner',
+  versions: ['>=1.6.0'],
+}, (runnerModule) => {
+  if (!vitestGetFn && runnerModule.getFn && runnerModule.setFn) {
+    vitestGetFn = runnerModule.getFn
+    vitestSetFn = runnerModule.setFn
+  }
+  if (!vitestGetHooks && runnerModule.getHooks) {
+    vitestGetHooks = runnerModule.getHooks
+  }
+  return runnerModule
+})
+
+addHook({
+  name: 'vitest',
+  versions: ['>=1.6.0 <4.0.0'],
+  file: 'dist/runners.js',
+}, (vitestPackage) => {
+  const { VitestTestRunner } = vitestPackage
+
+  wrapVitestTestRunner(VitestTestRunner)
+
+  return vitestPackage
+})
+
+// test suite start and finish
+// only relevant for workers
+addHook({
+  name: '@vitest/runner',
+  versions: ['>=1.6.0'],
+}, (vitestPackage, frameworkVersion) => {
+  shimmer.wrap(vitestPackage, 'startTests', startTests => async function (testPaths) {
+    let testSuiteError = null
+    if (!testSuiteFinishCh.hasSubscribers) {
+      return startTests.apply(this, arguments)
+    }
+    // From >=3.0.1, the first arguments changes from a string to an object containing the filepath
+    const testSuiteAbsolutePath = testPaths[0]?.filepath || testPaths[0]
+    const providedContext = getProvidedContext()
+
+    const testSuiteCtx = {
+      testSuiteAbsolutePath,
+      frameworkVersion,
+      testSessionId: providedContext.testSessionId,
+      testModuleId: providedContext.testModuleId,
+      testCommand: providedContext.testCommand,
+      repositoryRoot: providedContext.repositoryRoot,
+      codeOwnersEntries: providedContext.codeOwnersEntries,
+    }
+    testSuiteStartCh.runStores(testSuiteCtx, () => {})
+    const startTestsResponse = await startTests.apply(this, arguments)
+
+    let onFinish = null
+    const onFinishPromise = new Promise(resolve => {
+      onFinish = resolve
+    })
+
+    const testTasks = getTypeTasks(startTestsResponse[0].tasks)
+
+    // Only one test task per test, even if there are retries
+    for (const task of testTasks) {
+      const testCtx = taskToCtx.get(task)
+      const { result } = task
+      // We have to trick vitest into thinking that the test has passed
+      // but we want to report it as failed if it did fail
+      const isSwitchedStatus = switchedStatuses.has(task)
+
+      if (result) {
+        const { state, duration, errors } = result
+        const testError = getCurrentAttemptTestError(task, errors)
+        if (attemptToFixTasks.has(task)) {
+          const status = getFinalAttemptToFixStatus(task, state, isSwitchedStatus, testCtx)
+          recordFinalAttemptToFixExecution(task, status, providedContext)
+        }
+
+        if (state === 'skip') { // programmatic skip
+          testSkipCh.publish({
+            testName: getTestName(task),
+            testSuiteAbsolutePath: task.file.filepath,
+            isNew: newTasks.has(task),
+            isDisabled: disabledTasks.has(task),
+          })
+        } else if (state === 'pass' && !isSwitchedStatus) {
+          if (testCtx) {
+            const isSkippedByTestManagement =
+              !attemptToFixTasks.has(task) && (disabledTasks.has(task) || quarantinedTasks.has(task))
+            testPassCh.publish({
+              task,
+              finalStatus: isSkippedByTestManagement ? 'skip' : 'pass',
+              earlyFlakeAbortReason: efdSlowAbortedTasks.has(task) ? 'slow' : undefined,
+              ...testCtx.currentStore,
+            })
+          }
+        } else if (state === 'fail' || isSwitchedStatus) {
+          let hasFailedAllRetries = false
+          let attemptToFixFailed = false
+          if (attemptToFixTasks.has(task)) {
+            const statuses = attemptToFixTaskToStatuses.get(task)
+            if (statuses.includes('fail')) {
+              attemptToFixFailed = true
+            }
+            if (statuses.every(status => status === 'fail')) {
+              hasFailedAllRetries = true
+            }
+          }
+
+          // Check if all EFD retries failed
+          const isEfdRetry =
+            providedContext.isEarlyFlakeDetectionEnabled && (newTasks.has(task) || modifiedTasks.has(task))
+          if (isEfdRetry) {
+            const statuses = taskToStatuses.get(task)
+            const efdRetryCount = efdDeterminedRetries.get(task) ?? providedContext.numRepeats
+            // statuses only includes repetitions (not the initial run), so we check against retry count (not +1)
+            if (efdRetryCount > 0 && statuses && statuses.length === efdRetryCount &&
+              statuses.every(status => status === 'fail')) {
+              hasFailedAllRetries = true
+            }
+          }
+
+          // ATR: set hasFailedAllRetries when all auto test retries were exhausted and every attempt failed
+          const isAtrRetry = isFlakyTestRetriesEnabledForTask(providedContext, task) && !attemptToFixTasks.has(task) &&
+            !newTasks.has(task) && !modifiedTasks.has(task)
+          if (isAtrRetry) {
+            const maxRetries = providedContext.flakyTestRetriesCount ?? 0
+            if (maxRetries > 0 && task.result?.retryCount === maxRetries) {
+              hasFailedAllRetries = true
+            }
+          }
+
+          if (testCtx) {
+            const isRetry = task.result?.retryCount > 0
+            // `duration` is the duration of all the retries, so it can't be used if there are retries
+
+            let finalStatus
+            if (isSwitchedStatus) {
+              if (!attemptToFixTasks.has(task) && (disabledTasks.has(task) || quarantinedTasks.has(task))) {
+                finalStatus = 'skip'
+              } else if (isAtrRetry || isEfdRetry) {
+                finalStatus = hasFailedAllRetries ? 'fail' : 'pass'
+              } else if (attemptToFixTasks.has(task)) {
+                finalStatus = attemptToFixFailed ? 'fail' : 'pass'
+              } else {
+                finalStatus = undefined
+              }
+            } else {
+              finalStatus = 'fail'
+            }
+
+            testErrorCh.publish({
+              duration: isRetry ? undefined : duration,
+              error: testError,
+              hasFailedAllRetries,
+              attemptToFixFailed,
+              finalStatus,
+              earlyFlakeAbortReason: efdSlowAbortedTasks.has(task) ? 'slow' : undefined,
+              ...testCtx.currentStore,
+            })
+          }
+          if (errors?.length) {
+            testSuiteError = testError // we store the error to bubble it up to the suite
+          }
+        }
+      } else { // test.skip or test.todo
+        testSkipCh.publish({
+          testName: getTestName(task),
+          testSuiteAbsolutePath: task.file.filepath,
+          isNew: newTasks.has(task),
+          isDisabled: disabledTasks.has(task),
+        })
+      }
+    }
+
+    const testSuiteResult = startTestsResponse[0].result
+
+    if (testSuiteResult.errors?.length) { // Errors from root level hooks
+      testSuiteError = testSuiteResult.errors[0]
+    } else if (testSuiteResult.state === 'fail') { // Errors from `describe` level hooks
+      const suiteTasks = getTypeTasks(startTestsResponse[0].tasks, 'suite')
+      const failedSuites = suiteTasks.filter(task => task.result?.state === 'fail')
+      if (failedSuites.length && failedSuites[0].result?.errors?.length) {
+        testSuiteError = failedSuites[0].result.errors[0]
+      }
+    }
+
+    if (testSuiteError) {
+      testSuiteCtx.error = testSuiteError
+      testSuiteErrorCh.runStores(testSuiteCtx, () => {})
+    }
+
+    testSuiteFinishCh.publish({ status: testSuiteResult.state, onFinish, ...testSuiteCtx.currentStore })
+
+    await onFinishPromise
+
+    return startTestsResponse
+  })
+
+  return vitestPackage
+})
diff --git a/packages/datadog-instrumentations/src/vitest.js b/packages/datadog-instrumentations/src/vitest.js
index b594a81fbb..157773d3b4 100644
--- a/packages/datadog-instrumentations/src/vitest.js
+++ b/packages/datadog-instrumentations/src/vitest.js
@@ -1,1861 +1,17 @@
 'use strict'
 
-// Capture real timers at module load time, before any test can install fake timers.
-const realSetTimeout = setTimeout
+const { getEnvironmentVariable } = require('../../dd-trace/src/config/helper')
+const { isTrue } = require('../../dd-trace/src/util')
 
-const path = require('node:path')
-const { performance } = require('node:perf_hooks')
+const VITEST_NO_WORKER_INIT_ACTIVE_ENV = 'DD_TEST_OPT_VITEST_NO_WORKER_INIT_ACTIVE'
 
-const shimmer = require('../../datadog-shimmer')
-const log = require('../../dd-trace/src/log')
-const {
-  VITEST_WORKER_TRACE_PAYLOAD_CODE,
-  VITEST_WORKER_LOGS_PAYLOAD_CODE,
-  DYNAMIC_NAME_RE,
-  getTestSuitePath,
-  getEfdRetryCount,
-  getMaxEfdRetryCount,
-  recordAttemptToFixExecution,
-  collectTestOptimizationSummariesFromTraces,
-  logAttemptToFixTestExecution,
-  logTestOptimizationSummary,
-  getTestOptimizationRequestResults,
-} = require('../../dd-trace/src/plugins/util/test')
-const { addHook, channel } = require('./helpers/instrument')
+if (getEnvironmentVariable('DD_VITEST_WORKER') === '1') {
+  // In no-worker-init mode the main process reports Vitest events from reporter hooks.
+  // Loading worker instrumentation here would reintroduce the worker tracer path.
+  // eslint-disable-next-line eslint-rules/eslint-process-env
+  if (isTrue(process.env[VITEST_NO_WORKER_INIT_ACTIVE_ENV])) return
 
-// test hooks
-const testStartCh = channel('ci:vitest:test:start')
-const testFinishTimeCh = channel('ci:vitest:test:finish-time')
-const testPassCh = channel('ci:vitest:test:pass')
-const testErrorCh = channel('ci:vitest:test:error')
-const testSkipCh = channel('ci:vitest:test:skip')
-const isNewTestCh = channel('ci:vitest:test:is-new')
-const isAttemptToFixCh = channel('ci:vitest:test:is-attempt-to-fix')
-const isDisabledCh = channel('ci:vitest:test:is-disabled')
-const isQuarantinedCh = channel('ci:vitest:test:is-quarantined')
-const isModifiedCh = channel('ci:vitest:test:is-modified')
-const testFnCh = channel('ci:vitest:test:fn')
-
-// test suite hooks
-const testSuiteStartCh = channel('ci:vitest:test-suite:start')
-const testSuiteFinishCh = channel('ci:vitest:test-suite:finish')
-const testSuiteErrorCh = channel('ci:vitest:test-suite:error')
-
-// test session hooks
-const testSessionStartCh = channel('ci:vitest:session:start')
-const testSessionFinishCh = channel('ci:vitest:session:finish')
-const testSessionConfigurationCh = channel('ci:vitest:session:configuration')
-const libraryConfigurationCh = channel('ci:vitest:library-configuration')
-const knownTestsCh = channel('ci:vitest:known-tests')
-const isEarlyFlakeDetectionFaultyCh = channel('ci:vitest:is-early-flake-detection-faulty')
-const testManagementTestsCh = channel('ci:vitest:test-management-tests')
-const modifiedFilesCh = channel('ci:vitest:modified-files')
-
-const workerReportTraceCh = channel('ci:vitest:worker-report:trace')
-const workerReportLogsCh = channel('ci:vitest:worker-report:logs')
-const codeCoverageReportCh = channel('ci:vitest:coverage-report')
-
-const taskToCtx = new WeakMap()
-const taskToStatuses = new WeakMap()
-const taskToReportedErrorCount = new WeakMap()
-const attemptToFixTaskToStatuses = new WeakMap()
-const originalHookFns = new WeakMap()
-const newTasks = new WeakSet()
-const dynamicNameTasks = new WeakSet()
-const newTestsWithDynamicNames = new Set()
-const disabledTasks = new WeakSet()
-const quarantinedTasks = new WeakSet()
-const attemptToFixTasks = new WeakSet()
-const modifiedTasks = new WeakSet()
-const efdDeterminedRetries = new WeakMap()
-const efdSlowAbortedTasks = new WeakSet()
-const efdExecutionStartByTask = new WeakMap()
-const efdSkippedRetryResults = new WeakMap()
-const attemptToFixExecutions = new Map()
-const loggedAttemptToFixTests = new Set()
-let isRetryReasonEfd = false
-let isRetryReasonAttemptToFix = false
-const switchedStatuses = new WeakSet()
-const workerProcesses = new WeakSet()
-const mainProcessSetupPromises = new WeakMap()
-const coverageWrappedProviders = new WeakSet()
-const finishWrappedContexts = new WeakSet()
-let isFlakyTestRetriesEnabled = false
-let flakyTestRetriesCount = 0
-let isEarlyFlakeDetectionEnabled = false
-let earlyFlakeDetectionNumRetries = 0
-let earlyFlakeDetectionSlowTestRetries = {}
-let isEarlyFlakeDetectionFaulty = false
-let isKnownTestsEnabled = false
-let isTestManagementTestsEnabled = false
-let isImpactedTestsEnabled = false
-let vitestGetFn = null
-let vitestSetFn = null
-let vitestGetHooks = null
-let testManagementAttemptToFixRetries = 0
-let isDiEnabled = false
-let testCodeCoverageLinesTotal
-let coverageRootDir
-let isSessionStarted = false
-let vitestPool = null
-
-const BREAKPOINT_HIT_GRACE_PERIOD_MS = 400
-
-function getConfiguredEfdRetryCount (slowTestRetries, fallbackRetryCount) {
-  if (!slowTestRetries || !Object.keys(slowTestRetries).length) {
-    return fallbackRetryCount
-  }
-  return getMaxEfdRetryCount(slowTestRetries)
-}
-
-function getTestCommand () {
-  return `vitest ${process.argv.slice(2).join(' ')}`
-}
-
-function waitForHitProbe () {
-  return new Promise(resolve => {
-    realSetTimeout(() => {
-      resolve()
-    }, BREAKPOINT_HIT_GRACE_PERIOD_MS)
-  })
-}
-
-function isValidKnownTests (receivedKnownTests) {
-  return !!receivedKnownTests.vitest
-}
-
-function getProvidedContext () {
-  try {
-    const {
-      _ddIsEarlyFlakeDetectionEnabled,
-      _ddIsDiEnabled,
-      _ddKnownTests: knownTests,
-      _ddEarlyFlakeDetectionNumRetries: numRepeats,
-      _ddEarlyFlakeDetectionSlowTestRetries: slowTestRetries,
-      _ddIsKnownTestsEnabled: isKnownTestsEnabled,
-      _ddIsTestManagementTestsEnabled: isTestManagementTestsEnabled,
-      _ddTestManagementAttemptToFixRetries: testManagementAttemptToFixRetries,
-      _ddTestManagementTests: testManagementTests,
-      _ddIsFlakyTestRetriesEnabled: isFlakyTestRetriesEnabled,
-      _ddFlakyTestRetriesCount: flakyTestRetriesCount,
-      _ddFlakyTestRetriesIncludesUnnamedProject: flakyTestRetriesIncludesUnnamedProject,
-      _ddFlakyTestRetriesProjectNames: flakyTestRetriesProjectNames,
-      _ddIsImpactedTestsEnabled: isImpactedTestsEnabled,
-      _ddModifiedFiles: modifiedFiles,
-      _ddTestSessionId: testSessionId,
-      _ddTestModuleId: testModuleId,
-      _ddTestCommand: testCommand,
-      _ddRepositoryRoot: repositoryRoot,
-      _ddCodeOwnersEntries: codeOwnersEntries,
-    } = globalThis.__vitest_worker__.providedContext
-
-    return {
-      isDiEnabled: _ddIsDiEnabled,
-      isEarlyFlakeDetectionEnabled: _ddIsEarlyFlakeDetectionEnabled,
-      knownTests,
-      numRepeats,
-      slowTestRetries: slowTestRetries ?? {},
-      isKnownTestsEnabled,
-      isTestManagementTestsEnabled,
-      testManagementAttemptToFixRetries,
-      testManagementTests,
-      isFlakyTestRetriesEnabled,
-      flakyTestRetriesCount: flakyTestRetriesCount ?? 0,
-      flakyTestRetriesIncludesUnnamedProject,
-      flakyTestRetriesProjectNames,
-      isImpactedTestsEnabled,
-      modifiedFiles,
-      testSessionId,
-      testModuleId,
-      testCommand,
-      repositoryRoot,
-      codeOwnersEntries,
-    }
-  } catch {
-    log.error('Vitest workers could not parse provided context, so some features will not work.')
-    return {
-      isDiEnabled: false,
-      isEarlyFlakeDetectionEnabled: false,
-      knownTests: {},
-      numRepeats: 0,
-      slowTestRetries: {},
-      isKnownTestsEnabled: false,
-      isTestManagementTestsEnabled: false,
-      testManagementAttemptToFixRetries: 0,
-      testManagementTests: {},
-      isFlakyTestRetriesEnabled: false,
-      flakyTestRetriesCount: 0,
-      flakyTestRetriesIncludesUnnamedProject: false,
-      flakyTestRetriesProjectNames: undefined,
-      isImpactedTestsEnabled: false,
-      modifiedFiles: {},
-      testSessionId: undefined,
-      testModuleId: undefined,
-      testCommand: undefined,
-      repositoryRoot: undefined,
-      codeOwnersEntries: undefined,
-    }
-  }
-}
-
-function isReporterPackage (vitestPackage) {
-  return vitestPackage.B?.name === 'BaseSequencer'
-}
-
-// from 2.0.0
-function isReporterPackageNew (vitestPackage) {
-  return vitestPackage.e?.name === 'BaseSequencer'
-}
-
-function isReporterPackageNewest (vitestPackage) {
-  return vitestPackage.h?.name === 'BaseSequencer'
-}
-
-/**
- * Finds an export by its `.name` property in a minified vitest chunk.
- * Minified export keys change across versions, so we search by function/class name.
- * @param {object} pkg - The module exports object
- * @param {string} name - The `.name` value to look for
- * @returns {{ key: string, value: Function } | undefined}
- */
-function findExportByName (pkg, name) {
-  for (const [key, value] of Object.entries(pkg)) {
-    if (value?.name === name) {
-      return { key, value }
-    }
-  }
-}
-
-function getBaseSequencerExport (vitestPackage) {
-  return findExportByName(vitestPackage, 'BaseSequencer')
-}
-
-function getChannelPromise (channelToPublishTo, frameworkVersion) {
-  return new Promise(resolve => {
-    channelToPublishTo.publish({ onDone: resolve, frameworkVersion })
-  })
-}
-
-function isCliApiPackage (vitestPackage) {
-  return !!findExportByName(vitestPackage, 'startVitest')
-}
-
-function getTestRunnerExport (testPackage) {
-  return findExportByName(testPackage, 'VitestTestRunner') || findExportByName(testPackage, 'TestRunner')
-}
-
-function getVitestExport (vitestPackage) {
-  return findExportByName(vitestPackage, 'Vitest')
-}
-
-function getForksPoolWorkerExport (vitestPackage) {
-  return findExportByName(vitestPackage, 'ForksPoolWorker')
+  require('./vitest-worker')
+} else {
+  require('./vitest-main')
 }
-
-function getThreadsPoolWorkerExport (vitestPackage) {
-  return findExportByName(vitestPackage, 'ThreadsPoolWorker')
-}
-
-function getSessionStatus (state) {
-  if (state.getCountOfFailedTests() > 0) {
-    return 'fail'
-  }
-  if (state.pathsSet.size === 0) {
-    return 'skip'
-  }
-  return 'pass'
-}
-
-// From https://github.com/vitest-dev/vitest/blob/51c04e2f44d91322b334f8ccbcdb368facc3f8ec/packages/runner/src/run.ts#L243-L250
-function getVitestTestStatus (test, retryCount) {
-  if (test.result.state !== 'fail' && (!test.repeats || (test.retry ?? 0) === retryCount)) {
-    return 'pass'
-  }
-  return 'fail'
-}
-
-function getTypeTasks (fileTasks, type = 'test') {
-  const typeTasks = []
-
-  function getTasks (tasks) {
-    for (const task of tasks) {
-      if (task.type === type) {
-        typeTasks.push(task)
-      } else if (task.tasks) {
-        getTasks(task.tasks)
-      }
-    }
-  }
-
-  getTasks(fileTasks)
-
-  return typeTasks
-}
-
-function getTestName (task) {
-  let testName = task.name
-  let currentTask = task.suite
-
-  while (currentTask) {
-    if (currentTask.name) {
-      testName = `${currentTask.name} ${testName}`
-    }
-    currentTask = currentTask.suite
-  }
-
-  return testName
-}
-
-function getFinalAttemptToFixStatus (task, state, isSwitchedStatus, testCtx) {
-  if (isSwitchedStatus && attemptToFixTasks.has(task) && testCtx?.status) {
-    return testCtx.status
-  }
-
-  return state === 'fail' ? 'fail' : 'pass'
-}
-
-function recordFinalAttemptToFixExecution (task, status, providedContext) {
-  const statuses = attemptToFixTaskToStatuses.get(task)
-  if (statuses && statuses.length <= providedContext.testManagementAttemptToFixRetries) {
-    statuses.push(status)
-  }
-
-  recordAttemptToFixExecution(attemptToFixExecutions, {
-    testSuite: getTestSuitePath(task.file.filepath, process.cwd()),
-    testName: getTestName(task),
-    status,
-    isDisabled: disabledTasks.has(task),
-    isQuarantined: quarantinedTasks.has(task),
-  })
-}
-
-function disableFrameworkRetries (task) {
-  task.retry = 0
-}
-
-/**
- * Vitest accumulates retry and repeat errors on one task result. The first error added since
- * the last reported attempt is the primary error for the failed attempt currently being reported.
- *
- * @param {object} task
- * @param {Array<object> | undefined} errors
- * @returns {object | undefined}
- */
-function getCurrentAttemptTestError (task, errors) {
-  if (!errors?.length) return
-
-  const previousErrorCount = taskToReportedErrorCount.get(task) ?? 0
-  const testError = errors[previousErrorCount] ?? errors[0]
-  taskToReportedErrorCount.set(task, errors.length)
-  return testError
-}
-
-/**
- * Wraps a function so it runs inside the current test span context.
- * @param {object} task
- * @param {Function} fn
- * @returns {Function}
- */
-function wrapTestScopedFn (task, fn) {
-  return shimmer.wrapFunction(fn, fn => function (...args) {
-    return testFnCh.runStores(taskToCtx.get(task), () => fn.apply(this, args))
-  })
-}
-
-/**
- * Wraps a `beforeEach` cleanup callback so it inherits the test span context.
- * Vitest allows `beforeEach` to return a cleanup function, including via a promise.
- * @param {object} task
- * @param {unknown} result
- * @returns {unknown}
- */
-function wrapBeforeEachCleanupResult (task, result) {
-  if (typeof result === 'function') {
-    return wrapTestScopedFn(task, result)
-  }
-
-  if (result && typeof result.then === 'function') {
-    return result.then(cleanupFn => wrapBeforeEachCleanupResult(task, cleanupFn))
-  }
-
-  return result
-}
-
-function getWorkspaceProject (ctx) {
-  return ctx.getCoreWorkspaceProject
-    ? ctx.getCoreWorkspaceProject()
-    : ctx.getRootProject()
-}
-
-function setProvidedContext (ctx, values, warningMessage) {
-  try {
-    Object.assign(getWorkspaceProject(ctx)._provided, values)
-  } catch {
-    log.warn(warningMessage)
-  }
-}
-
-function getTestFilepathsFromSpecifications (testSpecifications) {
-  if (!Array.isArray(testSpecifications) || !testSpecifications.length) {
-    return
-  }
-
-  return testSpecifications.map(testSpecification => {
-    const testFile = Array.isArray(testSpecification) ? testSpecification[1] : testSpecification
-    return testFile?.moduleId || testFile?.filepath || testFile
-  })
-}
-
-function getTestFilepaths (ctx, testSpecifications) {
-  const testFilepaths = getTestFilepathsFromSpecifications(testSpecifications)
-  if (testFilepaths) {
-    return testFilepaths
-  }
-
-  const getFilePaths = ctx.getTestFilepaths || ctx._globTestFilepaths
-  return getFilePaths.call(ctx)
-}
-
-function wrapCoverageProvider (ctx) {
-  const { coverageProvider } = ctx
-  if (!coverageProvider?.generateCoverage || coverageWrappedProviders.has(coverageProvider)) {
-    return
-  }
-  coverageWrappedProviders.add(coverageProvider)
-
-  // Capture coverage root directory from config (default is 'coverage' in cwd)
-  try {
-    const coverageConfig = ctx.config?.coverage
-    const reportsDirectory = coverageConfig?.reportsDirectory || 'coverage'
-    const rootDir = ctx.config?.root || process.cwd()
-    coverageRootDir = path.isAbsolute(reportsDirectory) ? reportsDirectory : path.join(rootDir, reportsDirectory)
-  } catch {
-    // Fallback to cwd if we can't get config
-    coverageRootDir = process.cwd()
-  }
-
-  shimmer.wrap(coverageProvider, 'generateCoverage', generateCoverage => async function () {
-    const totalCodeCoverage = await generateCoverage.apply(this, arguments)
-
-    try {
-      testCodeCoverageLinesTotal = totalCodeCoverage.getCoverageSummary().lines.pct
-    } catch {
-      // ignore errors
-    }
-    return totalCodeCoverage
-  })
-}
-
-function wrapSessionFinish (ctx) {
-  if (finishWrappedContexts.has(ctx)) {
-    return
-  }
-  finishWrappedContexts.add(ctx)
-
-  shimmer.wrap(ctx, 'exit', getFinishWrapper)
-  shimmer.wrap(ctx, 'close', getFinishWrapper)
-}
-
-async function runMainProcessSetup (ctx, frameworkVersion, testSpecifications) {
-  if (!testSessionFinishCh.hasSubscribers) {
-    return
-  }
-
-  try {
-    const { err, libraryConfig } = await getChannelPromise(libraryConfigurationCh, frameworkVersion)
-    if (!err) {
-      isFlakyTestRetriesEnabled = libraryConfig.isFlakyTestRetriesEnabled
-      flakyTestRetriesCount = libraryConfig.flakyTestRetriesCount
-      isEarlyFlakeDetectionEnabled = libraryConfig.isEarlyFlakeDetectionEnabled
-      earlyFlakeDetectionNumRetries = libraryConfig.earlyFlakeDetectionNumRetries
-      earlyFlakeDetectionSlowTestRetries = libraryConfig.earlyFlakeDetectionSlowTestRetries ?? {}
-      isDiEnabled = libraryConfig.isDiEnabled
-      isKnownTestsEnabled = libraryConfig.isKnownTestsEnabled
-      isTestManagementTestsEnabled = libraryConfig.isTestManagementEnabled
-      testManagementAttemptToFixRetries = libraryConfig.testManagementAttemptToFixRetries
-      isImpactedTestsEnabled = libraryConfig.isImpactedTestsEnabled
-    }
-  } catch {
-    isFlakyTestRetriesEnabled = false
-    isEarlyFlakeDetectionEnabled = false
-    isDiEnabled = false
-    isKnownTestsEnabled = false
-    isImpactedTestsEnabled = false
-  }
-
-  if (testSessionConfigurationCh.hasSubscribers) {
-    const { testSessionId, testModuleId, testCommand, repositoryRoot, codeOwnersEntries } = await getChannelPromise(
-      testSessionConfigurationCh,
-      frameworkVersion
-    )
-    setProvidedContext(ctx, {
-      _ddTestSessionId: testSessionId,
-      _ddTestModuleId: testModuleId,
-      _ddTestCommand: testCommand,
-      _ddRepositoryRoot: repositoryRoot,
-      _ddCodeOwnersEntries: codeOwnersEntries,
-    }, 'Could not send test session configuration to workers.')
-  }
-
-  const {
-    knownTestsResponse,
-    testManagementTestsResponse,
-  } = await getTestOptimizationRequestResults({
-    isKnownTestsEnabled,
-    isTestManagementTestsEnabled,
-    getKnownTests: () => getChannelPromise(knownTestsCh),
-    getTestManagementTests: () => getChannelPromise(testManagementTestsCh),
-  })
-
-  const flakyTestRetriesConfiguration = configureFlakyTestRetries(ctx, testSpecifications)
-  if (flakyTestRetriesConfiguration) {
-    setProvidedContext(ctx, {
-      _ddIsFlakyTestRetriesEnabled: isFlakyTestRetriesEnabled,
-      _ddFlakyTestRetriesCount: flakyTestRetriesCount,
-      _ddFlakyTestRetriesIncludesUnnamedProject: flakyTestRetriesConfiguration.includesUnnamedProject,
-      _ddFlakyTestRetriesProjectNames: flakyTestRetriesConfiguration.projectNames,
-    }, 'Could not send library configuration to workers.')
-  }
-
-  if (isKnownTestsEnabled) {
-    const currentKnownTestsResponse = knownTestsResponse || await getChannelPromise(knownTestsCh)
-    if (currentKnownTestsResponse.err) {
-      isEarlyFlakeDetectionEnabled = false
-    } else {
-      const knownTests = currentKnownTestsResponse.knownTests
-      const testFilepaths = await getTestFilepaths(ctx, testSpecifications)
-
-      if (isValidKnownTests(knownTests)) {
-        isEarlyFlakeDetectionFaultyCh.publish({
-          knownTests: knownTests.vitest,
-          testFilepaths,
-          onDone: (isFaulty) => {
-            isEarlyFlakeDetectionFaulty = isFaulty
-          },
-        })
-        if (isEarlyFlakeDetectionFaulty) {
-          isEarlyFlakeDetectionEnabled = false
-          log.warn('New test detection is disabled because the number of new tests is too high.')
-        } else {
-          setProvidedContext(ctx, {
-            _ddIsKnownTestsEnabled: isKnownTestsEnabled,
-            _ddKnownTests: knownTests,
-            _ddIsEarlyFlakeDetectionEnabled: isEarlyFlakeDetectionEnabled,
-            _ddEarlyFlakeDetectionNumRetries:
-              getConfiguredEfdRetryCount(earlyFlakeDetectionSlowTestRetries, earlyFlakeDetectionNumRetries),
-            _ddEarlyFlakeDetectionSlowTestRetries: earlyFlakeDetectionSlowTestRetries,
-          }, 'Could not send known tests to workers so Early Flake Detection will not work.')
-        }
-      } else {
-        isEarlyFlakeDetectionFaulty = true
-        isEarlyFlakeDetectionEnabled = false
-      }
-    }
-  }
-
-  if (isDiEnabled) {
-    setProvidedContext(ctx, {
-      _ddIsDiEnabled: isDiEnabled,
-    }, 'Could not send Dynamic Instrumentation configuration to workers.')
-  }
-
-  if (isTestManagementTestsEnabled) {
-    const { err, testManagementTests: receivedTestManagementTests } =
-      testManagementTestsResponse || await getChannelPromise(testManagementTestsCh)
-    if (err) {
-      isTestManagementTestsEnabled = false
-      log.error('Could not get test management tests.')
-    } else {
-      setProvidedContext(ctx, {
-        _ddIsTestManagementTestsEnabled: isTestManagementTestsEnabled,
-        _ddTestManagementAttemptToFixRetries: testManagementAttemptToFixRetries,
-        _ddTestManagementTests: receivedTestManagementTests,
-      }, 'Could not send test management tests to workers so Test Management will not work.')
-    }
-  }
-
-  if (isImpactedTestsEnabled) {
-    const { err, modifiedFiles } = await getChannelPromise(modifiedFilesCh)
-    if (err) {
-      log.error('Could not get modified tests.')
-    } else {
-      setProvidedContext(ctx, {
-        _ddIsImpactedTestsEnabled: isImpactedTestsEnabled,
-        _ddModifiedFiles: modifiedFiles,
-      }, 'Could not send modified tests to workers so Impacted Tests will not work.')
-    }
-  }
-
-  wrapCoverageProvider(ctx)
-  wrapSessionFinish(ctx)
-}
-
-function ensureMainProcessSetup (ctx, frameworkVersion, testSpecifications) {
-  let setupPromise = mainProcessSetupPromises.get(ctx)
-  if (!setupPromise) {
-    setupPromise = runMainProcessSetup(ctx, frameworkVersion, testSpecifications)
-    mainProcessSetupPromises.set(ctx, setupPromise)
-  }
-  return setupPromise
-}
-
-/**
- * Configure Vitest retries for the root project and resolved workspace projects.
- *
- * @param {object} ctx
- * @param {unknown[]|undefined} testSpecifications
- * @returns {{ projectNames: string[], includesUnnamedProject: boolean }|undefined}
- */
-function configureFlakyTestRetries (ctx, testSpecifications) {
-  if (!isFlakyTestRetriesEnabled || flakyTestRetriesCount <= 0) return
-
-  let configured = false
-  let includesUnnamedProject = false
-  const projectNames = []
-  for (const { config, projectName } of getVitestProjectConfigs(ctx, testSpecifications)) {
-    if (!config.retry) {
-      config.retry = flakyTestRetriesCount
-      configured = true
-      if (projectName) {
-        projectNames.push(projectName)
-      } else {
-        includesUnnamedProject = true
-      }
-    }
-  }
-
-  if (!configured) return
-
-  return {
-    includesUnnamedProject,
-    projectNames,
-  }
-}
-
-/**
- * Return unique Vitest configs that can be used to run tests.
- *
- * @param {object} ctx
- * @param {unknown[]|undefined} testSpecifications
- * @returns {{ config: object, projectName?: string }[]}
- */
-function getVitestProjectConfigs (ctx, testSpecifications) {
-  const entries = []
-
-  addTestSpecificationConfigs(entries, testSpecifications)
-  if (entries.length > 0) {
-    return entries
-  }
-
-  const selectedProjectNames = getSelectedProjectNames()
-  addSelectedInlineProjectConfigs(entries, safeConfig(ctx), selectedProjectNames)
-  addSelectedRuntimeProjectConfigs(entries, ctx?.projects, selectedProjectNames)
-  if (entries.length > 0) {
-    return entries
-  }
-
-  if (Array.isArray(ctx?.projects)) {
-    for (const project of ctx.projects) {
-      addConfig(entries, safeConfig(project), getProjectName(project))
-    }
-    if (entries.length > 0) {
-      return entries
-    }
-  }
-
-  addConfig(entries, safeConfig(ctx))
-  addConfig(entries, safeConfig(safeWorkspaceProject(ctx)))
-
-  return entries
-}
-
-/**
- * Add configs from runnable test specifications once.
- *
- * @param {{ config: object, projectName?: string }[]} entries
- * @param {unknown[]|undefined} testSpecifications
- */
-function addTestSpecificationConfigs (entries, testSpecifications) {
-  if (!Array.isArray(testSpecifications)) return
-
-  for (const testSpecification of testSpecifications) {
-    const project = getTestSpecificationProject(testSpecification)
-    addConfig(entries, safeConfig(project), getProjectName(project))
-  }
-}
-
-/**
- * Add selected inline project configs from the root Vitest config once.
- *
- * @param {{ config: object, projectName?: string }[]} entries
- * @param {object|undefined} rootConfig
- * @param {string[]} selectedProjectNames
- */
-function addSelectedInlineProjectConfigs (entries, rootConfig, selectedProjectNames) {
-  if (selectedProjectNames.length === 0 || !Array.isArray(rootConfig?.projects)) return
-
-  for (const project of rootConfig.projects) {
-    const config = getInlineProjectConfig(project)
-    const projectName = getProjectName(project)
-    if (selectedProjectNames.includes(projectName)) {
-      addConfig(entries, config, projectName)
-    }
-  }
-}
-
-/**
- * Add selected resolved project configs once.
- *
- * @param {{ config: object, projectName?: string }[]} entries
- * @param {unknown[]|undefined} projects
- * @param {string[]} selectedProjectNames
- */
-function addSelectedRuntimeProjectConfigs (entries, projects, selectedProjectNames) {
-  if (selectedProjectNames.length === 0 || !Array.isArray(projects)) return
-
-  for (const project of projects) {
-    const projectName = getProjectName(project)
-    if (selectedProjectNames.includes(projectName)) {
-      addConfig(entries, safeConfig(project), projectName)
-    }
-  }
-}
-
-/**
- * Return selected project names from the Vitest CLI arguments.
- *
- * @returns {string[]}
- */
-function getSelectedProjectNames () {
-  const names = []
-  for (let index = 0; index < process.argv.length; index++) {
-    const argument = process.argv[index]
-    if (argument === '--project' && process.argv[index + 1]) {
-      names.push(process.argv[index + 1])
-      index++
-    } else if (argument.startsWith('--project=')) {
-      names.push(argument.slice('--project='.length))
-    }
-  }
-  return names
-}
-
-/**
- * Return the test config from an inline Vitest project entry.
- *
- * @param {unknown} project
- * @returns {object|undefined}
- */
-function getInlineProjectConfig (project) {
-  return project?.test || project
-}
-
-/**
- * Return a Vitest project name from runtime or inline project objects.
- *
- * @param {unknown} project
- * @returns {string|undefined}
- */
-function getProjectName (project) {
-  return normalizeProjectName(project?.name || project?.config?.name || project?.test?.name)
-}
-
-/**
- * Return a normalized Vitest project name.
- *
- * @param {unknown} name
- * @returns {string|undefined}
- */
-function normalizeProjectName (name) {
-  if (typeof name === 'string') return name
-
-  const label = name?.label
-  return typeof label === 'string' ? label : undefined
-}
-
-/**
- * Add a config object once.
- *
- * @param {{ config: object, projectName?: string }[]} entries
- * @param {object|undefined} config
- * @param {string|undefined} projectName
- */
-function addConfig (entries, config, projectName) {
-  if (config && !entries.some(entry => entry.config === config || (projectName && entry.projectName === projectName))) {
-    entries.push({ config, projectName })
-  }
-}
-
-/**
- * Read a Vitest config object without assuming the project is initialized.
- *
- * @param {object|undefined} project
- * @returns {object|undefined}
- */
-function safeConfig (project) {
-  let config
-  try {
-    config = project?.config
-  } catch {}
-  return config
-}
-
-/**
- * Read the workspace project without assuming the root server is initialized.
- *
- * @param {object} ctx
- * @returns {object|undefined}
- */
-function safeWorkspaceProject (ctx) {
-  let project
-  try {
-    project = getWorkspaceProject(ctx)
-  } catch {}
-  return project
-}
-
-/**
- * Return whether Datadog configured ATR retries for a task.
- *
- * @param {object} providedContext
- * @param {object} task
- * @returns {boolean}
- */
-function isFlakyTestRetriesEnabledForTask (providedContext, task) {
-  if (!providedContext.isFlakyTestRetriesEnabled) return false
-
-  const { flakyTestRetriesProjectNames } = providedContext
-  if (!Array.isArray(flakyTestRetriesProjectNames)) return true
-
-  const projectName = task.file?.projectName
-  if (!projectName) {
-    return providedContext.flakyTestRetriesIncludesUnnamedProject === true
-  }
-
-  return flakyTestRetriesProjectNames.includes(projectName)
-}
-
-function getSortWrapper (sort, frameworkVersion) {
-  return async function () {
-    await ensureMainProcessSetup(this.ctx, frameworkVersion, arguments[0])
-    return sort.apply(this, arguments)
-  }
-}
-
-function getFinishWrapper (exitOrClose) {
-  let isClosed = false
-  return async function () {
-    if (isClosed) { // needed because exit calls close
-      return exitOrClose.apply(this, arguments)
-    }
-    isClosed = true
-
-    if (!testSessionFinishCh.hasSubscribers) {
-      return exitOrClose.apply(this, arguments)
-    }
-
-    let onFinish
-
-    const flushPromise = new Promise(resolve => {
-      onFinish = resolve
-    })
-    const failedSuites = this.state.getFailedFilepaths()
-    let error
-    if (failedSuites.length) {
-      error = new Error(`Test suites failed: ${failedSuites.length}.`)
-    }
-
-    testSessionFinishCh.publish({
-      status: getSessionStatus(this.state),
-      testCodeCoverageLinesTotal,
-      error,
-      isEarlyFlakeDetectionEnabled,
-      isEarlyFlakeDetectionFaulty,
-      isTestManagementTestsEnabled,
-      vitestPool,
-      onFinish,
-    })
-
-    logTestOptimizationSummary({ attemptToFixExecutions, newTestsWithDynamicNames })
-    loggedAttemptToFixTests.clear()
-
-    await flushPromise
-
-    // If coverage was generated, publish coverage report channel for upload
-    if (coverageRootDir && codeCoverageReportCh.hasSubscribers) {
-      await new Promise((resolve) => {
-        codeCoverageReportCh.publish({ rootDir: coverageRootDir, onDone: resolve })
-      })
-    }
-
-    return exitOrClose.apply(this, arguments)
-  }
-}
-
-function getCliOrStartVitestWrapper (frameworkVersion) {
-  return function (oldCliOrStartVitest) {
-    return function (...args) {
-      if (!testSessionStartCh.hasSubscribers || isSessionStarted) {
-        return oldCliOrStartVitest.apply(this, args)
-      }
-      isSessionStarted = true
-      testSessionStartCh.publish({ command: getTestCommand(), frameworkVersion })
-      return oldCliOrStartVitest.apply(this, args)
-    }
-  }
-}
-
-function isForkPool (pool) {
-  return pool === 'forks' || pool === 'vmForks'
-}
-
-function isThreadPool (pool) {
-  return pool === 'threads' || pool === 'vmThreads'
-}
-
-/**
- * Return the project object attached to a Vitest test specification.
- *
- * @param {unknown} testSpecification
- * @returns {object|undefined}
- */
-function getTestSpecificationProject (testSpecification) {
-  if (Array.isArray(testSpecification)) {
-    return testSpecification[0]
-  }
-  return testSpecification?.project
-}
-
-function getTestSpecificationPool (testSpecification) {
-  const project = getTestSpecificationProject(testSpecification)
-  return project?.config?.pool || project?.serializedConfig?.pool || project?.pool || testSpecification?.pool
-}
-
-function hasForkPoolTestSpecification (testSpecifications) {
-  if (!Array.isArray(testSpecifications)) {
-    return false
-  }
-
-  for (const testSpecification of testSpecifications) {
-    if (isForkPool(getTestSpecificationPool(testSpecification))) {
-      return true
-    }
-  }
-
-  return false
-}
-
-function shouldMarkVitestWorkerEnv (pool, testSpecifications) {
-  return isForkPool(pool) || hasForkPoolTestSpecification(testSpecifications) ||
-    (!testSpecifications && !isThreadPool(pool))
-}
-
-function markVitestWorkerEnv (ctx, testSpecifications) {
-  const config = ctx?.config
-  if (!config || !shouldMarkVitestWorkerEnv(config.pool, testSpecifications)) {
-    return
-  }
-  config.env = config.env || {}
-  config.env.DD_VITEST_WORKER = '1'
-}
-
-function wrapVitestRunFiles (Vitest, frameworkVersion) {
-  if (!Vitest?.prototype?.runFiles) {
-    return
-  }
-
-  shimmer.wrap(Vitest.prototype, 'runFiles', runFiles => async function (testSpecifications) {
-    markVitestWorkerEnv(this, testSpecifications)
-    await ensureMainProcessSetup(this, frameworkVersion, testSpecifications)
-    return runFiles.apply(this, arguments)
-  })
-
-  if (Vitest.prototype.collectTests) {
-    shimmer.wrap(Vitest.prototype, 'collectTests', collectTests => function () {
-      markVitestWorkerEnv(this)
-      return collectTests.apply(this, arguments)
-    })
-  }
-}
-
-function getCreateCliWrapper (vitestPackage, frameworkVersion) {
-  const createCliExport = findExportByName(vitestPackage, 'createCLI')
-  if (!createCliExport) {
-    return vitestPackage
-  }
-  shimmer.wrap(vitestPackage, createCliExport.key, getCliOrStartVitestWrapper(frameworkVersion))
-
-  return vitestPackage
-}
-
-function threadHandler (thread) {
-  const { runtime } = thread
-  let workerProcess
-  if (runtime === 'child_process') {
-    vitestPool = 'child_process'
-    workerProcess = thread.process
-  } else if (runtime === 'worker_threads') {
-    vitestPool = 'worker_threads'
-    workerProcess = thread.thread
-  } else {
-    vitestPool = 'unknown'
-  }
-  if (!workerProcess) {
-    log.error('Vitest error: could not get process or thread from TinyPool#run')
-    return
-  }
-
-  if (workerProcesses.has(workerProcess)) {
-    return
-  }
-  workerProcesses.add(workerProcess)
-  workerProcess.on('message', (message) => {
-    if (message.__tinypool_worker_message__ && message.data) {
-      if (message.interprocessCode === VITEST_WORKER_TRACE_PAYLOAD_CODE) {
-        collectTestOptimizationSummariesFromTraces(message.data, {
-          newTestsWithDynamicNames,
-          attemptToFixExecutions,
-        })
-        workerReportTraceCh.publish(message.data)
-      } else if (message.interprocessCode === VITEST_WORKER_LOGS_PAYLOAD_CODE) {
-        workerReportLogsCh.publish(message.data)
-      }
-    }
-  })
-}
-
-function wrapTinyPoolRun (TinyPool) {
-  shimmer.wrap(TinyPool.prototype, 'run', run => async function () {
-    // We have to do this before and after because the threads list gets recycled, that is, the processes are re-created
-    // eslint-disable-next-line unicorn/no-array-for-each
-    this.threads.forEach(threadHandler)
-    const runResult = await run.apply(this, arguments)
-    // eslint-disable-next-line unicorn/no-array-for-each
-    this.threads.forEach(threadHandler)
-    return runResult
-  })
-}
-
-addHook({
-  name: 'tinypool',
-  // version from tinypool@0.8 was used in vitest@1.6.0
-  versions: ['>=0.8.0'],
-}, (TinyPool) => {
-  wrapTinyPoolRun(TinyPool)
-  return TinyPool
-})
-
-function getWrappedOn (on) {
-  return function (event, callback) {
-    if (event !== 'message') {
-      return on.apply(this, arguments)
-    }
-    // `arguments[1]` is the callback function, which
-    // we modify to intercept our messages to not interfere
-    // with vitest's own messages
-    arguments[1] = shimmer.wrapFunction(callback, callback => function (message) {
-      if (message.type !== 'Buffer' && Array.isArray(message)) {
-        const [interprocessCode, data] = message
-        if (interprocessCode === VITEST_WORKER_TRACE_PAYLOAD_CODE) {
-          collectTestOptimizationSummariesFromTraces(data, {
-            newTestsWithDynamicNames,
-            attemptToFixExecutions,
-          })
-          workerReportTraceCh.publish(data)
-        } else if (interprocessCode === VITEST_WORKER_LOGS_PAYLOAD_CODE) {
-          workerReportLogsCh.publish(data)
-        }
-        // If we execute the callback vitest crashes, as the message is not supported
-        return
-      }
-      return callback.apply(this, arguments)
-    })
-    return on.apply(this, arguments)
-  }
-}
-
-function getStartVitestWrapper (cliApiPackage, frameworkVersion) {
-  if (!isCliApiPackage(cliApiPackage)) {
-    return cliApiPackage
-  }
-  const startVitestExport = findExportByName(cliApiPackage, 'startVitest')
-  shimmer.wrap(cliApiPackage, startVitestExport.key, getCliOrStartVitestWrapper(frameworkVersion))
-
-  const vitest = getVitestExport(cliApiPackage)
-  if (vitest) {
-    wrapVitestRunFiles(vitest.value, frameworkVersion)
-  }
-
-  const forksPoolWorker = getForksPoolWorkerExport(cliApiPackage)
-  if (forksPoolWorker) {
-    // function is async
-    shimmer.wrap(forksPoolWorker.value.prototype, 'start', start => function (...args) {
-      vitestPool = 'child_process'
-      this.env.DD_VITEST_WORKER = '1'
-
-      return start.apply(this, args)
-    })
-    shimmer.wrap(forksPoolWorker.value.prototype, 'on', getWrappedOn)
-  }
-
-  const threadsPoolWorker = getThreadsPoolWorkerExport(cliApiPackage)
-  if (threadsPoolWorker) {
-    // function is async
-    shimmer.wrap(threadsPoolWorker.value.prototype, 'start', start => function (...args) {
-      vitestPool = 'worker_threads'
-      this.env.DD_VITEST_WORKER = '1'
-      return start.apply(this, args)
-    })
-    shimmer.wrap(threadsPoolWorker.value.prototype, 'on', getWrappedOn)
-  }
-  return cliApiPackage
-}
-
-function wrapVitestTestRunner (VitestTestRunner) {
-  // `onBeforeRunTask` is run before any repetition or attempt is run
-  // `onBeforeRunTask` is an async function
-  shimmer.wrap(VitestTestRunner.prototype, 'onBeforeRunTask', onBeforeRunTask => function (task) {
-    const testName = getTestName(task)
-
-    const {
-      knownTests,
-      isEarlyFlakeDetectionEnabled,
-      isKnownTestsEnabled,
-      numRepeats,
-      isTestManagementTestsEnabled,
-      testManagementAttemptToFixRetries,
-      testManagementTests,
-      isImpactedTestsEnabled,
-      modifiedFiles,
-    } = getProvidedContext()
-
-    if (isTestManagementTestsEnabled) {
-      isAttemptToFixCh.publish({
-        testManagementTests,
-        testSuiteAbsolutePath: task.file.filepath,
-        testName,
-        onDone: (isAttemptToFix) => {
-          if (isAttemptToFix) {
-            isRetryReasonAttemptToFix = task.repeats !== testManagementAttemptToFixRetries
-            disableFrameworkRetries(task)
-            task.repeats = testManagementAttemptToFixRetries
-            attemptToFixTasks.add(task)
-            attemptToFixTaskToStatuses.set(task, [])
-          }
-        },
-      })
-      isDisabledCh.publish({
-        testManagementTests,
-        testSuiteAbsolutePath: task.file.filepath,
-        testName,
-        onDone: (isTestDisabled) => {
-          if (isTestDisabled) {
-            disabledTasks.add(task)
-            if (!attemptToFixTasks.has(task)) {
-              // we only actually skip if the test is not being attempted to be fixed
-              task.mode = 'skip'
-            }
-          }
-        },
-      })
-    }
-
-    if (isImpactedTestsEnabled) {
-      isModifiedCh.publish({
-        modifiedFiles,
-        testSuiteAbsolutePath: task.file.filepath,
-        onDone: (isImpacted) => {
-          if (isImpacted) {
-            if (isEarlyFlakeDetectionEnabled) {
-              isRetryReasonEfd = true
-              disableFrameworkRetries(task)
-              task.repeats = numRepeats
-            }
-            modifiedTasks.add(task)
-            taskToStatuses.set(task, [])
-          }
-        },
-      })
-    }
-
-    if (isKnownTestsEnabled) {
-      isNewTestCh.publish({
-        knownTests,
-        testSuiteAbsolutePath: task.file.filepath,
-        testName,
-        onDone: (isNew) => {
-          if (isNew && !attemptToFixTasks.has(task)) {
-            if (isEarlyFlakeDetectionEnabled && !modifiedTasks.has(task)) {
-              isRetryReasonEfd = true
-              disableFrameworkRetries(task)
-              task.repeats = numRepeats
-            }
-            newTasks.add(task)
-            taskToStatuses.set(task, [])
-            if (DYNAMIC_NAME_RE.test(testName)) {
-              dynamicNameTasks.add(task)
-            }
-          }
-        },
-      })
-    }
-
-    return onBeforeRunTask.apply(this, arguments)
-  })
-
-  // `onAfterRunTask` is run after all repetitions or attempts are run
-  // `onAfterRunTask` is an async function
-  shimmer.wrap(VitestTestRunner.prototype, 'onAfterRunTask', onAfterRunTask => function (task) {
-    const { isEarlyFlakeDetectionEnabled, isTestManagementTestsEnabled } = getProvidedContext()
-
-    if (isTestManagementTestsEnabled) {
-      const isAttemptingToFix = attemptToFixTasks.has(task)
-      const isQuarantined = quarantinedTasks.has(task)
-
-      if (isAttemptingToFix) {
-        const statuses = attemptToFixTaskToStatuses.get(task)
-        if (task.result.state === 'pass' && statuses?.includes('fail')) {
-          switchedStatuses.add(task)
-          task.result.state = 'fail'
-        }
-      }
-
-      if (!isAttemptingToFix && isQuarantined) {
-        if (task.result.state === 'fail') {
-          switchedStatuses.add(task)
-        }
-        task.result.state = 'pass'
-      }
-    }
-
-    if (isEarlyFlakeDetectionEnabled && taskToStatuses.has(task) && !attemptToFixTasks.has(task)) {
-      const statuses = taskToStatuses.get(task)
-      // If the test has passed at least once, we consider it passed
-      if (statuses.includes('pass')) {
-        if (task.result.state === 'fail') {
-          switchedStatuses.add(task)
-        }
-        task.result.state = 'pass'
-      }
-    }
-
-    return onAfterRunTask.apply(this, arguments)
-  })
-
-  // test start (only tests that are not marked as skip or todo)
-  // `onBeforeTryTask` is run for every repetition and attempt of the test
-  shimmer.wrap(VitestTestRunner.prototype, 'onBeforeTryTask', onBeforeTryTask => async function (task, retryInfo) {
-    if (!testPassCh.hasSubscribers && !testErrorCh.hasSubscribers && !testSkipCh.hasSubscribers) {
-      return onBeforeTryTask.apply(this, arguments)
-    }
-    const testName = getTestName(task)
-    let isNew = false
-    let isQuarantined = false
-
-    const providedContext = getProvidedContext()
-    const {
-      isKnownTestsEnabled,
-      isEarlyFlakeDetectionEnabled,
-      isDiEnabled,
-      isTestManagementTestsEnabled,
-      testManagementTests,
-      slowTestRetries,
-    } = providedContext
-
-    if (isKnownTestsEnabled) {
-      isNew = newTasks.has(task)
-    }
-
-    if (isTestManagementTestsEnabled) {
-      isQuarantinedCh.publish({
-        testManagementTests,
-        testSuiteAbsolutePath: task.file.filepath,
-        testName,
-        onDone: (isTestQuarantined) => {
-          isQuarantined = isTestQuarantined
-          if (isTestQuarantined) {
-            quarantinedTasks.add(task)
-          }
-        },
-      })
-    }
-
-    const { retry: numAttempt, repeats: numRepetition } = retryInfo
-    const isEfdManagedTask = isEarlyFlakeDetectionEnabled && taskToStatuses.has(task) && !attemptToFixTasks.has(task)
-
-    if (isEfdManagedTask && numRepetition > 0 && !efdDeterminedRetries.has(task)) {
-      const previousExecutionStart = efdExecutionStartByTask.get(task)
-      const duration = previousExecutionStart === undefined
-        ? task.result?.duration ?? 0
-        : performance.now() - previousExecutionStart
-      const retryCount = getEfdRetryCount(duration, slowTestRetries)
-      efdDeterminedRetries.set(task, retryCount)
-      task.repeats = retryCount
-      if (retryCount === 0) {
-        efdSlowAbortedTasks.add(task)
-      }
-    }
-
-    const efdRetryCount = efdDeterminedRetries.get(task)
-    if (isEfdManagedTask && efdRetryCount !== undefined && numRepetition > efdRetryCount) {
-      if (task.result) {
-        efdSkippedRetryResults.set(task, {
-          ...task.result,
-          errors: task.result.errors?.slice(),
-        })
-      }
-      if (vitestSetFn) {
-        const noop = function () {}
-        noop.__ddTraceWrapped = true
-        vitestSetFn(task, noop)
-      }
-      return onBeforeTryTask.apply(this, arguments)
-    }
-    if (isEfdManagedTask) {
-      efdExecutionStartByTask.set(task, performance.now())
-    }
-
-    // We finish the previous test here because we know it has failed already
-    if (numAttempt > 0) {
-      const shouldWaitForHitProbe = isDiEnabled && numAttempt > 1
-      if (shouldWaitForHitProbe) {
-        await waitForHitProbe()
-      }
-
-      const promises = {}
-      const shouldSetProbe = isDiEnabled && numAttempt === 1
-      const ctx = taskToCtx.get(task)
-      const testError = getCurrentAttemptTestError(task, task.result?.errors)
-      if (ctx) {
-        testErrorCh.publish({
-          error: testError,
-          shouldSetProbe,
-          promises,
-          ...ctx.currentStore,
-        })
-        // We wait for the probe to be set
-        if (promises.setProbePromise) {
-          await promises.setProbePromise
-        }
-      }
-    }
-
-    const lastExecutionStatus = task.result.state
-    const isAtf = attemptToFixTasks.has(task)
-    const shouldTrackStatuses = isEarlyFlakeDetectionEnabled || isAtf
-    const shouldFlipStatus = isEarlyFlakeDetectionEnabled || isAtf
-    const statuses = isAtf ? attemptToFixTaskToStatuses.get(task) : taskToStatuses.get(task)
-
-    // These clauses handle task.repeats, whether EFD is enabled or not
-    // The only thing that EFD does is to forcefully pass the test if it has passed at least once
-    if (numRepetition > 0 && numRepetition < task.repeats) { // it may or may have not failed
-      // Here we finish the earlier iteration,
-      // as long as it's not the _last_ iteration (which will be finished normally)
-
-      const ctx = taskToCtx.get(task)
-      if (ctx) {
-        if (lastExecutionStatus === 'fail') {
-          const testError = getCurrentAttemptTestError(task, task.result?.errors)
-          testErrorCh.publish({ error: testError, ...ctx.currentStore })
-        } else {
-          testPassCh.publish({ task, ...ctx.currentStore })
-        }
-        if (shouldTrackStatuses && statuses) {
-          statuses.push(lastExecutionStatus)
-        }
-        if (shouldFlipStatus) {
-          // If we don't "reset" the result.state to "pass", once a repetition fails,
-          // vitest will always consider the test as failed, so we can't read the actual status
-          // This means that we change vitest's behavior:
-          // if the last attempt passes, vitest would consider the test as failed
-          // but after this change, it will consider the test as passed
-          task.result.state = 'pass'
-        }
-      }
-    } else if (numRepetition === task.repeats) {
-      if (shouldTrackStatuses && statuses) {
-        statuses.push(lastExecutionStatus)
-      }
-
-      const ctx = taskToCtx.get(task)
-      if (lastExecutionStatus === 'fail') {
-        const testError = getCurrentAttemptTestError(task, task.result?.errors)
-        testErrorCh.publish({ error: testError, ...ctx.currentStore })
-      } else {
-        testPassCh.publish({ task, ...ctx.currentStore })
-      }
-      if (shouldFlipStatus) {
-        task.result.state = 'pass'
-      }
-    }
-
-    const isRetryReasonAtr = numAttempt > 0 &&
-      isFlakyTestRetriesEnabledForTask(providedContext, task) &&
-      !isRetryReasonAttemptToFix &&
-      !isRetryReasonEfd
-
-    const ctx = {
-      testName,
-      testSuiteAbsolutePath: task.file.filepath,
-      isRetry: numAttempt > 0 || numRepetition > 0,
-      isRetryReasonEfd,
-      isRetryReasonAttemptToFix: isRetryReasonAttemptToFix && numRepetition > 0,
-      isNew,
-      hasDynamicName: dynamicNameTasks.has(task),
-      mightHitProbe: isDiEnabled && numAttempt > 0,
-      isAttemptToFix: attemptToFixTasks.has(task),
-      isDisabled: disabledTasks.has(task),
-      isQuarantined,
-      isRetryReasonAtr,
-      isModified: modifiedTasks.has(task),
-    }
-    taskToCtx.set(task, ctx)
-
-    if (attemptToFixTasks.has(task)) {
-      logAttemptToFixTestExecution(
-        getTestSuitePath(task.file.filepath, process.cwd()),
-        testName,
-        loggedAttemptToFixTests
-      )
-    }
-
-    testStartCh.runStores(ctx, () => {})
-
-    // Wrap the test function so it runs inside the test span context.
-    // Without this, HTTP requests during test execution become orphaned root spans.
-    if (vitestGetFn && vitestSetFn) {
-      const originalFn = vitestGetFn(task)
-      if (originalFn && !originalFn.__ddTraceWrapped) {
-        const wrappedFn = wrapTestScopedFn(task, originalFn)
-        wrappedFn.__ddTraceWrapped = true
-        vitestSetFn(task, wrappedFn)
-      }
-    }
-
-    // Wrap beforeEach/afterEach hooks so they also run inside the test span context.
-    // In vitest 4+, hooks are in a WeakMap accessed via getHooks(). In older versions, they're on suite.hooks.
-    let currentSuite = task.suite
-    while (currentSuite) {
-      const hooks = vitestGetHooks ? vitestGetHooks(currentSuite) : currentSuite.hooks
-      if (hooks) {
-        for (const hookType of ['beforeEach', 'afterEach']) {
-          const hookArray = hooks[hookType]
-          if (!hookArray) continue
-          for (let i = 0; i < hookArray.length; i++) {
-            const currentFn = hookArray[i]
-            const originalFn = originalHookFns.get(currentFn) || currentFn
-            const wrappedFn = shimmer.wrapFunction(originalFn, fn => function (...args) {
-              const result = testFnCh.runStores(taskToCtx.get(task), () => fn.apply(this, args))
-
-              if (hookType === 'beforeEach') {
-                return wrapBeforeEachCleanupResult(task, result)
-              }
-
-              return result
-            })
-            originalHookFns.set(wrappedFn, originalFn)
-            hookArray[i] = wrappedFn
-          }
-        }
-      }
-      currentSuite = currentSuite.suite
-    }
-
-    return onBeforeTryTask.apply(this, arguments)
-  })
-
-  // test finish (only passed tests)
-  shimmer.wrap(VitestTestRunner.prototype, 'onAfterTryTask', onAfterTryTask =>
-    async function (task, retryInfo) {
-      if (!testPassCh.hasSubscribers && !testErrorCh.hasSubscribers && !testSkipCh.hasSubscribers) {
-        return onAfterTryTask.apply(this, arguments)
-      }
-      const result = await onAfterTryTask.apply(this, arguments)
-
-      const {
-        isEarlyFlakeDetectionEnabled,
-        testManagementAttemptToFixRetries,
-        slowTestRetries,
-      } = getProvidedContext()
-
-      const status = getVitestTestStatus(task, retryInfo.retry)
-      const ctx = taskToCtx.get(task)
-
-      const { isDiEnabled } = getProvidedContext()
-
-      if (efdSkippedRetryResults.has(task)) {
-        task.result = efdSkippedRetryResults.get(task)
-        efdSkippedRetryResults.delete(task)
-        return result
-      }
-
-      if (isDiEnabled && retryInfo.retry > 1) {
-        await waitForHitProbe()
-      }
-
-      if (
-        isEarlyFlakeDetectionEnabled &&
-        (retryInfo.repeats ?? 0) === 0 &&
-        taskToStatuses.has(task) &&
-        !attemptToFixTasks.has(task) &&
-        !efdDeterminedRetries.has(task)
-      ) {
-        const executionStart = efdExecutionStartByTask.get(task)
-        const duration = executionStart === undefined ? task.result?.duration ?? 0 : performance.now() - executionStart
-        const retryCount = getEfdRetryCount(duration, slowTestRetries)
-        efdDeterminedRetries.set(task, retryCount)
-        task.repeats = retryCount
-        if (retryCount === 0) {
-          efdSlowAbortedTasks.add(task)
-        }
-      }
-
-      let attemptToFixPassed = false
-      let attemptToFixFailed = false
-      if (attemptToFixTasks.has(task)) {
-        const statuses = attemptToFixTaskToStatuses.get(task)
-        if (statuses.length === testManagementAttemptToFixRetries) {
-          if (status === 'pass' && statuses.every(status => status === 'pass')) {
-            attemptToFixPassed = true
-          } else if (status === 'fail' || statuses.includes('fail')) {
-            attemptToFixFailed = true
-          }
-        }
-      }
-
-      if (ctx) {
-        // We don't finish here because the test might fail in a later hook (afterEach)
-        ctx.status = status
-        ctx.task = task
-        ctx.attemptToFixPassed = attemptToFixPassed
-        ctx.attemptToFixFailed = attemptToFixFailed
-        testFinishTimeCh.runStores(ctx, () => {})
-      }
-
-      return result
-    })
-}
-
-function captureRunnerFunctions (pkg) {
-  if (vitestGetFn) return
-  const getFnExport = findExportByName(pkg, 'getFn')
-  const setFnExport = findExportByName(pkg, 'setFn')
-  if (getFnExport && setFnExport) {
-    vitestGetFn = getFnExport.value
-    vitestSetFn = setFnExport.value
-  }
-  const getHooksExport = findExportByName(pkg, 'getHooks')
-  if (getHooksExport) {
-    vitestGetHooks = getHooksExport.value
-  }
-}
-
-addHook({
-  name: 'vitest',
-  versions: ['>=4.0.0'],
-  filePattern: 'dist/chunks/test.*',
-}, (testPackage) => {
-  const testRunner = getTestRunnerExport(testPackage)
-  if (!testRunner) {
-    return testPackage
-  }
-
-  captureRunnerFunctions(testPackage)
-  wrapVitestTestRunner(testRunner.value)
-
-  return testPackage
-})
-
-addHook({
-  name: '@vitest/runner',
-  versions: ['>=1.6.0'],
-}, (runnerModule) => {
-  if (!vitestGetFn && runnerModule.getFn && runnerModule.setFn) {
-    vitestGetFn = runnerModule.getFn
-    vitestSetFn = runnerModule.setFn
-  }
-  if (!vitestGetHooks && runnerModule.getHooks) {
-    vitestGetHooks = runnerModule.getHooks
-  }
-  return runnerModule
-})
-
-addHook({
-  name: 'vitest',
-  versions: ['>=1.6.0 <4.0.0'],
-  file: 'dist/runners.js',
-}, (vitestPackage) => {
-  const { VitestTestRunner } = vitestPackage
-
-  wrapVitestTestRunner(VitestTestRunner)
-
-  return vitestPackage
-})
-
-// There are multiple index* files across different versions of vitest,
-// so we check for the existence of BaseSequencer to determine if we are in the right file
-addHook({
-  name: 'vitest',
-  versions: ['>=1.6.0 <2.0.0'],
-  filePattern: 'dist/vendor/index.*',
-}, (vitestPackage) => {
-  if (isReporterPackage(vitestPackage)) {
-    shimmer.wrap(vitestPackage.B.prototype, 'sort', getSortWrapper)
-  }
-
-  return vitestPackage
-})
-
-addHook({
-  name: 'vitest',
-  versions: ['>=2.0.0 <2.0.5'],
-  filePattern: 'dist/vendor/index.*',
-}, (vitestPackage) => {
-  if (isReporterPackageNew(vitestPackage)) {
-    shimmer.wrap(vitestPackage.e.prototype, 'sort', getSortWrapper)
-  }
-
-  return vitestPackage
-})
-
-addHook({
-  name: 'vitest',
-  versions: ['>=2.0.5 <2.1.0'],
-  filePattern: 'dist/chunks/index.*',
-}, (vitestPackage) => {
-  if (isReporterPackageNewest(vitestPackage)) {
-    shimmer.wrap(vitestPackage.h.prototype, 'sort', getSortWrapper)
-  }
-
-  return vitestPackage
-})
-
-addHook({
-  name: 'vitest',
-  versions: ['>=2.1.0 <3.0.0'],
-  filePattern: 'dist/chunks/RandomSequencer.*',
-}, (randomSequencerPackage) => {
-  shimmer.wrap(randomSequencerPackage.B.prototype, 'sort', getSortWrapper)
-  return randomSequencerPackage
-})
-
-addHook({
-  name: 'vitest',
-  versions: ['>=3.0.9'],
-  filePattern: 'dist/chunks/coverage.*',
-}, (coveragePackage) => {
-  const baseSequencer = getBaseSequencerExport(coveragePackage)
-  if (baseSequencer) {
-    shimmer.wrap(baseSequencer.value.prototype, 'sort', getSortWrapper)
-  }
-  return coveragePackage
-})
-
-addHook({
-  name: 'vitest',
-  versions: ['>=3.0.0 <3.0.9'],
-  filePattern: 'dist/chunks/resolveConfig.*',
-}, (resolveConfigPackage) => {
-  shimmer.wrap(resolveConfigPackage.B.prototype, 'sort', getSortWrapper)
-  return resolveConfigPackage
-})
-
-// Can't specify file because compiled vitest includes hashes in their files
-// Following 3 wrappers are for test session start
-addHook({
-  name: 'vitest',
-  versions: ['>=1.6.0 <2.0.5'],
-  filePattern: 'dist/vendor/cac.*',
-}, getCreateCliWrapper)
-
-addHook({
-  name: 'vitest',
-  versions: ['>=2.0.5'],
-  filePattern: 'dist/chunks/cac.*',
-}, getCreateCliWrapper)
-
-addHook({
-  name: 'vitest',
-  versions: ['>=1.6.0 <2.0.5'],
-  filePattern: 'dist/vendor/cli-api.*',
-}, getStartVitestWrapper)
-
-addHook({
-  name: 'vitest',
-  versions: ['>=2.0.5'],
-  filePattern: 'dist/chunks/cli-api.*',
-}, getStartVitestWrapper)
-
-// test suite start and finish
-// only relevant for workers
-addHook({
-  name: '@vitest/runner',
-  versions: ['>=1.6.0'],
-}, (vitestPackage, frameworkVersion) => {
-  shimmer.wrap(vitestPackage, 'startTests', startTests => async function (testPaths) {
-    let testSuiteError = null
-    if (!testSuiteFinishCh.hasSubscribers) {
-      return startTests.apply(this, arguments)
-    }
-    // From >=3.0.1, the first arguments changes from a string to an object containing the filepath
-    const testSuiteAbsolutePath = testPaths[0]?.filepath || testPaths[0]
-    const providedContext = getProvidedContext()
-
-    const testSuiteCtx = {
-      testSuiteAbsolutePath,
-      frameworkVersion,
-      testSessionId: providedContext.testSessionId,
-      testModuleId: providedContext.testModuleId,
-      testCommand: providedContext.testCommand,
-      repositoryRoot: providedContext.repositoryRoot,
-      codeOwnersEntries: providedContext.codeOwnersEntries,
-    }
-    testSuiteStartCh.runStores(testSuiteCtx, () => {})
-    const startTestsResponse = await startTests.apply(this, arguments)
-
-    let onFinish = null
-    const onFinishPromise = new Promise(resolve => {
-      onFinish = resolve
-    })
-
-    const testTasks = getTypeTasks(startTestsResponse[0].tasks)
-
-    // Only one test task per test, even if there are retries
-    for (const task of testTasks) {
-      const testCtx = taskToCtx.get(task)
-      const { result } = task
-      // We have to trick vitest into thinking that the test has passed
-      // but we want to report it as failed if it did fail
-      const isSwitchedStatus = switchedStatuses.has(task)
-
-      if (result) {
-        const { state, duration, errors } = result
-        const testError = getCurrentAttemptTestError(task, errors)
-        if (attemptToFixTasks.has(task)) {
-          const status = getFinalAttemptToFixStatus(task, state, isSwitchedStatus, testCtx)
-          recordFinalAttemptToFixExecution(task, status, providedContext)
-        }
-
-        if (state === 'skip') { // programmatic skip
-          testSkipCh.publish({
-            testName: getTestName(task),
-            testSuiteAbsolutePath: task.file.filepath,
-            isNew: newTasks.has(task),
-            isDisabled: disabledTasks.has(task),
-          })
-        } else if (state === 'pass' && !isSwitchedStatus) {
-          if (testCtx) {
-            const isSkippedByTestManagement =
-              !attemptToFixTasks.has(task) && (disabledTasks.has(task) || quarantinedTasks.has(task))
-            testPassCh.publish({
-              task,
-              finalStatus: isSkippedByTestManagement ? 'skip' : 'pass',
-              earlyFlakeAbortReason: efdSlowAbortedTasks.has(task) ? 'slow' : undefined,
-              ...testCtx.currentStore,
-            })
-          }
-        } else if (state === 'fail' || isSwitchedStatus) {
-          let hasFailedAllRetries = false
-          let attemptToFixFailed = false
-          if (attemptToFixTasks.has(task)) {
-            const statuses = attemptToFixTaskToStatuses.get(task)
-            if (statuses.includes('fail')) {
-              attemptToFixFailed = true
-            }
-            if (statuses.every(status => status === 'fail')) {
-              hasFailedAllRetries = true
-            }
-          }
-
-          // Check if all EFD retries failed
-          const isEfdRetry =
-            providedContext.isEarlyFlakeDetectionEnabled && (newTasks.has(task) || modifiedTasks.has(task))
-          if (isEfdRetry) {
-            const statuses = taskToStatuses.get(task)
-            const efdRetryCount = efdDeterminedRetries.get(task) ?? providedContext.numRepeats
-            // statuses only includes repetitions (not the initial run), so we check against retry count (not +1)
-            if (efdRetryCount > 0 && statuses && statuses.length === efdRetryCount &&
-              statuses.every(status => status === 'fail')) {
-              hasFailedAllRetries = true
-            }
-          }
-
-          // ATR: set hasFailedAllRetries when all auto test retries were exhausted and every attempt failed
-          const isAtrRetry = isFlakyTestRetriesEnabledForTask(providedContext, task) && !attemptToFixTasks.has(task) &&
-            !newTasks.has(task) && !modifiedTasks.has(task)
-          if (isAtrRetry) {
-            const maxRetries = providedContext.flakyTestRetriesCount ?? 0
-            if (maxRetries > 0 && task.result?.retryCount === maxRetries) {
-              hasFailedAllRetries = true
-            }
-          }
-
-          if (testCtx) {
-            const isRetry = task.result?.retryCount > 0
-            // `duration` is the duration of all the retries, so it can't be used if there are retries
-
-            let finalStatus
-            if (isSwitchedStatus) {
-              if (!attemptToFixTasks.has(task) && (disabledTasks.has(task) || quarantinedTasks.has(task))) {
-                finalStatus = 'skip'
-              } else if (isAtrRetry || isEfdRetry) {
-                finalStatus = hasFailedAllRetries ? 'fail' : 'pass'
-              } else if (attemptToFixTasks.has(task)) {
-                finalStatus = attemptToFixFailed ? 'fail' : 'pass'
-              } else {
-                finalStatus = undefined
-              }
-            } else {
-              finalStatus = 'fail'
-            }
-
-            testErrorCh.publish({
-              duration: isRetry ? undefined : duration,
-              error: testError,
-              hasFailedAllRetries,
-              attemptToFixFailed,
-              finalStatus,
-              earlyFlakeAbortReason: efdSlowAbortedTasks.has(task) ? 'slow' : undefined,
-              ...testCtx.currentStore,
-            })
-          }
-          if (errors?.length) {
-            testSuiteError = testError // we store the error to bubble it up to the suite
-          }
-        }
-      } else { // test.skip or test.todo
-        testSkipCh.publish({
-          testName: getTestName(task),
-          testSuiteAbsolutePath: task.file.filepath,
-          isNew: newTasks.has(task),
-          isDisabled: disabledTasks.has(task),
-        })
-      }
-    }
-
-    const testSuiteResult = startTestsResponse[0].result
-
-    if (testSuiteResult.errors?.length) { // Errors from root level hooks
-      testSuiteError = testSuiteResult.errors[0]
-    } else if (testSuiteResult.state === 'fail') { // Errors from `describe` level hooks
-      const suiteTasks = getTypeTasks(startTestsResponse[0].tasks, 'suite')
-      const failedSuites = suiteTasks.filter(task => task.result?.state === 'fail')
-      if (failedSuites.length && failedSuites[0].result?.errors?.length) {
-        testSuiteError = failedSuites[0].result.errors[0]
-      }
-    }
-
-    if (testSuiteError) {
-      testSuiteCtx.error = testSuiteError
-      testSuiteErrorCh.runStores(testSuiteCtx, () => {})
-    }
-
-    testSuiteFinishCh.publish({ status: testSuiteResult.state, onFinish, ...testSuiteCtx.currentStore })
-
-    await onFinishPromise
-
-    return startTestsResponse
-  })
-
-  return vitestPackage
-})
diff --git a/packages/datadog-instrumentations/test/express-mongo-sanitize.spec.js b/packages/datadog-instrumentations/test/express-mongo-sanitize.spec.js
index 48a35656ff..bbf83023a3 100644
--- a/packages/datadog-instrumentations/test/express-mongo-sanitize.spec.js
+++ b/packages/datadog-instrumentations/test/express-mongo-sanitize.spec.js
@@ -25,7 +25,7 @@ describe('express-mongo-sanitize', () => {
         // Highest version of express that supports express-mongo-sanitize is <5 (express 5 makes req.query a
         // getter-only property). The unversioned `versions/express` folder tracks the latest express (now 5.x), so
         // pin the <5 range that externals.js installs for this plugin.
-        const express = require('../../../versions/express@>=4 <5').get()
+        const express = require('../../../versions/express@4').get()
         const expressMongoSanitize = require(`../../../versions/express-mongo-sanitize@${version}`).get()
         const app = express()
 
diff --git a/packages/datadog-instrumentations/test/express-multi-version.spec.js b/packages/datadog-instrumentations/test/express-multi-version.spec.js
index 70f1d7746a..c8eaada44c 100644
--- a/packages/datadog-instrumentations/test/express-multi-version.spec.js
+++ b/packages/datadog-instrumentations/test/express-multi-version.spec.js
@@ -11,7 +11,7 @@ const { after, afterEach, before, beforeEach, describe, it } = require('mocha')
 const agent = require('../../dd-trace/test/plugins/agent')
 
 const express4Dir = join(__dirname, '..', '..', '..', 'versions', 'express@4')
-const express5Dir = join(__dirname, '..', '..', '..', 'versions', 'express@>=5.0.0')
+const express5Dir = join(__dirname, '..', '..', '..', 'versions', 'express@5')
 
 const describeOrSkip = existsSync(express4Dir) && existsSync(express5Dir)
   ? describe
diff --git a/packages/datadog-instrumentations/test/fs.spec.js b/packages/datadog-instrumentations/test/fs.spec.js
index dd3967b929..85b1d5ca33 100644
--- a/packages/datadog-instrumentations/test/fs.spec.js
+++ b/packages/datadog-instrumentations/test/fs.spec.js
@@ -1,10 +1,16 @@
 'use strict'
 
 const assert = require('node:assert')
-const { describe, it, afterEach } = require('mocha')
+const os = require('node:os')
+const path = require('node:path')
+const { describe, it, after, afterEach, before } = require('mocha')
+
+const dc = require('dc-polyfill')
 
 const agent = require('../../dd-trace/test/plugins/agent')
 
+const opStartCh = dc.channel('apm:fs:operation:start')
+
 describe('fs instrumentation', () => {
   afterEach(() => {
     return agent.close()
@@ -21,4 +27,81 @@ describe('fs instrumentation', () => {
     const fs = require('fs')
     assert.notStrictEqual(fs, undefined)
   })
+
+  // Node 20 defines `fs.opendir` / `fs.opendirSync` as lazy accessor properties.
+  // The instrumentation has to wrap the resolved method, not the accessor, so the
+  // start channel publishes the method's own operation and path. Activating the
+  // hook before the accessor is first read reproduces the order that broke: a
+  // wrapped getter leaves the real call uninstrumented.
+  describe('lazily defined methods', () => {
+    let fs, dirname, lazyAccessorShape
+
+    before(async () => {
+      // Capture the pristine descriptor shape before the hook wraps `fs`: on Node
+      // versions that define `opendir` as a lazy getter+setter accessor we assert
+      // the wrap preserves that shape; on versions where it is already a data
+      // property there is no accessor to preserve.
+      lazyAccessorShape = typeof Object.getOwnPropertyDescriptor(require('fs'), 'opendir')?.get === 'function'
+
+      await agent.load('fs', undefined, { flushInterval: 1 })
+      fs = require('fs')
+      dirname = fs.mkdtempSync(path.join(os.tmpdir(), 'dd-fs-opendir-'))
+    })
+
+    after(() => {
+      fs.rmdirSync(dirname)
+    })
+
+    it('instruments opendirSync while preserving its descriptor shape', () => {
+      // On Node 20 `opendirSync` is a lazy getter+setter accessor; the wrap must
+      // keep it an accessor pair (a downstream consumer may inspect the descriptor
+      // or assign to it on that version), not flatten it to a data property.
+      const descriptor = Object.getOwnPropertyDescriptor(fs, 'opendirSync')
+      if (lazyAccessorShape) {
+        assert.strictEqual(typeof descriptor.get, 'function', 'opendirSync getter must be preserved')
+        assert.strictEqual(typeof descriptor.set, 'function', 'opendirSync setter must be preserved')
+      }
+
+      const operations = []
+      const onStart = (ctx) => operations.push({ operation: ctx.operation, path: ctx.path })
+
+      opStartCh.subscribe(onStart)
+      try {
+        fs.opendirSync(dirname).closeSync()
+      } finally {
+        opStartCh.unsubscribe(onStart)
+      }
+
+      assert.ok(
+        operations.some(({ operation, path: opPath }) => operation === 'opendirSync' && opPath === dirname),
+        `Expected an opendirSync start for ${dirname}, got ${JSON.stringify(operations)}`
+      )
+    })
+
+    it('instruments opendir while preserving its descriptor shape', async () => {
+      const descriptor = Object.getOwnPropertyDescriptor(fs, 'opendir')
+      if (lazyAccessorShape) {
+        assert.strictEqual(typeof descriptor.get, 'function', 'opendir getter must be preserved')
+        assert.strictEqual(typeof descriptor.set, 'function', 'opendir setter must be preserved')
+      }
+
+      const operations = []
+      const onStart = (ctx) => operations.push({ operation: ctx.operation, path: ctx.path })
+
+      opStartCh.subscribe(onStart)
+      try {
+        const dir = await new Promise((resolve, reject) => {
+          fs.opendir(dirname, (error, openedDir) => error ? reject(error) : resolve(openedDir))
+        })
+        dir.closeSync()
+      } finally {
+        opStartCh.unsubscribe(onStart)
+      }
+
+      assert.ok(
+        operations.some(({ operation, path: opPath }) => operation === 'opendir' && opPath === dirname),
+        `Expected an opendir start for ${dirname}, got ${JSON.stringify(operations)}`
+      )
+    })
+  })
 })
diff --git a/packages/datadog-instrumentations/test/helpers/rewriter/loader.spec.mjs b/packages/datadog-instrumentations/test/helpers/rewriter/loader.spec.mjs
index dad773e6da..fdc68672ca 100644
--- a/packages/datadog-instrumentations/test/helpers/rewriter/loader.spec.mjs
+++ b/packages/datadog-instrumentations/test/helpers/rewriter/loader.spec.mjs
@@ -1,20 +1,36 @@
 import assert from 'node:assert/strict'
 import { spawnSync } from 'node:child_process'
 import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs'
+import { createRequire } from 'node:module'
 import { tmpdir } from 'node:os'
 import { dirname, join, resolve } from 'node:path'
 import { fileURLToPath, pathToFileURL } from 'node:url'
 
 import { supportsSyncHooks } from 'import-in-the-middle/create-hook.mjs'
-import { describe, it } from 'mocha'
-
-import { load, loadSync } from '../../../src/helpers/rewriter/loader.mjs'
+import { before, describe, it } from 'mocha'
 
+const require = createRequire(import.meta.url)
 const source = 'export function getTracer () { return "tracer" }\n'
 const testDirectory = dirname(fileURLToPath(import.meta.url))
 const repositoryRoot = resolve(testDirectory, '../../../../..')
 
 describe('rewriter loader', () => {
+  let load
+  let loadSync
+
+  before(async () => {
+    // require(esm) keeps the loader on nyc's CommonJS instrumentation path so its
+    // transforms count as covered. Without require(esm), nyc's .mjs require extension
+    // feeds the module to the CommonJS compiler, which throws on its ESM `import`.
+    // The property is absent (undefined) before Node 20.19/22.10, which is the false branch.
+    // eslint-disable-next-line n/no-unsupported-features/node-builtins
+    const rewriterLoader = process.features.require_module
+      ? require('../../../src/helpers/rewriter/loader.mjs')
+      : await import('../../../src/helpers/rewriter/loader.mjs')
+    load = rewriterLoader.load
+    loadSync = rewriterLoader.loadSync
+  })
+
   it('rewrites async loader results', async () => {
     const url = createAiModuleUrl()
     const result = await load(url, { format: 'module' }, () => ({ format: 'module', source }))
diff --git a/packages/datadog-plugin-apollo/test/index.spec.js b/packages/datadog-plugin-apollo/test/index.spec.js
index 1345c371ac..1fd48cb5e0 100644
--- a/packages/datadog-plugin-apollo/test/index.spec.js
+++ b/packages/datadog-plugin-apollo/test/index.spec.js
@@ -4,6 +4,7 @@ const assert = require('node:assert/strict')
 const { inspect } = require('node:util')
 
 const axios = require('axios')
+const semver = require('semver')
 const sinon = require('sinon')
 
 const { ERROR_MESSAGE, ERROR_TYPE, ERROR_STACK } = require('../../dd-trace/src/constants.js')
@@ -74,7 +75,7 @@ describe('Plugin', () => {
   }
 
   describe('@apollo/gateway', () => {
-    withVersions('apollo', '@apollo/gateway', version => {
+    withVersions('apollo', '@apollo/gateway', (version, moduleName, resolvedVersion) => {
       after(() => {
         return agent.close()
       })
@@ -419,7 +420,7 @@ describe('Plugin', () => {
               // the call to  the recordExceptions() method by ApolloGateway
               // in version 2.3.0, there is no recordExceptions method thus we can't ever attach an error to the
               // fetch span but instead the error will be propagated to the request span and be set there
-              if (version > '2.3.0') {
+              if (semver.gt(resolvedVersion, '2.3.0')) {
                 assertObjectContains(traces[0][3], {
                   error: 1,
                   meta: {
diff --git a/packages/datadog-plugin-aws-durable-execution-sdk-js/src/client.js b/packages/datadog-plugin-aws-durable-execution-sdk-js/src/client.js
index 0974490065..ff18741995 100644
--- a/packages/datadog-plugin-aws-durable-execution-sdk-js/src/client.js
+++ b/packages/datadog-plugin-aws-durable-execution-sdk-js/src/client.js
@@ -1,7 +1,7 @@
 'use strict'
 
 const ClientPlugin = require('../../dd-trace/src/plugins/client')
-const { addOpMeta, unwrapDurableError } = require('./util')
+const { addOpMeta, getStepDataForNext, unwrapDurableError } = require('./util')
 
 class AwsDurableExecutionSdkJsClientPlugin extends ClientPlugin {
   static id = 'aws-durable-execution-sdk-js'
@@ -29,7 +29,7 @@ class AwsDurableExecutionSdkJsClientPlugin extends ClientPlugin {
     if (operationName) {
       meta['aws.durable.operation_name'] = operationName
     }
-    addOpMeta(meta, ctx.self)
+    addOpMeta(meta, getStepDataForNext(ctx.self))
 
     this.startSpan(this.operationName(), {
       resource: operationName,
diff --git a/packages/datadog-plugin-aws-durable-execution-sdk-js/src/context.js b/packages/datadog-plugin-aws-durable-execution-sdk-js/src/context.js
index 513da12488..b9dd0b874e 100644
--- a/packages/datadog-plugin-aws-durable-execution-sdk-js/src/context.js
+++ b/packages/datadog-plugin-aws-durable-execution-sdk-js/src/context.js
@@ -2,7 +2,7 @@
 
 const { storage } = require('../../datadog-core')
 const TracingPlugin = require('../../dd-trace/src/plugins/tracing')
-const { addOpMeta, unwrapDurableError } = require('./util')
+const { addOpMeta, getOperationAttempt, getStepDataForNext, unwrapDurableError } = require('./util')
 
 // Span names whose direct children must keep the default resource.
 // These can have very high cardinality which is undesireable in the resource.
@@ -41,12 +41,18 @@ class BaseContextPlugin extends TracingPlugin {
     if (operationName) {
       meta['aws.durable.operation_name'] = operationName
     }
-    addOpMeta(meta, ctx.self)
+    const stepInfo = getStepDataForNext(ctx.self)
+    addOpMeta(meta, stepInfo)
+
+    const metrics = this.constructor.retryable
+      ? { 'aws.durable.operation_attempt': getOperationAttempt(stepInfo.stepData) }
+      : undefined
 
     this.startSpan(spanName, {
       resource,
       kind: this.constructor.kind,
       meta,
+      metrics,
     }, ctx)
 
     return ctx.currentStore
@@ -71,11 +77,12 @@ class BaseContextPlugin extends TracingPlugin {
   }
 }
 
-function makeContextPlugin (method, spanName) {
+function makeContextPlugin (method, spanName, { retryable }) {
   return class extends BaseContextPlugin {
     static prefix = `tracing:orchestrion:@aws/durable-execution-sdk-js:DurableContextImpl_${method}`
     static settleChannel = `apm:aws-durable-execution-sdk-js:${method}:settle`
     static spanName = spanName
+    static retryable = retryable
   }
 }
 
@@ -83,6 +90,7 @@ class RunInChildContextPlugin extends BaseContextPlugin {
   static prefix = 'tracing:orchestrion:@aws/durable-execution-sdk-js:DurableContextImpl_runInChildContext'
   static settleChannel = 'apm:aws-durable-execution-sdk-js:runInChildContext:settle'
   static spanName = 'aws.durable.child_context'
+  static retryable = false
 
   bindStart (ctx) {
     if (SUPPRESSED_CHILD_CONTEXT_SUBTYPES.has(getRunInChildContextSubType(ctx))) {
@@ -103,12 +111,12 @@ function getRunInChildContextSubType (ctx) {
 }
 
 module.exports = {
-  step: makeContextPlugin('step', 'aws.durable.step'),
-  wait: makeContextPlugin('wait', 'aws.durable.wait'),
-  waitForCondition: makeContextPlugin('waitForCondition', 'aws.durable.wait_for_condition'),
-  waitForCallback: makeContextPlugin('waitForCallback', 'aws.durable.wait_for_callback'),
-  createCallback: makeContextPlugin('createCallback', 'aws.durable.create_callback'),
-  map: makeContextPlugin('map', 'aws.durable.map'),
-  parallel: makeContextPlugin('parallel', 'aws.durable.parallel'),
+  step: makeContextPlugin('step', 'aws.durable.step', { retryable: true }),
+  wait: makeContextPlugin('wait', 'aws.durable.wait', { retryable: false }),
+  waitForCondition: makeContextPlugin('waitForCondition', 'aws.durable.wait_for_condition', { retryable: true }),
+  waitForCallback: makeContextPlugin('waitForCallback', 'aws.durable.wait_for_callback', { retryable: false }),
+  createCallback: makeContextPlugin('createCallback', 'aws.durable.create_callback', { retryable: false }),
+  map: makeContextPlugin('map', 'aws.durable.map', { retryable: false }),
+  parallel: makeContextPlugin('parallel', 'aws.durable.parallel', { retryable: false }),
   runInChildContext: RunInChildContextPlugin,
 }
diff --git a/packages/datadog-plugin-aws-durable-execution-sdk-js/src/util.js b/packages/datadog-plugin-aws-durable-execution-sdk-js/src/util.js
index 5236fb4f3c..d2f1303697 100644
--- a/packages/datadog-plugin-aws-durable-execution-sdk-js/src/util.js
+++ b/packages/datadog-plugin-aws-durable-execution-sdk-js/src/util.js
@@ -2,27 +2,63 @@
 
 const { createHash } = require('node:crypto')
 
+// A checkpoint in one of these terminal states means the operation is served from the checkpoint
+// on a replay rather than executed: the SDK reloads a SUCCEEDED result or re-raises a FAILED error
+// without running the user function. Both also carry the 1-indexed attempt that reached the terminal
+// state, so both need the same normalization to agree with the 0-indexed live run.
+const REPLAYED_STATUSES = new Set(['SUCCEEDED', 'FAILED'])
+
 /**
- * Populates the replay and operation_id tags for the op the DurableContextImpl is about to
- * run, deriving both from a single `getNextStepId()` call. `aws.durable.replayed` is always
- * set ('true' when the next stepId already has a SUCCEEDED checkpoint entry, i.e. the op will
- * be served from the SDK's checkpoint). `aws.durable.operation_id` — the 16-hex-char MD5 of
- * the stepId, mirroring the SDK's internal calculation — is only added when a stepId exists.
- * @param {Record<string, string>} meta - The span meta/tags object to populate.
+ * Resolves the SDK's next stepId and its checkpoint entry in a single pass, so one span start can
+ * feed both addOpMeta and getOperationAttempt without traversing the SDK internals twice. `stepData`
+ * is undefined when there is no next stepId, or no checkpoint entry exists for it yet.
  * @param {object} [ctxImpl] - The DurableContextImpl about to run the op.
- * @returns {void}
+ * @returns {{ stepId: string | undefined, stepData: object | undefined }}
  */
-function addOpMeta (meta, ctxImpl) {
+function getStepDataForNext (ctxImpl) {
   const stepId = ctxImpl?.getNextStepId?.()
+  const stepData = stepId ? ctxImpl?._executionContext?.getStepData?.(stepId) : undefined
+  return { stepId, stepData }
+}
+
+/**
+ * Populates the replay and operation_id tags from a pre-resolved step lookup (see
+ * getStepDataForNext). `aws.durable.replayed` is always set ('true' when the next stepId already
+ * has a terminal checkpoint entry — SUCCEEDED or FAILED — i.e. the op will be served from the SDK's
+ * checkpoint rather than executed). `aws.durable.operation_id` — the 16-hex-char MD5 of the stepId,
+ * mirroring the SDK's internal calculation — is only added when a stepId exists.
+ * @param {Record<string, string>} meta - The span meta/tags object to populate.
+ * @param {{ stepId?: string, stepData?: object }} stepInfo - Resolved next stepId and checkpoint entry.
+ * @returns {void}
+ */
+function addOpMeta (meta, { stepId, stepData }) {
   if (!stepId) {
     meta['aws.durable.replayed'] = 'false'
     return
   }
-  const stepData = ctxImpl?._executionContext?.getStepData?.(stepId)
-  meta['aws.durable.replayed'] = String(stepData?.Status === 'SUCCEEDED')
+  meta['aws.durable.replayed'] = String(REPLAYED_STATUSES.has(stepData?.Status))
   meta['aws.durable.operation_id'] = createHash('md5').update(stepId).digest('hex').slice(0, 16)
 }
 
+/**
+ * Returns the 0-indexed attempt number for the op (0 original, 1 first retry, …) from a pre-resolved
+ * checkpoint entry (see getStepDataForNext), defaulting to 0 before any checkpoint exists.
+ *
+ * StepDetails.Attempt is indexed differently depending on checkpoint status: on a pending/retry
+ * checkpoint it's the count of prior failed attempts (already 0-indexed), but on a terminal
+ * checkpoint read on replay (SUCCEEDED or FAILED) it's the 1-indexed attempt that reached that
+ * state. We subtract 1 in the terminal case so a replay agrees with the original run, flooring at
+ * 0 since the 1-indexing is observed server behavior, not an SDK guarantee.
+ *
+ * @param {object} [stepData] - The checkpoint entry for the next stepId.
+ * @returns {number}
+ */
+function getOperationAttempt (stepData) {
+  const attempt = stepData?.StepDetails?.Attempt
+  if (!Number.isFinite(attempt)) return 0
+  return REPLAYED_STATUSES.has(stepData.Status) ? Math.max(0, attempt - 1) : attempt
+}
+
 /**
  * The SDK wraps user errors in typed classes (StepError, ChildContextError, etc.); we follow the
  * `.cause` chain to recover the user's original Error. SDK wrappers expose a string `errorType`
@@ -40,4 +76,4 @@ function unwrapDurableError (ctx) {
   return err
 }
 
-module.exports = { addOpMeta, unwrapDurableError }
+module.exports = { addOpMeta, getOperationAttempt, getStepDataForNext, unwrapDurableError }
diff --git a/packages/datadog-plugin-aws-durable-execution-sdk-js/test/index.spec.js b/packages/datadog-plugin-aws-durable-execution-sdk-js/test/index.spec.js
index b98751f4b6..dad750351d 100644
--- a/packages/datadog-plugin-aws-durable-execution-sdk-js/test/index.spec.js
+++ b/packages/datadog-plugin-aws-durable-execution-sdk-js/test/index.spec.js
@@ -125,6 +125,12 @@ createIntegrationTestSuite('aws-durable-execution-sdk-js', '@aws/durable-executi
     })
   })
 
+  // Derived from the plugin's static retryable property — stays in sync automatically.
+  const contextPlugins = require('../src/context')
+  const RETRYABLE_SPAN_NAMES = new Set(
+    Object.values(contextPlugins).filter(cls => cls.retryable).map(cls => cls.spanName)
+  )
+
   for (const { span, operationName, run, opts, disableCrossInvocationTracing } of [
     {
       span: 'aws.durable.step',
@@ -183,6 +189,14 @@ createIntegrationTestSuite('aws-durable-execution-sdk-js', '@aws/durable-executi
         })
         assert.match(matched.meta?.['aws.durable.operation_id'] ?? '', OPERATION_ID_RE)
         assert.notEqual(matched.error, 1, `${span} happy path should not be errored`)
+        if (RETRYABLE_SPAN_NAMES.has(span)) {
+          // 0-indexed: original attempt has 0 prior failures.
+          assert.equal(matched.metrics?.['aws.durable.operation_attempt'], 0,
+            `${span} should carry aws.durable.operation_attempt`)
+        } else {
+          assert.equal(matched.metrics?.['aws.durable.operation_attempt'], undefined,
+            `${span} must not carry aws.durable.operation_attempt`)
+        }
       })
       const invoke = () => invokeHandler(async (event, ctx) => run(ctx), opts)
       await (disableCrossInvocationTracing ? withCrossInvocationTracingDisabled(invoke) : invoke())
@@ -341,18 +355,25 @@ createIntegrationTestSuite('aws-durable-execution-sdk-js', '@aws/durable-executi
   })
 
   it('checkpoint plugin: fail-then-succeed retry produces a span per attempt', async () => {
-    const failedAttemptSpan = agent.assertSomeTraces(traces => assertSpanByName(traces, {
-      name: 'aws.durable.step',
-      resource: 'retry-step',
-      meta: { 'error.type': 'Error', 'error.message': 'transient failure' },
-      error: 1,
-    }))
+    const failedAttemptSpan = agent.assertSomeTraces(traces => {
+      const span = assertSpanByName(traces, {
+        name: 'aws.durable.step',
+        resource: 'retry-step',
+        meta: { 'error.type': 'Error', 'error.message': 'transient failure' },
+        error: 1,
+      })
+      // Original attempt: 0 prior failed attempts.
+      assert.equal(span.metrics?.['aws.durable.operation_attempt'], 0,
+        'failed original attempt should carry aws.durable.operation_attempt=0')
+    })
     const succeededAttemptSpan = agent.assertSomeTraces(traces => {
       const span = traces.flat().find(s =>
-        s.name === 'aws.durable.step' && s.resource === 'retry-step'
+        s.name === 'aws.durable.step' && s.resource === 'retry-step' && s.error !== 1
       )
-      assert.ok(span, 'expected step span')
-      assert.notEqual(span.error, 1, 'successful retry attempt must not be tagged as errored')
+      assert.ok(span, 'expected successful step span')
+      // First retry: 1 prior failed attempt.
+      assert.equal(span.metrics?.['aws.durable.operation_attempt'], 1,
+        'successful retry attempt should carry aws.durable.operation_attempt=1')
     }, { timeoutMs: 5000 })
     const successfulExecuteSpan = agent.assertSomeTraces(traces => assertSpanByName(traces, {
       name: 'aws.durable.execute',
@@ -373,6 +394,118 @@ createIntegrationTestSuite('aws-durable-execution-sdk-js', '@aws/durable-executi
     return Promise.all([failedAttemptSpan, succeededAttemptSpan, successfulExecuteSpan])
   })
 
+  it('checkpoint plugin: replayed step that succeeded first try reports operation_attempt=0', async () => {
+    const replayedStep = agent.assertSomeTraces(traces => {
+      const span = traces.flat().find(s =>
+        s.name === 'aws.durable.step' &&
+        s.resource === 'first-try-step' &&
+        s.meta?.['aws.durable.replayed'] === 'true'
+      )
+      assert.ok(span, 'expected a replayed first-try-step span')
+      // The step succeeded on its first attempt. On replay the SDK reloads the
+      // SUCCEEDED checkpoint, whose StepDetails.Attempt is the 1-indexed number of
+      // the attempt that succeeded (1), not the "prior failed attempts" count used
+      // on the live run (0). We must normalize back to 0 so the replay agrees with
+      // the original attempt span.
+      assert.equal(span.metrics?.['aws.durable.operation_attempt'], 0,
+        'replayed first-try step should carry aws.durable.operation_attempt=0')
+    }, { timeoutMs: 5000 })
+
+    await invokeHandler(async (event, ctx) => {
+      await ctx.step('first-try-step', async () => 'ok')
+      await ctx.wait('suspend-trigger', { seconds: 1 })
+    })
+
+    return replayedStep
+  })
+
+  it('checkpoint plugin: replayed step that failed permanently reports normalized operation_attempt', async () => {
+    const replayedFailedStep = agent.assertSomeTraces(traces => {
+      const span = traces.flat().find(s =>
+        s.name === 'aws.durable.step' &&
+        s.resource === 'always-fails' &&
+        s.meta?.['aws.durable.replayed'] === 'true'
+      )
+      assert.ok(span, 'expected a replayed FAILED step span')
+      // The step exhausts its retries and fails on its 2nd attempt. On replay the SDK reloads the
+      // FAILED checkpoint (re-raising without running the body), whose StepDetails.Attempt is the
+      // 1-indexed attempt that failed (2). A FAILED checkpoint is a replay just like a SUCCEEDED
+      // one, so it is tagged replayed=true and normalized back to the live 0-indexed final attempt.
+      assert.equal(span.metrics?.['aws.durable.operation_attempt'], 1,
+        'replayed FAILED step should carry the normalized operation_attempt=1')
+    }, { timeoutMs: 8000 })
+
+    await invokeHandler(async (event, ctx) => {
+      try {
+        await ctx.step(
+          'always-fails',
+          async () => { throw new Error('permanent failure') },
+          { retryStrategy: (error, attempt) => ({ shouldRetry: attempt < 2, delay: { seconds: 1 } }) }
+        )
+      } catch {
+        // The durable step surfaces the permanent failure; swallow it so the execution continues
+        // to the wait below, whose replay re-reads the now-FAILED checkpoint.
+      }
+      await ctx.wait('suspend-trigger', { seconds: 1 })
+    })
+
+    return replayedFailedStep
+  })
+
+  // waitForCondition is the other retryable op. Its StepDetails.Attempt follows the
+  // same convention as step (live: prior-attempt count; SUCCEEDED replay: 1-indexed
+  // attempt that succeeded), so it must get the same replay normalization. This guards
+  // against the SDK diverging the two operations' attempt semantics in the future.
+  it('checkpoint plugin: replayed waitForCondition that passed first check reports operation_attempt=0', async () => {
+    const replayedCondition = agent.assertSomeTraces(traces => {
+      const span = traces.flat().find(s =>
+        s.name === 'aws.durable.wait_for_condition' &&
+        s.resource === 'first-check-condition' &&
+        s.meta?.['aws.durable.replayed'] === 'true'
+      )
+      assert.ok(span, 'expected a replayed first-check-condition span')
+      assert.equal(span.metrics?.['aws.durable.operation_attempt'], 0,
+        'replayed first-check waitForCondition should carry aws.durable.operation_attempt=0')
+    }, { timeoutMs: 5000 })
+
+    await invokeHandler(async (event, ctx) => {
+      await ctx.waitForCondition('first-check-condition', async () => 'done', {
+        initialState: 'pending',
+        waitStrategy: () => ({ shouldContinue: false }),
+      })
+      await ctx.wait('suspend-trigger', { seconds: 1 })
+    })
+
+    return replayedCondition
+  })
+
+  // Live multi-poll: the first check returns shouldContinue:true, forcing a second poll. Each poll
+  // is a separate retryable waitForCondition span, and the second carries operation_attempt=1. This
+  // is the only path that exercises getOperationAttempt's live (non-replay) branch at attempt>0 for
+  // waitForCondition — without it the op is only ever covered at attempt=0, so a future SDK that
+  // indexed waitForCondition's StepDetails.Attempt differently from step's would slip through.
+  it('checkpoint plugin: waitForCondition reports operation_attempt=1 on its second poll', async () => {
+    const secondPollSpan = agent.assertSomeTraces(traces => {
+      const span = traces.flat().find(s =>
+        s.name === 'aws.durable.wait_for_condition' &&
+        s.resource === 'multi-poll-condition' &&
+        s.metrics?.['aws.durable.operation_attempt'] === 1
+      )
+      assert.ok(span, 'expected a second-poll waitForCondition span with operation_attempt=1')
+    }, { timeoutMs: 5000 })
+
+    let polls = 0
+    await invokeHandler(async (event, ctx) => {
+      await ctx.waitForCondition('multi-poll-condition', async () => 'done', {
+        initialState: 'pending',
+        waitStrategy: () => ({ shouldContinue: polls++ < 1, delay: { seconds: 1 } }),
+      })
+    })
+    assert.equal(polls, 2, 'expected the condition to be polled twice (initial + one retry)')
+
+    return secondPollSpan
+  })
+
   // Regression coverage for the SDK "safe paths" the trace-checkpoint hook relies on
   // (see packages/datadog-plugin-aws-durable-execution-sdk-js/src/trace-checkpoint.js).
   // These exercise the real @aws/durable-execution-sdk-js + @aws/durable-execution-sdk-js-testing
diff --git a/packages/datadog-plugin-aws-sdk/test/bedrockruntime.spec.js b/packages/datadog-plugin-aws-sdk/test/bedrockruntime.spec.js
index 40891e23b3..7011743938 100644
--- a/packages/datadog-plugin-aws-sdk/test/bedrockruntime.spec.js
+++ b/packages/datadog-plugin-aws-sdk/test/bedrockruntime.spec.js
@@ -25,7 +25,7 @@ describe('Plugin', () => {
 
         before(function () {
           this.timeout(10_000)
-          const requireVersion = version === '3.0.0' ? '3.422.0' : '>=3.422.0'
+          const requireVersion = version === '3.0.0' ? '3.422.0' : '3'
           AWS = require(`../../../versions/${bedrockRuntimeClientName}@${requireVersion}`).get()
           const NodeHttpHandler =
             require(`../../../versions/${bedrockRuntimeClientName}@${requireVersion}`)
diff --git a/packages/datadog-plugin-child_process/test/index.spec.js b/packages/datadog-plugin-child_process/test/index.spec.js
index 94b07fb688..567adbad93 100644
--- a/packages/datadog-plugin-child_process/test/index.spec.js
+++ b/packages/datadog-plugin-child_process/test/index.spec.js
@@ -1,6 +1,7 @@
 'use strict'
 
 const assert = require('node:assert/strict')
+const events = require('node:events')
 
 const { after, afterEach, before, beforeEach, describe, it } = require('mocha')
 const sinon = require('sinon')
@@ -386,31 +387,36 @@ describe('Child process plugin', () => {
     // BLUEBIRD REGRESSION TEST - Prevents "this._then is not a function" bug
 
     let childProcess, tracer, util
-    let originalPromise
     let Bluebird
 
-    beforeEach(async () => {
+    // The regression only needs Bluebird to be the global `Promise` at the
+    // moment `util.promisify`/the wrapped child_process method runs, since that
+    // is when the instrumentation does `Promise.resolve(...).then(...)`. Holding
+    // the mutation across the awaited span round-trip leaks it into the shared
+    // mock agent and tracer, flip-flopping the process-wide `Promise` while the
+    // next test runs. Scope the mutation to the synchronous call and restore it
+    // before awaiting.
+    function withBluebird (fn) {
+      const original = global.Promise
+      global.Promise = Bluebird
+      try {
+        return fn()
+      } finally {
+        global.Promise = original
+      }
+    }
+
+    before(async () => {
       tracer = await agent.load('child_process', undefined, { flushInterval: 1 })
       childProcess = require('child_process')
       util = require('util')
       tracer.use('child_process', { enabled: true })
       Bluebird = require('../../../versions/bluebird').get()
-
-      originalPromise = global.Promise
-      global.Promise = Bluebird
     })
 
-    afterEach(() => {
-      global.Promise = originalPromise
-      return agent.close()
-    })
+    after(() => agent.close())
 
     it('should not crash with "this._then is not a function" when using Bluebird promises', async () => {
-      const execFileAsync = util.promisify(childProcess.execFile)
-
-      assert.strictEqual(global.Promise, Bluebird)
-      assert.ok(global.Promise.version)
-
       const expectedPromise = expectSomeSpan(agent, {
         type: 'system',
         name: 'command_execution',
@@ -421,36 +427,40 @@ describe('Child process plugin', () => {
         },
       })
 
-      const result = await execFileAsync('echo', ['bluebird-test'])
-      assert.ok(result)
-      assert.strictEqual(result.stdout, 'bluebird-test\n')
+      const callPromise = withBluebird(() => {
+        assert.strictEqual(global.Promise, Bluebird)
+        assert.ok(/** @type {{ version?: string }} */ (global.Promise).version)
+        return util.promisify(childProcess.execFile)('echo', ['bluebird-test'])
+      })
 
-      return expectedPromise
+      await Promise.all([expectedPromise, (async () => {
+        const result = await callPromise
+        assert.ok(result)
+        assert.strictEqual(result.stdout, 'bluebird-test\n')
+      })()])
     })
 
     it('should work with concurrent Bluebird promise calls', async () => {
-      const execFileAsync = util.promisify(childProcess.execFile)
-
-      const promises = []
-      for (let i = 0; i < 5; i++) {
-        promises.push(
-          execFileAsync('echo', [`concurrent-test-${i}`])
-            .then(result => {
-              assert.strictEqual(result.stdout, `concurrent-test-${i}\n`)
-              return result
-            })
-        )
-      }
+      const promises = withBluebird(() => {
+        const execFileAsync = util.promisify(childProcess.execFile)
+        const calls = []
+        for (let i = 0; i < 5; i++) {
+          calls.push(
+            execFileAsync('echo', [`concurrent-test-${i}`])
+              .then(result => {
+                assert.strictEqual(result.stdout, `concurrent-test-${i}\n`)
+                return result
+              })
+          )
+        }
+        return calls
+      })
 
       const results = await Promise.all(promises)
       assert.strictEqual(results.length, 5)
     })
 
     it('should handle Bluebird promise rejection properly', async () => {
-      global.Promise = Bluebird
-
-      const execFileAsync = util.promisify(childProcess.execFile)
-
       const expectedPromise = expectSomeSpan(agent, {
         type: 'system',
         name: 'command_execution',
@@ -461,30 +471,32 @@ describe('Child process plugin', () => {
         },
       })
 
-      try {
-        await execFileAsync('node', ['-invalidFlag'], { stdio: 'pipe' })
-        throw new Error('Expected command to fail')
-      } catch (error) {
-        assert.ok(error)
-        assert.ok(error.code)
-      }
+      const callPromise = withBluebird(() =>
+        util.promisify(childProcess.execFile)('node', ['-invalidFlag'], { stdio: 'pipe' }))
 
-      return expectedPromise
+      await Promise.all([expectedPromise, assert.rejects(callPromise, error => {
+        assert.ok(error.code)
+        return true
+      })])
     })
 
     it('should work with util.promisify when global Promise is Bluebird', async () => {
-      // Re-require util to get Bluebird-aware promisify
-      delete require.cache[require.resolve('util')]
-      const utilWithBluebird = require('util')
-
-      const execFileAsync = utilWithBluebird.promisify(childProcess.execFile)
+      const expectedPromise = expectSomeSpan(agent, {
+        type: 'system',
+        name: 'command_execution',
+        error: 0,
+        meta: {
+          component: 'subprocess',
+          'cmd.exec': '["echo","util-promisify-test"]',
+        },
+      })
 
-      const promise = execFileAsync('echo', ['util-promisify-test'])
-      assert.strictEqual(promise.constructor, Bluebird)
-      assert.ok(promise.constructor.version)
+      const callPromise = withBluebird(() => util.promisify(childProcess.execFile)('echo', ['util-promisify-test']))
 
-      const result = await promise
-      assert.strictEqual(result.stdout, 'util-promisify-test\n')
+      await Promise.all([expectedPromise, (async () => {
+        const result = await callPromise
+        assert.strictEqual(result.stdout, 'util-promisify-test\n')
+      })()])
     })
   })
 
@@ -494,13 +506,14 @@ describe('Child process plugin', () => {
       const execSyncMethods = ['execSync']
       let childProcess, tracer
 
-      beforeEach(async () => {
+      before(async () => {
         tracer = await agent.load('child_process', undefined, { flushInterval: 1 })
         childProcess = require('child_process')
         tracer.use('child_process', { enabled: true })
       })
 
-      afterEach(() => agent.close())
+      after(() => agent.close())
+
       const parentSpanList = [true, false]
       parentSpanList.forEach(hasParentSpan => {
         let parentSpan
@@ -524,19 +537,19 @@ describe('Child process plugin', () => {
 
           methods.forEach(({ methodName, async }) => {
             describe(methodName, () => {
-              it('should be instrumented', (done) => {
-                const expected = {
-                  type: 'system',
-                  name: 'command_execution',
-                  error: 0,
-                  meta: {
-                    component: 'subprocess',
-                    'cmd.shell': 'ls',
-                    'cmd.exit_code': '0',
-                  },
-                }
+              const lsExpected = {
+                type: 'system',
+                name: 'command_execution',
+                error: 0,
+                meta: {
+                  component: 'subprocess',
+                  'cmd.shell': 'ls',
+                  'cmd.exit_code': '0',
+                },
+              }
 
-                expectSomeSpan(agent, expected).then(done, done)
+              it('should be instrumented', (done) => {
+                expectSomeSpan(agent, lsExpected).then(done, done)
 
                 const res = childProcess[methodName]('ls')
                 if (async) {
@@ -544,27 +557,29 @@ describe('Child process plugin', () => {
                 }
               })
 
-              it('should maintain previous span after the execution', (done) => {
+              it('should maintain previous span after the execution', async () => {
+                const drained = expectSomeSpan(agent, lsExpected)
+
                 const res = childProcess[methodName]('ls')
-                const span = storage('legacy').getStore()?.span
-                assert.strictEqual(span, parentSpan)
+                assert.strictEqual(storage('legacy').getStore()?.span, parentSpan)
                 if (async) {
-                  res.on('close', () => {
-                    assert.strictEqual(span, parentSpan)
-                    done()
-                  })
+                  await Promise.all([drained, (async () => {
+                    await events.once(res, 'close')
+                    assert.strictEqual(storage('legacy').getStore()?.span, parentSpan)
+                  })()])
                 } else {
-                  done()
+                  await drained
                 }
               })
 
               if (async) {
-                it('should maintain previous span in the callback', (done) => {
-                  childProcess[methodName]('ls', () => {
-                    const span = storage('legacy').getStore()?.span
-                    assert.strictEqual(span, parentSpan)
-                    done()
-                  })
+                it('should maintain previous span in the callback', async () => {
+                  await Promise.all([expectSomeSpan(agent, lsExpected), new Promise(resolve => {
+                    childProcess[methodName]('ls', () => {
+                      assert.strictEqual(storage('legacy').getStore()?.span, parentSpan)
+                      resolve()
+                    })
+                  })])
                 })
               }
 
@@ -637,13 +652,14 @@ describe('Child process plugin', () => {
       const execSyncMethods = ['execFileSync', 'spawnSync']
       let childProcess, tracer
 
-      beforeEach(async () => {
+      before(async () => {
         tracer = await agent.load('child_process', undefined, { flushInterval: 1 })
         childProcess = require('child_process')
         tracer.use('child_process', { enabled: true })
       })
 
-      afterEach(() => agent.close())
+      after(() => agent.close())
+
       const parentSpanList = [true, false]
       parentSpanList.forEach(parentSpan => {
         describe(`${parentSpan ? 'with' : 'without'} parent span`, () => {
diff --git a/packages/datadog-plugin-cucumber/src/index.js b/packages/datadog-plugin-cucumber/src/index.js
index df01de2da0..4cbef7a43f 100644
--- a/packages/datadog-plugin-cucumber/src/index.js
+++ b/packages/datadog-plugin-cucumber/src/index.js
@@ -130,7 +130,7 @@ class CucumberPlugin extends CiPlugin {
       finishAllTraceSpans(this.testSessionSpan)
       this.telemetry.count(TELEMETRY_TEST_SESSION, {
         provider: this.ciProviderName,
-        autoInjected: !!this._tracerConfig.DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER,
+        autoInjected: !!this._tracerConfig.testOptimization.DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER,
       })
 
       this.libraryConfig = null
diff --git a/packages/datadog-plugin-cypress/src/cypress-plugin.js b/packages/datadog-plugin-cypress/src/cypress-plugin.js
index a34f26d9a0..f0c2357b4d 100644
--- a/packages/datadog-plugin-cypress/src/cypress-plugin.js
+++ b/packages/datadog-plugin-cypress/src/cypress-plugin.js
@@ -390,6 +390,7 @@ class CypressPlugin {
   earlyFlakeDetectionFaultyThreshold = 0
   testsToSkip = []
   skippedTests = []
+  skippedTestIds = new Set()
   skippableTestsCoverage = {}
   testSessionCoverageMap = createCoverageMap()
   hasForcedToRunSuites = false
@@ -473,6 +474,7 @@ class CypressPlugin {
     this.earlyFlakeDetectionFaultyThreshold = 0
     this.testsToSkip = []
     this.skippedTests = []
+    this.skippedTestIds = new Set()
     this.skippableTestsCoverage = {}
     this.testSessionCoverageMap = createCoverageMap()
     this.hasForcedToRunSuites = false
@@ -637,7 +639,7 @@ class CypressPlugin {
 
     this.isTestIsolationEnabled = getIsTestIsolationEnabled(cypressConfig)
 
-    this.rumFlushWaitMillis = getConfig().DD_CIVISIBILITY_RUM_FLUSH_WAIT_MILLIS
+    this.rumFlushWaitMillis = getConfig().testOptimization.DD_CIVISIBILITY_RUM_FLUSH_WAIT_MILLIS
 
     if (!this.isTestIsolationEnabled) {
       log.warn('Test isolation is disabled, retries will not be enabled')
@@ -1148,7 +1150,7 @@ class CypressPlugin {
       this.ciVisEvent(TELEMETRY_EVENT_FINISHED, 'session')
       incrementCountMetric(TELEMETRY_TEST_SESSION, {
         provider: this.ciProviderName,
-        autoInjected: !!getConfig().DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER,
+        autoInjected: !!getConfig().testOptimization.DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER,
       })
 
       finishAllTraceSpans(this.testSessionSpan)
@@ -1386,7 +1388,7 @@ class CypressPlugin {
         return suitePayload
       },
       'dd:beforeEach': (test) => {
-        const { testName, testSuite, isEfdRetry, efdRetryIndex } = test
+        const { testId, testName, testSuite, isEfdRetry, efdRetryIndex } = test
         if (isEfdRetry && this.shouldSkipEfdRetry(testSuite, testName, efdRetryIndex)) {
           return { shouldSkip: true, shouldDiscard: true }
         }
@@ -1398,7 +1400,11 @@ class CypressPlugin {
         const { isAttemptToFix, isDisabled, isQuarantined } = this.getTestProperties(testSuite, testName)
         // skip test
         if (shouldSkip && !isUnskippable) {
-          this.skippedTests.push(test)
+          const skippedTestId = `${testSuite}:${testId || testName}`
+          if (!this.skippedTestIds.has(skippedTestId)) {
+            this.skippedTestIds.add(skippedTestId)
+            this.skippedTests.push(test)
+          }
           this.isTestsSkipped = true
           return { shouldSkip: true }
         }
diff --git a/packages/datadog-plugin-cypress/src/support.js b/packages/datadog-plugin-cypress/src/support.js
index 831f551799..765d31bb7a 100644
--- a/packages/datadog-plugin-cypress/src/support.js
+++ b/packages/datadog-plugin-cypress/src/support.js
@@ -13,6 +13,8 @@ let testManagementTests = {}
 let isImpactedTestsEnabled = false
 let isModifiedTest = false
 let isTestIsolationEnabled = false
+let hasWarnedMissingBeforeEachTaskResult = false
+let hasWarnedMissingBeforeEachRetryResult = false
 // Array of test names that have been retried and the reason
 const retryReasonsByTestName = new Map()
 // Track test errors suppressed by test management so we can still report them to Datadog.
@@ -86,6 +88,47 @@ function getTestProperties (testName) {
   return { isAttemptToFix, isDisabled, isQuarantined }
 }
 
+/**
+ * @param {string} message
+ * @returns {void}
+ */
+function warnMissingBeforeEachTaskResult (message) {
+  // eslint-disable-next-line no-console
+  console.warn(message)
+}
+
+/**
+ * @param {object} test
+ * @returns {Cypress.Chainable<{ traceId?: string, shouldSkip?: boolean, shouldDiscard?: boolean }>}
+ */
+function runBeforeEachTask (test) {
+  return cy.task('dd:beforeEach', test).then((taskResult) => {
+    if (taskResult !== undefined && taskResult !== null) {
+      return taskResult
+    }
+
+    if (!hasWarnedMissingBeforeEachTaskResult) {
+      hasWarnedMissingBeforeEachTaskResult = true
+      warnMissingBeforeEachTaskResult('Datadog Cypress dd:beforeEach task returned no result. Retrying once.')
+    }
+
+    return cy.task('dd:beforeEach', test).then((retryTaskResult) => {
+      if (retryTaskResult !== undefined && retryTaskResult !== null) {
+        return retryTaskResult
+      }
+
+      if (!hasWarnedMissingBeforeEachRetryResult) {
+        hasWarnedMissingBeforeEachRetryResult = true
+        warnMissingBeforeEachTaskResult(
+          'Datadog Cypress dd:beforeEach task returned no result after retry. Continuing with an empty task result.'
+        )
+      }
+
+      return {}
+    })
+  })
+}
+
 // Catch test failures for quarantined tests and suppress them
 // By not re-throwing the error, Cypress marks the test as passed
 // This allows quarantined tests to run but not affect the exit code
@@ -263,7 +306,8 @@ beforeEach(function () {
     originalWindow = win
   })
 
-  cy.task('dd:beforeEach', {
+  runBeforeEachTask({
+    testId: currentTest.id,
     testName,
     testSuite: Cypress.mocha.getRootSuite().file,
     isEfdRetry: Cypress.mocha.getRunner().suite.ctx.currentTest._ddIsEfdRetry,
diff --git a/packages/datadog-plugin-express/src/code_origin.js b/packages/datadog-plugin-express/src/code_origin.js
index 633231ff13..1c802f4c55 100644
--- a/packages/datadog-plugin-express/src/code_origin.js
+++ b/packages/datadog-plugin-express/src/code_origin.js
@@ -31,7 +31,7 @@ class ExpressCodeOriginForSpansPlugin extends Plugin {
       layerTags.set(layer, entryTags(topOfStackFunc))
     }
 
-    if (this._tracerConfig.remoteConfig?.enabled) {
+    if (this._tracerConfig.remoteConfig.DD_REMOTE_CONFIGURATION_ENABLED) {
       // When RC is enabled, use manual subscriptions (always pre-compute)
       // This allows tags to be computed even when CO is disabled, so runtime enabling works
       dc.channel('apm:express:route:added').subscribe(handleRouteAdded)
diff --git a/packages/datadog-plugin-fastify/src/code_origin.js b/packages/datadog-plugin-fastify/src/code_origin.js
index ddda552ff6..0a937324dc 100644
--- a/packages/datadog-plugin-fastify/src/code_origin.js
+++ b/packages/datadog-plugin-fastify/src/code_origin.js
@@ -20,7 +20,7 @@ class FastifyCodeOriginForSpansPlugin extends Plugin {
       web.getContext(req)?.span?.addTags(tags)
     })
 
-    if (this._tracerConfig.remoteConfig?.enabled) {
+    if (this._tracerConfig.remoteConfig.DD_REMOTE_CONFIGURATION_ENABLED) {
       // When RC is enabled, use manual subscription (always pre-computes)
       // This allows tags to be computed even when CO is disabled, so runtime enabling works
       dc.channel('apm:fastify:route:added').subscribe(handleRouteAdded)
diff --git a/packages/datadog-plugin-graphql/src/execute.js b/packages/datadog-plugin-graphql/src/execute.js
index e574910f2d..19785af918 100644
--- a/packages/datadog-plugin-graphql/src/execute.js
+++ b/packages/datadog-plugin-graphql/src/execute.js
@@ -1,21 +1,117 @@
 'use strict'
 
+const dc = require('dc-polyfill')
+
+const { storage } = require('../../datadog-core')
 const TracingPlugin = require('../../dd-trace/src/plugins/tracing')
+const GraphQLParsePlugin = require('./parse')
 const { extractErrorIntoSpanEvent, getSignature } = require('./utils')
 
+const legacyStorage = storage('legacy')
+
+const types = new Set(['query', 'mutation', 'subscription'])
+
+const iastResolveCh = dc.channel('apm:graphql:resolve:start')
+const resolverStartCh = dc.channel('datadog:graphql:resolver:start')
+const updateFieldCh = dc.channel('apm:graphql:resolve:updateField')
+
+// AppSec/WAF abort gate. Published synchronously from bindStart with a
+// payload carrying the abortController; subscribers that call
+// `payload.abortController.abort()` signal a pre-execute abort. bindStart
+// observes the aborted signal by replacing `ctx.arguments[0]` with a Proxy
+// whose getters throw AbortError — the orchestrion-emitted wrapper's
+// `try { __apm$traced() } catch { ...; throw err }` block then propagates
+// the AbortError to the caller of graphql.execute.
+const startExecuteCh = dc.channel('apm:graphql:execute:start')
+
+const contexts = new WeakMap()
+const instrumentedArgs = new WeakSet()
+
+const patchedResolvers = new WeakSet()
+const patchedTypes = new WeakSet()
+
+// Module-level fast path: skip the resolver-side WeakMap lookup entirely
+// when depth=0 disables resolver instrumentation.
+let depthDisabled = false
+
+class AbortError extends Error {
+  constructor (message) {
+    super(message)
+    this.name = 'AbortError'
+  }
+}
+
 class GraphQLExecutePlugin extends TracingPlugin {
   static id = 'graphql'
   static operation = 'execute'
   static type = 'graphql'
   static kind = 'server'
+  static prefix = 'tracing:orchestrion:graphql:apm:graphql:execute'
+
+  // @graphql-tools/executor (used by graphql-yoga) emits on a different channel
+  // prefix because the module name differs. Subscribe to both so Yoga execution
+  // produces graphql.execute spans.
+  static extraPrefixes = [
+    'tracing:orchestrion:@graphql-tools/executor:apm:graphql:execute',
+  ]
+
+  /**
+   * @param {{ depth?: number }} config
+   */
+  configure (config) {
+    super.configure(config)
+    depthDisabled = config.depth === 0
+  }
+
+  addTraceSubs () {
+    super.addTraceSubs()
+
+    for (const prefix of this.constructor.extraPrefixes) {
+      const events = ['start', 'end', 'asyncStart', 'asyncEnd', 'error', 'finish']
+
+      for (const event of events) {
+        const bindName = `bind${event.charAt(0).toUpperCase()}${event.slice(1)}`
+
+        if (this[event]) {
+          this.addSub(`${prefix}:${event}`, message => {
+            this[event](message)
+          })
+        }
+
+        if (this[bindName]) {
+          this.addBind(`${prefix}:${event}`, message => this[bindName](message))
+        }
+      }
+    }
+  }
 
   bindStart (ctx) {
-    const { operation, args, docSource } = ctx
+    const rawArgs = ctx.arguments
+    const objectForm = isObjectForm(rawArgs)
+    const args = readArgs(rawArgs, objectForm)
+
+    // Re-entrant execute() short-circuit (yoga's normalizedExecutor calls
+    // execute internally with the same arguments object — without this we'd
+    // double-span). The contextValue check catches object contexts; the args
+    // check also catches primitive contexts.
+    if (instrumentedArgs.has(rawArgs?.[0])) {
+      ctx.ddSkipped = true
+      return ctx.currentStore
+    }
+
+    const { contextValue } = args
+    if (contextValue && typeof contextValue === 'object' && contexts.has(contextValue)) {
+      ctx.ddSkipped = true
+      return ctx.currentStore
+    }
 
-    const type = operation && operation.operation
-    const name = operation && operation.name && operation.name.value
     const document = args.document
-    const source = this.config.source && document && docSource
+    const docSource = document ? GraphQLParsePlugin.documentSources.get(document) : undefined
+    const operation = getOperation(document, args.operationName)
+
+    const type = operation?.operation
+    const name = operation?.name?.value
+    const source = this.config.source && docSource
 
     ctx.collapse = this.config.collapse
 
@@ -33,25 +129,545 @@ class GraphQLExecutePlugin extends TracingPlugin {
 
     addVariableTags(this.config, span, args.variableValues)
 
+    const abortController = new AbortController()
+
+    // AppSec/WAF synchronous-abort gate. Publish before any resolver-wrapping
+    // work — if a subscriber aborts, none of that work matters because we'll
+    // make execute's body throw AbortError before it reaches any resolvers.
+    // bindStart runs as a bindStore transform on
+    // tracing:orchestrion:graphql:apm:graphql:execute:start, which fires
+    // BEFORE the orchestrion-emitted wrapper publishes its own :start and
+    // BEFORE the wrapped fn runs. The subscriber gets the abortController
+    // synchronously; on return we observe `signal.aborted` and act.
+    if (startExecuteCh.hasSubscribers) {
+      startExecuteCh.publish({ abortController, args })
+      if (abortController.signal.aborted) {
+        // Replace ctx.arguments[0] with a Proxy that throws AbortError on any
+        // property access. The orchestrion wrapper calls
+        // `__apm$wrapped.apply(this, ctx.arguments)`; graphql.execute's body
+        // begins with `const { schema, document, ... } = args` so the
+        // destructure triggers the trap immediately. The wrapper catches and
+        // rethrows, propagating AbortError to graphql.execute's caller.
+        ctx.arguments[0] = new Proxy({}, {
+          get () { throw new AbortError('Aborted') },
+          has () { throw new AbortError('Aborted') },
+        })
+        ctx.ddAborted = true
+        return ctx.currentStore
+      }
+    }
+
+    ctx.ddArgs = setWrappedFieldResolver(rawArgs, args, objectForm, defaultFieldResolver)
+    if (ctx.ddArgs && typeof ctx.ddArgs === 'object') {
+      instrumentedArgs.add(ctx.ddArgs)
+      ctx.ddInstrumentedArgs = ctx.ddArgs
+    }
+
+    const schema = args.schema
+    if (schema) {
+      wrapFields(schema._queryType)
+      wrapFields(schema._mutationType)
+      wrapFields(schema._subscriptionType)
+    }
+
+    const rootCtx = {
+      source: docSource,
+      config: this.config,
+      fields: new Map(),
+      pathCache: new Map(),
+      collapsedPathCache: this.config.collapse ? { byPath: new Map(), byParent: new Map() } : undefined,
+      abortController,
+      executeSpan: span,
+      plugin: this,
+    }
+    ctx.ddRootCtx = rootCtx
+    if (isWeakMapKey(contextValue)) {
+      contexts.set(contextValue, rootCtx)
+      ctx.ddContextValue = contextValue
+    } else {
+      // Primitive / non-keyable contextValue: stash rootCtx on the
+      // orchestrion-scoped store that runStores enters for execute. Wrapped
+      // resolvers read it via legacyStorage.getStore() and it unwinds with the
+      // frame — no enterWith store that leaks past execute.
+      ctx.currentStore.graphqlRootCtx = rootCtx
+    }
+
     return ctx.currentStore
   }
 
-  finish (ctx) {
-    const { res, args } = ctx
+  end (ctx) {
+    if (ctx.ddSkipped) return ctx.parentStore
+
+    const span = ctx?.currentStore?.span || this.activeSpan
+    if (!span) return
+
+    // Synchronous execute() throw (e.g. execute(null, doc)) — error handler
+    // already tagged the span, just finish it.
+    if (ctx.error) {
+      this.#drain(ctx, span)
+      return ctx.parentStore
+    }
+
+    const result = ctx.result
+
+    if (typeof result?.then === 'function') {
+      result.then(
+        (res) => this.#finishSpan(ctx, span, res),
+        (err) => {
+          span.setTag('error', err)
+          this.#drain(ctx, span)
+        }
+      )
+    } else {
+      this.#finishSpan(ctx, span, result)
+    }
+
+    return ctx.parentStore
+  }
+
+  error (ctx) {
+    // Pre-execute WAF abort isn't an error condition — opSpan.error must
+    // stay 0 per master's contract.
+    if (ctx.ddAborted) return
     const span = ctx?.currentStore?.span || this.activeSpan
-    this.config.hooks.execute(span, args, res)
-    if (res?.errors) {
+    if (span && ctx?.error) {
+      span.setTag('error', ctx.error)
+    }
+  }
+
+  #finishSpan (ctx, span, res) {
+    this.config.hooks.execute(span, ctx.ddArgs, res)
+
+    if (res?.errors?.length) {
+      span.setTag('error', res.errors[0])
       for (const err of res.errors) {
         extractErrorIntoSpanEvent(this._tracerConfig, span, err)
       }
     }
-    super.finish(ctx)
 
-    return ctx.parentStore
+    this.#drain(ctx, span)
+  }
+
+  #drain (ctx, span) {
+    span.finish()
+    if (ctx.ddContextValue) {
+      contexts.delete(ctx.ddContextValue)
+    }
+    if (ctx.ddInstrumentedArgs) {
+      instrumentedArgs.delete(ctx.ddInstrumentedArgs)
+    }
+  }
+
+  // Public — called from wrapResolve (free function, crosses class boundary).
+  // Resolve-span creation is inline at first-encounter; deferring to a batch
+  // produces a bursty encoder stall when many spans finish together.
+  startResolveSpan (field, rootCtx, executeSpan, startTime) {
+    const { fieldNode, fieldName, returnType, baseTypeName, variableValues, collapsedKey } = field
+
+    const parent = getParentField(rootCtx, field)
+    const childOf = parent?.span || executeSpan
+
+    const document = rootCtx.source
+    const loc = this.config.source && document && fieldNode && fieldNode.loc
+    const source = loc && document.slice(loc.start, loc.end)
+
+    const span = this.startSpan('graphql.resolve', {
+      service: this.config.service,
+      resource: `${fieldName}:${returnType}`,
+      childOf,
+      type: 'graphql',
+      startTime,
+      meta: {
+        'graphql.field.name': fieldName,
+        'graphql.field.path': collapsedKey,
+        'graphql.field.type': baseTypeName,
+        'graphql.source': source,
+      },
+    }, false)
+
+    if (fieldNode && this.config.variables && fieldNode.arguments) {
+      const variables = this.config.variables(variableValues)
+      for (const arg of fieldNode.arguments) {
+        if (arg.value?.name && arg.value.kind === 'Variable' && variables[arg.value.name.value]) {
+          const name = arg.value.name.value
+          span.setTag(`graphql.variables.${name}`, variables[name])
+        }
+      }
+    }
+
+    return span
+  }
+
+  // Public — called from wrapResolve. endTime reflects when the resolver
+  // actually completed, not when the field record was created.
+  finishResolveSpan (span, field, error, result, endTime) {
+    if (error) span.setTag('error', error)
+
+    if (this.config.hooks.resolve) {
+      this.config.hooks.resolve(span, {
+        fieldName: field.fieldName,
+        path: field.pathString,
+        error: error || null,
+        // Any thenable from any realm — keep undefined so the hook doesn't
+        // accidentally see the unresolved promise.
+        result: typeof result?.then === 'function' ? undefined : result,
+      })
+    }
+
+    span.finish(endTime)
+  }
+}
+
+// --- resolver wrapping --------------------------------------------------------
+
+function wrapResolve (resolve) {
+  if (typeof resolve !== 'function' || patchedResolvers.has(resolve)) return resolve
+
+  function resolveAsync (source, args, contextValue, info) {
+    const hasIastSub = iastResolveCh.hasSubscribers
+    const hasResolverSub = resolverStartCh.hasSubscribers
+
+    // Combined fast-path: depth=0 AND no IAST/AppSec subscriber means nothing
+    // to do — skip rootCtx lookup, path walk, publish gates.
+    if (depthDisabled && !hasIastSub && !hasResolverSub) {
+      return resolve.apply(this, arguments)
+    }
+
+    const rootCtx = contexts.get(contextValue) ?? legacyStorage.getStore()?.graphqlRootCtx
+    if (!rootCtx) return resolve.apply(this, arguments)
+
+    const infoPath = info?.path
+    const config = rootCtx.config
+
+    // pathString built incrementally off the parent's cached value
+    // (rootCtx.pathCache, keyed by path node) — avoids re-walking the whole
+    // path linked-list on every resolver call, which is O(depth) per call for
+    // deeply nested resolvers. Shared between the IAST publish and the field
+    // record. Collapse-aware: list-index segments become '*'.
+    let pathString
+    let collapsedKey
+    if (infoPath) {
+      pathString = buildCachedPathString(infoPath, rootCtx.pathCache, config.collapse)
+      if (config.collapse) collapsedKey = pathString
+    }
+
+    // IAST and AppSec subscribers see EVERY resolver call, regardless of
+    // depth or collapse. The depth knob caps span creation only.
+    if (hasIastSub) {
+      iastResolveCh.publish({ rootCtx, args, info, path: pathToArray(infoPath), pathString })
+    }
+    if (hasResolverSub) {
+      resolverStartCh.publish({
+        abortController: rootCtx.abortController,
+        resolverInfo: getResolverInfo(info, args),
+      })
+    }
+
+    if (depthDisabled || !shouldInstrumentNode(config, infoPath)) {
+      if (rootCtx.abortController?.signal.aborted) {
+        throw new AbortError('Aborted')
+      }
+
+      return resolve.apply(this, arguments)
+    }
+
+    const fieldKey = config.collapse ? buildCachedCollapsedPath(infoPath, rootCtx.collapsedPathCache) : infoPath
+    let field = rootCtx.fields.get(fieldKey)
+    const isFirst = !field
+
+    if (isFirst) {
+      field = {
+        fieldNode: info.fieldNodes?.[0],
+        fieldName: info.fieldName,
+        returnType: info.returnType,
+        baseTypeName: getBaseTypeName(info.returnType),
+        variableValues: info.variableValues,
+        args,
+        infoPath,
+        fieldKey,
+        pathString,
+        collapsedKey: collapsedKey ?? pathString,
+        span: null,
+      }
+      rootCtx.fields.set(fieldKey, field)
+    }
+
+    // Collapsed siblings still publish updateField (master's contract: one
+    // publish per resolver call, even when the span is collapsed) and route
+    // through callInAsyncScope so the abort signal stops them mid-flight.
+    if (!isFirst) {
+      return callInAsyncScope(resolve, this, arguments, rootCtx.abortController, (err) => {
+        if (updateFieldCh.hasSubscribers) {
+          updateFieldCh.publish({ rootCtx, field, error: err, pathString: field.pathString })
+        }
+      })
+    }
+
+    const executeSpan = rootCtx.executeSpan
+    const startTime = executeSpan._getTime()
+    const span = rootCtx.plugin.startResolveSpan(field, rootCtx, executeSpan, startTime)
+    field.span = span
+
+    return callInAsyncScope(resolve, this, arguments, rootCtx.abortController, (err, res) => {
+      const endTime = executeSpan._getTime()
+      rootCtx.plugin.finishResolveSpan(span, field, err, res, endTime || startTime)
+      if (updateFieldCh.hasSubscribers) {
+        updateFieldCh.publish({ rootCtx, field, error: err, pathString: field.pathString })
+      }
+    })
+  }
+
+  patchedResolvers.add(resolveAsync)
+  return resolveAsync
+}
+
+function wrapFields (type) {
+  if (!type?._fields || patchedTypes.has(type)) return
+
+  patchedTypes.add(type)
+
+  for (const field of Object.values(type._fields)) {
+    wrapFieldResolve(field)
+    wrapFieldType(field)
+  }
+}
+
+function wrapFieldResolve (field) {
+  if (!field?.resolve) return
+  field.resolve = wrapResolve(field.resolve)
+}
+
+function wrapFieldType (field) {
+  if (!field?.type) return
+
+  let unwrapped = field.type
+  while (unwrapped.ofType) unwrapped = unwrapped.ofType
+
+  wrapFields(unwrapped)
+}
+
+function callInAsyncScope (fn, thisArg, args, abortController, cb) {
+  cb ??= () => {}
+
+  if (abortController?.signal.aborted) {
+    cb(null, null)
+    throw new AbortError('Aborted')
+  }
+
+  try {
+    const result = fn.apply(thisArg, args)
+    if (typeof result?.then === 'function') {
+      return result.then(
+        res => { cb(null, res); return res },
+        err => { cb(err); throw err }
+      )
+    }
+    cb(null, result)
+    return result
+  } catch (err) {
+    cb(err)
+    throw err
+  }
+}
+
+function pathToArray (path) {
+  let length = 0
+  for (let curr = path; curr; curr = curr.prev) {
+    length += 1
+  }
+
+  const flattened = new Array(length)
+  let index = length
+  for (let curr = path; curr; curr = curr.prev) {
+    flattened[--index] = curr.key
+  }
+  return flattened
+}
+
+// Build the dotted pathString for a resolver's path node, caching per node on
+// rootCtx.pathCache so each call reuses the parent's already-built string
+// instead of re-walking the whole path linked-list (O(1) amortized per call).
+// Collapse-aware: numeric (list-index) segments become '*'. The recursion
+// handles the cold path where a parent node never hit a resolver (graphql
+// inserts a synthetic array-index node between a list field and its items).
+function buildCachedPathString (path, cache, collapse) {
+  const cached = cache.get(path)
+  if (cached !== undefined) return cached
+
+  const key = path.key
+  const segment = collapse && typeof key !== 'string' ? '*' : key
+  const prev = path.prev
+
+  const pathString = prev === undefined
+    ? String(segment)
+    : `${buildCachedPathString(prev, cache, collapse)}.${segment}`
+  cache.set(path, pathString)
+  return pathString
+}
+
+function buildCachedCollapsedPath (path, cache) {
+  if (!path) return
+
+  const cached = cache.byPath.get(path)
+  if (cached !== undefined) return cached
+
+  const segment = typeof path.key === 'string' ? path.key : '*'
+  const prev = path.prev === undefined
+    ? undefined
+    : buildCachedCollapsedPath(path.prev, cache)
+
+  let siblings = cache.byParent.get(prev)
+  if (siblings === undefined) {
+    siblings = new Map()
+    cache.byParent.set(prev, siblings)
+  }
+
+  let collapsedPath = siblings.get(segment)
+  if (collapsedPath === undefined) {
+    collapsedPath = { key: segment, prev }
+    siblings.set(segment, collapsedPath)
   }
+
+  cache.byPath.set(path, collapsedPath)
+  return collapsedPath
+}
+
+// Depth filtering directly on the linked-list node — no array allocation needed.
+// config.depth < 0 means no limit. Only selection-set segments (string keys)
+// count toward depth; list indices are execution artifacts and are transparent.
+// On the v5 line `countListIndices` keeps the legacy behaviour of counting every
+// node when collapsing folds the numeric indices into '*'.
+function shouldInstrumentNode (config, path) {
+  if (config.depth < 0) return true
+
+  let depth = 0
+  if (config.countListIndices) {
+    for (let curr = path; curr; curr = curr.prev) depth++
+  } else {
+    for (let curr = path; curr; curr = curr.prev) {
+      if (typeof curr.key === 'string') depth++
+    }
+  }
+
+  return config.depth >= depth
+}
+
+function getParentField (rootCtx, field) {
+  for (let curr = field.fieldKey?.prev; curr; curr = curr.prev) {
+    const innerField = rootCtx.fields.get(curr)
+    if (innerField) return innerField
+  }
+
+  return null
+}
+
+// Build the resolverInfo payload that AppSec's datadog:graphql:resolver:start
+// subscriber expects: { [fieldName]: { ...args, ...directives } }.
+function getResolverInfo (info, args) {
+  let resolverVars = args ? { ...args } : undefined
+
+  const directives = info.fieldNodes?.[0]?.directives
+  if (Array.isArray(directives)) {
+    for (const directive of directives) {
+      if (directive.arguments.length === 0) continue
+
+      const argList = {}
+      for (const argument of directive.arguments) {
+        argList[argument.name.value] = argument.value.value
+      }
+
+      resolverVars ??= {}
+      resolverVars[directive.name.value] = argList
+    }
+  }
+
+  return resolverVars === undefined ? null : { [info.fieldName]: resolverVars }
+}
+
+// --- arg / context normalization ---------------------------------------------
+
+// graphql.execute accepts either a single args object or positional arguments;
+// the object form is a lone non-array object in slot 0.
+function isObjectForm (args) {
+  return args?.length === 1 && args[0] && typeof args[0] === 'object' && !Array.isArray(args[0])
 }
 
-// span-related
+function readArgs (args, objectForm) {
+  if (!args || args.length === 0) return {}
+
+  if (objectForm) {
+    return args[0]
+  }
+
+  return {
+    schema: args[0],
+    document: args[1],
+    rootValue: args[2],
+    contextValue: args[3],
+    variableValues: args[4],
+    operationName: args[5],
+    fieldResolver: args[6],
+  }
+}
+
+// No user input may be modified. Object-form clones rawArgs[0]; positional
+// form rewrites its own arguments slots (no caller-observable mutation).
+// Returns the readArgs-shaped view of the (possibly cloned) args so the caller
+// doesn't have to re-readArgs after the swap.
+function setWrappedFieldResolver (rawArgs, args, objectForm, defaultFieldResolver) {
+  if (!rawArgs || rawArgs.length === 0) return args
+
+  if (objectForm) {
+    const clone = {
+      ...args,
+      fieldResolver: wrapResolve(args.fieldResolver || defaultFieldResolver),
+    }
+    rawArgs[0] = clone
+    return clone
+  }
+
+  rawArgs[6] = wrapResolve(args.fieldResolver || defaultFieldResolver)
+  if (rawArgs.length < 7) rawArgs.length = 7
+  args.fieldResolver = rawArgs[6]
+  return args
+}
+
+function isWeakMapKey (value) {
+  return value !== null && (typeof value === 'object' || typeof value === 'function')
+}
+
+// Unwrap GraphQL List/NonNull wrappers to get the underlying named type's name.
+// e.g. [Human] → 'Human', [Pet!] → 'Pet', String → 'String'
+function getBaseTypeName (type) {
+  let cursor = type
+  while (cursor && cursor.ofType) cursor = cursor.ofType
+  return cursor?.name
+}
+
+// Fallback resolver used when graphql.execute() is called without an explicit
+// fieldResolver and the schema field has no .resolve. Mirrors graphql's own
+// defaultFieldResolver: property access on source, calling it if it's a function.
+// Defined locally so it survives dd-trace plugin-manager reloads (agent.load()
+// recreates globalThis[Symbol.for('dd-trace')], so capturing defaultFieldResolver
+// via ddGlobal at IITM hook time would lose the reference across test suites).
+function defaultFieldResolver (source, args, contextValue, info) {
+  if ((typeof source === 'object' && source !== null) || typeof source === 'function') {
+    const property = source[info.fieldName]
+    if (typeof property === 'function') return source[info.fieldName](args, contextValue, info)
+    return property
+  }
+}
+
+function getOperation (document, operationName) {
+  if (!document || !Array.isArray(document.definitions)) return
+
+  for (const definition of document.definitions) {
+    if (definition && types.has(definition.operation) &&
+        (!operationName || definition.name?.value === operationName)) {
+      return definition
+    }
+  }
+}
 
 function addVariableTags (config, span, variableValues) {
   if (!variableValues || !config.variables) return
diff --git a/packages/datadog-plugin-graphql/src/index.js b/packages/datadog-plugin-graphql/src/index.js
index 91e79a2f4b..a679c15424 100644
--- a/packages/datadog-plugin-graphql/src/index.js
+++ b/packages/datadog-plugin-graphql/src/index.js
@@ -1,12 +1,12 @@
 'use strict'
 
 const pick = require('../../datadog-core/src/utils/src/pick')
+const { DD_MAJOR } = require('../../../version')
 const CompositePlugin = require('../../dd-trace/src/plugins/composite')
 const log = require('../../dd-trace/src/log')
 const GraphQLExecutePlugin = require('./execute')
 const GraphQLParsePlugin = require('./parse')
 const GraphQLValidatePlugin = require('./validate')
-const GraphQLResolvePlugin = require('./resolve')
 
 class GraphQLPlugin extends CompositePlugin {
   static id = 'graphql'
@@ -15,7 +15,9 @@ class GraphQLPlugin extends CompositePlugin {
       execute: GraphQLExecutePlugin,
       parse: GraphQLParsePlugin,
       validate: GraphQLValidatePlugin,
-      resolve: GraphQLResolvePlugin,
+      // resolve plugin is absorbed into execute: per-field data is recorded
+      // synchronously in wrapResolve, and all graphql.resolve spans are
+      // materialized at execute end.
     }
   }
 
@@ -30,11 +32,15 @@ class GraphQLPlugin extends CompositePlugin {
 // config validator helpers
 
 function validateConfig (config) {
+  const collapse = config.collapse === undefined || !!config.collapse
   return {
     ...config,
     depth: getDepth(config),
     variables: getVariablesFilter(config),
-    collapse: config.collapse === undefined || !!config.collapse,
+    collapse,
+    // v5 counted collapsed list indices toward `depth`, so the same query reached a
+    // different depth depending on `collapse`. v6 counts selection-set depth only.
+    countListIndices: DD_MAJOR < 6 && collapse,
     hooks: getHooks(config),
   }
 }
@@ -60,13 +66,19 @@ function getVariablesFilter (config) {
 }
 
 const noop = () => {}
+const noopHooks = { execute: noop, parse: noop, validate: noop, resolve: undefined }
 
 function getHooks ({ hooks }) {
-  const execute = hooks?.execute ?? noop
-  const parse = hooks?.parse ?? noop
-  const validate = hooks?.validate ?? noop
-
-  return { execute, parse, validate }
+  if (!hooks) return noopHooks
+  return {
+    execute: hooks.execute ?? noop,
+    parse: hooks.parse ?? noop,
+    validate: hooks.validate ?? noop,
+    // No noop fallback: `resolve` runs per-field (hot path); the plugin
+    // gates with `if (this.config.hooks.resolve)` so the absent-hook case
+    // skips both the call and the payload-object allocation.
+    resolve: hooks.resolve,
+  }
 }
 
 module.exports = GraphQLPlugin
diff --git a/packages/datadog-plugin-graphql/src/parse.js b/packages/datadog-plugin-graphql/src/parse.js
index d49ea837d5..ce23f3cae4 100644
--- a/packages/datadog-plugin-graphql/src/parse.js
+++ b/packages/datadog-plugin-graphql/src/parse.js
@@ -2,34 +2,54 @@
 
 const TracingPlugin = require('../../dd-trace/src/plugins/tracing')
 
+const documentSources = new WeakMap()
+
 class GraphQLParsePlugin extends TracingPlugin {
   static id = 'graphql'
   static operation = 'parser'
+  static prefix = 'tracing:orchestrion:graphql:apm:graphql:parser'
 
   bindStart (ctx) {
+    const source = ctx.arguments?.[0]
+
     this.startSpan('graphql.parse', {
       service: this.config.service,
       type: 'graphql',
       meta: {},
     }, ctx)
 
+    ctx.ddSource = source
+
     return ctx.currentStore
   }
 
-  finish (ctx) {
-    const { source, document, docSource } = ctx
+  end (ctx) {
+    const source = ctx.ddSource
+    const document = ctx.result
     const span = ctx?.currentStore?.span || this.activeSpan
 
-    if (this.config.source && document) {
+    let docSource
+    if (document) {
+      if (source) {
+        docSource = source.body || source
+        documentSources.set(document, docSource)
+      } else {
+        docSource = documentSources.get(document)
+      }
+    }
+
+    if (this.config.source && docSource) {
       span.setTag('graphql.source', docSource)
     }
 
     this.config.hooks.parse(span, source, document)
 
-    super.finish(ctx)
+    span.finish()
 
     return ctx.parentStore
   }
 }
 
+GraphQLParsePlugin.documentSources = documentSources
+
 module.exports = GraphQLParsePlugin
diff --git a/packages/datadog-plugin-graphql/src/resolve.js b/packages/datadog-plugin-graphql/src/resolve.js
deleted file mode 100644
index 3d9177f7f7..0000000000
--- a/packages/datadog-plugin-graphql/src/resolve.js
+++ /dev/null
@@ -1,170 +0,0 @@
-'use strict'
-
-const dc = require('dc-polyfill')
-const TracingPlugin = require('../../dd-trace/src/plugins/tracing')
-
-class GraphQLResolvePlugin extends TracingPlugin {
-  static id = 'graphql'
-  static operation = 'resolve'
-
-  /**
-   * @param {{
-   *   rootCtx: {
-   *     source?: string,
-   *     collapse: boolean,
-   *     collapsedFields?: Map<string, { ctx: object }>,
-   *   },
-   *   args: Record<string, unknown>,
-   *   path: { prev: object | undefined, key: string | number },
-   *   pathString: string,
-   *   fieldName: string,
-   *   returnType: { name: string },
-   *   fieldNode: { loc?: { start: number, end: number }, arguments?: object[], directives?: object[] } | undefined,
-   *   variableValues: Record<string, unknown> | undefined,
-   * }} fieldCtx
-   */
-  start (fieldCtx) {
-    if (!shouldInstrument(this.config, fieldCtx.path)) return
-
-    const { rootCtx, args, path, pathString, fieldName, returnType, fieldNode, variableValues } = fieldCtx
-
-    // Siblings 2..N of a collapsed list share the first sibling's span, so
-    // skip span creation here. updateField still fires on the shared ctx and
-    // advances the shared span's finishTime.
-    if (rootCtx.collapse && rootCtx.collapsedFields?.has(pathString)) return
-
-    const parentField = getParentField(rootCtx, path)
-    const childOf = parentField?.ctx?.currentStore?.span
-
-    const document = rootCtx.source
-    const loc = this.config.source && document && fieldNode && fieldNode.loc
-    const source = loc && document.slice(loc.start, loc.end)
-
-    let namedReturnType = returnType
-    while (namedReturnType.ofType) namedReturnType = namedReturnType.ofType
-
-    const span = this.startSpan('graphql.resolve', {
-      service: this.config.service,
-      resource: `${fieldName}:${returnType}`,
-      childOf,
-      type: 'graphql',
-      meta: {
-        'graphql.field.name': fieldName,
-        'graphql.field.path': pathString,
-        'graphql.field.type': namedReturnType.name,
-        'graphql.source': source,
-      },
-    }, fieldCtx)
-
-    if (fieldNode && this.config.variables && fieldNode.arguments) {
-      const variables = this.config.variables(variableValues)
-
-      for (const arg of fieldNode.arguments) {
-        if (arg.value?.name && arg.value.kind === 'Variable' && variables[arg.value.name.value]) {
-          const name = arg.value.name.value
-          span.setTag(`graphql.variables.${name}`, variables[name])
-        }
-      }
-    }
-
-    if (this.resolverStartCh.hasSubscribers) {
-      this.resolverStartCh.publish({ ctx: rootCtx, resolverInfo: getResolverInfo(fieldNode, fieldName, args) })
-    }
-
-    return fieldCtx.currentStore
-  }
-
-  constructor (...args) {
-    super(...args)
-
-    this.addTraceSub('updateField', (ctx) => {
-      // start short-circuited on the depth gate, so there is no span to advance.
-      if (ctx.currentStore === undefined) return
-
-      const { field, error } = ctx
-      const span = ctx.currentStore.span
-      field.finishTime = span._getTime ? span._getTime() : 0
-      field.error = field.error || error
-    })
-
-    this.resolverStartCh = dc.channel('datadog:graphql:resolver:start')
-  }
-
-  configure (config) {
-    // this will disable resolve subscribers if `config.depth` is set to 0
-    super.configure(config.depth === 0 ? false : config)
-  }
-
-  finish (ctx) {
-    const { finishTime } = ctx
-
-    const span = ctx?.currentStore?.span || this.activeSpan
-    span.finish(finishTime)
-
-    return ctx.parentStore
-  }
-}
-
-// helpers
-
-/**
- * @param {{ depth: number, collapse: boolean }} config
- * @param {{ prev: object | undefined, key: string | number }} path
- */
-function shouldInstrument (config, path) {
-  const depth = config.depth
-  if (depth < 0) return true
-
-  let count = 0
-  if (config.collapse) {
-    for (let curr = path; curr; curr = curr.prev) count += 1
-  } else {
-    for (let curr = path; curr; curr = curr.prev) {
-      if (typeof curr.key === 'string') count += 1
-    }
-  }
-  return depth >= count
-}
-
-/**
- * @param {object | undefined} fieldNode
- * @param {string} fieldName
- * @param {Record<string, unknown> | undefined} args
- */
-function getResolverInfo (fieldNode, fieldName, args) {
-  let resolverVars
-
-  if (args && Object.keys(args).length > 0) {
-    resolverVars = { ...args }
-  }
-
-  const directives = fieldNode?.directives
-  if (Array.isArray(directives)) {
-    for (const directive of directives) {
-      if (directive.arguments.length === 0) continue
-
-      const argList = {}
-      for (const argument of directive.arguments) {
-        argList[argument.name.value] = argument.value.value
-      }
-
-      resolverVars ??= {}
-      resolverVars[directive.name.value] = argList
-    }
-  }
-
-  return resolverVars === undefined ? null : { [fieldName]: resolverVars }
-}
-
-/**
- * @param {{ fields: Map<object, { error: unknown, ctx: object }> }} rootCtx
- * @param {{ prev: object | undefined }} path
- */
-function getParentField (rootCtx, path) {
-  for (let curr = path.prev; curr; curr = curr.prev) {
-    const field = rootCtx.fields.get(curr)
-    if (field) return field
-  }
-}
-
-module.exports = GraphQLResolvePlugin
diff --git a/packages/datadog-plugin-graphql/src/validate.js b/packages/datadog-plugin-graphql/src/validate.js
index 789df6a9da..dfeeb4ea0c 100644
--- a/packages/datadog-plugin-graphql/src/validate.js
+++ b/packages/datadog-plugin-graphql/src/validate.js
@@ -1,14 +1,18 @@
 'use strict'
 
 const TracingPlugin = require('../../dd-trace/src/plugins/tracing')
+const GraphQLParsePlugin = require('./parse')
 const { extractErrorIntoSpanEvent } = require('./utils')
 
 class GraphQLValidatePlugin extends TracingPlugin {
   static id = 'graphql'
   static operation = 'validate'
+  static prefix = 'tracing:orchestrion:graphql:apm:graphql:validate'
 
   bindStart (ctx) {
-    const { docSource, document } = ctx
+    // validate(schema, documentAST, rules, options, typeInfo)
+    const document = ctx.arguments?.[1]
+    const docSource = document ? GraphQLParsePlugin.documentSources.get(document) : undefined
     const source = this.config.source && document && docSource
 
     this.startSpan('graphql.validate', {
@@ -19,19 +23,26 @@ class GraphQLValidatePlugin extends TracingPlugin {
       },
     }, ctx)
 
+    ctx.ddDocument = document
+
     return ctx.currentStore
   }
 
-  finish (ctx) {
-    const { document, errors } = ctx
+  end (ctx) {
+    const document = ctx.ddDocument
+    const errors = ctx.result
     const span = ctx?.currentStore?.span || this.activeSpan
+
     this.config.hooks.validate(span, document, errors)
-    if (errors) {
+
+    if (errors?.length) {
+      span.setTag('error', errors[0])
       for (const err of errors) {
         extractErrorIntoSpanEvent(this._tracerConfig, span, err)
       }
     }
-    super.finish(ctx)
+
+    span.finish()
 
     return ctx.parentStore
   }
diff --git a/packages/datadog-plugin-graphql/test/config.spec.js b/packages/datadog-plugin-graphql/test/config.spec.js
new file mode 100644
index 0000000000..dd35517850
--- /dev/null
+++ b/packages/datadog-plugin-graphql/test/config.spec.js
@@ -0,0 +1,58 @@
+'use strict'
+
+const assert = require('node:assert/strict')
+
+const { before, describe, it } = require('mocha')
+const proxyquire = require('proxyquire').noPreserveCache()
+
+// `countListIndices` decides whether numeric list-index path segments count toward
+// the resolver `depth` limit. The v5 release line counts them when collapsing; v6
+// never does, so depth always tracks selection-set nesting. The behaviour is gated
+// on DD_MAJOR, so stub the version constant to reach both arms on either release line.
+function loadPluginFor (DD_MAJOR) {
+  const GraphQLPlugin = proxyquire('../src', {
+    '../../../version': { DD_MAJOR, '@noCallThru': true },
+  })
+
+  return new GraphQLPlugin({}, {})
+}
+
+// CompositePlugin spreads the validated config into every sub-plugin, so the
+// execute plugin (which carries the depth gate) sees `countListIndices`.
+function countListIndicesFor (plugin, options) {
+  plugin.configure({ depth: 2, ...options })
+  return plugin.execute.config.countListIndices
+}
+
+describe('graphql plugin depth/collapse gate', () => {
+  describe('v5 (DD_MAJOR < 6)', () => {
+    let plugin
+
+    before(() => {
+      plugin = loadPluginFor(5)
+    })
+
+    it('counts collapsed list indices toward depth (collapse defaults on)', () => {
+      assert.strictEqual(countListIndicesFor(plugin, {}), true)
+      assert.strictEqual(countListIndicesFor(plugin, { collapse: true }), true)
+    })
+
+    it('counts only field segments when collapsing is disabled', () => {
+      assert.strictEqual(countListIndicesFor(plugin, { collapse: false }), false)
+    })
+  })
+
+  describe('v6 (DD_MAJOR >= 6)', () => {
+    let plugin
+
+    before(() => {
+      plugin = loadPluginFor(6)
+    })
+
+    it('never counts list indices, regardless of collapse', () => {
+      assert.strictEqual(countListIndicesFor(plugin, {}), false)
+      assert.strictEqual(countListIndicesFor(plugin, { collapse: true }), false)
+      assert.strictEqual(countListIndicesFor(plugin, { collapse: false }), false)
+    })
+  })
+})
diff --git a/packages/datadog-plugin-graphql/test/esm-test/esm-graphql-yoga-server.mjs b/packages/datadog-plugin-graphql/test/esm-test/esm-graphql-yoga-server.mjs
index 94f94587dc..9d0e2603db 100644
--- a/packages/datadog-plugin-graphql/test/esm-test/esm-graphql-yoga-server.mjs
+++ b/packages/datadog-plugin-graphql/test/esm-test/esm-graphql-yoga-server.mjs
@@ -6,6 +6,9 @@ const typeDefs = /* GraphQL */ `
   type Query {
     hello(name: String): String
   }
+  type Subscription {
+    count: Int
+  }
 `
 
 const resolvers = {
@@ -14,6 +17,13 @@ const resolvers = {
       return `Hello, ${name || 'world'}!`
     },
   },
+  Subscription: {
+    count: {
+      subscribe: async function * () {
+        yield { count: 1 }
+      },
+    },
+  },
 }
 
 const schema = createSchema({
diff --git a/packages/datadog-plugin-graphql/test/esm-test/esm.spec.js b/packages/datadog-plugin-graphql/test/esm-test/esm.spec.js
index 71080a1022..5a3698e924 100644
--- a/packages/datadog-plugin-graphql/test/esm-test/esm.spec.js
+++ b/packages/datadog-plugin-graphql/test/esm-test/esm.spec.js
@@ -102,6 +102,41 @@ describe('Plugin (ESM)', () => {
 
           await res
         }).timeout(50000)
+
+        it('should instrument GraphQL Yoga subscriptions with ESM', async () => {
+          const res = agent.assertMessageReceived(({ headers, payload }) => {
+            assert.strictEqual(headers.host, `127.0.0.1:${agent.port}`)
+            assert.ok(Array.isArray(payload), `Expected array, got ${inspect(payload)}`)
+            assert.strictEqual(checkSpansForServiceName(payload, 'graphql.execute'), true)
+          })
+
+          proc = await spawnPluginIntegrationTestProc(
+            sandboxCwd(),
+            'esm-graphql-yoga-server.mjs',
+            agent.port,
+            { NODE_OPTIONS: '--no-warnings --loader=dd-trace/loader-hook.mjs' }
+          )
+
+          const query = `
+            subscription CountSubscription {
+              count
+            }
+          `
+
+          try {
+            await axios.post(`${proc.url}/graphql`, {
+              query,
+            }, {
+              headers: {
+                accept: 'text/event-stream',
+              },
+            })
+          } catch (error) {
+            // Server might not respond correctly, but we care about tracing
+          }
+
+          await res
+        }).timeout(50000)
       }
     })
   })
diff --git a/packages/datadog-plugin-graphql/test/index.spec.js b/packages/datadog-plugin-graphql/test/index.spec.js
index 346e97bbcf..7ae02f32ed 100644
--- a/packages/datadog-plugin-graphql/test/index.spec.js
+++ b/packages/datadog-plugin-graphql/test/index.spec.js
@@ -12,6 +12,7 @@ const semver = require('semver')
 const sinon = require('sinon')
 
 const { assertObjectContains } = require('../../../integration-tests/helpers')
+const { DD_MAJOR } = require('../../../version')
 const { ERROR_MESSAGE, ERROR_TYPE, ERROR_STACK } = require('../../dd-trace/src/constants')
 const agent = require('../../dd-trace/test/plugins/agent')
 const { withNamingSchema, withVersions } = require('../../dd-trace/test/setup/mocha')
@@ -255,6 +256,10 @@ describe('Plugin', () => {
             const typeDefs = `
               type Query {
                 hello(name: String): String
+                error: String
+              }
+              type Subscription {
+                count: Int
               }
             `
 
@@ -263,6 +268,16 @@ describe('Plugin', () => {
                 hello: (_, { name }) => {
                   return `Hello, ${name || 'world'}!`
                 },
+                error: async () => {
+                  throw new Error('Yoga query failed')
+                },
+              },
+              Subscription: {
+                count: {
+                  subscribe: async function * () {
+                    yield { count: 1 }
+                  },
+                },
               },
             }
 
@@ -309,6 +324,7 @@ describe('Plugin', () => {
                 },
               })
               assert.ok(!('graphql.source' in spans[0].meta))
+              assert.strictEqual(spans.filter(span => span.name === expectedSchema.server.opName).length, 1)
             }, { spanResourceMatch: /MyQuery/ })
 
             return Promise.all([
@@ -316,6 +332,64 @@ describe('Plugin', () => {
               axios.post(`http://localhost:${port}/graphql`, { query }),
             ])
           })
+
+          it('should instrument graphql-yoga async execution errors', () => {
+            const query = `
+              query ErrorQuery {
+                error
+              }
+            `
+
+            const assertion = agent.assertSomeTraces(traces => {
+              const spans = sort(traces[0])
+
+              assertObjectContains(spans[0], {
+                name: expectedSchema.server.opName,
+                resource: 'query ErrorQuery{error}',
+                error: 1,
+                meta: {
+                  'graphql.operation.type': 'query',
+                  'graphql.operation.name': 'ErrorQuery',
+                },
+              })
+            }, { spanResourceMatch: /ErrorQuery/ })
+
+            return Promise.all([
+              assertion,
+              axios.post(`http://localhost:${port}/graphql`, { query }),
+            ])
+          })
+
+          it('should instrument graphql-yoga subscriptions', () => {
+            const query = `
+              subscription CountSubscription {
+                count
+              }
+            `
+
+            const assertion = agent.assertSomeTraces(traces => {
+              const spans = sort(traces[0])
+
+              assertObjectContains(spans[0], {
+                name: expectedSchema.server.opName,
+                resource: 'subscription CountSubscription{count}',
+                error: 0,
+                meta: {
+                  'graphql.operation.type': 'subscription',
+                  'graphql.operation.name': 'CountSubscription',
+                },
+              })
+            }, { spanResourceMatch: /CountSubscription/ })
+
+            return Promise.all([
+              assertion,
+              axios.post(`http://localhost:${port}/graphql`, { query }, {
+                headers: {
+                  accept: 'text/event-stream',
+                },
+              }),
+            ])
+          })
         })
       })
 
@@ -446,6 +520,56 @@ describe('Plugin', () => {
             'instrumentation must not overwrite the caller-supplied fieldResolver')
         })
 
+        it('should preserve graphql defaultFieldResolver behavior for primitive sources', async () => {
+          const Box = new graphql.GraphQLObjectType({
+            name: 'Box',
+            fields: {
+              length: {
+                type: graphql.GraphQLInt,
+              },
+            },
+          })
+          const query = new graphql.GraphQLObjectType({
+            name: 'Query',
+            fields: {
+              box: {
+                type: Box,
+                resolve: () => 'abc',
+              },
+            },
+          })
+          const localSchema = new graphql.GraphQLSchema({ query })
+          const document = graphql.parse('{ box { length } }')
+
+          const result = await graphql.execute({ schema: localSchema, document })
+
+          assert.strictEqual(result.data.box.length, null)
+        })
+
+        it('publishes caller-owned execute args before installing the wrapped fieldResolver', async () => {
+          const startChannel = dc.channel('apm:graphql:execute:start')
+          const document = graphql.parse('query MyQuery { hello(name: "world") }')
+          const callerFieldResolver = (source, args, contextValue, info) => 'caller-resolved'
+          const args = { schema, document, contextValue: {}, fieldResolver: callerFieldResolver }
+
+          let publishedArgs
+          const handler = ({ args: channelArgs }) => {
+            publishedArgs = channelArgs
+            assert.strictEqual(channelArgs, args)
+            assert.strictEqual(channelArgs.fieldResolver, callerFieldResolver)
+          }
+          startChannel.subscribe(handler)
+
+          try {
+            assert.ok(await graphql.execute(args), 'execute returned a result')
+          } finally {
+            startChannel.unsubscribe(handler)
+          }
+
+          assert.strictEqual(publishedArgs, args)
+          assert.strictEqual(args.fieldResolver, callerFieldResolver)
+        })
+
         describe('preserves the caller-supplied contextValue', () => {
           let recordingSchema
           let recordedContext
@@ -904,11 +1028,15 @@ describe('Plugin', () => {
 
           const [, result] = await Promise.all([
             agent.assertSomeTraces(traces => {
-              const paths = sort(traces[0])
-                .filter(span => span.name === 'graphql.resolve')
-                .map(span => span.meta['graphql.field.path'])
-                .sort()
+              const resolveSpans = sort(traces[0]).filter(span => span.name === 'graphql.resolve')
+              const paths = resolveSpans.map(span => span.meta['graphql.field.path']).sort()
               assert.deepStrictEqual(paths, ['matrix', 'matrix.*.*.value'])
+
+              const matrix = resolveSpans.find(span => span.meta['graphql.field.path'] === 'matrix')
+              const value = resolveSpans.find(span => span.meta['graphql.field.path'] === 'matrix.*.*.value')
+              assert.ok(matrix, 'expected matrix span')
+              assert.ok(value, 'expected matrix.*.*.value span')
+              assert.strictEqual(value.parent_id.toString(), matrix.span_id.toString())
             }),
             graphql.graphql({ schema: matrixSchema, source, rootValue }),
           ])
@@ -1517,6 +1645,27 @@ describe('Plugin', () => {
           }
         })
 
+        it('should publish empty resolver args with subscription to datadog:graphql:resolver:start', async () => {
+          const source = 'query MyQuery { human { name } }'
+          const document = graphql.parse(source)
+          const resolverInfo = []
+
+          const handler = ({ resolverInfo: info }) => {
+            resolverInfo.push(info)
+          }
+          dc.channel('datadog:graphql:resolver:start').subscribe(handler)
+
+          try {
+            await graphql.execute({ schema, document })
+          } finally {
+            dc.channel('datadog:graphql:resolver:start').unsubscribe(handler)
+          }
+
+          const humanResolverInfo = resolverInfo.find(info => info?.human)
+          assert.deepStrictEqual(humanResolverInfo, { human: {} },
+            `Expected empty human resolver args. Got ${inspect(resolverInfo)}`)
+        })
+
         it('should support multiple validations on a pre-parsed document', () => {
           const source = 'query MyQuery { hello(name: "world") }'
           const document = graphql.parse(source)
@@ -1859,6 +2008,26 @@ describe('Plugin', () => {
 
           graphql.graphql({ schema, source, rootValue }).catch(done)
         })
+
+        it('should publish resolver start for depth 0 AppSec subscribers', async () => {
+          const startCh = dc.channel('datadog:graphql:resolver:start')
+          const fields = []
+          const handler = ({ resolverInfo }) => {
+            fields.push(...Object.keys(resolverInfo || {}))
+          }
+
+          startCh.subscribe(handler)
+
+          try {
+            const source = '{ human { name } }'
+            const result = await graphql.graphql({ schema, source })
+
+            assert.ok(!result.errors || result.errors.length === 0, `Expected [${result.errors}] to be empty`)
+            assert.deepStrictEqual(fields.sort(), ['human', 'name'])
+          } finally {
+            startCh.unsubscribe(handler)
+          }
+        })
       })
 
       describe('with a depth >=1', () => {
@@ -1877,38 +2046,121 @@ describe('Plugin', () => {
           buildSchema()
         })
 
-        it('should only instrument up to the specified depth', () => {
-          const source = `
-            {
-              human {
-                name
-                address {
-                  civicNumber
-                  street
-                }
-              }
-              friends {
-                name
+        const source = `
+          {
+            human {
+              name
+              address {
+                civicNumber
+                street
               }
             }
-          `
+            friends {
+              name
+            }
+          }
+        `
+
+        // friends.*.name sits two fields deep (friends -> name); the list index
+        // between them is an execution artifact, not a query level, so depth: 2
+        // reaches it. human.address.civicNumber / human.address.street sit three
+        // fields deep and stay gated.
+        const v6DepthTest = DD_MAJOR >= 6 ? it : it.skip
+        v6DepthTest('counts selection-set depth only, so a collapsed list field resolves at its field depth', () => {
+          const assertion = agent.assertSomeTraces(traces => {
+            const paths = sort(traces[0])
+              .filter(span => span.name === 'graphql.resolve')
+              .map(span => span.meta['graphql.field.path'])
+              .sort()
+
+            assert.deepStrictEqual(paths, [
+              'friends',
+              'friends.*.name',
+              'human',
+              'human.address',
+              'human.name',
+            ])
+          })
 
+          return Promise.all([assertion, graphql.graphql({ schema, source })])
+        })
+
+        // v5 counted the collapsed list index toward depth, so friends.*.name sat
+        // three segments deep and was gated. Pin that contract on the v5 line.
+        const legacyDepthTest = DD_MAJOR < 6 ? it : it.skip
+        legacyDepthTest('counts collapsed list indices toward depth on v5', () => {
           const assertion = agent.assertSomeTraces(traces => {
-            const spans = sort(traces[0])
-            const ignored = spans.filter(span => {
-              return [
-                'human.address.civicNumber',
-                'human.address.street',
-              ].indexOf(span.resource) !== -1
-            })
+            const paths = sort(traces[0])
+              .filter(span => span.name === 'graphql.resolve')
+              .map(span => span.meta['graphql.field.path'])
+              .sort()
 
-            assert.strictEqual(spans.length, 5)
-            assert.strictEqual(ignored.length, 0)
+            assert.deepStrictEqual(paths, [
+              'friends',
+              'human',
+              'human.address',
+              'human.name',
+            ])
           })
 
           return Promise.all([assertion, graphql.graphql({ schema, source })])
         })
 
+        it('should honor resolver abort for fields gated by depth', async () => {
+          let streetResolverRan = false
+          const startCh = dc.channel('datadog:graphql:resolver:start')
+          const handler = ({ abortController, resolverInfo }) => {
+            if (resolverInfo?.street) abortController.abort()
+          }
+
+          const Address = new graphql.GraphQLObjectType({
+            name: 'DepthAbortAddress',
+            fields: {
+              street: {
+                type: graphql.GraphQLString,
+                resolve () {
+                  streetResolverRan = true
+                  return 'foo street'
+                },
+              },
+            },
+          })
+          const Human = new graphql.GraphQLObjectType({
+            name: 'DepthAbortHuman',
+            fields: {
+              address: {
+                type: Address,
+                resolve: () => ({}),
+              },
+            },
+          })
+          const query = new graphql.GraphQLObjectType({
+            name: 'DepthAbortQuery',
+            fields: {
+              human: {
+                type: Human,
+                resolve: () => ({}),
+              },
+            },
+          })
+          const localSchema = new graphql.GraphQLSchema({ query })
+
+          startCh.subscribe(handler)
+
+          try {
+            const result = await graphql.graphql({
+              schema: localSchema,
+              source: '{ human { address { street } } }',
+            })
+
+            assert.strictEqual(streetResolverRan, false)
+            assert.strictEqual(result.errors.length, 1)
+            assert.strictEqual(result.errors[0].originalError?.name, 'AbortError')
+          } finally {
+            startCh.unsubscribe(handler)
+          }
+        })
+
         it('publishes apm:graphql:resolve:start for every resolver, including depth-gated ones', async () => {
           // The depth knob caps span creation, not channel publishes.
           // IAST taint-tracking and AppSec WAF subscribers run on every resolver
@@ -2142,6 +2394,7 @@ describe('Plugin', () => {
             execute: sinon.spy((span, context, res) => {}),
             parse: sinon.spy((span, document, operation) => {}),
             validate: sinon.spy((span, document, error) => {}),
+            resolve: sinon.spy((span, field) => {}),
           },
         }
 
@@ -2279,6 +2532,32 @@ describe('Plugin', () => {
 
           return Promise.all([assertion, action])
         })
+
+        it('should run the resolve hook before graphql.resolve span is finished', () => {
+          const resolveSource = '{ hello(name: "world") }'
+
+          const assertion = agent.assertSomeTraces(traces => {
+            const spans = sort(traces[0])
+
+            assert.strictEqual(spans.length, 2)
+            assert.strictEqual(spans[1].name, 'graphql.resolve')
+            sinon.assert.calledOnce(config.hooks.resolve)
+
+            const span = config.hooks.resolve.firstCall.args[0]
+            const field = config.hooks.resolve.firstCall.args[1]
+
+            assert.strictEqual(span.context()._name, 'graphql.resolve')
+            assert.strictEqual(field.fieldName, 'hello')
+            assert.strictEqual(field.path, 'hello')
+            assert.strictEqual(field.error, null)
+            assert.strictEqual(field.result, 'world')
+          }, { spanResourceMatch: /hello:String/ })
+
+          return Promise.all([
+            assertion,
+            graphql.graphql({ schema, source: resolveSource }),
+          ])
+        })
       })
 
       withVersions('graphql', 'apollo-server-core', apolloVersion => {
diff --git a/packages/datadog-plugin-http/src/index.js b/packages/datadog-plugin-http/src/index.js
index dcf0abed05..d57f5e404b 100644
--- a/packages/datadog-plugin-http/src/index.js
+++ b/packages/datadog-plugin-http/src/index.js
@@ -1,6 +1,5 @@
 'use strict'
 
-const PushSubscriptionPlugin = require('../../datadog-plugin-google-cloud-pubsub/src/pubsub-push-subscription')
 const CompositePlugin = require('../../dd-trace/src/plugins/composite')
 const { enableGCPPubSubPushSubscription } = require('../../dd-trace/src/serverless')
 const log = require('../../dd-trace/src/log')
@@ -17,14 +16,13 @@ class HttpPlugin extends CompositePlugin {
   static get plugins () {
     const plugins = {}
 
-    // Load push subscription plugin first (if enabled) for GCP Cloud Run
+    // Load the push subscription plugin first (if enabled) for GCP Cloud Run.
+    // The require stays inside the gate so the pubsub plugin graph is not pulled
+    // into every process that instruments http — only GCP Cloud Run reaches it.
     if (enableGCPPubSubPushSubscription()) {
-      try {
-        plugins['pubsub-push-subscription'] = PushSubscriptionPlugin
-        log.debug('Loaded GCP Pub/Sub Push Subscription plugin for HTTP requests')
-      } catch (e) {
-        log.debug('Failed to load GCP Pub/Sub Push Subscription plugin:', e)
-      }
+      plugins['pubsub-push-subscription'] =
+        require('../../datadog-plugin-google-cloud-pubsub/src/pubsub-push-subscription')
+      log.debug('Loaded GCP Pub/Sub Push Subscription plugin for HTTP requests')
     }
 
     plugins.server = HttpServerPlugin
diff --git a/packages/datadog-plugin-http/test/index.spec.js b/packages/datadog-plugin-http/test/index.spec.js
new file mode 100644
index 0000000000..34f4bddc6a
--- /dev/null
+++ b/packages/datadog-plugin-http/test/index.spec.js
@@ -0,0 +1,62 @@
+'use strict'
+
+const assert = require('node:assert/strict')
+const path = require('node:path')
+
+const { describe, it, beforeEach, afterEach } = require('mocha')
+
+require('../../dd-trace/test/setup/core')
+
+const pubsubPluginPath = require.resolve(
+  '../../datadog-plugin-google-cloud-pubsub/src/pubsub-push-subscription'
+)
+const httpPluginPath = require.resolve('../src')
+
+function freshHttpPlugin () {
+  delete require.cache[httpPluginPath]
+  delete require.cache[pubsubPluginPath]
+  return require('../src')
+}
+
+describe('HttpPlugin composite plugins', () => {
+  const originalKService = process.env.K_SERVICE
+  const originalGcpPubsubPush = process.env.DD_TRACE_GCP_PUBSUB_PUSH_ENABLED
+
+  beforeEach(() => {
+    delete require.cache[pubsubPluginPath]
+  })
+
+  afterEach(() => {
+    if (originalKService === undefined) delete process.env.K_SERVICE
+    else process.env.K_SERVICE = originalKService
+    if (originalGcpPubsubPush === undefined) delete process.env.DD_TRACE_GCP_PUBSUB_PUSH_ENABLED
+    else process.env.DD_TRACE_GCP_PUBSUB_PUSH_ENABLED = originalGcpPubsubPush
+  })
+
+  it('does not load the pubsub push-subscription plugin when GCP push is disabled', () => {
+    delete process.env.K_SERVICE
+    const HttpPlugin = freshHttpPlugin()
+
+    const names = Object.keys(HttpPlugin.plugins)
+
+    assert.deepStrictEqual(names, ['server', 'client'])
+    assert.strictEqual(
+      require.cache[pubsubPluginPath],
+      undefined,
+      'the pubsub push-subscription module must not be required when the GCP push gate is off'
+    )
+  })
+
+  it('loads the pubsub push-subscription plugin first when GCP push is enabled', () => {
+    process.env.K_SERVICE = 'svc'
+    process.env.DD_TRACE_GCP_PUBSUB_PUSH_ENABLED = 'true'
+    const HttpPlugin = freshHttpPlugin()
+
+    const names = Object.keys(HttpPlugin.plugins)
+
+    assert.strictEqual(names[0], 'pubsub-push-subscription')
+    assert.deepStrictEqual(names, ['pubsub-push-subscription', 'server', 'client'])
+    assert.strictEqual(path.isAbsolute(pubsubPluginPath), true)
+    assert.notStrictEqual(require.cache[pubsubPluginPath], undefined)
+  })
+})
diff --git a/packages/datadog-plugin-jest/src/index.js b/packages/datadog-plugin-jest/src/index.js
index 76e998defa..7841517716 100644
--- a/packages/datadog-plugin-jest/src/index.js
+++ b/packages/datadog-plugin-jest/src/index.js
@@ -177,7 +177,7 @@ class JestPlugin extends CiPlugin {
 
         this.telemetry.count(TELEMETRY_TEST_SESSION, {
           provider: this.ciProviderName,
-          autoInjected: !!this._tracerConfig.DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER,
+          autoInjected: !!this._tracerConfig.testOptimization.DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER,
         })
 
         appClosingTelemetry()
diff --git a/packages/datadog-plugin-kafkajs/test/index.spec.js b/packages/datadog-plugin-kafkajs/test/index.spec.js
index 796882bee1..c65a3a8e6e 100644
--- a/packages/datadog-plugin-kafkajs/test/index.spec.js
+++ b/packages/datadog-plugin-kafkajs/test/index.spec.js
@@ -269,9 +269,6 @@ describe('Plugin', () => {
               const otherKafka = new Kafka({
                 clientId: `kafkajs-test-${version}`,
                 brokers: ['127.0.0.1:9092'],
-                retry: {
-                  retries: 0,
-                },
               })
 
               sendRequestStub = sinon.stub(Broker.prototype, 'produce').rejects(error)
@@ -350,14 +347,17 @@ describe('Plugin', () => {
 
           it('should emit one kafka.produce span per topicMessages entry', async () => {
             // Per-topic offset isolation: the broker returns one aggregated
-            // response covering every topic in the batch; each span must tag
-            // only its own topic's (partition, offset) entries.
-            const topicAOffsets = JSON.stringify([{ partition: 0, start_offset: '0' }])
-            const topicBOffsets = JSON.stringify([{ partition: 0, start_offset: '0' }])
+            // response covering every topic; each span must tag only its own
+            // topic's entries. The base offset is broker state (a retried
+            // NOT_LEADER_FOR_PARTITION right after topic creation advances it
+            // past 0), so it is compared against the send result rather than
+            // hard-coded. Each entry is its own root span, so it can land in
+            // any trace of any payload.
+            let topicASpan
+            let topicBSpan
 
             const topicASpanPromise = agent.assertSomeTraces(traces => {
-              const span = traces[0].find(s =>
-                s.name === expectedSchema.send.opName && s.resource === topicA)
+              const span = findProduceSpan(traces, topicA)
               assert.ok(span, `no kafka.produce span for ${topicA}`)
               assertObjectContains(span, {
                 service: expectedSchema.send.serviceName,
@@ -367,31 +367,38 @@ describe('Plugin', () => {
                   'messaging.destination.name': topicA,
                   'messaging.kafka.bootstrap.servers': '127.0.0.1:9092',
                   'kafka.cluster_id': testKafkaClusterId,
-                  'kafka.messages.offsets': topicAOffsets,
                 },
                 metrics: { 'kafka.batch_size': 1 },
                 error: 0,
               })
+              topicASpan = span
             })
 
             const topicBSpanPromise = agent.assertSomeTraces(traces => {
-              const span = traces[0].find(s =>
-                s.name === expectedSchema.send.opName && s.resource === topicB)
+              const span = findProduceSpan(traces, topicB)
               assert.ok(span, `no kafka.produce span for ${topicB}`)
               assertObjectContains(span, {
                 resource: topicB,
-                meta: { 'kafka.messages.offsets': topicBOffsets },
                 metrics: { 'kafka.batch_size': 2 },
                 error: 0,
               })
+              topicBSpan = span
             })
 
-            await sendBatch(kafka, [
-              { topic: topicA, messages: [{ key: 'a', value: 'msg-a' }] },
-              { topic: topicB, messages: [{ key: 'b1', value: 'msg-b1' }, { key: 'b2', value: 'msg-b2' }] },
+            let result
+            await Promise.all([
+              topicASpanPromise,
+              topicBSpanPromise,
+              (async () => {
+                result = await sendBatch(kafka, [
+                  { topic: topicA, messages: [{ key: 'a', value: 'msg-a' }] },
+                  { topic: topicB, messages: [{ key: 'b1', value: 'msg-b1' }, { key: 'b2', value: 'msg-b2' }] },
+                ])
+              })(),
             ])
 
-            return Promise.all([topicASpanPromise, topicBSpanPromise])
+            assert.strictEqual(topicASpan.meta['kafka.messages.offsets'], offsetsTag(result, topicA))
+            assert.strictEqual(topicBSpan.meta['kafka.messages.offsets'], offsetsTag(result, topicB))
           })
 
           it('should emit one span for a single-topic sendBatch (mirrors send)', async () => {
@@ -482,7 +489,6 @@ describe('Plugin', () => {
               const otherKafka = new Kafka({
                 clientId: `kafkajs-test-${version}`,
                 brokers: ['127.0.0.1:9092'],
-                retry: { retries: 0 },
               })
               produceStub = sinon.stub(Broker.prototype, 'produce').rejects(error)
               producer = otherKafka.producer({ transactionTimeout: 10 })
@@ -875,3 +881,42 @@ async function sendBatch (kafka, topicMessages) {
   await producer.disconnect()
   return result
 }
+
+/**
+ * sendBatch emits one independent root span per topicMessages entry, so the two
+ * spans are separate traces the agent may deliver in one payload in any order.
+ * Scan every trace, not just `traces[0]`.
+ *
+ * @param {Array<Array<object>>} traces
+ * @param {string} topic
+ */
+function findProduceSpan (traces, topic) {
+  for (const trace of traces) {
+    for (const span of trace) {
+      if (span.name === expectedSchema.send.opName && span.resource === topic) {
+        return span
+      }
+    }
+  }
+}
+
+/**
+ * The `kafka.messages.offsets` tag the producer span should carry for one topic,
+ * derived from the broker's aggregated sendBatch response. Mirrors the plugin's
+ * per-topic filter so the expectation tracks the broker's real (retry-advanced)
+ * offsets instead of assuming a fresh topic starts at 0.
+ *
+ * @param {Array<{ topicName: string, partition: number, offset?: string, baseOffset?: string }>} result
+ * @param {string} topic
+ */
+function offsetsTag (result, topic) {
+  const offsets = []
+  for (const record of result) {
+    if (record.topicName !== topic) continue
+    const offset = record.offset ?? record.baseOffset
+    if (record.partition === undefined || offset === undefined) continue
+    offsets.push({ partition: record.partition, start_offset: String(offset) })
+  }
+  offsets.sort((a, b) => a.partition - b.partition)
+  return JSON.stringify(offsets)
+}
diff --git a/packages/datadog-plugin-langchain/test/index.spec.js b/packages/datadog-plugin-langchain/test/index.spec.js
index 8c8d79c0b6..dcc5ee4c08 100644
--- a/packages/datadog-plugin-langchain/test/index.spec.js
+++ b/packages/datadog-plugin-langchain/test/index.spec.js
@@ -122,7 +122,7 @@ describe('Plugin', () => {
           .get('@langchain/core/tools')
 
         if (semifies(realVersion, '>=1.0')) {
-          MemoryVectorStore = require('../../../versions/@langchain/classic@>=1.0')
+          MemoryVectorStore = require('../../../versions/@langchain/classic@1')
             .get('@langchain/classic/vectorstores/memory')
             .MemoryVectorStore
         } else {
diff --git a/packages/datadog-plugin-mocha/src/index.js b/packages/datadog-plugin-mocha/src/index.js
index e9a6a049b8..f2f3d6abee 100644
--- a/packages/datadog-plugin-mocha/src/index.js
+++ b/packages/datadog-plugin-mocha/src/index.js
@@ -427,7 +427,7 @@ class MochaPlugin extends CiPlugin {
         finishAllTraceSpans(this.testSessionSpan)
         this.telemetry.count(TELEMETRY_TEST_SESSION, {
           provider: this.ciProviderName,
-          autoInjected: !!this._tracerConfig.DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER,
+          autoInjected: !!this._tracerConfig.testOptimization.DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER,
         })
       }
       this.libraryConfig = null
diff --git a/packages/datadog-plugin-openai/src/services.js b/packages/datadog-plugin-openai/src/services.js
index 93c4363ed4..67c5db5f0a 100644
--- a/packages/datadog-plugin-openai/src/services.js
+++ b/packages/datadog-plugin-openai/src/services.js
@@ -24,12 +24,12 @@ module.exports.init = function (tracerConfig) {
     })
     : new NoopDogStatsDClient()
 
-  logger = tracerConfig && tracerConfig.apiKey
+  logger = tracerConfig && tracerConfig.DD_API_KEY
     ? new ExternalLogger({
       ddsource: 'openai',
       hostname: tracerConfig.hostname,
       service: tracerConfig.service,
-      apiKey: tracerConfig.apiKey,
+      apiKey: tracerConfig.DD_API_KEY,
       interval: FLUSH_INTERVAL,
     })
     : new NoopExternalLogger()
diff --git a/packages/datadog-plugin-oracledb/test/integration-test/server.mjs b/packages/datadog-plugin-oracledb/test/integration-test/server.mjs
index 8d2740708a..d67605a657 100644
--- a/packages/datadog-plugin-oracledb/test/integration-test/server.mjs
+++ b/packages/datadog-plugin-oracledb/test/integration-test/server.mjs
@@ -6,12 +6,15 @@ const hostname = 'localhost'
 const config = {
   user: 'test',
   password: 'Oracle18',
-  connectString: `${hostname}:1521/xepdb1`,
+  // connect_timeout bounds the connect phase; callTimeout below bounds each query round-trip.
+  connectString: `${hostname}:1521/xepdb1?connect_timeout=15`,
 }
 
 const dbQuery = 'select current_timestamp from dual'
 
 const connection = await oracledb.getConnection(config)
+// callTimeout bounds each query round-trip. No effect on IPC connections; this connects over TCP.
+connection.callTimeout = 10_000
 await connection.execute(dbQuery)
 
 if (connection) {
diff --git a/packages/datadog-plugin-playwright/src/index.js b/packages/datadog-plugin-playwright/src/index.js
index a75e7ee26d..c84d0b2b22 100644
--- a/packages/datadog-plugin-playwright/src/index.js
+++ b/packages/datadog-plugin-playwright/src/index.js
@@ -108,7 +108,7 @@ class PlaywrightPlugin extends CiPlugin {
       finishAllTraceSpans(this.testSessionSpan)
       this.telemetry.count(TELEMETRY_TEST_SESSION, {
         provider: this.ciProviderName,
-        autoInjected: !!this._tracerConfig.DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER,
+        autoInjected: !!this._tracerConfig.testOptimization.DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER,
       })
       appClosingTelemetry()
       this.tracer._exporter.flush(onDone)
diff --git a/packages/datadog-plugin-vitest/src/index.js b/packages/datadog-plugin-vitest/src/index.js
index f88478368e..1d20d399ef 100644
--- a/packages/datadog-plugin-vitest/src/index.js
+++ b/packages/datadog-plugin-vitest/src/index.js
@@ -30,12 +30,12 @@ const {
   TEST_MANAGEMENT_IS_ATTEMPT_TO_FIX,
   TEST_MANAGEMENT_ATTEMPT_TO_FIX_PASSED,
   TEST_HAS_FAILED_ALL_RETRIES,
-  getLibraryCapabilitiesTags,
+  getLibraryCapabilitiesTags: getDefaultLibraryCapabilitiesTags,
   TEST_RETRY_REASON_TYPES,
-  isModifiedTest,
   TEST_IS_MODIFIED,
   TEST_HAS_DYNAMIC_NAME,
   TEST_FINAL_STATUS,
+  TEST_IS_TEST_FRAMEWORK_WORKER,
 } = require('../../dd-trace/src/plugins/util/test')
 const { COMPONENT } = require('../../dd-trace/src/constants')
 const {
@@ -70,49 +70,6 @@ class VitestPlugin extends CiPlugin {
       })
     })
 
-    this.addSub('ci:vitest:test:is-new', ({ knownTests, testSuiteAbsolutePath, testName, onDone }) => {
-      // if for whatever reason the worker does not receive valid known tests, we don't consider it as new
-      if (!knownTests.vitest) {
-        return onDone(false)
-      }
-      const testSuite = getTestSuitePath(testSuiteAbsolutePath, this.repositoryRoot)
-      const testsForThisTestSuite = knownTests.vitest[testSuite] || []
-      onDone(!testsForThisTestSuite.includes(testName))
-    })
-
-    this.addSub('ci:vitest:test:is-attempt-to-fix', ({
-      testManagementTests,
-      testSuiteAbsolutePath,
-      testName,
-      onDone,
-    }) => {
-      const testSuite = getTestSuitePath(testSuiteAbsolutePath, this.repositoryRoot)
-      const { isAttemptToFix } = this.getTestProperties(testManagementTests, testSuite, testName)
-
-      onDone(isAttemptToFix ?? false)
-    })
-
-    this.addSub('ci:vitest:test:is-disabled', ({ testManagementTests, testSuiteAbsolutePath, testName, onDone }) => {
-      const testSuite = getTestSuitePath(testSuiteAbsolutePath, this.repositoryRoot)
-      const { isDisabled } = this.getTestProperties(testManagementTests, testSuite, testName)
-
-      onDone(isDisabled)
-    })
-
-    this.addSub('ci:vitest:test:is-quarantined', ({ testManagementTests, testSuiteAbsolutePath, testName, onDone }) => {
-      const testSuite = getTestSuitePath(testSuiteAbsolutePath, this.repositoryRoot)
-      const { isQuarantined } = this.getTestProperties(testManagementTests, testSuite, testName)
-
-      onDone(isQuarantined)
-    })
-
-    this.addSub('ci:vitest:test:is-modified', ({ modifiedFiles, testSuiteAbsolutePath, onDone }) => {
-      const testSuite = getTestSuitePath(testSuiteAbsolutePath, this.repositoryRoot)
-      const isModified = isModifiedTest(testSuite, 0, 0, modifiedFiles, this.constructor.id)
-
-      onDone(isModified)
-    })
-
     this.addSub('ci:vitest:is-early-flake-detection-faulty', ({
       knownTests,
       testFilepaths,
@@ -141,12 +98,16 @@ class VitestPlugin extends CiPlugin {
         isRetryReasonAttemptToFix,
         isRetryReasonAtr,
         isModified,
+        isTestFrameworkWorker,
+        requestErrorTags,
       } = ctx
 
       const testSuite = getTestSuitePath(testSuiteAbsolutePath, this.repositoryRoot)
-      const store = storage('legacy').getStore()
+      const store = ctx.currentStore || storage('legacy').getStore()
+      const testSuiteSpan = store?.testSuiteSpan || this.testSuiteSpan
 
       const extraTags = {
+        ...requestErrorTags,
         [TEST_SOURCE_FILE]: testSuite,
       }
       if (isRetry) {
@@ -179,11 +140,14 @@ class VitestPlugin extends CiPlugin {
       if (isModified) {
         extraTags[TEST_IS_MODIFIED] = 'true'
       }
+      if (isTestFrameworkWorker) {
+        extraTags[TEST_IS_TEST_FRAMEWORK_WORKER] = 'true'
+      }
 
       const span = this.startTestSpan(
         testName,
         testSuite,
-        this.testSuiteSpan,
+        testSuiteSpan,
         extraTags
       )
 
@@ -204,7 +168,7 @@ class VitestPlugin extends CiPlugin {
     })
 
     this.addBind('ci:vitest:test:finish-time', (ctx) => {
-      const { status, task, attemptToFixPassed, attemptToFixFailed } = ctx
+      const { status, task, attemptToFixPassed, attemptToFixFailed, duration } = ctx
       const span = ctx.currentStore?.span
 
       // we store the finish time to finish at a later hook
@@ -218,7 +182,8 @@ class VitestPlugin extends CiPlugin {
           span.setTag(TEST_MANAGEMENT_ATTEMPT_TO_FIX_PASSED, 'false')
         }
 
-        this.taskToFinishTime.set(task, span._getTime())
+        const finishTime = typeof duration === 'number' ? span._startTime + duration : span._getTime()
+        this.taskToFinishTime.set(task, finishTime)
 
         ctx.parentStore = ctx.currentStore
         ctx.currentStore = { ...ctx.currentStore, span }
@@ -291,19 +256,29 @@ class VitestPlugin extends CiPlugin {
       finishAllTraceSpans(span)
     })
 
-    this.addSub('ci:vitest:test:skip', ({ testName, testSuiteAbsolutePath, isNew, isDisabled }) => {
+    this.addSub('ci:vitest:test:skip', ({
+      testName,
+      testSuiteAbsolutePath,
+      isNew,
+      isDisabled,
+      isTestFrameworkWorker,
+      requestErrorTags,
+      testSuiteSpan,
+    }) => {
       const testSuite = getTestSuitePath(testSuiteAbsolutePath, this.repositoryRoot)
       const testSpan = this.startTestSpan(
         testName,
         testSuite,
-        this.testSuiteSpan,
+        testSuiteSpan || this.testSuiteSpan,
         {
+          ...requestErrorTags,
           [TEST_SOURCE_FILE]: testSuite,
           [TEST_SOURCE_START]: 1, // we can't get the proper start line in vitest
           [TEST_STATUS]: 'skip',
           [TEST_FINAL_STATUS]: 'skip',
           ...(isDisabled ? { [TEST_MANAGEMENT_IS_DISABLED]: 'true' } : {}),
           ...(isNew ? { [TEST_IS_NEW]: 'true' } : {}),
+          ...(isTestFrameworkWorker ? { [TEST_IS_TEST_FRAMEWORK_WORKER]: 'true' } : {}),
         }
       )
       this.telemetry.ciVisEvent(TELEMETRY_EVENT_FINISHED, 'test', this.getTestTelemetryTags(testSpan))
@@ -311,7 +286,15 @@ class VitestPlugin extends CiPlugin {
     })
 
     this.addBind('ci:vitest:test-suite:start', (ctx) => {
-      const { codeOwnersEntries, repositoryRoot, testSuiteAbsolutePath, frameworkVersion } = ctx
+      const {
+        codeOwnersEntries,
+        repositoryRoot,
+        requestErrorTags,
+        testSuiteAbsolutePath,
+        frameworkVersion,
+        isTestFrameworkWorker,
+        isVitestNoWorkerInitActive,
+      } = ctx
 
       const testCommand = ctx.testCommand || 'vitest run'
       const { testSessionId, testModuleId } = ctx
@@ -329,13 +312,16 @@ class VitestPlugin extends CiPlugin {
       // test suites run in a different process, so they also need to init the metadata dictionary
       const testSessionName = getTestSessionName(this.config, trimmedCommand, this.testEnvironmentMetadata)
       if (this.tracer._exporter.addMetadataTags) {
+        const libraryCapabilitiesTags = this.getLibraryCapabilitiesTags(frameworkVersion, {
+          isVitestNoWorkerInitActive,
+        })
         this.tracer._exporter.addMetadataTags({
           [TEST_LEVELS_METADATA]: {
             [TEST_COMMAND]: testCommand,
             [TEST_SESSION_NAME]: testSessionName,
             ...getTestLevelsMetadataTags(this.testEnvironmentMetadata),
           },
-          test: getLibraryCapabilitiesTags(this.constructor.id),
+          test: libraryCapabilitiesTags,
         })
       }
 
@@ -348,9 +334,13 @@ class VitestPlugin extends CiPlugin {
           testSuite,
           'vitest'
         ),
+        ...requestErrorTags,
         [TEST_SOURCE_FILE]: testSuite,
         [TEST_SOURCE_START]: 1,
       }
+      if (isTestFrameworkWorker) {
+        testSuiteMetadata[TEST_IS_TEST_FRAMEWORK_WORKER] = 'true'
+      }
 
       const codeOwners = this.getCodeOwners(testSuiteMetadata)
       if (codeOwners) {
@@ -374,13 +364,17 @@ class VitestPlugin extends CiPlugin {
       return ctx.currentStore
     })
 
-    this.addSub('ci:vitest:test-suite:finish', ({ testSuiteSpan, status, onFinish }) => {
+    this.addSub('ci:vitest:test-suite:finish', ({ testSuiteSpan, status, deferFlush, onFinish }) => {
       if (testSuiteSpan) {
         testSuiteSpan.setTag(TEST_STATUS, status)
         testSuiteSpan.finish()
         finishAllTraceSpans(testSuiteSpan)
       }
       this.telemetry.ciVisEvent(TELEMETRY_EVENT_FINISHED, 'suite')
+      if (deferFlush) {
+        onFinish()
+        return
+      }
       this.tracer._exporter.flush(onFinish)
       if (this.runningTestProbe) {
         this.removeDiProbe(this.runningTestProbe)
@@ -409,9 +403,15 @@ class VitestPlugin extends CiPlugin {
       isEarlyFlakeDetectionEnabled,
       isEarlyFlakeDetectionFaulty,
       isTestManagementTestsEnabled,
+      requestErrorTags,
       vitestPool,
+      isVitestNoWorkerInitActive,
       onFinish,
     }) => {
+      for (const [tag, value] of Object.entries(requestErrorTags || {})) {
+        this.testSessionSpan.setTag(tag, value)
+        this.testModuleSpan.setTag(tag, value)
+      }
       this.testSessionSpan.setTag(TEST_STATUS, status)
       this.testModuleSpan.setTag(TEST_STATUS, status)
       if (error) {
@@ -438,12 +438,12 @@ class VitestPlugin extends CiPlugin {
       this.telemetry.ciVisEvent(TELEMETRY_EVENT_FINISHED, 'module')
       this.testSessionSpan.finish()
       this.telemetry.ciVisEvent(TELEMETRY_EVENT_FINISHED, 'session', {
-        hasFailedTestReplay: this.libraryConfig?.isDiEnabled || undefined,
+        hasFailedTestReplay: this.libraryConfig?.isDiEnabled && !isVitestNoWorkerInitActive ? true : undefined,
       })
       finishAllTraceSpans(this.testSessionSpan)
       this.telemetry.count(TELEMETRY_TEST_SESSION, {
         provider: this.ciProviderName,
-        autoInjected: !!this._tracerConfig.DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER,
+        autoInjected: !!this._tracerConfig.testOptimization.DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER,
       })
       this.tracer._exporter.flush(onFinish)
     })
@@ -453,6 +453,19 @@ class VitestPlugin extends CiPlugin {
     })
   }
 
+  /**
+   * Returns Vitest library capability metadata tags.
+   * @param {string} frameworkVersion - The Vitest version.
+   * @param {object} [ctx] - Diagnostic channel context.
+   * @param {boolean} [ctx.isVitestNoWorkerInitActive] - Whether no-worker init is active for this run.
+   * @returns {Record<string, string|undefined>}
+   */
+  getLibraryCapabilitiesTags (frameworkVersion, ctx = {}) {
+    return getDefaultLibraryCapabilitiesTags(this.constructor.id, frameworkVersion, {
+      omitFailedTestReplay: ctx.isVitestNoWorkerInitActive,
+    })
+  }
+
   /**
    * Handles the coverage report by discovering and uploading it if enabled.
    * @param {string} rootDir - The root directory where coverage reports are located.
@@ -469,13 +482,6 @@ class VitestPlugin extends CiPlugin {
       onDone,
     })
   }
-
-  getTestProperties (testManagementTests, testSuite, testName) {
-    const { attempt_to_fix: isAttemptToFix, disabled: isDisabled, quarantined: isQuarantined } =
-      testManagementTests?.vitest?.suites?.[testSuite]?.tests?.[testName]?.properties || {}
-
-    return { isAttemptToFix, isDisabled, isQuarantined }
-  }
 }
 
 module.exports = VitestPlugin
diff --git a/packages/datadog-shimmer/src/shimmer.js b/packages/datadog-shimmer/src/shimmer.js
index 3b410030a9..3af1e25a70 100644
--- a/packages/datadog-shimmer/src/shimmer.js
+++ b/packages/datadog-shimmer/src/shimmer.js
@@ -119,11 +119,14 @@ function wrapCallback (original, wrapper) {
  * object.
  * @param {string | symbol} name - The property key of the method to wrap.
  * @param {(original: Function) => (...args: unknown[]) => unknown} wrapper - The wrapper function.
- * @param {{ replaceGetter?: boolean }} [options] - If `replaceGetter` is set to
- * true, the getter is accessed and the getter is replaced with one that just
- * returns the earlier retrieved value. Use with care! This may only be done in
- * case the getter absolutely has no side effect and no setter is defined for the
- * property.
+ * @param {{ replaceGetter?: boolean }} [options] - By default the getter is
+ * wrapped in place, so each property access runs the wrapper. A getter+setter
+ * pair keeps its setter; a setter-only property throws. If `replaceGetter` is
+ * true, the getter is instead accessed once and replaced with one returning the
+ * resolved wrapped value — for a lazy getter+setter pair (e.g. Node 20's
+ * `fs.opendir`) the setter is rebuilt to materialize a writable data property on
+ * assignment, keeping the descriptor observationally identical for downstream
+ * consumers. Use with care! This may only be done when the getter has no side effect.
  * @returns {Record<string | symbol, unknown> | Function | undefined} The target object with
  * the wrapped method.
  */
@@ -151,17 +154,13 @@ function wrap (target, name, wrapper, options) {
     enumerable: false,
   }
 
-  if (descriptor.set && (!descriptor.get || options?.replaceGetter)) {
-    // It is possible to support these cases by instrumenting both the getter
-    // and setter (or only the setter, in case that is a use case).
-    // For now, this is not supported due to the complexity and the fact that
-    // this is not a common use case.
-    throw new Error(options?.replaceGetter
-      ? 'Replacing a getter/setter pair is not supported. Implement if required.'
-      : 'Replacing setters is not supported. Implement if required.')
+  // A setter-only property has nothing to wrap. Instrumenting the setter is not
+  // implemented; a getter+setter pair is handled below.
+  if (descriptor.set && !descriptor.get) {
+    throw new Error('Replacing setters is not supported. Implement if required.')
   }
 
-  const original = descriptor.value ?? options?.replaceGetter ? target[name] : descriptor.get
+  const original = (descriptor.value ?? options?.replaceGetter) ? target[name] : descriptor.get
 
   assertMethod(target, name, original)
 
@@ -176,8 +175,30 @@ function wrap (target, name, wrapper, options) {
     }
     descriptor.value = wrapped
   } else {
-    if (descriptor.get) {
-      // `replaceGetter` may only be used when the getter has no side effect.
+    if (descriptor.set && options?.replaceGetter) {
+      // A lazy accessor pair (e.g. Node 20's `fs.opendir`). `original` already
+      // resolved the value through the getter. Keep the property an accessor pair
+      // so the shape stays observationally identical — a downstream consumer may
+      // read the descriptor or assign to it on a specific Node.js version. The
+      // getter returns the wrapped value; the setter mirrors the native lazy
+      // contract (assignment self-replaces the property with a writable data
+      // property holding the assigned value), so a caller that overwrites the
+      // method gets exactly what they set, unwrapped, as before. The descriptor
+      // is the original accessor descriptor (no `value`/`writable` slots), so
+      // reassigning `get`/`set` keeps it a valid accessor descriptor.
+      descriptor.get = () => wrapped
+      descriptor.set = function (value) {
+        Object.defineProperty(this, name, {
+          configurable: descriptor.configurable,
+          enumerable: descriptor.enumerable,
+          writable: true,
+          value,
+        })
+      }
+    } else if (descriptor.get) {
+      // Wrap the getter in place; for a getter+setter pair the original setter
+      // stays untouched. `replaceGetter` (no side effect on read) instead returns
+      // the value resolved once into `wrapped`.
       descriptor.get = options?.replaceGetter ? () => wrapped : wrapped
     } else {
       descriptor.value = wrapped
diff --git a/packages/datadog-shimmer/test/shimmer.spec.js b/packages/datadog-shimmer/test/shimmer.spec.js
index 5fd61dbdeb..8532e2bd0e 100644
--- a/packages/datadog-shimmer/test/shimmer.spec.js
+++ b/packages/datadog-shimmer/test/shimmer.spec.js
@@ -57,6 +57,86 @@ describe('shimmer', () => {
       assert.strictEqual(called, 1)
     })
 
+    it('should wrap a lazy getter/setter pair while preserving the accessor shape', () => {
+      // Mirrors Node 20's `fs.opendir`: a lazy accessor that resolves the real
+      // function on first read and self-replaces with a data property on write.
+      // The wrap must keep it an accessor pair so the descriptor shape stays
+      // observationally identical for downstream consumers on that Node version.
+      const target = () => 'original'
+      const obj = {}
+      Object.defineProperty(obj, 'method', {
+        configurable: true,
+        enumerable: true,
+        get () { return target },
+        set (value) {
+          Object.defineProperty(obj, 'method', { configurable: true, enumerable: true, writable: true, value })
+        },
+      })
+
+      let called = 0
+      shimmer.wrap(obj, 'method', method => (...args) => {
+        called++
+        return method(...args)
+      }, { replaceGetter: true })
+
+      // Still an accessor pair, with the original configurable/enumerable flags.
+      const descriptor = Object.getOwnPropertyDescriptor(obj, 'method')
+      assert.strictEqual(typeof descriptor.get, 'function')
+      assert.strictEqual(typeof descriptor.set, 'function')
+      assert.strictEqual(descriptor.configurable, true)
+      assert.strictEqual(descriptor.enumerable, true)
+
+      // Reading returns the wrapped method.
+      assert.strictEqual(obj.method.name, target.name)
+      assert.strictEqual(obj.method(), 'original')
+      assert.strictEqual(called, 1)
+
+      // Assignment mirrors the native lazy contract: it materializes the property
+      // as a writable data property holding exactly what was set (unwrapped).
+      const replacement = () => 'replacement'
+      obj.method = replacement
+      const afterSet = Object.getOwnPropertyDescriptor(obj, 'method')
+      assert.strictEqual(afterSet.get, undefined)
+      assert.strictEqual(afterSet.set, undefined)
+      assert.strictEqual(afterSet.writable, true)
+      assert.strictEqual(obj.method, replacement)
+      assert.strictEqual(obj.method(), 'replacement')
+      assert.strictEqual(called, 1, 'a caller-supplied replacement is not wrapped')
+    })
+
+    it('should wrap a getter/setter pair in place without the replaceGetter option', () => {
+      // Mirrors `url.js` wrapping the `URL.prototype` `host`/`hostname` getters,
+      // which are getter+setter accessor pairs. Each read must run the wrapper,
+      // and the original setter is left untouched.
+      let setValue
+      const obj = {}
+      Object.defineProperty(obj, 'method', {
+        configurable: true,
+        enumerable: true,
+        get () { return 'original' },
+        set (value) { setValue = value },
+      })
+
+      let called = 0
+      shimmer.wrap(obj, 'method', getter => function () {
+        called++
+        return getter.call(this)
+      })
+
+      const descriptor = Object.getOwnPropertyDescriptor(obj, 'method')
+      assert.strictEqual(typeof descriptor.get, 'function')
+      assert.strictEqual(typeof descriptor.set, 'function')
+
+      assert.strictEqual(obj.method, 'original')
+      assert.strictEqual(called, 1)
+      assert.strictEqual(obj.method, 'original')
+      assert.strictEqual(called, 2)
+
+      obj.method = 42
+      assert.strictEqual(setValue, 42)
+      assert.strictEqual(typeof Object.getOwnPropertyDescriptor(obj, 'method').set, 'function')
+    })
+
     it('should not wrap setter only method', () => {
       // eslint-disable-next-line accessor-pairs
       const obj = { set setter (_method_) {} }
diff --git a/packages/dd-trace/src/aiguard/sdk.js b/packages/dd-trace/src/aiguard/sdk.js
index b9c87c2b19..952bcb3db7 100644
--- a/packages/dd-trace/src/aiguard/sdk.js
+++ b/packages/dd-trace/src/aiguard/sdk.js
@@ -93,14 +93,14 @@ class AIGuard extends NoopAIGuard {
   constructor (tracer, config) {
     super()
 
-    if (!config.apiKey || !config.DD_APP_KEY) {
+    if (!config.DD_API_KEY || !config.DD_APP_KEY) {
       log.error('AIGuard: missing api and/or app keys, use env DD_API_KEY and DD_APP_KEY')
       this.#initialized = false
       return
     }
     this.#tracer = tracer
     this.#headers = {
-      'DD-API-KEY': config.apiKey,
+      'DD-API-KEY': config.DD_API_KEY,
       'DD-APPLICATION-KEY': config.DD_APP_KEY,
       'DD-AI-GUARD-VERSION': tracerVersion,
       'DD-AI-GUARD-SOURCE': 'SDK',
diff --git a/packages/dd-trace/src/appsec/api_security/sampler.js b/packages/dd-trace/src/appsec/api_security/sampler.js
index dc083616b1..aeb19c6ea6 100644
--- a/packages/dd-trace/src/appsec/api_security/sampler.js
+++ b/packages/dd-trace/src/appsec/api_security/sampler.js
@@ -31,11 +31,11 @@ class NoopTTLCache {
 }
 
 function configure ({ appsec, apmTracingEnabled }) {
-  enabled = appsec.apiSecurity.enabled
+  enabled = appsec.DD_API_SECURITY_ENABLED
   asmStandaloneEnabled = apmTracingEnabled === false
-  sampledRequests = appsec.apiSecurity.sampleDelay === 0
+  sampledRequests = appsec.DD_API_SECURITY_SAMPLE_DELAY === 0
     ? new NoopTTLCache()
-    : new TTLCache({ max: MAX_SIZE, ttl: appsec.apiSecurity.sampleDelay * 1000 })
+    : new TTLCache({ max: MAX_SIZE, ttl: appsec.DD_API_SECURITY_SAMPLE_DELAY * 1000 })
 }
 
 function disable () {
diff --git a/packages/dd-trace/src/appsec/channels.js b/packages/dd-trace/src/appsec/channels.js
index 6e5deab3ff..5cdd6e52d2 100644
--- a/packages/dd-trace/src/appsec/channels.js
+++ b/packages/dd-trace/src/appsec/channels.js
@@ -27,6 +27,8 @@ module.exports = {
   httpClientResponseFinish: dc.channel('apm:http:client:response:finish'),
   incomingHttpRequestEnd: dc.channel('dd-trace:incomingHttpRequestEnd'),
   incomingHttpRequestStart: dc.channel('dd-trace:incomingHttpRequestStart'),
+  lambdaStartInvocation: dc.channel('datadog:lambda:start-invocation'),
+  lambdaEndInvocation: dc.channel('datadog:lambda:end-invocation'),
   multerParser: dc.channel('datadog:multer:read:finish'),
   mysql2OuterQueryStart: dc.channel('datadog:mysql2:outerquery:start'),
   nextBodyParsed: dc.channel('apm:next:body-parsed'),
@@ -43,7 +45,7 @@ module.exports = {
   routerParam: dc.channel('datadog:router:param:start'),
   setCookieChannel: dc.channel('datadog:iast:set-cookie'),
   setUncaughtExceptionCaptureCallbackStart: dc.channel('datadog:process:setUncaughtExceptionCaptureCallback:start'),
-  startGraphqlResolve: dc.channel('datadog:graphql:resolver:start'),
+  startGraphqlResolver: dc.channel('datadog:graphql:resolver:start'),
   stripeCheckoutSessionCreate: dc.channel('datadog:stripe:checkoutSession:create:finish'),
   stripeConstructEvent: dc.channel('datadog:stripe:constructEvent:finish'),
   stripePaymentIntentCreate: dc.channel('datadog:stripe:paymentIntent:create:finish'),
diff --git a/packages/dd-trace/src/appsec/downstream_requests.js b/packages/dd-trace/src/appsec/downstream_requests.js
index b7b004abe0..893bb55a9f 100644
--- a/packages/dd-trace/src/appsec/downstream_requests.js
+++ b/packages/dd-trace/src/appsec/downstream_requests.js
@@ -41,7 +41,7 @@ function enable (_config) {
   downstreamAnalysisCount = new WeakMap()
   responseBodyIgnoredCount = new WeakMap()
 
-  const bodyAnalysisSampleRate = config.appsec.apiSecurity?.downstreamBodyAnalysisSampleRate
+  const bodyAnalysisSampleRate = config.appsec.DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE
   samplingRate = Math.min(Math.max(bodyAnalysisSampleRate, 0), 1)
 
   if (samplingRate !== bodyAnalysisSampleRate) {
@@ -105,7 +105,7 @@ function recordResponseBodyIgnored (req, tag) {
  * @returns {boolean} whether downstream response body should be collected for AppSec.
  */
 function evaluateResponseBodyCollection (originatingReq, res) {
-  const maxBytes = config.appsec.apiSecurity.maxDownstreamBodyBytes
+  const maxBytes = config.appsec.DD_API_SECURITY_MAX_DOWNSTREAM_BODY_BYTES
 
   const mime = extractMimeType(res.headers?.['content-type'])
   if (!mime || !SUPPORTED_RESPONSE_BODY_MIME_TYPES.has(mime)) {
@@ -137,7 +137,7 @@ function shouldSampleBody (req) {
   globalRequestCounter = (globalRequestCounter + 1n) & UINT64_MAX
 
   const currentCount = bodyAnalysisCount.get(req) || 0
-  if (currentCount >= config.appsec.apiSecurity?.maxDownstreamRequestBodyAnalysis) {
+  if (currentCount >= config.appsec.DD_API_SECURITY_MAX_DOWNSTREAM_REQUEST_BODY_ANALYSIS) {
     return false
   }
 
@@ -166,7 +166,7 @@ function isRedirectResponse (res) {
  * @param {object} ctx http client instrumentation context (mutated).
  */
 function planResponseBodyCollection (originatingReq, res, ctx) {
-  if (!config?.appsec.apiSecurity) {
+  if (!config) {
     return
   }
 
diff --git a/packages/dd-trace/src/appsec/graphql.js b/packages/dd-trace/src/appsec/graphql.js
index 2209285cdf..3333889fed 100644
--- a/packages/dd-trace/src/appsec/graphql.js
+++ b/packages/dd-trace/src/appsec/graphql.js
@@ -12,7 +12,7 @@ const {
 const waf = require('./waf')
 const addresses = require('./addresses')
 const {
-  startGraphqlResolve,
+  startGraphqlResolver,
   graphqlMiddlewareChannel,
   apolloHttpServerChannel,
   apolloChannel,
@@ -32,7 +32,7 @@ function disable () {
   disableGraphql()
 }
 
-function onGraphqlStartResolve ({ context, resolverInfo }) {
+function onGraphqlStartResolver ({ abortController, resolverInfo }) {
   const req = getActiveRequest()
 
   if (!req) return
@@ -46,7 +46,7 @@ function onGraphqlStartResolve ({ context, resolverInfo }) {
     if (requestData?.isInGraphqlRequest) {
       requestData.blocked = true
       requestData.wafAction = blockingAction
-      context?.abortController?.abort()
+      abortController?.abort()
     }
   }
 }
@@ -153,11 +153,11 @@ function disableApollo () {
 }
 
 function enableGraphql () {
-  startGraphqlResolve.subscribe(onGraphqlStartResolve)
+  startGraphqlResolver.subscribe(onGraphqlStartResolver)
 }
 
 function disableGraphql () {
-  if (startGraphqlResolve.hasSubscribers) startGraphqlResolve.unsubscribe(onGraphqlStartResolve)
+  if (startGraphqlResolver.hasSubscribers) startGraphqlResolver.unsubscribe(onGraphqlStartResolver)
 }
 
 module.exports = {
diff --git a/packages/dd-trace/src/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.js b/packages/dd-trace/src/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.js
index daf3252d6c..b0082e571d 100644
--- a/packages/dd-trace/src/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.js
+++ b/packages/dd-trace/src/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.js
@@ -15,6 +15,20 @@ const EXCLUDED_PATHS_FROM_STACK = getNodeModulesPaths('mongodb', 'mongoose', 'mq
 const SAFE_OPERATORS = new Set(['$eq', '$gt', '$gte', '$in', '$lt', '$lte', '$ne', '$nin',
   '$exists', '$type', '$mod', '$bitsAllClear', '$bitsAllSet', '$bitsAnyClear', '$bitsAnySet'])
 
+// Scope a marked child store for a query's deferred execution so the nested mongodb
+// driver query skips re-analysis. `bindStore` enters the child only for that async
+// scope and restores the parent on its own, so no marker can be stranded for a later
+// request to inherit, and two concurrent queries of the same request each branch from
+// the shared parent rather than from each other.
+function markExecStore () {
+  const store = storage('legacy').getStore()
+  if (store && !store.nosqlAnalyzed && getIastContext(store)) {
+    return { ...store, nosqlAnalyzed: true }
+  }
+
+  return store
+}
+
 class NosqlInjectionMongodbAnalyzer extends InjectionAnalyzer {
   constructor () {
     super(NOSQL_MONGODB_INJECTION)
@@ -27,7 +41,7 @@ class NosqlInjectionMongodbAnalyzer extends InjectionAnalyzer {
     // Anything that accesses the storage is context dependent
     const onStart = ({ filters }) => {
       const store = storage('legacy').getStore()
-      if (store && !store.nosqlAnalyzed && filters?.length) {
+      if (store && !store.nosqlAnalyzed && filters?.length && getIastContext(store)) {
         for (const filter of filters) {
           this.analyze({ filter }, store)
         }
@@ -36,30 +50,23 @@ class NosqlInjectionMongodbAnalyzer extends InjectionAnalyzer {
       return store
     }
 
-    const onStartAndEnterWithStore = (message) => {
-      const store = onStart(message || {})
-      if (store) {
-        storage('legacy').enterWith({ ...store, nosqlAnalyzed: true, nosqlParentStore: store })
-      }
-    }
-
-    // Anything that accesses the storage is context dependent
-    // eslint-disable-next-line unicorn/consistent-function-scoping
-    const onFinish = () => {
-      const store = storage('legacy').getStore()
-      if (store?.nosqlParentStore) {
-        storage('legacy').enterWith(store.nosqlParentStore)
-      }
+    // mquery analyzes and marks on the same channel: its tracing start both reaches
+    // the driver scope and is the first place the filters are available.
+    const onStartAndBind = (message) => {
+      onStart(message)
+      return markExecStore()
     }
 
     this.addSub('datadog:mongodb:collection:filter:start', onStart)
 
-    this.addSub('datadog:mongoose:model:filter:start', onStartAndEnterWithStore)
-    this.addSub('datadog:mongoose:model:filter:finish', onFinish)
+    // A mongoose query builds, executes, and reaches the driver in separate async
+    // steps. The filters are analyzed at the build, but the marker is bound around
+    // the execution channel, where the driver call still runs under the parent store.
+    this.addSub('datadog:mongoose:model:filter:start', onStart)
+    this.addBind('datadog:mongoose:model:filter:exec', markExecStore)
 
     this.addSub('datadog:mquery:filter:prepare', onStart)
-    this.addSub('tracing:datadog:mquery:filter:start', onStartAndEnterWithStore)
-    this.addSub('tracing:datadog:mquery:filter:asyncEnd', onFinish)
+    this.addBind('tracing:datadog:mquery:filter:start', onStartAndBind)
   }
 
   configureSanitizers () {
diff --git a/packages/dd-trace/src/appsec/iast/security-controls/index.js b/packages/dd-trace/src/appsec/iast/security-controls/index.js
index 0302b85e56..7f7e1ce171 100644
--- a/packages/dd-trace/src/appsec/iast/security-controls/index.js
+++ b/packages/dd-trace/src/appsec/iast/security-controls/index.js
@@ -21,10 +21,10 @@ let controlsKeys
 let hooks
 
 function configure (iastConfig) {
-  if (!iastConfig?.securityControlsConfiguration) return
+  if (!iastConfig.DD_IAST_SECURITY_CONTROLS_CONFIGURATION) return
 
   try {
-    controls = parse(iastConfig.securityControlsConfiguration)
+    controls = parse(iastConfig.DD_IAST_SECURITY_CONTROLS_CONFIGURATION)
     if (controls?.size > 0) {
       hooks = new WeakSet()
       controlsKeys = [...controls.keys()]
diff --git a/packages/dd-trace/src/appsec/iast/telemetry/index.js b/packages/dd-trace/src/appsec/iast/telemetry/index.js
index 2b28ddf96f..61e08339f0 100644
--- a/packages/dd-trace/src/appsec/iast/telemetry/index.js
+++ b/packages/dd-trace/src/appsec/iast/telemetry/index.js
@@ -6,7 +6,8 @@ const { initRequestNamespace, finalizeRequestNamespace, globalNamespace } = requ
 
 class Telemetry {
   configure (config, verbosity) {
-    const telemetryAndMetricsEnabled = config?.telemetry?.enabled && config.telemetry.metrics
+    const telemetryAndMetricsEnabled = config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED &&
+      config.telemetry.DD_TELEMETRY_METRICS_ENABLED
 
     this.verbosity = telemetryAndMetricsEnabled ? getVerbosity(verbosity) : Verbosity.OFF
     this.enabled = this.verbosity !== Verbosity.OFF
diff --git a/packages/dd-trace/src/appsec/index.js b/packages/dd-trace/src/appsec/index.js
index 1c847aad19..1fcb9221a8 100644
--- a/packages/dd-trace/src/appsec/index.js
+++ b/packages/dd-trace/src/appsec/index.js
@@ -16,6 +16,8 @@ const {
   fastifyCookieParser,
   incomingHttpRequestStart,
   incomingHttpRequestEnd,
+  lambdaStartInvocation,
+  lambdaEndInvocation,
   passportVerify,
   passportUser,
   expressSession,
@@ -43,6 +45,7 @@ const { isBlocked, block, callBlockDelegation, setTemplates, getBlockingAction }
 const { getActiveRequest } = require('./store')
 const UserTracking = require('./user_tracking')
 const graphql = require('./graphql')
+const lambda = require('./lambda')
 const rasp = require('./rasp')
 
 const responseAnalyzedSet = new WeakSet()
@@ -99,11 +102,15 @@ function enable (_config) {
     stripeCheckoutSessionCreate.subscribe(onStripeCheckoutSessionCreate)
     stripePaymentIntentCreate.subscribe(onStripePaymentIntentCreate)
     stripeConstructEvent.subscribe(onStripeConstructEvent)
+    lambdaStartInvocation.subscribe(lambda.onLambdaStartInvocation)
+    lambdaEndInvocation.subscribe(lambda.onLambdaEndInvocation)
 
     isEnabled = true
     config = _config
   } catch (err) {
-    if (!IS_SERVERLESS) {
+    if (IS_SERVERLESS) {
+      log.debug('[ASM] Serverless mode: suppressing error log, calling disable()')
+    } else {
       log.error('[ASM] Unable to start AppSec', err)
     }
 
@@ -544,6 +551,8 @@ function disable () {
   if (stripeCheckoutSessionCreate.hasSubscribers) stripeCheckoutSessionCreate.unsubscribe(onStripeCheckoutSessionCreate)
   if (stripePaymentIntentCreate.hasSubscribers) stripePaymentIntentCreate.unsubscribe(onStripePaymentIntentCreate)
   if (stripeConstructEvent.hasSubscribers) stripeConstructEvent.unsubscribe(onStripeConstructEvent)
+  if (lambdaStartInvocation.hasSubscribers) lambdaStartInvocation.unsubscribe(lambda.onLambdaStartInvocation)
+  if (lambdaEndInvocation.hasSubscribers) lambdaEndInvocation.unsubscribe(lambda.onLambdaEndInvocation)
 }
 
 /**
diff --git a/packages/dd-trace/src/appsec/lambda.js b/packages/dd-trace/src/appsec/lambda.js
new file mode 100644
index 0000000000..8563a012d1
--- /dev/null
+++ b/packages/dd-trace/src/appsec/lambda.js
@@ -0,0 +1,135 @@
+'use strict'
+
+const { HTTP_CLIENT_IP } = require('../../../../ext/tags')
+
+const log = require('../log')
+const addresses = require('./addresses')
+const Reporter = require('./reporter')
+const waf = require('./waf')
+
+// Tracks spans for which start-invocation has been processed, so that
+// end-invocation can gate correctly
+const activeInvocations = new WeakSet()
+
+/**
+ * Maps pre-extracted HTTP data from the Lambda event to WAF addresses,
+ * runs the WAF, and reports results on the span.
+ *
+ * @param {{ span: object, headers: Record<string, string>, method: string, path: string,
+ *           query: Record<string, string | string[]> | undefined, body: string | object | undefined,
+ *           isBase64Encoded: boolean, clientIp: string | undefined,
+ *           pathParams: Record<string, string> | undefined,
+ *           cookies: Record<string, string> | undefined,
+ *           route: string | undefined }} data
+ */
+function onLambdaStartInvocation (data) {
+  try {
+    const { span, headers, method, path, query, body, clientIp, pathParams, cookies } = data
+
+    if (!span) {
+      log.warn('[ASM] No span provided in Lambda start invocation')
+      return
+    }
+
+    activeInvocations.add(span)
+
+    span.addTags({
+      '_dd.appsec.enabled': 1,
+      '_dd.runtime_family': 'nodejs',
+    })
+
+    const persistent = {}
+
+    if (path) {
+      persistent[addresses.HTTP_INCOMING_URL] = path
+    }
+
+    if (method) {
+      persistent[addresses.HTTP_INCOMING_METHOD] = method
+    }
+
+    if (headers) {
+      // Cookie header is already stripped by the Lambda layer's event-data-extractor
+      persistent[addresses.HTTP_INCOMING_HEADERS] = headers
+    }
+
+    if (clientIp) {
+      span.setTag(HTTP_CLIENT_IP, clientIp)
+      persistent[addresses.HTTP_CLIENT_IP] = clientIp
+    }
+
+    if (query) {
+      persistent[addresses.HTTP_INCOMING_QUERY] = query
+    }
+
+    if (body !== undefined && body !== null) {
+      persistent[addresses.HTTP_INCOMING_BODY] = body
+    }
+
+    if (pathParams) {
+      persistent[addresses.HTTP_INCOMING_PARAMS] = pathParams
+    }
+
+    if (cookies) {
+      persistent[addresses.HTTP_INCOMING_COOKIES] = cookies
+    }
+
+    waf.run({ persistent }, span, undefined, span)
+  } catch (err) {
+    log.error('[ASM] Error in Lambda start-invocation handler', err)
+  }
+}
+
+/**
+ * Maps response data to WAF addresses, runs a final WAF pass,
+ * disposes the WAF context, and finishes the request report.
+ *
+ * @param {{ span: object, statusCode: string | undefined,
+ *           responseHeaders: Record<string, string> | undefined }} data
+ */
+function onLambdaEndInvocation (data) {
+  try {
+    const { span, statusCode, responseHeaders } = data
+
+    if (!span) {
+      log.warn('[ASM] No span provided in Lambda end invocation')
+      return
+    }
+
+    if (!activeInvocations.has(span)) {
+      return
+    }
+
+    activeInvocations.delete(span)
+
+    let hasPersistentData = false
+    const persistent = {}
+
+    if (statusCode) {
+      persistent[addresses.HTTP_INCOMING_RESPONSE_CODE] = String(statusCode)
+      hasPersistentData = true
+    }
+
+    if (responseHeaders) {
+      const filteredHeaders = { ...responseHeaders }
+      delete filteredHeaders['set-cookie']
+      persistent[addresses.HTTP_INCOMING_RESPONSE_HEADERS] = filteredHeaders
+      hasPersistentData = true
+    }
+
+    if (hasPersistentData) {
+      waf.run({ persistent }, span, undefined, span)
+    }
+
+    waf.disposeContext(span)
+
+    Reporter.finishRequest(span, null, {}, undefined, span)
+  } catch (err) {
+    log.error('[ASM] Error in Lambda end-invocation handler', err)
+  }
+}
+
+module.exports = {
+  onLambdaStartInvocation,
+  onLambdaEndInvocation,
+}
diff --git a/packages/dd-trace/src/appsec/reporter.js b/packages/dd-trace/src/appsec/reporter.js
index 5db5a3ed04..c2fb000d9b 100644
--- a/packages/dd-trace/src/appsec/reporter.js
+++ b/packages/dd-trace/src/appsec/reporter.js
@@ -318,13 +318,21 @@ function reportWafConfigUpdate (product, rcConfigId, diagnostics, wafVersion) {
   }
 }
 
-function reportMetrics (metrics, raspRule, req) {
+/**
+ * @param {object} metrics - WAF run metrics
+ * @param {string} [raspRule] - RASP rule identifier
+ * @param {object} [req] - Request key (plain object for lambda)
+ * @param {object} [rootSpan] - Root span (required for lambda)
+ */
+function reportMetrics (metrics, raspRule, req, rootSpan) {
   if (!req) {
     req = getActiveRequest()
   }
-  const rootSpan = req && web.root(req)
+  if (!rootSpan) {
+    rootSpan = req && web.root(req)
+  }
 
-  if (!rootSpan) return
+  if (!req || !rootSpan) return
 
   if (metrics.rulesVersion) {
     rootSpan.setTag('_dd.appsec.event_rules.version', metrics.rulesVersion)
@@ -353,13 +361,26 @@ function reportTruncationMetrics (rootSpan, metrics) {
   }
 }
 
-function reportAttack ({ events: attackData, actions }, req) {
+// NOTE: `req` in the WAF execution path may be any object, not necessarily
+// an HTTP IncomingMessage. In Lambda, it is a plain context key ({}) with no
+// HTTP properties. Always guard HTTP-specific property access
+// See tests in lambda.spec.js for enforcement.
+
+/**
+ * @param {{ events: Array, actions: object }} result - WAF result with attack data
+ * @param {object} [req] - Request key. May be an HTTP IncomingMessage or a plain object (Lambda)
+ * @param {object} [rootSpan] - Root span (required for lambda)
+ */
+function reportAttack ({ events: attackData, actions }, req, rootSpan) {
   if (!req) {
     req = getActiveRequest()
   }
 
-  const rootSpan = web.root(req)
-  if (!rootSpan) return
+  if (!rootSpan) {
+    rootSpan = web.root(req)
+  }
+
+  if (!req || !rootSpan) return
 
   const spanContext = rootSpan.context()
 
@@ -494,14 +515,21 @@ function isSchemaAttribute (attribute) {
   return attribute.startsWith('_dd.appsec.s.')
 }
 
-function reportAttributes (attributes, req) {
+/**
+ * @param {object} [attributes] - WAF result attributes
+ * @param {object} [req] - Request key (plain object for lambda)
+ * @param {object} [rootSpan] - Root span (required for lambda)
+ */
+function reportAttributes (attributes, req, rootSpan) {
   if (!attributes) return
 
   if (!req) {
     req = getActiveRequest()
   }
 
-  const rootSpan = web.root(req)
+  if (!rootSpan) {
+    rootSpan = web.root(req)
+  }
 
   if (!rootSpan) return
 
@@ -517,8 +545,17 @@ function reportAttributes (attributes, req) {
   rootSpan.addTags(tags)
 }
 
-function finishRequest (req, res, storedResponseHeaders, requestBody) {
-  const rootSpan = web.root(req)
+/**
+ * @param {object} [req] - Request key (null for Lambda)
+ * @param {object} [res] - Response object (null for lambda)
+ * @param {object} storedResponseHeaders
+ * @param {object} [requestBody]
+ * @param {object} [rootSpan] - Root span (required for lambda)
+ */
+function finishRequest (req, res, storedResponseHeaders, requestBody, rootSpan) {
+  if (!rootSpan) {
+    rootSpan = web.root(req)
+  }
   if (!rootSpan) return
 
   if (metricsQueue.size) {
@@ -569,6 +606,8 @@ function finishRequest (req, res, storedResponseHeaders, requestBody) {
     rootSpan.setTag('_dd.appsec.rasp.rule.eval', metrics.raspEvalCount)
   }
 
+  if (!req) return
+
   incrementWafRequestsMetric(req)
 
   const tags = rootSpan.context().getTags()
diff --git a/packages/dd-trace/src/appsec/telemetry/index.js b/packages/dd-trace/src/appsec/telemetry/index.js
index d7676b04ba..5b8541475b 100644
--- a/packages/dd-trace/src/appsec/telemetry/index.js
+++ b/packages/dd-trace/src/appsec/telemetry/index.js
@@ -27,7 +27,7 @@ const metricsStoreMap = new WeakMap()
 let enabled = false
 
 function enable (config) {
-  enabled = config.telemetry?.enabled && config.telemetry?.metrics
+  enabled = config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED && config.telemetry.DD_TELEMETRY_METRICS_ENABLED
 }
 
 function disable () {
diff --git a/packages/dd-trace/src/appsec/waf/index.js b/packages/dd-trace/src/appsec/waf/index.js
index caa613ebb1..7601c64b53 100644
--- a/packages/dd-trace/src/appsec/waf/index.js
+++ b/packages/dd-trace/src/appsec/waf/index.js
@@ -110,7 +110,19 @@ function removeConfig (configPath) {
   }
 }
 
-function run (data, req, raspRule) {
+// `req` in the WAF execution path may be any object, not necessarily
+// an HTTP IncomingMessage (it is a plain object for lambda).
+// Always guard HTTP-specific property access.
+// @see packages/dd-trace/test/appsec/lambda.spec.js
+
+/**
+ * @param {object} data - WAF address data ({ persistent, ephemeral })
+ * @param {object} req - Request key for WAF context lookup. May be an HTTP
+ *   IncomingMessage or a plain object (Lambda invocation key).
+ * @param {string} [raspRule] - RASP rule identifier
+ * @param {object} [rootSpan] - Root span to tag (required for Lambda)
+ */
+function run (data, req, raspRule, rootSpan) {
   if (!req) {
     req = getActiveRequest()
     if (!req) {
@@ -120,12 +132,12 @@ function run (data, req, raspRule) {
   }
 
   const wafContext = waf.wafManager.getWAFContext(req)
-  const result = wafContext.run(data, raspRule, req)
+  const result = wafContext.run(data, raspRule, req, rootSpan)
 
   if (result?.keep) {
     if (limiter.isAllowed()) {
-      const rootSpan = web.root(req)
-      keepTrace(rootSpan, ASM)
+      const span = rootSpan || web.root(req)
+      keepTrace(span, ASM)
     } else {
       updateRateLimitedMetric(req)
     }
diff --git a/packages/dd-trace/src/appsec/waf/waf_context_wrapper.js b/packages/dd-trace/src/appsec/waf/waf_context_wrapper.js
index e733c30e41..4aaed79fbf 100644
--- a/packages/dd-trace/src/appsec/waf/waf_context_wrapper.js
+++ b/packages/dd-trace/src/appsec/waf/waf_context_wrapper.js
@@ -36,7 +36,7 @@ class WAFContextWrapper {
     }
   }
 
-  run ({ persistent, ephemeral }, raspRule, req) {
+  run ({ persistent, ephemeral }, raspRule, req, rootSpan) {
     if (this.ddwafContext.disposed) {
       log.warn('[ASM] Calling run on a disposed context')
       if (raspRule) {
@@ -156,10 +156,10 @@ class WAFContextWrapper {
       metrics.wafTimeout = result.timeout
 
       if (ruleTriggered) {
-        Reporter.reportAttack(result, req)
+        Reporter.reportAttack(result, req, rootSpan)
       }
 
-      Reporter.reportAttributes(result.attributes, req)
+      Reporter.reportAttributes(result.attributes, req, rootSpan)
 
       return result
     } catch (err) {
@@ -171,7 +171,7 @@ class WAFContextWrapper {
         wafRunFinished.publish({ payload })
       }
 
-      Reporter.reportMetrics(metrics, raspRule, req)
+      Reporter.reportMetrics(metrics, raspRule, req, rootSpan)
     }
   }
 
diff --git a/packages/dd-trace/src/ci-visibility/early-flake-detection/get-known-tests.js b/packages/dd-trace/src/ci-visibility/early-flake-detection/get-known-tests.js
index 968a5c5244..6f5fa560ab 100644
--- a/packages/dd-trace/src/ci-visibility/early-flake-detection/get-known-tests.js
+++ b/packages/dd-trace/src/ci-visibility/early-flake-detection/get-known-tests.js
@@ -17,6 +17,7 @@ const {
 
 const { getNumFromKnownTests } = require('../../plugins/util/test')
 const { buildCacheKey, writeToCache, withCache } = require('../requests/fs-cache')
+const { validateKnownTestsResponse } = require('../test-optimization-http-cache-schema')
 
 const MAX_KNOWN_TESTS_PAGES = 10_000
 
@@ -52,6 +53,19 @@ function mergeKnownTests (aggregate, page) {
   return aggregate
 }
 
+function parseJsonResponse (rawJson) {
+  return typeof rawJson === 'string' ? JSON.parse(rawJson) : rawJson
+}
+
+function parseKnownTestsResponse (rawJson, options = {}) {
+  const parsedResponse = parseJsonResponse(rawJson)
+  if (options.validateRequiredFields) {
+    validateKnownTestsResponse(parsedResponse)
+  }
+  const { data: { attributes: { tests } } } = parsedResponse
+  return tests
+}
+
 function getKnownTests ({
   url,
   isEvpProxy,
@@ -151,12 +165,12 @@ function fetchFromApi ({
     options.path = `${evpProxyPrefix}/api/v2/ci/libraries/tests`
     options.headers['X-Datadog-EVP-Subdomain'] = 'api'
   } else {
-    const { apiKey } = getConfig()
-    if (!apiKey) {
+    const { DD_API_KEY } = getConfig()
+    if (!DD_API_KEY) {
       return done(new Error('Known tests were not fetched because Datadog API key is not defined.'))
     }
 
-    options.headers['dd-api-key'] = apiKey
+    options.headers['dd-api-key'] = DD_API_KEY
   }
 
   const configurations = {
@@ -211,8 +225,9 @@ function fetchFromApi ({
       try {
         totalResponseBytes += res.length
 
-        const { data: { attributes } } = JSON.parse(res)
-        const { tests: pageTests, page_info: responsePageInfo } = attributes
+        const parsedResponse = parseJsonResponse(res)
+        const pageTests = parseKnownTestsResponse(parsedResponse)
+        const { page_info: responsePageInfo } = parsedResponse.data.attributes
 
         aggregateTests = mergeKnownTests(aggregateTests, pageTests)
 
@@ -251,4 +266,4 @@ function fetchFromApi ({
   fetchPage(null)
 }
 
-module.exports = { getKnownTests }
+module.exports = { getKnownTests, parseKnownTestsResponse }
diff --git a/packages/dd-trace/src/ci-visibility/exporters/agent-proxy/index.js b/packages/dd-trace/src/ci-visibility/exporters/agent-proxy/index.js
index 1ab05936d6..6ce6e1ecb8 100644
--- a/packages/dd-trace/src/ci-visibility/exporters/agent-proxy/index.js
+++ b/packages/dd-trace/src/ci-visibility/exporters/agent-proxy/index.js
@@ -40,7 +40,7 @@ class AgentProxyCiVisibilityExporter extends CiVisibilityExporter {
       lookup,
       protocolVersion,
       headers,
-      isTestDynamicInstrumentationEnabled,
+      testOptimization,
     } = config
 
     fetchAgentInfo(this._url, (err, agentInfo) => {
@@ -68,7 +68,7 @@ class AgentProxyCiVisibilityExporter extends CiVisibilityExporter {
           evpProxyPrefix,
         })
         this._codeCoverageReportUrl = this._url
-        if (isTestDynamicInstrumentationEnabled) {
+        if (testOptimization.DD_TEST_FAILED_TEST_REPLAY_ENABLED) {
           const canFowardLogs = getCanForwardDebuggerLogs(err, agentInfo)
           if (canFowardLogs) {
             const DynamicInstrumentationLogsWriter = require('../agentless/di-logs-writer')
diff --git a/packages/dd-trace/src/ci-visibility/exporters/agentless/coverage-writer.js b/packages/dd-trace/src/ci-visibility/exporters/agentless/coverage-writer.js
index c43f260436..782b7640bd 100644
--- a/packages/dd-trace/src/ci-visibility/exporters/agentless/coverage-writer.js
+++ b/packages/dd-trace/src/ci-visibility/exporters/agentless/coverage-writer.js
@@ -29,7 +29,7 @@ class Writer extends BaseWriter {
       path: '/api/v2/citestcov',
       method: 'POST',
       headers: {
-        'dd-api-key': getConfig().apiKey,
+        'dd-api-key': getConfig().DD_API_KEY,
         ...form.getHeaders(),
       },
       timeout: 15_000,
diff --git a/packages/dd-trace/src/ci-visibility/exporters/agentless/di-logs-writer.js b/packages/dd-trace/src/ci-visibility/exporters/agentless/di-logs-writer.js
index 2b797f2704..c92da84a30 100644
--- a/packages/dd-trace/src/ci-visibility/exporters/agentless/di-logs-writer.js
+++ b/packages/dd-trace/src/ci-visibility/exporters/agentless/di-logs-writer.js
@@ -26,7 +26,7 @@ class DynamicInstrumentationLogsWriter extends BaseWriter {
       path: '/api/v2/logs',
       method: 'POST',
       headers: {
-        'dd-api-key': getConfig().apiKey,
+        'dd-api-key': getConfig().DD_API_KEY,
         'Content-Type': 'application/json',
       },
       timeout: this.timeout,
diff --git a/packages/dd-trace/src/ci-visibility/exporters/agentless/index.js b/packages/dd-trace/src/ci-visibility/exporters/agentless/index.js
index 74d5d8bbd3..b25d5b5707 100644
--- a/packages/dd-trace/src/ci-visibility/exporters/agentless/index.js
+++ b/packages/dd-trace/src/ci-visibility/exporters/agentless/index.js
@@ -9,7 +9,8 @@ const CoverageWriter = require('./coverage-writer')
 class AgentlessCiVisibilityExporter extends CiVisibilityExporter {
   constructor (config) {
     super(config)
-    const { tags, site, DD_CIVISIBILITY_AGENTLESS_URL: url, isTestDynamicInstrumentationEnabled } = config
+    const { tags, site, testOptimization } = config
+    const { DD_CIVISIBILITY_AGENTLESS_URL: url } = testOptimization
     // we don't need to request /info because we are using agentless by configuration
     this._isInitialized = true
     this._resolveCanUseCiVisProtocol(true)
@@ -23,7 +24,7 @@ class AgentlessCiVisibilityExporter extends CiVisibilityExporter {
 
     this._codeCoverageReportUrl = url || new URL(`https://ci-intake.${site}`)
 
-    if (isTestDynamicInstrumentationEnabled) {
+    if (testOptimization.DD_TEST_FAILED_TEST_REPLAY_ENABLED) {
       const DynamicInstrumentationLogsWriter = require('./di-logs-writer')
       this._logsUrl = url || new URL(`https://http-intake.logs.${site}`)
       this._logsWriter = new DynamicInstrumentationLogsWriter({ url: this._logsUrl, tags })
diff --git a/packages/dd-trace/src/ci-visibility/exporters/agentless/writer.js b/packages/dd-trace/src/ci-visibility/exporters/agentless/writer.js
index c092e1f1a1..2fad9a633a 100644
--- a/packages/dd-trace/src/ci-visibility/exporters/agentless/writer.js
+++ b/packages/dd-trace/src/ci-visibility/exporters/agentless/writer.js
@@ -30,7 +30,7 @@ class Writer extends BaseWriter {
       path: '/api/v2/citestcycle',
       method: 'POST',
       headers: {
-        'dd-api-key': getConfig().apiKey,
+        'dd-api-key': getConfig().DD_API_KEY,
         'Content-Type': 'application/msgpack',
       },
       timeout: 15_000,
diff --git a/packages/dd-trace/src/ci-visibility/exporters/ci-visibility-exporter.js b/packages/dd-trace/src/ci-visibility/exporters/ci-visibility-exporter.js
index e92e20890e..7b3a0cf636 100644
--- a/packages/dd-trace/src/ci-visibility/exporters/ci-visibility-exporter.js
+++ b/packages/dd-trace/src/ci-visibility/exporters/ci-visibility-exporter.js
@@ -7,6 +7,8 @@ const { getSkippableSuites: getSkippableSuitesRequest } = require('../intelligen
 const { getKnownTests: getKnownTestsRequest } = require('../early-flake-detection/get-known-tests')
 const { getTestManagementTests: getTestManagementTestsRequest } =
   require('../test-management/get-test-management-tests')
+const { writeSettingsToCache } = require('../test-optimization-cache')
+const { CACHE_MISS, TestOptimizationHttpCache } = require('../test-optimization-http-cache')
 const { uploadCoverageReport: uploadCoverageReportRequest } = require('../requests/upload-coverage-report')
 const log = require('../../log')
 const BufferingExporter = require('../../exporters/common/buffering-exporter')
@@ -42,6 +44,7 @@ class CiVisibilityExporter extends BufferingExporter {
     this._coverageTimer = undefined
     this._logsTimer = undefined
     this._coverageBuffer = []
+    this._testOptimizationHttpCache = new TestOptimizationHttpCache()
     // The library can use new features like ITR and test suite level visibility
     // AKA CI Vis Protocol
     this._canUseCiVisProtocol = false
@@ -86,7 +89,7 @@ class CiVisibilityExporter extends BufferingExporter {
   }
 
   shouldRequestSkippableSuites () {
-    return !!(this._config.isIntelligentTestRunnerEnabled &&
+    return !!(this._config.testOptimization.DD_CIVISIBILITY_ITR_ENABLED &&
       this._canUseCiVisProtocol &&
       this._libraryConfig?.isSuitesSkippingEnabled)
   }
@@ -101,7 +104,7 @@ class CiVisibilityExporter extends BufferingExporter {
   shouldRequestTestManagementTests () {
     return !!(
       this._canUseCiVisProtocol &&
-      this._config.isTestManagementEnabled &&
+      this._config.testOptimization.DD_TEST_MANAGEMENT_ENABLED &&
       this._libraryConfig?.isTestManagementEnabled
     )
   }
@@ -133,11 +136,21 @@ class CiVisibilityExporter extends BufferingExporter {
     if (!this.shouldRequestSkippableSuites()) {
       return callback(null, [])
     }
+    const requestConfiguration = this.getRequestConfiguration(testConfiguration)
+    const cachedSkippableSuites = this._testOptimizationHttpCache.readSkippableSuites({
+      testLevel: requestConfiguration.testLevel,
+      isCoverageReportUploadEnabled: requestConfiguration.isCoverageReportUploadEnabled,
+    })
+    if (cachedSkippableSuites !== CACHE_MISS) {
+      const { skippableSuites, correlationId, coverage } = cachedSkippableSuites
+      return callback(null, skippableSuites, correlationId, coverage)
+    }
+
     this._gitUploadPromise.then(gitUploadError => {
       if (gitUploadError) {
         return callback(gitUploadError, [])
       }
-      getSkippableSuitesRequest(this.getRequestConfiguration(testConfiguration), callback)
+      getSkippableSuitesRequest(requestConfiguration, callback)
     })
   }
 
@@ -145,6 +158,10 @@ class CiVisibilityExporter extends BufferingExporter {
     if (!this.shouldRequestKnownTests()) {
       return callback(null)
     }
+    const cachedKnownTests = this._testOptimizationHttpCache.readKnownTests()
+    if (cachedKnownTests !== CACHE_MISS) {
+      return callback(null, cachedKnownTests)
+    }
     getKnownTestsRequest(this.getRequestConfiguration(testConfiguration), callback)
   }
 
@@ -152,6 +169,10 @@ class CiVisibilityExporter extends BufferingExporter {
     if (!this.shouldRequestTestManagementTests()) {
       return callback(null)
     }
+    const cachedTestManagementTests = this._testOptimizationHttpCache.readTestManagementTests()
+    if (cachedTestManagementTests !== CACHE_MISS) {
+      return callback(null, cachedTestManagementTests)
+    }
     getTestManagementTestsRequest(this.getRequestConfiguration(testConfiguration), callback)
   }
 
@@ -161,13 +182,30 @@ class CiVisibilityExporter extends BufferingExporter {
    */
   getLibraryConfiguration (testConfiguration, callback) {
     const { repositoryUrl } = testConfiguration
-    this.sendGitMetadata(repositoryUrl)
     this._canUseCiVisProtocolPromise.then((canUseCiVisProtocol) => {
       if (!canUseCiVisProtocol) {
         return callback(null, {})
       }
       const configuration = this.getRequestConfiguration(testConfiguration)
+      const cachedLibraryConfig = this._testOptimizationHttpCache.readSettings()
+      if (cachedLibraryConfig !== CACHE_MISS) {
+        log.debug('Test Optimization HTTP cache settings found, skipping settings request')
+        writeSettingsToCache(cachedLibraryConfig)
+        this._libraryConfig = this.filterConfiguration(cachedLibraryConfig)
+        const canUseCachedSkippableSuites = !this.shouldRequestSkippableSuites() ||
+          this._testOptimizationHttpCache.hasValidSkippableSuites({
+            testLevel: configuration.testLevel,
+            isCoverageReportUploadEnabled: configuration.isCoverageReportUploadEnabled,
+          })
+        if (this._libraryConfig.requireGit && !canUseCachedSkippableSuites) {
+          this.sendGitMetadata(repositoryUrl)
+        } else {
+          this._resolveGit()
+        }
+        return callback(null, this._libraryConfig)
+      }
 
+      this.sendGitMetadata(repositoryUrl)
       getLibraryConfigurationRequest(configuration, (err, libraryConfig) => {
         /**
          * **Important**: this._libraryConfig remains empty in testing frameworks
@@ -218,29 +256,32 @@ class CiVisibilityExporter extends BufferingExporter {
       isImpactedTestsEnabled,
       isCoverageReportUploadEnabled,
     } = remoteConfiguration
+    const { testOptimization } = this._config
     return {
       isCodeCoverageEnabled,
       isSuitesSkippingEnabled,
       isItrEnabled,
       requireGit,
-      isEarlyFlakeDetectionEnabled: isEarlyFlakeDetectionEnabled && this._config.isEarlyFlakeDetectionEnabled,
+      isEarlyFlakeDetectionEnabled:
+        isEarlyFlakeDetectionEnabled && testOptimization.DD_CIVISIBILITY_EARLY_FLAKE_DETECTION_ENABLED,
       earlyFlakeDetectionNumRetries,
       earlyFlakeDetectionSlowTestRetries,
       earlyFlakeDetectionFaultyThreshold,
-      isFlakyTestRetriesEnabled: isFlakyTestRetriesEnabled && this._config.isFlakyTestRetriesEnabled,
-      flakyTestRetriesCount: this._config.flakyTestRetriesCount,
-      isDiEnabled: isDiEnabled && this._config.isTestDynamicInstrumentationEnabled,
+      isFlakyTestRetriesEnabled: isFlakyTestRetriesEnabled && testOptimization.DD_CIVISIBILITY_FLAKY_RETRY_ENABLED,
+      flakyTestRetriesCount: testOptimization.DD_CIVISIBILITY_FLAKY_RETRY_COUNT,
+      isDiEnabled: isDiEnabled && testOptimization.DD_TEST_FAILED_TEST_REPLAY_ENABLED,
       isKnownTestsEnabled,
-      isTestManagementEnabled: isTestManagementEnabled && this._config.isTestManagementEnabled,
+      isTestManagementEnabled: isTestManagementEnabled && testOptimization.DD_TEST_MANAGEMENT_ENABLED,
       testManagementAttemptToFixRetries:
-        testManagementAttemptToFixRetries ?? this._config.testManagementAttemptToFixRetries,
-      isImpactedTestsEnabled: isImpactedTestsEnabled && this._config.isImpactedTestsEnabled,
+        testManagementAttemptToFixRetries ?? testOptimization.DD_TEST_MANAGEMENT_ATTEMPT_TO_FIX_RETRIES,
+      isImpactedTestsEnabled:
+        isImpactedTestsEnabled && testOptimization.DD_CIVISIBILITY_IMPACTED_TESTS_DETECTION_ENABLED,
       isCoverageReportUploadEnabled,
     }
   }
 
   sendGitMetadata (repositoryUrl) {
-    if (!this._config.isGitUploadEnabled) {
+    if (!this._config.testOptimization.DD_CIVISIBILITY_GIT_UPLOAD_ENABLED) {
       return
     }
     this._canUseCiVisProtocolPromise.then((canUseCiVisProtocol) => {
@@ -318,7 +359,8 @@ class CiVisibilityExporter extends BufferingExporter {
   // DI logs
   exportDiLogs (testEnvironmentMetadata, logMessage) {
     // TODO: could we lose logs if it's not initialized?
-    if (!this._config.isTestDynamicInstrumentationEnabled || !this._isInitialized || !this._canForwardLogs) {
+    if (!this._config.testOptimization.DD_TEST_FAILED_TEST_REPLAY_ENABLED ||
+      !this._isInitialized || !this._canForwardLogs) {
       return
     }
 
diff --git a/packages/dd-trace/src/ci-visibility/exporters/git/git_metadata.js b/packages/dd-trace/src/ci-visibility/exporters/git/git_metadata.js
index f8feb908a2..4fcde1070d 100644
--- a/packages/dd-trace/src/ci-visibility/exporters/git/git_metadata.js
+++ b/packages/dd-trace/src/ci-visibility/exporters/git/git_metadata.js
@@ -50,7 +50,7 @@ function getCommonRequestOptions (url) {
   return {
     method: 'POST',
     headers: {
-      'dd-api-key': getConfig().apiKey,
+      'dd-api-key': getConfig().DD_API_KEY,
     },
     timeout: 15_000,
     url,
@@ -287,7 +287,7 @@ function sendGitMetadata (url, { isEvpProxy, evpProxyPrefix }, configRepositoryU
     }
     // Otherwise we unshallow and get commits to upload again
     log.debug('It is shallow clone, unshallowing...')
-    if (getConfig().DD_CIVISIBILITY_GIT_UNSHALLOW_ENABLED) {
+    if (getConfig().testOptimization.DD_CIVISIBILITY_GIT_UNSHALLOW_ENABLED) {
       unshallowRepository(false)
     }
 
diff --git a/packages/dd-trace/src/ci-visibility/exporters/test-worker/writer.js b/packages/dd-trace/src/ci-visibility/exporters/test-worker/writer.js
index af364020cd..fb48f570d1 100644
--- a/packages/dd-trace/src/ci-visibility/exporters/test-worker/writer.js
+++ b/packages/dd-trace/src/ci-visibility/exporters/test-worker/writer.js
@@ -3,6 +3,11 @@ const { JSONEncoder } = require('../../encode/json-encoder')
 const { getEnvironmentVariable } = require('../../../config/helper')
 const log = require('../../../log')
 
+function getVitestWorkerPort () {
+  const port = globalThis.__vitest_worker__?.ctx?.port
+  return typeof port?.postMessage === 'function' ? port : undefined
+}
+
 class Writer {
   constructor (interprocessCode) {
     this._encoder = new JSONEncoder()
@@ -37,6 +42,18 @@ class Writer {
       ? { __tinypool_worker_message__: true, interprocessCode: this._interprocessCode, data }
       : [this._interprocessCode, data]
 
+    const vitestWorkerPort = getVitestWorkerPort()
+    if (vitestWorkerPort) {
+      try {
+        vitestWorkerPort.postMessage(payload)
+      } catch (error) {
+        log.error('Error posting message to vitest worker port', error)
+      } finally {
+        onDone()
+      }
+      return
+    }
+
     // child_process workers (jest default, cucumber)
     if (process.send) {
       process.send(payload, () => {
diff --git a/packages/dd-trace/src/ci-visibility/intelligent-test-runner/get-skippable-suites.js b/packages/dd-trace/src/ci-visibility/intelligent-test-runner/get-skippable-suites.js
index 011f9a92f8..1402f34346 100644
--- a/packages/dd-trace/src/ci-visibility/intelligent-test-runner/get-skippable-suites.js
+++ b/packages/dd-trace/src/ci-visibility/intelligent-test-runner/get-skippable-suites.js
@@ -14,6 +14,42 @@ const {
   TELEMETRY_ITR_SKIPPABLE_TESTS_RESPONSE_BYTES,
 } = require('../../ci-visibility/telemetry')
 const { buildCacheKey, writeToCache, withCache } = require('../requests/fs-cache')
+const { validateSkippableTestsResponse } = require('../test-optimization-http-cache-schema')
+
+function parseJsonResponse (rawJson) {
+  return typeof rawJson === 'string' ? JSON.parse(rawJson) : rawJson
+}
+
+function parseSkippableSuitesResponse (
+  rawJson,
+  { testLevel = 'suite', isCoverageReportUploadEnabled = false, validateRequiredFields = false } = {}
+) {
+  const parsedResponse = parseJsonResponse(rawJson)
+  if (validateRequiredFields) {
+    validateSkippableTestsResponse(parsedResponse)
+  }
+  const coverage = parsedResponse.meta?.coverage || {}
+
+  const skippableItems = parsedResponse
+    .data
+    .filter(({ type }) => type === testLevel)
+  const skippableSuites = []
+  for (const {
+    attributes: {
+      suite,
+      name,
+      _is_missing_line_code_coverage: isMissingLineCodeCoverage,
+    },
+  } of skippableItems) {
+    // Only reject candidates without backend line coverage when we need that coverage to backfill reports.
+    if (isCoverageReportUploadEnabled && isMissingLineCodeCoverage) continue
+
+    skippableSuites.push(testLevel === 'suite' ? suite : { suite, name })
+  }
+  const correlationId = parsedResponse.meta?.correlation_id
+
+  return { skippableSuites, correlationId, coverage }
+}
 
 function getSkippableSuites ({
   url,
@@ -124,12 +160,12 @@ function fetchFromApi ({
     options.path = `${evpProxyPrefix}/api/v2/ci/tests/skippable`
     options.headers['X-Datadog-EVP-Subdomain'] = 'api'
   } else {
-    const { apiKey } = getConfig()
-    if (!apiKey) {
+    const { DD_API_KEY } = getConfig()
+    if (!DD_API_KEY) {
       return done(new Error('Skippable suites were not fetched because Datadog API key is not defined.'))
     }
 
-    options.headers['dd-api-key'] = apiKey
+    options.headers['dd-api-key'] = DD_API_KEY
   }
 
   const data = JSON.stringify({
@@ -163,26 +199,12 @@ function fetchFromApi ({
       done(err)
     } else {
       try {
-        const parsedResponse = JSON.parse(res)
-        const coverage = parsedResponse.meta?.coverage || {}
-
-        const skippableItems = parsedResponse
-          .data
-          .filter(({ type }) => type === testLevel)
-        const skippableSuites = []
-        for (const {
-          attributes: {
-            suite,
-            name,
-            _is_missing_line_code_coverage: isMissingLineCodeCoverage,
-          },
-        } of skippableItems) {
-          // Only reject candidates without backend line coverage when we need that coverage to backfill reports.
-          if (isCoverageReportUploadEnabled && isMissingLineCodeCoverage) continue
-
-          skippableSuites.push(testLevel === 'suite' ? suite : { suite, name })
-        }
-        const correlationId = parsedResponse.meta?.correlation_id
+        const parsedResponse = parseJsonResponse(res)
+        const result = parseSkippableSuitesResponse(parsedResponse, {
+          testLevel,
+          isCoverageReportUploadEnabled,
+        })
+        const skippableItems = parsedResponse.data.filter(({ type }) => type === testLevel)
         incrementCountMetric(
           testLevel === 'test'
             ? TELEMETRY_ITR_SKIPPABLE_TESTS_RESPONSE_TESTS
@@ -191,9 +213,8 @@ function fetchFromApi ({
           skippableItems.length
         )
         distributionMetric(TELEMETRY_ITR_SKIPPABLE_TESTS_RESPONSE_BYTES, {}, res.length)
-        log.debug('Number of received skippable %ss:', testLevel, skippableSuites.length)
+        log.debug('Number of received skippable %ss:', testLevel, result.skippableSuites.length)
 
-        const result = { skippableSuites, correlationId, coverage }
         writeToCache(cacheKey, result)
 
         done(null, result)
@@ -204,4 +225,4 @@ function fetchFromApi ({
   })
 }
 
-module.exports = { getSkippableSuites }
+module.exports = { getSkippableSuites, parseSkippableSuitesResponse }
diff --git a/packages/dd-trace/src/ci-visibility/log-submission/log-submission-plugin.js b/packages/dd-trace/src/ci-visibility/log-submission/log-submission-plugin.js
index 852fcf4127..86695d0ebb 100644
--- a/packages/dd-trace/src/ci-visibility/log-submission/log-submission-plugin.js
+++ b/packages/dd-trace/src/ci-visibility/log-submission/log-submission-plugin.js
@@ -4,14 +4,14 @@ const Plugin = require('../../plugins/plugin')
 const log = require('../../log')
 
 function getWinstonLogSubmissionParameters (config) {
-  const { site, service, apiKey, DD_AGENTLESS_LOG_SUBMISSION_URL } = config
+  const { site, service, DD_API_KEY, DD_AGENTLESS_LOG_SUBMISSION_URL } = config
 
   const defaultParameters = {
     host: `http-intake.logs.${site}`,
     path: `/api/v2/logs?ddsource=winston&service=${service}`,
     ssl: true,
     headers: {
-      'DD-API-KEY': apiKey,
+      'DD-API-KEY': DD_API_KEY,
     },
   }
 
diff --git a/packages/dd-trace/src/ci-visibility/requests/get-library-configuration.js b/packages/dd-trace/src/ci-visibility/requests/get-library-configuration.js
index 816a61d83e..aad4594155 100644
--- a/packages/dd-trace/src/ci-visibility/requests/get-library-configuration.js
+++ b/packages/dd-trace/src/ci-visibility/requests/get-library-configuration.js
@@ -12,12 +12,72 @@ const {
   TELEMETRY_GIT_REQUESTS_SETTINGS_RESPONSE,
 } = require('../telemetry')
 const { writeSettingsToCache } = require('../test-optimization-cache')
+const { validateSettingsResponse } = require('../test-optimization-http-cache-schema')
 const request = require('./request')
 
 const DEFAULT_EARLY_FLAKE_DETECTION_NUM_RETRIES = 2
 const DEFAULT_EARLY_FLAKE_DETECTION_SLOW_TEST_RETRIES = { '5s': 10, '10s': 5, '30s': 3, '5m': 2 }
 const DEFAULT_EARLY_FLAKE_DETECTION_ERROR_THRESHOLD = 30
 
+function parseJsonResponse (rawJson) {
+  return typeof rawJson === 'string' ? JSON.parse(rawJson) : rawJson
+}
+
+function parseLibraryConfigurationResponse (rawJson, config = getConfig(), options = {}) {
+  const parsedResponse = parseJsonResponse(rawJson)
+  if (options.validateRequiredFields) {
+    validateSettingsResponse(parsedResponse)
+  }
+  const {
+    code_coverage: isCodeCoverageEnabled,
+    tests_skipping: isSuitesSkippingEnabled,
+    itr_enabled: isItrEnabled,
+    require_git: requireGit,
+    early_flake_detection: earlyFlakeDetectionConfig,
+    flaky_test_retries_enabled: isFlakyTestRetriesEnabled,
+    di_enabled: isDiEnabled,
+    known_tests_enabled: isKnownTestsEnabled,
+    test_management: testManagementConfig,
+    impacted_tests_enabled: isImpactedTestsEnabled,
+    coverage_report_upload_enabled: isCoverageReportUploadEnabled,
+  } = parsedResponse?.data?.attributes ?? parsedResponse
+
+  const settings = {
+    isCodeCoverageEnabled,
+    isSuitesSkippingEnabled,
+    isItrEnabled,
+    requireGit,
+    isEarlyFlakeDetectionEnabled: isKnownTestsEnabled && (earlyFlakeDetectionConfig?.enabled ?? false),
+    earlyFlakeDetectionNumRetries:
+      earlyFlakeDetectionConfig?.slow_test_retries?.['5s'] || DEFAULT_EARLY_FLAKE_DETECTION_NUM_RETRIES,
+    earlyFlakeDetectionSlowTestRetries:
+      earlyFlakeDetectionConfig?.slow_test_retries ?? DEFAULT_EARLY_FLAKE_DETECTION_SLOW_TEST_RETRIES,
+    earlyFlakeDetectionFaultyThreshold:
+      earlyFlakeDetectionConfig?.faulty_session_threshold ?? DEFAULT_EARLY_FLAKE_DETECTION_ERROR_THRESHOLD,
+    isFlakyTestRetriesEnabled,
+    isDiEnabled: isDiEnabled && isFlakyTestRetriesEnabled,
+    isKnownTestsEnabled,
+    isTestManagementEnabled: (testManagementConfig?.enabled ?? false),
+    testManagementAttemptToFixRetries:
+      testManagementConfig?.attempt_to_fix_retries,
+    isImpactedTestsEnabled,
+    isCoverageReportUploadEnabled: isCoverageReportUploadEnabled ?? false,
+  }
+
+  log.debug('Remote settings: %j', settings)
+
+  if (config.testOptimization.DD_CIVISIBILITY_DANGEROUSLY_FORCE_COVERAGE) {
+    settings.isCodeCoverageEnabled = true
+    log.debug('Dangerously set code coverage to true')
+  }
+  if (config.testOptimization.DD_CIVISIBILITY_DANGEROUSLY_FORCE_TEST_SKIPPING) {
+    settings.isSuitesSkippingEnabled = true
+    log.debug('Dangerously set test skipping to true')
+  }
+
+  return settings
+}
+
 function getLibraryConfiguration ({
   url,
   isEvpProxy,
@@ -51,10 +111,10 @@ function getLibraryConfiguration ({
     options.path = `${evpProxyPrefix}/api/v2/libraries/tests/services/setting`
     options.headers['X-Datadog-EVP-Subdomain'] = 'api'
   } else {
-    if (!config.apiKey) {
+    if (!config.DD_API_KEY) {
       return done(new Error('Request to settings endpoint was not done because Datadog API key is not defined.'))
     }
-    options.headers['dd-api-key'] = config.apiKey
+    options.headers['dd-api-key'] = config.DD_API_KEY
   }
 
   const data = JSON.stringify({
@@ -90,56 +150,7 @@ function getLibraryConfiguration ({
       done(err)
     } else {
       try {
-        const {
-          data: {
-            attributes: {
-              code_coverage: isCodeCoverageEnabled,
-              tests_skipping: isSuitesSkippingEnabled,
-              itr_enabled: isItrEnabled,
-              require_git: requireGit,
-              early_flake_detection: earlyFlakeDetectionConfig,
-              flaky_test_retries_enabled: isFlakyTestRetriesEnabled,
-              di_enabled: isDiEnabled,
-              known_tests_enabled: isKnownTestsEnabled,
-              test_management: testManagementConfig,
-              impacted_tests_enabled: isImpactedTestsEnabled,
-              coverage_report_upload_enabled: isCoverageReportUploadEnabled,
-            },
-          },
-        } = JSON.parse(res)
-
-        const settings = {
-          isCodeCoverageEnabled,
-          isSuitesSkippingEnabled,
-          isItrEnabled,
-          requireGit,
-          isEarlyFlakeDetectionEnabled: isKnownTestsEnabled && (earlyFlakeDetectionConfig?.enabled ?? false),
-          earlyFlakeDetectionNumRetries:
-            earlyFlakeDetectionConfig?.slow_test_retries?.['5s'] || DEFAULT_EARLY_FLAKE_DETECTION_NUM_RETRIES,
-          earlyFlakeDetectionSlowTestRetries:
-            earlyFlakeDetectionConfig?.slow_test_retries ?? DEFAULT_EARLY_FLAKE_DETECTION_SLOW_TEST_RETRIES,
-          earlyFlakeDetectionFaultyThreshold:
-            earlyFlakeDetectionConfig?.faulty_session_threshold ?? DEFAULT_EARLY_FLAKE_DETECTION_ERROR_THRESHOLD,
-          isFlakyTestRetriesEnabled,
-          isDiEnabled: isDiEnabled && isFlakyTestRetriesEnabled,
-          isKnownTestsEnabled,
-          isTestManagementEnabled: (testManagementConfig?.enabled ?? false),
-          testManagementAttemptToFixRetries:
-            testManagementConfig?.attempt_to_fix_retries,
-          isImpactedTestsEnabled,
-          isCoverageReportUploadEnabled: isCoverageReportUploadEnabled ?? false,
-        }
-
-        log.debug('Remote settings: %j', settings)
-
-        if (config.DD_CIVISIBILITY_DANGEROUSLY_FORCE_COVERAGE) {
-          settings.isCodeCoverageEnabled = true
-          log.debug('Dangerously set code coverage to true')
-        }
-        if (config.DD_CIVISIBILITY_DANGEROUSLY_FORCE_TEST_SKIPPING) {
-          settings.isSuitesSkippingEnabled = true
-          log.debug('Dangerously set test skipping to true')
-        }
+        const settings = parseLibraryConfigurationResponse(res, config)
 
         incrementCountMetric(TELEMETRY_GIT_REQUESTS_SETTINGS_RESPONSE, settings)
 
@@ -153,4 +164,4 @@ function getLibraryConfiguration ({
   })
 }
 
-module.exports = { getLibraryConfiguration }
+module.exports = { getLibraryConfiguration, parseLibraryConfigurationResponse }
diff --git a/packages/dd-trace/src/ci-visibility/requests/upload-coverage-report.js b/packages/dd-trace/src/ci-visibility/requests/upload-coverage-report.js
index b7d16c1af7..8b598fd6da 100644
--- a/packages/dd-trace/src/ci-visibility/requests/upload-coverage-report.js
+++ b/packages/dd-trace/src/ci-visibility/requests/upload-coverage-report.js
@@ -34,9 +34,9 @@ function uploadCoverageReport (
   { filePath, format, testEnvironmentMetadata, url, isEvpProxy, evpProxyPrefix },
   callback
 ) {
-  const apiKey = getConfig().apiKey
+  const { DD_API_KEY } = getConfig()
 
-  if (!apiKey && !isEvpProxy) {
+  if (!DD_API_KEY && !isEvpProxy) {
     return callback(new Error('DD_API_KEY is required for coverage report upload'))
   }
 
@@ -82,7 +82,7 @@ function uploadCoverageReport (
     options.headers['X-Datadog-EVP-Subdomain'] = 'ci-intake'
   } else {
     options.path = '/api/v2/cicovreprt'
-    options.headers['dd-api-key'] = apiKey
+    options.headers['dd-api-key'] = DD_API_KEY
   }
 
   log.debug('Uploading coverage report %s to %s%s', filePath, url, options.path)
diff --git a/packages/dd-trace/src/ci-visibility/test-management/get-test-management-tests.js b/packages/dd-trace/src/ci-visibility/test-management/get-test-management-tests.js
index 7191c2f058..f8b9eaaf6e 100644
--- a/packages/dd-trace/src/ci-visibility/test-management/get-test-management-tests.js
+++ b/packages/dd-trace/src/ci-visibility/test-management/get-test-management-tests.js
@@ -16,6 +16,7 @@ const {
 } = require('../telemetry')
 
 const { buildCacheKey, writeToCache, withCache } = require('../requests/fs-cache')
+const { validateTestManagementTestsResponse } = require('../test-optimization-http-cache-schema')
 
 // Calculate the number of tests from the test management tests response, which has a shape like:
 // { module: { suites: { suite: { tests: { testName: { properties: {...} } } } } } }
@@ -39,6 +40,19 @@ function getNumFromTestManagementTests (testManagementTests) {
   return totalNumTests
 }
 
+function parseJsonResponse (rawJson) {
+  return typeof rawJson === 'string' ? JSON.parse(rawJson) : rawJson
+}
+
+function parseTestManagementTestsResponse (rawJson, options = {}) {
+  const parsedResponse = parseJsonResponse(rawJson)
+  if (options.validateRequiredFields) {
+    validateTestManagementTestsResponse(parsedResponse)
+  }
+  const { data: { attributes: { modules: testManagementTests } } } = parsedResponse
+  return testManagementTests
+}
+
 function getTestManagementTests ({
   url,
   isEvpProxy,
@@ -121,12 +135,12 @@ function fetchFromApi ({
     options.path = `${evpProxyPrefix}/api/v2/test/libraries/test-management/tests`
     options.headers['X-Datadog-EVP-Subdomain'] = 'api'
   } else {
-    const { apiKey } = getConfig()
-    if (!apiKey) {
+    const { DD_API_KEY } = getConfig()
+    if (!DD_API_KEY) {
       return done(new Error('Test management tests were not fetched because Datadog API key is not defined.'))
     }
 
-    options.headers['dd-api-key'] = apiKey
+    options.headers['dd-api-key'] = DD_API_KEY
   }
 
   const data = JSON.stringify({
@@ -155,7 +169,7 @@ function fetchFromApi ({
       done(err)
     } else {
       try {
-        const { data: { attributes: { modules: testManagementTests } } } = JSON.parse(res)
+        const testManagementTests = parseTestManagementTestsResponse(res)
 
         const numTests = getNumFromTestManagementTests(testManagementTests)
 
@@ -174,4 +188,8 @@ function fetchFromApi ({
   })
 }
 
-module.exports = { getTestManagementTests }
+module.exports = {
+  getNumFromTestManagementTests, // Exported for later use in the cache
+  getTestManagementTests,
+  parseTestManagementTestsResponse,
+}
diff --git a/packages/dd-trace/src/ci-visibility/test-optimization-http-cache-schema.js b/packages/dd-trace/src/ci-visibility/test-optimization-http-cache-schema.js
new file mode 100644
index 0000000000..9f68258e9d
--- /dev/null
+++ b/packages/dd-trace/src/ci-visibility/test-optimization-http-cache-schema.js
@@ -0,0 +1,128 @@
+'use strict'
+
+const REQUIRED_SETTINGS_KEYS = [
+  'code_coverage',
+  'tests_skipping',
+  'itr_enabled',
+  'require_git',
+  'early_flake_detection',
+  'flaky_test_retries_enabled',
+  'di_enabled',
+  'known_tests_enabled',
+  'test_management',
+  'impacted_tests_enabled',
+  'coverage_report_upload_enabled',
+]
+
+function isObject (value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+}
+
+function assertObject (value, message) {
+  if (!isObject(value)) {
+    throw new Error(message)
+  }
+}
+
+function assertHasKeys (value, keys, endpoint) {
+  for (const key of keys) {
+    if (!Object.hasOwn(value, key)) {
+      throw new Error(`Invalid ${endpoint} response: missing ${key}`)
+    }
+  }
+}
+
+function getAttributes (response, endpoint) {
+  const attributes = response?.data?.attributes
+  assertObject(attributes, `Invalid ${endpoint} response: attributes must be an object`)
+  return attributes
+}
+
+function validateSettingsResponse (response) {
+  const attributes = response?.data?.attributes ?? response
+  assertObject(attributes, 'Invalid settings response: attributes must be an object')
+  assertHasKeys(attributes, REQUIRED_SETTINGS_KEYS, 'settings')
+  assertObject(attributes.early_flake_detection, 'Invalid settings response: early_flake_detection must be an object')
+  assertObject(attributes.test_management, 'Invalid settings response: test_management must be an object')
+  assertHasKeys(attributes.early_flake_detection, ['enabled'], 'settings early_flake_detection')
+  assertHasKeys(attributes.test_management, ['enabled'], 'settings test_management')
+}
+
+function validateKnownTestsResponse (response) {
+  const attributes = getAttributes(response, 'known tests')
+  assertHasKeys(attributes, ['tests'], 'known tests')
+
+  const { tests } = attributes
+  if (tests === null) return
+  assertObject(tests, 'Invalid known tests response: tests must be an object or null')
+
+  for (const suites of Object.values(tests)) {
+    assertObject(suites, 'Invalid known tests response: module suites must be objects')
+    for (const testNames of Object.values(suites)) {
+      if (!Array.isArray(testNames)) {
+        throw new TypeError('Invalid known tests response: suite tests must be arrays')
+      }
+      for (const testName of testNames) {
+        if (typeof testName !== 'string') {
+          throw new TypeError('Invalid known tests response: test names must be strings')
+        }
+      }
+    }
+  }
+}
+
+function validateSkippableTestsResponse (response) {
+  assertObject(response, 'Invalid skippable tests response: response must be an object')
+  if (!Array.isArray(response.data)) {
+    throw new TypeError('Invalid skippable tests response: data must be an array')
+  }
+  if (response.meta !== undefined) {
+    assertObject(response.meta, 'Invalid skippable tests response: meta must be an object')
+  }
+  if (response.meta?.coverage !== undefined) {
+    assertObject(response.meta.coverage, 'Invalid skippable tests response: meta.coverage must be an object')
+  }
+  if (response.meta?.correlation_id !== undefined && typeof response.meta.correlation_id !== 'string') {
+    throw new Error('Invalid skippable tests response: meta.correlation_id must be a string')
+  }
+
+  for (const item of response.data) {
+    assertObject(item, 'Invalid skippable tests response: data entries must be objects')
+    if (typeof item.type !== 'string') {
+      throw new TypeError('Invalid skippable tests response: data entry type must be a string')
+    }
+    assertObject(item.attributes, 'Invalid skippable tests response: data entry attributes must be an object')
+    if ((item.type === 'suite' || item.type === 'test') && typeof item.attributes.suite !== 'string') {
+      throw new Error('Invalid skippable tests response: data entry suite must be a string')
+    }
+    if (item.type === 'test' && typeof item.attributes.name !== 'string') {
+      throw new Error('Invalid skippable tests response: data entry name must be a string')
+    }
+  }
+}
+
+function validateTestManagementTestsResponse (response) {
+  const attributes = getAttributes(response, 'test management tests')
+  assertHasKeys(attributes, ['modules'], 'test management tests')
+  assertObject(attributes.modules, 'Invalid test management tests response: modules must be an object')
+
+  for (const testModule of Object.values(attributes.modules)) {
+    assertObject(testModule, 'Invalid test management tests response: modules entries must be objects')
+    assertObject(testModule.suites, 'Invalid test management tests response: module suites must be objects')
+    for (const suite of Object.values(testModule.suites)) {
+      assertObject(suite, 'Invalid test management tests response: suites entries must be objects')
+      assertObject(suite.tests, 'Invalid test management tests response: suite tests must be objects')
+      for (const test of Object.values(suite.tests)) {
+        assertObject(test, 'Invalid test management tests response: tests entries must be objects')
+        assertObject(test.properties, 'Invalid test management tests response: test properties must be objects')
+      }
+    }
+  }
+}
+
+module.exports = {
+  validateKnownTestsResponse,
+  validateSettingsResponse,
+  validateSkippableTestsResponse,
+  validateTestManagementTestsResponse,
+}
diff --git a/packages/dd-trace/src/ci-visibility/test-optimization-http-cache.js b/packages/dd-trace/src/ci-visibility/test-optimization-http-cache.js
new file mode 100644
index 0000000000..a7b4ac11f5
--- /dev/null
+++ b/packages/dd-trace/src/ci-visibility/test-optimization-http-cache.js
@@ -0,0 +1,287 @@
+'use strict'
+
+const fs = require('node:fs')
+const path = require('node:path')
+
+const log = require('../log')
+const { getNumFromKnownTests } = require('../plugins/util/test')
+const { parseKnownTestsResponse } = require('./early-flake-detection/get-known-tests')
+const { parseSkippableSuitesResponse } = require('./intelligent-test-runner/get-skippable-suites')
+const { parseLibraryConfigurationResponse } = require('./requests/get-library-configuration')
+const {
+  getNumFromTestManagementTests,
+  parseTestManagementTestsResponse,
+} = require('./test-management/get-test-management-tests')
+const {
+  incrementCountMetric,
+  distributionMetric,
+  TELEMETRY_GIT_REQUESTS_SETTINGS_RESPONSE,
+  TELEMETRY_KNOWN_TESTS_RESPONSE_TESTS,
+  TELEMETRY_KNOWN_TESTS_RESPONSE_BYTES,
+  TELEMETRY_ITR_SKIPPABLE_TESTS_RESPONSE_SUITES,
+  TELEMETRY_ITR_SKIPPABLE_TESTS_RESPONSE_TESTS,
+  TELEMETRY_ITR_SKIPPABLE_TESTS_RESPONSE_BYTES,
+  TELEMETRY_TEST_MANAGEMENT_TESTS_RESPONSE_TESTS,
+  TELEMETRY_TEST_MANAGEMENT_TESTS_RESPONSE_BYTES,
+} = require('./telemetry')
+
+const CACHE_MISS = Symbol('test optimization http cache miss')
+
+const PLAN_FOLDER = '.testoptimization'
+const MANIFEST_FILE_NAME = 'manifest.txt'
+const SUPPORTED_MANIFEST_VERSION = '1'
+const CACHE_FOLDER_NAME = 'cache'
+const HTTP_CACHE_FOLDER_NAME = 'http'
+
+const ENV_MANIFEST_FILE = 'TEST_OPTIMIZATION_MANIFEST_FILE'
+const ENV_MANIFEST_FILE_ALIAS = 'DD_TEST_OPTIMIZATION_MANIFEST_FILE'
+const ENV_RUNFILES_DIR = 'RUNFILES_DIR'
+const ENV_RUNFILES_MANIFEST_FILE = 'RUNFILES_MANIFEST_FILE'
+const ENV_TEST_SRCDIR = 'TEST_SRCDIR'
+
+const SETTINGS_FILE_NAME = 'settings.json'
+const KNOWN_TESTS_FILE_NAME = 'known_tests.json'
+const SKIPPABLE_TESTS_FILE_NAME = 'skippable_tests.json'
+const TEST_MANAGEMENT_FILE_NAME = 'test_management.json'
+
+const RUNFILES_MANIFEST_SEPARATOR = ' '
+
+function parseManifestVersion (content) {
+  // Supported just the number version or 'version=x'
+  const version = content.replace(/^\uFEFF/, '').trim()
+  const match = version.match(/^version=(.+)$/)
+  return match ? match[1].trim() : version
+}
+
+class TestOptimizationHttpCache {
+  constructor ({ cwd = process.cwd(), env } = {}) {
+    this._cwd = cwd
+    // This cache intentionally consumes env vars that are not tracer config keys. (??)
+    // eslint-disable-next-line eslint-rules/eslint-process-env
+    this._env = env ?? process.env
+    this._manifestPath = this._resolveManifestPath()
+    this._testOptimizationPath = undefined
+    this._httpCachePath = undefined
+    this._available = false
+
+    this._buildReader()
+  }
+
+  isAvailable () {
+    return this._available
+  }
+
+  readSettings () {
+    const payload = this._readFile(SETTINGS_FILE_NAME)
+    if (payload === CACHE_MISS) {
+      this._disable()
+      return CACHE_MISS
+    }
+
+    try {
+      const settings = parseLibraryConfigurationResponse(payload, undefined, { validateRequiredFields: true })
+      incrementCountMetric(TELEMETRY_GIT_REQUESTS_SETTINGS_RESPONSE, settings)
+      return settings
+    } catch (err) {
+      this._logInvalidCacheFile(SETTINGS_FILE_NAME, err)
+      this._disable()
+      return CACHE_MISS
+    }
+  }
+
+  readKnownTests () {
+    const payload = this._readFile(KNOWN_TESTS_FILE_NAME)
+    if (payload === CACHE_MISS) return CACHE_MISS
+
+    try {
+      const knownTests = parseKnownTestsResponse(payload, { validateRequiredFields: true })
+      distributionMetric(TELEMETRY_KNOWN_TESTS_RESPONSE_TESTS, {}, getNumFromKnownTests(knownTests))
+      distributionMetric(TELEMETRY_KNOWN_TESTS_RESPONSE_BYTES, {}, payload.length)
+      return knownTests
+    } catch (err) {
+      this._logInvalidCacheFile(KNOWN_TESTS_FILE_NAME, err)
+      return CACHE_MISS
+    }
+  }
+
+  readSkippableSuites (options = {}) {
+    const payload = this._readFile(SKIPPABLE_TESTS_FILE_NAME)
+    if (payload === CACHE_MISS) return CACHE_MISS
+
+    try {
+      const parsedResponse = JSON.parse(payload)
+      const result = parseSkippableSuitesResponse(parsedResponse, { ...options, validateRequiredFields: true })
+      const testLevel = options.testLevel || 'suite'
+      const skippableItems = parsedResponse.data.filter(({ type }) => type === testLevel)
+      incrementCountMetric(
+        testLevel === 'test'
+          ? TELEMETRY_ITR_SKIPPABLE_TESTS_RESPONSE_TESTS
+          : TELEMETRY_ITR_SKIPPABLE_TESTS_RESPONSE_SUITES,
+        {},
+        skippableItems.length
+      )
+      distributionMetric(TELEMETRY_ITR_SKIPPABLE_TESTS_RESPONSE_BYTES, {}, payload.length)
+      return result
+    } catch (err) {
+      this._logInvalidCacheFile(SKIPPABLE_TESTS_FILE_NAME, err)
+      return CACHE_MISS
+    }
+  }
+
+  hasValidSkippableSuites (options = {}) {
+    const payload = this._readFile(SKIPPABLE_TESTS_FILE_NAME)
+    if (payload === CACHE_MISS) return false
+
+    try {
+      parseSkippableSuitesResponse(JSON.parse(payload), { ...options, validateRequiredFields: true })
+      return true
+    } catch {
+      return false
+    }
+  }
+
+  readTestManagementTests () {
+    const payload = this._readFile(TEST_MANAGEMENT_FILE_NAME)
+    if (payload === CACHE_MISS) return CACHE_MISS
+
+    try {
+      const testManagementTests = parseTestManagementTestsResponse(payload, { validateRequiredFields: true })
+      distributionMetric(
+        TELEMETRY_TEST_MANAGEMENT_TESTS_RESPONSE_TESTS,
+        {},
+        getNumFromTestManagementTests(testManagementTests)
+      )
+      distributionMetric(TELEMETRY_TEST_MANAGEMENT_TESTS_RESPONSE_BYTES, {}, payload.length)
+      return testManagementTests
+    } catch (err) {
+      this._logInvalidCacheFile(TEST_MANAGEMENT_FILE_NAME, err)
+      return CACHE_MISS
+    }
+  }
+
+  _buildReader () {
+    if (!this._manifestPath) {
+      log.debug('Test Optimization HTTP cache manifest not found')
+      return
+    }
+
+    const version = this._readManifestVersion(this._manifestPath)
+    if (version !== SUPPORTED_MANIFEST_VERSION) {
+      log.debug('Unsupported Test Optimization HTTP cache manifest version %j at %s', version, this._manifestPath)
+      return
+    }
+
+    this._testOptimizationPath = path.dirname(this._manifestPath)
+    this._httpCachePath = path.join(
+      this._testOptimizationPath,
+      CACHE_FOLDER_NAME,
+      HTTP_CACHE_FOLDER_NAME
+    )
+
+    const settingsPath = path.join(this._httpCachePath, SETTINGS_FILE_NAME)
+    if (!fs.existsSync(settingsPath)) {
+      log.debug('Test Optimization HTTP cache settings file not found at %s', settingsPath)
+      return
+    }
+
+    log.debug('Test Optimization HTTP cache found at %s', this._httpCachePath)
+    this._available = true
+  }
+
+  _resolveManifestPath () {
+    const localManifest = path.join(this._cwd, PLAN_FOLDER, MANIFEST_FILE_NAME)
+    if (fs.existsSync(localManifest)) {
+      return localManifest
+    }
+
+    const manifestFile = this._env[ENV_MANIFEST_FILE] || this._env[ENV_MANIFEST_FILE_ALIAS]
+    if (!manifestFile) return
+
+    const resolvedManifestPath = this._resolveRunfilePath(manifestFile)
+    if (fs.existsSync(resolvedManifestPath)) {
+      return resolvedManifestPath
+    }
+  }
+
+  _resolveRunfilePath (manifestFile) {
+    if (fs.existsSync(manifestFile)) {
+      return manifestFile
+    }
+
+    const runfilesDir = this._env[ENV_RUNFILES_DIR]
+    if (runfilesDir) {
+      const candidate = path.join(runfilesDir, manifestFile)
+      if (fs.existsSync(candidate)) {
+        return candidate
+      }
+    }
+
+    const runfilesManifestCandidate = this._resolveRunfilePathFromManifest(manifestFile)
+    if (runfilesManifestCandidate) {
+      return runfilesManifestCandidate
+    }
+
+    const testSrcdir = this._env[ENV_TEST_SRCDIR]
+    if (testSrcdir) {
+      const candidate = path.join(testSrcdir, manifestFile)
+      if (fs.existsSync(candidate)) {
+        return candidate
+      }
+    }
+
+    return manifestFile
+  }
+
+  _resolveRunfilePathFromManifest (manifestFile) {
+    const runfilesManifest = this._env[ENV_RUNFILES_MANIFEST_FILE]
+    if (!runfilesManifest || !fs.existsSync(runfilesManifest)) return
+
+    try {
+      const lines = fs.readFileSync(runfilesManifest, 'utf8').split('\n')
+      for (const line of lines) {
+        const separatorIndex = line.indexOf(RUNFILES_MANIFEST_SEPARATOR)
+        if (separatorIndex <= 0) continue
+        if (line.slice(0, separatorIndex) !== manifestFile) continue
+
+        const resolvedPath = line.slice(separatorIndex + 1).trim()
+        if (resolvedPath) return resolvedPath
+      }
+    } catch (err) {
+      log.debug('Failed to resolve Test Optimization HTTP cache manifest from %s: %s', runfilesManifest, err.message)
+    }
+  }
+
+  _readManifestVersion (manifestPath) {
+    try {
+      return parseManifestVersion(fs.readFileSync(manifestPath, 'utf8'))
+    } catch (err) {
+      log.debug('Failed to read Test Optimization HTTP cache manifest %s: %s', manifestPath, err.message)
+    }
+  }
+
+  _readFile (fileName) {
+    if (!this.isAvailable()) return CACHE_MISS
+
+    const filePath = path.join(this._httpCachePath, fileName)
+    try {
+      log.debug('Reading Test Optimization HTTP cache file %s', filePath)
+      return fs.readFileSync(filePath, 'utf8')
+    } catch (err) {
+      log.debug('Test Optimization HTTP cache file %s could not be read: %s', filePath, err.message)
+      return CACHE_MISS
+    }
+  }
+
+  _logInvalidCacheFile (fileName, err) {
+    log.debug('Test Optimization HTTP cache file %s could not be parsed: %s', fileName, err.message)
+  }
+
+  _disable () {
+    this._available = false
+  }
+}
+
+module.exports = {
+  CACHE_MISS,
+  TestOptimizationHttpCache,
+}
diff --git a/packages/dd-trace/src/config/defaults.js b/packages/dd-trace/src/config/defaults.js
index 8feaf5d7a9..595672d60f 100644
--- a/packages/dd-trace/src/config/defaults.js
+++ b/packages/dd-trace/src/config/defaults.js
@@ -227,8 +227,9 @@ for (const [canonicalName, entries] of Object.entries(supportedConfigurations))
     if (entry.sensitive) {
       sensitiveConfigurations.add(canonicalName)
     }
-    const configurationNames = entry.internalPropertyName ? [entry.internalPropertyName] : entry.configurationNames
-    const fullPropertyName = configurationNames?.[0] ?? canonicalName
+    const fullPropertyName = entry.namespace
+      ? `${entry.namespace}.${canonicalName}`
+      : (entry.internalPropertyName ?? entry.configurationNames?.[0] ?? canonicalName)
     const type = entry.type.toUpperCase()
 
     let transformer = transformers[entry.transform]
diff --git a/packages/dd-trace/src/config/generated-config-types.d.ts b/packages/dd-trace/src/config/generated-config-types.d.ts
index ee41bc1c12..0941f2e2ce 100644
--- a/packages/dd-trace/src/config/generated-config-types.d.ts
+++ b/packages/dd-trace/src/config/generated-config-types.d.ts
@@ -3,21 +3,20 @@
 
 export interface GeneratedConfig {
   _DD_APM_TRACING_AGENTLESS_ENABLED: boolean;
-  apiKey: string | undefined;
+  _DD_TRACE_METRICS_OTEL_FLUSH_INTERVAL: number;
   apmTracingEnabled: boolean;
   appsec: {
-    apiSecurity: {
-      downstreamBodyAnalysisSampleRate: number;
-      enabled: boolean;
-      endpointCollectionEnabled: boolean;
-      endpointCollectionMessageLimit: number;
-      maxDownstreamBodyBytes: number;
-      maxDownstreamRequestBodyAnalysis: number;
-      sampleDelay: number;
-    };
     blockedTemplateGraphql: string | undefined;
     blockedTemplateHtml: string | undefined;
     blockedTemplateJson: string | undefined;
+    DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE: number;
+    DD_API_SECURITY_ENABLED: boolean;
+    DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: boolean;
+    DD_API_SECURITY_ENDPOINT_COLLECTION_MESSAGE_LIMIT: number;
+    DD_API_SECURITY_MAX_DOWNSTREAM_BODY_BYTES: number;
+    DD_API_SECURITY_MAX_DOWNSTREAM_REQUEST_BODY_ANALYSIS: number;
+    DD_API_SECURITY_SAMPLE_DELAY: number;
+    DD_APPSEC_SCA_ENABLED: boolean | undefined;
     enabled: boolean | undefined;
     eventTracking: {
       mode: string;
@@ -35,9 +34,6 @@ export interface GeneratedConfig {
     };
     rateLimit: number;
     rules: string | undefined;
-    sca: {
-      enabled: boolean | undefined;
-    };
     stackTrace: {
       enabled: boolean;
       maxDepth: number;
@@ -70,21 +66,10 @@ export interface GeneratedConfig {
   DD_ACTION_EXECUTION_ID: string | undefined;
   DD_AGENTLESS_LOG_SUBMISSION_ENABLED: boolean;
   DD_AGENTLESS_LOG_SUBMISSION_URL: string | undefined;
+  DD_API_KEY: string | undefined;
   DD_APM_FLUSH_DEADLINE_MILLISECONDS: number;
   DD_APP_KEY: string | undefined;
   DD_AZURE_RESOURCE_GROUP: string | undefined;
-  DD_CIVISIBILITY_AGENTLESS_ENABLED: boolean;
-  DD_CIVISIBILITY_AGENTLESS_URL: URL | undefined;
-  DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER: string | undefined;
-  DD_CIVISIBILITY_DANGEROUSLY_FORCE_COVERAGE: boolean;
-  DD_CIVISIBILITY_DANGEROUSLY_FORCE_TEST_SKIPPING: boolean;
-  DD_CIVISIBILITY_ENABLED: boolean;
-  DD_CIVISIBILITY_GIT_UNSHALLOW_ENABLED: boolean;
-  DD_CIVISIBILITY_MANUAL_API_ENABLED: boolean;
-  DD_CIVISIBILITY_RUM_FLUSH_WAIT_MILLIS: number;
-  DD_CIVISIBILITY_TEST_COMMAND: string | undefined;
-  DD_CIVISIBILITY_TEST_MODULE_ID: string | undefined;
-  DD_CIVISIBILITY_TEST_SESSION_ID: string | undefined;
   DD_CRASHTRACKING_ENABLED: boolean;
   DD_CUSTOM_PARENT_ID: string | undefined;
   DD_CUSTOM_TRACE_ID: string | undefined;
@@ -95,6 +80,7 @@ export interface GeneratedConfig {
   DD_EXPERIMENTAL_TEST_OPT_GIT_CACHE_DIR: string | undefined;
   DD_EXPERIMENTAL_TEST_OPT_GIT_CACHE_ENABLED: boolean;
   DD_EXPERIMENTAL_TEST_OPT_SETTINGS_CACHE: string;
+  DD_EXPERIMENTAL_TEST_OPT_VITEST_NO_WORKER_INIT: boolean | undefined;
   DD_EXPERIMENTAL_TEST_REQUESTS_FS_CACHE: boolean;
   DD_EXTERNAL_ENV: string | undefined;
   DD_GIT_BRANCH: string | undefined;
@@ -162,8 +148,6 @@ export interface GeneratedConfig {
   DD_RUNTIME_METRICS_FLUSH_INTERVAL: number;
   DD_SPAN_SAMPLING_RULES_FILE: string | undefined;
   DD_TELEMETRY_FORWARDER_PATH: string | undefined;
-  DD_TEST_FLEET_CONFIG_PATH: string | undefined;
-  DD_TEST_LOCAL_CONFIG_PATH: string | undefined;
   DD_TEST_SESSION_NAME: string | undefined;
   DD_TRACE_AEROSPIKE_ENABLED: boolean;
   DD_TRACE_AI_ENABLED: boolean;
@@ -249,6 +233,7 @@ export interface GeneratedConfig {
   DD_TRACE_ELASTIC_TRANSPORT_ENABLED: boolean;
   DD_TRACE_ELASTICSEARCH_ENABLED: boolean;
   DD_TRACE_ELECTRON_ENABLED: boolean;
+  DD_TRACE_ENABLED: boolean;
   DD_TRACE_ENCODING_DEBUG: boolean;
   DD_TRACE_EXPERIMENTAL_RUNTIME_ID_ENABLED: boolean;
   DD_TRACE_EXPERIMENTAL_SPAN_COUNTS: boolean;
@@ -342,6 +327,7 @@ export interface GeneratedConfig {
   DD_TRACE_NODE_REDIS_CLIENT_ENABLED: boolean;
   DD_TRACE_NODE_SERIALIZE_ENABLED: boolean;
   DD_TRACE_NYC_ENABLED: boolean;
+  DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP: string;
   DD_TRACE_OPENAI_ENABLED: boolean;
   DD_TRACE_OPENSEARCH_ENABLED: boolean;
   DD_TRACE_OPENSEARCH_PROJECT_OPENSEARCH_ENABLED: boolean;
@@ -376,9 +362,11 @@ export interface GeneratedConfig {
   DD_TRACE_REDIS_CLIENT_ENABLED: boolean;
   DD_TRACE_REDIS_ENABLED: boolean;
   DD_TRACE_REQUEST_ENABLED: boolean;
+  DD_TRACE_RESOURCE_RENAMING_ENABLED: boolean;
   DD_TRACE_RESTIFY_ENABLED: boolean;
   DD_TRACE_RHEA_ENABLED: boolean;
   DD_TRACE_ROUTER_ENABLED: boolean;
+  DD_TRACE_SCOPE: string | undefined;
   DD_TRACE_SELENIUM_ENABLED: boolean;
   DD_TRACE_SELENIUM_WEBDRIVER_ENABLED: boolean;
   DD_TRACE_SEQUELIZE_ENABLED: boolean;
@@ -439,13 +427,13 @@ export interface GeneratedConfig {
       };
     };
   };
-  flakyTestRetriesCount: number;
   flushInterval: number;
   flushMinSpans: number;
   headerTags: string[];
   hostname: string;
   iast: {
     dbRowsToTaint: number;
+    DD_IAST_SECURITY_CONTROLS_CONFIGURATION: string | undefined;
     deduplicationEnabled: boolean;
     enabled: boolean;
     maxConcurrentRequests: number;
@@ -454,28 +442,20 @@ export interface GeneratedConfig {
     redactionNamePattern: string;
     redactionValuePattern: string;
     requestSampling: number;
-    securityControlsConfiguration: string | undefined;
     stackTrace: {
       enabled: boolean;
     };
     telemetryVerbosity: string;
   };
   inferredProxyServicesEnabled: boolean;
-  isEarlyFlakeDetectionEnabled: boolean;
-  isFlakyTestRetriesEnabled: boolean;
-  isGitUploadEnabled: boolean;
-  isImpactedTestsEnabled: boolean;
-  isIntelligentTestRunnerEnabled: boolean;
-  isTestDynamicInstrumentationEnabled: boolean;
-  isTestManagementEnabled: boolean;
   langchain: {
-    spanCharLimit: number;
-    spanPromptCompletionSampleRate: number;
+    DD_LANGCHAIN_SPAN_CHAR_LIMIT: number;
+    DD_LANGCHAIN_SPAN_PROMPT_COMPLETION_SAMPLE_RATE: number;
   };
   legacyBaggageEnabled: boolean;
   llmobs: {
     agentlessEnabled: boolean | undefined;
-    enabled: boolean;
+    DD_LLMOBS_ENABLED: boolean;
     mlApp: string | undefined;
     sampleRate: number;
   };
@@ -483,7 +463,7 @@ export interface GeneratedConfig {
   logLevel: "debug" | "info" | "warn" | "error";
   middlewareTracingEnabled: boolean;
   openai: {
-    spanCharLimit: number;
+    DD_OPENAI_SPAN_CHAR_LIMIT: number;
   };
   openAiLogsEnabled: boolean;
   OTEL_BSP_MAX_EXPORT_BATCH_SIZE: number;
@@ -515,20 +495,19 @@ export interface GeneratedConfig {
   OTEL_TRACES_EXPORTER: "none" | "otlp" | undefined;
   OTEL_TRACES_SAMPLER: "always_on" | "always_off" | "traceidratio" | "parentbased_always_on" | "parentbased_always_off" | "parentbased_traceidratio";
   OTEL_TRACES_SAMPLER_ARG: number | undefined;
+  OTEL_TRACES_SPAN_METRICS_ENABLED: boolean | undefined;
   peerServiceMapping: Record<string, string>;
   port: string | number;
   profiling: {
-    enabled: 'true' | 'false' | 'auto';
+    DD_PROFILING_ENABLED: 'true' | 'false' | 'auto';
   };
   protocolVersion: string;
-  queryStringObfuscation: string;
   rateLimit: number;
   remoteConfig: {
-    enabled: boolean;
+    DD_REMOTE_CONFIGURATION_ENABLED: boolean;
     pollInterval: number;
   };
   reportHostname: boolean;
-  resourceRenamingEnabled: boolean;
   runtimeMetrics: {
     enabled: boolean;
     eventLoop: boolean;
@@ -538,7 +517,6 @@ export interface GeneratedConfig {
   runtimeMetricsRuntimeId: boolean;
   sampleRate: number | undefined;
   samplingRules: import('../../../../index').SamplingRule[];
-  scope: string | undefined;
   service: string;
   serviceMapping: Record<string, string>;
   site: string;
@@ -548,19 +526,43 @@ export interface GeneratedConfig {
   spanSamplingRules: import('../../../../index').SpanSamplingRule[] | undefined;
   startupLogs: boolean;
   stats: {
-    enabled: boolean;
+    DD_TRACE_STATS_COMPUTATION_ENABLED: boolean;
   };
   tags: Record<string, string>;
   telemetry: {
-    debug: boolean;
-    dependencyCollection: boolean;
-    enabled: boolean;
-    extendedHeartbeatInterval: number;
-    heartbeatInterval: number;
-    logCollection: boolean;
-    metrics: boolean;
+    DD_INSTRUMENTATION_TELEMETRY_ENABLED: boolean;
+    DD_TELEMETRY_DEBUG: boolean;
+    DD_TELEMETRY_DEPENDENCY_COLLECTION_ENABLED: boolean;
+    DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL: number;
+    DD_TELEMETRY_HEARTBEAT_INTERVAL: number;
+    DD_TELEMETRY_LOG_COLLECTION_ENABLED: boolean;
+    DD_TELEMETRY_METRICS_ENABLED: boolean;
+  };
+  testOptimization: {
+    DD_CIVISIBILITY_AGENTLESS_ENABLED: boolean;
+    DD_CIVISIBILITY_AGENTLESS_URL: URL | undefined;
+    DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER: string | undefined;
+    DD_CIVISIBILITY_DANGEROUSLY_FORCE_COVERAGE: boolean;
+    DD_CIVISIBILITY_DANGEROUSLY_FORCE_TEST_SKIPPING: boolean;
+    DD_CIVISIBILITY_EARLY_FLAKE_DETECTION_ENABLED: boolean;
+    DD_CIVISIBILITY_ENABLED: boolean;
+    DD_CIVISIBILITY_FLAKY_RETRY_COUNT: number;
+    DD_CIVISIBILITY_FLAKY_RETRY_ENABLED: boolean;
+    DD_CIVISIBILITY_GIT_UNSHALLOW_ENABLED: boolean;
+    DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: boolean;
+    DD_CIVISIBILITY_IMPACTED_TESTS_DETECTION_ENABLED: boolean;
+    DD_CIVISIBILITY_ITR_ENABLED: boolean;
+    DD_CIVISIBILITY_MANUAL_API_ENABLED: boolean;
+    DD_CIVISIBILITY_RUM_FLUSH_WAIT_MILLIS: number;
+    DD_CIVISIBILITY_TEST_COMMAND: string | undefined;
+    DD_CIVISIBILITY_TEST_MODULE_ID: string | undefined;
+    DD_CIVISIBILITY_TEST_SESSION_ID: string | undefined;
+    DD_TEST_FAILED_TEST_REPLAY_ENABLED: boolean;
+    DD_TEST_FLEET_CONFIG_PATH: string | undefined;
+    DD_TEST_LOCAL_CONFIG_PATH: string | undefined;
+    DD_TEST_MANAGEMENT_ATTEMPT_TO_FIX_RETRIES: number;
+    DD_TEST_MANAGEMENT_ENABLED: boolean;
   };
-  testManagementAttemptToFixRetries: number;
   traceId128BitGenerationEnabled: boolean;
   traceId128BitLoggingEnabled: boolean;
   tracePropagationStyle: {
@@ -570,17 +572,17 @@ export interface GeneratedConfig {
   traceWebsocketMessagesEnabled: boolean;
   traceWebsocketMessagesInheritSampling: boolean;
   traceWebsocketMessagesSeparateTraces: boolean;
-  tracing: boolean;
   url: string | URL;
   version: string | undefined;
   vertexai: {
-    spanCharLimit: number;
-    spanPromptCompletionSampleRate: number;
+    DD_VERTEXAI_SPAN_CHAR_LIMIT: number;
+    DD_VERTEXAI_SPAN_PROMPT_COMPLETION_SAMPLE_RATE: number;
   };
 }
 
 export interface GeneratedEnvVarConfig {
   _DD_APM_TRACING_AGENTLESS_ENABLED: boolean;
+  _DD_TRACE_METRICS_OTEL_FLUSH_INTERVAL: number;
   DATADOG_API_KEY: string | undefined;
   DD_ACTION_EXECUTION_ID: string | undefined;
   DD_AGENT_HOST: string;
@@ -675,6 +677,7 @@ export interface GeneratedEnvVarConfig {
   DD_EXPERIMENTAL_TEST_OPT_GIT_CACHE_DIR: string | undefined;
   DD_EXPERIMENTAL_TEST_OPT_GIT_CACHE_ENABLED: boolean;
   DD_EXPERIMENTAL_TEST_OPT_SETTINGS_CACHE: string;
+  DD_EXPERIMENTAL_TEST_OPT_VITEST_NO_WORKER_INIT: boolean | undefined;
   DD_EXPERIMENTAL_TEST_REQUESTS_FS_CACHE: boolean;
   DD_EXTERNAL_ENV: string | undefined;
   DD_GIT_BRANCH: string | undefined;
@@ -1109,4 +1112,5 @@ export interface GeneratedEnvVarConfig {
   OTEL_TRACES_EXPORTER: "none" | "otlp" | undefined;
   OTEL_TRACES_SAMPLER: "always_on" | "always_off" | "traceidratio" | "parentbased_always_on" | "parentbased_always_off" | "parentbased_traceidratio";
   OTEL_TRACES_SAMPLER_ARG: number | undefined;
+  OTEL_TRACES_SPAN_METRICS_ENABLED: boolean | undefined;
 }
diff --git a/packages/dd-trace/src/config/helper.js b/packages/dd-trace/src/config/helper.js
index b3b615ff04..1f01bf7100 100644
--- a/packages/dd-trace/src/config/helper.js
+++ b/packages/dd-trace/src/config/helper.js
@@ -10,6 +10,7 @@
  * @property {string[]} [aliases]
  * @property {string[]} [configurationNames]
  * @property {string} [internalPropertyName]
+ * @property {string} [namespace] Nests the canonical env name under this property path (e.g. `telemetry`).
  * @property {string} [transform]
  * @property {string} [allowed]
  * @property {string|boolean} [deprecated]
diff --git a/packages/dd-trace/src/config/index.js b/packages/dd-trace/src/config/index.js
index 8faf6dc597..3b2d667f73 100644
--- a/packages/dd-trace/src/config/index.js
+++ b/packages/dd-trace/src/config/index.js
@@ -25,6 +25,7 @@ const {
   getEnvironmentVariable,
   getEnvironmentVariables,
   getStableConfigSources,
+  getValueFromEnvSources,
 } = require('./helper')
 const {
   defaults,
@@ -245,12 +246,12 @@ class Config extends ConfigBase {
       let entry = optionsTable[fullName]
       if (!entry) {
         // TODO: Fix this by by changing remote config to use env styles.
-        if (name !== 'tracing' || source !== 'remote_config') {
+        if (name !== 'DD_TRACE_ENABLED' || source !== 'remote_config') {
           log.warn('Unknown option %s with value %o', fullName, value)
           continue
         }
         // @ts-expect-error - The entry is defined in the configurationsTable.
-        entry = configurationsTable.tracing
+        entry = configurationsTable.DD_TRACE_ENABLED
       }
 
       if (entry.nestedProperties) {
@@ -286,7 +287,7 @@ class Config extends ConfigBase {
       }
       // TODO: Coerce mismatched types to the expected type, if possible. E.g., strings <> numbers
       const transformed = value !== undefined && entry.transformer ? entry.transformer(value, fullName, source) : value
-      setAndTrack(this, entry.property, transformed, value, source)
+      setAndTrack(this, entry.property ?? name, transformed, value, source)
     }
   }
 
@@ -358,21 +359,22 @@ class Config extends ConfigBase {
       setAndTrack(this, 'OTEL_TRACES_EXPORTER', 'none')
     }
 
-    if (this.telemetry.heartbeatInterval) {
-      setAndTrack(this, 'telemetry.heartbeatInterval', Math.floor(this.telemetry.heartbeatInterval * 1000))
+    if (this.telemetry.DD_TELEMETRY_HEARTBEAT_INTERVAL) {
+      setAndTrack(this, 'telemetry.DD_TELEMETRY_HEARTBEAT_INTERVAL',
+        Math.floor(this.telemetry.DD_TELEMETRY_HEARTBEAT_INTERVAL * 1000))
     }
 
     // Allocation profiling needs a sampling hook only available on Node.js 26+.
     setAndTrack(this, 'DD_PROFILING_ALLOCATION_ENABLED', NODE_MAJOR >= 26 && this.DD_PROFILING_ALLOCATION_ENABLED)
-    if (this.telemetry.extendedHeartbeatInterval) {
-      setAndTrack(this, 'telemetry.extendedHeartbeatInterval',
-        Math.floor(this.telemetry.extendedHeartbeatInterval * 1000))
+    if (this.telemetry.DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL) {
+      setAndTrack(this, 'telemetry.DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL',
+        Math.floor(this.telemetry.DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL * 1000))
     }
 
-    // Enable resourceRenamingEnabled when appsec is enabled and only
+    // Enable resource renaming when appsec is enabled and only
     // if DD_TRACE_RESOURCE_RENAMING_ENABLED is not explicitly set
-    if (!trackedConfigOrigins.has('resourceRenamingEnabled')) {
-      setAndTrack(this, 'resourceRenamingEnabled', this.appsec.enabled ?? false)
+    if (!trackedConfigOrigins.has('DD_TRACE_RESOURCE_RENAMING_ENABLED')) {
+      setAndTrack(this, 'DD_TRACE_RESOURCE_RENAMING_ENABLED', this.appsec.enabled ?? false)
     }
 
     if (!trackedConfigOrigins.has('spanComputePeerService') && this.spanAttributeSchema !== 'v0') {
@@ -380,9 +382,9 @@ class Config extends ConfigBase {
     }
 
     if (!this.apmTracingEnabled) {
-      setAndTrack(this, 'stats.enabled', false)
-    } else if (!trackedConfigOrigins.has('stats.enabled')) {
-      setAndTrack(this, 'stats.enabled', getIsGCPFunction() || getIsAzureFunction())
+      setAndTrack(this, 'stats.DD_TRACE_STATS_COMPUTATION_ENABLED', false)
+    } else if (!trackedConfigOrigins.has('stats.DD_TRACE_STATS_COMPUTATION_ENABLED')) {
+      setAndTrack(this, 'stats.DD_TRACE_STATS_COMPUTATION_ENABLED', getIsGCPFunction() || getIsAzureFunction())
     }
 
     // TODO: Remove the experimental env vars as a major or deprecate the option?
@@ -454,11 +456,11 @@ class Config extends ConfigBase {
     }
 
     // For LLMObs, we want to auto enable it when other llmobs options are defined.
-    if (!this.llmobs.enabled &&
-        !trackedConfigOrigins.has('llmobs.enabled') &&
+    if (!this.llmobs.DD_LLMOBS_ENABLED &&
+        !trackedConfigOrigins.has('llmobs.DD_LLMOBS_ENABLED') &&
         (trackedConfigOrigins.has('llmobs.agentlessEnabled') ||
         trackedConfigOrigins.has('llmobs.mlApp'))) {
-      setAndTrack(this, 'llmobs.enabled', true)
+      setAndTrack(this, 'llmobs.DD_LLMOBS_ENABLED', true)
     }
 
     if (this.OTEL_RESOURCE_ATTRIBUTES) {
@@ -551,14 +553,15 @@ class Config extends ConfigBase {
     this.tags['runtime-id'] = RUNTIME_ID
 
     if (IS_SERVERLESS) {
-      setAndTrack(this, 'telemetry.enabled', false)
+      setAndTrack(this, 'telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED', false)
       setAndTrack(this, 'DD_CRASHTRACKING_ENABLED', false)
-      setAndTrack(this, 'remoteConfig.enabled', false)
+      setAndTrack(this, 'remoteConfig.DD_REMOTE_CONFIGURATION_ENABLED', false)
     }
 
     // TODO: Should this unconditionally be disabled?
-    if (getEnvironmentVariable('JEST_WORKER_ID') && !trackedConfigOrigins.has('telemetry.enabled')) {
-      setAndTrack(this, 'telemetry.enabled', false)
+    if (getEnvironmentVariable('JEST_WORKER_ID') &&
+        !trackedConfigOrigins.has('telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED')) {
+      setAndTrack(this, 'telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED', false)
     }
 
     // Experimental agentless APM span intake
@@ -568,7 +571,7 @@ class Config extends ConfigBase {
     if (agentlessEnabled) {
       setAndTrack(this, 'experimental.exporter', 'agentless')
       // Disable client-side stats computation
-      setAndTrack(this, 'stats.enabled', false)
+      setAndTrack(this, 'stats.DD_TRACE_STATS_COMPUTATION_ENABLED', false)
       // Enable hostname reporting
       setAndTrack(this, 'reportHostname', true)
       // Disable rate limiting - server-side sampling will be used
@@ -602,6 +605,16 @@ class Config extends ConfigBase {
       setAndTrack(this, 'OTEL_EXPORTER_OTLP_TRACES_ENDPOINT', `${defaultOtlpBase}/v1/traces`)
     }
 
+    const autoTraceMetrics = this.OTEL_TRACES_EXPORTER === 'otlp' && this.DD_METRICS_OTEL_ENABLED === true
+    setAndTrack(this, 'OTEL_TRACES_SPAN_METRICS_ENABLED', this.OTEL_TRACES_SPAN_METRICS_ENABLED ?? autoTraceMetrics)
+
+    if (this.OTEL_TRACES_SPAN_METRICS_ENABLED) {
+      this.stats = { ...this.stats, DD_TRACE_STATS_COMPUTATION_ENABLED: true }
+    }
+
+    const flushInterval = getValueFromEnvSources('_DD_TRACE_METRICS_OTEL_FLUSH_INTERVAL')
+    setAndTrack(this, '_DD_TRACE_METRICS_OTEL_FLUSH_INTERVAL', flushInterval)
+
     if (process.platform === 'win32') {
       // OOM monitoring does not work properly on Windows, so it will be disabled.
       deactivateIfEnabledAndWarnOnWindows(this, 'DD_PROFILING_EXPERIMENTAL_OOM_MONITORING_ENABLED')
diff --git a/packages/dd-trace/src/config/major-overrides.js b/packages/dd-trace/src/config/major-overrides.js
index 2d8c355c42..033b507bb3 100644
--- a/packages/dd-trace/src/config/major-overrides.js
+++ b/packages/dd-trace/src/config/major-overrides.js
@@ -72,11 +72,13 @@ function applyV5Overrides (supportedConfigurations) {
   const iastEntry = supportedConfigurations.DD_IAST_SECURITY_CONTROLS_CONFIGURATION?.[0]
   if (!iastEntry) return
 
+  // v5 kept this configurable through the (experimental) iast.* programmatic API. The entry
+  // still carries `namespace: "iast"`, so these names route to iast.DD_IAST_SECURITY_CONTROLS_CONFIGURATION
+  // and the property path stays canonical across majors.
   iastEntry.configurationNames = [
-    iastEntry.internalPropertyName || iastEntry.configurationNames?.[0],
+    'iast.securityControlsConfiguration',
     `${EXPERIMENTAL_IAST_PREFIX}.securityControlsConfiguration`,
   ]
-  delete iastEntry.internalPropertyName
 }
 
 /**
diff --git a/packages/dd-trace/src/config/remote_config.js b/packages/dd-trace/src/config/remote_config.js
index f981dd37fe..a95ca899a7 100644
--- a/packages/dd-trace/src/config/remote_config.js
+++ b/packages/dd-trace/src/config/remote_config.js
@@ -228,7 +228,7 @@ const optionLookupTable = {
   code_origin_enabled: 'codeOriginForSpans.enabled',
   tracing_sampling_rate: 'sampleRate',
   log_injection_enabled: 'logInjection',
-  tracing_enabled: 'tracing',
+  tracing_enabled: 'DD_TRACE_ENABLED',
   tracing_sampling_rules: 'samplingRules',
   tracing_header_tags: 'headerTags',
   tracing_tags: 'tags',
diff --git a/packages/dd-trace/src/config/supported-configurations.json b/packages/dd-trace/src/config/supported-configurations.json
index b915d6957d..7dde20bd19 100644
--- a/packages/dd-trace/src/config/supported-configurations.json
+++ b/packages/dd-trace/src/config/supported-configurations.json
@@ -111,7 +111,6 @@
         "aliases": [
           "DATADOG_API_KEY"
         ],
-        "internalPropertyName": "apiKey",
         "sensitive": true
       }
     ],
@@ -119,6 +118,7 @@
       {
         "implementation": "A",
         "type": "boolean",
+        "namespace": "appsec",
         "configurationNames": [
           "appsec.apiSecurity.enabled",
           "experimental.appsec.apiSecurity.enabled"
@@ -133,6 +133,7 @@
       {
         "implementation": "A",
         "type": "boolean",
+        "namespace": "appsec",
         "configurationNames": [
           "appsec.apiSecurity.endpointCollectionEnabled",
           "experimental.appsec.apiSecurity.endpointCollectionEnabled"
@@ -144,6 +145,7 @@
       {
         "implementation": "A",
         "type": "int",
+        "namespace": "appsec",
         "configurationNames": [
           "appsec.apiSecurity.endpointCollectionMessageLimit",
           "experimental.appsec.apiSecurity.endpointCollectionMessageLimit"
@@ -155,7 +157,7 @@
       {
         "implementation": "A",
         "type": "decimal",
-        "internalPropertyName": "appsec.apiSecurity.downstreamBodyAnalysisSampleRate",
+        "namespace": "appsec",
         "default": "0.5"
       }
     ],
@@ -163,7 +165,7 @@
       {
         "implementation": "A",
         "type": "int",
-        "internalPropertyName": "appsec.apiSecurity.maxDownstreamRequestBodyAnalysis",
+        "namespace": "appsec",
         "default": "1"
       }
     ],
@@ -171,7 +173,7 @@
       {
         "implementation": "A",
         "type": "int",
-        "internalPropertyName": "appsec.apiSecurity.maxDownstreamBodyBytes",
+        "namespace": "appsec",
         "default": "10485760"
       }
     ],
@@ -180,7 +182,7 @@
         "implementation": "A",
         "type": "decimal",
         "default": "30",
-        "internalPropertyName": "appsec.apiSecurity.sampleDelay"
+        "namespace": "appsec"
       }
     ],
     "DD_APM_FLUSH_DEADLINE_MILLISECONDS": [
@@ -392,7 +394,7 @@
         "implementation": "B",
         "type": "boolean",
         "default": null,
-        "internalPropertyName": "appsec.sca.enabled"
+        "namespace": "appsec"
       }
     ],
     "DD_APPSEC_STACK_TRACE_ENABLED": [
@@ -447,7 +449,8 @@
       {
         "implementation": "A",
         "type": "boolean",
-        "default": "false"
+        "default": "false",
+        "namespace": "testOptimization"
       }
     ],
     "DD_CIVISIBILITY_AGENTLESS_URL": [
@@ -455,28 +458,32 @@
         "implementation": "A",
         "type": "string",
         "transform": "toURL",
-        "default": null
+        "default": null,
+        "namespace": "testOptimization"
       }
     ],
     "DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER": [
       {
         "implementation": "A",
         "type": "string",
-        "default": null
+        "default": null,
+        "namespace": "testOptimization"
       }
     ],
     "DD_CIVISIBILITY_DANGEROUSLY_FORCE_COVERAGE": [
       {
         "implementation": "A",
         "type": "boolean",
-        "default": "false"
+        "default": "false",
+        "namespace": "testOptimization"
       }
     ],
     "DD_CIVISIBILITY_DANGEROUSLY_FORCE_TEST_SKIPPING": [
       {
         "implementation": "A",
         "type": "boolean",
-        "default": "false"
+        "default": "false",
+        "namespace": "testOptimization"
       }
     ],
     "DD_CIVISIBILITY_EARLY_FLAKE_DETECTION_ENABLED": [
@@ -484,14 +491,15 @@
         "implementation": "B",
         "type": "boolean",
         "default": "true",
-        "internalPropertyName": "isEarlyFlakeDetectionEnabled"
+        "namespace": "testOptimization"
       }
     ],
     "DD_CIVISIBILITY_ENABLED": [
       {
         "implementation": "A",
         "type": "boolean",
-        "default": "false"
+        "default": "false",
+        "namespace": "testOptimization"
       }
     ],
     "DD_CIVISIBILITY_FLAKY_RETRY_COUNT": [
@@ -499,7 +507,7 @@
         "implementation": "A",
         "type": "int",
         "default": "5",
-        "internalPropertyName": "flakyTestRetriesCount"
+        "namespace": "testOptimization"
       }
     ],
     "DD_CIVISIBILITY_FLAKY_RETRY_ENABLED": [
@@ -507,14 +515,15 @@
         "implementation": "A",
         "type": "boolean",
         "default": "true",
-        "internalPropertyName": "isFlakyTestRetriesEnabled"
+        "namespace": "testOptimization"
       }
     ],
     "DD_CIVISIBILITY_GIT_UNSHALLOW_ENABLED": [
       {
         "implementation": "A",
         "type": "boolean",
-        "default": "true"
+        "default": "true",
+        "namespace": "testOptimization"
       }
     ],
     "DD_CIVISIBILITY_GIT_UPLOAD_ENABLED": [
@@ -522,7 +531,7 @@
         "implementation": "A",
         "type": "boolean",
         "default": "true",
-        "internalPropertyName": "isGitUploadEnabled"
+        "namespace": "testOptimization"
       }
     ],
     "DD_CIVISIBILITY_IMPACTED_TESTS_DETECTION_ENABLED": [
@@ -530,7 +539,7 @@
         "implementation": "A",
         "type": "boolean",
         "default": "true",
-        "internalPropertyName": "isImpactedTestsEnabled"
+        "namespace": "testOptimization"
       }
     ],
     "DD_CIVISIBILITY_ITR_ENABLED": [
@@ -538,7 +547,7 @@
         "implementation": "A",
         "type": "boolean",
         "default": "true",
-        "internalPropertyName": "isIntelligentTestRunnerEnabled"
+        "namespace": "testOptimization"
       }
     ],
     "DD_ENABLE_LAGE_PACKAGE_NAME": [
@@ -552,35 +561,40 @@
       {
         "implementation": "A",
         "type": "boolean",
-        "default": "true"
+        "default": "true",
+        "namespace": "testOptimization"
       }
     ],
     "DD_CIVISIBILITY_RUM_FLUSH_WAIT_MILLIS": [
       {
         "implementation": "A",
         "type": "int",
-        "default": "500"
+        "default": "500",
+        "namespace": "testOptimization"
       }
     ],
     "DD_CIVISIBILITY_TEST_COMMAND": [
       {
         "implementation": "A",
         "type": "string",
-        "default": null
+        "default": null,
+        "namespace": "testOptimization"
       }
     ],
     "DD_CIVISIBILITY_TEST_MODULE_ID": [
       {
         "implementation": "A",
         "type": "string",
-        "default": null
+        "default": null,
+        "namespace": "testOptimization"
       }
     ],
     "DD_CIVISIBILITY_TEST_SESSION_ID": [
       {
         "implementation": "A",
         "type": "string",
-        "default": null
+        "default": null,
+        "namespace": "testOptimization"
       }
     ],
     "DD_CODE_ORIGIN_FOR_SPANS_ENABLED": [
@@ -824,6 +838,13 @@
         "default": "false"
       }
     ],
+    "DD_EXPERIMENTAL_TEST_OPT_VITEST_NO_WORKER_INIT": [
+      {
+        "implementation": "A",
+        "type": "boolean",
+        "default": null
+      }
+    ],
     "DD_EXPERIMENTAL_TEST_REQUESTS_FS_CACHE": [
       {
         "implementation": "A",
@@ -1094,7 +1115,7 @@
       {
         "implementation": "B",
         "type": "string",
-        "internalPropertyName": "iast.securityControlsConfiguration",
+        "namespace": "iast",
         "default": null
       }
     ],
@@ -1170,7 +1191,7 @@
         "aliases": [
           "DD_TRACE_TELEMETRY_ENABLED"
         ],
-        "internalPropertyName": "telemetry.enabled"
+        "namespace": "telemetry"
       }
     ],
     "DD_INTERNAL_PROFILING_LONG_LIVED_THRESHOLD": [
@@ -1199,7 +1220,7 @@
         "implementation": "A",
         "type": "int",
         "default": "128",
-        "internalPropertyName": "langchain.spanCharLimit"
+        "namespace": "langchain"
       }
     ],
     "DD_LANGCHAIN_SPAN_PROMPT_COMPLETION_SAMPLE_RATE": [
@@ -1207,7 +1228,7 @@
         "implementation": "A",
         "type": "decimal",
         "default": "1",
-        "internalPropertyName": "langchain.spanPromptCompletionSampleRate"
+        "namespace": "langchain"
       }
     ],
     "DD_LLMOBS_AGENTLESS_ENABLED": [
@@ -1225,7 +1246,7 @@
         "implementation": "A",
         "type": "boolean",
         "default": "false",
-        "internalPropertyName": "llmobs.enabled"
+        "namespace": "llmobs"
       }
     ],
     "DD_LLMOBS_ML_APP": [
@@ -1323,7 +1344,7 @@
         "implementation": "A",
         "type": "int",
         "default": "128",
-        "internalPropertyName": "openai.spanCharLimit"
+        "namespace": "openai"
       }
     ],
     "DD_PIPELINE_EXECUTION_ID": [
@@ -1416,7 +1437,7 @@
       {
         "implementation": "B",
         "type": "string",
-        "internalPropertyName": "profiling.enabled",
+        "namespace": "profiling",
         "configurationNames": [
           "profiling"
         ],
@@ -1578,7 +1599,7 @@
         "aliases": [
           "DD_REMOTE_CONFIG_ENABLED"
         ],
-        "internalPropertyName": "remoteConfig.enabled"
+        "namespace": "remoteConfig"
       }
     ],
     "DD_REMOTE_CONFIG_POLL_INTERVAL_SECONDS": [
@@ -1740,7 +1761,7 @@
         "implementation": "A",
         "type": "boolean",
         "default": "false",
-        "internalPropertyName": "telemetry.debug"
+        "namespace": "telemetry"
       }
     ],
     "DD_TELEMETRY_DEPENDENCY_COLLECTION_ENABLED": [
@@ -1748,7 +1769,7 @@
         "implementation": "A",
         "type": "boolean",
         "default": "true",
-        "internalPropertyName": "telemetry.dependencyCollection"
+        "namespace": "telemetry"
       }
     ],
     "DD_TELEMETRY_FORWARDER_PATH": [
@@ -1763,7 +1784,7 @@
         "implementation": "A",
         "type": "int",
         "default": "86400",
-        "internalPropertyName": "telemetry.extendedHeartbeatInterval"
+        "namespace": "telemetry"
       }
     ],
     "DD_TELEMETRY_HEARTBEAT_INTERVAL": [
@@ -1771,7 +1792,7 @@
         "implementation": "B",
         "type": "decimal",
         "default": "60.0",
-        "internalPropertyName": "telemetry.heartbeatInterval"
+        "namespace": "telemetry"
       }
     ],
     "DD_TELEMETRY_LOG_COLLECTION_ENABLED": [
@@ -1779,7 +1800,7 @@
         "implementation": "A",
         "type": "boolean",
         "default": "true",
-        "internalPropertyName": "telemetry.logCollection"
+        "namespace": "telemetry"
       }
     ],
     "DD_TELEMETRY_METRICS_ENABLED": [
@@ -1787,7 +1808,7 @@
         "implementation": "A",
         "type": "boolean",
         "default": "true",
-        "internalPropertyName": "telemetry.metrics"
+        "namespace": "telemetry"
       }
     ],
     "DD_TEST_FAILED_TEST_REPLAY_ENABLED": [
@@ -1795,21 +1816,23 @@
         "implementation": "A",
         "type": "boolean",
         "default": "true",
-        "internalPropertyName": "isTestDynamicInstrumentationEnabled"
+        "namespace": "testOptimization"
       }
     ],
     "DD_TEST_FLEET_CONFIG_PATH": [
       {
         "implementation": "A",
         "type": "string",
-        "default": null
+        "default": null,
+        "namespace": "testOptimization"
       }
     ],
     "DD_TEST_LOCAL_CONFIG_PATH": [
       {
         "implementation": "A",
         "type": "string",
-        "default": null
+        "default": null,
+        "namespace": "testOptimization"
       }
     ],
     "DD_TEST_MANAGEMENT_ATTEMPT_TO_FIX_RETRIES": [
@@ -1817,7 +1840,7 @@
         "implementation": "C",
         "type": "int",
         "default": "20",
-        "internalPropertyName": "testManagementAttemptToFixRetries"
+        "namespace": "testOptimization"
       }
     ],
     "DD_TEST_MANAGEMENT_ENABLED": [
@@ -1825,7 +1848,7 @@
         "implementation": "A",
         "type": "boolean",
         "default": "true",
-        "internalPropertyName": "isTestManagementEnabled"
+        "namespace": "testOptimization"
       }
     ],
     "DD_TEST_SESSION_NAME": [
@@ -2557,8 +2580,7 @@
       {
         "implementation": "A",
         "type": "boolean",
-        "default": "true",
-        "internalPropertyName": "tracing"
+        "default": "true"
       }
     ],
     "DD_TRACE_ENCODING_DEBUG": [
@@ -3115,6 +3137,14 @@
         "default": "true"
       }
     ],
+    "_DD_TRACE_METRICS_OTEL_FLUSH_INTERVAL": [
+      {
+        "implementation": "A",
+        "type": "int",
+        "default": "10000",
+        "allowed": "[1-9]\\d*"
+      }
+    ],
     "DD_TRACE_MICROGATEWAY_CORE_ENABLED": [
       {
         "implementation": "A",
@@ -3292,8 +3322,7 @@
       {
         "implementation": "F",
         "type": "string",
-        "default": "(?:p(?:ass)?w(?:or)?d|pass(?:_?phrase)?|secret|(?:api_?|private_?|public_?|access_?|secret_?)key(?:_?id)?|token|consumer_?(?:id|key|secret)|sign(?:ed|ature)?|auth(?:entication|orization)?)(?:(?:\\s|%20)*(?:=|%3D)[^&]+|(?:\"|%22)(?:\\s|%20)*(?::|%3A)(?:\\s|%20)*(?:\"|%22)(?:%2[^2]|%[^2]|[^\"%])+(?:\"|%22))|bearer(?:\\s|%20)+[a-z0-9\\._\\-]+|token(?::|%3A)[a-z0-9]{13}|gh[opsu]_[0-9a-zA-Z]{36}|ey[I-L](?:[\\w=-]|%3D)+\\.ey[I-L](?:[\\w=-]|%3D)+(?:\\.(?:[\\w.+\\/=-]|%3D|%2F|%2B)+)?|[\\-]{5}BEGIN(?:[a-z\\s]|%20)+PRIVATE(?:\\s|%20)KEY[\\-]{5}[^\\-]+[\\-]{5}END(?:[a-z\\s]|%20)+PRIVATE(?:\\s|%20)KEY|ssh-rsa(?:\\s|%20)*(?:[a-z0-9\\/\\.+]|%2F|%5C|%2B){100,}",
-        "internalPropertyName": "queryStringObfuscation"
+        "default": "(?:p(?:ass)?w(?:or)?d|pass(?:_?phrase)?|secret|(?:api_?|private_?|public_?|access_?|secret_?)key(?:_?id)?|token|consumer_?(?:id|key|secret)|sign(?:ed|ature)?|auth(?:entication|orization)?)(?:(?:\\s|%20)*(?:=|%3D)[^&]+|(?:\"|%22)(?:\\s|%20)*(?::|%3A)(?:\\s|%20)*(?:\"|%22)(?:%2[^2]|%[^2]|[^\"%])+(?:\"|%22))|bearer(?:\\s|%20)+[a-z0-9\\._\\-]+|token(?::|%3A)[a-z0-9]{13}|gh[opsu]_[0-9a-zA-Z]{36}|ey[I-L](?:[\\w=-]|%3D)+\\.ey[I-L](?:[\\w=-]|%3D)+(?:\\.(?:[\\w.+\\/=-]|%3D|%2F|%2B)+)?|[\\-]{5}BEGIN(?:[a-z\\s]|%20)+PRIVATE(?:\\s|%20)KEY[\\-]{5}[^\\-]+[\\-]{5}END(?:[a-z\\s]|%20)+PRIVATE(?:\\s|%20)KEY|ssh-rsa(?:\\s|%20)*(?:[a-z0-9\\/\\.+]|%2F|%5C|%2B){100,}"
       }
     ],
     "DD_TRACE_OPENAI_ENABLED": [
@@ -3331,14 +3360,14 @@
         "default": "true"
       }
     ],
-    "DD_TRACE_OTEL_SEMANTICS_ENABLED": [
+    "DD_TRACE_OTEL_ENABLED": [
       {
         "implementation": "A",
         "type": "boolean",
         "default": "false"
       }
     ],
-    "DD_TRACE_OTEL_ENABLED": [
+    "DD_TRACE_OTEL_SEMANTICS_ENABLED": [
       {
         "implementation": "A",
         "type": "boolean",
@@ -3633,8 +3662,7 @@
       {
         "implementation": "A",
         "type": "boolean",
-        "default": "false",
-        "internalPropertyName": "resourceRenamingEnabled"
+        "default": "false"
       }
     ],
     "DD_TRACE_RESTIFY_ENABLED": [
@@ -3685,8 +3713,7 @@
       {
         "implementation": "A",
         "type": "string",
-        "default": null,
-        "internalPropertyName": "scope"
+        "default": null
       }
     ],
     "DD_TRACE_SELENIUM_ENABLED": [
@@ -3764,7 +3791,7 @@
       {
         "implementation": "A",
         "type": "boolean",
-        "internalPropertyName": "stats.enabled",
+        "namespace": "stats",
         "configurationNames": [
           "stats"
         ],
@@ -3910,7 +3937,7 @@
         "implementation": "A",
         "type": "int",
         "default": "128",
-        "internalPropertyName": "vertexai.spanCharLimit"
+        "namespace": "vertexai"
       }
     ],
     "DD_VERTEXAI_SPAN_PROMPT_COMPLETION_SAMPLE_RATE": [
@@ -3918,7 +3945,7 @@
         "implementation": "A",
         "type": "decimal",
         "default": "1",
-        "internalPropertyName": "vertexai.spanPromptCompletionSampleRate"
+        "namespace": "vertexai"
       }
     ],
     "DD_VITEST_WORKER": [
@@ -4182,6 +4209,13 @@
         "default": null,
         "allowed": "\\d+(\\.\\d+)?"
       }
+    ],
+    "OTEL_TRACES_SPAN_METRICS_ENABLED": [
+      {
+        "implementation": "A",
+        "type": "boolean",
+        "default": null
+      }
     ]
   }
 }
diff --git a/packages/dd-trace/src/constants.js b/packages/dd-trace/src/constants.js
index 903da8c659..1ddd8c7fb0 100644
--- a/packages/dd-trace/src/constants.js
+++ b/packages/dd-trace/src/constants.js
@@ -61,4 +61,11 @@ module.exports = {
     UPSTREAM: 'span-pointer-up',
     DOWNSTREAM: 'span-pointer-down',
   }),
+  // https://github.com/grpc/grpc/blob/master/doc/statuscodes.md
+  GRPC_STATUS_NAMES: [
+    'OK', 'CANCELLED', 'UNKNOWN', 'INVALID_ARGUMENT', 'DEADLINE_EXCEEDED',
+    'NOT_FOUND', 'ALREADY_EXISTS', 'PERMISSION_DENIED', 'RESOURCE_EXHAUSTED',
+    'FAILED_PRECONDITION', 'ABORTED', 'OUT_OF_RANGE', 'UNIMPLEMENTED',
+    'INTERNAL', 'UNAVAILABLE', 'DATA_LOSS', 'UNAUTHENTICATED',
+  ],
 }
diff --git a/packages/dd-trace/src/datastreams/processor.js b/packages/dd-trace/src/datastreams/processor.js
index ac458bb322..f086efefa8 100644
--- a/packages/dd-trace/src/datastreams/processor.js
+++ b/packages/dd-trace/src/datastreams/processor.js
@@ -235,7 +235,11 @@ class DataStreamsProcessor {
     this._schemaSamplers = {}
     this._checkpointRegistry = new CheckpointRegistry()
 
-    if (this.enabled) {
+    // `flushInterval === 0` is the "flush on write" sentinel the trace exporter already honors
+    // (agent exporter `export()`); a background timer of `0` would instead fire on every event-loop
+    // tick, decoupled from when checkpoints are recorded, and a single tick landing while the agent
+    // is unreachable drops the bucket for good (it is cleared on serialize). Push on record instead.
+    if (this.enabled && flushInterval !== 0) {
       this.timer = setInterval(this.onInterval.bind(this), flushInterval)
       this.timer.unref?.()
     }
@@ -282,6 +286,7 @@ class DataStreamsProcessor {
       // StatsPoint already converted the 8-byte Buffer hash to a uint64 BigInt.
       span.setTag(PATHWAY_HASH, statsPoint.hash.toString())
     }
+    if (this.flushInterval === 0) this.onInterval()
   }
 
   setCheckpoint (edgeTags, span, ctx, payloadSize = 0) {
@@ -356,8 +361,9 @@ class DataStreamsProcessor {
 
   recordOffset ({ timestamp, ...backlogData }) {
     if (!this.enabled) return
-    return this.bucketFromTimestamp(timestamp)
-      .forBacklog(backlogData)
+    const backlog = this.bucketFromTimestamp(timestamp).forBacklog(backlogData)
+    if (this.flushInterval === 0) this.onInterval()
+    return backlog
   }
 
   setOffset (offsetObj) {
@@ -401,6 +407,8 @@ class DataStreamsProcessor {
     // Number() cast is safe here: 10s bucket granularity tolerates ~0.5ns precision loss
     this.bucketFromTimestamp(Number(timestampNs)).addTransaction(entry)
 
+    if (this.flushInterval === 0) this.onInterval()
+
     if (span) {
       span.setTag(DSM_TRANSACTION_ID, transactionId)
       span.setTag(DSM_TRANSACTION_CHECKPOINT, checkpointName)
diff --git a/packages/dd-trace/src/exporters/agent/index.js b/packages/dd-trace/src/exporters/agent/index.js
index 3bb0a7e681..e951048ab5 100644
--- a/packages/dd-trace/src/exporters/agent/index.js
+++ b/packages/dd-trace/src/exporters/agent/index.js
@@ -13,7 +13,7 @@ class AgentExporter {
     this._url = config.url
 
     const headers = {}
-    if (stats.enabled || apmTracingEnabled === false) {
+    if (stats.DD_TRACE_STATS_COMPUTATION_ENABLED || apmTracingEnabled === false) {
       headers['Datadog-Client-Computed-Stats'] = 'yes'
     }
 
diff --git a/packages/dd-trace/src/exporters/agentless/writer.js b/packages/dd-trace/src/exporters/agentless/writer.js
index 2a884cb7c4..56c7511221 100644
--- a/packages/dd-trace/src/exporters/agentless/writer.js
+++ b/packages/dd-trace/src/exporters/agentless/writer.js
@@ -40,7 +40,7 @@ class AgentlessWriter extends BaseWriter {
       }
     }
 
-    if (!getConfig().apiKey) {
+    if (!getConfig().DD_API_KEY) {
       this.#apiKeyMissing = true
       log.error('DD_API_KEY is required for agentless trace intake. Set DD_API_KEY. Traces will not be sent.')
     }
@@ -109,8 +109,8 @@ class AgentlessWriter extends BaseWriter {
       return
     }
 
-    const apiKey = getConfig().apiKey
-    if (!apiKey) {
+    const { DD_API_KEY } = getConfig()
+    if (!DD_API_KEY) {
       if (!this.#apiKeyMissing) {
         this.#apiKeyMissing = true
         log.error('DD_API_KEY is required for agentless trace intake. Set DD_API_KEY. Traces will not be sent.')
@@ -126,7 +126,7 @@ class AgentlessWriter extends BaseWriter {
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
-        'dd-api-key': apiKey,
+        'dd-api-key': DD_API_KEY,
         'X-Datadog-Trace-Count': String(count),
         'Datadog-Meta-Lang': 'nodejs',
         'Datadog-Meta-Lang-Version': process.version,
diff --git a/packages/dd-trace/src/llmobs/index.js b/packages/dd-trace/src/llmobs/index.js
index f78a4a538c..55c6469a08 100644
--- a/packages/dd-trace/src/llmobs/index.js
+++ b/packages/dd-trace/src/llmobs/index.js
@@ -75,7 +75,7 @@ function enable (config) {
   injectCh.subscribe(handleLLMObsInjection)
 
   setAgentStrategy(config, useAgentless => {
-    if (useAgentless && !(config.apiKey && config.site)) {
+    if (useAgentless && !(config.DD_API_KEY && config.site)) {
       if (DD_MAJOR < 6 || !config?.startupLogs) {
         // eslint-disable-next-line no-console
         console.error(INCOMPATIBLE_INITIALIZATION)
diff --git a/packages/dd-trace/src/llmobs/plugins/base.js b/packages/dd-trace/src/llmobs/plugins/base.js
index 6f58a7e5c7..278db9a5a3 100644
--- a/packages/dd-trace/src/llmobs/plugins/base.js
+++ b/packages/dd-trace/src/llmobs/plugins/base.js
@@ -25,7 +25,7 @@ class LLMObsPlugin extends TracingPlugin {
   start (ctx) {
     // even though llmobs span events won't be enqueued if llmobs is disabled
     // we should avoid doing any computations here (these listeners aren't disabled)
-    const enabled = this._tracerConfig.llmobs.enabled
+    const enabled = this._tracerConfig.llmobs.DD_LLMOBS_ENABLED
     if (!enabled) return
 
     const parentStore = llmobsStorage.getStore()
@@ -52,7 +52,7 @@ class LLMObsPlugin extends TracingPlugin {
   }
 
   end (ctx) {
-    const enabled = this._tracerConfig.llmobs.enabled
+    const enabled = this._tracerConfig.llmobs.DD_LLMOBS_ENABLED
     if (!enabled) return
 
     // only attempt to restore the context if the current span was an LLMObs span
@@ -67,7 +67,7 @@ class LLMObsPlugin extends TracingPlugin {
   asyncEnd (ctx) {
     // even though llmobs span events won't be enqueued if llmobs is disabled
     // we should avoid doing any computations here (these listeners aren't disabled)
-    const enabled = this._tracerConfig.llmobs.enabled
+    const enabled = this._tracerConfig.llmobs.DD_LLMOBS_ENABLED
     if (!enabled) return
 
     const apmStore = ctx.currentStore
@@ -85,7 +85,7 @@ class LLMObsPlugin extends TracingPlugin {
 
   configure (config) {
     // we do not want to enable any LLMObs plugins if it is disabled on the tracer
-    const llmobsEnabled = this._tracerConfig.llmobs.enabled
+    const llmobsEnabled = this._tracerConfig.llmobs.DD_LLMOBS_ENABLED
     if (llmobsEnabled === false) {
       config = typeof config === 'boolean' ? false : { ...config, enabled: false } // override to false
     }
diff --git a/packages/dd-trace/src/llmobs/plugins/langgraph/index.js b/packages/dd-trace/src/llmobs/plugins/langgraph/index.js
index 4cc08be8e2..b5b121dd57 100644
--- a/packages/dd-trace/src/llmobs/plugins/langgraph/index.js
+++ b/packages/dd-trace/src/llmobs/plugins/langgraph/index.js
@@ -14,7 +14,7 @@ class PregelStreamLLMObsPlugin extends LLMObsPlugin {
   getLLMObsSpanRegisterOptions (ctx) {
     const name = ctx.self.name || 'LangGraph'
 
-    const enabled = this._tracerConfig.llmobs.enabled
+    const enabled = this._tracerConfig.llmobs.DD_LLMOBS_ENABLED
     if (!enabled) return
 
     const span = ctx.currentStore?.span
diff --git a/packages/dd-trace/src/llmobs/sdk.js b/packages/dd-trace/src/llmobs/sdk.js
index 6a50c5b2cc..3feb414f7e 100644
--- a/packages/dd-trace/src/llmobs/sdk.js
+++ b/packages/dd-trace/src/llmobs/sdk.js
@@ -49,7 +49,7 @@ class LLMObs extends NoopLLMObs {
   }
 
   get enabled () {
-    return this._config.llmobs.enabled ?? false
+    return this._config.llmobs.DD_LLMOBS_ENABLED ?? false
   }
 
   enable (options = {}) {
@@ -75,7 +75,7 @@ class LLMObs extends NoopLLMObs {
     }
 
     // TODO: These configs should be passed through directly at construction time instead.
-    this._config.llmobs.enabled = true
+    this._config.llmobs.DD_LLMOBS_ENABLED = true
     this._config.llmobs.mlApp = options.mlApp
     this._config.llmobs.agentlessEnabled = options.agentlessEnabled
 
@@ -96,7 +96,7 @@ class LLMObs extends NoopLLMObs {
 
     logger.debug('Disabling LLMObs')
 
-    this._config.llmobs.enabled = false
+    this._config.llmobs.DD_LLMOBS_ENABLED = false
 
     // disable writers and channel subscribers
     this._llmobsModule.disable()
diff --git a/packages/dd-trace/src/llmobs/span_processor.js b/packages/dd-trace/src/llmobs/span_processor.js
index 615d4626b4..a41a629928 100644
--- a/packages/dd-trace/src/llmobs/span_processor.js
+++ b/packages/dd-trace/src/llmobs/span_processor.js
@@ -83,7 +83,7 @@ class LLMObsSpanProcessor {
 
   // TODO: instead of relying on the tagger's weakmap registry, can we use some namespaced storage correlation?
   process (span) {
-    if (!this.#config.llmobs.enabled) return
+    if (!this.#config.llmobs.DD_LLMOBS_ENABLED) return
     // if the span is not in our private tagger map, it is not an llmobs span
     if (!LLMObsTagger.tagMap.has(span)) return
 
diff --git a/packages/dd-trace/src/llmobs/tagger.js b/packages/dd-trace/src/llmobs/tagger.js
index c60337b6b8..dea398c111 100644
--- a/packages/dd-trace/src/llmobs/tagger.js
+++ b/packages/dd-trace/src/llmobs/tagger.js
@@ -105,7 +105,7 @@ class LLMObsTagger {
     integration,
     _decorator,
   } = {}) {
-    if (!this.#config.llmobs.enabled) return
+    if (!this.#config.llmobs.DD_LLMOBS_ENABLED) return
     if (!kind) return // do not register it in the map if it doesn't have an llmobs span kind
 
     const spanMlApp =
@@ -734,7 +734,7 @@ class LLMObsTagger {
   }
 
   _register (span) {
-    if (!this.#config.llmobs.enabled) return
+    if (!this.#config.llmobs.DD_LLMOBS_ENABLED) return
     if (registry.has(span)) {
       this.#handleFailure(`LLMObs Span "${span._name}" already registered.`)
       return
@@ -744,7 +744,7 @@ class LLMObsTagger {
   }
 
   _setTag (span, key, value) {
-    if (!this.#config.llmobs.enabled) return
+    if (!this.#config.llmobs.DD_LLMOBS_ENABLED) return
     if (!registry.has(span)) {
       this.#handleFailure(`Span "${span._name}" must be an LLMObs generated span.`)
       return
diff --git a/packages/dd-trace/src/llmobs/writers/base.js b/packages/dd-trace/src/llmobs/writers/base.js
index decb1896e2..89cbe5af19 100644
--- a/packages/dd-trace/src/llmobs/writers/base.js
+++ b/packages/dd-trace/src/llmobs/writers/base.js
@@ -229,7 +229,7 @@ class BaseLLMObsWriter {
     }
 
     if (this._agentless) {
-      options.headers['DD-API-KEY'] = this._config.apiKey || ''
+      options.headers['DD-API-KEY'] = this._config.DD_API_KEY || ''
     } else {
       options.headers[EVP_SUBDOMAIN_HEADER_NAME] = this._intake
     }
diff --git a/packages/dd-trace/src/opentelemetry/metrics/index.js b/packages/dd-trace/src/opentelemetry/metrics/index.js
index 4e2c82b11a..e9e16910bc 100644
--- a/packages/dd-trace/src/opentelemetry/metrics/index.js
+++ b/packages/dd-trace/src/opentelemetry/metrics/index.js
@@ -2,6 +2,14 @@
 
 const os = require('os')
 
+const { metrics } = require('@opentelemetry/api')
+
+const { VERSION } = require('../../../../../version')
+const processTags = require('../../process-tags')
+const MeterProvider = require('./meter_provider')
+const PeriodicMetricReader = require('./periodic_metric_reader')
+const OtlpHttpMetricExporter = require('./otlp_http_metric_exporter')
+
 /**
  * @typedef {import('../../config')} Config
  */
@@ -28,11 +36,6 @@ const os = require('os')
  * @package
  */
 
-const { metrics } = require('@opentelemetry/api')
-const MeterProvider = require('./meter_provider')
-const PeriodicMetricReader = require('./periodic_metric_reader')
-const OtlpHttpMetricExporter = require('./otlp_http_metric_exporter')
-
 /**
  * Initializes OpenTelemetry Metrics support
  * @param {import('../../config/config-base')} config - Tracer configuration instance
@@ -75,7 +78,53 @@ function initializeOpenTelemetryMetrics (config) {
   metrics.setGlobalMeterProvider(meterProvider)
 }
 
+function buildResourceAttributes (tags, { reportHostname, otelSemanticsEnabled, service, env, serviceVersion } = {}) {
+  const attrs = {
+    'telemetry.sdk.name': 'datadog',
+    'telemetry.sdk.language': 'nodejs',
+    'telemetry.sdk.version': VERSION,
+  }
+  if (service) attrs['service.name'] = service
+  if (serviceVersion) attrs['service.version'] = serviceVersion
+  if (env) attrs['deployment.environment.name'] = env
+  if (reportHostname) attrs['host.name'] = os.hostname()
+
+  if (!otelSemanticsEnabled) {
+    if (tags?.['runtime-id']) attrs['datadog.runtime_id'] = tags['runtime-id']
+    const processTagsObject = processTags.tagsObject
+    if (processTagsObject) {
+      for (const key of Object.keys(processTagsObject)) {
+        attrs[`datadog.${key}`] = processTagsObject[key]
+      }
+    }
+  }
+  return attrs
+}
+
+function createOtlpSpanStatsExporter (config) {
+  const { OtlpStatsExporter } = require('./otlp_span_stats_exporter')
+  const protocol = config.OTEL_EXPORTER_OTLP_METRICS_PROTOCOL || 'http/json'
+  const resourceAttributes = buildResourceAttributes(config.tags, {
+    reportHostname: config.reportHostname,
+    otelSemanticsEnabled: config.DD_TRACE_OTEL_SEMANTICS_ENABLED,
+    service: config.service,
+    env: config.env,
+    serviceVersion: config.version,
+  })
+  return new OtlpStatsExporter(
+    config.OTEL_EXPORTER_OTLP_METRICS_ENDPOINT,
+    protocol,
+    resourceAttributes,
+    config.DD_TRACE_OTEL_SEMANTICS_ENABLED,
+    config.service,
+    config.OTEL_EXPORTER_OTLP_METRICS_HEADERS,
+    config.OTEL_EXPORTER_OTLP_METRICS_TIMEOUT
+  )
+}
+
 module.exports = {
   MeterProvider,
   initializeOpenTelemetryMetrics,
+  buildResourceAttributes,
+  createOtlpSpanStatsExporter,
 }
diff --git a/packages/dd-trace/src/opentelemetry/metrics/otlp_span_stats_exporter.js b/packages/dd-trace/src/opentelemetry/metrics/otlp_span_stats_exporter.js
new file mode 100644
index 0000000000..018493dbf5
--- /dev/null
+++ b/packages/dd-trace/src/opentelemetry/metrics/otlp_span_stats_exporter.js
@@ -0,0 +1,40 @@
+'use strict'
+
+const log = require('../../log')
+const OtlpHttpExporterBase = require('../otlp/otlp_http_exporter_base')
+const OtlpStatsTransformer = require('./otlp_span_stats_transformer')
+
+class OtlpStatsExporter extends OtlpHttpExporterBase {
+  #transformer
+
+  /**
+   * @param {string} url
+   * @param {string} protocol
+   * @param {import('@opentelemetry/api').Attributes} resourceAttributes
+   * @param {boolean} [otelSemanticsEnabled]
+   * @param {string} [defaultService]
+   * @param {Record<string, string>} [headers]
+   * @param {number} [timeout]
+   */
+  constructor (url, protocol, resourceAttributes, otelSemanticsEnabled = false, defaultService = '',
+    headers, timeout = 10_000) {
+    super(url, headers, timeout, protocol, 'span-stats')
+    this.#transformer = new OtlpStatsTransformer(resourceAttributes, protocol, otelSemanticsEnabled, defaultService)
+  }
+
+  /**
+   * @param {Array<{timeNs: number, bucket: import('../../span_stats').SpanBuckets}>} drained
+   * @param {number} bucketSizeNs
+   */
+  export (drained, bucketSizeNs) {
+    if (drained.length === 0) return
+    const payload = this.#transformer.transform(drained, bucketSizeNs)
+    this.sendPayload(payload, (result) => {
+      if (result.code !== 0) {
+        log.error('Failed to export span stats: %s', result.error?.message)
+      }
+    })
+  }
+}
+
+module.exports = { OtlpStatsExporter }
diff --git a/packages/dd-trace/src/opentelemetry/metrics/otlp_span_stats_transformer.js b/packages/dd-trace/src/opentelemetry/metrics/otlp_span_stats_transformer.js
new file mode 100644
index 0000000000..ca4d23a747
--- /dev/null
+++ b/packages/dd-trace/src/opentelemetry/metrics/otlp_span_stats_transformer.js
@@ -0,0 +1,169 @@
+'use strict'
+
+const { LogCollapsingLowestDenseDDSketch } = require('../../../../../vendor/dist/@datadog/sketches-js')
+const OtlpTransformerBase = require('../otlp/otlp_transformer_base')
+const { getProtobufTypes } = require('../otlp/protobuf_loader')
+
+const NS_PER_S = 1e9
+
+// Must match libdatadog's EXPLICIT_BOUNDS_SECONDS and OTel spanmetrics connector defaults.
+const EXPLICIT_BOUNDS_SECONDS = [
+  0.002, 0.004, 0.006, 0.008, 0.01, 0.05, 0.1, 0.2, 0.4, 0.8, 1, 1.4, 2, 5, 10, 15,
+]
+
+/**
+ * @param {object} sketch
+ * @returns {number[]}
+ */
+function sketchToFixedHistogram (sketch) {
+  const bucketCounts = new Array(EXPLICIT_BOUNDS_SECONDS.length + 1).fill(0)
+  if (sketch.zeroCount > 0) bucketCounts[0] += sketch.zeroCount
+  const { store, mapping } = sketch
+  for (let key = store.minKey; key <= store.maxKey; key++) {
+    const weight = store.bins[key - store.offset]
+    if (!weight) continue
+    const seconds = mapping.value(key) / NS_PER_S
+    let idx = EXPLICIT_BOUNDS_SECONDS.findIndex((bound) => seconds <= bound)
+    if (idx === -1) idx = EXPLICIT_BOUNDS_SECONDS.length
+    bucketCounts[idx] += weight
+  }
+  return bucketCounts.map((weight) => Math.round(weight))
+}
+
+let _deltaTemporality
+
+function getDeltaTemporality () {
+  if (_deltaTemporality === undefined) {
+    const { protoAggregationTemporality } = getProtobufTypes()
+    _deltaTemporality = protoAggregationTemporality.values.AGGREGATION_TEMPORALITY_DELTA
+  }
+  return _deltaTemporality
+}
+
+const ERROR_STATUS_ATTR = { key: 'status.code', value: { intValue: 2 } }
+
+class OtlpStatsTransformer extends OtlpTransformerBase {
+  #otelSemanticsEnabled
+  #defaultService
+
+  /**
+   * @param {import('@opentelemetry/api').Attributes} resourceAttributes
+   * @param {string} protocol
+   * @param {boolean} [otelSemanticsEnabled]
+   * @param {string} [defaultService]
+   */
+  constructor (resourceAttributes, protocol, otelSemanticsEnabled = false, defaultService = '') {
+    super(resourceAttributes, protocol, 'span-stats')
+    this.#otelSemanticsEnabled = otelSemanticsEnabled
+    this.#defaultService = defaultService
+  }
+
+  /**
+   * @param {Array<{timeNs: number, bucket: import('../../span_stats').SpanBuckets}>} drained
+   * @param {number} bucketSizeNs
+   */
+  transform (drained, bucketSizeNs) {
+    const isJson = this.protocol === 'http/json'
+    const data = {
+      resourceMetrics: [{
+        resource: this.transformResource(),
+        scopeMetrics: this.#buildScopeMetrics(drained, bucketSizeNs, isJson),
+      }],
+    }
+    return isJson
+      ? this.serializeToJson(data)
+      : this.serializeToProtobuf(getProtobufTypes().protoMetricsService, data)
+  }
+
+  #buildScopeMetrics (drained, bucketSizeNs, isJson) {
+    const temporality = isJson ? 'AGGREGATION_TEMPORALITY_DELTA' : getDeltaTemporality()
+
+    const dataPoints = []
+
+    for (const { timeNs, bucket } of drained) {
+      const endTimeNs = timeNs + bucketSizeNs
+      const startNano = isJson ? String(timeNs) : timeNs
+      const endNano = isJson ? String(endTimeNs) : endTimeNs
+
+      for (const aggStats of bucket.values()) {
+        const baseAttrs = this.#buildAttributes(aggStats.aggKey)
+
+        if (this.#otelSemanticsEnabled) {
+          const okDist = new LogCollapsingLowestDenseDDSketch()
+          okDist.merge(aggStats.topLevelOkDistribution)
+          okDist.merge(aggStats.nonTopLevelOkDistribution)
+          const errDist = new LogCollapsingLowestDenseDDSketch()
+          errDist.merge(aggStats.topLevelErrorDistribution)
+          errDist.merge(aggStats.nonTopLevelErrorDistribution)
+          this.#pushPoint(dataPoints, okDist, startNano, endNano, baseAttrs)
+          this.#pushPoint(dataPoints, errDist, startNano, endNano, [...baseAttrs, ERROR_STATUS_ATTR])
+        } else {
+          const tlAttrs = [...baseAttrs, { key: 'datadog.span.top_level', value: { boolValue: true } }]
+          const ntlAttrs = [...baseAttrs, { key: 'datadog.span.top_level', value: { boolValue: false } }]
+          this.#pushPoint(dataPoints, aggStats.topLevelOkDistribution, startNano, endNano, tlAttrs)
+          this.#pushPoint(dataPoints, aggStats.topLevelErrorDistribution, startNano, endNano,
+            [...tlAttrs, ERROR_STATUS_ATTR])
+          this.#pushPoint(dataPoints, aggStats.nonTopLevelOkDistribution, startNano, endNano, ntlAttrs)
+          this.#pushPoint(dataPoints, aggStats.nonTopLevelErrorDistribution, startNano, endNano,
+            [...ntlAttrs, ERROR_STATUS_ATTR])
+        }
+      }
+    }
+
+    if (dataPoints.length === 0) return []
+    return [{
+      metrics: [
+        {
+          name: 'traces.span.sdk.metrics.duration',
+          unit: 's',
+          histogram: { dataPoints, aggregationTemporality: temporality },
+        },
+      ],
+    }]
+  }
+
+  #pushPoint (points, sketch, startNano, endNano, attributes) {
+    if (!sketch || sketch.count === 0) return
+    points.push({
+      attributes,
+      startTimeUnixNano: startNano,
+      timeUnixNano: endNano,
+      count: sketch.count,
+      sum: sketch.sum / NS_PER_S,
+      min: sketch.min / NS_PER_S,
+      max: sketch.max / NS_PER_S,
+      bucketCounts: sketchToFixedHistogram(sketch),
+      explicitBounds: EXPLICIT_BOUNDS_SECONDS,
+    })
+  }
+
+  /**
+   * @param {import('../../span_stats').SpanAggKey} aggKey
+   */
+  #buildAttributes (aggKey) {
+    const raw = { 'span.name': aggKey.resource }
+
+    if (aggKey.service && aggKey.service !== this.#defaultService) {
+      raw['service.name'] = aggKey.service
+    }
+
+    if (aggKey.spanKind) raw['span.kind'] = aggKey.spanKind
+    if (aggKey.statusCode) raw['http.response.status_code'] = Number(aggKey.statusCode)
+    if (aggKey.method) raw['http.request.method'] = aggKey.method
+    if (aggKey.endpoint) raw['http.route'] = aggKey.endpoint
+    if (aggKey.rpcStatusCode !== '') {
+      raw['rpc.response.status_code'] = String(aggKey.rpcStatusCode).toUpperCase()
+    }
+
+    if (!this.#otelSemanticsEnabled) {
+      raw['datadog.operation.name'] = aggKey.name
+      if (aggKey.type) raw['datadog.span.type'] = aggKey.type
+      if (aggKey.synthetics) raw['datadog.origin'] = 'synthetics'
+    }
+
+    return this.transformAttributes(raw)
+  }
+}
+
+module.exports = OtlpStatsTransformer
+module.exports.EXPLICIT_BOUNDS_SECONDS = EXPLICIT_BOUNDS_SECONDS
diff --git a/packages/dd-trace/src/opentelemetry/otlp/otlp_http_exporter_base.js b/packages/dd-trace/src/opentelemetry/otlp/otlp_http_exporter_base.js
index 55afb34c61..fe27cb643d 100644
--- a/packages/dd-trace/src/opentelemetry/otlp/otlp_http_exporter_base.js
+++ b/packages/dd-trace/src/opentelemetry/otlp/otlp_http_exporter_base.js
@@ -3,10 +3,12 @@
 const http = require('node:http')
 const https = require('node:https')
 const { URL } = require('node:url')
+const { storage } = require('../../../../datadog-core')
 const log = require('../../log')
 const telemetryMetrics = require('../../telemetry/metrics')
 
 const tracerMetrics = telemetryMetrics.manager.namespace('tracers')
+const legacyStorage = storage('legacy')
 
 /**
  * Base class for OTLP HTTP exporters.
@@ -35,18 +37,20 @@ class OtlpHttpExporterBase {
 
     const isJson = protocol === 'http/json'
 
-    // Initialize fields setUrl doesn't touch; it fills in hostname/port/path below.
+    const parsedUrl = new URL(url)
+    this.#transport = parsedUrl.protocol === 'http:' ? http : https
     this.options = {
       method: 'POST',
       timeout,
+      hostname: parsedUrl.hostname,
+      port: parsedUrl.port,
+      path: parsedUrl.pathname + parsedUrl.search,
       headers: {
         'Content-Type': isJson ? 'application/json' : 'application/x-protobuf',
         ...headers,
       },
     }
 
-    this.setUrl(url)
-
     this.telemetryTags = [
       `protocol:${this.#transport === https ? 'https' : 'http'}`,
       `encoding:${isJson ? 'json' : 'protobuf'}`,
@@ -84,59 +88,54 @@ class OtlpHttpExporterBase {
       },
     }
 
-    const req = this.#transport.request(options, (res) => {
-      let data = ''
-
-      res.on('data', (chunk) => {
-        data += chunk
+    legacyStorage.run({ noop: true }, () => {
+      const req = this.#transport.request(options, (res) => {
+        let data = ''
+
+        res.on('data', (chunk) => {
+          data += chunk
+        })
+
+        res.once('end', () => {
+          // @ts-expect-error - res.statusCode can be undefined
+          if (res.statusCode >= 200 && res.statusCode < 300) {
+            resultCallback({ code: 0 })
+          } else {
+            const error = new Error(`HTTP ${res.statusCode}: ${data}`)
+            resultCallback({ code: 1, error })
+          }
+        })
       })
 
-      res.once('end', () => {
-        // @ts-expect-error - res.statusCode can be undefined
-        if (res.statusCode >= 200 && res.statusCode < 300) {
-          resultCallback({ code: 0 })
-        } else {
-          const error = new Error(`HTTP ${res.statusCode}: ${data}`)
-          resultCallback({ code: 1, error })
-        }
+      req.on('error', (error) => {
+        log.error('Error sending OTLP %s:', this.signalType, error)
+        resultCallback({ code: 1, error })
       })
-    })
 
-    req.on('error', (error) => {
-      log.error('Error sending OTLP %s:', this.signalType, error)
-      resultCallback({ code: 1, error })
-    })
+      req.once('timeout', () => {
+        req.destroy()
+        const error = new Error('Request timeout')
+        resultCallback({ code: 1, error })
+      })
 
-    req.once('timeout', () => {
-      req.destroy()
-      const error = new Error('Request timeout')
-      resultCallback({ code: 1, error })
+      req.write(payload)
+      req.end()
     })
-
-    req.write(payload)
-    req.end()
   }
 
   /**
-   * Updates the target URL used by this exporter. The URL is used as-is per the OTel spec: the
-   * caller is responsible for including the signal-specific path (`/v1/traces` etc.).
-   * @param {string} url - New OTLP endpoint URL
+   * Re-targets the exporter to a different URL, updating transport, hostname, port, and path.
+   * @param {string} url
    */
   setUrl (url) {
     const parsedUrl = new URL(url)
+    this.#transport = parsedUrl.protocol === 'http:' ? http : https
     this.options.hostname = parsedUrl.hostname
     this.options.port = parsedUrl.port
     this.options.path = parsedUrl.pathname + parsedUrl.search
-    this.#transport = parsedUrl.protocol === 'http:' ? http : https
-    if (this.telemetryTags !== undefined) {
-      this.telemetryTags[0] = `protocol:${this.#transport === https ? 'https' : 'http'}`
-    }
+    this.telemetryTags[0] = `protocol:${this.#transport === https ? 'https' : 'http'}`
   }
 
-  /**
-   * Shuts down the exporter.
-   * Subclasses can override to add cleanup logic.
-   */
   shutdown () {}
 }
 
diff --git a/packages/dd-trace/src/opentelemetry/trace/index.js b/packages/dd-trace/src/opentelemetry/trace/index.js
index 12c7e95db6..e3013cd2c5 100644
--- a/packages/dd-trace/src/opentelemetry/trace/index.js
+++ b/packages/dd-trace/src/opentelemetry/trace/index.js
@@ -45,6 +45,10 @@ function buildResourceAttributes (config) {
   const { service, version, env, ...filteredTags } = config.tags
   Object.assign(resourceAttributes, filteredTags)
 
+  if (config.OTEL_TRACES_SPAN_METRICS_ENABLED) {
+    resourceAttributes['_dd.stats_computed'] = 'true'
+  }
+
   return resourceAttributes
 }
 
diff --git a/packages/dd-trace/src/opentelemetry/tracer_provider.js b/packages/dd-trace/src/opentelemetry/tracer_provider.js
index 4baf9d1210..32e20b76c6 100644
--- a/packages/dd-trace/src/opentelemetry/tracer_provider.js
+++ b/packages/dd-trace/src/opentelemetry/tracer_provider.js
@@ -68,7 +68,7 @@ class TracerProvider {
       return Promise.reject(new Error('Not started'))
     }
 
-    exporter._writer.flush()
+    exporter._writer?.flush()
     return this._activeProcessor.forceFlush()
   }
 
diff --git a/packages/dd-trace/src/opentracing/tracer.js b/packages/dd-trace/src/opentracing/tracer.js
index 7dd3ce9c52..e52a783ee7 100644
--- a/packages/dd-trace/src/opentracing/tracer.js
+++ b/packages/dd-trace/src/opentracing/tracer.js
@@ -45,7 +45,12 @@ class DatadogTracer {
       this._exporter = new Exporter(config, this._prioritySampler)
     }
 
-    this._processor = new SpanProcessor(this._exporter, this._prioritySampler, config)
+    let otlpStatsExporter
+    if (config.OTEL_TRACES_SPAN_METRICS_ENABLED) {
+      const { createOtlpSpanStatsExporter } = require('../opentelemetry/metrics')
+      otlpStatsExporter = createOtlpSpanStatsExporter(config)
+    }
+    this._processor = new SpanProcessor(this._exporter, this._prioritySampler, config, otlpStatsExporter)
     this._url = this._exporter._url
     this._enableGetRumData = config.experimental.enableGetRumData
     this._traceId128BitGenerationEnabled = config.traceId128BitGenerationEnabled
diff --git a/packages/dd-trace/src/plugin_manager.js b/packages/dd-trace/src/plugin_manager.js
index 552e4c242e..4c7aa52710 100644
--- a/packages/dd-trace/src/plugin_manager.js
+++ b/packages/dd-trace/src/plugin_manager.js
@@ -158,7 +158,7 @@ module.exports = class PluginManager {
     const {
       logInjection,
       serviceMapping,
-      queryStringObfuscation,
+      DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP,
       site,
       url,
       headerTags,
@@ -171,14 +171,14 @@ module.exports = class PluginManager {
       DD_TRACE_OTEL_SEMANTICS_ENABLED,
       DD_TEST_SESSION_NAME,
       DD_AGENTLESS_LOG_SUBMISSION_ENABLED,
-      isTestDynamicInstrumentationEnabled,
+      testOptimization,
       isServiceUserProvided,
       middlewareTracingEnabled,
       traceWebsocketMessagesEnabled,
       traceWebsocketMessagesInheritSampling,
       traceWebsocketMessagesSeparateTraces,
       experimental,
-      resourceRenamingEnabled,
+      DD_TRACE_RESOURCE_RENAMING_ENABLED,
     } = /** @type {import('./config/config-base')} */ (this._tracerConfig)
 
     const sharedConfig = {
@@ -193,21 +193,21 @@ module.exports = class PluginManager {
       clientIpHeader,
       DD_TEST_SESSION_NAME,
       DD_AGENTLESS_LOG_SUBMISSION_ENABLED,
-      isTestDynamicInstrumentationEnabled,
+      isTestDynamicInstrumentationEnabled: testOptimization.DD_TEST_FAILED_TEST_REPLAY_ENABLED,
       isServiceUserProvided,
       traceWebsocketMessagesEnabled,
       traceWebsocketMessagesInheritSampling,
       traceWebsocketMessagesSeparateTraces,
       experimental,
-      resourceRenamingEnabled,
+      resourceRenamingEnabled: DD_TRACE_RESOURCE_RENAMING_ENABLED,
     }
 
     if (logInjection !== undefined) {
       sharedConfig.logInjection = logInjection
     }
 
-    if (queryStringObfuscation !== undefined) {
-      sharedConfig.queryStringObfuscation = queryStringObfuscation
+    if (DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP !== undefined) {
+      sharedConfig.queryStringObfuscation = DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP
     }
 
     if (serviceMapping && serviceMapping[name]) {
diff --git a/packages/dd-trace/src/plugins/ci_plugin.js b/packages/dd-trace/src/plugins/ci_plugin.js
index d2589a0306..3e49eb53f5 100644
--- a/packages/dd-trace/src/plugins/ci_plugin.js
+++ b/packages/dd-trace/src/plugins/ci_plugin.js
@@ -61,7 +61,7 @@ const {
   DI_DEBUG_ERROR_SNAPSHOT_ID_SUFFIX,
   DI_DEBUG_ERROR_FILE_SUFFIX,
   DI_DEBUG_ERROR_LINE_SUFFIX,
-  getLibraryCapabilitiesTags,
+  getLibraryCapabilitiesTags: getDefaultLibraryCapabilitiesTags,
   getPullRequestDiff,
   getModifiedFilesFromDiff,
   getPullRequestBaseBranch,
@@ -109,7 +109,7 @@ const TEST_FRAMEWORKS_TO_SKIP_GIT_METADATA_EXTRACTION = new Set([
 ])
 
 function setItrSkippingEnabledTagFromLibraryConfig (plugin, frameworkVersion) {
-  const libraryCapabilitiesTags = getLibraryCapabilitiesTags(plugin.constructor.id, frameworkVersion)
+  const libraryCapabilitiesTags = getDefaultLibraryCapabilitiesTags(plugin.constructor.id, frameworkVersion)
 
   if (!libraryCapabilitiesTags[DD_CAPABILITIES_TEST_IMPACT_ANALYSIS] ||
     !plugin.libraryConfig ||
@@ -168,7 +168,7 @@ module.exports = class CiPlugin extends Plugin {
           ? getSessionRequestErrorTags(this.testSessionSpan)
           : Object.fromEntries(this._pendingRequestErrorTags.map(({ tag, value }) => [tag, value]))
 
-        const libraryCapabilitiesTags = getLibraryCapabilitiesTags(this.constructor.id, frameworkVersion)
+        const libraryCapabilitiesTags = this.getLibraryCapabilitiesTags(frameworkVersion, ctx)
         const metadataTags = {
           test: {
             ...libraryCapabilitiesTags,
@@ -431,6 +431,15 @@ module.exports = class CiPlugin extends Plugin {
     }
   }
 
+  /**
+   * Returns library capability metadata tags for this test framework.
+   * @param {string} frameworkVersion - The test framework version.
+   * @returns {Record<string, string|undefined>}
+   */
+  getLibraryCapabilitiesTags (frameworkVersion) {
+    return getDefaultLibraryCapabilitiesTags(this.constructor.id, frameworkVersion)
+  }
+
   /**
    * Adds a hidden _dd tag to the test session span when a test-optimization request fails.
    * If the session span does not exist yet (e.g. library-configuration failed before session:start),
diff --git a/packages/dd-trace/src/plugins/util/llm.js b/packages/dd-trace/src/plugins/util/llm.js
index b22cd96c09..548ddc78cd 100644
--- a/packages/dd-trace/src/plugins/util/llm.js
+++ b/packages/dd-trace/src/plugins/util/llm.js
@@ -37,7 +37,12 @@ function isPromptCompletionSampled (sampler, span) {
 
 module.exports = function makeUtilities (integrationName, tracerConfig) {
   const integrationConfig = tracerConfig[integrationName] || {}
-  const { spanCharLimit, spanPromptCompletionSampleRate } = integrationConfig
+  // The per-integration config is keyed by the canonical environment variable
+  // names (e.g. `DD_LANGCHAIN_SPAN_CHAR_LIMIT`), nested under the integration's
+  // namespace. Derive those leaf names from the integration name.
+  const prefix = `DD_${integrationName.toUpperCase()}_`
+  const spanCharLimit = integrationConfig[`${prefix}SPAN_CHAR_LIMIT`]
+  const spanPromptCompletionSampleRate = integrationConfig[`${prefix}SPAN_PROMPT_COMPLETION_SAMPLE_RATE`]
 
   const sampler = new Sampler(spanPromptCompletionSampleRate ?? 1)
 
diff --git a/packages/dd-trace/src/plugins/util/test.js b/packages/dd-trace/src/plugins/util/test.js
index ea33e63cc7..a8e883e29f 100644
--- a/packages/dd-trace/src/plugins/util/test.js
+++ b/packages/dd-trace/src/plugins/util/test.js
@@ -112,6 +112,12 @@ const TEST_RETRY_REASON = 'test.retry_reason'
 const TEST_HAS_FAILED_ALL_RETRIES = 'test.has_failed_all_retries'
 const TEST_IS_MODIFIED = 'test.is_modified'
 const TEST_HAS_DYNAMIC_NAME = '_dd.has_dynamic_name'
+const EARLY_FLAKE_DETECTION_RETRY_THRESHOLDS = [
+  { limitMs: 5 * 1000, key: '5s' },
+  { limitMs: 10 * 1000, key: '10s' },
+  { limitMs: 30 * 1000, key: '30s' },
+  { limitMs: 5 * 60 * 1000, key: '5m' },
+]
 const CI_APP_ORIGIN = 'ciapp-test'
 
 // Matches patterns that are almost certainly runtime-generated values in test names:
@@ -493,6 +499,7 @@ module.exports = {
   removeInvalidMetadata,
   parseAnnotations,
   getIsFaultyEarlyFlakeDetection,
+  EARLY_FLAKE_DETECTION_RETRY_THRESHOLDS,
   getEfdRetryCount,
   getMaxEfdRetryCount,
   TEST_BROWSER_DRIVER,
@@ -1447,13 +1454,7 @@ function parseAnnotations (annotations) {
  * @returns {number}
  */
 function getEfdRetryCount (durationMs, slowTestRetries) {
-  const thresholds = [
-    { limitMs: 5 * 1000, key: '5s' },
-    { limitMs: 10 * 1000, key: '10s' },
-    { limitMs: 30 * 1000, key: '30s' },
-    { limitMs: 5 * 60 * 1000, key: '5m' },
-  ]
-  for (const { limitMs, key } of thresholds) {
+  for (const { limitMs, key } of EARLY_FLAKE_DETECTION_RETRY_THRESHOLDS) {
     if (durationMs < limitMs) {
       return slowTestRetries[key] ?? 0
     }
@@ -1616,7 +1617,7 @@ function isFailedTestReplaySupported (testFramework, frameworkVersion) {
     : true
 }
 
-function getLibraryCapabilitiesTags (testFramework, frameworkVersion) {
+function getLibraryCapabilitiesTags (testFramework, frameworkVersion, options = {}) {
   return {
     [DD_CAPABILITIES_TEST_IMPACT_ANALYSIS]: isTiaSupported(testFramework)
       ? '1'
@@ -1638,7 +1639,8 @@ function getLibraryCapabilitiesTags (testFramework, frameworkVersion) {
       isAttemptToFixSupported(testFramework, frameworkVersion)
         ? '5'
         : undefined,
-    [DD_CAPABILITIES_FAILED_TEST_REPLAY]: isFailedTestReplaySupported(testFramework, frameworkVersion)
+    [DD_CAPABILITIES_FAILED_TEST_REPLAY]: !options.omitFailedTestReplay &&
+      isFailedTestReplaySupported(testFramework, frameworkVersion)
       ? '1'
       : undefined,
   }
diff --git a/packages/dd-trace/src/profiling/exporter_cli.js b/packages/dd-trace/src/profiling/exporter_cli.js
index 24c4c56c88..5369b0507b 100644
--- a/packages/dd-trace/src/profiling/exporter_cli.js
+++ b/packages/dd-trace/src/profiling/exporter_cli.js
@@ -18,7 +18,7 @@ function exporterFromURL (url) {
     return new FileExporter({}, fileURLToPath(url))
   }
   // The subprocess has no tracer config, so mirror the canonical config property
-  // names the exporters read. Normalize the raw env to the parsed profiling.enabled
+  // names the exporters read. Normalize the raw env to the parsed profiling.DD_PROFILING_ENABLED
   // values ('true' | 'false' | 'auto') the main process would have produced.
   const profilingEnabled = (getValueFromEnvSources('DD_PROFILING_ENABLED') ?? '').toLowerCase()
   const enabled = profilingEnabled === 'auto'
@@ -28,7 +28,7 @@ function exporterFromURL (url) {
     url,
     DD_PROFILING_UPLOAD_TIMEOUT: timeoutMs,
     DD_INJECTION_ENABLED: getValueFromEnvSources('DD_INJECTION_ENABLED'),
-    profiling: { enabled },
+    profiling: { DD_PROFILING_ENABLED: enabled },
   })
 }
 
diff --git a/packages/dd-trace/src/profiling/exporters/event_serializer.js b/packages/dd-trace/src/profiling/exporters/event_serializer.js
index b3cb6c9c17..aff7aa1985 100644
--- a/packages/dd-trace/src/profiling/exporters/event_serializer.js
+++ b/packages/dd-trace/src/profiling/exporters/event_serializer.js
@@ -11,10 +11,10 @@ const processTags = require('../../process-tags')
 /** @typedef {import('../../config/config-base')} TracerConfig */
 
 /**
- * Maps the canonical profiling.enabled value to the activation reported in the
+ * Maps the canonical profiling.DD_PROFILING_ENABLED value to the activation reported in the
  * profile event.
  *
- * @param {string} [enabled] - config.profiling.enabled ('true' | 'false' | 'auto')
+ * @param {string} [enabled] - config.profiling.DD_PROFILING_ENABLED ('true' | 'false' | 'auto')
  * @returns {string}
  */
 function getActivation (enabled) {
@@ -38,7 +38,7 @@ class EventSerializer {
     this.#service = config.service
     this.#appVersion = config.version
     this.#libraryInjected = !!config.DD_INJECTION_ENABLED
-    this.#activation = getActivation(config.profiling?.enabled)
+    this.#activation = getActivation(config.profiling?.DD_PROFILING_ENABLED)
   }
 
   /**
diff --git a/packages/dd-trace/src/profiling/profilers/wall.js b/packages/dd-trace/src/profiling/profilers/wall.js
index bdce213c6d..798a68f327 100644
--- a/packages/dd-trace/src/profiling/profilers/wall.js
+++ b/packages/dd-trace/src/profiling/profilers/wall.js
@@ -148,7 +148,7 @@ class NativeWallProfiler {
     this.#endpointCollectionEnabled = config.DD_PROFILING_ENDPOINT_COLLECTION_ENABLED
     this.#flushIntervalMillis = flushInterval
     this.#samplingIntervalMicros = SAMPLING_INTERVAL * 1000
-    this.#telemetryHeartbeatIntervalMillis = config.telemetry.heartbeatInterval
+    this.#telemetryHeartbeatIntervalMillis = config.telemetry.DD_TELEMETRY_HEARTBEAT_INTERVAL
     this.#timelineEnabled = config.DD_PROFILING_TIMELINE_ENABLED
     this.#v8ProfilerBugWorkaroundEnabled = config.DD_PROFILING_V8_PROFILER_BUG_WORKAROUND
 
diff --git a/packages/dd-trace/src/proxy.js b/packages/dd-trace/src/proxy.js
index 821f7aac3b..54d581a227 100644
--- a/packages/dd-trace/src/proxy.js
+++ b/packages/dd-trace/src/proxy.js
@@ -138,7 +138,7 @@ class Tracer extends NoopProxy {
         spanleak.startScrubber()
       }
 
-      if (config.remoteConfig.enabled && !config.isCiVisibility) {
+      if (config.remoteConfig.DD_REMOTE_CONFIGURATION_ENABLED && !config.isCiVisibility) {
         const RemoteConfig = require('./remote_config')
         const rc = new RemoteConfig(config)
 
@@ -180,11 +180,11 @@ class Tracer extends NoopProxy {
         openfeatureRemoteConfig.enable(rc, config, () => this.openfeature)
       }
 
-      if (config.profiling.enabled === 'true') {
+      if (config.profiling.DD_PROFILING_ENABLED === 'true') {
         this._profilerStarted = this._startProfiler(config)
       } else {
         this._profilerStarted = false
-        if (config.profiling.enabled === 'auto') {
+        if (config.profiling.DD_PROFILING_ENABLED === 'auto') {
           const { SSIHeuristics } = require('./profiling/ssi-heuristics')
           const ssiHeuristics = new SSIHeuristics(config)
           ssiHeuristics.start()
@@ -216,7 +216,7 @@ class Tracer extends NoopProxy {
 
       this._modules.rewriter.enable(config)
 
-      if (config.tracing && config.DD_CIVISIBILITY_MANUAL_API_ENABLED) {
+      if (config.DD_TRACE_ENABLED && config.testOptimization.DD_CIVISIBILITY_MANUAL_API_ENABLED) {
         const TestApiManualPlugin = require('./ci-visibility/test-api-manual/test-api-manual-plugin')
         this._testApiManualPlugin = new TestApiManualPlugin(this)
         // `shouldGetEnvironmentData` is passed as false so that we only lazily calculate it
@@ -225,7 +225,7 @@ class Tracer extends NoopProxy {
         this._testApiManualPlugin.configure({ ...config, enabled: true }, false)
       }
       if (config.DD_AGENTLESS_LOG_SUBMISSION_ENABLED) {
-        if (config.apiKey) {
+        if (config.DD_API_KEY) {
           const LogSubmissionPlugin = require('./ci-visibility/log-submission/log-submission-plugin')
           const automaticLogPlugin = new LogSubmissionPlugin(this)
           automaticLogPlugin.configure({ ...config, enabled: true })
@@ -237,7 +237,7 @@ class Tracer extends NoopProxy {
         }
       }
 
-      if (config.isTestDynamicInstrumentationEnabled) {
+      if (config.testOptimization.DD_TEST_FAILED_TEST_REPLAY_ENABLED) {
         const getDynamicInstrumentationClient = require('./ci-visibility/dynamic-instrumentation')
         // We instantiate the client but do not start the Worker here. The worker is started lazily
         getDynamicInstrumentationClient(config)
@@ -270,11 +270,11 @@ class Tracer extends NoopProxy {
    * @param {import('./config/config-base')} config - Tracer configuration
    */
   #updateTracing (config) {
-    if (config.tracing !== false) {
+    if (config.DD_TRACE_ENABLED !== false) {
       if (config.appsec.enabled) {
         this._modules.appsec.enable(config)
       }
-      if (config.llmobs.enabled) {
+      if (config.llmobs.DD_LLMOBS_ENABLED) {
         this._modules.llmobs.enable(config)
       }
       if (!this._tracingInitialized) {
diff --git a/packages/dd-trace/src/span_processor.js b/packages/dd-trace/src/span_processor.js
index ac7f471d05..ab2f8106e0 100644
--- a/packages/dd-trace/src/span_processor.js
+++ b/packages/dd-trace/src/span_processor.js
@@ -11,16 +11,15 @@ const startedSpans = new WeakSet()
 const finishedSpans = new WeakSet()
 
 class SpanProcessor {
-  constructor (exporter, prioritySampler, config) {
+  constructor (exporter, prioritySampler, config, otlpStatsExporter) {
     this._exporter = exporter
     this._prioritySampler = prioritySampler
     this._config = config
     this._killAll = false
 
-    // TODO: This should already have been calculated in `config.js`.
-    if (config.stats?.enabled && !config.appsec?.standalone?.enabled) {
+    if (config.stats?.DD_TRACE_STATS_COMPUTATION_ENABLED && !config.appsec?.standalone?.enabled) {
       const { SpanStatsProcessor } = require('./span_stats')
-      this._stats = new SpanStatsProcessor(config)
+      this._stats = new SpanStatsProcessor(config, otlpStatsExporter)
     }
 
     this._spanSampler = new SpanSampler(config.sampler)
@@ -42,11 +41,11 @@ class SpanProcessor {
     const active = []
     const formatted = []
     const trace = spanContext._trace
-    const { flushMinSpans, tracing } = this._config
+    const { flushMinSpans, DD_TRACE_ENABLED } = this._config
     const { started, finished } = trace
 
     if (trace.record === false) return
-    if (tracing === false) {
+    if (DD_TRACE_ENABLED === false) {
       this._erase(trace, active)
       return
     }
diff --git a/packages/dd-trace/src/span_stats.js b/packages/dd-trace/src/span_stats.js
index 39039191bb..7bdd8c3f04 100644
--- a/packages/dd-trace/src/span_stats.js
+++ b/packages/dd-trace/src/span_stats.js
@@ -10,8 +10,10 @@ const {
   HTTP_ENDPOINT,
   HTTP_ROUTE,
   HTTP_METHOD,
+  SPAN_KIND,
+  GRPC_STATUS_CODE,
 } = require('../../../ext/tags')
-const { ORIGIN_KEY, TOP_LEVEL_KEY, SVC_SRC_KEY } = require('./constants')
+const { ORIGIN_KEY, TOP_LEVEL_KEY, SVC_SRC_KEY, GRPC_STATUS_NAMES } = require('./constants')
 const { version } = require('./pkg')
 const processTags = require('./process-tags')
 
@@ -27,43 +29,32 @@ class SpanAggStats {
     this.aggKey = aggKey
     this.hits = 0
     this.topLevelHits = 0
-    this.errors = 0
-    this.duration = 0
-    this.okDistribution = new LogCollapsingLowestDenseDDSketch()
-    this.errorDistribution = new LogCollapsingLowestDenseDDSketch()
+    this.topLevelOkDistribution = new LogCollapsingLowestDenseDDSketch()
+    this.topLevelErrorDistribution = new LogCollapsingLowestDenseDDSketch()
+    this.nonTopLevelOkDistribution = new LogCollapsingLowestDenseDDSketch()
+    this.nonTopLevelErrorDistribution = new LogCollapsingLowestDenseDDSketch()
   }
 
   record (span) {
     const durationNs = span.duration
     this.hits++
-    this.duration += durationNs
-
-    if (span.metrics[TOP_LEVEL_KEY]) {
-      this.topLevelHits++
-    }
-
+    const isTopLevel = Boolean(span.metrics[TOP_LEVEL_KEY])
+    if (isTopLevel) this.topLevelHits++
     if (span.error) {
-      this.errors++
-      this.errorDistribution.accept(durationNs)
+      if (isTopLevel) this.topLevelErrorDistribution.accept(durationNs)
+      else this.nonTopLevelErrorDistribution.accept(durationNs)
     } else {
-      this.okDistribution.accept(durationNs)
+      if (isTopLevel) this.topLevelOkDistribution.accept(durationNs)
+      else this.nonTopLevelOkDistribution.accept(durationNs)
     }
   }
 
   toJSON () {
     const {
-      name,
-      service,
-      resource,
-      type,
-      statusCode,
-      synthetics,
-      method,
-      endpoint,
-      srvSrc,
+      name, service, resource, type, statusCode, synthetics, method, endpoint, srvSrc,
+      spanKind, rpcStatusCode,
     } = this.aggKey
-
-    return {
+    const base = {
       Name: name,
       Service: service,
       Resource: resource,
@@ -73,13 +64,34 @@ class SpanAggStats {
       HTTPMethod: method,
       HTTPEndpoint: endpoint,
       srv_src: srvSrc,
-      Hits: this.hits,
-      TopLevelHits: this.topLevelHits,
-      Errors: this.errors,
-      Duration: this.duration,
-      OkSummary: this.okDistribution.toProto(), // TODO: custom proto encoding
-      ErrorSummary: this.errorDistribution.toProto(), // TODO: custom proto encoding
+      SpanKind: spanKind,
+      GRPCStatusCode: rpcStatusCode,
+    }
+    const rows = []
+    if (this.topLevelHits > 0) {
+      rows.push({
+        ...base,
+        Hits: this.topLevelHits,
+        TopLevelHits: this.topLevelHits,
+        Errors: this.topLevelErrorDistribution.count,
+        Duration: this.topLevelOkDistribution.sum + this.topLevelErrorDistribution.sum,
+        OkSummary: this.topLevelOkDistribution.toProto(),
+        ErrorSummary: this.topLevelErrorDistribution.toProto(),
+      })
+    }
+    const nonTopLevelHits = this.hits - this.topLevelHits
+    if (nonTopLevelHits > 0) {
+      rows.push({
+        ...base,
+        Hits: nonTopLevelHits,
+        TopLevelHits: 0,
+        Errors: this.nonTopLevelErrorDistribution.count,
+        Duration: this.nonTopLevelOkDistribution.sum + this.nonTopLevelErrorDistribution.sum,
+        OkSummary: this.nonTopLevelOkDistribution.toProto(), // TODO: custom proto encoding
+        ErrorSummary: this.nonTopLevelErrorDistribution.toProto(), // TODO: custom proto encoding
+      })
     }
+    return rows
   }
 }
 
@@ -94,6 +106,12 @@ class SpanAggKey {
     this.endpoint = span.meta[HTTP_ROUTE] || span.meta[HTTP_ENDPOINT] || ''
     this.method = span.meta[HTTP_METHOD] || ''
     this.srvSrc = span.meta[SVC_SRC_KEY] || ''
+    this.spanKind = span.meta[SPAN_KIND] || ''
+    // dd gRPC plugin sets a numeric code via setTag; OTel/manual sets a string name via meta.
+    const grpcCode = span.meta[GRPC_STATUS_CODE] ?? span.metrics?.[GRPC_STATUS_CODE]
+    this.rpcStatusCode = typeof grpcCode === 'number'
+      ? (GRPC_STATUS_NAMES[grpcCode] ?? String(grpcCode))
+      : (grpcCode ?? '')
   }
 
   toString () {
@@ -107,6 +125,8 @@ class SpanAggKey {
       this.method,
       this.endpoint,
       this.srvSrc,
+      this.spanKind,
+      this.rpcStatusCode,
     ].join(',')
   }
 }
@@ -137,57 +157,60 @@ class TimeBuckets extends Map {
 class SpanStatsProcessor {
   constructor ({
     stats: {
-      enabled = false,
+      DD_TRACE_STATS_COMPUTATION_ENABLED: enabled = false,
       interval = 10,
-    },
+    } = {},
     hostname,
     port,
     url,
     env,
     tags,
-    version,
-  } = {}) {
-    this.exporter = new SpanStatsExporter({
-      hostname,
-      port,
-      tags,
-      url,
-    })
-    this.interval = interval
-    this.bucketSizeNs = interval * 1e9
+    version: appVersion,
+    _DD_TRACE_METRICS_OTEL_FLUSH_INTERVAL: flushIntervalMs,
+  } = {}, otlpExporter) {
+    if (!otlpExporter) {
+      this.exporter = new SpanStatsExporter({ hostname, port, tags, url })
+    }
+    const intervalMs = otlpExporter ? (flushIntervalMs ?? 10_000) : interval * 1e3
+    this.interval = intervalMs / 1e3
+    this.bucketSizeNs = intervalMs * 1e6
     this.buckets = new TimeBuckets()
     this.hostname = os.hostname()
     this.enabled = enabled
+    this.otlpExporter = otlpExporter || null
     this.env = env
     this.tags = tags || {}
     this.sequence = 0
-    this.version = version
+    this.version = appVersion
 
-    if (this.enabled) {
-      this.timer = setInterval(this.onInterval.bind(this), interval * 1e3)
+    if (this.enabled || this.otlpExporter) {
+      this.timer = setInterval(this.onInterval.bind(this), intervalMs)
       this.timer.unref?.()
     }
   }
 
   onInterval () {
-    const serialized = this._serializeBuckets()
-    if (!serialized) return
-
-    this.exporter.export({
-      Hostname: this.hostname,
-      Env: this.env,
-      Version: this.version || version,
-      Stats: serialized,
-      Lang: 'javascript',
-      TracerVersion: pkg.version,
-      RuntimeID: this.tags['runtime-id'],
-      Sequence: ++this.sequence,
-      ProcessTags: processTags.serialized,
-    })
+    const drained = this.#drainBuckets()
+
+    if (this.enabled && !this.otlpExporter) {
+      this.exporter.export({
+        Hostname: this.hostname,
+        Env: this.env,
+        Version: this.version || version,
+        Stats: this.#toV06Payload(drained),
+        Lang: 'javascript',
+        TracerVersion: pkg.version,
+        RuntimeID: this.tags['runtime-id'],
+        Sequence: ++this.sequence,
+        ProcessTags: processTags.serialized,
+      })
+    } else if (this.otlpExporter && drained.length > 0) {
+      this.otlpExporter.export(drained, this.bucketSizeNs)
+    }
   }
 
   onSpanFinished (span) {
-    if (!this.enabled) return
+    if (!this.enabled && !this.otlpExporter) return
     if (!span.metrics[TOP_LEVEL_KEY] && !span.metrics[MEASURED]) return
 
     const spanEndNs = span.start + span.duration
@@ -198,27 +221,22 @@ class SpanStatsProcessor {
       .record(span)
   }
 
-  _serializeBuckets () {
-    const { bucketSizeNs } = this
-    const serializedBuckets = []
-
+  #drainBuckets () {
+    const drained = []
     for (const [timeNs, bucket] of this.buckets.entries()) {
-      const bucketAggStats = []
-
-      for (const stats of bucket.values()) {
-        bucketAggStats.push(stats.toJSON())
-      }
-
-      serializedBuckets.push({
-        Start: timeNs,
-        Duration: bucketSizeNs,
-        Stats: bucketAggStats,
-      })
+      drained.push({ timeNs, bucket })
     }
-
     this.buckets.clear()
+    return drained
+  }
 
-    return serializedBuckets
+  #toV06Payload (drained) {
+    const { bucketSizeNs } = this
+    return drained.map(({ timeNs, bucket }) => ({
+      Start: timeNs,
+      Duration: bucketSizeNs,
+      Stats: [...bucket.values()].flatMap(stats => stats.toJSON()),
+    }))
   }
 }
 
diff --git a/packages/dd-trace/src/startup-log.js b/packages/dd-trace/src/startup-log.js
index 37071f9efc..7e74e3d508 100644
--- a/packages/dd-trace/src/startup-log.js
+++ b/packages/dd-trace/src/startup-log.js
@@ -76,6 +76,7 @@ function logGenericError (message) {
  */
 function configInfo () {
   const url = config.url
+  const profilingEnabled = config.profiling.DD_PROFILING_ENABLED
 
   return {
     [inspect.custom] () {
@@ -104,7 +105,7 @@ function configInfo () {
     ...(config.tags && config.tags.version && { dd_version: config.tags.version }),
     log_injection_enabled: !!config.logInjection,
     runtime_metrics_enabled: !!config.runtimeMetrics,
-    profiling_enabled: config.profiling?.enabled === 'true' || config.profiling?.enabled === 'auto',
+    profiling_enabled: profilingEnabled === 'true' || profilingEnabled === 'auto',
     appsec_enabled: config.appsec.enabled,
     data_streams_enabled: !!config.dsmEnabled,
   }
diff --git a/packages/dd-trace/src/telemetry/dependencies.js b/packages/dd-trace/src/telemetry/dependencies.js
index dbdac58232..017b6d113a 100644
--- a/packages/dd-trace/src/telemetry/dependencies.js
+++ b/packages/dd-trace/src/telemetry/dependencies.js
@@ -32,7 +32,7 @@ function waitAndSend (config, application, host) {
       const [name, version, initialLoadModule] = dependency.split(' ')
       // If a dependency is from the initial load, *always* send the event
       // Otherwise, only send if dependencyCollection is enabled
-      const sendModule = isTrue(initialLoadModule) || config.telemetry?.dependencyCollection
+      const sendModule = isTrue(initialLoadModule) || config.telemetry.DD_TELEMETRY_DEPENDENCY_COLLECTION_ENABLED
 
       savedDependenciesToSend.delete(dependency)
 
diff --git a/packages/dd-trace/src/telemetry/endpoints.js b/packages/dd-trace/src/telemetry/endpoints.js
index cc3c838178..e1ad3a3454 100644
--- a/packages/dd-trace/src/telemetry/endpoints.js
+++ b/packages/dd-trace/src/telemetry/endpoints.js
@@ -11,7 +11,10 @@ const { sendData } = require('./send-data')
  */
 /**
  * @typedef {import('./send-data').TelemetryConfig & {
- *   appsec?: { apiSecurity?: { endpointCollectionEnabled?: boolean, endpointCollectionMessageLimit?: number } }
+ *   appsec: {
+ *     DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: boolean,
+ *     DD_API_SECURITY_ENDPOINT_COLLECTION_MESSAGE_LIMIT: number
+ *   }
  * }} TelemetryConfig
  */
 
@@ -142,8 +145,7 @@ function flushAndSend () {
   for (const [key, endpoint] of pendingEndpoints) {
     batchEndpoints.push(endpoint)
     pendingEndpoints.delete(key)
-    // Config is set when endpoint collection is enabled; message limit is optional
-    if (batchEndpoints.length >= (config.appsec?.apiSecurity?.endpointCollectionMessageLimit ?? 0)) break
+    if (batchEndpoints.length >= config.appsec.DD_API_SECURITY_ENDPOINT_COLLECTION_MESSAGE_LIMIT) break
   }
 
   const payloadObj = {
@@ -184,7 +186,7 @@ function flushAndSend () {
  * @param {import('./send-data').SendDataCallback} updateRetryDataFunction
  */
 function start (_config, _application, _host, getRetryDataFunction, updateRetryDataFunction) {
-  if (!_config.appsec?.apiSecurity?.endpointCollectionEnabled) return
+  if (!_config.appsec.DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED) return
 
   config = _config
   application = _application
diff --git a/packages/dd-trace/src/telemetry/index.js b/packages/dd-trace/src/telemetry/index.js
index 43e884b026..bc277ddafb 100644
--- a/packages/dd-trace/src/telemetry/index.js
+++ b/packages/dd-trace/src/telemetry/index.js
@@ -5,14 +5,14 @@ let telemetry
 // Lazy load the telemetry module to avoid the performance impact of loading it unconditionally
 module.exports = {
   start (config, ...args) {
-    if (!config.telemetry.enabled) return
+    if (!config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED) return
     telemetry ??= require('./telemetry')
     telemetry.start(config, ...args)
   },
   // This might be called before `start` so we have to trigger loading the
   // underlying module here as well.
   updateConfig (changes, config, ...args) {
-    if (!config.telemetry.enabled) return
+    if (!config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED) return
     telemetry ??= require('./telemetry')
     telemetry.updateConfig(changes, config, ...args)
   },
diff --git a/packages/dd-trace/src/telemetry/logs/index.js b/packages/dd-trace/src/telemetry/logs/index.js
index 8b37070108..1266289008 100644
--- a/packages/dd-trace/src/telemetry/logs/index.js
+++ b/packages/dd-trace/src/telemetry/logs/index.js
@@ -55,7 +55,7 @@ function onErrorLog (msg) {
 }
 
 function start (config) {
-  if (!config.telemetry.logCollection || enabled) return
+  if (!config.telemetry.DD_TELEMETRY_LOG_COLLECTION_ENABLED || enabled) return
 
   enabled = true
 
diff --git a/packages/dd-trace/src/telemetry/send-data.js b/packages/dd-trace/src/telemetry/send-data.js
index f1ab6d61e9..28a2d019f8 100644
--- a/packages/dd-trace/src/telemetry/send-data.js
+++ b/packages/dd-trace/src/telemetry/send-data.js
@@ -87,12 +87,12 @@ function getHeaders (config, application, reqType) {
   if (config.DD_ROOT_JS_SESSION_ID) {
     headers['dd-root-session-id'] = config.DD_ROOT_JS_SESSION_ID
   }
-  const debug = config.telemetry && config.telemetry.debug
+  const debug = config.telemetry && config.telemetry.DD_TELEMETRY_DEBUG
   if (debug) {
     headers['dd-telemetry-debug-enabled'] = 'true'
   }
-  if (config.apiKey) {
-    headers['dd-api-key'] = config.apiKey
+  if (config.DD_API_KEY) {
+    headers['dd-api-key'] = config.DD_API_KEY
   }
   return headers
 }
@@ -137,16 +137,16 @@ function sendData (config, application, host, reqType, payload = {}, cb = () =>
     hostname,
     port,
     isCiVisibility,
-    DD_CIVISIBILITY_AGENTLESS_ENABLED,
+    testOptimization,
   } = config
 
   let url = config.url
 
-  const isCiVisibilityAgentlessMode = isCiVisibility && DD_CIVISIBILITY_AGENTLESS_ENABLED
+  const isCiVisibilityAgentlessMode = isCiVisibility && testOptimization.DD_CIVISIBILITY_AGENTLESS_ENABLED
 
   if (isCiVisibilityAgentlessMode) {
     try {
-      url = config.DD_CIVISIBILITY_AGENTLESS_URL ?? new URL(getAgentlessTelemetryEndpoint(config.site))
+      url = testOptimization.DD_CIVISIBILITY_AGENTLESS_URL ?? new URL(getAgentlessTelemetryEndpoint(config.site))
     } catch (err) {
       log.error('Telemetry endpoint url is invalid', err)
       // No point to do the request if the URL is invalid
@@ -176,7 +176,7 @@ function sendData (config, application, host, reqType, payload = {}, cb = () =>
   })
 
   request(data, options, (error) => {
-    if (error && config.apiKey && config.site) {
+    if (error && config.DD_API_KEY && config.site) {
       if (agentTelemetry) {
         log.warn('Agent telemetry failed, started agentless telemetry')
         agentTelemetry = false
@@ -189,7 +189,7 @@ function sendData (config, application, host, reqType, payload = {}, cb = () =>
         log.error('Invalid Telemetry URL')
         return
       }
-      const backendHeader = { ...options.headers, 'DD-API-KEY': config.apiKey }
+      const backendHeader = { ...options.headers, 'DD-API-KEY': config.DD_API_KEY }
       const backendOptions = {
         ...options,
         url: backendUrl,
diff --git a/packages/dd-trace/src/telemetry/session-propagation.js b/packages/dd-trace/src/telemetry/session-propagation.js
index 7f191f02d7..528f36dec4 100644
--- a/packages/dd-trace/src/telemetry/session-propagation.js
+++ b/packages/dd-trace/src/telemetry/session-propagation.js
@@ -40,7 +40,7 @@ function onChildProcessStart (context) {
 }
 
 function start (config) {
-  if (!config.telemetry?.enabled || subscribed) return
+  if (!config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED || subscribed) return
   subscribed = true
 
   runtimeId = config.DD_ROOT_JS_SESSION_ID || config.tags['runtime-id']
diff --git a/packages/dd-trace/src/telemetry/telemetry.js b/packages/dd-trace/src/telemetry/telemetry.js
index 06aa8500de..af6f5d37b7 100644
--- a/packages/dd-trace/src/telemetry/telemetry.js
+++ b/packages/dd-trace/src/telemetry/telemetry.js
@@ -154,7 +154,7 @@ function getProducts (config) {
     },
     profiler: {
       version: tracerVersion,
-      enabled: profilingEnabledToBoolean(config.profiling.enabled),
+      enabled: profilingEnabledToBoolean(config.profiling.DD_PROFILING_ENABLED),
     },
   }
 }
@@ -193,7 +193,7 @@ function appStarted (config) {
 }
 
 function appClosing () {
-  if (!config?.telemetry?.enabled) {
+  if (!config?.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED) {
     return
   }
   // Give chance to listeners to update metrics before shutting down.
@@ -244,7 +244,7 @@ function createHostObject () {
 }
 
 function getTelemetryData () {
-  return { config, application, host, heartbeatInterval: config?.telemetry.heartbeatInterval }
+  return { config, application, host, heartbeatInterval: config?.telemetry.DD_TELEMETRY_HEARTBEAT_INTERVAL }
 }
 
 /**
@@ -291,7 +291,7 @@ function heartbeat (config, application) {
 
     const { reqType, payload } = createPayload('app-heartbeat')
     sendData(config, application, host, reqType, payload, updateRetryData)
-  }, config.telemetry.heartbeatInterval).unref?.()
+  }, config.telemetry.DD_TELEMETRY_HEARTBEAT_INTERVAL).unref?.()
 }
 
 /** @param {import('../config/config-base')} config */
@@ -307,7 +307,7 @@ function extendedHeartbeat (config) {
       heartbeatFailedDependencies = []
     }
     sendData(config, application, host, 'app-extended-heartbeat', appPayload)
-  }, config.telemetry.extendedHeartbeatInterval).unref?.()
+  }, config.telemetry.DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL).unref?.()
 }
 
 /**
@@ -315,8 +315,8 @@ function extendedHeartbeat (config) {
  * @param {PluginManager} thePluginManager
  */
 function start (aConfig, thePluginManager) {
-  if (!aConfig.telemetry.enabled) {
-    if (aConfig.appsec.sca.enabled) {
+  if (!aConfig.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED) {
+    if (aConfig.appsec.DD_APPSEC_SCA_ENABLED) {
       logger.warn('DD_APPSEC_SCA_ENABLED requires enabling telemetry to work.')
     }
 
@@ -347,7 +347,7 @@ function start (aConfig, thePluginManager) {
 }
 
 function updateIntegrations () {
-  if (!config?.telemetry.enabled) {
+  if (!config?.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED) {
     return
   }
   const integrations = getIntegrations()
@@ -367,7 +367,7 @@ let latestConfiguration = []
  * @param {import('../config/config-base')} config
  */
 function updateConfig (configuration, config) {
-  if (!config.telemetry.enabled) return
+  if (!config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED) return
 
   logger.trace(configuration)
 
diff --git a/packages/dd-trace/test/aiguard/index.spec.js b/packages/dd-trace/test/aiguard/index.spec.js
index d2dfaa5061..797c095592 100644
--- a/packages/dd-trace/test/aiguard/index.spec.js
+++ b/packages/dd-trace/test/aiguard/index.spec.js
@@ -33,7 +33,7 @@ describe('AIGuard SDK', () => {
     flushInterval: 0,
     service: 'ai_guard_demo',
     env: 'test',
-    apiKey: 'API_KEY',
+    DD_API_KEY: 'API_KEY',
     DD_APP_KEY: 'APP_KEY',
     protocolVersion: '0.4',
     experimental: {
@@ -124,7 +124,7 @@ describe('AIGuard SDK', () => {
         headers: {
           'Content-Type': 'application/json',
           'Content-Length': Buffer.byteLength(postData),
-          'DD-API-KEY': config.apiKey,
+          'DD-API-KEY': config.DD_API_KEY,
           'DD-APPLICATION-KEY': config.DD_APP_KEY,
           'DD-AI-GUARD-VERSION': tracerVersion,
           'DD-AI-GUARD-SOURCE': 'SDK',
diff --git a/packages/dd-trace/test/appsec/api_security/sampler.spec.js b/packages/dd-trace/test/appsec/api_security/sampler.spec.js
index 79272f998b..6392cbd790 100644
--- a/packages/dd-trace/test/appsec/api_security/sampler.spec.js
+++ b/packages/dd-trace/test/appsec/api_security/sampler.spec.js
@@ -81,7 +81,7 @@ describe('API Security Sampler', () => {
 
   describe('with TTLCache', () => {
     beforeEach(() => {
-      apiSecuritySampler.configure({ appsec: { apiSecurity: { enabled: true, sampleDelay: 30 } } })
+      apiSecuritySampler.configure({ appsec: { DD_API_SECURITY_ENABLED: true, DD_API_SECURITY_SAMPLE_DELAY: 30 } })
     })
 
     it('should not sample before 30 seconds', () => {
@@ -157,7 +157,7 @@ describe('API Security Sampler', () => {
 
   describe('with NoopTTLCache', () => {
     beforeEach(() => {
-      apiSecuritySampler.configure({ appsec: { apiSecurity: { enabled: true, sampleDelay: 0 } } })
+      apiSecuritySampler.configure({ appsec: { DD_API_SECURITY_ENABLED: true, DD_API_SECURITY_SAMPLE_DELAY: 0 } })
     })
 
     it('should always return SAMPLE for sampleRequest', () => {
@@ -203,7 +203,7 @@ describe('API Security Sampler', () => {
 
   describe('MISSING_ROUTE decision', () => {
     beforeEach(() => {
-      apiSecuritySampler.configure({ appsec: { apiSecurity: { enabled: true, sampleDelay: 30 } } })
+      apiSecuritySampler.configure({ appsec: { DD_API_SECURITY_ENABLED: true, DD_API_SECURITY_SAMPLE_DELAY: 30 } })
     })
 
     it('returns MISSING_ROUTE when there is no route and status is not 404 and response is not blocked', () => {
@@ -258,10 +258,8 @@ describe('API Security Sampler', () => {
       SamplingDecision = apiSecuritySampler.SamplingDecision
       apiSecuritySampler.configure({
         appsec: {
-          apiSecurity: {
-            enabled: true,
-            sampleDelay: 30,
-          },
+          DD_API_SECURITY_ENABLED: true,
+          DD_API_SECURITY_SAMPLE_DELAY: 30,
         },
         apmTracingEnabled: false,
       })
@@ -283,7 +281,7 @@ describe('API Security Sampler', () => {
 
   describe('http.endpoint fallback', () => {
     beforeEach(() => {
-      apiSecuritySampler.configure({ appsec: { apiSecurity: { enabled: true, sampleDelay: 30 } } })
+      apiSecuritySampler.configure({ appsec: { DD_API_SECURITY_ENABLED: true, DD_API_SECURITY_SAMPLE_DELAY: 30 } })
     })
 
     function makeSpan (tags) {
diff --git a/packages/dd-trace/test/appsec/downstream_requests.spec.js b/packages/dd-trace/test/appsec/downstream_requests.spec.js
index 1bc8446d30..26f3707426 100644
--- a/packages/dd-trace/test/appsec/downstream_requests.spec.js
+++ b/packages/dd-trace/test/appsec/downstream_requests.spec.js
@@ -16,12 +16,10 @@ describe('appsec downstream_requests', () => {
   beforeEach(() => {
     config = {
       appsec: {
-        apiSecurity: {
-          enabled: true,
-          downstreamBodyAnalysisSampleRate: 1,
-          maxDownstreamRequestBodyAnalysis: 1,
-          maxDownstreamBodyBytes: 1024,
-        },
+        DD_API_SECURITY_ENABLED: true,
+        DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE: 1,
+        DD_API_SECURITY_MAX_DOWNSTREAM_REQUEST_BODY_ANALYSIS: 1,
+        DD_API_SECURITY_MAX_DOWNSTREAM_BODY_BYTES: 1024,
       },
     }
 
@@ -38,7 +36,7 @@ describe('appsec downstream_requests', () => {
   describe('apiSecurity downstream body analysis sample rate', () => {
     it('logs warning and clamps value when sample rate is above 1', () => {
       downstream.disable()
-      config.appsec.apiSecurity.downstreamBodyAnalysisSampleRate = 1.5
+      config.appsec.DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE = 1.5
       downstream.enable(config)
 
       sinon.assert.calledOnce(logWarnStub)
@@ -51,7 +49,7 @@ describe('appsec downstream_requests', () => {
 
     it('logs warning and clamps value when sample rate is below 0', () => {
       downstream.disable()
-      config.appsec.apiSecurity.downstreamBodyAnalysisSampleRate = -0.5
+      config.appsec.DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE = -0.5
       downstream.enable(config)
 
       sinon.assert.calledOnce(logWarnStub)
@@ -64,7 +62,7 @@ describe('appsec downstream_requests', () => {
 
     it('does not log warning when sample rate is within valid range', () => {
       downstream.disable()
-      config.appsec.apiSecurity.downstreamBodyAnalysisSampleRate = 0.5
+      config.appsec.DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE = 0.5
       downstream.enable(config)
 
       const validRes = {
@@ -180,7 +178,7 @@ describe('appsec downstream_requests', () => {
 
     it('does not plan body collection when sample rate is zero', () => {
       downstream.disable()
-      config.appsec.apiSecurity.downstreamBodyAnalysisSampleRate = 0
+      config.appsec.DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE = 0
       downstream.enable(config)
 
       const inboundReq = {}
@@ -494,8 +492,8 @@ describe('appsec downstream_requests', () => {
 
     it('collects body on every hop at sample rate 1.0 (100%)', () => {
       downstream.disable()
-      config.appsec.apiSecurity.downstreamBodyAnalysisSampleRate = 1.0
-      config.appsec.apiSecurity.maxDownstreamRequestBodyAnalysis = 100
+      config.appsec.DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE = 1.0
+      config.appsec.DD_API_SECURITY_MAX_DOWNSTREAM_REQUEST_BODY_ANALYSIS = 100
       downstream.enable(config)
 
       for (let i = 0; i < 10; i++) {
@@ -508,8 +506,8 @@ describe('appsec downstream_requests', () => {
 
     it('never collects at sample rate 0.0 (0%)', () => {
       downstream.disable()
-      config.appsec.apiSecurity.downstreamBodyAnalysisSampleRate = 0.0
-      config.appsec.apiSecurity.maxDownstreamRequestBodyAnalysis = 100
+      config.appsec.DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE = 0.0
+      config.appsec.DD_API_SECURITY_MAX_DOWNSTREAM_REQUEST_BODY_ANALYSIS = 100
       downstream.enable(config)
 
       for (let i = 0; i < 10; i++) {
@@ -522,8 +520,8 @@ describe('appsec downstream_requests', () => {
 
     it('produces some collects and some skips with rate 0.5', () => {
       downstream.disable()
-      config.appsec.apiSecurity.downstreamBodyAnalysisSampleRate = 0.5
-      config.appsec.apiSecurity.maxDownstreamRequestBodyAnalysis = 1000
+      config.appsec.DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE = 0.5
+      config.appsec.DD_API_SECURITY_MAX_DOWNSTREAM_REQUEST_BODY_ANALYSIS = 1000
       downstream.enable(config)
 
       const results = []
@@ -543,8 +541,8 @@ describe('appsec downstream_requests', () => {
 
     it('tracks per-request body analysis count independently', () => {
       downstream.disable()
-      config.appsec.apiSecurity.downstreamBodyAnalysisSampleRate = 1.0
-      config.appsec.apiSecurity.maxDownstreamRequestBodyAnalysis = 2
+      config.appsec.DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE = 1.0
+      config.appsec.DD_API_SECURITY_MAX_DOWNSTREAM_REQUEST_BODY_ANALYSIS = 2
       downstream.enable(config)
 
       const req1 = {}
@@ -573,8 +571,8 @@ describe('appsec downstream_requests', () => {
 
     it('increments counter only after successful header-based collection plan', () => {
       downstream.disable()
-      config.appsec.apiSecurity.downstreamBodyAnalysisSampleRate = 1.0
-      config.appsec.apiSecurity.maxDownstreamRequestBodyAnalysis = 3
+      config.appsec.DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE = 1.0
+      config.appsec.DD_API_SECURITY_MAX_DOWNSTREAM_REQUEST_BODY_ANALYSIS = 3
       downstream.enable(config)
 
       const testReq = {}
diff --git a/packages/dd-trace/test/appsec/graphql.spec.js b/packages/dd-trace/test/appsec/graphql.spec.js
index a9ef1fe318..0b417a5e9f 100644
--- a/packages/dd-trace/test/appsec/graphql.spec.js
+++ b/packages/dd-trace/test/appsec/graphql.spec.js
@@ -12,7 +12,7 @@ const { withRequest } = require('../../src/appsec/store')
 const waf = require('../../src/appsec/waf')
 const web = require('../../src/plugins/util/web')
 const {
-  startGraphqlResolve,
+  startGraphqlResolver,
   graphqlMiddlewareChannel,
   apolloChannel,
   apolloServerCoreChannel,
@@ -64,7 +64,7 @@ describe('GraphQL', () => {
       assert.strictEqual(apolloChannel.asyncEnd.hasSubscribers, false)
       assert.strictEqual(apolloServerCoreChannel.start.hasSubscribers, false)
       assert.strictEqual(apolloServerCoreChannel.asyncEnd.hasSubscribers, false)
-      assert.strictEqual(startGraphqlResolve.hasSubscribers, false)
+      assert.strictEqual(startGraphqlResolver.hasSubscribers, false)
 
       graphql.enable()
 
@@ -73,7 +73,7 @@ describe('GraphQL', () => {
       assert.strictEqual(apolloChannel.asyncEnd.hasSubscribers, true)
       assert.strictEqual(apolloServerCoreChannel.start.hasSubscribers, true)
       assert.strictEqual(apolloServerCoreChannel.asyncEnd.hasSubscribers, true)
-      assert.strictEqual(startGraphqlResolve.hasSubscribers, true)
+      assert.strictEqual(startGraphqlResolver.hasSubscribers, true)
     })
   })
 
@@ -86,7 +86,7 @@ describe('GraphQL', () => {
       assert.strictEqual(apolloChannel.asyncEnd.hasSubscribers, true)
       assert.strictEqual(apolloServerCoreChannel.start.hasSubscribers, true)
       assert.strictEqual(apolloServerCoreChannel.asyncEnd.hasSubscribers, true)
-      assert.strictEqual(startGraphqlResolve.hasSubscribers, true)
+      assert.strictEqual(startGraphqlResolver.hasSubscribers, true)
 
       graphql.disable()
 
@@ -95,7 +95,7 @@ describe('GraphQL', () => {
       assert.strictEqual(apolloChannel.asyncEnd.hasSubscribers, false)
       assert.strictEqual(apolloServerCoreChannel.start.hasSubscribers, false)
       assert.strictEqual(apolloServerCoreChannel.asyncEnd.hasSubscribers, false)
-      assert.strictEqual(startGraphqlResolve.hasSubscribers, false)
+      assert.strictEqual(startGraphqlResolver.hasSubscribers, false)
     })
   })
 
@@ -113,46 +113,35 @@ describe('GraphQL', () => {
     })
 
     it('Should not call waf if resolvers is undefined', () => {
-      const context = {
-        resolver: undefined,
-      }
-
-      startGraphqlResolve.publish({ context })
+      startGraphqlResolver.publish({ resolverInfo: undefined })
 
       sinon.assert.notCalled(waf.run)
     })
 
     it('Should not call waf if resolvers is not an object', () => {
-      const context = {
-        resolver: '',
-      }
-
-      startGraphqlResolve.publish({ context })
+      startGraphqlResolver.publish({ resolverInfo: '' })
 
       sinon.assert.notCalled(waf.run)
     })
 
     it('Should not call waf if req is unavailable', () => {
-      const context = {}
       const resolverInfo = {
         user: [{ id: '1234' }],
       }
 
       storage('legacy').getStore.returns({})
 
-      startGraphqlResolve.publish({ context, resolverInfo })
+      startGraphqlResolver.publish({ resolverInfo })
 
       sinon.assert.notCalled(waf.run)
     })
 
     it('Should call waf if resolvers is well formatted', () => {
-      const context = {}
-
       const resolverInfo = {
         user: [{ id: '1234' }],
       }
 
-      startGraphqlResolve.publish({ context, resolverInfo })
+      startGraphqlResolver.publish({ resolverInfo })
 
       sinon.assert.calledOnceWithExactly(waf.run, {
         ephemeral: {
@@ -200,7 +189,7 @@ describe('GraphQL', () => {
 
       sinon.stub(waf, 'run').returns([''])
 
-      startGraphqlResolve.publish({ context, resolverInfo })
+      startGraphqlResolver.publish({ abortController, resolverInfo })
 
       sinon.assert.calledOnceWithExactly(waf.run, {
         ephemeral: {
@@ -226,7 +215,7 @@ describe('GraphQL', () => {
 
       sinon.stub(web, 'root').returns(rootSpan)
 
-      startGraphqlResolve.publish({ context, resolverInfo })
+      startGraphqlResolver.publish({ abortController, resolverInfo })
 
       sinon.assert.calledOnceWithExactly(waf.run, {
         ephemeral: {
@@ -258,7 +247,7 @@ describe('GraphQL', () => {
 
       sinon.stub(web, 'root').returns(rootSpan)
 
-      startGraphqlResolve.publish({ context, resolverInfo })
+      startGraphqlResolver.publish({ abortController, resolverInfo })
 
       sinon.assert.calledOnceWithExactly(waf.run, {
         ephemeral: {
diff --git a/packages/dd-trace/test/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.mongoose.plugin.spec.js b/packages/dd-trace/test/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.mongoose.plugin.spec.js
index c6aca3e971..c5754e08bc 100644
--- a/packages/dd-trace/test/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.mongoose.plugin.spec.js
+++ b/packages/dd-trace/test/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.mongoose.plugin.spec.js
@@ -8,14 +8,9 @@ const semver = require('semver')
 const { prepareTestServerForIastInExpress } = require('../utils')
 const agent = require('../../../plugins/agent')
 const { withVersions } = require('../../../setup/mocha')
-const { NODE_MAJOR } = require('../../../../../../version')
 
 describe('nosql injection detection in mongodb - whole feature', () => {
-  withVersions('mongoose', 'express', (expressVersion, _moduleName, resolvedExpressVersion) => {
-    // Node 20 + Express 5 loses IAST taint on the per-request `req.query` getter;
-    // passes on Node 18 and Node 24. See APPSEC-66705.
-    if (NODE_MAJOR === 20 && semver.major(resolvedExpressVersion) >= 5) return
-
+  withVersions('mongoose', 'express', expressVersion => {
     withVersions('mongoose', 'mongoose', '>4.0.0', mongooseVersion => {
       const specificMongooseVersion = require(`../../../../../../versions/mongoose@${mongooseVersion}`).version()
 
diff --git a/packages/dd-trace/test/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.mquery.plugin.spec.js b/packages/dd-trace/test/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.mquery.plugin.spec.js
index db9d1aa22b..40c2f93e70 100644
--- a/packages/dd-trace/test/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.mquery.plugin.spec.js
+++ b/packages/dd-trace/test/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.mquery.plugin.spec.js
@@ -7,17 +7,27 @@ const path = require('node:path')
 
 const axios = require('axios')
 const { after, before, describe } = require('mocha')
+const satisfies = require('semifies')
 
 const agent = require('../../../plugins/agent')
 const { withVersions } = require('../../../setup/mocha')
 const { prepareTestServerForIastInExpress } = require('../utils')
+const { NODE_MAJOR } = require('../../../../../../version')
 
-// TODO(APPSEC-62431): re-enable once duplicate NOSQL_MONGODB_INJECTION
-// detection (N+1 !== N) is fixed
-describe.skip('nosql injection detection with mquery', () => {
+describe('nosql injection detection with mquery', () => {
   // https://github.com/fiznool/express-mongo-sanitize/issues/200
   withVersions('mquery', 'express', '>4.18.0 <5.0.0', expressVersion => {
     withVersions('mquery', 'mongodb', mongodbVersion => {
+      const mongodb = require(`../../../../../../versions/mongodb@${mongodbVersion}`)
+
+      // TODO: remove once Node.js 18 is no longer supported
+      if (satisfies(mongodb.version(), '>=7') && NODE_MAJOR < 20) {
+        describe.skip(
+          `Skipping the tests as mongodb@${mongodb.version()} requires Node.js >= 20 (current: ${NODE_MAJOR})`
+        )
+        return
+      }
+
       const vulnerableMethodFilename = 'mquery-vulnerable-method.js'
       let client, testCollection, tmpFilePath, dbName
 
@@ -28,7 +38,7 @@ describe.skip('nosql injection detection with mquery', () => {
       before(async () => {
         const id = require('../../../../src/id')
         dbName = id().toString()
-        const mongo = require(`../../../../../../versions/mongodb@${mongodbVersion}`).get()
+        const mongo = mongodb.get()
 
         client = new mongo.MongoClient(`mongodb://localhost:27017/${dbName}`)
         await client.connect()
diff --git a/packages/dd-trace/test/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.spec.js b/packages/dd-trace/test/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.spec.js
index ec84c4d4e4..1119fa4bc9 100644
--- a/packages/dd-trace/test/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.spec.js
+++ b/packages/dd-trace/test/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.spec.js
@@ -4,7 +4,9 @@ const assert = require('node:assert/strict')
 
 const { afterEach, before, beforeEach, describe, it } = require('mocha')
 const proxyquire = require('proxyquire')
+const sinon = require('sinon')
 
+const { storage } = require('../../../../../datadog-core')
 const { channel } = require('../../../../../datadog-instrumentations/src/helpers/instrument')
 const {
   createTransaction,
@@ -12,6 +14,7 @@ const {
   removeTransaction,
   getRanges,
 } = require('../../../../src/appsec/iast/taint-tracking/operations')
+const { IAST_CONTEXT_KEY } = require('../../../../src/appsec/iast/iast-context')
 const { NOSQL_MONGODB_INJECTION_MARK } = require('../../../../src/appsec/iast/taint-tracking/secure-marks')
 
 const sanitizeMiddlewareFinished = channel('datadog:express-mongo-sanitize:filter:finish')
@@ -127,4 +130,108 @@ describe('nosql injection detection in mongodb', () => {
       })
     })
   })
+
+  describe('per-query analysis scoping', () => {
+    const legacyStorage = storage('legacy')
+    const nosqlAnalyzer = require('../../../../src/appsec/iast/analyzers/nosql-injection-mongodb-analyzer')
+    const mongooseFilterStart = channel('datadog:mongoose:model:filter:start')
+    const mongooseFilterExec = channel('datadog:mongoose:model:filter:exec')
+    const mongodbFilterStart = channel('datadog:mongodb:collection:filter:start')
+
+    let analyze
+
+    // Drive an outer mongoose query the way the instrumentation does: the filters
+    // are analyzed at the synchronous build (`model:filter:start`), then the query
+    // executes inside `model:filter:exec`'s `runStores`, which enters the marked
+    // store the analyzer's bound transform returns. The nested mongodb driver start
+    // fires a turn later, from inside that execution scope, mirroring mongoose
+    // deferring to the driver after the build has returned. `model:filter:start`
+    // uses `runStores` to match the instrumentation: that is what makes the build
+    // analysis run, so a marker missing at execution time surfaces as a second
+    // analysis on the deferred driver call.
+    function runMongooseQuery (store, filter) {
+      return new Promise((resolve, reject) => {
+        legacyStorage.run(store, () => {
+          mongooseFilterStart.runStores({ filters: [filter] }, () => {})
+
+          mongooseFilterExec.runStores({ filters: [filter] }, () => {
+            setImmediate(() => {
+              try {
+                mongodbFilterStart.publish({ filters: [filter] })
+                resolve()
+              } catch (error) {
+                reject(error)
+              }
+            })
+          })
+        })
+      })
+    }
+
+    beforeEach(() => {
+      nosqlAnalyzer.configure({ enabled: true })
+      analyze = sinon.spy(nosqlAnalyzer, 'analyze')
+    })
+
+    afterEach(() => {
+      analyze.restore()
+      nosqlAnalyzer.configure({ enabled: false })
+    })
+
+    it('analyzes an outer query once and skips its deferred driver call', async () => {
+      const store = { [IAST_CONTEXT_KEY]: {} }
+
+      await runMongooseQuery(store, { name: 'value' })
+
+      assert.strictEqual(analyze.callCount, 1)
+    })
+
+    it('analyzes a direct mongodb driver query with no outer mongoose layer', () => {
+      const store = { [IAST_CONTEXT_KEY]: {} }
+
+      legacyStorage.run(store, () => {
+        mongodbFilterStart.publish({ filters: [{ name: 'value' }] })
+      })
+
+      assert.strictEqual(analyze.callCount, 1)
+    })
+
+    it('does not analyze when there is no IAST context in the store', async () => {
+      await runMongooseQuery({}, { name: 'value' })
+
+      assert.strictEqual(analyze.callCount, 0)
+    })
+
+    it('skips a query whose store is already marked as analyzed', async () => {
+      const store = { [IAST_CONTEXT_KEY]: {}, nosqlAnalyzed: true }
+
+      await runMongooseQuery(store, { name: 'value' })
+
+      assert.strictEqual(analyze.callCount, 0)
+    })
+
+    it('analyzes both of two concurrent queries in the same request', async () => {
+      // Two queries of the same request run concurrently: each execution scope
+      // branches from the shared request store, not from the sibling's child
+      // store, so neither query's marker suppresses the other. Both outer filters
+      // are analyzed and each deferred driver call is skipped.
+      const requestStore = { [IAST_CONTEXT_KEY]: {} }
+      const filterA = { name: 'a' }
+      const filterB = { name: 'b' }
+
+      await new Promise((resolve, reject) => {
+        legacyStorage.run(requestStore, () => {
+          Promise.all([
+            runMongooseQuery(requestStore, filterA),
+            runMongooseQuery(requestStore, filterB),
+          ]).then(resolve, reject)
+        })
+      })
+
+      assert.strictEqual(analyze.callCount, 2)
+      const analyzedFilters = new Set(analyze.args.map(([value]) => value.filter))
+      assert.ok(analyzedFilters.has(filterA), 'query A filter analyzed')
+      assert.ok(analyzedFilters.has(filterB), 'query B filter analyzed')
+    })
+  })
 })
diff --git a/packages/dd-trace/test/appsec/iast/security-controls/index.spec.js b/packages/dd-trace/test/appsec/iast/security-controls/index.spec.js
index 8fa1161cc3..6752e0aba3 100644
--- a/packages/dd-trace/test/appsec/iast/security-controls/index.spec.js
+++ b/packages/dd-trace/test/appsec/iast/security-controls/index.spec.js
@@ -53,7 +53,7 @@ describe('IAST Security Controls', () => {
       controls.set('sanitizer.js', {})
 
       const securityControlsConfiguration = 'SANITIZER:CODE_INJECTION:sanitizer.js:sanitize'
-      securityControls.configure({ securityControlsConfiguration })
+      securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: securityControlsConfiguration })
 
       sinon.assert.calledWithExactly(parse, securityControlsConfiguration)
 
@@ -63,7 +63,7 @@ describe('IAST Security Controls', () => {
 
     it('should call parse and not subscribe to moduleLoad channels', () => {
       const securityControlsConfiguration = 'invalid_config'
-      securityControls.configure({ securityControlsConfiguration })
+      securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: securityControlsConfiguration })
 
       sinon.assert.calledWithExactly(parse, securityControlsConfiguration)
 
@@ -114,7 +114,7 @@ describe('IAST Security Controls', () => {
       // eslint-disable-next-line no-multi-str
       const conf = 'INPUT_VALIDATOR:COMMAND_INJECTION:packages/dd-trace/test/appsec/iast\
 /security-controls/resources/custom_input_validator.js:validate'
-      securityControls.configure({ securityControlsConfiguration: conf })
+      securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: conf })
 
       requireAndPublish('./resources/custom_input_validator')
 
@@ -129,7 +129,7 @@ describe('IAST Security Controls', () => {
         // eslint-disable-next-line no-multi-str
         const conf = 'INPUT_VALIDATOR:COMMAND_INJECTION:packages/dd-trace/test/appsec/iast\
 /security-controls/resources/custom_input_validator.js:validate'
-        securityControls.configure({ securityControlsConfiguration: conf })
+        securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: conf })
 
         const { validate } = requireAndPublish('./resources/custom_input_validator')
         validate('input')
@@ -141,7 +141,7 @@ describe('IAST Security Controls', () => {
         // eslint-disable-next-line no-multi-str
         const conf = 'SANITIZER:COMMAND_INJECTION:packages/dd-trace/test/appsec/iast\
 /security-controls/resources/sanitizer_default.js'
-        securityControls.configure({ securityControlsConfiguration: conf })
+        securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: conf })
 
         const sanitize = requireAndPublish('./resources/sanitizer_default')
         const result = sanitize('input')
@@ -156,7 +156,7 @@ describe('IAST Security Controls', () => {
 /security-controls/resources/custom_input_validator.js:validate;INPUT_VALIDATOR:\
 COMMAND_INJECTION:packages/dd-trace/test/appsec/iast/security-controls/resources\
 /custom_input_validator.js:validateObject'
-        securityControls.configure({ securityControlsConfiguration: conf })
+        securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: conf })
 
         const { validate, validateObject } = requireAndPublish('./resources/custom_input_validator')
         let result = validate('input')
@@ -174,7 +174,7 @@ COMMAND_INJECTION:packages/dd-trace/test/appsec/iast/security-controls/resources
         // eslint-disable-next-line no-multi-str
         const conf = 'INPUT_VALIDATOR:COMMAND_INJECTION:packages/dd-trace/test/appsec/iast\
 /security-controls/resources/custom_input_validator.js:validate'
-        securityControls.configure({ securityControlsConfiguration: conf })
+        securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: conf })
 
         const { validate } = requireAndPublish('./resources/custom_input_validator')
         validate('input1', 'input2')
@@ -188,7 +188,7 @@ COMMAND_INJECTION:packages/dd-trace/test/appsec/iast/security-controls/resources
         // eslint-disable-next-line no-multi-str
         const conf = 'INPUT_VALIDATOR:COMMAND_INJECTION:packages/dd-trace/test/appsec/iast\
 /security-controls/resources/custom_input_validator.js:validate:1'
-        securityControls.configure({ securityControlsConfiguration: conf })
+        securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: conf })
 
         const { validate } = requireAndPublish('./resources/custom_input_validator')
         validate('input1', 'input2')
@@ -200,7 +200,7 @@ COMMAND_INJECTION:packages/dd-trace/test/appsec/iast/security-controls/resources
         // eslint-disable-next-line no-multi-str
         const conf = 'INPUT_VALIDATOR:COMMAND_INJECTION:packages/dd-trace/test/appsec/iast\
 /security-controls/resources/custom_input_validator.js:validate:1,3'
-        securityControls.configure({ securityControlsConfiguration: conf })
+        securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: conf })
 
         const { validate } = requireAndPublish('./resources/custom_input_validator')
         validate('input1', 'input2', 'input3', 'input4')
@@ -214,7 +214,7 @@ COMMAND_INJECTION:packages/dd-trace/test/appsec/iast/security-controls/resources
         // eslint-disable-next-line no-multi-str
         const conf = 'INPUT_VALIDATOR:COMMAND_INJECTION:packages/dd-trace/test/appsec/iast\
 /security-controls/resources/custom_input_validator.js:validate:42'
-        securityControls.configure({ securityControlsConfiguration: conf })
+        securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: conf })
 
         const { validate } = requireAndPublish('./resources/custom_input_validator')
         validate('input1')
@@ -226,7 +226,7 @@ COMMAND_INJECTION:packages/dd-trace/test/appsec/iast/security-controls/resources
         // eslint-disable-next-line no-multi-str
         const conf = 'SANITIZER:COMMAND_INJECTION:packages/dd-trace/test/appsec/iast\
 /security-controls/resources/sanitizer.js:sanitize'
-        securityControls.configure({ securityControlsConfiguration: conf })
+        securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: conf })
 
         const { sanitize } = requireAndPublish('./resources/sanitizer')
         const result = sanitize('input')
@@ -240,7 +240,7 @@ COMMAND_INJECTION:packages/dd-trace/test/appsec/iast/security-controls/resources
         // eslint-disable-next-line no-multi-str
         const conf = 'INPUT_VALIDATOR:COMMAND_INJECTION:packages/dd-trace/test/appsec/iast\
 /security-controls/resources/custom_input_validator.js:validateObject'
-        securityControls.configure({ securityControlsConfiguration: conf })
+        securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: conf })
 
         const { validateObject } = requireAndPublish('./resources/custom_input_validator')
         const result = validateObject({ input1: 'input1', nested: { input: 'input2' } })
@@ -256,7 +256,7 @@ COMMAND_INJECTION:packages/dd-trace/test/appsec/iast/security-controls/resources
         // eslint-disable-next-line no-multi-str
         const conf = 'INPUT_VALIDATOR:COMMAND_INJECTION:packages/dd-trace/test/appsec/iast\
 /security-controls/resources/custom_input_validator.js:validateObject'
-        securityControls.configure({ securityControlsConfiguration: conf })
+        securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: conf })
 
         const { validateObject } = requireAndPublish('./resources/custom_input_validator')
         const result = validateObject({ input1: 'input1' }, 'input3')
@@ -272,7 +272,7 @@ COMMAND_INJECTION:packages/dd-trace/test/appsec/iast/security-controls/resources
         // eslint-disable-next-line no-multi-str
         const conf = 'SANITIZER:COMMAND_INJECTION:packages/dd-trace/test/appsec/iast\
 /security-controls/resources/sanitizer.js:sanitizeObject'
-        securityControls.configure({ securityControlsConfiguration: conf })
+        securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: conf })
 
         const { sanitizeObject } = requireAndPublish('./resources/sanitizer')
         const result = sanitizeObject({ output: 'output1', nested: { output: 'nested output' } })
@@ -290,7 +290,7 @@ COMMAND_INJECTION:packages/dd-trace/test/appsec/iast/security-controls/resources
         // eslint-disable-next-line no-multi-str
         const conf = 'SANITIZER:COMMAND_INJECTION:packages/dd-trace/test/appsec/iast\
 /security-controls/resources/sanitizer.js:nested.sanitize'
-        securityControls.configure({ securityControlsConfiguration: conf })
+        securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: conf })
 
         const { nested } = requireAndPublish('./resources/sanitizer')
         const result = nested.sanitize('input')
@@ -303,7 +303,7 @@ COMMAND_INJECTION:packages/dd-trace/test/appsec/iast/security-controls/resources
         // eslint-disable-next-line no-multi-str
         const conf = 'SANITIZER:COMMAND_INJECTION:packages/dd-trace/test/appsec/iast\
 /security-controls/resources/sanitizer.js:incorrect.sanitize'
-        securityControls.configure({ securityControlsConfiguration: conf })
+        securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: conf })
 
         const { nested } = requireAndPublish('./resources/sanitizer')
         const result = nested.sanitize('input')
@@ -316,7 +316,7 @@ COMMAND_INJECTION:packages/dd-trace/test/appsec/iast/security-controls/resources
         // eslint-disable-next-line no-multi-str
         const conf = 'SANITIZER:COMMAND_INJECTION:packages/dd-trace/test/appsec/iast\
 /security-controls/resources/sanitizer.js:nested.incorrect.sanitize'
-        securityControls.configure({ securityControlsConfiguration: conf })
+        securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: conf })
 
         const { nested } = requireAndPublish('./resources/sanitizer')
         const result = nested.sanitize('input')
@@ -329,7 +329,7 @@ COMMAND_INJECTION:packages/dd-trace/test/appsec/iast/security-controls/resources
     describe('in node_modules', () => {
       it('should hook node_module dependency', () => {
         const conf = 'SANITIZER:COMMAND_INJECTION:node_modules/sanitizer/index.js:sanitize'
-        securityControls.configure({ securityControlsConfiguration: conf })
+        securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: conf })
 
         const { sanitize } = requireAndPublish('./resources/node_modules/sanitizer')
         const result = sanitize('input')
@@ -340,7 +340,7 @@ COMMAND_INJECTION:packages/dd-trace/test/appsec/iast/security-controls/resources
 
       it('should hook transitive node_module dependency', () => {
         const conf = 'SANITIZER:COMMAND_INJECTION:node_modules/sanitizer/index.js:sanitize'
-        securityControls.configure({ securityControlsConfiguration: conf })
+        securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: conf })
 
         const { sanitize } = requireAndPublish('./resources/node_modules/anotherlib/node_modules/sanitizer')
         const result = sanitize('input')
@@ -351,7 +351,7 @@ COMMAND_INJECTION:packages/dd-trace/test/appsec/iast/security-controls/resources
 
       it('should not fail with not found node_module dep', () => {
         const conf = 'SANITIZER:COMMAND_INJECTION:node_modules/not_loaded_sanitizer/index.js:sanitize'
-        securityControls.configure({ securityControlsConfiguration: conf })
+        securityControls.configure({ DD_IAST_SECURITY_CONTROLS_CONFIGURATION: conf })
 
         const { sanitize } = requireAndPublish('./resources/node_modules/sanitizer')
         const result = sanitize('input')
diff --git a/packages/dd-trace/test/appsec/iast/taint-tracking/taint-tracking-operations.spec.js b/packages/dd-trace/test/appsec/iast/taint-tracking/taint-tracking-operations.spec.js
index e9abbc5720..5d00b4f3cf 100644
--- a/packages/dd-trace/test/appsec/iast/taint-tracking/taint-tracking-operations.spec.js
+++ b/packages/dd-trace/test/appsec/iast/taint-tracking/taint-tracking-operations.spec.js
@@ -255,7 +255,7 @@ describe('IAST TaintTracking Operations', () => {
         [taintTrackingOperations.IAST_TRANSACTION_ID]: 'id',
       }
       iastTelemetry.configure({
-        telemetry: { enabled: true, metrics: true },
+        telemetry: { DD_INSTRUMENTATION_TELEMETRY_ENABLED: true, DD_TELEMETRY_METRICS_ENABLED: true },
       }, 'INFORMATION')
 
       const requestTaintedInc = sinon.stub(REQUEST_TAINTED, 'inc')
diff --git a/packages/dd-trace/test/appsec/iast/telemetry/index.spec.js b/packages/dd-trace/test/appsec/iast/telemetry/index.spec.js
index b6429c179d..f8ae447ad6 100644
--- a/packages/dd-trace/test/appsec/iast/telemetry/index.spec.js
+++ b/packages/dd-trace/test/appsec/iast/telemetry/index.spec.js
@@ -25,8 +25,8 @@ describe('Telemetry', () => {
     beforeEach(() => {
       defaultConfig = {
         telemetry: {
-          enabled: true,
-          metrics: true,
+          DD_INSTRUMENTATION_TELEMETRY_ENABLED: true,
+          DD_TELEMETRY_METRICS_ENABLED: true,
         },
       }
 
@@ -66,7 +66,7 @@ describe('Telemetry', () => {
           '../../../telemetry/metrics': telemetryMetrics,
         })
 
-        const telemetryConfig = { enabled: true, metrics: true }
+        const telemetryConfig = { DD_INSTRUMENTATION_TELEMETRY_ENABLED: true, DD_TELEMETRY_METRICS_ENABLED: true }
         iastTelemetry.configure({
           telemetry: telemetryConfig,
         }, 'OFF')
@@ -77,7 +77,7 @@ describe('Telemetry', () => {
       })
 
       it('should enable telemetry if telemetry.metrics is true', () => {
-        const telemetryConfig = { enabled: true, metrics: true }
+        const telemetryConfig = { DD_INSTRUMENTATION_TELEMETRY_ENABLED: true, DD_TELEMETRY_METRICS_ENABLED: true }
         iastTelemetry.configure({
           telemetry: telemetryConfig,
         })
@@ -88,7 +88,7 @@ describe('Telemetry', () => {
       })
 
       it('should not enable telemetry if telemetry.metrics is false', () => {
-        const telemetryConfig = { enabled: true, metrics: false }
+        const telemetryConfig = { DD_INSTRUMENTATION_TELEMETRY_ENABLED: true, DD_TELEMETRY_METRICS_ENABLED: false }
         iastTelemetry.configure({
           telemetry: telemetryConfig,
         })
@@ -127,7 +127,7 @@ describe('Telemetry', () => {
           },
         })
         iastTelemetry.configure({
-          telemetry: { enabled: true },
+          telemetry: { DD_INSTRUMENTATION_TELEMETRY_ENABLED: true },
         })
 
         const iastContext = {}
@@ -155,7 +155,7 @@ describe('Telemetry', () => {
           },
         })
         iastTelemetry.configure({
-          telemetry: { enabled: true },
+          telemetry: { DD_INSTRUMENTATION_TELEMETRY_ENABLED: true },
         })
 
         const iastContext = {}
diff --git a/packages/dd-trace/test/appsec/iast/telemetry/logs.spec.js b/packages/dd-trace/test/appsec/iast/telemetry/logs.spec.js
index b8db6aa6da..1794a2c7a2 100644
--- a/packages/dd-trace/test/appsec/iast/telemetry/logs.spec.js
+++ b/packages/dd-trace/test/appsec/iast/telemetry/logs.spec.js
@@ -35,10 +35,14 @@ describe('Telemetry logs', () => {
     })
 
     const config = {
-      telemetry: { enabled: true, heartbeatInterval: 3000, logCollection: true },
+      telemetry: {
+        DD_INSTRUMENTATION_TELEMETRY_ENABLED: true,
+        DD_TELEMETRY_HEARTBEAT_INTERVAL: 3000,
+        DD_TELEMETRY_LOG_COLLECTION_ENABLED: true,
+      },
       version: '1.2.3-beta4',
-      appsec: { enabled: false },
-      profiling: { enabled: false },
+      appsec: { enabled: false, DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: false },
+      profiling: { DD_PROFILING_ENABLED: false },
       env: 'preprod',
       tags: {
         'runtime-id': '1a2b3c',
diff --git a/packages/dd-trace/test/appsec/index.express.plugin.spec.js b/packages/dd-trace/test/appsec/index.express.plugin.spec.js
index 0eb14ec10d..17752435db 100644
--- a/packages/dd-trace/test/appsec/index.express.plugin.spec.js
+++ b/packages/dd-trace/test/appsec/index.express.plugin.spec.js
@@ -319,7 +319,7 @@ withVersions('express', 'express', version => {
 
     describe('with sample delay 10', () => {
       beforeEach(() => {
-        config.appsec.apiSecurity.sampleDelay = 10
+        config.appsec.DD_API_SECURITY_SAMPLE_DELAY = 10
         appsec.enable(config)
       })
 
@@ -387,8 +387,8 @@ withVersions('express', 'express', version => {
     })
 
     it('should not get the schema', async () => {
-      config.appsec.apiSecurity.enabled = false
-      config.appsec.apiSecurity.sampleDelay = 10
+      config.appsec.DD_API_SECURITY_ENABLED = false
+      config.appsec.DD_API_SECURITY_SAMPLE_DELAY = 10
       appsec.enable(config)
 
       const res = await axios.post('/', { key: 'value' })
diff --git a/packages/dd-trace/test/appsec/index.fastify.plugin.spec.js b/packages/dd-trace/test/appsec/index.fastify.plugin.spec.js
index 8d6e46002b..f79f24427d 100644
--- a/packages/dd-trace/test/appsec/index.fastify.plugin.spec.js
+++ b/packages/dd-trace/test/appsec/index.fastify.plugin.spec.js
@@ -717,7 +717,6 @@ describe('Api Security - Fastify', () => {
           rules: path.join(__dirname, 'api_security_rules.json'),
           apiSecurity: {
             enabled: true,
-            sampleDelay: 10,
           },
         },
       })
diff --git a/packages/dd-trace/test/appsec/index.sequelize.plugin.spec.js b/packages/dd-trace/test/appsec/index.sequelize.plugin.spec.js
index 88eea125ed..a8fa93a150 100644
--- a/packages/dd-trace/test/appsec/index.sequelize.plugin.spec.js
+++ b/packages/dd-trace/test/appsec/index.sequelize.plugin.spec.js
@@ -51,7 +51,6 @@ describe('sequelize', () => {
               rules: path.join(__dirname, 'rules-example.json'),
               apiSecurity: {
                 enabled: true,
-                sampleDelay: 10,
               },
             },
           }))
diff --git a/packages/dd-trace/test/appsec/index.spec.js b/packages/dd-trace/test/appsec/index.spec.js
index 66c1668e84..c24c318a05 100644
--- a/packages/dd-trace/test/appsec/index.spec.js
+++ b/packages/dd-trace/test/appsec/index.spec.js
@@ -85,10 +85,8 @@ describe('AppSec Index', function () {
         eventTracking: {
           mode: 'anon',
         },
-        apiSecurity: {
-          enabled: false,
-          sampleDelay: 10,
-        },
+        DD_API_SECURITY_ENABLED: false,
+        DD_API_SECURITY_SAMPLE_DELAY: 10,
         rasp: {
           enabled: true,
           bodyCollection: true,
@@ -249,8 +247,8 @@ describe('AppSec Index', function () {
 
     it('should call appsec telemetry enable', () => {
       config.telemetry = {
-        enabled: true,
-        metrics: true,
+        DD_INSTRUMENTATION_TELEMETRY_ENABLED: true,
+        DD_TELEMETRY_METRICS_ENABLED: true,
       }
       AppSec.enable(config)
 
@@ -791,10 +789,8 @@ describe('AppSec Index', function () {
     })
 
     it('should not trigger schema extraction with feature disabled', () => {
-      config.appsec.apiSecurity = {
-        enabled: false,
-        sampleDelay: 1,
-      }
+      config.appsec.DD_API_SECURITY_ENABLED = false
+      config.appsec.DD_API_SECURITY_SAMPLE_DELAY = 1
 
       AppSec.enable(config)
 
@@ -842,10 +838,8 @@ describe('AppSec Index', function () {
     })
 
     it('should trigger schema extraction with sampling enabled', () => {
-      config.appsec.apiSecurity = {
-        enabled: true,
-        sampleDelay: 1,
-      }
+      config.appsec.DD_API_SECURITY_ENABLED = true
+      config.appsec.DD_API_SECURITY_SAMPLE_DELAY = 1
 
       AppSec.enable(config)
 
@@ -897,10 +891,8 @@ describe('AppSec Index', function () {
 
     describe('onResponseBody', () => {
       beforeEach(() => {
-        config.appsec.apiSecurity = {
-          enabled: true,
-          sampleDelay: 1,
-        }
+        config.appsec.DD_API_SECURITY_ENABLED = true
+        config.appsec.DD_API_SECURITY_SAMPLE_DELAY = 1
 
         AppSec.enable(config)
       })
@@ -1536,8 +1528,8 @@ describe('AppSec Index', function () {
     })
 
     it('should increment waf.init metric', () => {
-      config.telemetry.enabled = true
-      config.telemetry.metrics = true
+      config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED = true
+      config.telemetry.DD_TELEMETRY_METRICS_ENABLED = true
 
       appsec.enable(config)
 
@@ -1548,8 +1540,8 @@ describe('AppSec Index', function () {
     })
 
     it('should not increment waf.init metric if metrics are not enabled', () => {
-      config.telemetry.enabled = true
-      config.telemetry.metrics = false
+      config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED = true
+      config.telemetry.DD_TELEMETRY_METRICS_ENABLED = false
 
       appsec.enable(config)
 
@@ -1559,8 +1551,8 @@ describe('AppSec Index', function () {
     })
 
     it('should not increment waf.init metric if telemetry is not enabled', () => {
-      config.telemetry.enabled = false
-      config.telemetry.metrics = true
+      config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED = false
+      config.telemetry.DD_TELEMETRY_METRICS_ENABLED = true
 
       appsec.enable(config)
 
diff --git a/packages/dd-trace/test/appsec/lambda.spec.js b/packages/dd-trace/test/appsec/lambda.spec.js
new file mode 100644
index 0000000000..f4e6f623eb
--- /dev/null
+++ b/packages/dd-trace/test/appsec/lambda.spec.js
@@ -0,0 +1,503 @@
+'use strict'
+
+const assert = require('node:assert/strict')
+
+const { afterEach, beforeEach, describe, it } = require('mocha')
+const sinon = require('sinon')
+const proxyquire = require('proxyquire')
+
+describe('AppSec Lambda handler', () => {
+  let lambda
+  let waf
+  let Reporter
+  let keepTrace
+  let log
+  let addresses
+
+  const fakeSpan = () => {
+    const tags = {}
+    const spanContext = {
+      getTag (key) { return tags[key] },
+    }
+    return {
+      addTags: sinon.stub().callsFake((obj) => Object.assign(tags, obj)),
+      setTag: sinon.stub().callsFake((k, v) => { tags[k] = v }),
+      context: sinon.stub().returns(spanContext),
+    }
+  }
+
+  beforeEach(() => {
+    waf = {
+      run: sinon.stub(),
+      disposeContext: sinon.stub(),
+    }
+
+    Reporter = {
+      finishRequest: sinon.stub(),
+    }
+
+    keepTrace = sinon.stub()
+
+    log = {
+      warn: sinon.stub(),
+      error: sinon.stub(),
+      debug: sinon.stub(),
+    }
+
+    addresses = require('../../src/appsec/addresses')
+
+    lambda = proxyquire('../../src/appsec/lambda', {
+      '../log': log,
+      './waf': waf,
+      './reporter': Reporter,
+      '../priority_sampler': { keepTrace },
+    })
+  })
+
+  afterEach(() => {
+    sinon.restore()
+  })
+
+  describe('onLambdaStartInvocation', () => {
+    it('should warn and return when no span is provided', () => {
+      lambda.onLambdaStartInvocation({})
+
+      sinon.assert.calledOnce(log.warn)
+      sinon.assert.notCalled(waf.run)
+    })
+
+    it('should set appsec enabled tags on the span', () => {
+      const span = fakeSpan()
+
+      lambda.onLambdaStartInvocation({
+        span,
+        headers: { host: 'example.com' },
+        method: 'GET',
+        path: '/test',
+      })
+
+      assert.equal(span.context().getTag('_dd.appsec.enabled'), 1)
+      assert.equal(span.context().getTag('_dd.runtime_family'), 'nodejs')
+    })
+
+    it('should set HTTP_CLIENT_IP tag when clientIp is provided', () => {
+      const span = fakeSpan()
+
+      lambda.onLambdaStartInvocation({
+        span,
+        headers: {},
+        method: 'GET',
+        path: '/',
+        clientIp: '1.2.3.4',
+      })
+
+      assert.equal(span.context().getTag('http.client_ip'), '1.2.3.4')
+    })
+
+    it('should call waf.run with mapped addresses using span as the invocation key', () => {
+      const span = fakeSpan()
+
+      lambda.onLambdaStartInvocation({
+        span,
+        headers: { host: 'example.com' },
+        method: 'POST',
+        path: '/api/test',
+        query: { foo: 'bar' },
+        body: { key: 'value' },
+        clientIp: '10.0.0.1',
+        pathParams: { id: '123' },
+        cookies: { session: 'abc' },
+      })
+
+      sinon.assert.calledOnce(waf.run)
+
+      const [data, key, raspRule, rootSpan] = waf.run.firstCall.args
+      assert.deepStrictEqual(data.persistent, {
+        [addresses.HTTP_INCOMING_URL]: '/api/test',
+        [addresses.HTTP_INCOMING_METHOD]: 'POST',
+        [addresses.HTTP_INCOMING_HEADERS]: { host: 'example.com' },
+        [addresses.HTTP_CLIENT_IP]: '10.0.0.1',
+        [addresses.HTTP_INCOMING_QUERY]: { foo: 'bar' },
+        [addresses.HTTP_INCOMING_BODY]: { key: 'value' },
+        [addresses.HTTP_INCOMING_PARAMS]: { id: '123' },
+        [addresses.HTTP_INCOMING_COOKIES]: { session: 'abc' },
+      })
+      assert.equal(key, span)
+      assert.equal(raspRule, undefined)
+      assert.equal(rootSpan, span)
+    })
+
+    it('should not include undefined optional fields in WAF addresses', () => {
+      const span = fakeSpan()
+
+      lambda.onLambdaStartInvocation({
+        span,
+        headers: { host: 'example.com' },
+        method: 'GET',
+        path: '/',
+      })
+
+      sinon.assert.calledOnce(waf.run)
+      const persistent = waf.run.firstCall.args[0].persistent
+      assert.ok(!(addresses.HTTP_INCOMING_QUERY in persistent))
+      assert.ok(!(addresses.HTTP_INCOMING_BODY in persistent))
+      assert.ok(!(addresses.HTTP_INCOMING_PARAMS in persistent))
+      assert.ok(!(addresses.HTTP_INCOMING_COOKIES in persistent))
+      assert.ok(!(addresses.HTTP_CLIENT_IP in persistent))
+    })
+
+    it('should catch errors and log them', () => {
+      const span = fakeSpan()
+      waf.run.throws(new Error('boom'))
+
+      lambda.onLambdaStartInvocation({
+        span,
+        headers: {},
+        method: 'GET',
+        path: '/',
+      })
+
+      sinon.assert.calledOnce(log.error)
+    })
+  })
+
+  describe('onLambdaEndInvocation', () => {
+    it('should warn and return when no span is provided', () => {
+      lambda.onLambdaEndInvocation({})
+
+      sinon.assert.calledOnce(log.warn)
+      sinon.assert.notCalled(waf.run)
+    })
+
+    it('should return silently when start-invocation was not called for this span', () => {
+      const span = fakeSpan()
+
+      lambda.onLambdaEndInvocation({ span })
+
+      sinon.assert.notCalled(waf.run)
+      sinon.assert.notCalled(waf.disposeContext)
+    })
+
+    it('should run WAF with response addresses and dispose context', () => {
+      const span = fakeSpan()
+
+      lambda.onLambdaStartInvocation({ span, headers: {}, method: 'GET', path: '/' })
+      waf.run.reset()
+
+      lambda.onLambdaEndInvocation({
+        span,
+        statusCode: '200',
+        responseHeaders: { 'content-type': 'application/json', 'set-cookie': 'foo=bar' },
+      })
+
+      sinon.assert.calledOnce(waf.run)
+      const [data, key] = waf.run.firstCall.args
+      assert.equal(data.persistent[addresses.HTTP_INCOMING_RESPONSE_CODE], '200')
+      assert.deepStrictEqual(data.persistent[addresses.HTTP_INCOMING_RESPONSE_HEADERS], {
+        'content-type': 'application/json',
+      })
+      assert.ok(!('set-cookie' in data.persistent[addresses.HTTP_INCOMING_RESPONSE_HEADERS]))
+      assert.equal(key, span)
+
+      sinon.assert.calledOnce(waf.disposeContext)
+      sinon.assert.calledOnce(Reporter.finishRequest)
+    })
+
+    it('should skip WAF run when no response data', () => {
+      const span = fakeSpan()
+
+      lambda.onLambdaStartInvocation({ span, headers: {}, method: 'GET', path: '/' })
+      waf.run.reset()
+
+      lambda.onLambdaEndInvocation({ span })
+
+      sinon.assert.notCalled(waf.run)
+      sinon.assert.calledOnce(waf.disposeContext)
+      sinon.assert.calledOnce(Reporter.finishRequest)
+    })
+
+    it('should not process end-invocation twice for the same span', () => {
+      const span = fakeSpan()
+
+      lambda.onLambdaStartInvocation({ span, headers: {}, method: 'GET', path: '/' })
+      lambda.onLambdaEndInvocation({ span, statusCode: '200' })
+      lambda.onLambdaEndInvocation({ span, statusCode: '200' })
+
+      assert.equal(waf.disposeContext.callCount, 1)
+      assert.equal(Reporter.finishRequest.callCount, 1)
+    })
+
+    it('should pass the span as rootSpan to Reporter.finishRequest', () => {
+      const span = fakeSpan()
+
+      lambda.onLambdaStartInvocation({ span, headers: {}, method: 'GET', path: '/' })
+      lambda.onLambdaEndInvocation({ span, statusCode: '200' })
+
+      sinon.assert.calledOnce(Reporter.finishRequest)
+      const args = Reporter.finishRequest.firstCall.args
+      assert.equal(args[4], span)
+    })
+
+    it('should pass span as req to Reporter.finishRequest', () => {
+      const span = fakeSpan()
+
+      lambda.onLambdaStartInvocation({ span, headers: {}, method: 'GET', path: '/' })
+      lambda.onLambdaEndInvocation({ span, statusCode: '200' })
+
+      sinon.assert.calledOnce(Reporter.finishRequest)
+      const [req, res, storedHeaders, body, rootSpan] = Reporter.finishRequest.firstCall.args
+      assert.equal(req, span)
+      assert.equal(res, null)
+      assert.deepStrictEqual(storedHeaders, {})
+      assert.equal(body, undefined)
+      assert.equal(rootSpan, span)
+    })
+
+    it('should catch errors and log them', () => {
+      const span = fakeSpan()
+
+      lambda.onLambdaStartInvocation({ span, headers: {}, method: 'GET', path: '/' })
+      waf.disposeContext.throws(new Error('boom'))
+
+      lambda.onLambdaEndInvocation({ span, statusCode: '200' })
+
+      sinon.assert.calledOnce(log.error)
+    })
+
+    it('should use span as key for WAF run and dispose across start and end', () => {
+      const span = fakeSpan()
+
+      lambda.onLambdaStartInvocation({
+        span,
+        headers: { host: 'example.com' },
+        method: 'GET',
+        path: '/',
+      })
+
+      lambda.onLambdaEndInvocation({ span, statusCode: '200' })
+
+      const startKey = waf.run.firstCall.args[1]
+      const endKey = waf.run.secondCall.args[1]
+      const disposeKey = waf.disposeContext.firstCall.args[0]
+
+      assert.equal(startKey, span)
+      assert.equal(endKey, span)
+      assert.equal(disposeKey, span)
+    })
+  })
+})
+
+// ─── WAF path safety: contract enforcement for non-HTTP req ───────────────────
+//
+// In Lambda, `req` in the WAF execution path is the span object, which has no
+// HTTP properties (no socket, headers, body, etc.). The tests below exercise
+// the real WAFContextWrapper → Reporter chain with such an object to verify that
+// no unguarded req property access exists.
+//
+// A Proxy-based `strictNonHttpReq` is used as the req object. It allows access
+// to properties that have been audited as safe (they return undefined and all
+// call-sites guard against it), and throws on any NEW property access. This
+// forces developers to explicitly acknowledge and guard new req usages.
+// ──────────────────────────────────────────────────────────────────────────────
+
+describe('WAF path safety with non-HTTP req', () => {
+  let RealReporter
+  let WAFContextWrapper
+  let web
+  let telemetry
+
+  // Properties on req that are known to be accessed in the WAF/reporter path
+  // and have been verified safe for non-HTTP objects (all return undefined).
+  // If you need to access a new req property, add it here AND ensure the
+  // call-site guards against undefined (e.g. req?.prop, if (prop) ...).
+  const AUDITED_REQ_PROPERTIES = new Set([
+    'socket', // reportAttack: guarded with req?.socket
+    'body', // reportAttack: only reached when config.raspBodyCollection && isRaspAttack; undefined is safe
+  ])
+
+  function makeStrictNonHttpReq () {
+    return new Proxy(Object.create(null), {
+      get (_target, prop) {
+        if (typeof prop === 'symbol') return undefined
+        if (AUDITED_REQ_PROPERTIES.has(prop)) return undefined
+        throw new Error(
+          `Unguarded access to req.${String(prop)} in WAF path — ` +
+          'req may not be an HTTP request (e.g. Lambda invocation key). ' +
+          'Guard the access or add the property to AUDITED_REQ_PROPERTIES in lambda.spec.js.'
+        )
+      },
+    })
+  }
+
+  const fakeSpan = () => {
+    const tags = {}
+    const spanContext = {
+      getTags () { return tags },
+      getTag (key) { return tags[key] },
+      setTag (key, value) { tags[key] = value },
+      hasTag (key) { return key in tags },
+    }
+    return {
+      addTags: sinon.stub().callsFake((obj) => Object.assign(tags, obj)),
+      setTag: sinon.stub().callsFake((k, v) => { tags[k] = v }),
+      context: sinon.stub().returns(spanContext),
+      keep: sinon.stub(),
+    }
+  }
+
+  beforeEach(() => {
+    web = {
+      root: sinon.stub(),
+      getContext: sinon.stub(),
+    }
+
+    telemetry = {
+      incrementWafInitMetric: sinon.stub(),
+      incrementWafConfigErrorsMetric: sinon.stub(),
+      incrementWafUpdatesMetric: sinon.stub(),
+      incrementWafRequestsMetric: sinon.stub(),
+      updateWafRequestsMetricTags: sinon.stub(),
+      updateRaspRequestsMetricTags: sinon.stub(),
+      updateRaspRuleSkippedMetricTags: sinon.stub(),
+      updateRateLimitedMetric: sinon.stub(),
+      getRequestMetrics: sinon.stub(),
+    }
+
+    RealReporter = proxyquire('../../src/appsec/reporter', {
+      '../plugins/util/web': web,
+      './telemetry': telemetry,
+    })
+
+    WAFContextWrapper = proxyquire('../../src/appsec/waf/waf_context_wrapper', {
+      '../reporter': RealReporter,
+      '../../log': { warn: sinon.stub(), error: sinon.stub() },
+      '../blocking': { getBlockingAction: () => undefined },
+      '../channels': { wafRunFinished: { hasSubscribers: false } },
+    })
+  })
+
+  afterEach(() => {
+    sinon.restore()
+  })
+
+  it('should complete WAF run with attack result without accessing non-HTTP req properties', () => {
+    const req = makeStrictNonHttpReq()
+    const span = fakeSpan()
+
+    const mockDdwafContext = {
+      disposed: false,
+      run: sinon.stub().returns({
+        events: [{ rule: { id: 'ua0-600-55x', tags: { type: 'security_scanner' } } }],
+        actions: {},
+        duration: 100,
+        timeout: false,
+        metrics: {},
+      }),
+    }
+
+    const knownAddresses = new Set([
+      'server.request.headers.no_cookies',
+      'server.request.uri.raw',
+      'server.request.method',
+    ])
+
+    const ctx = new WAFContextWrapper(mockDdwafContext, 5000, '1.18.0', '1.13.3', knownAddresses)
+
+    ctx.run(
+      { persistent: { 'server.request.headers.no_cookies': { host: 'example.com' } } },
+      undefined,
+      req,
+      span
+    )
+
+    assert.equal(span.context().getTag('appsec.event'), 'true')
+    assert.ok(span.context().getTag('_dd.appsec.json'))
+    assert.equal(span.context().getTag('network.client.ip'), undefined)
+  })
+
+  it('should complete WAF run without attack without accessing non-HTTP req properties', () => {
+    const req = makeStrictNonHttpReq()
+    const span = fakeSpan()
+
+    const mockDdwafContext = {
+      disposed: false,
+      run: sinon.stub().returns({
+        events: [],
+        actions: {},
+        duration: 50,
+        timeout: false,
+        metrics: {},
+      }),
+    }
+
+    const knownAddresses = new Set(['server.request.uri.raw'])
+    const ctx = new WAFContextWrapper(mockDdwafContext, 5000, '1.18.0', '1.13.3', knownAddresses)
+
+    ctx.run(
+      { persistent: { 'server.request.uri.raw': '/test' } },
+      undefined,
+      req,
+      span
+    )
+
+    sinon.assert.calledOnce(telemetry.updateWafRequestsMetricTags)
+    assert.equal(span.context().getTag('appsec.event'), undefined)
+  })
+
+  it('should complete WAF run with attributes without accessing non-HTTP req properties', () => {
+    const req = makeStrictNonHttpReq()
+    const span = fakeSpan()
+
+    const mockDdwafContext = {
+      disposed: false,
+      run: sinon.stub().returns({
+        events: [],
+        actions: {},
+        duration: 50,
+        timeout: false,
+        metrics: {},
+        attributes: { '_dd.appsec.s.req.body': [{ key: [8] }] },
+      }),
+    }
+
+    const knownAddresses = new Set(['server.request.uri.raw'])
+    const ctx = new WAFContextWrapper(mockDdwafContext, 5000, '1.18.0', '1.13.3', knownAddresses)
+
+    ctx.run(
+      { persistent: { 'server.request.uri.raw': '/test' } },
+      undefined,
+      req,
+      span
+    )
+
+    assert.ok(span.context().getTag('_dd.appsec.s.req.body'))
+  })
+
+  it('should complete finishRequest with span as req without crash', () => {
+    const span = fakeSpan()
+
+    RealReporter.finishRequest(span, null, {}, undefined, span)
+  })
+
+  it('should flush metricsQueue in finishRequest with span as req (Lambda production path)', () => {
+    const span = fakeSpan()
+
+    RealReporter.metricsQueue.set('_dd.appsec.waf.duration', 100)
+
+    RealReporter.finishRequest(span, null, {}, undefined, span)
+
+    assert.equal(span.context().getTag('_dd.appsec.waf.duration'), 100)
+    assert.equal(RealReporter.metricsQueue.size, 0)
+  })
+
+  it('should use Proxy as a valid WeakMap key for telemetry and WAF contexts', () => {
+    const req = makeStrictNonHttpReq()
+    const weakMap = new WeakMap()
+
+    weakMap.set(req, { duration: 42 })
+    assert.deepStrictEqual(weakMap.get(req), { duration: 42 })
+
+    weakMap.delete(req)
+    assert.equal(weakMap.get(req), undefined)
+  })
+})
diff --git a/packages/dd-trace/test/appsec/reporter.spec.js b/packages/dd-trace/test/appsec/reporter.spec.js
index 3d534fbde7..a38cfa0c50 100644
--- a/packages/dd-trace/test/appsec/reporter.spec.js
+++ b/packages/dd-trace/test/appsec/reporter.spec.js
@@ -1332,5 +1332,48 @@ describe('reporter', () => {
         sinon.assert.calledWith(span.addTags, expectedTags)
       })
     })
+
+    describe('Lambda (null req)', () => {
+      it('should not crash when req is null and rootSpan is provided', () => {
+        Reporter.finishRequest(null, null, {}, undefined, span)
+
+        sinon.assert.notCalled(span.addTags)
+      })
+
+      it('should still flush metricsQueue when req is null but rootSpan is provided', () => {
+        Reporter.metricsQueue.set('_dd.appsec.json', '{"triggers":[]}')
+
+        Reporter.finishRequest(null, null, {}, undefined, span)
+
+        sinon.assert.calledWithExactly(span.setTag, '_dd.appsec.json', '{"triggers":[]}')
+        assert.strictEqual(Reporter.metricsQueue.size, 0)
+      })
+    })
+  })
+
+  describe('reportAttack (Lambda path)', () => {
+    it('should not crash when req is an empty object and rootSpan is provided', () => {
+      const fakeReq = {}
+
+      Reporter.reportAttack({
+        events: [{ rule: { id: 'test-rule' } }],
+        actions: {},
+      }, fakeReq, span)
+
+      sinon.assert.calledOnce(span.addTags)
+      const tags = span.addTags.firstCall.args[0]
+      assert.strictEqual(tags['appsec.event'], 'true')
+      assert.ok(tags['_dd.appsec.json'].includes('test-rule'))
+    })
+
+    it('should not set NETWORK_CLIENT_IP when req has no socket', () => {
+      Reporter.reportAttack({
+        events: [{ rule: { id: 'test-rule' } }],
+        actions: {},
+      }, {}, span)
+
+      const tags = span.addTags.firstCall.args[0]
+      assert.strictEqual(tags['network.client.ip'], undefined)
+    })
   })
 })
diff --git a/packages/dd-trace/test/appsec/telemetry/api_security.spec.js b/packages/dd-trace/test/appsec/telemetry/api_security.spec.js
index 6fb55e86b7..9bc5b60f0b 100644
--- a/packages/dd-trace/test/appsec/telemetry/api_security.spec.js
+++ b/packages/dd-trace/test/appsec/telemetry/api_security.spec.js
@@ -27,8 +27,8 @@ describe('Appsec API Security Telemetry metrics', () => {
   describe('if enabled', () => {
     beforeEach(() => {
       const config = getConfig()
-      config.telemetry.enabled = true
-      config.telemetry.metrics = true
+      config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED = true
+      config.telemetry.DD_TELEMETRY_METRICS_ENABLED = true
 
       appsecTelemetry.enable(config)
     })
@@ -78,8 +78,8 @@ describe('Appsec API Security Telemetry metrics', () => {
   describe('if telemetry is disabled', () => {
     beforeEach(() => {
       const config = getConfig()
-      config.telemetry.enabled = false
-      config.telemetry.metrics = false
+      config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED = false
+      config.telemetry.DD_TELEMETRY_METRICS_ENABLED = false
 
       appsecTelemetry.enable(config)
     })
diff --git a/packages/dd-trace/test/appsec/telemetry/rasp.spec.js b/packages/dd-trace/test/appsec/telemetry/rasp.spec.js
index a183c77b2c..800f31589e 100644
--- a/packages/dd-trace/test/appsec/telemetry/rasp.spec.js
+++ b/packages/dd-trace/test/appsec/telemetry/rasp.spec.js
@@ -33,8 +33,8 @@ describe('Appsec Rasp Telemetry metrics', () => {
   describe('if enabled', () => {
     beforeEach(() => {
       const config = getConfig()
-      config.telemetry.enabled = true
-      config.telemetry.metrics = true
+      config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED = true
+      config.telemetry.DD_TELEMETRY_METRICS_ENABLED = true
 
       appsecTelemetry.enable(config)
     })
@@ -270,10 +270,9 @@ describe('Appsec Rasp Telemetry metrics', () => {
 
   describe('if disabled', () => {
     it('should not increment any metric if telemetry is disabled', () => {
-      appsecTelemetry.enable({
-        enabled: false,
-        metrics: true,
-      })
+      const config = getConfig()
+      config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED = false
+      appsecTelemetry.enable(config)
 
       appsecTelemetry.incrementWafInitMetric(wafVersion, rulesVersion)
 
@@ -282,10 +281,9 @@ describe('Appsec Rasp Telemetry metrics', () => {
     })
 
     it('should not increment any metric if telemetry metrics are disabled', () => {
-      appsecTelemetry.enable({
-        enabled: true,
-        metrics: false,
-      })
+      const config = getConfig()
+      config.telemetry.DD_TELEMETRY_METRICS_ENABLED = false
+      appsecTelemetry.enable(config)
 
       appsecTelemetry.incrementWafInitMetric(wafVersion, rulesVersion)
 
@@ -295,10 +293,9 @@ describe('Appsec Rasp Telemetry metrics', () => {
 
     describe('updateRaspRequestsMetricTags', () => {
       it('should sum rasp.duration and rasp.durationExt request metrics', () => {
-        appsecTelemetry.enable({
-          enabled: false,
-          metrics: true,
-        })
+        const config = getConfig()
+        config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED = false
+        appsecTelemetry.enable(config)
 
         appsecTelemetry.updateRaspRequestsMetricTags({
           duration: 42,
@@ -318,10 +315,9 @@ describe('Appsec Rasp Telemetry metrics', () => {
       })
 
       it('should sum rasp.duration and rasp.durationExt with telemetry enabled and metrics disabled', () => {
-        appsecTelemetry.enable({
-          enabled: true,
-          metrics: false,
-        })
+        const config = getConfig()
+        config.telemetry.DD_TELEMETRY_METRICS_ENABLED = false
+        appsecTelemetry.enable(config)
 
         appsecTelemetry.updateRaspRequestsMetricTags({
           duration: 42,
@@ -341,10 +337,9 @@ describe('Appsec Rasp Telemetry metrics', () => {
       })
 
       it('should not increment any metric if telemetry metrics are disabled', () => {
-        appsecTelemetry.enable({
-          enabled: true,
-          metrics: false,
-        })
+        const config = getConfig()
+        config.telemetry.DD_TELEMETRY_METRICS_ENABLED = false
+        appsecTelemetry.enable(config)
 
         appsecTelemetry.updateRaspRequestsMetricTags({
           duration: 24,
diff --git a/packages/dd-trace/test/appsec/telemetry/user.spec.js b/packages/dd-trace/test/appsec/telemetry/user.spec.js
index 783438dded..f83f40e7ec 100644
--- a/packages/dd-trace/test/appsec/telemetry/user.spec.js
+++ b/packages/dd-trace/test/appsec/telemetry/user.spec.js
@@ -27,8 +27,8 @@ describe('Appsec User Telemetry metrics', () => {
   describe('if enabled', () => {
     beforeEach(() => {
       const config = getConfig()
-      config.telemetry.enabled = true
-      config.telemetry.metrics = true
+      config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED = true
+      config.telemetry.DD_TELEMETRY_METRICS_ENABLED = true
 
       appsecTelemetry.enable(config)
     })
diff --git a/packages/dd-trace/test/appsec/telemetry/waf.spec.js b/packages/dd-trace/test/appsec/telemetry/waf.spec.js
index 1d9efccfbf..551dc6a9d3 100644
--- a/packages/dd-trace/test/appsec/telemetry/waf.spec.js
+++ b/packages/dd-trace/test/appsec/telemetry/waf.spec.js
@@ -45,8 +45,8 @@ describe('Appsec Waf Telemetry metrics', () => {
 
     beforeEach(() => {
       const config = getConfig()
-      config.telemetry.enabled = true
-      config.telemetry.metrics = true
+      config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED = true
+      config.telemetry.DD_TELEMETRY_METRICS_ENABLED = true
 
       appsecTelemetry.enable(config)
     })
@@ -420,10 +420,9 @@ describe('Appsec Waf Telemetry metrics', () => {
 
   describe('if disabled', () => {
     it('should not increment any metric if telemetry is disabled', () => {
-      appsecTelemetry.enable({
-        enabled: false,
-        metrics: true,
-      })
+      const config = getConfig()
+      config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED = false
+      appsecTelemetry.enable(config)
 
       appsecTelemetry.incrementWafInitMetric(wafVersion, rulesVersion, true)
 
@@ -432,10 +431,9 @@ describe('Appsec Waf Telemetry metrics', () => {
     })
 
     it('should not increment any metric if telemetry metrics are disabled', () => {
-      appsecTelemetry.enable({
-        enabled: true,
-        metrics: false,
-      })
+      const config = getConfig()
+      config.telemetry.DD_TELEMETRY_METRICS_ENABLED = false
+      appsecTelemetry.enable(config)
 
       appsecTelemetry.incrementWafInitMetric(wafVersion, rulesVersion, true)
 
@@ -457,10 +455,9 @@ describe('Appsec Waf Telemetry metrics', () => {
 
     describe('updateWafRequestMetricTags', () => {
       it('should sum waf.duration and waf.durationExt request metrics', () => {
-        appsecTelemetry.enable({
-          enabled: false,
-          metrics: true,
-        })
+        const config = getConfig()
+        config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED = false
+        appsecTelemetry.enable(config)
 
         appsecTelemetry.updateWafRequestsMetricTags({
           duration: 42,
@@ -479,10 +476,9 @@ describe('Appsec Waf Telemetry metrics', () => {
       })
 
       it('should sum waf.duration and waf.durationExt with telemetry enabled and metrics disabled', () => {
-        appsecTelemetry.enable({
-          enabled: true,
-          metrics: false,
-        })
+        const config = getConfig()
+        config.telemetry.DD_TELEMETRY_METRICS_ENABLED = false
+        appsecTelemetry.enable(config)
 
         appsecTelemetry.updateWafRequestsMetricTags({
           duration: 42,
diff --git a/packages/dd-trace/test/appsec/waf/index.spec.js b/packages/dd-trace/test/appsec/waf/index.spec.js
index 2ee308842f..d8180c948d 100644
--- a/packages/dd-trace/test/appsec/waf/index.spec.js
+++ b/packages/dd-trace/test/appsec/waf/index.spec.js
@@ -128,7 +128,7 @@ describe('WAF Manager', () => {
       const req = {}
       waf.run(payload, req, 'ssrf')
 
-      sinon.assert.calledOnceWithExactly(run, payload, 'ssrf', req)
+      sinon.assert.calledOnceWithExactly(run, payload, 'ssrf', req, undefined)
     })
 
     it('should call wafManager.run without raspRuleType', () => {
@@ -140,7 +140,7 @@ describe('WAF Manager', () => {
       const req = {}
       waf.run(payload, req)
 
-      sinon.assert.calledOnceWithExactly(run, payload, undefined, req)
+      sinon.assert.calledOnceWithExactly(run, payload, undefined, req, undefined)
     })
 
     describe('sampling priority', () => {
@@ -458,7 +458,7 @@ describe('WAF Manager', () => {
 
         wafContextWrapper.run(params, undefined, req)
 
-        sinon.assert.calledOnceWithExactly(Reporter.reportAttack, match({ events: ['ATTACK DATA'] }), req)
+        sinon.assert.calledOnceWithExactly(Reporter.reportAttack, match({ events: ['ATTACK DATA'] }), req, undefined)
       })
 
       it('should report if rule is triggered', () => {
@@ -582,7 +582,7 @@ describe('WAF Manager', () => {
         ddwafContext.run.returns(result)
 
         wafContextWrapper.run(params, undefined, req)
-        sinon.assert.calledOnceWithExactly(Reporter.reportAttributes, result.attributes, req)
+        sinon.assert.calledOnceWithExactly(Reporter.reportAttributes, result.attributes, req, undefined)
       })
 
       it('should report fingerprints when ddwafContext returns fingerprints in results attributes', () => {
@@ -604,7 +604,7 @@ describe('WAF Manager', () => {
             'server.request.body': 'foo',
           },
         }, undefined, req)
-        sinon.assert.calledOnceWithExactly(Reporter.reportAttributes, result.attributes, req)
+        sinon.assert.calledOnceWithExactly(Reporter.reportAttributes, result.attributes, req, undefined)
       })
     })
   })
diff --git a/packages/dd-trace/test/asserts/profile.js b/packages/dd-trace/test/asserts/profile.js
deleted file mode 100644
index 537c10d670..0000000000
--- a/packages/dd-trace/test/asserts/profile.js
+++ /dev/null
@@ -1,63 +0,0 @@
-'use strict'
-
-const assert = require('node:assert/strict')
-const { inspect } = require('node:util')
-module.exports = ({ Assertion, expect }, { expectTypes }) => {
-  Assertion.addProperty('valueType', function () {
-    const obj = this._obj
-
-    assert.ok(typeof obj === 'object' && obj !== null, `Expected non-null object, got ${inspect(obj)}`)
-    assert.strictEqual(typeof obj.type, 'number')
-    assert.strictEqual(typeof obj.unit, 'number')
-  })
-
-  Assertion.addProperty('numeric', function () {
-    expectTypes(this, ['number', 'bigint'])
-  })
-
-  Assertion.addProperty('profile', function () {
-    const obj = this._obj
-
-    assert.ok(typeof obj === 'object' && obj !== null, `Expected non-null object, got ${inspect(obj)}`)
-
-    assert.strictEqual(typeof obj.timeNanos, 'bigint')
-    expect(obj.period).to.be.numeric
-    expect(obj.periodType).to.be.a.valueType
-    assert.ok(Array.isArray(obj.sampleType), `Expected array, got ${inspect(obj.sampleType)}`)
-    assert.strictEqual(obj.sampleType.length, 2)
-    assert.ok(Array.isArray(obj.sample), `Expected array, got ${inspect(obj.sample)}`)
-    assert.ok(Array.isArray(obj.location), `Expected array, got ${inspect(obj.location)}`)
-    assert.ok(Array.isArray(obj.function), `Expected array, got ${inspect(obj.function)}`)
-    assert.ok(Array.isArray(obj.stringTable.strings), `Expected array, got ${inspect(obj.stringTable.strings)}`)
-    assert.ok(obj.stringTable.strings.length >= 1, `Expected ${obj.stringTable.strings.length} >= 1`)
-    assert.strictEqual(obj.stringTable.strings[0], '')
-
-    for (const sampleType of obj.sampleType) {
-      expect(sampleType).to.be.a.valueType
-    }
-
-    for (const fn of obj.function) {
-      assert.strictEqual(typeof fn.filename, 'number')
-      assert.strictEqual(typeof fn.systemName, 'number')
-      assert.strictEqual(typeof fn.name, 'number')
-      assert.ok(Number.isSafeInteger(fn.id), `Expected isSafeInteger, got ${inspect(fn.id)}`)
-    }
-
-    for (const location of obj.location) {
-      assert.ok(Number.isSafeInteger(location.id), `Expected isSafeInteger, got ${inspect(location.id)}`)
-      assert.ok(Array.isArray(location.line), `Expected array, got ${inspect(location.line)}`)
-
-      for (const line of location.line) {
-        assert.ok(Number.isSafeInteger(line.functionId), `Expected isSafeInteger, got ${inspect(line.functionId)}`)
-        assert.strictEqual(typeof line.line, 'number')
-      }
-    }
-
-    for (const sample of obj.sample) {
-      assert.ok(Array.isArray(sample.locationId), `Expected array, got ${inspect(sample.locationId)}`)
-      assert.ok(sample.locationId.length >= 1, `Expected ${sample.locationId.length} >= 1`)
-      assert.ok(Array.isArray(sample.value), `Expected array, got ${inspect(sample.value)}`)
-      assert.strictEqual(sample.value.length, obj.sampleType.length)
-    }
-  })
-}
diff --git a/packages/dd-trace/test/ci-visibility/early-flake-detection/get-known-tests.spec.js b/packages/dd-trace/test/ci-visibility/early-flake-detection/get-known-tests.spec.js
index 3c706ee25d..32608b767b 100644
--- a/packages/dd-trace/test/ci-visibility/early-flake-detection/get-known-tests.spec.js
+++ b/packages/dd-trace/test/ci-visibility/early-flake-detection/get-known-tests.spec.js
@@ -8,7 +8,11 @@ const nock = require('nock')
 
 require('../../setup/core')
 
-const { getKnownTests } = require('../../../src/ci-visibility/early-flake-detection/get-known-tests')
+const {
+  getKnownTests,
+  parseKnownTestsResponse,
+} = require('../../../src/ci-visibility/early-flake-detection/get-known-tests')
+const getConfig = require('../../../src/config')
 const {
   buildCacheKey,
   getCachePath,
@@ -72,13 +76,17 @@ function cleanup (params) {
 describe('get-known-tests', () => {
   beforeEach(() => {
     process.env.DD_API_KEY = 'test-api-key'
+    getConfig().DD_API_KEY = 'test-api-key'
     process.env.DD_EXPERIMENTAL_TEST_REQUESTS_FS_CACHE = 'true'
+    getConfig().DD_EXPERIMENTAL_TEST_REQUESTS_FS_CACHE = true
     cleanup(DEFAULT_PARAMS)
   })
 
   afterEach(() => {
     delete process.env.DD_API_KEY
+    getConfig().DD_API_KEY = undefined
     delete process.env.DD_EXPERIMENTAL_TEST_REQUESTS_FS_CACHE
+    getConfig().DD_EXPERIMENTAL_TEST_REQUESTS_FS_CACHE = false
     cleanup(DEFAULT_PARAMS)
     nock.cleanAll()
   })
@@ -329,3 +337,34 @@ describe('get-known-tests', () => {
     })
   })
 })
+
+describe('parseKnownTestsResponse', () => {
+  it('returns tests from a raw backend response', () => {
+    assert.deepStrictEqual(
+      parseKnownTestsResponse(JSON.stringify(KNOWN_TESTS_RESPONSE)),
+      KNOWN_TESTS_RESPONSE.data.attributes.tests
+    )
+  })
+
+  it('preserves null tests from a raw backend response', () => {
+    assert.strictEqual(parseKnownTestsResponse(JSON.stringify(EMPTY_KNOWN_TESTS_RESPONSE)), null)
+  })
+
+  it('validates known tests response shape when requested', () => {
+    assert.deepStrictEqual(
+      parseKnownTestsResponse(JSON.stringify(KNOWN_TESTS_RESPONSE), { validateRequiredFields: true }),
+      KNOWN_TESTS_RESPONSE.data.attributes.tests
+    )
+    assert.throws(
+      () => parseKnownTestsResponse(JSON.stringify({ data: { attributes: {} } }), { validateRequiredFields: true }),
+      /Invalid known tests response: missing tests/
+    )
+    assert.throws(
+      () => parseKnownTestsResponse(
+        JSON.stringify({ data: { attributes: { tests: { jest: { 'suite.js': 'test' } } } } }),
+        { validateRequiredFields: true }
+      ),
+      /Invalid known tests response: suite tests must be arrays/
+    )
+  })
+})
diff --git a/packages/dd-trace/test/ci-visibility/exporters/agent-proxy/agent-proxy.spec.js b/packages/dd-trace/test/ci-visibility/exporters/agent-proxy/agent-proxy.spec.js
index 6cac20369b..b4ed9d2af8 100644
--- a/packages/dd-trace/test/ci-visibility/exporters/agent-proxy/agent-proxy.spec.js
+++ b/packages/dd-trace/test/ci-visibility/exporters/agent-proxy/agent-proxy.spec.js
@@ -10,7 +10,7 @@ const nock = require('nock')
 
 const { assertObjectContains } = require('../../../../../../integration-tests/helpers')
 require('../../../../../dd-trace/test/setup/core')
-const AgentProxyCiVisibilityExporter = require('../../../../src/ci-visibility/exporters/agent-proxy')
+const AgentProxyCiVisibilityExporterBase = require('../../../../src/ci-visibility/exporters/agent-proxy')
 const AgentlessWriter = require('../../../../src/ci-visibility/exporters/agentless/writer')
 const DynamicInstrumentationLogsWriter = require('../../../../src/ci-visibility/exporters/agentless/di-logs-writer')
 const CoverageWriter = require('../../../../src/ci-visibility/exporters/agentless/coverage-writer')
@@ -18,6 +18,14 @@ const AgentWriter = require('../../../../src/exporters/agent/writer')
 const { clearCache } = require('../../../../src/agent/info')
 const { defaults: { hostname, port } } = require('../../../../src/config/defaults')
 
+// The real tracer Config always carries a `testOptimization` namespace object.
+// Default it here so the partial config stand-ins below mirror that guarantee.
+class AgentProxyCiVisibilityExporter extends AgentProxyCiVisibilityExporterBase {
+  constructor (config) {
+    super({ testOptimization: {}, ...config })
+  }
+}
+
 describe('AgentProxyCiVisibilityExporter', () => {
   beforeEach(() => {
     nock.abortPendingRequests()
@@ -140,7 +148,7 @@ describe('AgentProxyCiVisibilityExporter', () => {
         const agentProxyCiVisibilityExporter = new AgentProxyCiVisibilityExporter({
           url,
           tags,
-          isTestDynamicInstrumentationEnabled: true,
+          testOptimization: { DD_TEST_FAILED_TEST_REPLAY_ENABLED: true },
         })
         await agentProxyCiVisibilityExporter._canUseCiVisProtocolPromise
         assert.ok(agentProxyCiVisibilityExporter._logsWriter instanceof DynamicInstrumentationLogsWriter)
@@ -154,7 +162,7 @@ describe('AgentProxyCiVisibilityExporter', () => {
         const agentProxyCiVisibilityExporter = new AgentProxyCiVisibilityExporter({
           url,
           tags,
-          isTestDynamicInstrumentationEnabled: true,
+          testOptimization: { DD_TEST_FAILED_TEST_REPLAY_ENABLED: true },
         })
         await agentProxyCiVisibilityExporter._canUseCiVisProtocolPromise
         agentProxyCiVisibilityExporter._logsWriter = mockWriter
@@ -223,7 +231,7 @@ describe('AgentProxyCiVisibilityExporter', () => {
         const agentProxyCiVisibilityExporter = new AgentProxyCiVisibilityExporter({
           url,
           tags,
-          isTestDynamicInstrumentationEnabled: true,
+          testOptimization: { DD_TEST_FAILED_TEST_REPLAY_ENABLED: true },
         })
         await agentProxyCiVisibilityExporter._canUseCiVisProtocolPromise
         assert.strictEqual(agentProxyCiVisibilityExporter._logsWriter, undefined)
@@ -237,7 +245,7 @@ describe('AgentProxyCiVisibilityExporter', () => {
         const agentProxyCiVisibilityExporter = new AgentProxyCiVisibilityExporter({
           url,
           tags,
-          isTestDynamicInstrumentationEnabled: true,
+          testOptimization: { DD_TEST_FAILED_TEST_REPLAY_ENABLED: true },
         })
         await agentProxyCiVisibilityExporter._canUseCiVisProtocolPromise
         agentProxyCiVisibilityExporter._logsWriter = mockWriter
diff --git a/packages/dd-trace/test/ci-visibility/exporters/agentless/di-logs-writer.spec.js b/packages/dd-trace/test/ci-visibility/exporters/agentless/di-logs-writer.spec.js
index a63d840636..5eb254bafa 100644
--- a/packages/dd-trace/test/ci-visibility/exporters/agentless/di-logs-writer.spec.js
+++ b/packages/dd-trace/test/ci-visibility/exporters/agentless/di-logs-writer.spec.js
@@ -13,7 +13,7 @@ const log = require('../../../../src/log')
 
 const DynamicInstrumentationLogsWriterWithApiKey = proxyquire(
   '../../../../src/ci-visibility/exporters/agentless/di-logs-writer',
-  { '../../../config': () => ({ apiKey: '1' }) }
+  { '../../../config': () => ({ DD_API_KEY: '1' }) }
 )
 const DynamicInstrumentationLogsWriter = require('../../../../src/ci-visibility/exporters/agentless/di-logs-writer')
 
diff --git a/packages/dd-trace/test/ci-visibility/exporters/agentless/exporter.spec.js b/packages/dd-trace/test/ci-visibility/exporters/agentless/exporter.spec.js
index b4dfbd860d..729c8e7bab 100644
--- a/packages/dd-trace/test/ci-visibility/exporters/agentless/exporter.spec.js
+++ b/packages/dd-trace/test/ci-visibility/exporters/agentless/exporter.spec.js
@@ -11,9 +11,17 @@ const sinon = require('sinon')
 const nock = require('nock')
 
 require('../../../../../dd-trace/test/setup/core')
-const AgentlessCiVisibilityExporter = require('../../../../src/ci-visibility/exporters/agentless')
+const AgentlessCiVisibilityExporterBase = require('../../../../src/ci-visibility/exporters/agentless')
 const DynamicInstrumentationLogsWriter = require('../../../../src/ci-visibility/exporters/agentless/di-logs-writer')
 
+// The real tracer Config always carries a `testOptimization` namespace object.
+// Default it here so the partial config stand-ins below mirror that guarantee.
+class AgentlessCiVisibilityExporter extends AgentlessCiVisibilityExporterBase {
+  constructor (config) {
+    super({ testOptimization: {}, ...config })
+  }
+}
+
 // Used by the negative "no API key" test to inject a stubbed getConfig singleton into
 // the request chain. The stubbed singleton still pulls every other field from the real
 // tracer Config so the rest of the exporter behaves normally.
@@ -53,7 +61,7 @@ describe('CI Visibility Agentless Exporter', () => {
 
   it('can use CI Vis protocol right away', () => {
     const agentlessExporter = new AgentlessCiVisibilityExporter({
-      DD_CIVISIBILITY_AGENTLESS_URL: url, isGitUploadEnabled: true, tags: {},
+      testOptimization: { DD_CIVISIBILITY_AGENTLESS_URL: url, DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true }, tags: {},
     })
     assert.strictEqual(agentlessExporter.canReportSessionTraces(), true)
   })
@@ -73,8 +81,10 @@ describe('CI Visibility Agentless Exporter', () => {
         }))
       const agentlessExporter = new AgentlessCiVisibilityExporter({
         site: 'datadoge.c0m',
-        isGitUploadEnabled: true,
-        isIntelligentTestRunnerEnabled: true,
+        testOptimization: {
+          DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true,
+          DD_CIVISIBILITY_ITR_ENABLED: true,
+        },
         tags: {},
       })
       agentlessExporter.getLibraryConfiguration({}, () => {
@@ -104,8 +114,10 @@ describe('CI Visibility Agentless Exporter', () => {
 
       const agentlessExporter = new AgentlessCiVisibilityExporter({
         site: 'datadoge.c0m',
-        isGitUploadEnabled: true,
-        isIntelligentTestRunnerEnabled: true,
+        testOptimization: {
+          DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true,
+          DD_CIVISIBILITY_ITR_ENABLED: true,
+        },
         tags: {},
       })
       agentlessExporter._resolveGit()
@@ -130,7 +142,12 @@ describe('CI Visibility Agentless Exporter', () => {
           },
         }))
       const agentlessExporter = new AgentlessCiVisibilityExporter({
-        DD_CIVISIBILITY_AGENTLESS_URL: url, isGitUploadEnabled: true, isIntelligentTestRunnerEnabled: true, tags: {},
+        testOptimization: {
+          DD_CIVISIBILITY_AGENTLESS_URL: url,
+          DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true,
+          DD_CIVISIBILITY_ITR_ENABLED: true,
+        },
+        tags: {},
       })
       agentlessExporter.getLibraryConfiguration({}, () => {
         assert.strictEqual(scope.isDone(), true)
@@ -153,7 +170,12 @@ describe('CI Visibility Agentless Exporter', () => {
           },
         }))
       const agentlessExporter = new AgentlessCiVisibilityExporter({
-        DD_CIVISIBILITY_AGENTLESS_URL: url, isGitUploadEnabled: true, isIntelligentTestRunnerEnabled: true, tags: {},
+        testOptimization: {
+          DD_CIVISIBILITY_AGENTLESS_URL: url,
+          DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true,
+          DD_CIVISIBILITY_ITR_ENABLED: true,
+        },
+        tags: {},
       })
       agentlessExporter.getLibraryConfiguration({}, () => {
         assert.strictEqual(scope.isDone(), true)
@@ -163,8 +185,8 @@ describe('CI Visibility Agentless Exporter', () => {
     })
 
     it('will not allow skippable request if ITR configuration fails', (done) => {
-      // Stub apiKey to be missing so the request is never sent.
-      const AgentlessCiVisibilityExporter = loadAgentlessExporterWithFakeConfig({ apiKey: undefined })
+      // Stub the API key to be missing so the request is never sent.
+      const AgentlessCiVisibilityExporter = loadAgentlessExporterWithFakeConfig({ DD_API_KEY: undefined })
 
       const scope = nock('http://www.example.com')
         .post('/api/v2/libraries/tests/services/setting')
@@ -179,7 +201,12 @@ describe('CI Visibility Agentless Exporter', () => {
         }))
 
       const agentlessExporter = new AgentlessCiVisibilityExporter({
-        DD_CIVISIBILITY_AGENTLESS_URL: url, isGitUploadEnabled: true, isIntelligentTestRunnerEnabled: true, tags: {},
+        testOptimization: {
+          DD_CIVISIBILITY_AGENTLESS_URL: url,
+          DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true,
+          DD_CIVISIBILITY_ITR_ENABLED: true,
+        },
+        tags: {},
       })
       agentlessExporter.sendGitMetadata = () => {
         return /** @type {Promise<void>} */ (new Promise(resolve => {
@@ -204,7 +231,7 @@ describe('CI Visibility Agentless Exporter', () => {
     it('should initialise DynamicInstrumentationLogsWriter', async () => {
       const agentProxyCiVisibilityExporter = new AgentlessCiVisibilityExporter({
         tags: {},
-        isTestDynamicInstrumentationEnabled: true,
+        testOptimization: { DD_TEST_FAILED_TEST_REPLAY_ENABLED: true },
       })
       await agentProxyCiVisibilityExporter._canUseCiVisProtocolPromise
       assert.ok(agentProxyCiVisibilityExporter._logsWriter instanceof DynamicInstrumentationLogsWriter)
@@ -217,7 +244,7 @@ describe('CI Visibility Agentless Exporter', () => {
       }
       const agentProxyCiVisibilityExporter = new AgentlessCiVisibilityExporter({
         tags: {},
-        isTestDynamicInstrumentationEnabled: true,
+        testOptimization: { DD_TEST_FAILED_TEST_REPLAY_ENABLED: true },
       })
       await agentProxyCiVisibilityExporter._canUseCiVisProtocolPromise
       agentProxyCiVisibilityExporter._logsWriter = mockWriter
@@ -237,7 +264,7 @@ describe('CI Visibility Agentless Exporter', () => {
 
     it('uses DD_CIVISIBILITY_AGENTLESS_URL as the intake override for every endpoint', () => {
       const agentlessExporter = new AgentlessCiVisibilityExporter({
-        DD_CIVISIBILITY_AGENTLESS_URL: url, site: 'd4tad0g.com', tags: {},
+        testOptimization: { DD_CIVISIBILITY_AGENTLESS_URL: url }, site: 'd4tad0g.com', tags: {},
       })
       assert.strictEqual(agentlessExporter._url.href, 'http://www.example.com/')
       assert.strictEqual(agentlessExporter._coverageUrl.href, 'http://www.example.com/')
diff --git a/packages/dd-trace/test/ci-visibility/exporters/ci-visibility-exporter.spec.js b/packages/dd-trace/test/ci-visibility/exporters/ci-visibility-exporter.spec.js
index 307a819576..0a72264525 100644
--- a/packages/dd-trace/test/ci-visibility/exporters/ci-visibility-exporter.spec.js
+++ b/packages/dd-trace/test/ci-visibility/exporters/ci-visibility-exporter.spec.js
@@ -13,9 +13,17 @@ const nock = require('nock')
 
 const { assertObjectContains } = require('../../../../../integration-tests/helpers')
 require('../../../../dd-trace/test/setup/core')
-const CiVisibilityExporter = require('../../../src/ci-visibility/exporters/ci-visibility-exporter')
+const CiVisibilityExporterBase = require('../../../src/ci-visibility/exporters/ci-visibility-exporter')
 const { defaults: { hostname, port } } = require('../../../src/config/defaults')
 
+// The real tracer Config always carries a `testOptimization` namespace object.
+// Default it here so the partial config stand-ins below mirror that guarantee.
+class CiVisibilityExporter extends CiVisibilityExporterBase {
+  constructor (config) {
+    super({ testOptimization: {}, ...config })
+  }
+}
+
 describe('CI Visibility Exporter', () => {
   const url = new URL(`http://${hostname}:${port}`)
 
@@ -41,7 +49,10 @@ describe('CI Visibility Exporter', () => {
         .post('/api/v2/git/repository/packfile')
         .reply(202, '')
 
-      const ciVisibilityExporter = new CiVisibilityExporter({ url, isGitUploadEnabled: true })
+      const ciVisibilityExporter = new CiVisibilityExporter({
+        url,
+        testOptimization: { DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true },
+      })
 
       ciVisibilityExporter._gitUploadPromise.then((err) => {
         assert.ok(err == null, `Expected ${err} == null`)
@@ -57,7 +68,10 @@ describe('CI Visibility Exporter', () => {
         .post('/api/v2/git/repository/search_commits')
         .reply(404)
 
-      const ciVisibilityExporter = new CiVisibilityExporter({ url, isGitUploadEnabled: true })
+      const ciVisibilityExporter = new CiVisibilityExporter({
+        url,
+        testOptimization: { DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true },
+      })
 
       ciVisibilityExporter._gitUploadPromise.then((err) => {
         assert.match(err.message, /Error fetching commits to exclude/)
@@ -79,7 +93,10 @@ describe('CI Visibility Exporter', () => {
         .post('/api/v2/git/repository/packfile')
         .reply(202, '')
 
-      const ciVisibilityExporter = new CiVisibilityExporter({ url, isGitUploadEnabled: true })
+      const ciVisibilityExporter = new CiVisibilityExporter({
+        url,
+        testOptimization: { DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true },
+      })
 
       ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
       ciVisibilityExporter.sendGitMetadata('https://custom-git@datadog.com')
@@ -96,7 +113,10 @@ describe('CI Visibility Exporter', () => {
         .post('/api/v2/git/repository/packfile')
         .reply(202, '')
 
-      const ciVisibilityExporter = new CiVisibilityExporter({ url, isGitUploadEnabled: true })
+      const ciVisibilityExporter = new CiVisibilityExporter({
+        url,
+        testOptimization: { DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true },
+      })
       ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
       ciVisibilityExporter.getLibraryConfiguration({}, () => {})
       ciVisibilityExporter._gitUploadPromise.then(() => {
@@ -125,7 +145,7 @@ describe('CI Visibility Exporter', () => {
 
         const ciVisibilityExporter = new CiVisibilityExporter({
           url,
-          isIntelligentTestRunnerEnabled: true,
+          testOptimization: { DD_CIVISIBILITY_ITR_ENABLED: true },
           tags: {
             'test.configuration.my_custom_config': 'my_custom_config_value',
           },
@@ -159,7 +179,7 @@ describe('CI Visibility Exporter', () => {
           }))
         const ciVisibilityExporter = new CiVisibilityExporter({
           url,
-          isIntelligentTestRunnerEnabled: true,
+          testOptimization: { DD_CIVISIBILITY_ITR_ENABLED: true },
         })
         const testConfiguration = {
           tag: 'v1.0.0',
@@ -193,7 +213,10 @@ describe('CI Visibility Exporter', () => {
             },
           }))
 
-        const ciVisibilityExporter = new CiVisibilityExporter({ url, isIntelligentTestRunnerEnabled: true })
+        const ciVisibilityExporter = new CiVisibilityExporter({
+          url,
+          testOptimization: { DD_CIVISIBILITY_ITR_ENABLED: true },
+        })
 
         ciVisibilityExporter.getLibraryConfiguration({}, (err, libraryConfig) => {
           assertObjectContains(libraryConfig, {
@@ -223,7 +246,10 @@ describe('CI Visibility Exporter', () => {
             },
           }))
 
-        const ciVisibilityExporter = new CiVisibilityExporter({ url, isIntelligentTestRunnerEnabled: true })
+        const ciVisibilityExporter = new CiVisibilityExporter({
+          url,
+          testOptimization: { DD_CIVISIBILITY_ITR_ENABLED: true },
+        })
         assert.strictEqual(ciVisibilityExporter.shouldRequestSkippableSuites(), false)
 
         ciVisibilityExporter.getLibraryConfiguration({}, () => {
@@ -258,7 +284,7 @@ describe('CI Visibility Exporter', () => {
           }))
 
         const ciVisibilityExporter = new CiVisibilityExporter({
-          url, isIntelligentTestRunnerEnabled: true,
+          url, testOptimization: { DD_CIVISIBILITY_ITR_ENABLED: true },
         })
         ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
         ciVisibilityExporter.getLibraryConfiguration({}, (err, libraryConfig) => {
@@ -299,7 +325,7 @@ describe('CI Visibility Exporter', () => {
           }))
 
         const ciVisibilityExporter = new CiVisibilityExporter({
-          url, isIntelligentTestRunnerEnabled: true,
+          url, testOptimization: { DD_CIVISIBILITY_ITR_ENABLED: true },
         })
         ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
         ciVisibilityExporter.getLibraryConfiguration({}, (err, libraryConfig) => {
@@ -336,7 +362,10 @@ describe('CI Visibility Exporter', () => {
           .post('/api/v2/ci/tests/skippable')
           .reply(200)
 
-        const ciVisibilityExporter = new CiVisibilityExporter({ url, isIntelligentTestRunnerEnabled: true })
+        const ciVisibilityExporter = new CiVisibilityExporter({
+          url,
+          testOptimization: { DD_CIVISIBILITY_ITR_ENABLED: true },
+        })
 
         ciVisibilityExporter._resolveCanUseCiVisProtocol(false)
         ciVisibilityExporter._resolveGit()
@@ -377,8 +406,10 @@ describe('CI Visibility Exporter', () => {
 
         const ciVisibilityExporter = new CiVisibilityExporter({
           url,
-          isIntelligentTestRunnerEnabled: true,
-          isGitUploadEnabled: true,
+          testOptimization: {
+            DD_CIVISIBILITY_ITR_ENABLED: true,
+            DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true,
+          },
           tags: {
             'test.configuration.my_custom_config_2': 'my_custom_config_value_2',
           },
@@ -421,8 +452,10 @@ describe('CI Visibility Exporter', () => {
 
         const ciVisibilityExporter = new CiVisibilityExporter({
           url,
-          isIntelligentTestRunnerEnabled: true,
-          isGitUploadEnabled: true,
+          testOptimization: {
+            DD_CIVISIBILITY_ITR_ENABLED: true,
+            DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true,
+          },
         })
 
         ciVisibilityExporter._libraryConfig = { isSuitesSkippingEnabled: true }
@@ -443,7 +476,10 @@ describe('CI Visibility Exporter', () => {
           .post('/api/v2/ci/tests/skippable')
           .reply(200)
 
-        const ciVisibilityExporter = new CiVisibilityExporter({ url, isIntelligentTestRunnerEnabled: true })
+        const ciVisibilityExporter = new CiVisibilityExporter({
+          url,
+          testOptimization: { DD_CIVISIBILITY_ITR_ENABLED: true },
+        })
 
         ciVisibilityExporter._libraryConfig = { isSuitesSkippingEnabled: true }
         ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
@@ -491,8 +527,10 @@ describe('CI Visibility Exporter', () => {
           })
         const ciVisibilityExporter = new CiVisibilityExporter({
           url,
-          isIntelligentTestRunnerEnabled: true,
-          isGitUploadEnabled: true,
+          testOptimization: {
+            DD_CIVISIBILITY_ITR_ENABLED: true,
+            DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true,
+          },
         })
         ciVisibilityExporter._libraryConfig = { isSuitesSkippingEnabled: true }
         ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
@@ -538,8 +576,10 @@ describe('CI Visibility Exporter', () => {
           })
         const ciVisibilityExporter = new CiVisibilityExporter({
           url,
-          isIntelligentTestRunnerEnabled: true,
-          isGitUploadEnabled: true,
+          testOptimization: {
+            DD_CIVISIBILITY_ITR_ENABLED: true,
+            DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true,
+          },
         })
         ciVisibilityExporter._libraryConfig = { isSuitesSkippingEnabled: true }
         ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
@@ -766,9 +806,16 @@ describe('CI Visibility Exporter', () => {
       })
 
       it('should return an error if the request fails', (done) => {
+        // A 5xx triggers one jittered 5–7.5 s retry in the request helper, so the endpoint is
+        // hit twice and the retry delay must collapse to 0 ms to stay under the mocha timeout.
+        const realSetTimeout = setTimeout
+        sinon.stub(global, 'setTimeout').callsFake((fn, delay, ...args) =>
+          realSetTimeout(fn, delay > 100 ? 0 : delay, ...args))
         const scope = nock(url)
           .post('/api/v2/ci/libraries/tests')
           .reply(500)
+          .post('/api/v2/ci/libraries/tests')
+          .reply(500)
         const ciVisibilityExporter = new CiVisibilityExporter({ url })
 
         ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
@@ -1025,7 +1072,7 @@ describe('CI Visibility Exporter', () => {
         const log = { message: 'log' }
         const ciVisibilityExporter = new CiVisibilityExporter({
           url,
-          isTestDynamicInstrumentationEnabled: true,
+          testOptimization: { DD_TEST_FAILED_TEST_REPLAY_ENABLED: true },
         })
         ciVisibilityExporter.exportDiLogs(log)
         ciVisibilityExporter._export = sinon.spy()
@@ -1043,7 +1090,7 @@ describe('CI Visibility Exporter', () => {
         const log = { message: 'log' }
         const ciVisibilityExporter = new CiVisibilityExporter({
           url,
-          isTestDynamicInstrumentationEnabled: true,
+          testOptimization: { DD_TEST_FAILED_TEST_REPLAY_ENABLED: true },
         })
         ciVisibilityExporter._isInitialized = true
         ciVisibilityExporter._logsWriter = writer
@@ -1089,7 +1136,7 @@ describe('CI Visibility Exporter', () => {
           env: 'ci',
           version: '1.0.0',
           url,
-          isTestDynamicInstrumentationEnabled: true,
+          testOptimization: { DD_TEST_FAILED_TEST_REPLAY_ENABLED: true },
           service: 'my-service',
         })
         ciVisibilityExporter._isInitialized = true
diff --git a/packages/dd-trace/test/ci-visibility/exporters/ci-visibility-http-cache.spec.js b/packages/dd-trace/test/ci-visibility/exporters/ci-visibility-http-cache.spec.js
new file mode 100644
index 0000000000..74aa42ea04
--- /dev/null
+++ b/packages/dd-trace/test/ci-visibility/exporters/ci-visibility-http-cache.spec.js
@@ -0,0 +1,622 @@
+'use strict'
+
+const assert = require('node:assert/strict')
+const fs = require('node:fs')
+const os = require('node:os')
+const path = require('node:path')
+
+const { describe, it, beforeEach, afterEach } = require('mocha')
+const nock = require('nock')
+const proxyquire = require('proxyquire').noPreserveCache()
+
+require('../../setup/core')
+
+const getConfig = require('../../../src/config')
+const CiVisibilityExporterBase = require('../../../src/ci-visibility/exporters/ci-visibility-exporter')
+const { defaults: { hostname, port } } = require('../../../src/config/defaults')
+
+const ALL_FEATURE_GATES_ENABLED = {
+  DD_CIVISIBILITY_EARLY_FLAKE_DETECTION_ENABLED: true,
+  DD_CIVISIBILITY_FLAKY_RETRY_ENABLED: true,
+  DD_CIVISIBILITY_IMPACTED_TESTS_DETECTION_ENABLED: true,
+  DD_CIVISIBILITY_ITR_ENABLED: true,
+  DD_TEST_FAILED_TEST_REPLAY_ENABLED: true,
+  DD_TEST_MANAGEMENT_ENABLED: true,
+}
+
+const ITR_FEATURE_GATE_ENABLED = {
+  DD_CIVISIBILITY_ITR_ENABLED: true,
+}
+
+const TEST_MANAGEMENT_FEATURE_GATE_ENABLED = {
+  DD_TEST_MANAGEMENT_ENABLED: true,
+}
+
+function withTestOptimizationDefaults (Exporter) {
+  return class CiVisibilityExporter extends Exporter {
+    constructor (config = {}) {
+      super({ testOptimization: {}, ...config })
+    }
+  }
+}
+
+const CiVisibilityExporter = withTestOptimizationDefaults(CiVisibilityExporterBase)
+
+const SETTINGS_RESPONSE = {
+  data: {
+    attributes: {
+      code_coverage: true,
+      tests_skipping: true,
+      itr_enabled: true,
+      require_git: true,
+      early_flake_detection: {
+        enabled: true,
+        slow_test_retries: {
+          '5s': 4,
+        },
+        faulty_session_threshold: 12,
+      },
+      flaky_test_retries_enabled: true,
+      di_enabled: true,
+      known_tests_enabled: true,
+      test_management: {
+        enabled: true,
+        attempt_to_fix_retries: 8,
+      },
+      impacted_tests_enabled: true,
+      coverage_report_upload_enabled: true,
+    },
+  },
+}
+
+const KNOWN_TESTS_RESPONSE = {
+  data: {
+    attributes: {
+      tests: {
+        jest: {
+          'suite1.spec.js': ['test1'],
+        },
+      },
+    },
+  },
+}
+
+const SKIPPABLE_RESPONSE = {
+  meta: {
+    correlation_id: 'corr-123',
+    coverage: {
+      'src/file.js': 'gA==',
+    },
+  },
+  data: [
+    { type: 'suite', attributes: { suite: 'suite1.spec.js' } },
+  ],
+}
+
+const TEST_MANAGEMENT_RESPONSE = {
+  data: {
+    attributes: {
+      modules: {
+        jest: {
+          suites: {
+            'suite1.spec.js': {
+              tests: {
+                test1: { properties: { disabled: true } },
+              },
+            },
+          },
+        },
+      },
+    },
+  },
+}
+
+function writeCacheLayout (root, options = {}) {
+  const {
+    settings = SETTINGS_RESPONSE,
+    knownTests = KNOWN_TESTS_RESPONSE,
+    skippableTests = SKIPPABLE_RESPONSE,
+    testManagement = TEST_MANAGEMENT_RESPONSE,
+  } = options
+  const httpCachePath = path.join(root, '.testoptimization', 'cache', 'http')
+  fs.mkdirSync(httpCachePath, { recursive: true })
+  fs.writeFileSync(path.join(root, '.testoptimization', 'manifest.txt'), '1\n')
+  if (settings !== undefined) {
+    fs.writeFileSync(path.join(httpCachePath, 'settings.json'), JSON.stringify(settings))
+  }
+  if (knownTests !== undefined) {
+    fs.writeFileSync(path.join(httpCachePath, 'known_tests.json'), JSON.stringify(knownTests))
+  }
+  if (skippableTests !== undefined) {
+    fs.writeFileSync(path.join(httpCachePath, 'skippable_tests.json'), JSON.stringify(skippableTests))
+  }
+  if (testManagement !== undefined) {
+    fs.writeFileSync(path.join(httpCachePath, 'test_management.json'), JSON.stringify(testManagement))
+  }
+}
+
+function loadCiVisibilityExporterWithGitUpload (sendGitMetadata) {
+  const Exporter = proxyquire('../../../src/ci-visibility/exporters/ci-visibility-exporter', {
+    './git/git_metadata': {
+      sendGitMetadata,
+    },
+  })
+  return withTestOptimizationDefaults(Exporter)
+}
+
+describe('CI Visibility Exporter Test Optimization HTTP cache', () => {
+  const url = new URL(`http://${hostname}:${port}`)
+
+  let previousCwd
+  let previousSettingsCachePath
+  let tmpRoot
+
+  beforeEach(() => {
+    previousCwd = process.cwd()
+    previousSettingsCachePath = process.env.DD_EXPERIMENTAL_TEST_OPT_SETTINGS_CACHE
+    tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'dd-js-exporter-http-cache-'))
+    writeCacheLayout(tmpRoot)
+    process.chdir(tmpRoot)
+    delete process.env.DD_API_KEY
+    delete process.env.DD_EXPERIMENTAL_TEST_OPT_SETTINGS_CACHE
+    getConfig().DD_API_KEY = undefined
+    nock.cleanAll()
+  })
+
+  afterEach(() => {
+    process.chdir(previousCwd)
+    fs.rmSync(tmpRoot, { recursive: true, force: true })
+    process.env.DD_API_KEY = '1'
+    if (previousSettingsCachePath === undefined) {
+      delete process.env.DD_EXPERIMENTAL_TEST_OPT_SETTINGS_CACHE
+    } else {
+      process.env.DD_EXPERIMENTAL_TEST_OPT_SETTINGS_CACHE = previousSettingsCachePath
+    }
+    getConfig().DD_API_KEY = '1'
+    nock.cleanAll()
+  })
+
+  it('uses cached settings without an API key or settings HTTP request', (done) => {
+    const settingsScope = nock(url)
+      .post('/api/v2/libraries/tests/services/setting')
+      .reply(200, {})
+
+    const ciVisibilityExporter = new CiVisibilityExporter({
+      url,
+      testOptimization: ALL_FEATURE_GATES_ENABLED,
+    })
+
+    ciVisibilityExporter.getLibraryConfiguration({}, (err, libraryConfig) => {
+      assert.strictEqual(err, null)
+      assert.strictEqual(libraryConfig.requireGit, true)
+      assert.strictEqual(libraryConfig.isCodeCoverageEnabled, true)
+      assert.strictEqual(libraryConfig.isSuitesSkippingEnabled, true)
+      assert.strictEqual(libraryConfig.isEarlyFlakeDetectionEnabled, true)
+      assert.strictEqual(libraryConfig.isTestManagementEnabled, true)
+      assert.strictEqual(libraryConfig.isImpactedTestsEnabled, true)
+      assert.strictEqual(libraryConfig.isCoverageReportUploadEnabled, true)
+      assert.strictEqual(settingsScope.isDone(), false)
+      done()
+    })
+    ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
+  })
+
+  it('writes cached settings to the nyc settings handoff cache', (done) => {
+    const settingsCachePath = path.join(tmpRoot, 'nyc-settings.json')
+    process.env.DD_EXPERIMENTAL_TEST_OPT_SETTINGS_CACHE = settingsCachePath
+
+    const ciVisibilityExporter = new CiVisibilityExporter({
+      url,
+      testOptimization: ALL_FEATURE_GATES_ENABLED,
+    })
+
+    ciVisibilityExporter.getLibraryConfiguration({}, (err, libraryConfig) => {
+      try {
+        assert.strictEqual(err, null)
+        assert.strictEqual(libraryConfig.isCoverageReportUploadEnabled, true)
+
+        const cachedSettings = JSON.parse(fs.readFileSync(settingsCachePath, 'utf8'))
+        assert.strictEqual(cachedSettings.isCoverageReportUploadEnabled, true)
+        assert.strictEqual(cachedSettings.isCodeCoverageEnabled, true)
+        assert.strictEqual(cachedSettings.requireGit, true)
+        done()
+      } catch (err) {
+        done(err)
+      }
+    })
+    ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
+  })
+
+  it('falls back to live settings when cached settings are missing', (done) => {
+    fs.rmSync(path.join(tmpRoot, '.testoptimization', 'cache', 'http', 'settings.json'))
+    const liveSettingsResponse = JSON.parse(JSON.stringify(SETTINGS_RESPONSE))
+    liveSettingsResponse.data.attributes.require_git = false
+    getConfig().DD_API_KEY = '1'
+
+    const settingsScope = nock(url)
+      .post('/api/v2/libraries/tests/services/setting')
+      .reply(200, JSON.stringify(liveSettingsResponse))
+
+    const ciVisibilityExporter = new CiVisibilityExporter({
+      url,
+      testOptimization: ALL_FEATURE_GATES_ENABLED,
+    })
+
+    ciVisibilityExporter.getLibraryConfiguration({
+      repositoryUrl: 'https://github.com/example/repo',
+    }, (err, libraryConfig) => {
+      assert.strictEqual(err, null)
+      assert.strictEqual(libraryConfig.requireGit, false)
+      assert.strictEqual(libraryConfig.isCodeCoverageEnabled, true)
+      assert.strictEqual(libraryConfig.isSuitesSkippingEnabled, true)
+      assert.strictEqual(libraryConfig.isEarlyFlakeDetectionEnabled, true)
+      assert.strictEqual(libraryConfig.isKnownTestsEnabled, true)
+      assert.strictEqual(libraryConfig.isTestManagementEnabled, true)
+      assert.strictEqual(libraryConfig.isImpactedTestsEnabled, true)
+      assert.strictEqual(libraryConfig.isCoverageReportUploadEnabled, true)
+      assert.strictEqual(settingsScope.isDone(), true)
+      done()
+    })
+    ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
+  })
+
+  it('falls back to live settings when cached settings are missing required attributes', (done) => {
+    fs.writeFileSync(
+      path.join(tmpRoot, '.testoptimization', 'cache', 'http', 'settings.json'),
+      JSON.stringify({ data: { attributes: { itr_enabled: true } } })
+    )
+    const liveSettingsResponse = JSON.parse(JSON.stringify(SETTINGS_RESPONSE))
+    liveSettingsResponse.data.attributes.require_git = false
+    getConfig().DD_API_KEY = '1'
+
+    const settingsScope = nock(url)
+      .post('/api/v2/libraries/tests/services/setting')
+      .reply(200, JSON.stringify(liveSettingsResponse))
+
+    const ciVisibilityExporter = new CiVisibilityExporter({
+      url,
+      testOptimization: ALL_FEATURE_GATES_ENABLED,
+    })
+
+    ciVisibilityExporter.getLibraryConfiguration({
+      repositoryUrl: 'https://github.com/example/repo',
+    }, (err, libraryConfig) => {
+      assert.strictEqual(err, null)
+      assert.strictEqual(libraryConfig.requireGit, false)
+      assert.strictEqual(libraryConfig.isCodeCoverageEnabled, true)
+      assert.strictEqual(libraryConfig.isSuitesSkippingEnabled, true)
+      assert.strictEqual(libraryConfig.isEarlyFlakeDetectionEnabled, true)
+      assert.strictEqual(libraryConfig.isKnownTestsEnabled, true)
+      assert.strictEqual(libraryConfig.isTestManagementEnabled, true)
+      assert.strictEqual(libraryConfig.isImpactedTestsEnabled, true)
+      assert.strictEqual(libraryConfig.isCoverageReportUploadEnabled, true)
+      assert.strictEqual(settingsScope.isDone(), true)
+      done()
+    })
+    ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
+  })
+
+  it('skips git metadata upload after cached settings are read', (done) => {
+    const gitScope = nock(url)
+      .post('/api/v2/git/repository/search_commits')
+      .reply(200, { data: [] })
+
+    const ciVisibilityExporter = new CiVisibilityExporter({
+      url,
+      testOptimization: {
+        DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true,
+        DD_CIVISIBILITY_ITR_ENABLED: true,
+      },
+    })
+
+    ciVisibilityExporter.getLibraryConfiguration({}, (err, libraryConfig) => {
+      assert.strictEqual(err, null)
+      assert.strictEqual(libraryConfig.requireGit, true)
+      ciVisibilityExporter._gitUploadPromise.then((gitUploadError) => {
+        assert.strictEqual(gitUploadError, undefined)
+        assert.strictEqual(gitScope.isDone(), false)
+        done()
+      })
+    })
+    ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
+  })
+
+  it('uploads git metadata before retrying live settings when cached settings are malformed', (done) => {
+    fs.writeFileSync(path.join(tmpRoot, '.testoptimization', 'cache', 'http', 'settings.json'), '{invalid json')
+    getConfig().DD_API_KEY = '1'
+
+    const firstLiveSettingsResponse = JSON.parse(JSON.stringify(SETTINGS_RESPONSE))
+    firstLiveSettingsResponse.data.attributes.require_git = true
+    const finalLiveSettingsResponse = JSON.parse(JSON.stringify(SETTINGS_RESPONSE))
+    finalLiveSettingsResponse.data.attributes.require_git = false
+
+    let gitUploadCalls = 0
+    let hasUploadedGit = false
+    let uploadedRepositoryUrl
+    let secondSettingsRequestSawGitUploaded = false
+    const GitUploadingCiVisibilityExporter = loadCiVisibilityExporterWithGitUpload(
+      (_url, _options, repositoryUrl, callback) => {
+        gitUploadCalls++
+        uploadedRepositoryUrl = repositoryUrl
+        setImmediate(() => {
+          hasUploadedGit = true
+          callback()
+        })
+      })
+
+    const settingsScope = nock(url)
+      .post('/api/v2/libraries/tests/services/setting')
+      .reply(200, JSON.stringify(firstLiveSettingsResponse))
+      .post('/api/v2/libraries/tests/services/setting', () => {
+        secondSettingsRequestSawGitUploaded = hasUploadedGit
+        return true
+      })
+      .reply(200, JSON.stringify(finalLiveSettingsResponse))
+
+    const ciVisibilityExporter = new GitUploadingCiVisibilityExporter({
+      url,
+      testOptimization: {
+        ...ALL_FEATURE_GATES_ENABLED,
+        DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true,
+      },
+    })
+
+    ciVisibilityExporter.getLibraryConfiguration({
+      repositoryUrl: 'https://github.com/example/repo',
+    }, (err, libraryConfig) => {
+      assert.strictEqual(err, null)
+      assert.strictEqual(libraryConfig.requireGit, false)
+      assert.strictEqual(gitUploadCalls, 1)
+      assert.strictEqual(uploadedRepositoryUrl, 'https://github.com/example/repo')
+      assert.strictEqual(secondSettingsRequestSawGitUploaded, true)
+      assert.strictEqual(settingsScope.isDone(), true)
+      done()
+    })
+    ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
+  })
+
+  it('uses cached known tests without an API key or known-tests HTTP request', (done) => {
+    const knownTestsScope = nock(url)
+      .post('/api/v2/ci/libraries/tests')
+      .reply(200, {})
+
+    const ciVisibilityExporter = new CiVisibilityExporter({ url })
+    ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
+    ciVisibilityExporter._libraryConfig = { isKnownTestsEnabled: true }
+
+    ciVisibilityExporter.getKnownTests({}, (err, knownTests) => {
+      assert.strictEqual(err, null)
+      assert.deepStrictEqual(knownTests, KNOWN_TESTS_RESPONSE.data.attributes.tests)
+      assert.strictEqual(knownTestsScope.isDone(), false)
+      done()
+    })
+  })
+
+  it('falls back to live known tests when cached known tests are missing', (done) => {
+    fs.rmSync(path.join(tmpRoot, '.testoptimization', 'cache', 'http', 'known_tests.json'))
+    getConfig().DD_API_KEY = '1'
+    const knownTestsScope = nock(url)
+      .post('/api/v2/ci/libraries/tests')
+      .reply(200, JSON.stringify(KNOWN_TESTS_RESPONSE))
+
+    const ciVisibilityExporter = new CiVisibilityExporter({ url })
+    ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
+    ciVisibilityExporter._libraryConfig = { isKnownTestsEnabled: true }
+
+    ciVisibilityExporter.getKnownTests({}, (err, knownTests) => {
+      assert.strictEqual(err, null)
+      assert.deepStrictEqual(knownTests, KNOWN_TESTS_RESPONSE.data.attributes.tests)
+      assert.strictEqual(knownTestsScope.isDone(), true)
+      done()
+    })
+  })
+
+  it('falls back to live known tests when cached known tests are malformed', (done) => {
+    fs.writeFileSync(
+      path.join(tmpRoot, '.testoptimization', 'cache', 'http', 'known_tests.json'),
+      JSON.stringify({ data: { attributes: {} } })
+    )
+    getConfig().DD_API_KEY = '1'
+    const knownTestsScope = nock(url)
+      .post('/api/v2/ci/libraries/tests')
+      .reply(200, JSON.stringify(KNOWN_TESTS_RESPONSE))
+
+    const ciVisibilityExporter = new CiVisibilityExporter({ url })
+    ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
+    ciVisibilityExporter._libraryConfig = { isKnownTestsEnabled: true }
+
+    ciVisibilityExporter.getKnownTests({}, (err, knownTests) => {
+      assert.strictEqual(err, null)
+      assert.deepStrictEqual(knownTests, KNOWN_TESTS_RESPONSE.data.attributes.tests)
+      assert.strictEqual(knownTestsScope.isDone(), true)
+      done()
+    })
+  })
+
+  it('uses cached skippable tests without waiting on git upload', (done) => {
+    const skippableScope = nock(url)
+      .post('/api/v2/ci/tests/skippable')
+      .reply(200, {})
+
+    const ciVisibilityExporter = new CiVisibilityExporter({ url, testOptimization: ITR_FEATURE_GATE_ENABLED })
+    ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
+    ciVisibilityExporter._libraryConfig = { isSuitesSkippingEnabled: true }
+
+    ciVisibilityExporter.getSkippableSuites({}, (err, skippableSuites, correlationId, coverage) => {
+      assert.strictEqual(err, null)
+      assert.deepStrictEqual(skippableSuites, ['suite1.spec.js'])
+      assert.strictEqual(correlationId, 'corr-123')
+      assert.deepStrictEqual(coverage, { 'src/file.js': 'gA==' })
+      assert.strictEqual(skippableScope.isDone(), false)
+      done()
+    })
+  })
+
+  it('falls back to live skippable tests when cached skippable tests are missing', (done) => {
+    fs.rmSync(path.join(tmpRoot, '.testoptimization', 'cache', 'http', 'skippable_tests.json'))
+    getConfig().DD_API_KEY = '1'
+    let gitUploadCalls = 0
+    let hasUploadedGit = false
+    let uploadedRepositoryUrl
+    let skippableRequestSawGitUploaded = false
+    const GitUploadingCiVisibilityExporter = loadCiVisibilityExporterWithGitUpload(
+      (_url, _options, repositoryUrl, callback) => {
+        gitUploadCalls++
+        uploadedRepositoryUrl = repositoryUrl
+        setImmediate(() => {
+          hasUploadedGit = true
+          callback()
+        })
+      })
+    const skippableScope = nock(url)
+      .post('/api/v2/ci/tests/skippable', () => {
+        skippableRequestSawGitUploaded = hasUploadedGit
+        return true
+      })
+      .reply(200, JSON.stringify(SKIPPABLE_RESPONSE))
+
+    const ciVisibilityExporter = new GitUploadingCiVisibilityExporter({
+      url,
+      testOptimization: {
+        DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true,
+        DD_CIVISIBILITY_ITR_ENABLED: true,
+      },
+    })
+    ciVisibilityExporter.getLibraryConfiguration({
+      repositoryUrl: 'https://github.com/example/repo',
+    }, (settingsErr) => {
+      assert.strictEqual(settingsErr, null)
+      ciVisibilityExporter.getSkippableSuites({}, (err, skippableSuites, correlationId, coverage) => {
+        assert.strictEqual(err, null)
+        assert.deepStrictEqual(skippableSuites, ['suite1.spec.js'])
+        assert.strictEqual(correlationId, 'corr-123')
+        assert.deepStrictEqual(coverage, { 'src/file.js': 'gA==' })
+        assert.strictEqual(gitUploadCalls, 1)
+        assert.strictEqual(uploadedRepositoryUrl, 'https://github.com/example/repo')
+        assert.strictEqual(skippableRequestSawGitUploaded, true)
+        assert.strictEqual(skippableScope.isDone(), true)
+        done()
+      })
+    })
+    ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
+  })
+
+  it('falls back to live skippable tests when cached skippable tests are malformed', (done) => {
+    fs.writeFileSync(
+      path.join(tmpRoot, '.testoptimization', 'cache', 'http', 'skippable_tests.json'),
+      JSON.stringify({ data: [{ type: 'suite', attributes: {} }] })
+    )
+    getConfig().DD_API_KEY = '1'
+    let gitUploadCalls = 0
+    let hasUploadedGit = false
+    let uploadedRepositoryUrl
+    let skippableRequestSawGitUploaded = false
+    const GitUploadingCiVisibilityExporter = loadCiVisibilityExporterWithGitUpload(
+      (_url, _options, repositoryUrl, callback) => {
+        gitUploadCalls++
+        uploadedRepositoryUrl = repositoryUrl
+        setImmediate(() => {
+          hasUploadedGit = true
+          callback()
+        })
+      })
+    const skippableScope = nock(url)
+      .post('/api/v2/ci/tests/skippable', () => {
+        skippableRequestSawGitUploaded = hasUploadedGit
+        return true
+      })
+      .reply(200, JSON.stringify(SKIPPABLE_RESPONSE))
+
+    const ciVisibilityExporter = new GitUploadingCiVisibilityExporter({
+      url,
+      testOptimization: {
+        DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true,
+        DD_CIVISIBILITY_ITR_ENABLED: true,
+      },
+    })
+    ciVisibilityExporter.getLibraryConfiguration({
+      repositoryUrl: 'https://github.com/example/repo',
+    }, (settingsErr) => {
+      assert.strictEqual(settingsErr, null)
+      ciVisibilityExporter.getSkippableSuites({}, (err, skippableSuites, correlationId, coverage) => {
+        assert.strictEqual(err, null)
+        assert.deepStrictEqual(skippableSuites, ['suite1.spec.js'])
+        assert.strictEqual(correlationId, 'corr-123')
+        assert.deepStrictEqual(coverage, { 'src/file.js': 'gA==' })
+        assert.strictEqual(gitUploadCalls, 1)
+        assert.strictEqual(uploadedRepositoryUrl, 'https://github.com/example/repo')
+        assert.strictEqual(skippableRequestSawGitUploaded, true)
+        assert.strictEqual(skippableScope.isDone(), true)
+        done()
+      })
+    })
+    ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
+  })
+
+  it('uses cached test management tests without an API key or test-management HTTP request', (done) => {
+    const testManagementScope = nock(url)
+      .post('/api/v2/test/libraries/test-management/tests')
+      .reply(200, {})
+
+    const ciVisibilityExporter = new CiVisibilityExporter({
+      url,
+      testOptimization: TEST_MANAGEMENT_FEATURE_GATE_ENABLED,
+    })
+    ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
+    ciVisibilityExporter._libraryConfig = { isTestManagementEnabled: true }
+
+    ciVisibilityExporter.getTestManagementTests({}, (err, tests) => {
+      assert.strictEqual(err, null)
+      assert.deepStrictEqual(tests, TEST_MANAGEMENT_RESPONSE.data.attributes.modules)
+      assert.strictEqual(testManagementScope.isDone(), false)
+      done()
+    })
+  })
+
+  it('falls back to live test management tests when cached test management tests are malformed', (done) => {
+    fs.writeFileSync(
+      path.join(tmpRoot, '.testoptimization', 'cache', 'http', 'test_management.json'),
+      JSON.stringify({ data: { attributes: {} } })
+    )
+    getConfig().DD_API_KEY = '1'
+    const testManagementScope = nock(url)
+      .post('/api/v2/test/libraries/test-management/tests')
+      .reply(200, JSON.stringify(TEST_MANAGEMENT_RESPONSE))
+
+    const ciVisibilityExporter = new CiVisibilityExporter({
+      url,
+      testOptimization: TEST_MANAGEMENT_FEATURE_GATE_ENABLED,
+    })
+    ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
+    ciVisibilityExporter._libraryConfig = { isTestManagementEnabled: true }
+
+    ciVisibilityExporter.getTestManagementTests({}, (err, tests) => {
+      assert.strictEqual(err, null)
+      assert.deepStrictEqual(tests, TEST_MANAGEMENT_RESPONSE.data.attributes.modules)
+      assert.strictEqual(testManagementScope.isDone(), true)
+      done()
+    })
+  })
+
+  it('falls back to live test management tests when cached test management tests are missing', (done) => {
+    fs.rmSync(path.join(tmpRoot, '.testoptimization', 'cache', 'http', 'test_management.json'))
+    getConfig().DD_API_KEY = '1'
+    const testManagementScope = nock(url)
+      .post('/api/v2/test/libraries/test-management/tests')
+      .reply(200, JSON.stringify(TEST_MANAGEMENT_RESPONSE))
+
+    const ciVisibilityExporter = new CiVisibilityExporter({
+      url,
+      testOptimization: TEST_MANAGEMENT_FEATURE_GATE_ENABLED,
+    })
+    ciVisibilityExporter._resolveCanUseCiVisProtocol(true)
+    ciVisibilityExporter._libraryConfig = { isTestManagementEnabled: true }
+
+    ciVisibilityExporter.getTestManagementTests({}, (err, tests) => {
+      assert.strictEqual(err, null)
+      assert.deepStrictEqual(tests, TEST_MANAGEMENT_RESPONSE.data.attributes.modules)
+      assert.strictEqual(testManagementScope.isDone(), true)
+      done()
+    })
+  })
+})
diff --git a/packages/dd-trace/test/ci-visibility/exporters/git/git_metadata.spec.js b/packages/dd-trace/test/ci-visibility/exporters/git/git_metadata.spec.js
index 09d7c20fa2..e20626636e 100644
--- a/packages/dd-trace/test/ci-visibility/exporters/git/git_metadata.spec.js
+++ b/packages/dd-trace/test/ci-visibility/exporters/git/git_metadata.spec.js
@@ -60,7 +60,7 @@ describe('git_metadata', () => {
 
     generatePackFilesForCommitsStub = sinon.stub().returns([temporaryPackFile])
 
-    fakeConfig = { apiKey: 'api-key', DD_CIVISIBILITY_GIT_UNSHALLOW_ENABLED: true }
+    fakeConfig = { DD_API_KEY: 'api-key', testOptimization: { DD_CIVISIBILITY_GIT_UNSHALLOW_ENABLED: true } }
 
     // Most tests inject requestStub directly so they never touch nock or the
     // real HTTP stack. This avoids the Windows CI hang caused by nock's
@@ -132,7 +132,7 @@ describe('git_metadata', () => {
   })
 
   it('should not unshallow if the parameter to enable unshallow is false', (done) => {
-    fakeConfig.DD_CIVISIBILITY_GIT_UNSHALLOW_ENABLED = false
+    fakeConfig.testOptimization.DD_CIVISIBILITY_GIT_UNSHALLOW_ENABLED = false
     requestStub.onCall(0).callsArgWith(2, null, JSON.stringify({ data: [] }), 200)
     requestStub.onCall(1).callsArgWith(2, null, JSON.stringify({ data: [] }), 200)
     requestStub.onCall(2).callsArgWith(2, null, '', 204)
diff --git a/packages/dd-trace/test/ci-visibility/exporters/test-worker/exporter.spec.js b/packages/dd-trace/test/ci-visibility/exporters/test-worker/exporter.spec.js
index 4968b37469..783e5b3926 100644
--- a/packages/dd-trace/test/ci-visibility/exporters/test-worker/exporter.spec.js
+++ b/packages/dd-trace/test/ci-visibility/exporters/test-worker/exporter.spec.js
@@ -160,6 +160,7 @@ describe('CI Visibility Test Worker Exporter', () => {
     afterEach(() => {
       delete process.env.DD_VITEST_WORKER
       delete process.env.TINYPOOL_WORKER_ID
+      delete globalThis.__vitest_worker__
     })
 
     it('can export traces (vitest >=4)', () => {
@@ -186,6 +187,25 @@ describe('CI Visibility Test Worker Exporter', () => {
       })
     })
 
+    it('can export traces through the worker port in legacy thread workers (vitest <4)', () => {
+      process.env.DD_VITEST_WORKER = '1'
+      delete process.send
+      const postMessage = sinon.spy()
+      const trace = [{ type: 'test' }]
+      globalThis.__vitest_worker__ = {
+        ctx: {
+          port: {
+            postMessage,
+          },
+        },
+      }
+      const vitestWorkerExporter = new TestWorkerCiVisibilityExporter()
+      vitestWorkerExporter.export(trace)
+      vitestWorkerExporter.flush()
+      sinon.assert.calledWith(postMessage, [VITEST_WORKER_TRACE_PAYLOAD_CODE, JSON.stringify([trace])])
+      sinon.assert.notCalled(send)
+    })
+
     it('does not break if process.send is undefined', () => {
       process.env.DD_VITEST_WORKER = '1'
       delete process.send
diff --git a/packages/dd-trace/test/ci-visibility/intelligent-test-runner/get-skippable-suites.spec.js b/packages/dd-trace/test/ci-visibility/intelligent-test-runner/get-skippable-suites.spec.js
index bafe54093b..1662453dd4 100644
--- a/packages/dd-trace/test/ci-visibility/intelligent-test-runner/get-skippable-suites.spec.js
+++ b/packages/dd-trace/test/ci-visibility/intelligent-test-runner/get-skippable-suites.spec.js
@@ -8,7 +8,10 @@ const nock = require('nock')
 
 require('../../setup/core')
 
-const { getSkippableSuites } = require('../../../src/ci-visibility/intelligent-test-runner/get-skippable-suites')
+const {
+  getSkippableSuites,
+  parseSkippableSuitesResponse,
+} = require('../../../src/ci-visibility/intelligent-test-runner/get-skippable-suites')
 const getConfig = require('../../../src/config')
 const {
   buildCacheKey,
@@ -111,7 +114,7 @@ function cleanup (params) {
 describe('get-skippable-suites', () => {
   beforeEach(() => {
     process.env.DD_API_KEY = 'test-api-key'
-    getConfig().apiKey = 'test-api-key'
+    getConfig().DD_API_KEY = 'test-api-key'
     process.env.DD_EXPERIMENTAL_TEST_REQUESTS_FS_CACHE = 'true'
     getConfig().DD_EXPERIMENTAL_TEST_REQUESTS_FS_CACHE = true
     cleanup(DEFAULT_PARAMS)
@@ -120,7 +123,7 @@ describe('get-skippable-suites', () => {
 
   afterEach(() => {
     delete process.env.DD_API_KEY
-    getConfig().apiKey = undefined
+    getConfig().DD_API_KEY = undefined
     delete process.env.DD_EXPERIMENTAL_TEST_REQUESTS_FS_CACHE
     getConfig().DD_EXPERIMENTAL_TEST_REQUESTS_FS_CACHE = false
     cleanup(DEFAULT_PARAMS)
@@ -255,3 +258,64 @@ describe('get-skippable-suites', () => {
     })
   })
 })
+
+describe('parseSkippableSuitesResponse', () => {
+  it('returns suite-level skippable data with correlation id and coverage', () => {
+    const result = parseSkippableSuitesResponse(JSON.stringify(SKIPPABLE_RESPONSE_WITH_COVERAGE), {
+      testLevel: 'suite',
+    })
+
+    assert.deepStrictEqual(result, {
+      skippableSuites: ['suite1.spec.js', 'suite2.spec.js'],
+      correlationId: 'corr-123',
+      coverage: {
+        'src/file1.js': 'gA==',
+        'src/file2.js': 'IA==',
+      },
+    })
+  })
+
+  it('returns test-level skippable data', () => {
+    const result = parseSkippableSuitesResponse(JSON.stringify({
+      data: [
+        { type: 'suite', attributes: { suite: 'suite1.spec.js' } },
+        { type: 'test', attributes: { suite: 'suite1.spec.js', name: 'test 1' } },
+      ],
+      meta: { correlation_id: 'corr-123' },
+    }), { testLevel: 'test' })
+
+    assert.deepStrictEqual(result, {
+      skippableSuites: [{ suite: 'suite1.spec.js', name: 'test 1' }],
+      correlationId: 'corr-123',
+      coverage: {},
+    })
+  })
+
+  it('filters missing line coverage when coverage report upload is enabled', () => {
+    const result = parseSkippableSuitesResponse(JSON.stringify(SKIPPABLE_RESPONSE_WITH_MISSING_LINE_COVERAGE), {
+      testLevel: 'suite',
+      isCoverageReportUploadEnabled: true,
+    })
+
+    assert.deepStrictEqual(result.skippableSuites, ['suite2.spec.js'])
+  })
+
+  it('validates skippable tests response shape when requested', () => {
+    const result = parseSkippableSuitesResponse(JSON.stringify(SKIPPABLE_RESPONSE), {
+      validateRequiredFields: true,
+    })
+
+    assert.deepStrictEqual(result.skippableSuites, ['suite1.spec.js', 'suite2.spec.js'])
+    assert.throws(
+      () => parseSkippableSuitesResponse(JSON.stringify({}), { validateRequiredFields: true }),
+      /Invalid skippable tests response: data must be an array/
+    )
+    assert.throws(
+      () => parseSkippableSuitesResponse(
+        JSON.stringify({ data: [{ type: 'suite', attributes: {} }] }),
+        { validateRequiredFields: true }
+      ),
+      /Invalid skippable tests response: data entry suite must be a string/
+    )
+  })
+})
diff --git a/packages/dd-trace/test/ci-visibility/requests/get-library-configuration.spec.js b/packages/dd-trace/test/ci-visibility/requests/get-library-configuration.spec.js
new file mode 100644
index 0000000000..cc1a9a8288
--- /dev/null
+++ b/packages/dd-trace/test/ci-visibility/requests/get-library-configuration.spec.js
@@ -0,0 +1,156 @@
+'use strict'
+
+const assert = require('node:assert/strict')
+
+const { describe, it, beforeEach, afterEach } = require('mocha')
+
+require('../../setup/core')
+
+const getConfig = require('../../../src/config')
+const {
+  parseLibraryConfigurationResponse,
+} = require('../../../src/ci-visibility/requests/get-library-configuration')
+
+const COMPLETE_SETTINGS_ATTRIBUTES = {
+  code_coverage: true,
+  tests_skipping: true,
+  itr_enabled: true,
+  require_git: false,
+  early_flake_detection: {
+    enabled: true,
+    slow_test_retries: {
+      '5s': 4,
+      '10s': 3,
+    },
+    faulty_session_threshold: 12,
+  },
+  flaky_test_retries_enabled: true,
+  di_enabled: true,
+  known_tests_enabled: true,
+  test_management: {
+    enabled: true,
+    attempt_to_fix_retries: 8,
+  },
+  impacted_tests_enabled: true,
+  coverage_report_upload_enabled: true,
+}
+
+describe('get-library-configuration', () => {
+  beforeEach(() => {
+    getConfig().testOptimization.DD_CIVISIBILITY_DANGEROUSLY_FORCE_COVERAGE = false
+    getConfig().testOptimization.DD_CIVISIBILITY_DANGEROUSLY_FORCE_TEST_SKIPPING = false
+  })
+
+  afterEach(() => {
+    getConfig().testOptimization.DD_CIVISIBILITY_DANGEROUSLY_FORCE_COVERAGE = false
+    getConfig().testOptimization.DD_CIVISIBILITY_DANGEROUSLY_FORCE_TEST_SKIPPING = false
+  })
+
+  describe('parseLibraryConfigurationResponse', () => {
+    it('normalizes raw settings responses', () => {
+      const settings = parseLibraryConfigurationResponse(JSON.stringify({
+        data: {
+          attributes: COMPLETE_SETTINGS_ATTRIBUTES,
+        },
+      }))
+
+      assert.deepStrictEqual(settings, {
+        isCodeCoverageEnabled: true,
+        isSuitesSkippingEnabled: true,
+        isItrEnabled: true,
+        requireGit: false,
+        isEarlyFlakeDetectionEnabled: true,
+        earlyFlakeDetectionNumRetries: 4,
+        earlyFlakeDetectionSlowTestRetries: {
+          '5s': 4,
+          '10s': 3,
+        },
+        earlyFlakeDetectionFaultyThreshold: 12,
+        isFlakyTestRetriesEnabled: true,
+        isDiEnabled: true,
+        isKnownTestsEnabled: true,
+        isTestManagementEnabled: true,
+        testManagementAttemptToFixRetries: 8,
+        isImpactedTestsEnabled: true,
+        isCoverageReportUploadEnabled: true,
+      })
+    })
+
+    it('accepts bare settings attributes like the Ruby cache reader', () => {
+      const settings = parseLibraryConfigurationResponse(JSON.stringify({
+        code_coverage: true,
+        tests_skipping: false,
+        itr_enabled: true,
+        require_git: false,
+        known_tests_enabled: false,
+      }))
+
+      assert.strictEqual(settings.isCodeCoverageEnabled, true)
+      assert.strictEqual(settings.isSuitesSkippingEnabled, false)
+      assert.strictEqual(settings.isItrEnabled, true)
+      assert.strictEqual(settings.requireGit, false)
+      assert.strictEqual(settings.isEarlyFlakeDetectionEnabled, false)
+    })
+
+    it('validates complete cached settings attributes', () => {
+      const apiSettings = parseLibraryConfigurationResponse(JSON.stringify({
+        data: {
+          attributes: COMPLETE_SETTINGS_ATTRIBUTES,
+        },
+      }), undefined, { validateRequiredFields: true })
+      const bareSettings = parseLibraryConfigurationResponse(
+        JSON.stringify(COMPLETE_SETTINGS_ATTRIBUTES),
+        undefined,
+        { validateRequiredFields: true }
+      )
+
+      assert.strictEqual(apiSettings.isCodeCoverageEnabled, true)
+      assert.strictEqual(bareSettings.isCodeCoverageEnabled, true)
+    })
+
+    it('rejects cached settings without all required attributes', () => {
+      const partialSettingsAttributes = { ...COMPLETE_SETTINGS_ATTRIBUTES }
+      delete partialSettingsAttributes.require_git
+
+      assert.throws(
+        () => parseLibraryConfigurationResponse(JSON.stringify({}), undefined, { validateRequiredFields: true }),
+        /Invalid settings response: missing code_coverage/
+      )
+      assert.throws(
+        () => parseLibraryConfigurationResponse(
+          JSON.stringify({ data: { attributes: {} } }),
+          undefined,
+          { validateRequiredFields: true }
+        ),
+        /Invalid settings response: missing code_coverage/
+      )
+      assert.throws(
+        () => parseLibraryConfigurationResponse(
+          JSON.stringify({ data: { attributes: partialSettingsAttributes } }),
+          undefined,
+          { validateRequiredFields: true }
+        ),
+        /Invalid settings response: missing require_git/
+      )
+    })
+
+    it('applies dangerous force flags after parsing', () => {
+      getConfig().testOptimization.DD_CIVISIBILITY_DANGEROUSLY_FORCE_COVERAGE = true
+      getConfig().testOptimization.DD_CIVISIBILITY_DANGEROUSLY_FORCE_TEST_SKIPPING = true
+
+      const settings = parseLibraryConfigurationResponse(JSON.stringify({
+        data: {
+          attributes: {
+            code_coverage: false,
+            tests_skipping: false,
+            itr_enabled: true,
+            require_git: false,
+          },
+        },
+      }))
+
+      assert.strictEqual(settings.isCodeCoverageEnabled, true)
+      assert.strictEqual(settings.isSuitesSkippingEnabled, true)
+    })
+  })
+})
diff --git a/packages/dd-trace/test/ci-visibility/test-management/get-test-management-tests.spec.js b/packages/dd-trace/test/ci-visibility/test-management/get-test-management-tests.spec.js
index 42ed2858ba..54e8467921 100644
--- a/packages/dd-trace/test/ci-visibility/test-management/get-test-management-tests.spec.js
+++ b/packages/dd-trace/test/ci-visibility/test-management/get-test-management-tests.spec.js
@@ -10,7 +10,9 @@ require('../../setup/core')
 
 const {
   getTestManagementTests,
+  parseTestManagementTestsResponse,
 } = require('../../../src/ci-visibility/test-management/get-test-management-tests')
+const getConfig = require('../../../src/config')
 const {
   buildCacheKey,
   getCachePath,
@@ -64,13 +66,17 @@ function cleanup (params) {
 describe('get-test-management-tests', () => {
   beforeEach(() => {
     process.env.DD_API_KEY = 'test-api-key'
+    getConfig().DD_API_KEY = 'test-api-key'
     process.env.DD_EXPERIMENTAL_TEST_REQUESTS_FS_CACHE = 'true'
+    getConfig().DD_EXPERIMENTAL_TEST_REQUESTS_FS_CACHE = true
     cleanup(DEFAULT_PARAMS)
   })
 
   afterEach(() => {
     delete process.env.DD_API_KEY
+    getConfig().DD_API_KEY = undefined
     delete process.env.DD_EXPERIMENTAL_TEST_REQUESTS_FS_CACHE
+    getConfig().DD_EXPERIMENTAL_TEST_REQUESTS_FS_CACHE = false
     cleanup(DEFAULT_PARAMS)
     nock.cleanAll()
   })
@@ -124,3 +130,33 @@ describe('get-test-management-tests', () => {
     })
   })
 })
+
+describe('parseTestManagementTestsResponse', () => {
+  it('returns modules from a raw backend response', () => {
+    assert.deepStrictEqual(
+      parseTestManagementTestsResponse(JSON.stringify(TEST_MGMT_RESPONSE)),
+      TEST_MGMT_RESPONSE.data.attributes.modules
+    )
+  })
+
+  it('validates test management tests response shape when requested', () => {
+    assert.deepStrictEqual(
+      parseTestManagementTestsResponse(JSON.stringify(TEST_MGMT_RESPONSE), { validateRequiredFields: true }),
+      TEST_MGMT_RESPONSE.data.attributes.modules
+    )
+    assert.throws(
+      () => parseTestManagementTestsResponse(
+        JSON.stringify({ data: { attributes: {} } }),
+        { validateRequiredFields: true }
+      ),
+      /Invalid test management tests response: missing modules/
+    )
+    assert.throws(
+      () => parseTestManagementTestsResponse(
+        JSON.stringify({ data: { attributes: { modules: { jest: {} } } } }),
+        { validateRequiredFields: true }
+      ),
+      /Invalid test management tests response: module suites must be objects/
+    )
+  })
+})
diff --git a/packages/dd-trace/test/ci-visibility/test-optimization-http-cache.spec.js b/packages/dd-trace/test/ci-visibility/test-optimization-http-cache.spec.js
new file mode 100644
index 0000000000..d4bd952503
--- /dev/null
+++ b/packages/dd-trace/test/ci-visibility/test-optimization-http-cache.spec.js
@@ -0,0 +1,369 @@
+'use strict'
+
+const assert = require('node:assert/strict')
+const fs = require('node:fs')
+const os = require('node:os')
+const path = require('node:path')
+
+const { describe, it, beforeEach, afterEach } = require('mocha')
+
+require('../setup/core')
+
+const {
+  CACHE_MISS,
+  TestOptimizationHttpCache,
+} = require('../../src/ci-visibility/test-optimization-http-cache')
+
+const SETTINGS_RESPONSE = {
+  data: {
+    attributes: {
+      code_coverage: true,
+      tests_skipping: true,
+      itr_enabled: true,
+      require_git: false,
+      early_flake_detection: {
+        enabled: true,
+        slow_test_retries: {
+          '5s': 4,
+        },
+        faulty_session_threshold: 12,
+      },
+      flaky_test_retries_enabled: true,
+      di_enabled: true,
+      known_tests_enabled: true,
+      test_management: {
+        enabled: true,
+        attempt_to_fix_retries: 8,
+      },
+      impacted_tests_enabled: true,
+      coverage_report_upload_enabled: true,
+    },
+  },
+}
+
+const DISABLED_SETTINGS_RESPONSE = {
+  data: {
+    attributes: {
+      code_coverage: false,
+      tests_skipping: false,
+      itr_enabled: false,
+      require_git: false,
+      early_flake_detection: {
+        enabled: false,
+        slow_test_retries: {},
+        faulty_session_threshold: 0,
+      },
+      flaky_test_retries_enabled: false,
+      di_enabled: false,
+      known_tests_enabled: false,
+      test_management: {
+        enabled: false,
+      },
+      impacted_tests_enabled: false,
+      coverage_report_upload_enabled: false,
+    },
+  },
+}
+
+const KNOWN_TESTS_RESPONSE = {
+  data: {
+    attributes: {
+      tests: {
+        jest: {
+          'suite1.spec.js': ['test1'],
+        },
+      },
+    },
+  },
+}
+
+const SKIPPABLE_RESPONSE = {
+  meta: {
+    correlation_id: 'corr-123',
+  },
+  data: [
+    { type: 'suite', attributes: { suite: 'suite1.spec.js' } },
+  ],
+}
+
+const TEST_MANAGEMENT_RESPONSE = {
+  data: {
+    attributes: {
+      modules: {
+        jest: {
+          suites: {
+            'suite1.spec.js': {
+              tests: {
+                test1: { properties: { disabled: true } },
+              },
+            },
+          },
+        },
+      },
+    },
+  },
+}
+
+const ENV_NAMES = [
+  'TEST_OPTIMIZATION_MANIFEST_FILE',
+  'DD_TEST_OPTIMIZATION_MANIFEST_FILE',
+  'RUNFILES_DIR',
+  'RUNFILES_MANIFEST_FILE',
+  'TEST_SRCDIR',
+]
+
+function writeCacheLayout (root, options = {}) {
+  const { manifest = '1\n' } = options
+  const settings = Object.hasOwn(options, 'settings') ? options.settings : SETTINGS_RESPONSE
+  const testOptimizationPath = path.join(root, '.testoptimization')
+  const httpCachePath = path.join(testOptimizationPath, 'cache', 'http')
+
+  fs.mkdirSync(httpCachePath, { recursive: true })
+  fs.writeFileSync(path.join(testOptimizationPath, 'manifest.txt'), manifest)
+  if (settings !== undefined) {
+    fs.writeFileSync(path.join(httpCachePath, 'settings.json'), JSON.stringify(settings))
+  }
+
+  return {
+    manifestPath: path.join(testOptimizationPath, 'manifest.txt'),
+    httpCachePath,
+  }
+}
+
+function writeHttpCacheFile (root, fileName, payload) {
+  const filePath = path.join(root, '.testoptimization', 'cache', 'http', fileName)
+  fs.mkdirSync(path.dirname(filePath), { recursive: true })
+  fs.writeFileSync(filePath, typeof payload === 'string' ? payload : JSON.stringify(payload))
+  return filePath
+}
+
+describe('test-optimization-http-cache', () => {
+  let previousCwd
+  let tmpRoot
+  let previousEnv
+
+  beforeEach(() => {
+    previousCwd = process.cwd()
+    previousEnv = {}
+    for (const envName of ENV_NAMES) {
+      previousEnv[envName] = process.env[envName]
+      delete process.env[envName]
+    }
+
+    tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'dd-js-http-cache-'))
+    process.chdir(tmpRoot)
+  })
+
+  afterEach(() => {
+    process.chdir(previousCwd)
+    for (const envName of ENV_NAMES) {
+      if (previousEnv[envName] === undefined) {
+        delete process.env[envName]
+      } else {
+        process.env[envName] = previousEnv[envName]
+      }
+    }
+    fs.rmSync(tmpRoot, { recursive: true, force: true })
+  })
+
+  it('discovers local manifest before env vars', () => {
+    writeCacheLayout(tmpRoot, { settings: SETTINGS_RESPONSE })
+
+    const envRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'dd-js-http-cache-env-'))
+    const { manifestPath } = writeCacheLayout(envRoot, { settings: DISABLED_SETTINGS_RESPONSE })
+    process.env.TEST_OPTIMIZATION_MANIFEST_FILE = manifestPath
+
+    try {
+      const cache = new TestOptimizationHttpCache()
+      const settings = cache.readSettings()
+
+      assert.strictEqual(cache.isAvailable(), true)
+      assert.strictEqual(settings.isCodeCoverageEnabled, true)
+    } finally {
+      fs.rmSync(envRoot, { recursive: true, force: true })
+    }
+  })
+
+  it('uses TEST_OPTIMIZATION_MANIFEST_FILE when no local manifest exists', () => {
+    const envRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'dd-js-http-cache-env-'))
+    const { manifestPath } = writeCacheLayout(envRoot)
+    process.env.TEST_OPTIMIZATION_MANIFEST_FILE = manifestPath
+
+    try {
+      const cache = new TestOptimizationHttpCache()
+
+      assert.strictEqual(cache.isAvailable(), true)
+      assert.strictEqual(cache.readSettings().isCodeCoverageEnabled, true)
+    } finally {
+      fs.rmSync(envRoot, { recursive: true, force: true })
+    }
+  })
+
+  it('uses DD_TEST_OPTIMIZATION_MANIFEST_FILE as an alias', () => {
+    const envRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'dd-js-http-cache-env-'))
+    const { manifestPath } = writeCacheLayout(envRoot)
+    process.env.DD_TEST_OPTIMIZATION_MANIFEST_FILE = manifestPath
+
+    try {
+      const cache = new TestOptimizationHttpCache()
+
+      assert.strictEqual(cache.isAvailable(), true)
+      assert.strictEqual(cache.readSettings().isCodeCoverageEnabled, true)
+    } finally {
+      fs.rmSync(envRoot, { recursive: true, force: true })
+    }
+  })
+
+  it('resolves manifests through RUNFILES_DIR', () => {
+    const runfilesDir = fs.mkdtempSync(path.join(os.tmpdir(), 'dd-js-runfiles-dir-'))
+    const layoutRoot = path.join(runfilesDir, 'workspace')
+    writeCacheLayout(layoutRoot)
+
+    process.env.TEST_OPTIMIZATION_MANIFEST_FILE = 'workspace/.testoptimization/manifest.txt'
+    process.env.RUNFILES_DIR = runfilesDir
+
+    try {
+      const cache = new TestOptimizationHttpCache()
+      assert.strictEqual(cache.isAvailable(), true)
+    } finally {
+      fs.rmSync(runfilesDir, { recursive: true, force: true })
+    }
+  })
+
+  it('resolves manifests through RUNFILES_MANIFEST_FILE', () => {
+    const actualRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'dd-js-runfiles-manifest-'))
+    const { manifestPath } = writeCacheLayout(actualRoot)
+    const runfilesManifestPath = path.join(tmpRoot, 'MANIFEST')
+
+    process.env.TEST_OPTIMIZATION_MANIFEST_FILE = 'workspace/.testoptimization/manifest.txt'
+    process.env.RUNFILES_MANIFEST_FILE = runfilesManifestPath
+    fs.writeFileSync(runfilesManifestPath, `workspace/.testoptimization/manifest.txt ${manifestPath}\n`)
+
+    try {
+      const cache = new TestOptimizationHttpCache()
+      assert.strictEqual(cache.isAvailable(), true)
+    } finally {
+      fs.rmSync(actualRoot, { recursive: true, force: true })
+    }
+  })
+
+  it('resolves manifests through TEST_SRCDIR', () => {
+    const testSrcdir = fs.mkdtempSync(path.join(os.tmpdir(), 'dd-js-test-srcdir-'))
+    const layoutRoot = path.join(testSrcdir, 'workspace')
+    writeCacheLayout(layoutRoot)
+
+    process.env.TEST_OPTIMIZATION_MANIFEST_FILE = 'workspace/.testoptimization/manifest.txt'
+    process.env.TEST_SRCDIR = testSrcdir
+
+    try {
+      const cache = new TestOptimizationHttpCache()
+      assert.strictEqual(cache.isAvailable(), true)
+    } finally {
+      fs.rmSync(testSrcdir, { recursive: true, force: true })
+    }
+  })
+
+  it('accepts supported manifest version formats', () => {
+    writeCacheLayout(tmpRoot, { manifest: '\uFEFFversion=1\n' })
+
+    const cache = new TestOptimizationHttpCache()
+    assert.strictEqual(cache.isAvailable(), true)
+  })
+
+  it('rejects unsupported manifests', () => {
+    writeCacheLayout(tmpRoot, { manifest: '2\n' })
+
+    const cache = new TestOptimizationHttpCache()
+    assert.strictEqual(cache.isAvailable(), false)
+    assert.strictEqual(cache.readSettings(), CACHE_MISS)
+  })
+
+  it('treats a supported manifest as unavailable when settings.json is absent', () => {
+    writeCacheLayout(tmpRoot, { settings: undefined })
+
+    const cache = new TestOptimizationHttpCache()
+    assert.strictEqual(cache.isAvailable(), false)
+    assert.strictEqual(cache.readSettings(), CACHE_MISS)
+  })
+
+  it('reads endpoint files relative to the manifest directory', () => {
+    writeCacheLayout(tmpRoot)
+    writeHttpCacheFile(tmpRoot, 'known_tests.json', KNOWN_TESTS_RESPONSE)
+    writeHttpCacheFile(tmpRoot, 'skippable_tests.json', SKIPPABLE_RESPONSE)
+    writeHttpCacheFile(tmpRoot, 'test_management.json', TEST_MANAGEMENT_RESPONSE)
+
+    const cache = new TestOptimizationHttpCache()
+    assert.deepStrictEqual(cache.readKnownTests(), KNOWN_TESTS_RESPONSE.data.attributes.tests)
+    assert.deepStrictEqual(cache.readSkippableSuites().skippableSuites, ['suite1.spec.js'])
+    assert.deepStrictEqual(cache.readTestManagementTests(), TEST_MANAGEMENT_RESPONSE.data.attributes.modules)
+  })
+
+  it('returns cache miss for missing optional endpoint files', () => {
+    writeCacheLayout(tmpRoot)
+
+    const cache = new TestOptimizationHttpCache()
+
+    assert.strictEqual(cache.readKnownTests(), CACHE_MISS)
+    assert.strictEqual(cache.readSkippableSuites(), CACHE_MISS)
+    assert.strictEqual(cache.readTestManagementTests(), CACHE_MISS)
+  })
+
+  it('returns cache miss for invalid cache files', () => {
+    writeCacheLayout(tmpRoot)
+
+    const cache = new TestOptimizationHttpCache()
+    writeHttpCacheFile(tmpRoot, 'settings.json', '{invalid json')
+    assert.strictEqual(cache.readSettings(), CACHE_MISS)
+    writeHttpCacheFile(tmpRoot, 'known_tests.json', '{invalid json')
+    assert.strictEqual(cache.readKnownTests(), CACHE_MISS)
+    writeHttpCacheFile(tmpRoot, 'skippable_tests.json', '{invalid json')
+    assert.strictEqual(cache.readSkippableSuites(), CACHE_MISS)
+    writeHttpCacheFile(tmpRoot, 'test_management.json', '{invalid json')
+    assert.strictEqual(cache.readTestManagementTests(), CACHE_MISS)
+  })
+
+  it('returns cache miss for settings files missing required attributes', () => {
+    for (const settings of [
+      {},
+      { data: {} },
+      { data: { attributes: { code_coverage: true } } },
+    ]) {
+      fs.rmSync(path.join(tmpRoot, '.testoptimization'), { recursive: true, force: true })
+      writeCacheLayout(tmpRoot, { settings })
+
+      const cache = new TestOptimizationHttpCache()
+      assert.strictEqual(cache.readSettings(), CACHE_MISS)
+      assert.strictEqual(cache.isAvailable(), false)
+    }
+  })
+
+  it('ignores optional endpoint files after invalid settings disable the cache', () => {
+    writeCacheLayout(tmpRoot, { settings: { data: { attributes: { code_coverage: true } } } })
+    writeHttpCacheFile(tmpRoot, 'known_tests.json', KNOWN_TESTS_RESPONSE)
+
+    const cache = new TestOptimizationHttpCache()
+
+    assert.strictEqual(cache.readSettings(), CACHE_MISS)
+    assert.strictEqual(cache.readKnownTests(), CACHE_MISS)
+  })
+
+  it('returns per-file cache miss for optional files missing required attributes', () => {
+    writeCacheLayout(tmpRoot)
+
+    const cache = new TestOptimizationHttpCache()
+    writeHttpCacheFile(tmpRoot, 'known_tests.json', { data: { attributes: {} } })
+    assert.strictEqual(cache.readKnownTests(), CACHE_MISS)
+    assert.strictEqual(cache.isAvailable(), true)
+
+    writeHttpCacheFile(tmpRoot, 'skippable_tests.json', { data: [{ type: 'suite', attributes: {} }] })
+    assert.strictEqual(cache.readSkippableSuites(), CACHE_MISS)
+    assert.strictEqual(cache.isAvailable(), true)
+
+    writeHttpCacheFile(tmpRoot, 'test_management.json', { data: { attributes: {} } })
+    assert.strictEqual(cache.readTestManagementTests(), CACHE_MISS)
+    assert.strictEqual(cache.isAvailable(), true)
+
+    writeHttpCacheFile(tmpRoot, 'known_tests.json', KNOWN_TESTS_RESPONSE)
+    assert.deepStrictEqual(cache.readKnownTests(), KNOWN_TESTS_RESPONSE.data.attributes.tests)
+  })
+})
diff --git a/packages/dd-trace/test/config/index.spec.js b/packages/dd-trace/test/config/index.spec.js
index e823ed4211..ef333b5a47 100644
--- a/packages/dd-trace/test/config/index.spec.js
+++ b/packages/dd-trace/test/config/index.spec.js
@@ -246,12 +246,25 @@ describe('Config', () => {
       assert.strictEqual(iastEntry.internalPropertyName, undefined)
     })
 
+    it('does not retain any internalPropertyName entries in supported-configurations.json', () => {
+      const { supportedConfigurations } = require('../../src/config/supported-configurations.json')
+      const offenders = []
+      for (const [canonicalName, entries] of Object.entries(supportedConfigurations)) {
+        for (const entry of entries) {
+          if (entry.internalPropertyName !== undefined) {
+            offenders.push(`${canonicalName} -> ${entry.internalPropertyName}`)
+          }
+        }
+      }
+      assert.deepStrictEqual(offenders, [], 'internalPropertyName is replaced by namespace or the canonical name')
+    })
+
     it('loads v5 config repeatedly after security controls are restored', () => {
       const firstConfig = getConfig(undefined, { ddMajor: 5 })
       const secondConfig = getConfig(undefined, { ddMajor: 5 })
 
-      assert.strictEqual(firstConfig.iast.securityControlsConfiguration, undefined)
-      assert.strictEqual(secondConfig.iast.securityControlsConfiguration, undefined)
+      assert.strictEqual(firstConfig.iast.DD_IAST_SECURITY_CONTROLS_CONFIGURATION, undefined)
+      assert.strictEqual(secondConfig.iast.DD_IAST_SECURITY_CONTROLS_CONFIGURATION, undefined)
     })
 
     it('should pass through random envs', async () => {
@@ -589,7 +602,7 @@ describe('Config', () => {
 
       const config = getConfig()
 
-      assert.strictEqual(config.apiKey, 'SENTINEL_DATADOG_API_KEY')
+      assert.strictEqual(config.DD_API_KEY, 'SENTINEL_DATADOG_API_KEY')
       for (const entry of telemetryEntries()) {
         const value = typeof entry.value === 'string' ? entry.value : JSON.stringify(entry.value)
         assert.ok(
@@ -769,6 +782,33 @@ describe('Config', () => {
     assert.strictEqual(config.sampleRate, 0.5)
   })
 
+  it('auto-enables OTEL_TRACES_SPAN_METRICS_ENABLED when OTEL_TRACES_EXPORTER=otlp and DD_METRICS_OTEL_ENABLED', () => {
+    process.env.OTEL_TRACES_EXPORTER = 'otlp'
+    process.env.DD_METRICS_OTEL_ENABLED = 'true'
+    const config = getConfig()
+    assert.strictEqual(config.OTEL_TRACES_SPAN_METRICS_ENABLED, true)
+  })
+
+  it('should not auto-enable OTEL_TRACES_SPAN_METRICS_ENABLED when OTEL_TRACES_EXPORTER is not otlp', () => {
+    process.env.DD_METRICS_OTEL_ENABLED = 'true'
+    const config = getConfig()
+    assert.strictEqual(config.OTEL_TRACES_SPAN_METRICS_ENABLED, false)
+  })
+
+  it('should not auto-enable OTEL_TRACES_SPAN_METRICS_ENABLED when DD_METRICS_OTEL_ENABLED is false', () => {
+    process.env.OTEL_TRACES_EXPORTER = 'otlp'
+    const config = getConfig()
+    assert.strictEqual(config.OTEL_TRACES_SPAN_METRICS_ENABLED, false)
+  })
+
+  it('should respect explicit OTEL_TRACES_SPAN_METRICS_ENABLED over auto-enable', () => {
+    process.env.OTEL_TRACES_EXPORTER = 'otlp'
+    process.env.DD_METRICS_OTEL_ENABLED = 'true'
+    process.env.OTEL_TRACES_SPAN_METRICS_ENABLED = 'false'
+    const config = getConfig()
+    assert.strictEqual(config.OTEL_TRACES_SPAN_METRICS_ENABLED, false)
+  })
+
   it('should initialize with the correct defaults', () => {
     const config = getConfig()
 
@@ -776,15 +816,13 @@ describe('Config', () => {
       apmTracingEnabled: true,
       DD_APP_KEY: undefined,
       appsec: {
-        apiSecurity: {
-          enabled: true,
-          sampleDelay: 30,
-          endpointCollectionEnabled: true,
-          endpointCollectionMessageLimit: 300,
-          downstreamBodyAnalysisSampleRate: 0.5,
-          maxDownstreamRequestBodyAnalysis: 1,
-          maxDownstreamBodyBytes: 10485760,
-        },
+        DD_API_SECURITY_ENABLED: true,
+        DD_API_SECURITY_SAMPLE_DELAY: 30,
+        DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: true,
+        DD_API_SECURITY_ENDPOINT_COLLECTION_MESSAGE_LIMIT: 300,
+        DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE: 0.5,
+        DD_API_SECURITY_MAX_DOWNSTREAM_REQUEST_BODY_ANALYSIS: 1,
+        DD_API_SECURITY_MAX_DOWNSTREAM_BODY_BYTES: 10485760,
         blockedTemplateHtml: undefined,
         blockedTemplateJson: undefined,
         blockedTemplateGraphql: undefined,
@@ -803,9 +841,7 @@ describe('Config', () => {
           enabled: true,
         },
         rateLimit: 100,
-        sca: {
-          enabled: undefined,
-        },
+        DD_APPSEC_SCA_ENABLED: undefined,
         stackTrace: {
           enabled: true,
           maxDepth: 32,
@@ -870,19 +906,19 @@ describe('Config', () => {
       DD_INSTRUMENTATION_CONFIG_ID: undefined,
       llmobs: {
         agentlessEnabled: undefined,
-        enabled: false,
+        DD_LLMOBS_ENABLED: false,
         mlApp: undefined,
       },
       logLevel: 'debug',
       middlewareTracingEnabled: true,
       plugins: true,
       protocolVersion: '0.4',
-      tracing: true,
+      DD_TRACE_ENABLED: true,
       tags: {
         service: 'node',
       },
       remoteConfig: {
-        enabled: true,
+        DD_REMOTE_CONFIGURATION_ENABLED: true,
         pollInterval: 5,
       },
       reportHostname: false,
@@ -893,7 +929,7 @@ describe('Config', () => {
       },
       runtimeMetricsRuntimeId: false,
       sampleRate: undefined,
-      scope: undefined,
+      DD_TRACE_SCOPE: undefined,
       service: 'node',
       spanAttributeSchema: 'v0',
       spanComputePeerService: false,
@@ -910,7 +946,7 @@ describe('Config', () => {
     assert.deepStrictEqual(config.serviceMapping, {})
     assert.deepStrictEqual(config.tracePropagationStyle.extract, ['datadog', 'tracecontext', 'baggage'])
     assert.deepStrictEqual(config.tracePropagationStyle.inject, ['datadog', 'tracecontext', 'baggage'])
-    assert.strictEqual(config.queryStringObfuscation.length, 626)
+    assert.strictEqual(config.DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP.length, 626)
     assert.strictEqual(config.appsec.obfuscatorKeyRegex.length, 190)
     assert.strictEqual(config.appsec.obfuscatorValueRegex.length, 578)
 
@@ -1024,7 +1060,7 @@ describe('Config', () => {
       { name: 'DD_TRACE_AGENT_PROTOCOL_VERSION', value: '0.4', origin: 'default' },
       {
         name: 'DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP',
-        value: config.queryStringObfuscation,
+        value: config.DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP,
         origin: 'default',
       },
       { name: 'DD_REMOTE_CONFIGURATION_ENABLED', value: true, origin: 'default' },
@@ -1254,15 +1290,13 @@ describe('Config', () => {
       apmTracingEnabled: false,
       DD_APP_KEY: 'myAppKey',
       appsec: {
-        apiSecurity: {
-          enabled: true,
-          sampleDelay: 25,
-          endpointCollectionEnabled: false,
-          endpointCollectionMessageLimit: 500,
-          downstreamBodyAnalysisSampleRate: 0.75,
-          maxDownstreamRequestBodyAnalysis: 2,
-          maxDownstreamBodyBytes: 2048,
-        },
+        DD_API_SECURITY_ENABLED: true,
+        DD_API_SECURITY_SAMPLE_DELAY: 25,
+        DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: false,
+        DD_API_SECURITY_ENDPOINT_COLLECTION_MESSAGE_LIMIT: 500,
+        DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE: 0.75,
+        DD_API_SECURITY_MAX_DOWNSTREAM_REQUEST_BODY_ANALYSIS: 2,
+        DD_API_SECURITY_MAX_DOWNSTREAM_BODY_BYTES: 2048,
         blockedTemplateGraphql: BLOCKED_TEMPLATE_GRAPHQL,
         blockedTemplateHtml: BLOCKED_TEMPLATE_HTML,
         blockedTemplateJson: BLOCKED_TEMPLATE_JSON,
@@ -1283,9 +1317,7 @@ describe('Config', () => {
         },
         rateLimit: 42,
         rules: RULES_JSON_PATH,
-        sca: {
-          enabled: true,
-        },
+        DD_APPSEC_SCA_ENABLED: true,
         stackTrace: {
           enabled: false,
           maxDepth: 42,
@@ -1343,7 +1375,7 @@ describe('Config', () => {
         redactionNamePattern: 'REDACTION_NAME_PATTERN',
         redactionValuePattern: 'REDACTION_VALUE_PATTERN',
         requestSampling: 40,
-        securityControlsConfiguration: 'SANITIZER:CODE_INJECTION:sanitizer.js:method',
+        DD_IAST_SECURITY_CONTROLS_CONFIGURATION: 'SANITIZER:CODE_INJECTION:sanitizer.js:method',
         stackTrace: {
           enabled: false,
         },
@@ -1356,9 +1388,9 @@ describe('Config', () => {
       },
       middlewareTracingEnabled: false,
       protocolVersion: '0.5',
-      queryStringObfuscation: '.*',
+      DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP: '.*',
       remoteConfig: {
-        enabled: false,
+        DD_REMOTE_CONFIGURATION_ENABLED: false,
         pollInterval: 42,
       },
       reportHostname: true,
@@ -1384,7 +1416,7 @@ describe('Config', () => {
       traceId128BitGenerationEnabled: true,
       traceId128BitLoggingEnabled: true,
       DD_TRACE_PROPAGATION_BEHAVIOR_EXTRACT: 'restart',
-      tracing: true,
+      DD_TRACE_ENABLED: true,
       version: '1.0.0',
     })
     assert.deepStrictEqual(config.DD_GRPC_CLIENT_ERROR_STATUSES, [3, 13, 400, 401, 402, 403])
@@ -1615,7 +1647,7 @@ describe('Config', () => {
     assert.strictEqual(config.url.toString(), 'https://agent2:7777/')
 
     assertObjectContains(config, {
-      tracing: false,
+      DD_TRACE_ENABLED: false,
       dogstatsd: {
         hostname: 'agent',
       },
@@ -1892,7 +1924,10 @@ describe('Config', () => {
     assert.deepStrictEqual(config.dynamicInstrumentation.redactedIdentifiers, ['foo', 'bar'])
     assert.deepStrictEqual(config.dynamicInstrumentation.redactionExcludedIdentifiers, ['a', 'b', 'c'])
     if (DD_MAJOR < 6) {
-      assert.strictEqual(config.iast.securityControlsConfiguration, 'SANITIZER:CODE_INJECTION:sanitizer.js:method')
+      assert.strictEqual(
+        config.iast.DD_IAST_SECURITY_CONTROLS_CONFIGURATION,
+        'SANITIZER:CODE_INJECTION:sanitizer.js:method'
+      )
     } else {
       assert.ok(!('iast.securityControlsConfiguration' in config))
     }
@@ -2386,11 +2421,9 @@ describe('Config', () => {
     assertObjectContains(config, {
       apmTracingEnabled: true,
       appsec: {
-        apiSecurity: {
-          enabled: true,
-          endpointCollectionEnabled: true,
-          endpointCollectionMessageLimit: 150,
-        },
+        DD_API_SECURITY_ENABLED: true,
+        DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: true,
+        DD_API_SECURITY_ENDPOINT_COLLECTION_MESSAGE_LIMIT: 150,
         blockedTemplateGraphql: BLOCKED_TEMPLATE_GRAPHQL,
         blockedTemplateHtml: BLOCKED_TEMPLATE_HTML,
         blockedTemplateJson: BLOCKED_TEMPLATE_JSON,
@@ -2464,7 +2497,8 @@ describe('Config', () => {
         redactionNamePattern: 'REDACTION_NAME_PATTERN',
         redactionValuePattern: 'REDACTION_VALUE_PATTERN',
         requestSampling: 30,
-        securityControlsConfiguration: 'SANITIZER:CODE_INJECTION:sanitizer.js:method' + (DD_MAJOR < 6 ? '2' : '1'),
+        DD_IAST_SECURITY_CONTROLS_CONFIGURATION:
+          'SANITIZER:CODE_INJECTION:sanitizer.js:method' + (DD_MAJOR < 6 ? '2' : '1'),
         stackTrace: {
           enabled: false,
         },
@@ -2600,15 +2634,13 @@ describe('Config', () => {
     })
 
     assert.deepStrictEqual(config.appsec, {
-      apiSecurity: {
-        enabled: true,
-        sampleDelay: 30,
-        endpointCollectionEnabled: true,
-        endpointCollectionMessageLimit: 500,
-        downstreamBodyAnalysisSampleRate: 0.5,
-        maxDownstreamRequestBodyAnalysis: 1,
-        maxDownstreamBodyBytes: 10485760,
-      },
+      DD_API_SECURITY_ENABLED: true,
+      DD_API_SECURITY_SAMPLE_DELAY: 30,
+      DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: true,
+      DD_API_SECURITY_ENDPOINT_COLLECTION_MESSAGE_LIMIT: 500,
+      DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE: 0.5,
+      DD_API_SECURITY_MAX_DOWNSTREAM_REQUEST_BODY_ANALYSIS: 1,
+      DD_API_SECURITY_MAX_DOWNSTREAM_BODY_BYTES: 10485760,
       blockedTemplateGraphql: BLOCKED_TEMPLATE_GRAPHQL,
       blockedTemplateHtml: BLOCKED_TEMPLATE_HTML,
       blockedTemplateJson: BLOCKED_TEMPLATE_JSON,
@@ -2629,9 +2661,7 @@ describe('Config', () => {
       },
       rateLimit: 42,
       rules: RULES_JSON_PATH,
-      sca: {
-        enabled: undefined,
-      },
+      DD_APPSEC_SCA_ENABLED: undefined,
       stackTrace: {
         enabled: true,
         maxStackTraces: 2,
@@ -2650,7 +2680,7 @@ describe('Config', () => {
       redactionNamePattern: 'REDACTION_NAME_PATTERN',
       redactionValuePattern: 'REDACTION_VALUE_PATTERN',
       requestSampling: 15,
-      securityControlsConfiguration: undefined,
+      DD_IAST_SECURITY_CONTROLS_CONFIGURATION: undefined,
       stackTrace: {
         enabled: false,
       },
@@ -2804,7 +2834,7 @@ describe('Config', () => {
 
     const config = getConfig()
 
-    assert.strictEqual(config.telemetry.enabled, false)
+    assert.strictEqual(config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED, false)
   })
 
   it('should not set DD_INSTRUMENTATION_TELEMETRY_ENABLED if FUNCTION_NAME and GCP_PROJECT are present', () => {
@@ -2814,7 +2844,7 @@ describe('Config', () => {
 
     const config = getConfig()
 
-    assert.strictEqual(config.telemetry.enabled, false)
+    assert.strictEqual(config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED, false)
   })
 
   it('should not set DD_INSTRUMENTATION_TELEMETRY_ENABLED if K_SERVICE and FUNCTION_TARGET are present', () => {
@@ -2824,7 +2854,7 @@ describe('Config', () => {
 
     const config = getConfig()
 
-    assert.strictEqual(config.telemetry.enabled, false)
+    assert.strictEqual(config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED, false)
   })
 
   it('should not set DD_INSTRUMENTATION_TELEMETRY_ENABLED if Azure Consumption Plan Function', () => {
@@ -2835,7 +2865,7 @@ describe('Config', () => {
 
     const config = getConfig()
 
-    assert.strictEqual(config.telemetry.enabled, false)
+    assert.strictEqual(config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED, false)
   })
 
   it('should set telemetry default values', () => {
@@ -2843,11 +2873,11 @@ describe('Config', () => {
 
     assertObjectContains(config, {
       telemetry: {
-        enabled: true,
-        heartbeatInterval: 60000,
-        logCollection: true,
-        debug: false,
-        metrics: true,
+        DD_INSTRUMENTATION_TELEMETRY_ENABLED: true,
+        DD_TELEMETRY_HEARTBEAT_INTERVAL: 60000,
+        DD_TELEMETRY_LOG_COLLECTION_ENABLED: true,
+        DD_TELEMETRY_DEBUG: false,
+        DD_TELEMETRY_METRICS_ENABLED: true,
       },
     })
   })
@@ -2858,7 +2888,7 @@ describe('Config', () => {
 
     const config = getConfig()
 
-    assert.strictEqual(config.telemetry.heartbeatInterval, 42000)
+    assert.strictEqual(config.telemetry.DD_TELEMETRY_HEARTBEAT_INTERVAL, 42000)
 
     process.env.DD_TELEMETRY_HEARTBEAT_INTERVAL = origTelemetryHeartbeatIntervalValue
   })
@@ -2869,7 +2899,7 @@ describe('Config', () => {
 
     const config = getConfig()
 
-    assert.strictEqual(config.telemetry.enabled, false)
+    assert.strictEqual(config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED, false)
 
     process.env.DD_INSTRUMENTATION_TELEMETRY_ENABLED = origTraceTelemetryValue
   })
@@ -2880,7 +2910,7 @@ describe('Config', () => {
 
     const config = getConfig()
 
-    assert.strictEqual(config.telemetry.metrics, false)
+    assert.strictEqual(config.telemetry.DD_TELEMETRY_METRICS_ENABLED, false)
 
     process.env.DD_TELEMETRY_METRICS_ENABLED = origTelemetryMetricsEnabledValue
   })
@@ -2891,7 +2921,7 @@ describe('Config', () => {
 
     const config = getConfig()
 
-    assert.strictEqual(config.telemetry.logCollection, false)
+    assert.strictEqual(config.telemetry.DD_TELEMETRY_LOG_COLLECTION_ENABLED, false)
 
     process.env.DD_TELEMETRY_LOG_COLLECTION_ENABLED = origLogsValue
   })
@@ -2902,7 +2932,7 @@ describe('Config', () => {
 
     const config = getConfig()
 
-    assert.strictEqual(config.telemetry.debug, true)
+    assert.strictEqual(config.telemetry.DD_TELEMETRY_DEBUG, true)
 
     process.env.DD_TELEMETRY_DEBUG = origTelemetryDebugValue
   })
@@ -2912,7 +2942,7 @@ describe('Config', () => {
 
     const config = getConfig()
 
-    assert.strictEqual(config.remoteConfig.enabled, false)
+    assert.strictEqual(config.remoteConfig.DD_REMOTE_CONFIGURATION_ENABLED, false)
   })
 
   describe('flushInterval in Lambda', () => {
@@ -2944,7 +2974,7 @@ describe('Config', () => {
 
     const config = getConfig()
 
-    assert.strictEqual(config.remoteConfig.enabled, false)
+    assert.strictEqual(config.remoteConfig.DD_REMOTE_CONFIGURATION_ENABLED, false)
   })
 
   it('should not set DD_REMOTE_CONFIGURATION_ENABLED if K_SERVICE and FUNCTION_TARGET are present', () => {
@@ -2953,7 +2983,7 @@ describe('Config', () => {
 
     const config = getConfig()
 
-    assert.strictEqual(config.remoteConfig.enabled, false)
+    assert.strictEqual(config.remoteConfig.DD_REMOTE_CONFIGURATION_ENABLED, false)
   })
 
   it('should not set DD_REMOTE_CONFIGURATION_ENABLED if Azure Functions env vars are present', () => {
@@ -2963,7 +2993,7 @@ describe('Config', () => {
 
     const config = getConfig()
 
-    assert.strictEqual(config.remoteConfig.enabled, false)
+    assert.strictEqual(config.remoteConfig.DD_REMOTE_CONFIGURATION_ENABLED, false)
   })
 
   it('should send empty array when remote config is called on empty options', () => {
@@ -3180,7 +3210,7 @@ describe('Config', () => {
 
     const config = getConfig()
 
-    assert.strictEqual(config.appsec.apiSecurity.enabled, true)
+    assert.strictEqual(config.appsec.DD_API_SECURITY_ENABLED, true)
   })
 
   it('should disable api security with DD_EXPERIMENTAL_API_SECURITY_ENABLED', () => {
@@ -3188,7 +3218,7 @@ describe('Config', () => {
 
     const config = getConfig()
 
-    assert.strictEqual(config.appsec.apiSecurity.enabled, false)
+    assert.strictEqual(config.appsec.DD_API_SECURITY_ENABLED, false)
   })
 
   it('should ignore DD_EXPERIMENTAL_API_SECURITY_ENABLED with DD_API_SECURITY_ENABLED=true', () => {
@@ -3197,7 +3227,7 @@ describe('Config', () => {
 
     const config = getConfig()
 
-    assert.strictEqual(config.appsec.apiSecurity.enabled, true)
+    assert.strictEqual(config.appsec.DD_API_SECURITY_ENABLED, true)
   })
 
   it('should prioritize DD_DOGSTATSD_HOST over DD_DOGSTATSD_HOSTNAME', () => {
@@ -3230,7 +3260,7 @@ describe('Config', () => {
         const config = getConfig()
 
         assert.strictEqual(config.url.toString(), 'http://127.0.0.1:8126/')
-        assert.strictEqual(config.DD_CIVISIBILITY_AGENTLESS_URL, undefined)
+        assert.strictEqual(config.testOptimization.DD_CIVISIBILITY_AGENTLESS_URL, undefined)
       })
 
       it('should resolve url to the agent and expose DD_CIVISIBILITY_AGENTLESS_URL as the intake override', () => {
@@ -3240,7 +3270,7 @@ describe('Config', () => {
         const config = getConfig()
 
         assert.strictEqual(config.url.toString(), 'http://127.0.0.1:8126/')
-        assert.strictEqual(config.DD_CIVISIBILITY_AGENTLESS_URL.toString(), 'https://my-intake.example/')
+        assert.strictEqual(config.testOptimization.DD_CIVISIBILITY_AGENTLESS_URL.toString(), 'https://my-intake.example/')
       })
     })
 
@@ -3329,7 +3359,7 @@ describe('Config', () => {
         } else {
           assert.strictEqual(config.url.toString(), 'unix:///var/run/datadog/apm.socket')
         }
-        assert.strictEqual(config.DD_CIVISIBILITY_AGENTLESS_URL, undefined)
+        assert.strictEqual(config.testOptimization.DD_CIVISIBILITY_AGENTLESS_URL, undefined)
       })
     })
   })
@@ -3355,30 +3385,30 @@ describe('Config', () => {
       })
       it('should activate git upload by default', () => {
         const config = getConfig(options)
-        assert.strictEqual(config.isGitUploadEnabled, true)
+        assert.strictEqual(config.testOptimization.DD_CIVISIBILITY_GIT_UPLOAD_ENABLED, true)
       })
       it('should disable git upload if the DD_CIVISIBILITY_GIT_UPLOAD_ENABLED is set to false', () => {
         process.env.DD_CIVISIBILITY_GIT_UPLOAD_ENABLED = 'false'
         const config = getConfig(options)
-        assert.strictEqual(config.isGitUploadEnabled, false)
+        assert.strictEqual(config.testOptimization.DD_CIVISIBILITY_GIT_UPLOAD_ENABLED, false)
       })
       it('should activate ITR by default', () => {
         const config = getConfig(options)
-        assert.strictEqual(config.isIntelligentTestRunnerEnabled, true)
+        assert.strictEqual(config.testOptimization.DD_CIVISIBILITY_ITR_ENABLED, true)
       })
       it('should disable ITR if DD_CIVISIBILITY_ITR_ENABLED is set to false', () => {
         process.env.DD_CIVISIBILITY_ITR_ENABLED = 'false'
         const config = getConfig(options)
-        assert.strictEqual(config.isIntelligentTestRunnerEnabled, false)
+        assert.strictEqual(config.testOptimization.DD_CIVISIBILITY_ITR_ENABLED, false)
       })
       it('should enable manual testing API by default', () => {
         const config = getConfig(options)
-        assert.strictEqual(config.DD_CIVISIBILITY_MANUAL_API_ENABLED, true)
+        assert.strictEqual(config.testOptimization.DD_CIVISIBILITY_MANUAL_API_ENABLED, true)
       })
       it('should disable manual testing API if DD_CIVISIBILITY_MANUAL_API_ENABLED is set to false', () => {
         process.env.DD_CIVISIBILITY_MANUAL_API_ENABLED = 'false'
         const config = getConfig(options)
-        assert.strictEqual(config.DD_CIVISIBILITY_MANUAL_API_ENABLED, false)
+        assert.strictEqual(config.testOptimization.DD_CIVISIBILITY_MANUAL_API_ENABLED, false)
       })
       it('should disable memcached command tagging by default', () => {
         const config = getConfig(options)
@@ -3391,44 +3421,44 @@ describe('Config', () => {
       })
       it('should enable telemetry', () => {
         const config = getConfig(options)
-        assert.strictEqual(config.telemetry.enabled, true)
+        assert.strictEqual(config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED, true)
       })
       it('should enable early flake detection by default', () => {
         const config = getConfig(options)
-        assert.strictEqual(config.isEarlyFlakeDetectionEnabled, true)
+        assert.strictEqual(config.testOptimization.DD_CIVISIBILITY_EARLY_FLAKE_DETECTION_ENABLED, true)
       })
       it('should disable early flake detection if DD_CIVISIBILITY_EARLY_FLAKE_DETECTION_ENABLED is false', () => {
         process.env.DD_CIVISIBILITY_EARLY_FLAKE_DETECTION_ENABLED = 'false'
         const config = getConfig(options)
-        assert.strictEqual(config.isEarlyFlakeDetectionEnabled, false)
+        assert.strictEqual(config.testOptimization.DD_CIVISIBILITY_EARLY_FLAKE_DETECTION_ENABLED, false)
       })
       it('should enable flaky test retries by default', () => {
         const config = getConfig(options)
-        assert.strictEqual(config.isFlakyTestRetriesEnabled, true)
+        assert.strictEqual(config.testOptimization.DD_CIVISIBILITY_FLAKY_RETRY_ENABLED, true)
       })
-      it('should disable flaky test retries if isFlakyTestRetriesEnabled is false', () => {
+      it('should disable flaky test retries if DD_CIVISIBILITY_FLAKY_RETRY_ENABLED is false', () => {
         process.env.DD_CIVISIBILITY_FLAKY_RETRY_ENABLED = 'false'
         const config = getConfig(options)
-        assert.strictEqual(config.isFlakyTestRetriesEnabled, false)
+        assert.strictEqual(config.testOptimization.DD_CIVISIBILITY_FLAKY_RETRY_ENABLED, false)
       })
       it('should read DD_CIVISIBILITY_FLAKY_RETRY_COUNT if present', () => {
         process.env.DD_CIVISIBILITY_FLAKY_RETRY_COUNT = '4'
         const config = getConfig(options)
-        assert.strictEqual(config.flakyTestRetriesCount, 4)
+        assert.strictEqual(config.testOptimization.DD_CIVISIBILITY_FLAKY_RETRY_COUNT, 4)
       })
       it('should default DD_CIVISIBILITY_FLAKY_RETRY_COUNT to 5', () => {
         const config = getConfig(options)
-        assert.strictEqual(config.flakyTestRetriesCount, 5)
+        assert.strictEqual(config.testOptimization.DD_CIVISIBILITY_FLAKY_RETRY_COUNT, 5)
       })
       it('should round non integer values of DD_CIVISIBILITY_FLAKY_RETRY_COUNT', () => {
         process.env.DD_CIVISIBILITY_FLAKY_RETRY_COUNT = '4.1'
         const config = getConfig(options)
-        assert.strictEqual(config.flakyTestRetriesCount, 4)
+        assert.strictEqual(config.testOptimization.DD_CIVISIBILITY_FLAKY_RETRY_COUNT, 4)
       })
       it('should set the default to DD_CIVISIBILITY_FLAKY_RETRY_COUNT if it is not a number', () => {
         process.env.DD_CIVISIBILITY_FLAKY_RETRY_COUNT = 'a'
         const config = getConfig(options)
-        assert.strictEqual(config.flakyTestRetriesCount, 5)
+        assert.strictEqual(config.testOptimization.DD_CIVISIBILITY_FLAKY_RETRY_COUNT, 5)
       })
       it('should set the session name if DD_TEST_SESSION_NAME is set', () => {
         process.env.DD_TEST_SESSION_NAME = 'my-test-session'
@@ -3444,15 +3474,15 @@ describe('Config', () => {
         const config = getConfig(options)
         assert.strictEqual(config.DD_AGENTLESS_LOG_SUBMISSION_ENABLED, true)
       })
-      it('should set isTestDynamicInstrumentationEnabled by default', () => {
+      it('should set DD_TEST_FAILED_TEST_REPLAY_ENABLED by default', () => {
         const config = getConfig(options)
-        assert.strictEqual(config.isTestDynamicInstrumentationEnabled, true)
+        assert.strictEqual(config.testOptimization.DD_TEST_FAILED_TEST_REPLAY_ENABLED, true)
       })
-      it('should set isTestDynamicInstrumentationEnabled to false if DD_TEST_FAILED_TEST_REPLAY_ENABLED is false',
+      it('should set DD_TEST_FAILED_TEST_REPLAY_ENABLED to false if DD_TEST_FAILED_TEST_REPLAY_ENABLED is false',
         () => {
           process.env.DD_TEST_FAILED_TEST_REPLAY_ENABLED = 'false'
           const config = getConfig(options)
-          assert.strictEqual(config.isTestDynamicInstrumentationEnabled, false)
+          assert.strictEqual(config.testOptimization.DD_TEST_FAILED_TEST_REPLAY_ENABLED, false)
         })
     })
     context('ci visibility mode is not enabled', () => {
@@ -3462,8 +3492,10 @@ describe('Config', () => {
         const config = getConfig(options)
         assertObjectContains(config, {
           isCiVisibility: false,
-          isIntelligentTestRunnerEnabled: true,
-          isGitUploadEnabled: true,
+          testOptimization: {
+            DD_CIVISIBILITY_ITR_ENABLED: true,
+            DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true,
+          },
         })
       })
     })
@@ -3471,21 +3503,21 @@ describe('Config', () => {
     it('should accept all values for DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER', () => {
       for (const provider of ['github', 'gitlab', 'circleci', 'jenkins']) {
         process.env.DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER = provider
-        assert.strictEqual(getConfig(options).DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER, provider)
+        assert.strictEqual(getConfig(options).testOptimization.DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER, provider)
       }
     })
 
     it('disables telemetry if inside a jest worker', () => {
       process.env.JEST_WORKER_ID = '1'
       const config = getConfig(options)
-      assert.strictEqual(config.telemetry.enabled, false)
+      assert.strictEqual(config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED, false)
     })
   })
 
   context('llmobs config', () => {
     it('should disable llmobs by default', () => {
       const config = getConfig()
-      assert.strictEqual(config.llmobs.enabled, false)
+      assert.strictEqual(config.llmobs.DD_LLMOBS_ENABLED, false)
 
       // check origin computation
       assertConfigUpdateContains(updateConfig.getCall(0).args[0], [{
@@ -3496,7 +3528,7 @@ describe('Config', () => {
     it('should enable llmobs if DD_LLMOBS_ENABLED is set to true', () => {
       process.env.DD_LLMOBS_ENABLED = 'true'
       const config = getConfig()
-      assert.strictEqual(config.llmobs.enabled, true)
+      assert.strictEqual(config.llmobs.DD_LLMOBS_ENABLED, true)
 
       // check origin computation
       assertConfigUpdateContains(updateConfig.getCall(0).args[0], [{
@@ -3507,7 +3539,7 @@ describe('Config', () => {
     it('should disable llmobs if DD_LLMOBS_ENABLED is set to false', () => {
       process.env.DD_LLMOBS_ENABLED = 'false'
       const config = getConfig()
-      assert.strictEqual(config.llmobs.enabled, false)
+      assert.strictEqual(config.llmobs.DD_LLMOBS_ENABLED, false)
 
       // check origin computation
       assertConfigUpdateContains(updateConfig.getCall(0).args[0], [{
@@ -3517,7 +3549,7 @@ describe('Config', () => {
 
     it('should enable llmobs with options and DD_LLMOBS_ENABLED is not set', () => {
       const config = getConfig({ llmobs: { agentlessEnabled: true } })
-      assert.strictEqual(config.llmobs.enabled, true)
+      assert.strictEqual(config.llmobs.DD_LLMOBS_ENABLED, true)
 
       // check origin computation
       assertConfigUpdateContains(updateConfig.getCall(0).args[0], [{
@@ -3528,7 +3560,7 @@ describe('Config', () => {
     it('should have DD_LLMOBS_ENABLED take priority over options', () => {
       process.env.DD_LLMOBS_ENABLED = 'false'
       const config = getConfig({ llmobs: { agentlessEnabled: true } })
-      assert.strictEqual(config.llmobs.enabled, false)
+      assert.strictEqual(config.llmobs.DD_LLMOBS_ENABLED, false)
 
       // check origin computation
       assertConfigUpdateContains(updateConfig.getCall(0).args[0], [{
@@ -3724,7 +3756,7 @@ describe('Config', () => {
       assertObjectContains(config, {
         apmTracingEnabled: true,
         stats: {
-          enabled: true,
+          DD_TRACE_STATS_COMPUTATION_ENABLED: true,
         },
       })
 
@@ -3742,7 +3774,7 @@ describe('Config', () => {
       assertObjectContains(config, {
         apmTracingEnabled: false,
         stats: {
-          enabled: false,
+          DD_TRACE_STATS_COMPUTATION_ENABLED: false,
         },
       })
 
@@ -3760,7 +3792,7 @@ describe('Config', () => {
       assertObjectContains(config, {
         apmTracingEnabled: false,
         stats: {
-          enabled: false,
+          DD_TRACE_STATS_COMPUTATION_ENABLED: false,
         },
       })
     })
@@ -3966,8 +3998,8 @@ apm_configuration_default:
           maxConcurrentRequests: 10,
         },
         telemetry: {
-          heartbeatInterval: 42000,
-          metrics: false,
+          DD_TELEMETRY_HEARTBEAT_INTERVAL: 42000,
+          DD_TELEMETRY_METRICS_ENABLED: false,
         },
         llmobs: {
           mlApp: 'my-llm-app',
@@ -3998,7 +4030,7 @@ apm_configuration_default:
 `)
       let config = getConfig()
       assertObjectContains(config, {
-        apiKey: 'local-api-key',
+        DD_API_KEY: 'local-api-key',
         DD_APP_KEY: 'local-app-key',
         DD_INSTRUMENTATION_INSTALL_ID: 'local-install-id',
         DD_INSTRUMENTATION_INSTALL_TIME: '1234567890',
@@ -4016,7 +4048,7 @@ apm_configuration_default:
       process.env.DD_TRACE_CLOUD_PAYLOAD_TAGGING_MAX_DEPTH = '7'
       config = getConfig()
       assertObjectContains(config, {
-        apiKey: 'env-api-key',
+        DD_API_KEY: 'env-api-key',
         DD_APP_KEY: 'env-app-key',
         DD_INSTRUMENTATION_INSTALL_ID: 'env-install-id',
         cloudPayloadTagging: {
@@ -4046,7 +4078,7 @@ rules:
 `)
       config = getConfig()
       assertObjectContains(config, {
-        apiKey: 'fleet-api-key',
+        DD_API_KEY: 'fleet-api-key',
         DD_APP_KEY: 'fleet-app-key',
         DD_INSTRUMENTATION_INSTALL_ID: 'fleet-install-id',
         DD_INSTRUMENTATION_INSTALL_TIME: '9999999999',
@@ -4086,60 +4118,60 @@ rules:
 
     it('should be false by default', () => {
       const config = getConfig()
-      assert.strictEqual(config.resourceRenamingEnabled, false)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, false)
     })
 
     it('should be enabled when DD_TRACE_RESOURCE_RENAMING_ENABLED is true', () => {
       process.env.DD_TRACE_RESOURCE_RENAMING_ENABLED = 'true'
       const config = getConfig()
-      assert.strictEqual(config.resourceRenamingEnabled, true)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, true)
     })
 
     it('should be disabled when DD_TRACE_RESOURCE_RENAMING_ENABLED is false', () => {
       process.env.DD_TRACE_RESOURCE_RENAMING_ENABLED = 'false'
       const config = getConfig()
-      assert.strictEqual(config.resourceRenamingEnabled, false)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, false)
     })
 
     it('should be enabled when appsec is enabled via env var', () => {
       process.env.DD_APPSEC_ENABLED = 'true'
       const config = getConfig()
-      assert.strictEqual(config.resourceRenamingEnabled, true)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, true)
     })
 
     it('should be enabled when appsec is enabled via options', () => {
       const config = getConfig({ appsec: { enabled: true } })
-      assert.strictEqual(config.resourceRenamingEnabled, true)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, true)
     })
 
     it('should prioritize DD_TRACE_RESOURCE_RENAMING_ENABLED over appsec setting', () => {
       process.env.DD_APPSEC_ENABLED = 'true'
       process.env.DD_TRACE_RESOURCE_RENAMING_ENABLED = 'false'
       const config = getConfig()
-      assert.strictEqual(config.resourceRenamingEnabled, false)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, false)
     })
 
     it('should prioritize DD_TRACE_RESOURCE_RENAMING_ENABLED over appsec option', () => {
       process.env.DD_TRACE_RESOURCE_RENAMING_ENABLED = 'false'
       const config = getConfig({ appsec: { enabled: true } })
-      assert.strictEqual(config.resourceRenamingEnabled, false)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, false)
     })
 
     it('should enable when appsec is enabled via both env and options', () => {
       process.env.DD_APPSEC_ENABLED = 'true'
       const config = getConfig({ appsec: { enabled: true } })
-      assert.strictEqual(config.resourceRenamingEnabled, true)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, true)
     })
 
     it('should remain false when appsec is disabled', () => {
       process.env.DD_APPSEC_ENABLED = 'false'
       const config = getConfig()
-      assert.strictEqual(config.resourceRenamingEnabled, false)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, false)
     })
 
     it('should remain false when appsec is disabled via options', () => {
       const config = getConfig({ appsec: { enabled: false } })
-      assert.strictEqual(config.resourceRenamingEnabled, false)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, false)
     })
   })
 
@@ -4310,60 +4342,60 @@ rules:
 
     it('should be false by default', () => {
       const config = getConfig()
-      assert.strictEqual(config.resourceRenamingEnabled, false)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, false)
     })
 
     it('should be enabled when DD_TRACE_RESOURCE_RENAMING_ENABLED is true', () => {
       process.env.DD_TRACE_RESOURCE_RENAMING_ENABLED = 'true'
       const config = getConfig()
-      assert.strictEqual(config.resourceRenamingEnabled, true)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, true)
     })
 
     it('should be disabled when DD_TRACE_RESOURCE_RENAMING_ENABLED is false', () => {
       process.env.DD_TRACE_RESOURCE_RENAMING_ENABLED = 'false'
       const config = getConfig()
-      assert.strictEqual(config.resourceRenamingEnabled, false)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, false)
     })
 
     it('should be enabled when appsec is enabled via env var', () => {
       process.env.DD_APPSEC_ENABLED = 'true'
       const config = getConfig()
-      assert.strictEqual(config.resourceRenamingEnabled, true)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, true)
     })
 
     it('should be enabled when appsec is enabled via options', () => {
       const config = getConfig({ appsec: { enabled: true } })
-      assert.strictEqual(config.resourceRenamingEnabled, true)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, true)
     })
 
     it('should prioritize DD_TRACE_RESOURCE_RENAMING_ENABLED over appsec setting', () => {
       process.env.DD_APPSEC_ENABLED = 'true'
       process.env.DD_TRACE_RESOURCE_RENAMING_ENABLED = 'false'
       const config = getConfig()
-      assert.strictEqual(config.resourceRenamingEnabled, false)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, false)
     })
 
     it('should prioritize DD_TRACE_RESOURCE_RENAMING_ENABLED over appsec option', () => {
       process.env.DD_TRACE_RESOURCE_RENAMING_ENABLED = 'false'
       const config = getConfig({ appsec: { enabled: true } })
-      assert.strictEqual(config.resourceRenamingEnabled, false)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, false)
     })
 
     it('should enable when appsec is enabled via both env and options', () => {
       process.env.DD_APPSEC_ENABLED = 'true'
       const config = getConfig({ appsec: { enabled: true } })
-      assert.strictEqual(config.resourceRenamingEnabled, true)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, true)
     })
 
     it('should remain false when appsec is disabled', () => {
       process.env.DD_APPSEC_ENABLED = 'false'
       const config = getConfig()
-      assert.strictEqual(config.resourceRenamingEnabled, false)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, false)
     })
 
     it('should remain false when appsec is disabled via options', () => {
       const config = getConfig({ appsec: { enabled: false } })
-      assert.strictEqual(config.resourceRenamingEnabled, false)
+      assert.strictEqual(config.DD_TRACE_RESOURCE_RENAMING_ENABLED, false)
     })
   })
 
@@ -4430,12 +4462,12 @@ rules:
       assert.strictEqual(config.logInjection, false)
     })
 
-    it('should map tracing_enabled to tracing', () => {
+    it('should map tracing_enabled to DD_TRACE_ENABLED', () => {
       // Tracing is not exposed as programmatic option and will be ignored.
       const config = getConfig({ tracing: false })
-      assert.strictEqual(config.tracing, true)
-      config.setRemoteConfig({ tracing: false })
-      assert.strictEqual(config.tracing, false)
+      assert.strictEqual(config.DD_TRACE_ENABLED, true)
+      config.setRemoteConfig({ DD_TRACE_ENABLED: false })
+      assert.strictEqual(config.DD_TRACE_ENABLED, false)
     })
 
     it('should map tracing_sampling_rules to samplingRules', () => {
@@ -4475,15 +4507,15 @@ rules:
       const config = getConfig({ logInjection: true, sampleRate: 0.5 })
 
       assertObjectContains(config, {
-        tracing: true,
+        DD_TRACE_ENABLED: true,
         logInjection: true,
         sampleRate: 0.5,
       })
 
-      config.setRemoteConfig({ tracing: false })
+      config.setRemoteConfig({ DD_TRACE_ENABLED: false })
 
       assertObjectContains(config, {
-        tracing: false,
+        DD_TRACE_ENABLED: false,
         logInjection: true,
         sampleRate: 0.5,
       })
@@ -4491,7 +4523,7 @@ rules:
       config.setRemoteConfig(null)
 
       assertObjectContains(config, {
-        tracing: true,
+        DD_TRACE_ENABLED: true,
         logInjection: true,
         sampleRate: 0.5,
       })
@@ -4506,14 +4538,14 @@ rules:
     it('should treat null values as unset', () => {
       const config = getConfig({ sampleRate: 0.5, tracing: true })
       assert.strictEqual(config.sampleRate, 0.5)
-      assert.strictEqual(config.tracing, true)
-      config.setRemoteConfig({ sampleRate: 0.8, tracing: false })
+      assert.strictEqual(config.DD_TRACE_ENABLED, true)
+      config.setRemoteConfig({ sampleRate: 0.8, DD_TRACE_ENABLED: false })
       assert.strictEqual(config.sampleRate, 0.8)
-      assert.strictEqual(config.tracing, false)
+      assert.strictEqual(config.DD_TRACE_ENABLED, false)
       assert.strictEqual(config.logInjection, true)
       config.setRemoteConfig({ logInjection: false })
       assert.strictEqual(config.sampleRate, 0.5)
-      assert.strictEqual(config.tracing, true)
+      assert.strictEqual(config.DD_TRACE_ENABLED, true)
       assert.strictEqual(config.logInjection, false)
     })
 
@@ -4570,20 +4602,20 @@ rules:
       updateConfig.resetHistory()
 
       config.setRemoteConfig({
-        tracing: false,
+        DD_TRACE_ENABLED: false,
         sampleRate: 0.8,
       })
 
-      assert.strictEqual(config.getOrigin('tracing'), 'remote_config')
+      assert.strictEqual(config.getOrigin('DD_TRACE_ENABLED'), 'remote_config')
       assert.strictEqual(config.getOrigin('sampleRate'), 'remote_config')
 
       config.setRemoteConfig({
         sampleRate: 0.8,
       })
 
-      assert.strictEqual(config.tracing, true)
+      assert.strictEqual(config.DD_TRACE_ENABLED, true)
       assert.strictEqual(config.sampleRate, 0.8)
-      assert.strictEqual(config.getOrigin('tracing'), 'default')
+      assert.strictEqual(config.getOrigin('DD_TRACE_ENABLED'), 'default')
       assert.strictEqual(config.getOrigin('sampleRate'), 'remote_config')
     })
 
@@ -4593,7 +4625,7 @@ rules:
       updateConfig.resetHistory()
 
       config.setRemoteConfig({
-        tracing: false,
+        DD_TRACE_ENABLED: false,
         sampleRate: 0.1,
       })
       config.setRemoteConfig({
@@ -4616,30 +4648,30 @@ rules:
       const config = getConfig()
 
       assertObjectContains(config, {
-        tracing: true,
+        DD_TRACE_ENABLED: true,
         logInjection: true,
       })
 
       assert.strictEqual(config.sampleRate, undefined)
 
       config.setRemoteConfig({
-        tracing: true,
+        DD_TRACE_ENABLED: true,
         logInjection: false,
         sampleRate: 0.8,
       })
 
       assertObjectContains(config, {
-        tracing: true,
+        DD_TRACE_ENABLED: true,
         logInjection: false,
         sampleRate: 0.8,
       })
 
       config.setRemoteConfig({
-        tracing: false,
+        DD_TRACE_ENABLED: false,
       })
 
       assertObjectContains(config, {
-        tracing: false,
+        DD_TRACE_ENABLED: false,
         logInjection: true,
       })
       assert.strictEqual(config.sampleRate, undefined)
@@ -4667,7 +4699,7 @@ rules:
     it('should disable stats computation when agentless is enabled', () => {
       process.env._DD_APM_TRACING_AGENTLESS_ENABLED = 'true'
       const config = getConfig()
-      assert.strictEqual(config.stats.enabled, false)
+      assert.strictEqual(config.stats.DD_TRACE_STATS_COMPUTATION_ENABLED, false)
     })
 
     it('should enable hostname reporting when agentless is enabled', () => {
diff --git a/packages/dd-trace/test/datastreams/flush_on_write.spec.js b/packages/dd-trace/test/datastreams/flush_on_write.spec.js
new file mode 100644
index 0000000000..c701402dc8
--- /dev/null
+++ b/packages/dd-trace/test/datastreams/flush_on_write.spec.js
@@ -0,0 +1,99 @@
+'use strict'
+
+const assert = require('node:assert/strict')
+
+const { describe, it, beforeEach, afterEach } = require('mocha')
+const sinon = require('sinon')
+const proxyquire = require('proxyquire')
+
+require('../setup/core')
+
+const writer = {
+  flush: sinon.stub(),
+}
+const DataStreamsWriter = sinon.stub().returns(writer)
+const { DataStreamsProcessor } = proxyquire('../../src/datastreams/processor', {
+  './writer': { DataStreamsWriter },
+})
+
+const DEFAULT_TIMESTAMP = Number(new Date('2023-04-20T16:20:00.000Z'))
+
+const baseConfig = {
+  dsmEnabled: true,
+  hostname: '127.0.0.1',
+  port: 8126,
+  url: new URL('http://127.0.0.1:8126'),
+  env: 'test',
+  version: 'v1',
+  service: 'service1',
+  tags: { foo: 'foovalue', bar: 'barvalue' },
+}
+
+const checkpoint = {
+  currentTimestamp: DEFAULT_TIMESTAMP,
+  hash: Buffer.from('e858212fd11a41e5', 'hex'),
+  parentHash: Buffer.from('e858292fd15a41e4', 'hex'),
+  edgeTags: ['service:service-name', 'env:env-name', 'topic:test-topic'],
+  edgeLatencyNs: 100000000,
+  pathwayLatencyNs: 100000000,
+  payloadSize: 100,
+}
+
+// `flushInterval: 0` is the "flush on write" sentinel the agent/agentless trace exporters already
+// honor. The processor must push each recorded checkpoint immediately, while the writer URL is known
+// live. The previous `setInterval(onInterval, 0)` fired on every event-loop tick instead, decoupled
+// from the recording, so a tick landing after the agent listener was torn down posted to a dead port
+// and lost the bucket (it is cleared on serialize) — dropping the single payload a producer-only DSM
+// test waits for and timing it out.
+describe('DataStreamsProcessor flush-on-write', () => {
+  let processor
+
+  afterEach(() => {
+    clearTimeout(processor?.timer)
+    writer.flush.resetHistory()
+  })
+
+  describe('with flushInterval 0', () => {
+    beforeEach(() => {
+      processor = new DataStreamsProcessor({ ...baseConfig, flushInterval: 0 })
+    })
+
+    it('does not arm an interval timer', () => {
+      assert.strictEqual(processor.timer, undefined)
+    })
+
+    it('flushes synchronously while recording a checkpoint', () => {
+      processor.recordCheckpoint(checkpoint)
+
+      sinon.assert.calledOnce(writer.flush)
+    })
+
+    it('flushes synchronously while recording an offset', () => {
+      processor.recordOffset({ timestamp: DEFAULT_TIMESTAMP, partition: 0, topic: 'test-topic' })
+
+      sinon.assert.calledOnce(writer.flush)
+    })
+
+    it('flushes synchronously while tracking a transaction', () => {
+      processor.trackTransaction('msg-id-001', 'ingested')
+
+      sinon.assert.calledOnce(writer.flush)
+    })
+  })
+
+  describe('with a non-zero flushInterval', () => {
+    beforeEach(() => {
+      processor = new DataStreamsProcessor({ ...baseConfig, flushInterval: 1000 })
+    })
+
+    it('arms an interval timer', () => {
+      assert.notStrictEqual(processor.timer, undefined)
+    })
+
+    it('does not flush while recording a checkpoint', () => {
+      processor.recordCheckpoint(checkpoint)
+
+      sinon.assert.notCalled(writer.flush)
+    })
+  })
+})
diff --git a/packages/dd-trace/test/debugger/devtools_client/breakpoints.spec.js b/packages/dd-trace/test/debugger/devtools_client/breakpoints.spec.js
index 7f0df68390..f07a4563ef 100644
--- a/packages/dd-trace/test/debugger/devtools_client/breakpoints.spec.js
+++ b/packages/dd-trace/test/debugger/devtools_client/breakpoints.spec.js
@@ -23,6 +23,13 @@ describe('breakpoints', function () {
    * }}
    */
   let sessionMock
+  /**
+   * @type {{
+   *   getGeneratedPosition: sinon.SinonStub;
+   *   '@noCallThru': boolean;
+   * }}
+   */
+  let sourceMapsMock
   /**
    * @type {{
    *   debug: sinon.SinonStub;
@@ -31,6 +38,8 @@ describe('breakpoints', function () {
    * }}
    */
   let logMock
+  /** @type {() => void} */
+  let scriptLoadingStabilizedCallback
   /**
    * @type {{
    *   findScriptFromPartialPath: sinon.SinonStub;
@@ -77,14 +86,22 @@ describe('breakpoints', function () {
       }),
       /**
        * @param {string} event
-       * @param {Function} callback
+       * @param {() => void} callback
        */
       on (event, callback) {
-        if (event === 'scriptLoadingStabilized') callback()
+        if (event === 'scriptLoadingStabilized') {
+          scriptLoadingStabilizedCallback = callback
+          callback()
+        }
       },
       '@noCallThru': true,
     }
 
+    sourceMapsMock = {
+      getGeneratedPosition: sinon.stub(),
+      '@noCallThru': true,
+    }
+
     logMock = {
       debug: sinon.stub(),
       error: sinon.stub(),
@@ -108,6 +125,7 @@ describe('breakpoints', function () {
 
     breakpoints = proxyquire('../../../src/debugger/devtools_client/breakpoints', {
       './session': sessionMock,
+      './source-maps': sourceMapsMock,
       './state': stateMock,
       './log': logMock,
     })
@@ -176,6 +194,51 @@ describe('breakpoints', function () {
       )
     })
 
+    it('should translate source-mapped locations before setting the breakpoint', async function () {
+      stateMock.findScriptFromPartialPath.returns({
+        url: 'file:///path/to/test.js',
+        scriptId: 'script-1',
+        sourceMapURL: 'test.js.map',
+        source: 'source',
+      })
+      sourceMapsMock.getGeneratedPosition.resolves({ line: 12, column: 4 })
+
+      await addProbe()
+
+      sinon.assert.calledOnceWithExactly(
+        sourceMapsMock.getGeneratedPosition,
+        'file:///path/to/test.js',
+        'source',
+        10,
+        'test.js.map'
+      )
+      sinon.assert.calledWith(sessionMock.post.secondCall, 'Debugger.setBreakpoint', {
+        location: {
+          scriptId: 'script-1',
+          lineNumber: 11,
+          columnNumber: 4,
+        },
+        condition: compileBreakpointCondition([{ id: 'probe-1', samplingIndex: 0, nsBetweenSampling: 200000n }]),
+      })
+    })
+
+    it('should throw if a source map cannot resolve the generated location', async function () {
+      stateMock.findScriptFromPartialPath.returns({
+        url: 'file:///path/to/test.js',
+        scriptId: 'script-1',
+        sourceMapURL: 'test.js.map',
+        source: 'source',
+      })
+      sourceMapsMock.getGeneratedPosition.resolves({ line: null, column: null })
+
+      await assert.rejects(
+        addProbe(),
+        {
+          message: 'Could not find generated position for file:///path/to/test.js:10:0 (probe: probe-1, version: 1)',
+        }
+      )
+    })
+
     describe('capture limits', function () {
       it('should set default capture limits when captureSnapshot is true', async function () {
         await addProbe({ captureSnapshot: true })
@@ -468,6 +531,26 @@ describe('breakpoints', function () {
         })
     })
 
+    it('should wrap errors when setting a new breakpoint fails', async function () {
+      const cause = new Error('inspector failure')
+      sessionMock.post.callsFake((method, { location } = {}) => {
+        if (method === 'Debugger.setBreakpoint') {
+          return Promise.reject(cause)
+        }
+        return Promise.resolve({})
+      })
+
+      await assert.rejects(
+        addProbe(),
+        (err) => {
+          assert(err instanceof Error)
+          assert.strictEqual(err.message, 'Error setting breakpoint for probe probe-1 (version: 1)')
+          assert.strictEqual(err.cause, cause)
+          return true
+        }
+      )
+    })
+
     it('should wrap errors when replacing a breakpoint while adding a probe fails', async function () {
       await addProbe()
       sessionMock.post.resetHistory()
@@ -942,6 +1025,35 @@ describe('breakpoints', function () {
       })
     })
 
+    it('should wrap errors when removing a breakpoint fails', async function () {
+      await addProbe()
+      await addProbe({ id: 'probe-2', where: { sourceFile: 'test2.js', lines: ['20'] } })
+      sessionMock.post.resetHistory()
+
+      const cause = new Error('inspector failure')
+      sessionMock.post.callsFake((method, { location } = {}) => {
+        if (method === 'Debugger.removeBreakpoint') {
+          return Promise.reject(cause)
+        }
+        if (method === 'Debugger.setBreakpoint') {
+          return Promise.resolve({
+            breakpointId: `bp-${location.scriptId}:${location.lineNumber}:${location.columnNumber}`,
+          })
+        }
+        return Promise.resolve({})
+      })
+
+      await assert.rejects(
+        breakpoints.removeBreakpoint({ id: 'probe-1' }),
+        (err) => {
+          assert(err instanceof Error)
+          assert.strictEqual(err.message, 'Error removing breakpoint for probe probe-1')
+          assert.strictEqual(err.cause, cause)
+          return true
+        }
+      )
+    })
+
     it('should throw error if debugger not started', async function () {
       await breakpoints.removeBreakpoint({ id: 'probe-1' })
         .then(() => {
@@ -1032,6 +1144,26 @@ describe('breakpoints', function () {
     })
   })
 
+  describe('re-evaluation', function () {
+    it('should log errors from async probe re-evaluation', async function () {
+      await addProbe()
+      logMock.error.resetHistory()
+
+      const cause = new Error('script lookup failure')
+      stateMock.findScriptFromPartialPath.throws(cause)
+
+      scriptLoadingStabilizedCallback()
+      await Promise.resolve()
+
+      sinon.assert.calledWith(
+        logMock.error,
+        '[debugger:devtools_client] Error re-evaluating probe %s',
+        'probe-1',
+        cause
+      )
+    })
+  })
+
   /**
    * Add a generated probe.
    *
diff --git a/packages/dd-trace/test/exporters/agent/exporter.spec.js b/packages/dd-trace/test/exporters/agent/exporter.spec.js
index 7f35a21d95..e9b38fa44b 100644
--- a/packages/dd-trace/test/exporters/agent/exporter.spec.js
+++ b/packages/dd-trace/test/exporters/agent/exporter.spec.js
@@ -37,7 +37,7 @@ describe('Exporter', () => {
   })
 
   it('should pass computed stats header through to writer', () => {
-    const stats = { enabled: true }
+    const stats = { DD_TRACE_STATS_COMPUTATION_ENABLED: true }
     exporter = new Exporter({ url, flushInterval, stats }, prioritySampler)
     sinon.assert.calledWithMatch(Writer, {
       headers: {
@@ -47,7 +47,7 @@ describe('Exporter', () => {
   })
 
   it('should pass computed stats header through to writer if APM Tracing is disabled', () => {
-    const stats = { enabled: false }
+    const stats = { DD_TRACE_STATS_COMPUTATION_ENABLED: false }
     const apmTracingEnabled = false
     exporter = new Exporter({ url, flushInterval, stats, apmTracingEnabled }, prioritySampler)
 
@@ -59,7 +59,7 @@ describe('Exporter', () => {
   })
 
   it('should forward an IPv6 agent URL to the writer', () => {
-    const stats = { enabled: true }
+    const stats = { DD_TRACE_STATS_COMPUTATION_ENABLED: true }
     const url = new URL('http://[::1]:8126/')
     exporter = new Exporter({ url, flushInterval, stats }, prioritySampler)
     sinon.assert.calledWithMatch(Writer, { url })
diff --git a/packages/dd-trace/test/exporters/agentless/writer.spec.js b/packages/dd-trace/test/exporters/agentless/writer.spec.js
index 75d135f3c5..4e6b2cdb1d 100644
--- a/packages/dd-trace/test/exporters/agentless/writer.spec.js
+++ b/packages/dd-trace/test/exporters/agentless/writer.spec.js
@@ -53,7 +53,7 @@ describe('AgentlessWriter', () => {
       '../../encode/agentless-json': { AgentlessJSONEncoder },
       '../../../../../package.json': { version: 'tracerVersion' },
       '../../log': log,
-      '../../config': () => ({ apiKey }),
+      '../../config': () => ({ DD_API_KEY: apiKey }),
     })
   })
 
diff --git a/packages/dd-trace/test/llmobs/cassettes/anthropic/anthropic_v1_messages_post_f33becab.json b/packages/dd-trace/test/llmobs/cassettes/anthropic/anthropic_v1_messages_post_f33becab.json
new file mode 100644
index 0000000000..79041e55a8
--- /dev/null
+++ b/packages/dd-trace/test/llmobs/cassettes/anthropic/anthropic_v1_messages_post_f33becab.json
@@ -0,0 +1,64 @@
+{
+  "request": {
+    "method": "POST",
+    "url": "https://api.anthropic.com/v1/messages",
+    "headers": {
+      "Connection": "keep-alive",
+      "Accept": "application/json",
+      "User-Agent": "Anthropic/JS 0.103.0",
+      "X-Stainless-Retry-Count": "0",
+      "X-Stainless-Timeout": "600",
+      "X-Stainless-Lang": "js",
+      "X-Stainless-Package-Version": "0.103.0",
+      "X-Stainless-OS": "MacOS",
+      "X-Stainless-Arch": "arm64",
+      "X-Stainless-Runtime": "node",
+      "X-Stainless-Runtime-Version": "v24.14.1",
+      "anthropic-dangerous-direct-browser-access": "true",
+      "anthropic-version": "2023-06-01",
+      "Content-Type": "application/json",
+      "Accept-Language": "*",
+      "sec-fetch-mode": "cors",
+      "Accept-Encoding": "gzip, deflate",
+      "Content-Length": "119"
+    },
+    "body": "{\"model\":\"claude-haiku-4-5-20251001\",\"stream\":false,\"max_tokens\":16384,\"messages\":[{\"role\":\"user\",\"content\":\"Hello!\"}]}"
+  },
+  "response": {
+    "status": {
+      "code": 200,
+      "message": "OK"
+    },
+    "headers": {
+      "Date": "Mon, 29 Jun 2026 14:16:58 GMT",
+      "Content-Type": "application/json",
+      "Transfer-Encoding": "chunked",
+      "Connection": "keep-alive",
+      "anthropic-ratelimit-requests-limit": "20000",
+      "anthropic-ratelimit-requests-remaining": "19998",
+      "anthropic-ratelimit-requests-reset": "2026-06-29T14:16:58Z",
+      "anthropic-ratelimit-input-tokens-limit": "33800000",
+      "anthropic-ratelimit-input-tokens-remaining": "33800000",
+      "anthropic-ratelimit-input-tokens-reset": "2026-06-29T14:16:58Z",
+      "anthropic-ratelimit-output-tokens-limit": "5100000",
+      "anthropic-ratelimit-output-tokens-remaining": "5100000",
+      "anthropic-ratelimit-output-tokens-reset": "2026-06-29T14:16:58Z",
+      "anthropic-ratelimit-tokens-limit": "38900000",
+      "anthropic-ratelimit-tokens-remaining": "38900000",
+      "anthropic-ratelimit-tokens-reset": "2026-06-29T14:16:58Z",
+      "request-id": "req_011CcXhCJTXFMEuMGt6iEuHA",
+      "strict-transport-security": "max-age=31536000; includeSubDomains; preload",
+      "anthropic-organization-id": "4257e925-ee99-4ee8-9c62-8e53716d5203",
+      "traceresponse": "00-75c1a803ef6b4f92f13c54ae89f07e25-a2248baea3a4f9cf-01",
+      "Server": "cloudflare",
+      "Content-Encoding": "gzip",
+      "vary": "Accept-Encoding",
+      "set-cookie": "_cfuvid=ov4s.yYh5a1cexjfcJhG8G45yw0PzpbmovIDjn8nwHs-1782742618.0674112-1.0.1.1-p3F3KU37ARKYBb0tekk.tvPEZexvEl_nj_aMRcnWKqI; HttpOnly; SameSite=None; Secure; Path=/; Domain=api.anthropic.com",
+      "X-Robots-Tag": "none",
+      "cf-cache-status": "DYNAMIC",
+      "Content-Security-Policy": "default-src 'none'; frame-ancestors 'none'",
+      "CF-RAY": "a1358d52eedc09ae-EWR"
+    },
+    "body": "{\"model\":\"claude-haiku-4-5-20251001\",\"id\":\"msg_01Umb157FEvyPktZZSgdcmZQ\",\"type\":\"message\",\"role\":\"assistant\",\"content\":[{\"type\":\"text\",\"text\":\"Hi there! How can I help you today?\"}],\"stop_reason\":\"end_turn\",\"stop_sequence\":null,\"stop_details\":null,\"usage\":{\"input_tokens\":9,\"cache_creation_input_tokens\":0,\"cache_read_input_tokens\":0,\"cache_creation\":{\"ephemeral_5m_input_tokens\":0,\"ephemeral_1h_input_tokens\":0},\"output_tokens\":13,\"service_tier\":\"standard\",\"inference_geo\":\"not_available\"}}"
+  }
+}
diff --git a/packages/dd-trace/test/llmobs/index.spec.js b/packages/dd-trace/test/llmobs/index.spec.js
index 7fd14e5a9f..e818bbff63 100644
--- a/packages/dd-trace/test/llmobs/index.spec.js
+++ b/packages/dd-trace/test/llmobs/index.spec.js
@@ -230,7 +230,7 @@ describe('module', () => {
           llmobs: {
             agentlessEnabled: true,
           },
-          apiKey: 'test',
+          DD_API_KEY: 'test',
           site: 'datadoghq.com',
         })
 
@@ -285,7 +285,7 @@ describe('module', () => {
         it('configures the agentless writers', () => {
           llmobsModule.enable({
             llmobs: {},
-            apiKey: 'test',
+            DD_API_KEY: 'test',
             site: 'datadoghq.com',
           })
 
@@ -327,7 +327,7 @@ describe('module', () => {
 
       describe('when no site is provided', () => {
         it('throws an error', () => {
-          llmobsModule.enable({ llmobs: {}, apiKey: 'test', startupLogs: true })
+          llmobsModule.enable({ llmobs: {}, DD_API_KEY: 'test', startupLogs: true })
 
           sinon.assert.calledWith(startupLogStub, INCOMPATIBLE_INITIALIZATION)
         })
@@ -335,7 +335,7 @@ describe('module', () => {
 
       describe('when an API key is provided', () => {
         it('configures the agentless writers', () => {
-          llmobsModule.enable({ llmobs: {}, apiKey: 'test', site: 'datadoghq.com' })
+          llmobsModule.enable({ llmobs: {}, DD_API_KEY: 'test', site: 'datadoghq.com' })
 
           sinon.assert.calledWith(LLMObsSpanWriterSpy().setAgentless, true)
           sinon.assert.calledWith(LLMObsEvalMetricsWriterSpy().setAgentless, true)
diff --git a/packages/dd-trace/test/llmobs/plugins/aws-sdk/bedrockruntime.spec.js b/packages/dd-trace/test/llmobs/plugins/aws-sdk/bedrockruntime.spec.js
index 4a70ef0383..a894dd899c 100644
--- a/packages/dd-trace/test/llmobs/plugins/aws-sdk/bedrockruntime.spec.js
+++ b/packages/dd-trace/test/llmobs/plugins/aws-sdk/bedrockruntime.spec.js
@@ -37,7 +37,7 @@ describe('Plugin', () => {
 
       describe('with configuration', () => {
         before(() => {
-          const requireVersion = version === '3.0.0' ? '3.422.0' : '>=3.422.0'
+          const requireVersion = version === '3.0.0' ? '3.422.0' : '3'
           AWS = require(`../../../../../../versions/${bedrockRuntimeClientName}@${requireVersion}`).get()
           const NodeHttpHandler =
             require(`../../../../../../versions/${bedrockRuntimeClientName}@${requireVersion}`)
diff --git a/packages/dd-trace/test/llmobs/plugins/aws-sdk/bedrockruntime.token-cache.spec.js b/packages/dd-trace/test/llmobs/plugins/aws-sdk/bedrockruntime.token-cache.spec.js
index deb8731c6f..64303f1233 100644
--- a/packages/dd-trace/test/llmobs/plugins/aws-sdk/bedrockruntime.token-cache.spec.js
+++ b/packages/dd-trace/test/llmobs/plugins/aws-sdk/bedrockruntime.token-cache.spec.js
@@ -39,7 +39,7 @@ describe('BedrockRuntime LLMObs plugin pending token headers', () => {
     })
 
     plugin = new BedrockRuntimePlugin({}, {
-      llmobs: { enabled: true, mlApp: 'test' },
+      llmobs: { DD_LLMOBS_ENABLED: true, mlApp: 'test' },
       service: 'test',
     })
     plugin._tagger = {
diff --git a/packages/dd-trace/test/llmobs/plugins/langchain/index.spec.js b/packages/dd-trace/test/llmobs/plugins/langchain/index.spec.js
index 8427f697d0..68399dcfec 100644
--- a/packages/dd-trace/test/llmobs/plugins/langchain/index.spec.js
+++ b/packages/dd-trace/test/llmobs/plugins/langchain/index.spec.js
@@ -164,7 +164,7 @@ describe('integrations', () => {
             .tool
 
           if (semifies(realVersion, '>=1.0')) {
-            MemoryVectorStore = require('../../../../../../versions/@langchain/classic@>=1.0')
+            MemoryVectorStore = require('../../../../../../versions/@langchain/classic@1')
               .get('@langchain/classic/vectorstores/memory')
               .MemoryVectorStore
           } else {
diff --git a/packages/dd-trace/test/llmobs/sdk/index.spec.js b/packages/dd-trace/test/llmobs/sdk/index.spec.js
index aa5d4bea10..d023fe94ac 100644
--- a/packages/dd-trace/test/llmobs/sdk/index.spec.js
+++ b/packages/dd-trace/test/llmobs/sdk/index.spec.js
@@ -81,7 +81,7 @@ describe('sdk', () => {
       [false, 'disabled'],
     ]) {
       it(`returns ${value} when llmobs is ${label}`, () => {
-        const enabledOrDisabledLLMObs = new LLMObsSDK(null, { disable () {} }, { llmobs: { enabled: value } })
+        const enabledOrDisabledLLMObs = new LLMObsSDK(null, { disable () {} }, { llmobs: { DD_LLMOBS_ENABLED: value } })
 
         assert.strictEqual(enabledOrDisabledLLMObs.enabled, value)
         enabledOrDisabledLLMObs.disable() // unsubscribe
@@ -163,7 +163,7 @@ describe('sdk', () => {
 
     it('does not disable llmobs if it is already disabled', () => {
       // do not fully enable a disabled llmobs
-      const disabledLLMObs = new LLMObsSDK(null, { disable () {} }, { llmobs: { enabled: false } })
+      const disabledLLMObs = new LLMObsSDK(null, { disable () {} }, { llmobs: { DD_LLMOBS_ENABLED: false } })
       sinon.spy(disabledLLMObs._llmobsModule, 'disable')
 
       disabledLLMObs.disable()
@@ -177,7 +177,7 @@ describe('sdk', () => {
     describe('trace', () => {
       describe('tracing behavior', () => {
         it('starts a span if llmobs is disabled but does not process it in the LLMObs span processor', () => {
-          tracer._tracer._config.llmobs.enabled = false
+          tracer._tracer._config.llmobs.DD_LLMOBS_ENABLED = false
 
           llmobs.trace({ kind: 'workflow', name: 'myWorkflow' }, (span, cb) => {
             const tag = LLMObsTagger.tagMap.get(span)
@@ -189,7 +189,7 @@ describe('sdk', () => {
           sinon.assert.called(llmobs._tracer._processor.process)
           sinon.assert.notCalled(LLMObsSpanProcessor.prototype.format)
 
-          tracer._tracer._config.llmobs.enabled = true
+          tracer._tracer._config.llmobs.DD_LLMOBS_ENABLED = true
         })
 
         it('throws if the kind is invalid', () => {
@@ -426,7 +426,7 @@ describe('sdk', () => {
     describe('wrap', () => {
       describe('tracing behavior', () => {
         it('starts a span if llmobs is disabled but does not process it in the LLMObs span processor', () => {
-          tracer._tracer._config.llmobs.enabled = false
+          tracer._tracer._config.llmobs.DD_LLMOBS_ENABLED = false
 
           const fn = llmobs.wrap({ kind: 'workflow' }, (a) => {
             assert.strictEqual(a, 1)
@@ -439,7 +439,7 @@ describe('sdk', () => {
           sinon.assert.called(llmobs._tracer._processor.process)
           sinon.assert.notCalled(LLMObsSpanProcessor.prototype.format)
 
-          tracer._tracer._config.llmobs.enabled = true
+          tracer._tracer._config.llmobs.DD_LLMOBS_ENABLED = true
         })
 
         it('throws if the kind is invalid', () => {
@@ -903,14 +903,14 @@ describe('sdk', () => {
 
   describe('annotate', () => {
     it('returns if llmobs is disabled', () => {
-      tracer._tracer._config.llmobs.enabled = false
+      tracer._tracer._config.llmobs.DD_LLMOBS_ENABLED = false
       sinon.spy(llmobs, '_active')
       llmobs.annotate()
 
       sinon.assert.notCalled(llmobs._active)
       llmobs._active.restore()
 
-      tracer._tracer._config.llmobs.enabled = true
+      tracer._tracer._config.llmobs.DD_LLMOBS_ENABLED = true
     })
 
     it('throws if no arguments are provided', () => {
@@ -1411,8 +1411,8 @@ describe('sdk', () => {
     let originalApiKey
 
     before(() => {
-      originalApiKey = tracer._tracer._config.apiKey
-      tracer._tracer._config.apiKey = 'test'
+      originalApiKey = tracer._tracer._config.DD_API_KEY
+      tracer._tracer._config.DD_API_KEY = 'test'
     })
 
     beforeEach(() => {
@@ -1423,16 +1423,16 @@ describe('sdk', () => {
     })
 
     after(() => {
-      tracer._tracer._config.apiKey = originalApiKey
+      tracer._tracer._config.DD_API_KEY = originalApiKey
     })
 
     it('does not submit an evaluation if llmobs is disabled', () => {
-      tracer._tracer._config.llmobs.enabled = false
+      tracer._tracer._config.llmobs.DD_LLMOBS_ENABLED = false
       llmobs.submitEvaluation()
 
       sinon.assert.notCalled(LLMObsEvalMetricsWriter.prototype.append)
 
-      tracer._tracer._config.llmobs.enabled = true
+      tracer._tracer._config.llmobs.DD_LLMOBS_ENABLED = true
     })
 
     it('throws for an invalid span context', () => {
@@ -1722,7 +1722,7 @@ describe('sdk', () => {
         process.env.DD_TRACE_OTEL_ENABLED = 'true'
         const config = getConfigFresh({ llmobs: { mlApp: 'mlApp', agentlessEnabled: false } })
         delete process.env.DD_TRACE_OTEL_ENABLED
-        config.llmobs.enabled = true
+        config.llmobs.DD_LLMOBS_ENABLED = true
         otelLLMObs = new LLMObsSDK(tracer._tracer, llmobsModule, config)
       })
 
@@ -1743,12 +1743,12 @@ describe('sdk', () => {
 
   describe('flush', () => {
     it('does not flush if llmobs is disabled', () => {
-      tracer._tracer._config.llmobs.enabled = false
+      tracer._tracer._config.llmobs.DD_LLMOBS_ENABLED = false
       llmobs.flush()
 
       sinon.assert.notCalled(LLMObsEvalMetricsWriter.prototype.flush)
       sinon.assert.notCalled(LLMObsSpanWriter.prototype.flush)
-      tracer._tracer._config.llmobs.enabled = true
+      tracer._tracer._config.llmobs.DD_LLMOBS_ENABLED = true
     })
 
     it('flushes the evaluation writer and span writer', () => {
diff --git a/packages/dd-trace/test/llmobs/span_processor.spec.js b/packages/dd-trace/test/llmobs/span_processor.spec.js
index 21347b9d94..b6892f5f20 100644
--- a/packages/dd-trace/test/llmobs/span_processor.spec.js
+++ b/packages/dd-trace/test/llmobs/span_processor.spec.js
@@ -29,7 +29,7 @@ describe('span processor', () => {
       '../log': log,
     })
 
-    processor = new LLMObsSpanProcessor({ llmobs: { enabled: true } })
+    processor = new LLMObsSpanProcessor({ llmobs: { DD_LLMOBS_ENABLED: true } })
     processor.setWriter(writer)
   })
 
@@ -37,7 +37,7 @@ describe('span processor', () => {
     let span
 
     it('should do nothing if llmobs is not enabled', () => {
-      processor = new LLMObsSpanProcessor({ llmobs: { enabled: false } })
+      processor = new LLMObsSpanProcessor({ llmobs: { DD_LLMOBS_ENABLED: false } })
 
       processor.process(span)
     })
diff --git a/packages/dd-trace/test/llmobs/tagger.spec.js b/packages/dd-trace/test/llmobs/tagger.spec.js
index fcde0eb48a..b74f6645d9 100644
--- a/packages/dd-trace/test/llmobs/tagger.spec.js
+++ b/packages/dd-trace/test/llmobs/tagger.spec.js
@@ -60,12 +60,12 @@ describe('tagger', () => {
 
   describe('without softFail', () => {
     beforeEach(() => {
-      tagger = new Tagger({ llmobs: { enabled: true, mlApp: 'my-default-ml-app' } })
+      tagger = new Tagger({ llmobs: { DD_LLMOBS_ENABLED: true, mlApp: 'my-default-ml-app' } })
     })
 
     describe('registerLLMObsSpan', () => {
       it('will not set tags if llmobs is not enabled', () => {
-        tagger = new Tagger({ llmobs: { enabled: false } })
+        tagger = new Tagger({ llmobs: { DD_LLMOBS_ENABLED: false } })
         tagger.registerLLMObsSpan(span, 'llm')
 
         assert.deepStrictEqual(Tagger.tagMap.get(span), undefined)
@@ -196,7 +196,7 @@ describe('tagger', () => {
         })
 
         it('records a DROPPED decision on a root span when sampleRate is 0', () => {
-          tagger = new Tagger({ llmobs: { enabled: true, mlApp: 'my-default-ml-app', sampleRate: 0 } })
+          tagger = new Tagger({ llmobs: { DD_LLMOBS_ENABLED: true, mlApp: 'my-default-ml-app', sampleRate: 0 } })
           tagger.registerLLMObsSpan(span, { kind: 'llm' })
 
           const tags = Tagger.tagMap.get(span)
@@ -206,7 +206,7 @@ describe('tagger', () => {
 
         it('truncates a longer rate to at most 6 decimals', () => {
           // 1/3 = 0.3333... which must be capped at 6 decimal places.
-          tagger = new Tagger({ llmobs: { enabled: true, mlApp: 'my-default-ml-app', sampleRate: 1 / 3 } })
+          tagger = new Tagger({ llmobs: { DD_LLMOBS_ENABLED: true, mlApp: 'my-default-ml-app', sampleRate: 1 / 3 } })
           tagger.registerLLMObsSpan(span, { kind: 'llm' })
 
           assert.strictEqual(Tagger.tagMap.get(span)['_ml_obs.sample_rate'], '0.333333')
@@ -214,7 +214,7 @@ describe('tagger', () => {
 
         it('strips trailing zeros from a fractional rate', () => {
           // 0.25 -> "0.250000" via toFixed(6), which must be stripped back to "0.25".
-          tagger = new Tagger({ llmobs: { enabled: true, mlApp: 'my-default-ml-app', sampleRate: 0.25 } })
+          tagger = new Tagger({ llmobs: { DD_LLMOBS_ENABLED: true, mlApp: 'my-default-ml-app', sampleRate: 0.25 } })
           tagger.registerLLMObsSpan(span, { kind: 'llm' })
 
           assert.strictEqual(Tagger.tagMap.get(span)['_ml_obs.sample_rate'], '0.25')
@@ -253,7 +253,7 @@ describe('tagger', () => {
           // The tagger reads sampleRate from config on each root decision, so a
           // mutation (such as a future remote config update) takes effect without
           // re-instantiating the tagger.
-          const config = { llmobs: { enabled: true, mlApp: 'my-default-ml-app', sampleRate: 1 } }
+          const config = { llmobs: { DD_LLMOBS_ENABLED: true, mlApp: 'my-default-ml-app', sampleRate: 1 } }
           tagger = new Tagger(config)
 
           tagger.registerLLMObsSpan(span, { kind: 'llm' })
@@ -293,7 +293,7 @@ describe('tagger', () => {
 
       describe('with no global mlApp configured', () => {
         beforeEach(() => {
-          tagger = new Tagger({ llmobs: { enabled: true } })
+          tagger = new Tagger({ llmobs: { DD_LLMOBS_ENABLED: true } })
         })
 
         it('uses the mlApp from the propagated mlApp if no mlApp is provided', () => {
@@ -310,7 +310,7 @@ describe('tagger', () => {
         })
 
         it('uses the service name if no mlApp is provided and no propagated mlApp is provided', () => {
-          tagger = new Tagger({ llmobs: { enabled: true }, service: 'my-service' })
+          tagger = new Tagger({ llmobs: { DD_LLMOBS_ENABLED: true }, service: 'my-service' })
           tagger.registerLLMObsSpan(span, { kind: 'llm' })
 
           const tags = Tagger.tagMap.get(span)
@@ -344,7 +344,7 @@ describe('tagger', () => {
         })
 
         it('does not write bridge tags when llmobs is disabled', () => {
-          tagger = new Tagger({ llmobs: { enabled: false } })
+          tagger = new Tagger({ llmobs: { DD_LLMOBS_ENABLED: false } })
           tagger.registerLLMObsSpan(span, { kind: 'workflow' })
 
           assert.strictEqual(spanContext._trace.tags.llmobs_trace_id, undefined)
@@ -413,7 +413,7 @@ describe('tagger', () => {
                 findGenAIAncestorSpanId,
               },
             })
-            realTagger = new RealTagger({ llmobs: { enabled: true, mlApp: 'test-app' } })
+            realTagger = new RealTagger({ llmobs: { DD_LLMOBS_ENABLED: true, mlApp: 'test-app' } })
           })
 
           it('detects a real gen_ai.* ancestor, suppresses llmobs_parent_id, and uses ancestor as event parent', () => {
@@ -1233,7 +1233,7 @@ describe('tagger', () => {
 
   describe('with softFail', () => {
     beforeEach(() => {
-      tagger = new Tagger({ llmobs: { enabled: true, mlApp: 'my-default-ml-app' } }, true)
+      tagger = new Tagger({ llmobs: { DD_LLMOBS_ENABLED: true, mlApp: 'my-default-ml-app' } }, true)
     })
 
     it('logs a warning when an unexpected value is encountered for text tagging', () => {
diff --git a/packages/dd-trace/test/llmobs/writers/base.spec.js b/packages/dd-trace/test/llmobs/writers/base.spec.js
index 57d664a50c..e603296bdb 100644
--- a/packages/dd-trace/test/llmobs/writers/base.spec.js
+++ b/packages/dd-trace/test/llmobs/writers/base.spec.js
@@ -43,7 +43,7 @@ describe('BaseLLMObsWriter', () => {
       config: {
         site: 'site.com',
         url: new URL('http://localhost:8126'),
-        apiKey: 'test',
+        DD_API_KEY: 'test',
       },
     }
   })
diff --git a/packages/dd-trace/test/llmobs/writers/evaluations.spec.js b/packages/dd-trace/test/llmobs/writers/evaluations.spec.js
index aea247a426..7d863792e6 100644
--- a/packages/dd-trace/test/llmobs/writers/evaluations.spec.js
+++ b/packages/dd-trace/test/llmobs/writers/evaluations.spec.js
@@ -45,7 +45,7 @@ describe('LLMObsEvalMetricsWriter', () => {
   it('builds the payload correctly', () => {
     writer = new LLMObsEvalMetricsWriter({
       site: 'datadoghq.com',
-      apiKey: 'test',
+      DD_API_KEY: 'test',
     })
     writer.setAgentless(true)
 
diff --git a/packages/dd-trace/test/llmobs/writers/multi-tenant.spec.js b/packages/dd-trace/test/llmobs/writers/multi-tenant.spec.js
index 5d5b52da06..8bb17755de 100644
--- a/packages/dd-trace/test/llmobs/writers/multi-tenant.spec.js
+++ b/packages/dd-trace/test/llmobs/writers/multi-tenant.spec.js
@@ -21,7 +21,7 @@ describe('Multi-Tenant Routing', () => {
     site: 'default-site.com',
     hostname: 'localhost',
     port: 8126,
-    apiKey: 'default-key',
+    DD_API_KEY: 'default-key',
   }
 
   beforeEach(() => {
diff --git a/packages/dd-trace/test/opentelemetry/metrics/otlp_span_stats_exporter.spec.js b/packages/dd-trace/test/opentelemetry/metrics/otlp_span_stats_exporter.spec.js
new file mode 100644
index 0000000000..c1fae32129
--- /dev/null
+++ b/packages/dd-trace/test/opentelemetry/metrics/otlp_span_stats_exporter.spec.js
@@ -0,0 +1,182 @@
+'use strict'
+
+const assert = require('node:assert/strict')
+const http = require('node:http')
+const { describe, it, beforeEach, afterEach } = require('mocha')
+const sinon = require('sinon')
+
+require('../../setup/core')
+
+const { OtlpStatsExporter } = require('../../../src/opentelemetry/metrics/otlp_span_stats_exporter')
+const { buildResourceAttributes, createOtlpSpanStatsExporter } = require('../../../src/opentelemetry/metrics')
+const { SpanBuckets } = require('../../../src/span_stats')
+const { HTTP_STATUS_CODE } = require('../../../../../ext/tags')
+
+const RESOURCE_ATTRS = { 'service.name': 'svc' }
+const BUCKET_SIZE_NS = 10 * 1e9
+
+function makeSpan (overrides = {}) {
+  return {
+    startTime: 12345 * 1e9,
+    duration: 1000,
+    error: 0,
+    name: 'op',
+    service: 'svc',
+    resource: 'res',
+    type: 'web',
+    meta: { [HTTP_STATUS_CODE]: 200 },
+    metrics: {},
+    ...overrides,
+  }
+}
+
+function makeDrained (spans) {
+  const bucket = new SpanBuckets()
+  for (const span of spans) {
+    bucket.forSpan(span).record(span)
+  }
+  return [{ timeNs: 12340000000000, bucket }]
+}
+
+describe('buildResourceAttributes', () => {
+  it('includes sdk identity and maps service/env/version to OTel attributes', () => {
+    const attrs = buildResourceAttributes({}, { service: 'my-svc', env: 'prod', serviceVersion: '1.0.0' })
+
+    assert.strictEqual(attrs['telemetry.sdk.name'], 'datadog')
+    assert.strictEqual(attrs['telemetry.sdk.language'], 'nodejs')
+    assert.strictEqual(typeof attrs['telemetry.sdk.version'], 'string')
+    assert.strictEqual(attrs['service.name'], 'my-svc')
+    assert.strictEqual(attrs['deployment.environment.name'], 'prod')
+    assert.strictEqual(attrs['service.version'], '1.0.0')
+  })
+
+  it('includes datadog.runtime_id from tags when otelSemanticsEnabled is false', () => {
+    const attrs = buildResourceAttributes({ 'runtime-id': 'abc-123' }, { otelSemanticsEnabled: false })
+    assert.strictEqual(attrs['datadog.runtime_id'], 'abc-123')
+  })
+
+  it('omits dd.* attributes when otelSemanticsEnabled is true', () => {
+    const attrs = buildResourceAttributes({ 'runtime-id': 'abc-123' }, { otelSemanticsEnabled: true })
+    assert.ok(!Object.keys(attrs).some(k => k.startsWith('datadog.')))
+  })
+})
+
+describe('createOtlpSpanStatsExporter', () => {
+  let httpStub
+
+  beforeEach(() => {
+    httpStub = sinon.stub(http, 'request').returns({
+      write: sinon.stub(), end: sinon.stub(), on: sinon.stub(), once: sinon.stub(),
+    })
+  })
+
+  afterEach(() => httpStub.restore())
+
+  it('returns an OtlpStatsExporter configured from config', () => {
+    const exporter = createOtlpSpanStatsExporter({
+      OTEL_EXPORTER_OTLP_METRICS_ENDPOINT: 'http://localhost:4318/v1/metrics',
+      service: 'svc',
+    })
+    assert.ok(exporter instanceof OtlpStatsExporter)
+  })
+})
+
+describe('OtlpStatsExporter', () => {
+  let exporter
+  let httpStub
+  let mockReq
+
+  beforeEach(() => {
+    mockReq = {
+      write: sinon.stub(),
+      end: sinon.stub(),
+      on: sinon.stub(),
+      once: sinon.stub(),
+    }
+
+    httpStub = sinon.stub(http, 'request').callsFake((options, callback) => {
+      const mockRes = {
+        statusCode: 200,
+        on: sinon.stub(),
+        once: (event, handler) => {
+          if (event === 'end') handler()
+          return mockRes
+        },
+      }
+      if (callback) callback(mockRes)
+      return mockReq
+    })
+
+    exporter = new OtlpStatsExporter('http://localhost:4318/v1/metrics', 'http/json', RESOURCE_ATTRS)
+  })
+
+  afterEach(() => {
+    httpStub.restore()
+  })
+
+  it('sends a POST to /v1/metrics', () => {
+    const drained = makeDrained([makeSpan()])
+    exporter.export(drained, BUCKET_SIZE_NS)
+
+    assert.ok(httpStub.calledOnce)
+    const options = httpStub.firstCall.args[0]
+    assert.strictEqual(options.method, 'POST')
+    assert.strictEqual(options.path, '/v1/metrics')
+  })
+
+  it('sends a JSON payload containing the single duration histogram metric', () => {
+    const drained = makeDrained([makeSpan()])
+    exporter.export(drained, BUCKET_SIZE_NS)
+
+    const payload = JSON.parse(mockReq.write.firstCall.args[0].toString())
+    const { metrics } = payload.resourceMetrics[0].scopeMetrics[0]
+    assert.strictEqual(metrics.length, 1)
+    assert.strictEqual(metrics[0].name, 'traces.span.sdk.metrics.duration')
+  })
+
+  it('returns early when drained is empty', () => {
+    exporter.export([], BUCKET_SIZE_NS)
+    assert.ok(httpStub.notCalled)
+  })
+
+  it('uses http/json Content-Type', () => {
+    const drained = makeDrained([makeSpan()])
+    exporter.export(drained, BUCKET_SIZE_NS)
+
+    const options = httpStub.firstCall.args[0]
+    assert.strictEqual(options.headers['Content-Type'], 'application/json')
+  })
+
+  it('uses http/protobuf Content-Type when protocol is http/protobuf', () => {
+    const protoExporter = new OtlpStatsExporter('http://localhost:4318/v1/metrics', 'http/protobuf', RESOURCE_ATTRS)
+    const drained = makeDrained([makeSpan()])
+    protoExporter.export(drained, BUCKET_SIZE_NS)
+
+    const options = httpStub.firstCall.args[0]
+    assert.strictEqual(options.headers['Content-Type'], 'application/x-protobuf')
+  })
+
+  it('logs an error on non-2xx HTTP response', () => {
+    httpStub.callsFake((options, callback) => {
+      const mockRes = {
+        statusCode: 500,
+        on: (event, handler) => { if (event === 'data') handler('err body') },
+        once: (event, handler) => { if (event === 'end') handler() },
+      }
+      if (callback) callback(mockRes)
+      return mockReq
+    })
+
+    const drained = makeDrained([makeSpan()])
+    exporter.export(drained, BUCKET_SIZE_NS)
+    assert.ok(httpStub.calledOnce)
+  })
+
+  it('handles request error without throwing', () => {
+    mockReq.on = (event, handler) => { if (event === 'error') handler(new Error('connection refused')) }
+
+    const drained = makeDrained([makeSpan()])
+    exporter.export(drained, BUCKET_SIZE_NS)
+    assert.ok(httpStub.calledOnce)
+  })
+})
diff --git a/packages/dd-trace/test/opentelemetry/metrics/otlp_span_stats_transformer.spec.js b/packages/dd-trace/test/opentelemetry/metrics/otlp_span_stats_transformer.spec.js
new file mode 100644
index 0000000000..7fcb44e324
--- /dev/null
+++ b/packages/dd-trace/test/opentelemetry/metrics/otlp_span_stats_transformer.spec.js
@@ -0,0 +1,323 @@
+'use strict'
+
+const assert = require('node:assert/strict')
+const { describe, it, before } = require('mocha')
+
+require('../../setup/core')
+
+const OtlpStatsTransformer = require('../../../src/opentelemetry/metrics/otlp_span_stats_transformer')
+const { EXPLICIT_BOUNDS_SECONDS } = OtlpStatsTransformer
+const { SpanBuckets } = require('../../../src/span_stats')
+const { getProtobufTypes } = require('../../../src/opentelemetry/otlp/protobuf_loader')
+const { HTTP_STATUS_CODE, HTTP_METHOD, HTTP_ROUTE, SPAN_KIND, GRPC_STATUS_CODE } = require('../../../../../ext/tags')
+const { ORIGIN_KEY, TOP_LEVEL_KEY } = require('../../../src/constants')
+
+const METRIC_NAME = 'traces.span.sdk.metrics.duration'
+const RESOURCE_ATTRS = {
+  'telemetry.sdk.name': 'datadog',
+  'telemetry.sdk.language': 'nodejs',
+  'service.name': 'svc',
+  'service.version': '1.2.3',
+  'deployment.environment.name': 'test',
+}
+const DEFAULT_SERVICE = 'svc'
+const BUCKET_SIZE_NS = 10 * 1e9
+
+function makeSpan (overrides = {}) {
+  return {
+    startTime: 12345 * 1e9,
+    duration: 1000,
+    error: 0,
+    name: 'test.op',
+    service: 'svc',
+    resource: 'GET /foo',
+    type: 'web',
+    meta: { [HTTP_STATUS_CODE]: 200 },
+    metrics: {},
+    ...overrides,
+  }
+}
+
+function makeTopLevelSpan (overrides = {}) {
+  return makeSpan({ metrics: { [TOP_LEVEL_KEY]: 1 }, ...overrides })
+}
+
+function makeBucket (spans) {
+  const bucket = new SpanBuckets()
+  for (const span of spans) {
+    bucket.forSpan(span).record(span)
+  }
+  return bucket
+}
+
+function makeDrained (timeNs, spans) {
+  return [{ timeNs, bucket: makeBucket(spans) }]
+}
+
+/**
+ * @param {object} dataPoint
+ * @returns {Record<string, string | number | boolean>}
+ */
+function attrMapOf (dataPoint) {
+  return Object.fromEntries(dataPoint.attributes.map(a => {
+    const v = a.value
+    return [a.key, v.stringValue ?? v.boolValue ?? v.intValue ?? v.doubleValue]
+  }))
+}
+
+function dataPointsOf (payload) {
+  return payload.resourceMetrics[0].scopeMetrics[0].metrics[0].histogram.dataPoints
+}
+
+describe('OtlpStatsTransformer', () => {
+  let protoMetricsService
+  let protoAggregationTemporality
+
+  before(() => {
+    ({ protoMetricsService, protoAggregationTemporality } = getProtobufTypes())
+  })
+
+  describe('JSON format (default mode)', () => {
+    let transformer
+
+    before(() => {
+      transformer = new OtlpStatsTransformer(RESOURCE_ATTRS, 'http/json', false, DEFAULT_SERVICE)
+    })
+
+    it('emits a single histogram metric with the correct name, unit and temporality', () => {
+      const payload = JSON.parse(transformer.transform(makeDrained(12340000000000, [makeSpan()]), BUCKET_SIZE_NS))
+      const { metrics } = payload.resourceMetrics[0].scopeMetrics[0]
+
+      assert.strictEqual(metrics.length, 1)
+      assert.deepStrictEqual(
+        { name: metrics[0].name, unit: metrics[0].unit, temporality: metrics[0].histogram.aggregationTemporality },
+        { name: METRIC_NAME, unit: 's', temporality: 'AGGREGATION_TEMPORALITY_DELTA' }
+      )
+    })
+
+    it('maps span dimensions to OTel and dd.* data-point attributes', () => {
+      const span = makeSpan({
+        meta: {
+          [HTTP_STATUS_CODE]: 404,
+          [HTTP_METHOD]: 'POST',
+          [HTTP_ROUTE]: '/users/:id',
+          [SPAN_KIND]: 'server',
+          [GRPC_STATUS_CODE]: 'OK',
+          [ORIGIN_KEY]: 'synthetics',
+        },
+      })
+      const payload = JSON.parse(transformer.transform(makeDrained(12340000000000, [span]), BUCKET_SIZE_NS))
+
+      assert.deepStrictEqual(attrMapOf(dataPointsOf(payload)[0]), {
+        'span.name': 'GET /foo',
+        'span.kind': 'server',
+        'http.response.status_code': 404,
+        'http.request.method': 'POST',
+        'http.route': '/users/:id',
+        'rpc.response.status_code': 'OK',
+        'datadog.operation.name': 'test.op',
+        'datadog.span.type': 'web',
+        'datadog.origin': 'synthetics',
+        'datadog.span.top_level': false,
+      })
+    })
+
+    it('emits the raw grpc.status.code name upper-cased as rpc.response.status_code', () => {
+      const span = makeSpan({ meta: { [GRPC_STATUS_CODE]: 'not_found' }, metrics: {} })
+      const payload = JSON.parse(transformer.transform(makeDrained(12340000000000, [span]), BUCKET_SIZE_NS))
+
+      assert.strictEqual(attrMapOf(dataPointsOf(payload)[0])['rpc.response.status_code'], 'NOT_FOUND')
+    })
+
+    it('translates numeric grpc.status.code from metrics to the canonical status name', () => {
+      const span = makeSpan({ meta: {}, metrics: { [GRPC_STATUS_CODE]: 14 } })
+      const payload = JSON.parse(transformer.transform(makeDrained(12340000000000, [span]), BUCKET_SIZE_NS))
+
+      assert.strictEqual(attrMapOf(dataPointsOf(payload)[0])['rpc.response.status_code'], 'UNAVAILABLE')
+    })
+
+    it('omits optional attributes when not present on the span', () => {
+      const payload = JSON.parse(
+        transformer.transform(makeDrained(12340000000000, [makeSpan({ meta: {} })]), BUCKET_SIZE_NS)
+      )
+      const keys = dataPointsOf(payload)[0].attributes.map(a => a.key)
+
+      for (const key of ['http.response.status_code', 'http.request.method', 'http.route', 'span.kind']) {
+        assert.ok(!keys.includes(key), `${key} should be omitted`)
+      }
+    })
+
+    it('converts duration to seconds with fixed bounds and a sketch-derived distribution', () => {
+      const spans = [makeSpan({ duration: 1e9 }), makeSpan({ duration: 3e9 })]
+      const payload = JSON.parse(transformer.transform(makeDrained(12340000000000, spans), BUCKET_SIZE_NS))
+      const dp = dataPointsOf(payload)[0]
+
+      assert.strictEqual(dp.count, 2)
+      assert.strictEqual(dp.min, 1)
+      assert.strictEqual(dp.max, 3)
+      assert.strictEqual(dp.sum, 4)
+      assert.deepStrictEqual(dp.explicitBounds, EXPLICIT_BOUNDS_SECONDS)
+      assert.strictEqual(dp.bucketCounts.length, EXPLICIT_BOUNDS_SECONDS.length + 1)
+      assert.strictEqual(dp.bucketCounts.reduce((a, b) => a + b, 0), 2)
+      assert.strictEqual(dp.bucketCounts.filter(c => c > 0).length, 2)
+    })
+
+    it('marks error data points with status.code=ERROR and ok data points without it', () => {
+      const spans = [makeTopLevelSpan(), makeTopLevelSpan({ error: 1 })]
+      const payload = JSON.parse(transformer.transform(makeDrained(12340000000000, spans), BUCKET_SIZE_NS))
+      const points = dataPointsOf(payload)
+
+      const ok = points.find(dp => attrMapOf(dp)['datadog.span.top_level'] === true && !attrMapOf(dp)['status.code'])
+      const err = points.find(dp => attrMapOf(dp)['status.code'] === 2)
+      assert.ok(ok, 'ok data point should carry no status.code')
+      assert.strictEqual(attrMapOf(err)['datadog.span.top_level'], true)
+    })
+
+    it('emits at most two data points per group (ok + error) tagged top-level when all hits are top-level', () => {
+      const spans = [makeTopLevelSpan(), makeTopLevelSpan(), makeTopLevelSpan({ error: 1 })]
+      const payload = JSON.parse(transformer.transform(makeDrained(12340000000000, spans), BUCKET_SIZE_NS))
+      const points = dataPointsOf(payload)
+
+      assert.strictEqual(points.length, 2)
+      const ok = points.find(dp => !attrMapOf(dp)['status.code'])
+      const err = points.find(dp => attrMapOf(dp)['status.code'] === 2)
+      assert.strictEqual(ok.count, 2)
+      assert.strictEqual(err.count, 1)
+      assert.strictEqual(attrMapOf(ok)['datadog.span.top_level'], true)
+      assert.strictEqual(attrMapOf(err)['datadog.span.top_level'], true)
+    })
+
+    it('emits separate data points for top-level and non-top-level spans sharing the same dimensions', () => {
+      const spans = [makeSpan(), makeTopLevelSpan()]
+      const payload = JSON.parse(transformer.transform(makeDrained(12340000000000, spans), BUCKET_SIZE_NS))
+      const points = dataPointsOf(payload)
+
+      assert.strictEqual(points.length, 2)
+      const topLevelPoint = points.find(dp => attrMapOf(dp)['datadog.span.top_level'] === true)
+      const nonTopLevelPoint = points.find(dp => attrMapOf(dp)['datadog.span.top_level'] === false)
+      assert.ok(topLevelPoint, 'top-level data point should exist')
+      assert.ok(nonTopLevelPoint, 'non-top-level data point should exist')
+      assert.strictEqual(topLevelPoint.count, 1)
+      assert.strictEqual(nonTopLevelPoint.count, 1)
+    })
+
+    it('omits data points with zero count', () => {
+      const payload = JSON.parse(
+        transformer.transform(makeDrained(12340000000000, [makeTopLevelSpan({ error: 1 })]), BUCKET_SIZE_NS)
+      )
+      assert.strictEqual(dataPointsOf(payload).length, 1)
+    })
+
+    it('reports service identity on the resource and emits no InstrumentationScope', () => {
+      const payload = JSON.parse(transformer.transform(makeDrained(12340000000000, [makeSpan()]), BUCKET_SIZE_NS))
+      const resourceAttrs = Object.fromEntries(
+        payload.resourceMetrics[0].resource.attributes.map(a => [a.key, a.value.stringValue])
+      )
+      const scopeMetrics = payload.resourceMetrics[0].scopeMetrics[0]
+
+      assert.ok(!('scope' in scopeMetrics), 'no InstrumentationScope should be emitted')
+      assert.strictEqual(resourceAttrs['service.name'], 'svc')
+      assert.strictEqual(resourceAttrs['service.version'], '1.2.3')
+      assert.strictEqual(resourceAttrs['deployment.environment.name'], 'test')
+    })
+
+    it('emits a single scopeMetrics and tags data points whose service differs from the default', () => {
+      const drained = makeDrained(12340000000000, [
+        makeSpan({ service: 'svc', resource: 'GET /foo' }),
+        makeSpan({ service: 'svc-other', resource: 'GET /bar' }),
+      ])
+      const payload = JSON.parse(transformer.transform(drained, BUCKET_SIZE_NS))
+      const scopeMetrics = payload.resourceMetrics[0].scopeMetrics
+
+      assert.strictEqual(scopeMetrics.length, 1)
+      assert.ok(!('scope' in scopeMetrics[0]), 'no InstrumentationScope should be emitted')
+      const serviceByResource = Object.fromEntries(
+        dataPointsOf(payload).map(dp => [attrMapOf(dp)['span.name'], attrMapOf(dp)['service.name']])
+      )
+      assert.strictEqual(serviceByResource['GET /foo'], undefined)
+      assert.strictEqual(serviceByResource['GET /bar'], 'svc-other')
+    })
+
+    it('sets timestamps from the bucket time and size', () => {
+      const timeNs = 12340000000000
+      const dp = dataPointsOf(JSON.parse(transformer.transform(makeDrained(timeNs, [makeSpan()]), BUCKET_SIZE_NS)))[0]
+
+      assert.deepStrictEqual(
+        { start: dp.startTimeUnixNano, end: dp.timeUnixNano },
+        { start: String(timeNs), end: String(timeNs + BUCKET_SIZE_NS) }
+      )
+    })
+
+    it('handles multiple time buckets', () => {
+      const drained = [
+        { timeNs: 12340000000000, bucket: makeBucket([makeSpan()]) },
+        { timeNs: 12350000000000, bucket: makeBucket([makeSpan()]) },
+      ]
+      const payload = JSON.parse(transformer.transform(drained, BUCKET_SIZE_NS))
+      assert.strictEqual(dataPointsOf(payload).length, 2)
+    })
+  })
+
+  describe('JSON format (OTel-semantics mode)', () => {
+    let transformer
+
+    before(() => {
+      transformer = new OtlpStatsTransformer(RESOURCE_ATTRS, 'http/json', true, DEFAULT_SERVICE)
+    })
+
+    it('emits only OTel attributes (no dd.*) while keeping status.code on errors', () => {
+      const span = makeTopLevelSpan({
+        error: 1,
+        meta: { [HTTP_STATUS_CODE]: 500, [HTTP_METHOD]: 'GET' },
+      })
+      const payload = JSON.parse(transformer.transform(makeDrained(12340000000000, [span]), BUCKET_SIZE_NS))
+      const attrs = attrMapOf(dataPointsOf(payload)[0])
+
+      assert.ok(
+        !Object.keys(attrs).some(k => k.startsWith('datadog.')),
+        'no datadog.* attributes in OTel-semantics mode'
+      )
+      assert.deepStrictEqual(
+        { name: attrs['span.name'], method: attrs['http.request.method'], status: attrs['status.code'] },
+        { name: 'GET /foo', method: 'GET', status: 2 }
+      )
+    })
+  })
+
+  describe('protobuf format', () => {
+    let transformer
+
+    before(() => {
+      transformer = new OtlpStatsTransformer(RESOURCE_ATTRS, 'http/protobuf', false, DEFAULT_SERVICE)
+    })
+
+    it('emits a valid ExportMetricsServiceRequest with a single duration metric', () => {
+      const buf = transformer.transform(makeDrained(12340000000000, [makeSpan()]), BUCKET_SIZE_NS)
+      assert.ok(Buffer.isBuffer(buf))
+
+      const metrics = protoMetricsService.decode(buf).resourceMetrics[0].scopeMetrics[0].metrics
+      assert.strictEqual(metrics.length, 1)
+      assert.strictEqual(metrics[0].name, METRIC_NAME)
+    })
+
+    it('uses delta temporality and native typed attribute values', () => {
+      const delta = protoAggregationTemporality.values.AGGREGATION_TEMPORALITY_DELTA
+      const spans = [makeSpan({ resource: 'GET /a' }), makeTopLevelSpan({ error: 1, resource: 'GET /b' })]
+      const buf = transformer.transform(makeDrained(12340000000000, spans), BUCKET_SIZE_NS)
+      const decoded = protoMetricsService.decode(buf)
+      const metric = decoded.resourceMetrics[0].scopeMetrics[0].metrics[0]
+
+      assert.strictEqual(metric.histogram.aggregationTemporality, delta)
+      const okNotTopLevel = metric.histogram.dataPoints.find(dp =>
+        dp.attributes.some(a => a.key === 'datadog.span.top_level' && a.value.boolValue === false) &&
+        !dp.attributes.some(a => a.key === 'status.code')
+      )
+      const errTopLevel = metric.histogram.dataPoints.find(dp =>
+        dp.attributes.some(a => a.key === 'status.code' && Number(a.value.intValue) === 2) &&
+        dp.attributes.some(a => a.key === 'datadog.span.top_level' && a.value.boolValue === true)
+      )
+      assert.ok(okNotTopLevel, 'should have ok not-top-level data point')
+      assert.ok(errTopLevel, 'should have error top-level data point')
+    })
+  })
+})
diff --git a/packages/dd-trace/test/plugin_manager.spec.js b/packages/dd-trace/test/plugin_manager.spec.js
index 16b95b7bf8..409644f87e 100644
--- a/packages/dd-trace/test/plugin_manager.spec.js
+++ b/packages/dd-trace/test/plugin_manager.spec.js
@@ -29,6 +29,9 @@ describe('Plugin Manager', () => {
       plugins: true,
       spanAttributeSchema: 'v0',
       spanRemoveIntegrationFromService: false,
+      // The real tracer Config always carries the testOptimization namespace;
+      // #getSharedConfig reads it, so the stand-in must provide it too.
+      testOptimization: {},
       ...overrides,
     }
   }
@@ -368,7 +371,7 @@ describe('Plugin Manager', () => {
       pm.configure(makeTracerConfig({
         serviceMapping: { two: 'deux' },
         logInjection: true,
-        queryStringObfuscation: '.*',
+        DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP: '.*',
         clientIpEnabled: true,
       }))
       loadChannel.publish({ name: 'two' })
diff --git a/packages/dd-trace/test/plugins/util/llm.spec.js b/packages/dd-trace/test/plugins/util/llm.spec.js
index 77c0fb4646..139b228495 100644
--- a/packages/dd-trace/test/plugins/util/llm.spec.js
+++ b/packages/dd-trace/test/plugins/util/llm.spec.js
@@ -43,8 +43,8 @@ describe('llm utils', () => {
     beforeEach(() => {
       utils = makeUtilities('langchain', {
         langchain: {
-          spanCharLimit: 100,
-          spanPromptCompletionSampleRate: 0.6,
+          DD_LANGCHAIN_SPAN_CHAR_LIMIT: 100,
+          DD_LANGCHAIN_SPAN_PROMPT_COMPLETION_SAMPLE_RATE: 0.6,
         },
       })
     })
diff --git a/packages/dd-trace/test/plugins/util/test.spec.js b/packages/dd-trace/test/plugins/util/test.spec.js
index 1e5e47ba90..49b459de4c 100644
--- a/packages/dd-trace/test/plugins/util/test.spec.js
+++ b/packages/dd-trace/test/plugins/util/test.spec.js
@@ -13,6 +13,7 @@ const istanbul = require('../../../../../vendor/dist/istanbul-lib-coverage')
 require('../../setup/core')
 
 const {
+  EARLY_FLAKE_DETECTION_RETRY_THRESHOLDS,
   getTestParametersString,
   getTestLevelsMetadataTags,
   getTestSuitePath,
@@ -1252,6 +1253,15 @@ describe('getIsFaultyEarlyFlakeDetection', () => {
 describe('getEfdRetryCount', () => {
   const slowTestRetries = { '5s': 10, '10s': 5, '30s': 3, '5m': 2 }
 
+  it('exports the retry thresholds used to select slow test retry buckets', () => {
+    assert.deepStrictEqual(EARLY_FLAKE_DETECTION_RETRY_THRESHOLDS, [
+      { limitMs: 5_000, key: '5s' },
+      { limitMs: 10_000, key: '10s' },
+      { limitMs: 30_000, key: '30s' },
+      { limitMs: 300_000, key: '5m' },
+    ])
+  })
+
   it('returns retries for the matching duration bucket', () => {
     assert.strictEqual(getEfdRetryCount(0, slowTestRetries), 10)
     assert.strictEqual(getEfdRetryCount(4_999, slowTestRetries), 10)
diff --git a/packages/dd-trace/test/plugins/versions.spec.js b/packages/dd-trace/test/plugins/versions.spec.js
index e0d727872d..35344a0771 100644
--- a/packages/dd-trace/test/plugins/versions.spec.js
+++ b/packages/dd-trace/test/plugins/versions.spec.js
@@ -3,61 +3,78 @@
 const assert = require('node:assert/strict')
 
 const { describe, it } = require('mocha')
+const { coerce, major } = require('semver')
 
-const { getVersionList, resolvePluginVersions } = require('./versions')
+const { getVersionList, resolvePluginVersions, brokenVersionReason } = require('./versions')
+
+const latests = require('./versions/package.json').dependencies
 
 const keys = (name, versions, nonConsecutive) =>
   getVersionList(name, versions, nonConsecutive).map(({ versionKey }) => versionKey)
 
+const latestMajorKey = name => String(major(coerce(latests[name])))
+
 describe('getVersionList', () => {
-  it('returns the wildcard untouched', () => {
-    assert.deepEqual(keys('mongodb', ['*']), ['*'])
+  it('collapses the wildcard to the latest major', () => {
+    assert.deepEqual(keys('mongodb', ['*']), [latestMajorKey('mongodb')])
   })
 
   it('collapses equivalent exact-version notations to a single key', () => {
     assert.deepEqual(keys('mongodb', ['1.2.3', '=1.2.3', 'v1.2.3']), ['1.2.3'])
   })
 
-  it('pins the floor and keeps the range for a single-major range', () => {
-    // `<3` caps the range below any plausible pinned latest, so there is no in-between major to fill.
-    assert.deepEqual(keys('mongodb', ['>=2 <3']), ['2.0.0', '>=2 <3'])
+  it('pins the floor and the major for a single-major range', () => {
+    // `<3` caps the range to major 2, so only the pinned floor and the latest of major 2 are keys.
+    assert.deepEqual(keys('mongodb', ['>=2 <3']), ['2.0.0', '2'])
+  })
+
+  it('covers the floor major and every major up to the range top', () => {
+    // `<5` caps the top at major 4; the floor (2.0.0) is pinned and majors 2-4 each resolve to their latest.
+    assert.deepEqual(keys('mongodb', ['>=2 <5']), ['2.0.0', '2', '3', '4'])
   })
 
-  it('fills every in-between major between the floor and the range top', () => {
-    // `<5` caps the top at major 4, so only major 3 sits strictly in between major 2 and major 4.
-    assert.deepEqual(keys('mongodb', ['>=2 <5']), ['2.0.0', '>=3.0.0 <4.0.0', '>=2 <5'])
+  it('covers every major from the floor to the capped top', () => {
+    // `<6` caps the top at major 5; the floor major's latest (1) is covered too, not only the newest of the range.
+    assert.deepEqual(keys('mongodb', ['>=1 <6']), ['1.0.0', '1', '2', '3', '4', '5'])
   })
 
-  it('orders fills ascending and keeps the declared range last (the top major is covered by the range itself)', () => {
-    // `<6` caps the top at major 5, which the `>=1 <6` range resolves to; only majors 2-4 are filled in between.
-    assert.deepEqual(keys('mongodb', ['>=1 <6']), [
-      '1.0.0',
-      '>=2.0.0 <3.0.0',
-      '>=3.0.0 <4.0.0',
-      '>=4.0.0 <5.0.0',
-      '>=1 <6',
-    ])
+  it('keeps the declared range for a top major the range caps mid-way', () => {
+    // `<=3.0.0` stops inside major 3, so a bare `3` (which resolves to the major's latest) would overshoot the
+    // ceiling; the declared range is kept instead so it resolves to the newest version `<=3.0.0`.
+    assert.deepEqual(keys('mongodb', ['>=2.1 <=3.0.0']), ['2.1.0', '2', '>=2.1 <=3.0.0'])
+  })
+
+  it('keeps a sub-major range as its own key', () => {
+    // `>=4.0.0 <4.3.0` never spans major 4 in full, so there is no safe bare major; the floor and the range cover it.
+    assert.deepEqual(keys('mongodb', ['>=4.0.0 <4.3.0']), ['4.0.0', '>=4.0.0 <4.3.0'])
   })
 
   it('de-duplicates a shared floor across multiple ranges', () => {
-    assert.deepEqual(keys('mongodb', ['>=2 <3', '^2.0.0']), ['2.0.0', '>=2 <3', '^2.0.0'])
+    assert.deepEqual(keys('mongodb', ['>=2 <3', '^2.0.0']), ['2.0.0', '2'])
+  })
+
+  it('consolidates the floor with the top major when the floor is the pinned latest', () => {
+    // `>=<pinned latest>` floors at the newest version, so the bare top-major key resolves to that same version and is
+    // dropped; the pinned package.json is what proves the two keys identical.
+    assert.deepEqual(keys('mongodb', [`>=${latests.mongodb}`]), [latests.mongodb])
   })
 
-  it('does not fill in-between majors for non-consecutive packages', () => {
-    assert.deepEqual(keys('mongodb', ['>=1 <6'], new Set(['mongodb'])), ['1.0.0', '>=1 <6'])
+  it('adds the floor, the floor major and the top major for non-consecutive packages', () => {
+    // The middle majors may be unpublished, but the floor major (1) and the top major (5) both exist and are tested.
+    assert.deepEqual(keys('mongodb', ['>=1 <6'], new Set(['mongodb'])), ['1.0.0', '1', '5'])
   })
 
-  it('treats the built-in non-consecutive packages as floor + range only', () => {
-    // graphql jumps from 0.x to 14.x; auto-filling 1.x–13.x would fail the install.
-    assert.deepEqual(keys('graphql', ['>=0.10']), ['0.10.0', '>=0.10'])
+  it('treats the built-in non-consecutive packages as floor + floor major + top major', () => {
+    // graphql jumps from 0.x to 14.x; 1.x–13.x are skipped, but the latest 0.x and the newest major are still tested.
+    assert.deepEqual(keys('graphql', ['>=0.10']), ['0.10.0', '0', latestMajorKey('graphql')])
   })
 
   it('throws on an unparseable range', () => {
     assert.throws(() => getVersionList('mongodb', ['not-a-version']), /Invalid version range/)
   })
 
-  it('ignores empty entries', () => {
-    assert.deepEqual(keys('mongodb', ['', undefined, '>=2 <3']), ['2.0.0', '>=2 <3'])
+  it('throws on an empty entry', () => {
+    assert.throws(() => getVersionList('mongodb', ['', '>=2 <3']), /Empty version entry/)
   })
 })
 
@@ -67,8 +84,8 @@ describe('resolvePluginVersions', () => {
   it('expands the declared versions and points the unversioned folder at the newest in-scope key', () => {
     const result = resolvePluginVersions({ name: 'mongodb', declaredVersions: ['>=2 <5'], env: {} })
 
-    assert.deepEqual(versionKeys(result), ['2.0.0', '>=3.0.0 <4.0.0', '>=2 <5'])
-    assert.equal(result.unversioned, '>=2 <5')
+    assert.deepEqual(versionKeys(result), ['2.0.0', '2', '3', '4'])
+    assert.equal(result.unversioned, '4')
   })
 
   it('filters the installed keys by RANGE and follows the filtered tail', () => {
@@ -78,8 +95,8 @@ describe('resolvePluginVersions', () => {
       env: { RANGE: '>=2.0.0 <4.0.0' },
     })
 
-    assert.deepEqual(versionKeys(result), ['>=2.0.0 <3.0.0', '>=3.0.0 <4.0.0'])
-    assert.equal(result.unversioned, '>=3.0.0 <4.0.0')
+    assert.deepEqual(versionKeys(result), ['2', '3'])
+    assert.equal(result.unversioned, '3')
   })
 
   it('replaces the declared versions with PACKAGE_VERSION_RANGE when the module is honoured', () => {
@@ -89,7 +106,7 @@ describe('resolvePluginVersions', () => {
       env: { PACKAGE_VERSION_RANGE: '>=3 <4' },
     })
 
-    assert.deepEqual(versionKeys(result), ['3.0.0', '>=3 <4'])
+    assert.deepEqual(versionKeys(result), ['3.0.0', '3'])
     assert.equal(result.unversioned, '>=3 <4')
   })
 
@@ -101,8 +118,8 @@ describe('resolvePluginVersions', () => {
       env: { PACKAGE_VERSION_RANGE: '>=3 <4' },
     })
 
-    assert.deepEqual(versionKeys(result), ['2.0.0', '>=3.0.0 <4.0.0', '>=2 <5'])
-    assert.equal(result.unversioned, '>=2 <5')
+    assert.deepEqual(versionKeys(result), ['2.0.0', '2', '3', '4'])
+    assert.equal(result.unversioned, '4')
   })
 
   it('keeps the unversioned folder on the raw shard while RANGE narrows the installed keys', () => {
@@ -112,7 +129,7 @@ describe('resolvePluginVersions', () => {
       env: { PACKAGE_VERSION_RANGE: '>=2 <5', RANGE: '>=3.0.0 <4.0.0' },
     })
 
-    assert.deepEqual(versionKeys(result), ['>=3.0.0 <4.0.0'])
+    assert.deepEqual(versionKeys(result), ['3'])
     assert.equal(result.unversioned, '>=2 <5')
   })
 
@@ -134,3 +151,16 @@ describe('resolvePluginVersions', () => {
     assert.equal(result.unversioned, undefined)
   })
 })
+
+describe('brokenVersionReason', () => {
+  const broken = { ai: [{ range: '>=4.1.0 <5.0.0', reason: 'no cassette' }] }
+
+  it('returns the reason for a version inside a broken range', () => {
+    assert.equal(brokenVersionReason('ai', '4.3.19', broken), 'no cassette')
+  })
+
+  it('returns undefined outside every broken range and for unlisted modules', () => {
+    assert.equal(brokenVersionReason('ai', '4.0.0', broken), undefined)
+    assert.equal(brokenVersionReason('mongodb', '4.3.19', broken), undefined)
+  })
+})
diff --git a/packages/dd-trace/test/plugins/versions/index.js b/packages/dd-trace/test/plugins/versions/index.js
index 7ae0ed1a88..deb18f299e 100644
--- a/packages/dd-trace/test/plugins/versions/index.js
+++ b/packages/dd-trace/test/plugins/versions/index.js
@@ -1,6 +1,6 @@
 'use strict'
 
-const { clean, coerce, intersects, subset } = require('semver')
+const { clean, coerce, intersects, satisfies, subset } = require('semver')
 
 const latests = require('./package.json').dependencies
 
@@ -15,6 +15,22 @@ const nonConsecutiveMajorPackages = new Set([
   '@redis/client', // jumps from 2.x to 5.x (no 3.x–4.x)
 ])
 
+// Versions the matrix installs but must not run, keyed by module name. `withVersions()` skips any resolved
+// version matching a range here and surfaces the reason as a pending test. Each entry is a stop-gap: keep the reason
+// a TODO so a fixed version drops the entry instead of rotting, and scope the range as narrowly as the break warrants.
+/** @type {Record<string, Array<{ range: string, reason: string }>>} */
+const brokenVersions = {
+  // TODO: record VCR cassettes for the ai 4.x line; `versions/ai@4` resolves to the newest 4.x, which has no cassette,
+  // so the test would hit the live API. 4.0.x (cassetted) and 5.x/6.x stay covered.
+  ai: [{ range: '>=4.1.0 <5.0.0', reason: 'no VCR cassette for the ai 4.x latest (TODO: record cassettes)' }],
+  // TODO: record VCR cassettes for the @langchain/core 0.x line above 0.1. `@langchain/core@0` resolves to the newest
+  // 0.x (0.3.x), which has no cassette, so the LLMObs langchain specs hit the live API. The 0.1.0 floor and the 1.x
+  // latest stay covered.
+  '@langchain/core': [
+    { range: '>=0.2.0 <1.0.0', reason: 'no VCR cassette for the @langchain/core 0.x latest (TODO: record cassettes)' },
+  ],
+}
+
 /**
  * @param {string} name
  * @param {string} range
@@ -55,13 +71,23 @@ function capSubrange (name, subrange) {
  * maps to a `versions/<name>@<key>` workspace folder; the install script and `withVersions()` share this so the set of
  * installed folders and the set of tested folders never drift apart.
  *
- * Per range, this yields the lowest supported version (pinned exactly), the latest of every major in between, and the
- * range itself (which resolves to the newest supported version). The top major is derived from the pinned latest in
- * `package.json` rather than a registry lookup, so a major that does not exist makes the install fail loudly instead of
- * silently skipping versions — which is the signal to mark the range as non-consecutive (see `consecutiveMajors`).
+ * Per declared range this yields the lowest supported version (pinned exactly) and the newest version of every major
+ * the range spans, keyed by the bare major so the key resolves to that major's latest. Covering each major explicitly
+ * (rather than emitting the raw range, which resolves only to the newest version of the whole range) makes sure the
+ * floor major's latest is tested too. The top major is derived from the pinned latest in `package.json` rather than a
+ * registry lookup, so a major that was never published makes the install fail loudly — the signal to add the package
+ * to `nonConsecutiveMajorPackages`.
+ *
+ * A bare-major key resolves to that major's newest published version, so it can only be used where the declared range
+ * spans the major in full. When the range caps inside its top major (an upper bound below `<${major + 1}.0.0`), the
+ * top major keeps the declared range instead, which resolves to the newest version the range still allows — a bare
+ * key there would overshoot the ceiling (`>=2.1 <=3.0.0` keyed `3` installs the major's latest, a version above the
+ * declared `<=3.0.0` that the plugin never supported).
  *
- * Notations that resolve to the same exact version (`1.2.3`, `=1.2.3`, `v1.2.3`) collapse to a single key, so a version
- * is never installed twice under different spellings.
+ * Notations that resolve to the same exact version (`1.2.3`, `=1.2.3`, `v1.2.3`) collapse to a single key, and `*`
+ * collapses to the latest major (the same version an open-ended range resolves to), so a version is never installed
+ * twice under different spellings. A floor that equals the pinned latest also drops the redundant top-major key,
+ * since the pinned `package.json` proves they resolve to the same version.
  *
  * @param {string} name The module name, e.g. `mongodb`.
  * @param {string[]} versions The declared version entries, e.g. `['>=3.3 <5', '5', '>=6']`.
@@ -78,10 +104,13 @@ function getVersionList (name, versions, nonConsecutiveMajors = nonConsecutiveMa
   }
 
   for (const range of versions) {
-    if (!range) continue
+    // An empty entry is a setup mistake (a stray comma or an undefined slot); fail loudly rather than skip silently.
+    if (!range) {
+      throw new Error(`Empty version entry declared for '${name}'. Each declared version must be a non-empty range.`)
+    }
 
     if (range === '*') {
-      add('*', range)
+      add(latestMajor(name), range)
       continue
     }
 
@@ -97,19 +126,73 @@ function getVersionList (name, versions, nonConsecutiveMajors = nonConsecutiveMa
 
     add(floor.version, range)
 
-    if (!nonConsecutiveMajors.has(name)) {
-      const topMajor = highestMajor(name, range, floor.major)
-      for (let major = floor.major + 1; major < topMajor; major++) {
-        add(`>=${major}.0.0 <${major + 1}.0.0`, range)
+    const topMajor = highestMajor(name, range, floor.major)
+
+    const addMajor = (major) => {
+      if (!intersects(`>=${major}.0.0 <${major + 1}.0.0`, range)) return
+      // The top major is the only one the range can cap inside; lower majors are always spanned in full. A capped top
+      // keeps the declared range so it resolves below the ceiling instead of jumping to the major's latest.
+      if (major === topMajor && !reachesMajorCeiling(major, range)) {
+        add(range, range)
+      } else {
+        add(String(major), range)
       }
     }
 
-    add(range, range)
+    if (nonConsecutiveMajors.has(name)) {
+      // Only the in-between majors were never published. The floor major and the top major both exist, so add the
+      // latest of each (skipping the uncertain middle, which is what would make the install fail).
+      addMajor(floor.major)
+      if (topMajor > floor.major) addMajor(topMajor)
+    } else {
+      for (let major = floor.major; major <= topMajor; major++) {
+        addMajor(major)
+      }
+    }
   }
 
+  // The bare-major key for the pinned latest's major resolves to the pin itself, so when a declared floor already pins
+  // that exact version the major key would install the same thing. Drop it. This is the only such redundancy the
+  // pinned upper bound lets us prove; for lower majors the newest published version is unknown without the registry.
+  const pinned = coerce(latests[name])
+  if (pinned && entries.has(pinned.version)) entries.delete(String(pinned.major))
+
   return [...entries.values()]
 }
 
+// Higher than any real release within a major. A range that still admits it does not cap inside the major, so a
+// bare-major key is safe; a range that excludes it ends mid-major and must keep its own upper bound.
+const MAJOR_CEILING_PROBE = 999_999
+
+/**
+ * Whether `range` admits versions all the way to the top of `major` (a clean `<${major + 1}.0.0` upper bound, or none).
+ * When it does not, a bare-major key would resolve past the declared ceiling, so the caller keeps the declared range.
+ *
+ * @param {number} major
+ * @param {string} range
+ * @returns {boolean}
+ */
+function reachesMajorCeiling (major, range) {
+  return satisfies(`${major}.${MAJOR_CEILING_PROBE}.${MAJOR_CEILING_PROBE}`, range)
+}
+
+/**
+ * The latest major of `name` as a bare-major version key. `*` resolves here so it de-duplicates against an open-ended
+ * range whose top resolves to the same newest version.
+ *
+ * @param {string} name
+ * @returns {string}
+ */
+function latestMajor (name) {
+  const latest = coerce(latests[name])
+  if (!latest) {
+    throw new Error(
+      `Latest version for '${name}' needs to be defined in 'packages/dd-trace/test/plugins/versions/package.json'.`
+    )
+  }
+  return String(latest.major)
+}
+
 /**
  * Highest major still spanned by `range`, capped at the pinned latest. Iterates down from the latest so the first
  * intersecting major is the top; nothing above the pinned latest is installed.
@@ -159,7 +242,22 @@ function resolvePluginVersions ({ name, declaredVersions, honourEnvRange = true,
   return { versionList, unversioned }
 }
 
+/**
+ * The reason `version` of `name` is marked broken (and must be skipped), or `undefined` when it is testable.
+ *
+ * @param {string} name
+ * @param {string} version A concrete, resolved version.
+ * @param {Record<string, Array<{ range: string, reason: string }>>} [broken] Injectable for testing.
+ * @returns {string|undefined}
+ */
+function brokenVersionReason (name, version, broken = brokenVersions) {
+  for (const { range, reason } of broken[name] ?? []) {
+    if (satisfies(version, range)) return reason
+  }
+}
+
 module.exports = {
+  brokenVersionReason,
   getCappedRange,
   getVersionList,
   resolvePluginVersions,
diff --git a/packages/dd-trace/test/plugins/versions/package.json b/packages/dd-trace/test/plugins/versions/package.json
index 626396cb89..558849c270 100644
--- a/packages/dd-trace/test/plugins/versions/package.json
+++ b/packages/dd-trace/test/plugins/versions/package.json
@@ -14,14 +14,14 @@
     "@apollo/subgraph": "2.14.0",
     "@aws/durable-execution-sdk-js": "2.0.0",
     "@aws/durable-execution-sdk-js-testing": "1.1.1",
-    "@aws-sdk/client-bedrock-runtime": "3.1074.0",
-    "@aws-sdk/client-dynamodb": "3.1074.0",
-    "@aws-sdk/client-kinesis": "3.1074.0",
-    "@aws-sdk/client-lambda": "3.1074.0",
-    "@aws-sdk/client-s3": "3.1074.0",
-    "@aws-sdk/client-sfn": "3.1074.0",
-    "@aws-sdk/client-sns": "3.1074.0",
-    "@aws-sdk/client-sqs": "3.1074.0",
+    "@aws-sdk/client-bedrock-runtime": "3.1075.0",
+    "@aws-sdk/client-dynamodb": "3.1075.0",
+    "@aws-sdk/client-kinesis": "3.1075.0",
+    "@aws-sdk/client-lambda": "3.1075.0",
+    "@aws-sdk/client-s3": "3.1075.0",
+    "@aws-sdk/client-sfn": "3.1075.0",
+    "@aws-sdk/client-sns": "3.1075.0",
+    "@aws-sdk/client-sqs": "3.1075.0",
     "@aws-sdk/node-http-handler": "3.374.0",
     "@aws-sdk/smithy-client": "3.374.0",
     "@azure/cosmos": "4.9.3",
@@ -54,13 +54,13 @@
     "@jest/test-sequencer": "30.4.1",
     "@jest/transform": "30.4.1",
     "@koa/router": "15.5.0",
-    "@langchain/anthropic": "1.5.0",
-    "@langchain/classic": "1.0.36",
+    "@langchain/anthropic": "1.5.1",
+    "@langchain/classic": "1.0.38",
     "@langchain/cohere": "1.1.0",
-    "@langchain/core": "1.2.0",
+    "@langchain/core": "1.2.1",
     "@langchain/google-genai": "2.2.0",
-    "@langchain/langgraph": "1.4.4",
-    "@langchain/openai": "1.5.1",
+    "@langchain/langgraph": "1.4.7",
+    "@langchain/openai": "1.5.3",
     "@modelcontextprotocol/sdk": "1.29.0",
     "@nats-io/nats-core": "3.4.0",
     "@nats-io/transport-node": "3.4.0",
@@ -85,7 +85,7 @@
     "@redis/client": "5.12.1",
     "@smithy/core": "3.26.0",
     "@smithy/smithy-client": "4.14.2",
-    "@types/node": "26.0.0",
+    "@types/node": "26.0.1",
     "@vitest/coverage-istanbul": "4.1.9",
     "@vitest/coverage-v8": "4.1.9",
     "@vitest/runner": "4.1.9",
@@ -100,12 +100,12 @@
     "avsc": "5.7.9",
     "aws-sdk": "2.1693.0",
     "axios": "1.16.1",
-    "azure-functions-core-tools": "4.12.0",
+    "azure-functions-core-tools": "4.12.1",
     "babel-jest": "30.4.1",
     "bluebird": "3.7.2",
     "body-parser": "2.2.2",
     "bson": "7.2.0",
-    "bullmq": "5.79.1",
+    "bullmq": "5.79.2",
     "bunyan": "2.0.5",
     "cassandra-driver": "4.9.0",
     "collections": "5.1.13",
@@ -116,7 +116,7 @@
     "cypress": "15.16.0",
     "cypress-fail-fast": "8.1.0",
     "dd-trace-api": "1.0.1",
-    "durable-functions": "3.3.1",
+    "durable-functions": "3.4.0",
     "ejs": "5.0.2",
     "elasticsearch": "16.7.3",
     "electron": "42.1.0",
@@ -198,11 +198,11 @@
     "pino-pretty": "13.1.3",
     "playwright": "1.61.0",
     "playwright-core": "1.61.0",
-    "pnpm": "11.8.0",
+    "pnpm": "11.9.0",
     "prisma": "7.8.0",
     "promise": "8.3.0",
     "promise-js": "0.0.7",
-    "protobufjs": "8.6.4",
+    "protobufjs": "8.6.5",
     "pug": "3.0.4",
     "q": "2.0.3",
     "react": "19.2.6",
@@ -217,7 +217,7 @@
     "sharedb": "5.2.2",
     "sinon": "22.0.0",
     "sqlite3": "6.0.1",
-    "stripe": "22.2.3",
+    "stripe": "22.3.0",
     "tedious": "19.2.1",
     "tinypool": "2.1.0",
     "typescript": "6.0.3",
diff --git a/packages/dd-trace/test/profiling/config.spec.js b/packages/dd-trace/test/profiling/config.spec.js
index 8bfc299232..02b87c27f8 100644
--- a/packages/dd-trace/test/profiling/config.spec.js
+++ b/packages/dd-trace/test/profiling/config.spec.js
@@ -76,7 +76,7 @@ describe('config', () => {
       service: tracerConfig.service,
       version: tracerConfig.version,
       env: tracerConfig.env,
-      activation: getActivation(tracerConfig.profiling.enabled),
+      activation: getActivation(tracerConfig.profiling.DD_PROFILING_ENABLED),
       uploadTimeout: tracerConfig.DD_PROFILING_UPLOAD_TIMEOUT,
       pprofPrefix: tracerConfig.DD_PROFILING_PPROF_PREFIX,
     }
@@ -828,7 +828,7 @@ describe('config', () => {
   })
 
   describe('getActivation', () => {
-    it('should map the canonical profiling.enabled value to an activation', () => {
+    it('should map the canonical profiling.DD_PROFILING_ENABLED value to an activation', () => {
       assert.strictEqual(getActivation('auto'), 'auto')
       assert.strictEqual(getActivation('true'), 'manual')
       assert.strictEqual(getActivation('false'), 'unknown')
diff --git a/packages/dd-trace/test/profiling/exporters/agent.spec.js b/packages/dd-trace/test/profiling/exporters/agent.spec.js
index a30fc9d681..74a368331f 100644
--- a/packages/dd-trace/test/profiling/exporters/agent.spec.js
+++ b/packages/dd-trace/test/profiling/exporters/agent.spec.js
@@ -43,7 +43,7 @@ const profilerConfig = {
   DD_PROFILING_V8_PROFILER_BUG_WORKAROUND: false,
   DD_PROFILING_ALLOCATION_ENABLED: false,
   DD_PROFILING_HEAP_SAMPLING_INTERVAL: 512 * 1024,
-  telemetry: { heartbeatInterval: 60 * 1e3 },
+  telemetry: { DD_TELEMETRY_HEARTBEAT_INTERVAL: 60 * 1e3 },
 }
 
 async function createProfile (periodType) {
diff --git a/packages/dd-trace/test/profiling/profilers/wall.spec.js b/packages/dd-trace/test/profiling/profilers/wall.spec.js
index c9c95f4337..70207cc159 100644
--- a/packages/dd-trace/test/profiling/profilers/wall.spec.js
+++ b/packages/dd-trace/test/profiling/profilers/wall.spec.js
@@ -30,7 +30,7 @@ function makeWall (Cls, {
     DD_PROFILING_ENDPOINT_COLLECTION_ENABLED: endpointCollectionEnabled,
     DD_PROFILING_TIMELINE_ENABLED: timelineEnabled,
     DD_PROFILING_V8_PROFILER_BUG_WORKAROUND: v8ProfilerBugWorkaroundEnabled,
-    telemetry: { heartbeatInterval },
+    telemetry: { DD_TELEMETRY_HEARTBEAT_INTERVAL: heartbeatInterval },
   }, { asyncContextFrameEnabled, flushInterval })
 }
 
diff --git a/packages/dd-trace/test/proxy.spec.js b/packages/dd-trace/test/proxy.spec.js
index 8120089461..3389365825 100644
--- a/packages/dd-trace/test/proxy.spec.js
+++ b/packages/dd-trace/test/proxy.spec.js
@@ -145,7 +145,8 @@ describe('TracerProxy', () => {
     NoopDogStatsDClient = sinon.stub().returns(noopDogStatsDClient)
 
     config = {
-      tracing: true,
+      DD_TRACE_ENABLED: true,
+      testOptimization: {},
       experimental: {
         flaggingProvider: {},
         aiguard: {
@@ -161,7 +162,7 @@ describe('TracerProxy', () => {
       DD_CRASHTRACKING_ENABLED: false,
       dynamicInstrumentation: {},
       remoteConfig: {
-        enabled: true,
+        DD_REMOTE_CONFIGURATION_ENABLED: true,
       },
       runtimeMetrics: {
         enabled: false,
@@ -285,7 +286,7 @@ describe('TracerProxy', () => {
       })
 
       it('should not enable remote config when disabled', () => {
-        config.remoteConfig.enabled = false
+        config.remoteConfig.DD_REMOTE_CONFIGURATION_ENABLED = false
 
         proxy.init()
 
@@ -294,7 +295,7 @@ describe('TracerProxy', () => {
       })
 
       it('should not initialize when disabled', () => {
-        config.tracing = false
+        config.DD_TRACE_ENABLED = false
 
         proxy.init()
 
@@ -411,12 +412,12 @@ describe('TracerProxy', () => {
         sinon.assert.notCalled(appsec.enable)
         sinon.assert.notCalled(iast.enable)
 
-        let conf = { tracing: false }
+        let conf = { DD_TRACE_ENABLED: false }
         handlers.get('APM_TRACING')(createApmTracingTransaction('test-config-1', conf))
         sinon.assert.notCalled(appsec.disable)
         sinon.assert.notCalled(iast.disable)
 
-        conf = { tracing: true }
+        conf = { DD_TRACE_ENABLED: true }
         handlers.get('APM_TRACING')(createApmTracingTransaction('test-config-1', conf, 'modify'))
         sinon.assert.calledOnce(DatadogTracer)
         sinon.assert.calledOnce(AppsecSdk)
@@ -438,7 +439,7 @@ describe('TracerProxy', () => {
         config.appsec.enabled = true
         config.iast.enabled = true
         config.setRemoteConfig = conf => {
-          config.tracing = conf.tracing
+          config.DD_TRACE_ENABLED = conf.DD_TRACE_ENABLED
         }
 
         const remoteConfigProxy = new RemoteConfigProxy()
@@ -447,12 +448,12 @@ describe('TracerProxy', () => {
         sinon.assert.calledOnceWithExactly(appsec.enable, config)
         sinon.assert.calledOnceWithExactly(iast.enable, config, tracer)
 
-        let conf = { tracing: false }
+        let conf = { DD_TRACE_ENABLED: false }
         handlers.get('APM_TRACING')(createApmTracingTransaction('test-config-2', conf))
         sinon.assert.called(appsec.disable)
         sinon.assert.called(iast.disable)
 
-        conf = { tracing: true }
+        conf = { DD_TRACE_ENABLED: true }
         handlers.get('APM_TRACING')(createApmTracingTransaction('test-config-2', conf, 'modify'))
         sinon.assert.calledTwice(appsec.enable)
         sinon.assert.calledWithExactly(appsec.enable.secondCall, config)
@@ -536,7 +537,7 @@ describe('TracerProxy', () => {
       })
 
       it('should not load the profiler when not configured', () => {
-        config.profiling = { enabled: false }
+        config.profiling = { DD_PROFILING_ENABLED: false }
 
         proxy.init()
 
@@ -552,7 +553,7 @@ describe('TracerProxy', () => {
       })
 
       it('should load profiler when configured', () => {
-        config.profiling = { enabled: 'true' }
+        config.profiling = { DD_PROFILING_ENABLED: 'true' }
 
         proxy.init()
 
@@ -560,7 +561,7 @@ describe('TracerProxy', () => {
       })
 
       it('should throw an error since profiler fails to be imported', () => {
-        config.profiling = { enabled: 'true' }
+        config.profiling = { DD_PROFILING_ENABLED: 'true' }
 
         const ProfilerImportFailureProxy = proxyquire('../src/proxy', {
           './tracer': DatadogTracer,
diff --git a/packages/dd-trace/test/runtime_metrics.spec.js b/packages/dd-trace/test/runtime_metrics.spec.js
index f1c3a0fcc7..3aa7410c73 100644
--- a/packages/dd-trace/test/runtime_metrics.spec.js
+++ b/packages/dd-trace/test/runtime_metrics.spec.js
@@ -326,7 +326,12 @@ function createGarbage (count = 50) {
             return value > 0 && Number.isInteger(value)
           })
           const isGC95Percentile = sinon.match((value) => {
-            return value >= 1e5 && value < 1e8 // In Nanoseconds. 0.1ms to 100ms.
+            // Nanoseconds, 1µs to 100ms. These bounds guard the unit conversion, not the timing:
+            // a sub-microsecond value means the ms→ns conversion (`entry.duration * 1e6`) was
+            // dropped, and a value over 100ms means it was left in milliseconds or seconds. The
+            // floor used to be 0.1ms, which flaked on fast/idle runners where a single scavenge
+            // pause is the only sample for a gc_type and its p95 sits below that.
+            return value >= 1e3 && value < 1e8
           })
           const isHeapSpace = sinon.match((metricName) => {
             return /^heap_space:[a-z_]+$/.test(metricName)
diff --git a/packages/dd-trace/test/setup/mocha.js b/packages/dd-trace/test/setup/mocha.js
index 44c23ac3ae..f4b9d984b2 100644
--- a/packages/dd-trace/test/setup/mocha.js
+++ b/packages/dd-trace/test/setup/mocha.js
@@ -16,7 +16,7 @@ require('./core')
 const { engines, nodeMaxMajor } = require('../../../../package.json')
 
 const externals = require('../plugins/externals')
-const { resolvePluginVersions } = require('../plugins/versions')
+const { resolvePluginVersions, brokenVersionReason } = require('../plugins/versions')
 const runtimeMetrics = require('../../src/runtime_metrics')
 const Nomenclature = require('../../src/service-naming')
 const { SVC_SRC_KEY } = require('../../src/constants')
@@ -316,6 +316,16 @@ function withVersions (plugin, modules, range, cb) {
       .sort(({ resolvedVersion }) => resolvedVersion.localeCompare(resolvedVersion))
 
     for (const testCase of testCases) {
+      const brokenReason = brokenVersionReason(moduleName, testCase.resolvedVersion)
+      if (brokenReason) {
+        // The version is installed but deliberately not exercised; surface it as a pending test so the skip is visible
+        // in CI rather than silently absent.
+        describe(`with ${moduleName} ${testCase.versionRange} (${testCase.resolvedVersion})`, () => {
+          it.skip(`skipped — known broken: ${brokenReason}`, () => {})
+        })
+        continue
+      }
+
       const absBasePath = path.resolve(__dirname, getModulePath(moduleName, testCase.versionKey))
       const absNodeModulesPath = `${absBasePath}/node_modules`
 
diff --git a/packages/dd-trace/test/span_processor.spec.js b/packages/dd-trace/test/span_processor.spec.js
index fe616cddc0..ccf712ec4e 100644
--- a/packages/dd-trace/test/span_processor.spec.js
+++ b/packages/dd-trace/test/span_processor.spec.js
@@ -60,8 +60,9 @@ describe('SpanProcessor', () => {
     config = {
       flushMinSpans: 3,
       stats: {
-        enabled: false,
+        DD_TRACE_STATS_COMPUTATION_ENABLED: false,
       },
+      appsec: {},
     }
     spanFormat = sinon.stub().returns({ formatted: true })
 
@@ -142,7 +143,8 @@ describe('SpanProcessor', () => {
 
   it('should configure span sampler correctly', () => {
     const config = {
-      stats: { enabled: false },
+      stats: { DD_TRACE_STATS_COMPUTATION_ENABLED: false },
+      appsec: {},
       sampler: {
         sampleRate: 0,
         spanSamplingRules: [
@@ -164,10 +166,11 @@ describe('SpanProcessor', () => {
 
   it('should erase the trace and stop execution when tracing=false', () => {
     const config = {
-      tracing: false,
+      DD_TRACE_ENABLED: false,
       stats: {
-        enabled: false,
+        DD_TRACE_STATS_COMPUTATION_ENABLED: false,
       },
+      appsec: {},
     }
 
     const processor = new SpanProcessor(exporter, prioritySampler, config)
@@ -246,7 +249,12 @@ describe('SpanProcessor', () => {
 
     it('applies the OTel HTTP rename to the exported span', () => {
       spanFormat.returns(formattedHttpSpan())
-      const otelConfig = { flushMinSpans: 3, stats: { enabled: false }, DD_TRACE_OTEL_SEMANTICS_ENABLED: true }
+      const otelConfig = {
+        flushMinSpans: 3,
+        stats: { DD_TRACE_STATS_COMPUTATION_ENABLED: false },
+        appsec: {},
+        DD_TRACE_OTEL_SEMANTICS_ENABLED: true,
+      }
       const processor = new SpanProcessor(exporter, prioritySampler, otelConfig)
       trace.started = [finishedSpan]
       trace.finished = [finishedSpan]
@@ -261,7 +269,12 @@ describe('SpanProcessor', () => {
 
     it('records span stats from the Datadog tag names, before the export-only rename', () => {
       spanFormat.returns(formattedHttpSpan())
-      const otelConfig = { flushMinSpans: 3, stats: { enabled: false }, DD_TRACE_OTEL_SEMANTICS_ENABLED: true }
+      const otelConfig = {
+        flushMinSpans: 3,
+        stats: { DD_TRACE_STATS_COMPUTATION_ENABLED: false },
+        appsec: {},
+        DD_TRACE_OTEL_SEMANTICS_ENABLED: true,
+      }
       const processor = new SpanProcessor(exporter, prioritySampler, otelConfig)
       const statsView = {}
       processor._stats = {
diff --git a/packages/dd-trace/test/span_stats.spec.js b/packages/dd-trace/test/span_stats.spec.js
index f650196895..8ba57d5142 100644
--- a/packages/dd-trace/test/span_stats.spec.js
+++ b/packages/dd-trace/test/span_stats.spec.js
@@ -83,6 +83,10 @@ const exporter = {
 
 const SpanStatsExporter = sinon.stub().returns(exporter)
 
+const otlpExporter = {
+  export: sinon.stub(),
+}
+
 const {
   SpanAggStats,
   SpanAggKey,
@@ -98,22 +102,25 @@ const {
 describe('SpanAggKey', () => {
   it('should make aggregation key for a basic span', () => {
     const key = new SpanAggKey(basicSpan)
-    assert.strictEqual(key.toString(), 'basic-span,service-name,resource-name,span-type,200,false,,,integration')
+    assert.strictEqual(
+      key.toString(), 'basic-span,service-name,resource-name,span-type,200,false,,,integration,,')
   })
 
   it('should make aggregation key for a synthetic span', () => {
     const key = new SpanAggKey(syntheticSpan)
-    assert.strictEqual(key.toString(), 'synthetic-span,service-name,resource-name,span-type,200,true,,,integration')
+    assert.strictEqual(
+      key.toString(), 'synthetic-span,service-name,resource-name,span-type,200,true,,,integration,,')
   })
 
   it('should make aggregation key for an error span', () => {
     const key = new SpanAggKey(errorSpan)
-    assert.strictEqual(key.toString(), 'error-span,service-name,resource-name,span-type,500,false,,,integration')
+    assert.strictEqual(
+      key.toString(), 'error-span,service-name,resource-name,span-type,500,false,,,integration,,')
   })
 
   it('should use sensible defaults', () => {
     const key = new SpanAggKey({ meta: {}, metrics: {} })
-    assert.strictEqual(key.toString(), `${DEFAULT_SPAN_NAME},${DEFAULT_SERVICE_NAME},,,0,false,,,`)
+    assert.strictEqual(key.toString(), `${DEFAULT_SPAN_NAME},${DEFAULT_SERVICE_NAME},,,0,false,,,,,`)
   })
 
   it('should include HTTP method and route in aggregation key', () => {
@@ -127,7 +134,7 @@ describe('SpanAggKey', () => {
     }
     const key = new SpanAggKey(span)
     assert.strictEqual(
-      key.toString(), 'basic-span,service-name,resource-name,span-type,200,false,GET,/users/:id,integration')
+      key.toString(), 'basic-span,service-name,resource-name,span-type,200,false,GET,/users/:id,integration,,')
   })
 
   it('should include HTTP method and endpoint in aggregation key', () => {
@@ -141,7 +148,8 @@ describe('SpanAggKey', () => {
     }
     const key = new SpanAggKey(span)
     assert.strictEqual(
-      key.toString(), 'basic-span,service-name,resource-name,span-type,200,false,POST,/users/{param:int},integration')
+      key.toString(),
+      'basic-span,service-name,resource-name,span-type,200,false,POST,/users/{param:int},integration,,')
   })
 
   it('should prioritize http.route over http.endpoint', () => {
@@ -156,7 +164,7 @@ describe('SpanAggKey', () => {
     }
     const key = new SpanAggKey(span)
     assert.strictEqual(
-      key.toString(), 'basic-span,service-name,resource-name,span-type,200,false,GET,/users/:id,integration')
+      key.toString(), 'basic-span,service-name,resource-name,span-type,200,false,GET,/users/:id,integration,,')
   })
 
   it('should include service source in aggregation key', () => {
@@ -169,7 +177,7 @@ describe('SpanAggKey', () => {
     }
     const key = new SpanAggKey(span)
     assert.strictEqual(
-      key.toString(), 'basic-span,service-name,resource-name,span-type,200,false,,,opt.plugin')
+      key.toString(), 'basic-span,service-name,resource-name,span-type,200,false,,,opt.plugin,,')
   })
 })
 
@@ -183,7 +191,7 @@ describe('SpanAggStats', () => {
     const errorDistribution = new LogCollapsingLowestDenseDDSketch(0.00775)
     okDistribution.accept(basicSpan.duration)
 
-    assert.deepStrictEqual(aggStats.toJSON(), {
+    assert.deepStrictEqual(aggStats.toJSON(), [{
       Name: aggKey.name,
       Type: aggKey.type,
       Resource: aggKey.resource,
@@ -193,13 +201,16 @@ describe('SpanAggStats', () => {
       HTTPMethod: aggKey.method,
       HTTPEndpoint: aggKey.endpoint,
       srv_src: aggKey.srvSrc,
+      SpanKind: aggKey.spanKind,
+
+      GRPCStatusCode: aggKey.rpcStatusCode,
       Hits: 1,
       TopLevelHits: 0,
       Errors: 0,
       Duration: basicSpan.duration,
       OkSummary: okDistribution.toProto(),
       ErrorSummary: errorDistribution.toProto(),
-    })
+    }])
   })
 
   it('should record a top-level span', () => {
@@ -211,7 +222,7 @@ describe('SpanAggStats', () => {
     const errorDistribution = new LogCollapsingLowestDenseDDSketch(0.00775)
     okDistribution.accept(topLevelSpan.duration)
 
-    assert.deepStrictEqual(aggStats.toJSON(), {
+    assert.deepStrictEqual(aggStats.toJSON(), [{
       Name: aggKey.name,
       Type: aggKey.type,
       Resource: aggKey.resource,
@@ -221,13 +232,16 @@ describe('SpanAggStats', () => {
       HTTPMethod: aggKey.method,
       HTTPEndpoint: aggKey.endpoint,
       srv_src: aggKey.srvSrc,
+      SpanKind: aggKey.spanKind,
+
+      GRPCStatusCode: aggKey.rpcStatusCode,
       Hits: 1,
       TopLevelHits: 1,
       Errors: 0,
       Duration: topLevelSpan.duration,
       OkSummary: okDistribution.toProto(),
       ErrorSummary: errorDistribution.toProto(),
-    })
+    }])
   })
 
   it('should record an error span', () => {
@@ -239,7 +253,7 @@ describe('SpanAggStats', () => {
     const errorDistribution = new LogCollapsingLowestDenseDDSketch(0.00775)
     errorDistribution.accept(errorSpan.duration)
 
-    assert.deepStrictEqual(aggStats.toJSON(), {
+    assert.deepStrictEqual(aggStats.toJSON(), [{
       Name: aggKey.name,
       Type: aggKey.type,
       Resource: aggKey.resource,
@@ -249,13 +263,16 @@ describe('SpanAggStats', () => {
       HTTPMethod: aggKey.method,
       HTTPEndpoint: aggKey.endpoint,
       srv_src: aggKey.srvSrc,
+      SpanKind: aggKey.spanKind,
+
+      GRPCStatusCode: aggKey.rpcStatusCode,
       Hits: 1,
       TopLevelHits: 0,
       Errors: 1,
       Duration: errorSpan.duration,
       OkSummary: okDistribution.toProto(),
       ErrorSummary: errorDistribution.toProto(),
-    })
+    }])
   })
 })
 
@@ -304,7 +321,7 @@ describe('SpanStatsProcessor', () => {
 
   const config = {
     stats: {
-      enabled: true,
+      DD_TRACE_STATS_COMPUTATION_ENABLED: true,
       interval: 10,
     },
     hostname: '127.0.0.1',
@@ -328,14 +345,14 @@ describe('SpanStatsProcessor', () => {
     assert.strictEqual(processor.interval, config.stats.interval)
     assert.ok(processor.buckets instanceof TimeBuckets)
     assert.strictEqual(processor.hostname, hostname())
-    assert.strictEqual(processor.enabled, config.stats.enabled)
+    assert.strictEqual(processor.enabled, config.stats.DD_TRACE_STATS_COMPUTATION_ENABLED)
     assert.strictEqual(processor.env, config.env)
     assert.deepStrictEqual(processor.tags, config.tags)
     assert.strictEqual(processor.version, config.version)
   })
 
   it('should construct a disabled instance', () => {
-    const disabledConfig = { ...config, stats: { enabled: false, interval: 10 } }
+    const disabledConfig = { ...config, stats: { DD_TRACE_STATS_COMPUTATION_ENABLED: false, interval: 10 } }
     const processor = new SpanStatsProcessor(disabledConfig)
 
     assert.strictEqual(processor.enabled, false)
@@ -363,7 +380,7 @@ describe('SpanStatsProcessor', () => {
       okDistribution.accept(topLevelSpan.duration)
     }
 
-    assert.deepStrictEqual(spanBucket.toJSON(), {
+    assert.deepStrictEqual(spanBucket.toJSON(), [{
       Name: 'top-level-span',
       Service: 'service-name',
       Resource: 'resource-name',
@@ -373,13 +390,15 @@ describe('SpanStatsProcessor', () => {
       HTTPMethod: '',
       HTTPEndpoint: '',
       srv_src: 'integration',
+      SpanKind: '',
+      GRPCStatusCode: '',
       Hits: n,
       TopLevelHits: n,
       Errors: 0,
       Duration: (topLevelSpan.duration) * n,
       OkSummary: okDistribution.toProto(),
       ErrorSummary: errorDistribution.toProto(),
-    })
+    }])
   })
 
   it('should bucket by the formatted span start, not the missing startTime field', () => {
@@ -429,6 +448,8 @@ describe('SpanStatsProcessor', () => {
           HTTPMethod: '',
           HTTPEndpoint: '',
           srv_src: 'integration',
+          SpanKind: '',
+          GRPCStatusCode: '',
           Hits: n,
           TopLevelHits: n,
           Errors: 0,
@@ -463,4 +484,70 @@ describe('SpanStatsProcessor', () => {
       ProcessTags: processTags.serialized,
     })
   })
+
+  it('should clear buckets after each interval flush', () => {
+    const p = new SpanStatsProcessor(config)
+    clearTimeout(p.timer)
+    p.onSpanFinished(topLevelSpan)
+
+    assert.strictEqual(p.buckets.size, 1)
+    p.onInterval()
+    assert.strictEqual(p.buckets.size, 0)
+  })
+
+  it('creates and stores the injected otlp exporter', () => {
+    const p = new SpanStatsProcessor(config, otlpExporter)
+    clearTimeout(p.timer)
+    assert.strictEqual(p.otlpExporter, otlpExporter)
+  })
+
+  it('should call OTLP exporter on interval when traceMetrics enabled', () => {
+    otlpExporter.export.resetHistory()
+    const p = new SpanStatsProcessor(config, otlpExporter)
+    clearTimeout(p.timer)
+    p.onSpanFinished(topLevelSpan)
+    p.onInterval()
+
+    assert.ok(otlpExporter.export.calledOnce)
+    const [drained, bucketSizeNs] = otlpExporter.export.firstCall.args
+    assert.strictEqual(drained.length, 1)
+    assert.strictEqual(bucketSizeNs, p.bucketSizeNs)
+  })
+
+  it('should not call OTLP exporter on interval when drained is empty', () => {
+    otlpExporter.export.resetHistory()
+    const p = new SpanStatsProcessor(config, otlpExporter)
+    clearTimeout(p.timer)
+    p.onInterval()
+
+    assert.ok(otlpExporter.export.notCalled)
+  })
+
+  it('should not call the legacy /v0.6/stats exporter when OTLP is enabled (mutual exclusion)', () => {
+    exporter.export.resetHistory()
+    otlpExporter.export.resetHistory()
+    const p = new SpanStatsProcessor(config, otlpExporter)
+    clearTimeout(p.timer)
+    p.onSpanFinished(topLevelSpan)
+    p.onInterval()
+
+    assert.ok(exporter.export.notCalled)
+    assert.ok(otlpExporter.export.calledOnce)
+  })
+
+  it('should record spans when only OTLP is enabled', () => {
+    otlpExporter.export.resetHistory()
+    const p = new SpanStatsProcessor({
+      stats: { DD_TRACE_STATS_COMPUTATION_ENABLED: false, interval: 10 },
+      hostname: '127.0.0.1',
+      port: 8126,
+      url: new URL('http://127.0.0.1:8126'),
+      env: 'test',
+      tags: {},
+    }, otlpExporter)
+    clearTimeout(p.timer)
+
+    p.onSpanFinished(topLevelSpan)
+    assert.strictEqual(p.buckets.size, 1)
+  })
 })
diff --git a/packages/dd-trace/test/startup-log.spec.js b/packages/dd-trace/test/startup-log.spec.js
index 78b1468cb9..aa0df80865 100644
--- a/packages/dd-trace/test/startup-log.spec.js
+++ b/packages/dd-trace/test/startup-log.spec.js
@@ -26,6 +26,7 @@ const configWithStartupLogs = {
   runtimeMetrics: true,
   startupLogs: true,
   appsec: { enabled: true },
+  profiling: { DD_PROFILING_ENABLED: false },
   dsmEnabled: true,
 }
 
diff --git a/packages/dd-trace/test/telemetry/dependencies.spec.js b/packages/dd-trace/test/telemetry/dependencies.spec.js
index 11e3c7c33e..a5b2baf80d 100644
--- a/packages/dd-trace/test/telemetry/dependencies.spec.js
+++ b/packages/dd-trace/test/telemetry/dependencies.spec.js
@@ -360,7 +360,7 @@ describe('dependencies', () => {
   describe('with configuration', () => {
     const config = {
       telemetry: {
-        dependencyCollection: false,
+        DD_TELEMETRY_DEPENDENCY_COLLECTION_ENABLED: false,
       },
     }
     const application = 'test'
diff --git a/packages/dd-trace/test/telemetry/endpoints.spec.js b/packages/dd-trace/test/telemetry/endpoints.spec.js
index 3db487f4f0..8efbd77be0 100644
--- a/packages/dd-trace/test/telemetry/endpoints.spec.js
+++ b/packages/dd-trace/test/telemetry/endpoints.spec.js
@@ -31,14 +31,14 @@ describe('endpoints telemetry', () => {
     })
 
     it('should subscribe', () => {
-      const config = { appsec: { apiSecurity: { endpointCollectionEnabled: true } } }
+      const config = { appsec: { DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: true } }
       endpoints.start(config)
 
       sinon.assert.calledThrice(subscribe)
     })
 
     it('should not subscribe', () => {
-      const config = { appsec: { apiSecurity: { endpointCollectionEnabled: false } } }
+      const config = { appsec: { DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: false } }
       endpoints.start(config)
 
       sinon.assert.notCalled(subscribe)
@@ -68,10 +68,8 @@ describe('endpoints telemetry', () => {
 
       const config = {
         appsec: {
-          apiSecurity: {
-            endpointCollectionEnabled: true,
-            endpointCollectionMessageLimit: 100,
-          },
+          DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: true,
+          DD_API_SECURITY_ENDPOINT_COLLECTION_MESSAGE_LIMIT: 100,
         },
       }
 
diff --git a/packages/dd-trace/test/telemetry/index.spec.js b/packages/dd-trace/test/telemetry/index.spec.js
index e636da486c..392a037d50 100644
--- a/packages/dd-trace/test/telemetry/index.spec.js
+++ b/packages/dd-trace/test/telemetry/index.spec.js
@@ -43,7 +43,7 @@ describe('telemetry (proxy)', () => {
   })
 
   it('should proxy when enabled', () => {
-    const config = { telemetry: { enabled: true } }
+    const config = { telemetry: { DD_INSTRUMENTATION_TELEMETRY_ENABLED: true } }
 
     proxy.start(config)
     proxy.updateIntegrations()
@@ -57,7 +57,7 @@ describe('telemetry (proxy)', () => {
   })
 
   it('should proxy when enabled from updateConfig', () => {
-    const config = { telemetry: { enabled: true } }
+    const config = { telemetry: { DD_INSTRUMENTATION_TELEMETRY_ENABLED: true } }
 
     proxy.updateConfig([], config)
     proxy.updateIntegrations()
@@ -122,9 +122,9 @@ describe('telemetry', () => {
 
     telemetry.start({
       telemetry: {
-        enabled: true,
-        heartbeatInterval: DEFAULT_HEARTBEAT_INTERVAL,
-        extendedHeartbeatInterval: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
+        DD_INSTRUMENTATION_TELEMETRY_ENABLED: true,
+        DD_TELEMETRY_HEARTBEAT_INTERVAL: DEFAULT_HEARTBEAT_INTERVAL,
+        DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
       },
       hostname: 'localhost',
       port: traceAgent.address().port,
@@ -135,8 +135,8 @@ describe('telemetry', () => {
         'runtime-id': '1a2b3c',
       },
       circularObject,
-      appsec: { enabled: true },
-      profiling: { enabled: 'true' },
+      appsec: { enabled: true, DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: false },
+      profiling: { DD_PROFILING_ENABLED: 'true' },
       peerServiceMapping: {
         service_1: 'remapped_service_1',
         service_2: 'remapped_service_2',
@@ -254,13 +254,13 @@ describe('telemetry', () => {
     }).listen(0, () => {
       telemetry.start({
         telemetry: {
-          enabled: false,
-          heartbeatInterval: 60000,
-          extendedHeartbeatInterval: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
+          DD_INSTRUMENTATION_TELEMETRY_ENABLED: false,
+          DD_TELEMETRY_HEARTBEAT_INTERVAL: 60000,
+          DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
         },
         hostname: 'localhost',
         port: (/** @type {import('net').AddressInfo} */ (server.address())).port,
-        appsec: { sca: { enabled: false } },
+        appsec: { DD_APPSEC_SCA_ENABLED: false },
       })
 
       setTimeout(() => {
@@ -279,12 +279,12 @@ describe('telemetry', () => {
     })
     notEnabledTelemetry.start({
       telemetry: {
-        enabled: false,
-        heartbeatInterval: DEFAULT_HEARTBEAT_INTERVAL,
-        extendedHeartbeatInterval: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
+        DD_INSTRUMENTATION_TELEMETRY_ENABLED: false,
+        DD_TELEMETRY_HEARTBEAT_INTERVAL: DEFAULT_HEARTBEAT_INTERVAL,
+        DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
       },
-      appsec: { enabled: false, sca: { enabled: undefined } },
-      profiling: { enabled: false },
+      appsec: { enabled: false, DD_APPSEC_SCA_ENABLED: undefined },
+      profiling: { DD_PROFILING_ENABLED: false },
     }, {
       _pluginsByName: pluginsByName,
     })
@@ -311,7 +311,7 @@ describe('telemetry app-heartbeat', () => {
   })
 
   it('should send heartbeat in uniform intervals', (done) => {
-    let beats = 0 // to keep track of the amont of times extendedHeartbeat is called
+    let beats = 0 // to keep track of the amount of times extendedHeartbeat is called
     const sendDataRequest = {
       sendData: (config, application, host, reqType, payload, cb = () => {}) => {
         if (reqType === 'app-heartbeat') {
@@ -331,16 +331,16 @@ describe('telemetry app-heartbeat', () => {
 
     telemetry.start({
       telemetry: {
-        enabled: true,
-        heartbeatInterval: HEARTBEAT_INTERVAL,
-        extendedHeartbeatInterval: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
+        DD_INSTRUMENTATION_TELEMETRY_ENABLED: true,
+        DD_TELEMETRY_HEARTBEAT_INTERVAL: HEARTBEAT_INTERVAL,
+        DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
       },
       hostname: 'localhost',
       port: 0,
       service: 'test service',
       version: '1.2.3-beta4',
-      appsec: { enabled: true },
-      profiling: { enabled: true },
+      appsec: { enabled: true, DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: false },
+      profiling: { DD_PROFILING_ENABLED: true },
       env: 'preprod',
       tags: {
         'runtime-id': '1a2b3c',
@@ -373,7 +373,7 @@ describe('Telemetry extended heartbeat', () => {
 
   it('should be sent every 24 hours', (done) => {
     let extendedHeartbeatRequest
-    let beats = 0 // to keep track of the amont of times extendedHeartbeat is called
+    let beats = 0 // to keep track of the amount of times extendedHeartbeat is called
     const sendDataRequest = {
       sendData: (config, application, host, reqType, payload, cb = () => {}) => {
         if (reqType === 'app-started') {
@@ -399,16 +399,16 @@ describe('Telemetry extended heartbeat', () => {
 
     telemetry.start({
       telemetry: {
-        enabled: true,
-        heartbeatInterval: HEARTBEAT_INTERVAL,
-        extendedHeartbeatInterval: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
+        DD_INSTRUMENTATION_TELEMETRY_ENABLED: true,
+        DD_TELEMETRY_HEARTBEAT_INTERVAL: HEARTBEAT_INTERVAL,
+        DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
       },
       hostname: 'localhost',
       port: 0,
       service: 'test service',
       version: '1.2.3-beta4',
-      appsec: { enabled: true },
-      profiling: { enabled: true },
+      appsec: { enabled: true, DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: false },
+      profiling: { DD_PROFILING_ENABLED: true },
       env: 'preprod',
       tags: {
         'runtime-id': '1a2b3c',
@@ -444,16 +444,16 @@ describe('Telemetry extended heartbeat', () => {
 
     const config = {
       telemetry: {
-        enabled: true,
-        heartbeatInterval: HEARTBEAT_INTERVAL,
-        extendedHeartbeatInterval: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
+        DD_INSTRUMENTATION_TELEMETRY_ENABLED: true,
+        DD_TELEMETRY_HEARTBEAT_INTERVAL: HEARTBEAT_INTERVAL,
+        DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
       },
       hostname: 'localhost',
       port: 0,
       service: 'test service',
       version: '1.2.3-beta4',
-      appsec: { enabled: true },
-      profiling: { enabled: true },
+      appsec: { enabled: true, DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: false },
+      profiling: { DD_PROFILING_ENABLED: true },
       env: 'preprod',
       tags: {
         'runtime-id': '1a2b3c',
@@ -551,16 +551,16 @@ describe('Telemetry extended heartbeat', () => {
 
     const config = {
       telemetry: {
-        enabled: true,
-        heartbeatInterval: HEARTBEAT_INTERVAL,
-        extendedHeartbeatInterval: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
+        DD_INSTRUMENTATION_TELEMETRY_ENABLED: true,
+        DD_TELEMETRY_HEARTBEAT_INTERVAL: HEARTBEAT_INTERVAL,
+        DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
       },
       hostname: 'localhost',
       port: 0,
       service: 'test service',
       version: '1.2.3-beta4',
-      appsec: { enabled: true },
-      profiling: { enabled: true },
+      appsec: { enabled: true, DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: false },
+      profiling: { DD_PROFILING_ENABLED: true },
       env: 'preprod',
       tags: {
         'runtime-id': '1a2b3c',
@@ -647,16 +647,16 @@ describe('Telemetry retry', () => {
 
     telemetry.start({
       telemetry: {
-        enabled: true,
-        heartbeatInterval: HEARTBEAT_INTERVAL,
-        extendedHeartbeatInterval: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
+        DD_INSTRUMENTATION_TELEMETRY_ENABLED: true,
+        DD_TELEMETRY_HEARTBEAT_INTERVAL: HEARTBEAT_INTERVAL,
+        DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
       },
       hostname: 'localhost',
       port: 0,
       service: 'test service',
       version: '1.2.3-beta4',
-      appsec: { enabled: true },
-      profiling: { enabled: true },
+      appsec: { enabled: true, DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: false },
+      profiling: { DD_PROFILING_ENABLED: true },
       env: 'preprod',
       tags: {
         'runtime-id': '1a2b3c',
@@ -740,16 +740,16 @@ describe('Telemetry retry', () => {
 
     telemetry.start({
       telemetry: {
-        enabled: true,
-        heartbeatInterval: HEARTBEAT_INTERVAL,
-        extendedHeartbeatInterval: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
+        DD_INSTRUMENTATION_TELEMETRY_ENABLED: true,
+        DD_TELEMETRY_HEARTBEAT_INTERVAL: HEARTBEAT_INTERVAL,
+        DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
       },
       hostname: 'localhost',
       port: 0,
       service: 'test service',
       version: '1.2.3-beta4',
-      appsec: { enabled: true },
-      profiling: { enabled: true },
+      appsec: { enabled: true, DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: false },
+      profiling: { DD_PROFILING_ENABLED: true },
       env: 'preprod',
       tags: {
         'runtime-id': '1a2b3c',
@@ -815,16 +815,16 @@ describe('Telemetry retry', () => {
 
     telemetry.start({
       telemetry: {
-        enabled: true,
-        heartbeatInterval: HEARTBEAT_INTERVAL,
-        extendedHeartbeatInterval: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
+        DD_INSTRUMENTATION_TELEMETRY_ENABLED: true,
+        DD_TELEMETRY_HEARTBEAT_INTERVAL: HEARTBEAT_INTERVAL,
+        DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
       },
       hostname: 'localhost',
       port: 0,
       service: 'test service',
       version: '1.2.3-beta4',
-      appsec: { enabled: true },
-      profiling: { enabled: true },
+      appsec: { enabled: true, DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: false },
+      profiling: { DD_PROFILING_ENABLED: true },
       env: 'preprod',
       tags: {
         'runtime-id': '1a2b3c',
@@ -881,16 +881,16 @@ describe('Telemetry retry', () => {
     // Start function sends 2 messages app-started & app-integrations-change
     telemetry.start({
       telemetry: {
-        enabled: true,
-        heartbeatInterval: HEARTBEAT_INTERVAL,
-        extendedHeartbeatInterval: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
+        DD_INSTRUMENTATION_TELEMETRY_ENABLED: true,
+        DD_TELEMETRY_HEARTBEAT_INTERVAL: HEARTBEAT_INTERVAL,
+        DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
       },
       hostname: 'localhost',
       port: 0,
       service: 'test service',
       version: '1.2.3-beta4',
-      appsec: { enabled: true },
-      profiling: { enabled: true },
+      appsec: { enabled: true, DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: false },
+      profiling: { DD_PROFILING_ENABLED: true },
       env: 'preprod',
       tags: {
         'runtime-id': '1a2b3c',
@@ -969,16 +969,16 @@ describe('Telemetry retry', () => {
     // Start function sends 2 messages app-started & app-integrations-change
     telemetry.start({
       telemetry: {
-        enabled: true,
-        heartbeatInterval: HEARTBEAT_INTERVAL,
-        extendedHeartbeatInterval: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
+        DD_INSTRUMENTATION_TELEMETRY_ENABLED: true,
+        DD_TELEMETRY_HEARTBEAT_INTERVAL: HEARTBEAT_INTERVAL,
+        DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
       },
       hostname: 'localhost',
       port: 0,
       service: 'test service',
       version: '1.2.3-beta4',
-      appsec: { enabled: true },
-      profiling: { enabled: true },
+      appsec: { enabled: true, DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: false },
+      profiling: { DD_PROFILING_ENABLED: true },
       env: 'preprod',
       tags: {
         'runtime-id': '1a2b3c',
@@ -1068,9 +1068,9 @@ describe('AVM OSS', () => {
 
           telemetryConfig = {
             telemetry: {
-              enabled: true,
-              heartbeatInterval: HEARTBEAT_INTERVAL,
-              extendedHeartbeatInterval: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
+              DD_INSTRUMENTATION_TELEMETRY_ENABLED: true,
+              DD_TELEMETRY_HEARTBEAT_INTERVAL: HEARTBEAT_INTERVAL,
+              DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL: DEFAULT_EXTENDED_HEARTBEAT_INTERVAL,
             },
             hostname: 'localhost',
             port: traceAgent.address().port,
@@ -1080,8 +1080,8 @@ describe('AVM OSS', () => {
             tags: {
               'runtime-id': '1a2b3c',
             },
-            appsec: { enabled: false },
-            profiling: { enabled: false },
+            appsec: { enabled: false, DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED: false },
+            profiling: { DD_PROFILING_ENABLED: false },
           }
         })
 
@@ -1139,8 +1139,8 @@ describe('AVM OSS', () => {
     it('should log a warning when sca is enabled and telemetry no', () => {
       telemetry.start(
         {
-          telemetry: { enabled: false },
-          appsec: { sca: { enabled: true } },
+          telemetry: { DD_INSTRUMENTATION_TELEMETRY_ENABLED: false },
+          appsec: { DD_APPSEC_SCA_ENABLED: true },
         }
       )
 
diff --git a/packages/dd-trace/test/telemetry/logs/index.spec.js b/packages/dd-trace/test/telemetry/logs/index.spec.js
index 4394f4d703..87b1611863 100644
--- a/packages/dd-trace/test/telemetry/logs/index.spec.js
+++ b/packages/dd-trace/test/telemetry/logs/index.spec.js
@@ -18,9 +18,9 @@ describe('telemetry logs', () => {
   beforeEach(() => {
     defaultConfig = {
       telemetry: {
-        enabled: true,
-        logCollection: true,
-        debug: false,
+        DD_INSTRUMENTATION_TELEMETRY_ENABLED: true,
+        DD_TELEMETRY_LOG_COLLECTION_ENABLED: true,
+        DD_TELEMETRY_DEBUG: false,
       },
     }
 
@@ -65,7 +65,7 @@ describe('telemetry logs', () => {
         'dc-polyfill': dc,
       })
 
-      defaultConfig.telemetry.logCollection = false
+      defaultConfig.telemetry.DD_TELEMETRY_LOG_COLLECTION_ENABLED = false
       logs.start(defaultConfig)
 
       sinon.assert.notCalled(telemetryLog.subscribe)
@@ -222,7 +222,7 @@ describe('telemetry logs', () => {
     })
 
     it('should not drain logCollector and call sendData if not enabled', () => {
-      defaultConfig.telemetry.logCollection = false
+      defaultConfig.telemetry.DD_TELEMETRY_LOG_COLLECTION_ENABLED = false
 
       logs.start(defaultConfig)
 
diff --git a/packages/dd-trace/test/telemetry/send-data.spec.js b/packages/dd-trace/test/telemetry/send-data.spec.js
index b951a1d46c..aefe0dced3 100644
--- a/packages/dd-trace/test/telemetry/send-data.spec.js
+++ b/packages/dd-trace/test/telemetry/send-data.spec.js
@@ -83,7 +83,7 @@ describe('sendData', () => {
     sendDataModule.sendData({
       url: '/test',
       tags: { 'runtime-id': '123' },
-      telemetry: { debug: true },
+      telemetry: { DD_TELEMETRY_DEBUG: true },
     }, application, host, 'req-type')
 
     sinon.assert.calledOnce(request)
@@ -161,7 +161,7 @@ describe('sendData', () => {
     sendDataModule.sendData(
       {
         isCiVisibility: true,
-        DD_CIVISIBILITY_AGENTLESS_ENABLED: true,
+        testOptimization: { DD_CIVISIBILITY_AGENTLESS_ENABLED: true },
         tags: { 'runtime-id': '123' },
         site: 'datadoghq.eu',
       },
@@ -184,8 +184,10 @@ describe('sendData', () => {
     sendDataModule.sendData(
       {
         isCiVisibility: true,
-        DD_CIVISIBILITY_AGENTLESS_ENABLED: true,
-        DD_CIVISIBILITY_AGENTLESS_URL: new URL('https://my-intake.example/'),
+        testOptimization: {
+          DD_CIVISIBILITY_AGENTLESS_ENABLED: true,
+          DD_CIVISIBILITY_AGENTLESS_URL: new URL('https://my-intake.example/'),
+        },
         tags: { 'runtime-id': '123' },
         site: 'datadoghq.eu',
       },
@@ -205,7 +207,7 @@ describe('sendData', () => {
 
     sendDataModule.sendData(
       {
-        apiKey: 'secret-key',
+        DD_API_KEY: 'secret-key',
         site: 'datadoghq.eu',
         tags: { 'runtime-id': '123' },
       },
@@ -225,7 +227,7 @@ describe('sendData', () => {
 
     sendDataModule.sendData(
       {
-        apiKey: 'secret-key',
+        DD_API_KEY: 'secret-key',
         site: 'x:notaport',
         tags: { 'runtime-id': '123' },
       },
diff --git a/packages/dd-trace/test/telemetry/session-propagation.spec.js b/packages/dd-trace/test/telemetry/session-propagation.spec.js
index 00363dacbe..0db1f94ca5 100644
--- a/packages/dd-trace/test/telemetry/session-propagation.spec.js
+++ b/packages/dd-trace/test/telemetry/session-propagation.spec.js
@@ -40,13 +40,13 @@ describe('session-propagation', () => {
   function createConfig (overrides = {}) {
     /**
      * @type {{
-     *   telemetry: { enabled: boolean },
+     *   telemetry: { DD_INSTRUMENTATION_TELEMETRY_ENABLED: boolean },
      *   DD_ROOT_JS_SESSION_ID: string | undefined,
      *   tags: { 'runtime-id': string }
      * }}
      */
     const config = {
-      telemetry: { enabled: true, ...overrides.telemetry },
+      telemetry: { DD_INSTRUMENTATION_TELEMETRY_ENABLED: true, ...overrides.telemetry },
       DD_ROOT_JS_SESSION_ID: undefined,
       tags: { 'runtime-id': 'current-id', ...overrides.tags },
     }
@@ -192,7 +192,7 @@ describe('session-propagation', () => {
     })
 
     it('does not change child process execution when telemetry is disabled', () => {
-      sessionPropagation.start(createConfig({ telemetry: { enabled: false } }))
+      sessionPropagation.start(createConfig({ telemetry: { DD_INSTRUMENTATION_TELEMETRY_ENABLED: false } }))
 
       const context = {
         callArgs: ['node', ['test.js'], { cwd: '/tmp', env: { FOO: 'bar' } }],
diff --git a/scripts/ci/widen-engines-for-ci.js b/scripts/ci/widen-engines-for-ci.js
new file mode 100644
index 0000000000..375f7e5d32
--- /dev/null
+++ b/scripts/ci/widen-engines-for-ci.js
@@ -0,0 +1,35 @@
+#!/usr/bin/env node
+
+'use strict'
+
+// CI-only helper. The shipped package.json pins `engines.node` to the supported
+// runtime range (`>=22`), but CI still runs the full suite on Node 18 and 20 to
+// keep those jobs exercising real tests. The runtime guard
+// (packages/dd-trace/src/guardrails/index.js) and the `withVersions` test helper
+// both read `engines.node` and bail when the running major is below it, which would
+// silently skip every suite on those majors. Widening the field to `>=18` for the
+// CI checkout keeps those jobs honest without touching what we publish.
+//
+// The node/setup action gates this step so it only runs on the supported majors the
+// `>=22` bump newly excludes (18 and 20); it is never invoked on the ancient runtimes
+// the `integration-guardrails-unsupported` job installs, which must keep seeing the
+// shipped `>=22` so the guard aborts.
+
+const fs = require('node:fs')
+const path = require('node:path')
+
+const CI_MIN_NODE = '>=18'
+
+const packageJsonPath = path.join(__dirname, '..', '..', 'package.json')
+const pkg = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'))
+
+const before = pkg.engines.node
+if (before === CI_MIN_NODE) return
+
+pkg.engines.node = CI_MIN_NODE
+const after = pkg.engines.node
+
+fs.writeFileSync(packageJsonPath, JSON.stringify(pkg, null, 2) + '\n')
+
+// eslint-disable-next-line no-console
+console.log(`Widened engines.node for CI: ${before} -> ${after}`)
diff --git a/scripts/generate-config-types.js b/scripts/generate-config-types.js
index bd7b05a302..6376b8c86e 100644
--- a/scripts/generate-config-types.js
+++ b/scripts/generate-config-types.js
@@ -57,8 +57,10 @@ function createTreeNode () {
 }
 
 function getPropertyName (canonicalName, entry) {
-  const configurationNames = entry.internalPropertyName ? [entry.internalPropertyName] : entry.configurationNames
-  return configurationNames?.[0] ?? canonicalName
+  if (entry.namespace) {
+    return `${entry.namespace}.${canonicalName}`
+  }
+  return entry.internalPropertyName ?? entry.configurationNames?.[0] ?? canonicalName
 }
 
 const FALLBACK_PATTERN =
diff --git a/scripts/group-coverage.mjs b/scripts/group-coverage.mjs
new file mode 100644
index 0000000000..b7df77c38a
--- /dev/null
+++ b/scripts/group-coverage.mjs
@@ -0,0 +1,244 @@
+import { copyFileSync, mkdirSync, readdirSync, rmSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { argv } from 'node:process'
+import { fileURLToPath } from 'node:url'
+
+/* eslint-disable no-console */
+
+// Sorts the per-cell `coverage-*` artifacts that `download-artifacts.mjs` placed under
+// `coverage-results/` into one directory per integration under `coverage-upload/<group>/`, so the
+// All Green upload steps send ~100 grouped reports to Codecov/Datadog instead of ~430. Codecov
+// silently parks uploads past its ~150-per-commit ceiling in `started` (never merged), so the
+// cell-per-upload model dropped coverage; one upload per integration stays under the ceiling.
+//
+// The reports are not merged here — both backends merge same-flag uploads server-side, so this only
+// routes each cell's already-patched `lcov.info` into its group's directory. That keeps the harness
+// free of any istanbul dependency in All Green's sparse checkout and passes each report through
+// byte-for-byte, so the `getLineCoverage` patch the producers baked in survives untouched.
+
+const INPUT_DIR = 'coverage-results'
+const OUTPUT_DIR = 'coverage-upload'
+const ARTIFACT_PREFIX = 'coverage-'
+// `upload-coverage-artifact` names each cell `coverage-<flag>__<job>-<job-index>`; the `__` separates
+// the grouping flag from the per-cell uniqueness suffix so two matrix cells sharing a flag (cypress
+// varies `spec` outside its flag) still upload distinct artifacts instead of clobbering each other.
+const UNIQUE_SEPARATOR = '__'
+
+// Tokens that name a Node.js major, a library version, or a runtime/OS/module-format axis — all
+// noise for "which integration regressed". Stripping every noise token folds a flag like
+// `apm-integrations-next-oldest-14.2.6` down to its integration `apm-integrations-next`.
+const NOISE_TOKENS = new Set([
+  'latest', 'oldest', 'eol', 'active', 'maintenance', 'all', // Node.js / range_clean aliases
+  'ubuntu', 'macos', 'windows', // runner OS
+  'commonjs', 'esm', // module format
+])
+// A bare version (`14.2.6`, `18`) or a `range_clean` qualifier that packs the operator and version
+// into one dash-token (`gte.5.2.0`, `gte.6.16.0.and.lt.7.0.0`).
+const VERSION_RE = /^(?:gte|gt|lte|lt|eq)?\.?\d+(?:\.\d+)*(?:\.(?:and|or|gte|gt|lte|lt|eq)\b.*)?$/
+
+// Keep a busy area's one-cell libraries from each becoming their own upload: pack them into buckets
+// of at most this many libraries, named for their members so the flag still points at a library.
+const MAX_LIBS_PER_BUCKET = 3
+// Codecov validates flags against `^[\w\.\-]{1,45}$` and silently drops any that fail. `+` is out, so
+// members join with `_`; a name longer than this falls back to a numbered bucket that stays valid.
+const MAX_FLAG_LENGTH = 45
+
+/**
+ * @param {string} token
+ * @returns {boolean}
+ */
+function isNoiseToken (token) {
+  return NOISE_TOKENS.has(token.toLowerCase()) || VERSION_RE.test(token)
+}
+
+/**
+ * The integration a per-cell flag belongs to, with every version/OS/tier/format token removed
+ * wherever it sits. Node.js tier and library version commonly land in the middle of a flag (e.g.
+ * `serverless-aws-sdk-oldest-s3`, where `oldest` is the Node.js tier and `s3` a real sub-suite of
+ * the one `aws-sdk` integration), so a tail-only strip would leave the tier stranded mid-flag.
+ *
+ * @param {string} flag
+ * @returns {string}
+ */
+function integrationOf (flag) {
+  const tokens = flag.split('-').filter(token => !isNoiseToken(token))
+  return tokens.length > 0 ? tokens.join('-') : flag
+}
+
+/**
+ * The Codecov flag carried by an artifact name, dropping the `coverage-` prefix and the
+ * `__<unique>` cell-uniqueness suffix.
+ *
+ * @param {string} artifact
+ * @returns {string}
+ */
+function flagOf (artifact) {
+  const withoutPrefix = artifact.slice(ARTIFACT_PREFIX.length)
+  const separator = withoutPrefix.indexOf(UNIQUE_SEPARATOR)
+  return separator === -1 ? withoutPrefix : withoutPrefix.slice(0, separator)
+}
+
+// Codecov reads branch/function coverage from istanbul's JSON; Datadog only ingests the lcov. Each
+// report is routed by format into its own subdirectory so the two upload steps search the one their
+// backend reads. The extension marks which.
+const REPORTS = new Map([
+  ['lcov.info', 'lcov'],
+  ['coverage-final.json', 'json'],
+])
+
+/**
+ * Recursively collect coverage report files beneath a directory, paired with the artifact instance
+ * (run-id + name) they came from and their format. `download-artifacts.mjs` lays files out as
+ * `coverage-results/<run-id>/<artifact-name>/...`; a single artifact can hold more than one report
+ * per format (a cell that ran coverage across several Node.js versions writes one set per version),
+ * so the run-id distinguishes a rerun's reupload from those siblings.
+ *
+ * @param {string} dir
+ * @param {Array<{ runId: string, name: string, format: string, reportPath: string }>} out
+ * @param {{ runId?: string, name?: string }} context
+ * @returns {Array<{ runId: string, name: string, format: string, reportPath: string }>}
+ */
+function collectCoverageFiles (dir, out = [], context = {}) {
+  let entries
+  try {
+    entries = readdirSync(dir, { withFileTypes: true })
+  } catch {
+    return out
+  }
+  for (const entry of entries) {
+    const full = join(dir, entry.name)
+    if (entry.isDirectory()) {
+      const runId = context.runId ?? entry.name
+      const name = context.runId === undefined ? undefined : (context.name ?? entry.name)
+      collectCoverageFiles(full, out, { runId, name })
+    } else if (REPORTS.has(entry.name) && context.name?.startsWith(ARTIFACT_PREFIX)) {
+      out.push({ runId: context.runId, name: context.name, format: REPORTS.get(entry.name), reportPath: full })
+    }
+  }
+  return out
+}
+
+/**
+ * Assign each integration to an upload group. Integrations exercised by more than one cell stay on
+ * their own; the one-cell tail of a busy area is packed into buckets named for their libraries, or a
+ * numbered bucket when those names would overrun Codecov's flag length limit.
+ *
+ * @param {Map<string, string[]>} cellsByIntegration  Integration → artifact names feeding it.
+ * @returns {Map<string, string[]>}  Group flag → integrations it owns.
+ */
+function planGroups (cellsByIntegration) {
+  const groups = new Map()
+  const singletonsByArea = new Map()
+
+  for (const [integration, cells] of cellsByIntegration) {
+    if (cells.length > 1) {
+      groups.set(integration, [integration])
+      continue
+    }
+    const area = integration.split('-')[0]
+    const list = singletonsByArea.get(area)
+    if (list) {
+      list.push(integration)
+    } else {
+      singletonsByArea.set(area, [integration])
+    }
+  }
+
+  for (const [area, integrations] of singletonsByArea) {
+    integrations.sort()
+    if (integrations.length <= 2) {
+      for (const integration of integrations) {
+        groups.set(integration, [integration])
+      }
+      continue
+    }
+    let bucket = 0
+    for (let i = 0; i < integrations.length; i += MAX_LIBS_PER_BUCKET) {
+      const chunk = integrations.slice(i, i + MAX_LIBS_PER_BUCKET)
+      const named = `${area}-${chunk.map(integration => integration.slice(area.length + 1)).join('_')}`
+      groups.set(named.length <= MAX_FLAG_LENGTH ? named : `${area}-bucket-${bucket}`, chunk)
+      bucket++
+    }
+  }
+
+  return groups
+}
+
+/**
+ * Reduce discovered report files to one cell per artifact name and bucket the cells by integration.
+ * All Green reruns failed workflows, so the same artifact name can arrive from more than one run;
+ * the newest run reflects the cell's final state, so older reuploads are dropped.
+ *
+ * @param {Array<{ runId: string, name: string, format: string, reportPath: string }>} files
+ * @returns {{ groups: Map<string, string[]>,
+ *   reportsByArtifact: Map<string, Array<{ format: string, reportPath: string }>>,
+ *   cellsByIntegration: Map<string, string[]> }}
+ */
+function planCoverageGroups (files) {
+  const newestRunByArtifact = new Map()
+  for (const { runId, name } of files) {
+    const previous = newestRunByArtifact.get(name)
+    if (previous === undefined || Number(runId) > Number(previous)) {
+      newestRunByArtifact.set(name, runId)
+    }
+  }
+
+  const reportsByArtifact = new Map()
+  const cellsByIntegration = new Map()
+  for (const { runId, name, format, reportPath } of files) {
+    if (runId !== newestRunByArtifact.get(name)) continue
+    const existing = reportsByArtifact.get(name)
+    if (existing) {
+      existing.push({ format, reportPath })
+      continue
+    }
+    reportsByArtifact.set(name, [{ format, reportPath }])
+    const integration = integrationOf(flagOf(name))
+    const owned = cellsByIntegration.get(integration)
+    if (owned) {
+      owned.push(name)
+    } else {
+      cellsByIntegration.set(integration, [name])
+    }
+  }
+
+  return { groups: planGroups(cellsByIntegration), reportsByArtifact, cellsByIntegration }
+}
+
+function main () {
+  rmSync(OUTPUT_DIR, { force: true, recursive: true })
+
+  const files = collectCoverageFiles(INPUT_DIR)
+  if (files.length === 0) {
+    console.log(`No coverage reports found under ${INPUT_DIR}/.`)
+    return
+  }
+
+  const { groups, reportsByArtifact, cellsByIntegration } = planCoverageGroups(files)
+
+  console.log(`Routing ${reportsByArtifact.size} cell report set(s) into ${groups.size} group(s):`)
+  for (const [flag, integrations] of [...groups].sort()) {
+    const counts = new Map()
+    for (const integration of integrations) {
+      for (const artifact of cellsByIntegration.get(integration)) {
+        for (const { format, reportPath } of reportsByArtifact.get(artifact)) {
+          const index = counts.get(format) ?? 0
+          const formatDir = join(OUTPUT_DIR, flag, format)
+          mkdirSync(formatDir, { recursive: true })
+          copyFileSync(reportPath, join(formatDir, `${artifact}-${index}.${format}`))
+          counts.set(format, index + 1)
+        }
+      }
+    }
+    const summary = [...counts].map(([format, count]) => `${count} ${format}`).join(', ')
+    console.log(`  ${flag} (${integrations.length} integration(s): ${summary})`)
+  }
+
+  writeFileSync(join(OUTPUT_DIR, 'groups.txt'), [...groups.keys()].sort().join('\n') + '\n')
+}
+
+export { flagOf, integrationOf, planCoverageGroups, planGroups }
+
+if (argv[1] === fileURLToPath(import.meta.url)) {
+  main()
+}
diff --git a/scripts/group-coverage.spec.mjs b/scripts/group-coverage.spec.mjs
new file mode 100644
index 0000000000..9d743fb516
--- /dev/null
+++ b/scripts/group-coverage.spec.mjs
@@ -0,0 +1,169 @@
+import assert from 'node:assert/strict'
+
+import { describe, it } from 'mocha'
+
+import { flagOf, integrationOf, planCoverageGroups, planGroups } from './group-coverage.mjs'
+
+/**
+ * One cell's discovered report set: a `lcov` and a `json` entry per Node.js version the cell ran.
+ *
+ * @param {string} name
+ * @param {object} [options]
+ * @param {string} [options.runId]
+ * @param {number} [options.versions]  Number of Node.js versions the cell ran (one report set each).
+ * @returns {Array<{ runId: string, name: string, format: string, reportPath: string }>}
+ */
+function files (name, { runId = '1', versions = 1 } = {}) {
+  const out = []
+  for (let version = 0; version < versions; version++) {
+    const dir = `coverage-results/${runId}/${name}/node-2${version}-x`
+    out.push(
+      { runId, name, format: 'lcov', reportPath: `${dir}/lcov.info` },
+      { runId, name, format: 'json', reportPath: `${dir}/coverage-final.json` }
+    )
+  }
+  return out
+}
+
+describe('group-coverage', () => {
+  describe('integrationOf', () => {
+    it('strips a Node.js major from the tail', () => {
+      assert.equal(integrationOf('apm-integrations-kafkajs-18'), 'apm-integrations-kafkajs')
+    })
+
+    it('strips a library version and its range qualifier', () => {
+      assert.equal(integrationOf('apm-integrations-aerospike-20-gte.5.2.0'), 'apm-integrations-aerospike')
+    })
+
+    it('strips Node.js tier, library version, and module format together', () => {
+      assert.equal(integrationOf('test-optimization-cypress-latest-14.5.4-esm'), 'test-optimization-cypress')
+      assert.equal(integrationOf('test-optimization-cypress-oldest-12.0.0-commonJS'), 'test-optimization-cypress')
+    })
+
+    it('strips a trailing OS token', () => {
+      assert.equal(integrationOf('appsec-windows'), 'appsec')
+    })
+
+    it('keeps an integration that carries no version axis', () => {
+      assert.equal(integrationOf('apm-integrations-dns'), 'apm-integrations-dns')
+    })
+
+    it('strips a Node.js tier stranded mid-flag while keeping the meaningful sub-suite', () => {
+      // `serverless-aws-sdk-${node-version}-${spec}`: the tier (oldest/latest) is noise, but the
+      // sub-suite (s3, dynamodb) names a real slice of the aws-sdk integration worth its own group.
+      assert.equal(integrationOf('serverless-aws-sdk-oldest-s3'), 'serverless-aws-sdk-s3')
+      assert.equal(integrationOf('serverless-aws-sdk-latest-dynamodb'), 'serverless-aws-sdk-dynamodb')
+    })
+
+    it('never strips the area when every token looks like noise', () => {
+      assert.equal(integrationOf('latest'), 'latest')
+    })
+  })
+
+  describe('flagOf', () => {
+    it('drops the coverage- prefix', () => {
+      assert.equal(flagOf('coverage-appsec-express'), 'appsec-express')
+    })
+
+    it('drops the per-cell uniqueness suffix after the separator', () => {
+      assert.equal(flagOf('coverage-test-optimization-cypress-latest-14.5.4-esm__integration-cypress-7'),
+        'test-optimization-cypress-latest-14.5.4-esm')
+    })
+  })
+
+  describe('planGroups', () => {
+    it('keeps a multi-cell integration as its own group', () => {
+      const groups = planGroups(new Map([['apm-integrations-next', ['a', 'b', 'c']]]))
+      assert.deepEqual([...groups], [['apm-integrations-next', ['apm-integrations-next']]])
+    })
+
+    it('leaves a small singleton tail (<=2) standalone', () => {
+      const groups = planGroups(new Map([
+        ['serverless-lambda', ['a']],
+        ['serverless-azure', ['b']],
+      ]))
+      assert.deepEqual(groups.get('serverless-lambda'), ['serverless-lambda'])
+      assert.deepEqual(groups.get('serverless-azure'), ['serverless-azure'])
+    })
+
+    it('buckets a busy singleton tail into library-named groups of at most three', () => {
+      const singletons = ['plugins-axios', 'plugins-redis', 'plugins-pino', 'plugins-fs', 'plugins-net']
+      const groups = planGroups(new Map(singletons.map(name => [name, ['cell']])))
+      assert.deepEqual([...groups.keys()].sort(), ['plugins-axios_fs_net', 'plugins-pino_redis'])
+      assert.deepEqual(groups.get('plugins-axios_fs_net'), ['plugins-axios', 'plugins-fs', 'plugins-net'])
+      for (const integrations of groups.values()) {
+        assert.ok(integrations.length <= 3, 'no bucket exceeds three integrations')
+      }
+    })
+
+    it('keeps every generated bucket flag valid for Codecov and within its length limit', () => {
+      // Codecov rejects any flag that does not match `^[\w\.\-]{1,45}$`, so a bucket name may carry
+      // only word characters, `.` and `-`, and must stay <= 45 chars. The verbose `apm-integrations`
+      // tail blows past 45 once three members join, so the overflow path must fall back to a valid
+      // bounded name rather than ship a flag Codecov drops.
+      const singletons = [
+        'apm-integrations-aerospike', 'apm-integrations-couchbase', 'apm-integrations-elasticsearch',
+        'apm-integrations-mongodb', 'apm-integrations-opensearch',
+      ]
+      const groups = planGroups(new Map(singletons.map(name => [name, ['cell']])))
+      for (const flag of groups.keys()) {
+        assert.match(flag, /^[\w.-]{1,45}$/, `flag ${flag} is a valid Codecov flag`)
+      }
+    })
+
+    it('joins short bucket members with an underscore so the flag stays valid', () => {
+      const groups = planGroups(new Map([
+        ['plugins-a', ['cell']], ['plugins-b', ['cell']], ['plugins-c', ['cell']],
+      ]))
+      assert.deepEqual([...groups.keys()], ['plugins-a_b_c'])
+    })
+  })
+
+  describe('planCoverageGroups', () => {
+    it('keeps only the newest run when a rerun reuploads the same artifact name', () => {
+      const { reportsByArtifact } = planCoverageGroups([
+        ...files('coverage-plugins-axios__a-0', { runId: '100' }),
+        ...files('coverage-plugins-axios__a-0', { runId: '205' }),
+      ])
+      const reports = reportsByArtifact.get('coverage-plugins-axios__a-0')
+      assert.ok(reports.every(report => report.reportPath.includes('/205/')), 'only the newest run survives')
+    })
+
+    it('compares run ids numerically across a digit-length boundary', () => {
+      // A lexicographic compare keeps the older run when the rerun crosses a power-of-ten boundary
+      // (`'9' > '10'` is true as strings), silently uploading the stale failed run's coverage.
+      const { reportsByArtifact } = planCoverageGroups([
+        ...files('coverage-plugins-axios__a-0', { runId: '9' }),
+        ...files('coverage-plugins-axios__a-0', { runId: '10' }),
+      ])
+      const reports = reportsByArtifact.get('coverage-plugins-axios__a-0')
+      assert.ok(reports.every(report => report.reportPath.includes('/10/')), 'the newer run wins numerically')
+    })
+
+    it('keeps both formats across every Node.js version a single artifact carries', () => {
+      const { reportsByArtifact } = planCoverageGroups(files('coverage-plugins-axios__a-0', { versions: 2 }))
+      const reports = reportsByArtifact.get('coverage-plugins-axios__a-0')
+      assert.equal(reports.filter(report => report.format === 'lcov').length, 2)
+      assert.equal(reports.filter(report => report.format === 'json').length, 2)
+    })
+
+    it('folds cells that share a flag but carry distinct uniqueness suffixes', () => {
+      // Cypress varies `spec` outside its flag: eight specs per (version, cypress-version, module)
+      // upload distinct artifacts that all belong to the one cypress integration.
+      const { groups, cellsByIntegration } = planCoverageGroups([
+        ...files('coverage-test-optimization-cypress-latest-latest-esm__integration-cypress-0'),
+        ...files('coverage-test-optimization-cypress-latest-latest-esm__integration-cypress-1'),
+      ])
+      assert.deepEqual([...groups], [['test-optimization-cypress', ['test-optimization-cypress']]])
+      assert.equal(cellsByIntegration.get('test-optimization-cypress').length, 2)
+    })
+
+    it('folds distinct version cells into one integration', () => {
+      const { groups } = planCoverageGroups([
+        ...files('coverage-apm-integrations-next-11.1.4__integration-next-0'),
+        ...files('coverage-apm-integrations-next-15.0.0__integration-next-1'),
+      ])
+      assert.deepEqual([...groups], [['apm-integrations-next', ['apm-integrations-next']]])
+    })
+  })
+})
diff --git a/scripts/install_plugin_modules.js b/scripts/install_plugin_modules.js
index c4b28e7ac2..404ef576fd 100644
--- a/scripts/install_plugin_modules.js
+++ b/scripts/install_plugin_modules.js
@@ -245,11 +245,16 @@ async function patchPeerDependencies ({ folder, externalName }) {
         if (dep === externalName) {
           versionPkgJson.dependencies[name] = pkgJson.version
         } else {
-          versionPkgJson.dependencies[name] = pkgJson[section][name].includes('||')
-            // Use the first version in the list (as npm does by default)
-            ? pkgJson[section][name].split('||')[0].trim()
-            // Only one version available so use that.
-            : pkgJson[section][name]
+          const declared = pkgJson[section][name]
+          versionPkgJson.dependencies[name] = declared.startsWith('workspace:')
+            // A `workspace:` protocol leaked into the published manifest (some monorepo packages publish it raw); it
+            // cannot resolve outside the source repo, so fall back to the pinned compatible version.
+            ? (latests[name] ?? '*')
+            : declared.includes('||')
+              // Use the first version in the list (as npm does by default)
+              ? declared.split('||')[0].trim()
+              // Only one version available so use that.
+              : declared
         }
         break
       }
diff --git a/scripts/mocha-parallel-files.js b/scripts/mocha-parallel-files.js
index 74bf1fa285..ed46806b4f 100644
--- a/scripts/mocha-parallel-files.js
+++ b/scripts/mocha-parallel-files.js
@@ -10,6 +10,12 @@ const { globSync } = require('glob')
 
 const multiMochaRc = require('../.mochamultireporterrc')
 
+// V8's top-level `--maglev`/`--no-maglev` toggle landed in V8 11 (Node 20). On
+// V8 10 (Node 18) the flag does not exist, so passing it aborts the child with
+// `bad option: --no-maglev` (exit 9) before mocha runs. Children reuse this
+// process's binary, so our own V8 major decides whether the flag is safe.
+const SUPPORTS_NO_MAGLEV = Number.parseInt(process.versions.v8, 10) >= 11
+
 /**
  * @param {string} openTag
  * @param {string} name
@@ -549,6 +555,11 @@ async function main () {
 
         const nodeArgs = []
         if (opts.exposeGc) nodeArgs.push('--expose-gc')
+        // Network-heavy specs intermittently abort with STATUS_STACK_BUFFER_OVERRUN
+        // (0xC0000409) when mocha-run-file's process.exit() races V8's Maglev teardown
+        // on Windows. Maglev can only be disabled via a CLI flag, not NODE_OPTIONS.
+        // TODO(BridgeAR): drop once https://github.com/nodejs/node/issues/62260 is fixed.
+        if (process.platform === 'win32' && SUPPORTS_NO_MAGLEV) nodeArgs.push('--no-maglev')
         nodeArgs.push(runFileScript, file)
 
         entry.started = true
diff --git a/scripts/release/changelog.js b/scripts/release/changelog.js
index eef658905f..c541ae6373 100644
--- a/scripts/release/changelog.js
+++ b/scripts/release/changelog.js
@@ -143,18 +143,31 @@ for (const [product, scopes] of PRODUCTS) {
 
 /**
  * @param {CommitEntry[]} entries
+ * @param {CommitEntry[]} [breakingEntries]
  * @returns {ReleaseChangelog}
  */
-function createReleaseChangelog (entries) {
+function createReleaseChangelog (entries, breakingEntries = []) {
   const sections = new Map()
+  const breakingChanges = []
+  const breakingPullRequests = new Set()
   const contributors = new Set()
   const warnings = []
   let isMinor = false
 
+  for (const entry of breakingEntries) {
+    const change = parseChange(entry, { dropOtherDependencies: false })
+
+    if (change.warning) warnings.push(change.warning)
+    if (entry.author) contributors.add(entry.author)
+    if (change.pr) breakingPullRequests.add(change.pr)
+    breakingChanges.push(change)
+  }
+
   for (const entry of entries) {
     const change = parseChange(entry)
 
     if (change.drop) continue
+    if (change.pr && breakingPullRequests.has(change.pr)) continue
     if (change.warning) warnings.push(change.warning)
     if (change.category === 'Features' && !change.revert) isMinor = true
     if (entry.author) contributors.add(entry.author)
@@ -168,7 +181,7 @@ function createReleaseChangelog (entries) {
   }
 
   return {
-    markdown: renderMarkdown(sections, contributors),
+    markdown: renderMarkdown(sections, contributors, breakingChanges),
     isMinor,
     warnings,
   }
@@ -176,9 +189,10 @@ function createReleaseChangelog (entries) {
 
 /**
  * @param {CommitEntry} entry
+ * @param {{ dropOtherDependencies?: boolean }} [options]
  * @returns {Change}
  */
-function parseChange (entry) {
+function parseChange (entry, options = {}) {
   const subjectWithPullRequest = parsePullRequest(entry.subject)
   const parsed = parseConventionalSubject(subjectWithPullRequest.subject)
 
@@ -194,13 +208,13 @@ function parseChange (entry) {
   }
 
   const dependency = classifyDependencyBump(parsed.scopes, parsed.subject)
-  if (dependency === 'other') {
+  if (dependency === 'other' && options.dropOtherDependencies !== false) {
     return { drop: true }
   }
 
   return {
     category: CATEGORY_BY_TYPE[parsed.type] || INTERNAL_CATEGORY,
-    product: dependency === 'production' ? DEPENDENCY_PRODUCT : selectProduct(parsed.scopes),
+    product: dependency ? DEPENDENCY_PRODUCT : selectProduct(parsed.scopes),
     subject: parsed.subject,
     pr: subjectWithPullRequest.pr,
     revert: parsed.isRevert,
@@ -321,10 +335,19 @@ function sentenceCase (subject) {
 /**
  * @param {Map<string, Change[]>} sections
  * @param {Set<string>} contributors
+ * @param {Change[]} breakingChanges
  */
-function renderMarkdown (sections, contributors) {
+function renderMarkdown (sections, contributors, breakingChanges) {
   const lines = []
 
+  if (breakingChanges.length > 0) {
+    lines.push('### Breaking Changes')
+    for (const change of breakingChanges.sort(compareChanges)) {
+      lines.push(renderChange(change))
+    }
+    lines.push('')
+  }
+
   for (const category of CATEGORY_ORDER) {
     const changes = sections.get(category)
     if (!changes?.length) continue
diff --git a/scripts/release/changelog.spec.js b/scripts/release/changelog.spec.js
index a57399a1c1..75934f7b6e 100644
--- a/scripts/release/changelog.spec.js
+++ b/scripts/release/changelog.spec.js
@@ -144,6 +144,84 @@ describe('release changelog', () => {
     ].join('\n'))
   })
 
+  it('renders breaking changes at the top of the release changelog', () => {
+    const changelog = createReleaseChangelog([
+      {
+        sha: 'abc001',
+        subject: 'fix(core): keep existing behavior stable (#9001)',
+        author: '@alice',
+      },
+    ], [
+      {
+        sha: 'abc002',
+        subject: 'feat(opentelemetry)!: remove legacy propagation mode (#9002)',
+        author: '@bob',
+      },
+      {
+        sha: 'abc003',
+        subject: 'chore(deps-dev): bump eslint from 9.0.0 to 10.0.0 (#9003)',
+      },
+    ])
+
+    assert.strictEqual(changelog.markdown, [
+      '### Breaking Changes',
+      `- **Dependencies:** Bump eslint from 9.0.0 to 10.0.0 ${prLink(9003)}`,
+      `- **OpenTelemetry:** Remove legacy propagation mode ${prLink(9002)}`,
+      '',
+      '### Fixes',
+      `- **General:** Keep existing behavior stable ${prLink(9001)}`,
+      '',
+      '### Contributors',
+      '',
+      `${avatar('alice')} ${avatar('bob')}`,
+      '',
+    ].join('\n'))
+  })
+
+  it('does not promote the release to minor for breaking-only features', () => {
+    const changelog = createReleaseChangelog([
+      {
+        sha: 'abc001',
+        subject: 'fix(core): keep existing behavior stable (#9001)',
+      },
+    ], [
+      {
+        sha: 'abc002',
+        subject: 'feat(opentelemetry)!: remove legacy propagation mode (#9002)',
+      },
+    ])
+
+    assert.strictEqual(changelog.isMinor, false)
+  })
+
+  it('drops regular release note entries already listed as breaking changes', () => {
+    const changelog = createReleaseChangelog([
+      {
+        sha: 'abc001',
+        subject: 'feat(opentelemetry)!: remove legacy propagation mode (#9002)',
+      },
+      {
+        sha: 'abc002',
+        subject: 'fix(core): keep existing behavior stable (#9001)',
+      },
+    ], [
+      {
+        sha: 'abc003',
+        subject: 'feat(opentelemetry)!: remove legacy propagation mode (#9002)',
+      },
+    ])
+
+    assert.strictEqual(changelog.markdown, [
+      '### Breaking Changes',
+      `- **OpenTelemetry:** Remove legacy propagation mode ${prLink(9002)}`,
+      '',
+      '### Fixes',
+      `- **General:** Keep existing behavior stable ${prLink(9001)}`,
+      '',
+    ].join('\n'))
+    assert.strictEqual(changelog.isMinor, false)
+  })
+
   it('handles breaking markers and subjects without pull request numbers', () => {
     const changelog = createReleaseChangelog([
       {
diff --git a/scripts/release/proposal.js b/scripts/release/proposal.js
index f36e8c167b..6cef054ca9 100644
--- a/scripts/release/proposal.js
+++ b/scripts/release/proposal.js
@@ -23,6 +23,8 @@ const { checkAll } = require('./helpers/requirements')
 const tmpdir = process.env.RUNNER_TEMP || os.tmpdir()
 const main = 'master'
 const releaseLine = params[0]
+const breakingLabels = ['semver-major', 'only-land-on-next']
+const pullRequestNumberPattern = /\(#([0-9]+)\)$/
 
 // Validate release line argument.
 if (!releaseLine || releaseLine === 'help' || flags.help) {
@@ -71,11 +73,11 @@ try {
   const stableVersion = `${DD_MAJOR}.${DD_MINOR}.${DD_PATCH}`
   const isPreRelease = VERSION !== stableVersion
 
-  // Notes exclude semver-major (gated behind a flag, not user-visible).
+  // Notes list semver-major and only-land-on-next separately as breaking changes.
   // Cherry-pick includes semver-major; only only-land-on-next is fully excluded,
   // except when promoting a pre-release to stable (that's what "next" means).
   const notesDiffCmd = 'branch-diff --user DataDog --repo dd-trace-js' +
-    (isPreRelease ? '' : ' --exclude-label=semver-major --exclude-label=only-land-on-next')
+    ' --exclude-label=semver-major --exclude-label=only-land-on-next'
   const cherryPickDiffCmd = 'branch-diff --user DataDog --repo dd-trace-js' +
     (isPreRelease ? '' : ' --exclude-label=only-land-on-next')
 
@@ -94,17 +96,22 @@ try {
   // runs. It equals allMainShas[min(length, MAX_CHERRY_PICKS) - 1] regardless of
   // how many commits are already on the branch (proven by:
   // existingCherryPicked + shasToApply.length = min(allMainShas.length, MAX_CHERRY_PICKS)).
-  const upperBoundSha = allMainShas.at(Math.min(allMainShas.length, MAX_CHERRY_PICKS) - 1)
+  const upperBoundSha = allMainShas.at(Math.min(allMainShas.length, MAX_CHERRY_PICKS) - 1) ||
+    (isPreRelease ? capture(`git rev-parse v${releaseLine}.x`) : undefined)
 
   if (!upperBoundSha) {
     pass('none (already up to date)')
     process.exit(0)
   }
 
+  // Expand to full SHA to avoid minimist scientific notation coercion in branch-diff.
+  // Abbreviated SHAs like "980e663509" match JS float syntax and become Infinity.
+  const upperBoundRef = capture(`git rev-parse ${upperBoundSha}`)
+
   // notesShas is scoped to upperBoundSha so isMinor and release notes only reflect
   // the capped commits actually included in the proposal, not deferred ones.
-  // Excludes semver-major (gated behind a flag, not user-visible).
-  const notesShas = capture(`${notesDiffCmd} --format=sha --reverse v${releaseLine}.x ${upperBoundSha}`)
+  // Excludes changes that are listed in the dedicated breaking changes section.
+  const notesShas = capture(`${notesDiffCmd} --format=sha --reverse v${releaseLine}.x ${upperBoundRef}`)
     .split('\n').filter(Boolean)
   const contributorBySha = getContributorsBySha(`v${releaseLine}.x`, upperBoundSha)
   const notesEntries = []
@@ -115,7 +122,10 @@ try {
       author: contributorBySha.get(sha),
     })
   }
-  const notes = createReleaseChangelog(notesEntries)
+  const breakingEntries = isPreRelease
+    ? getBreakingPullRequestEntries(releaseLine, upperBoundRef)
+    : []
+  const notes = createReleaseChangelog(notesEntries, breakingEntries)
   const isMinor = notes.isMinor
   const newPatch = `${releaseLine}.${DD_MINOR}.${DD_PATCH + 1}`
   const newMinor = `${releaseLine}.${DD_MINOR + 1}.0`
@@ -155,7 +165,7 @@ try {
 
   if (shasToApply.length > 0) {
     // Show only commits being applied; upperBoundSha is the last main SHA that fits.
-    const newChanges = capture(`${cherryPickDiffCmd} v${newVersion}-proposal ${upperBoundSha}`)
+    const newChanges = capture(`${cherryPickDiffCmd} v${newVersion}-proposal ${upperBoundRef}`)
     const truncationNote = truncated
       ? `\n\n⚠️  Applying ${shasToApply.length} of ${proposalShas.length} available commits` +
         ` (GitHub limit: ${MAX_CHERRY_PICKS}). Remaining commits require a separate release.`
@@ -325,3 +335,66 @@ function getContributorsBySha (base, head) {
 
   return contributors
 }
+
+/**
+ * Semver-major changes are commonly guarded by version checks and backported to
+ * stable branches. Branch comparisons can miss them because the commits exist
+ * on both the previous and next release lines, so the vN.0.0 promotion lists
+ * merged PRs by label across the previous major cycle instead.
+ *
+ * @param {string} releaseLine
+ * @param {string} upperBoundRef
+ */
+function getBreakingPullRequestEntries (releaseLine, upperBoundRef) {
+  const previousReleaseLine = Number.parseInt(releaseLine, 10) - 1
+  const previousMajorTag = `v${previousReleaseLine}.0.0`
+  const mergedAfter = capture(`git log -1 --format=%cs ${previousMajorTag}`)
+  const mergedBefore = capture(`git show -s --format=%cs ${upperBoundRef}`)
+  const pullRequestsByNumber = new Map()
+  const includedPullRequests = getIncludedPullRequests(previousMajorTag, [`v${releaseLine}.x`, upperBoundRef])
+
+  for (const label of breakingLabels) {
+    const pullRequests = JSON.parse(capture(
+      'gh pr list --repo DataDog/dd-trace-js --state merged --limit 1000' +
+      ` --label=${label}` +
+      ` --search "base:${main} merged:>=${mergedAfter} merged:<=${mergedBefore}"` +
+      ' --json number,title,mergeCommit,author'
+    ))
+
+    for (const pullRequest of pullRequests) {
+      if (!includedPullRequests.has(pullRequest.number)) continue
+
+      pullRequestsByNumber.set(pullRequest.number, pullRequest)
+    }
+  }
+
+  return [...pullRequestsByNumber.values()].map(pullRequest => {
+    return {
+      sha: pullRequest.mergeCommit?.oid || `pull-request-${pullRequest.number}`,
+      subject: `${pullRequest.title} (#${pullRequest.number})`,
+      author: pullRequest.author?.login ? `@${pullRequest.author.login}` : undefined,
+    }
+  })
+}
+
+/**
+ * Release proposal branches are built with cherry-picks, so PR merge commits
+ * often are not ancestors of the release branch even when their changes are
+ * present. Match by the PR number preserved in the commit subject instead.
+ *
+ * @param {string} base
+ * @param {string[]} refs
+ */
+function getIncludedPullRequests (base, refs) {
+  const pullRequests = new Set()
+
+  for (const ref of refs) {
+    const subjects = capture(`git log --format=%s ${base}..${ref}`).split('\n')
+    for (const subject of subjects) {
+      const match = subject.match(pullRequestNumberPattern)
+      if (match) pullRequests.add(Number.parseInt(match[1], 10))
+    }
+  }
+
+  return pullRequests
+}
diff --git a/scripts/verify-exercised-tests.js b/scripts/verify-exercised-tests.js
index 720ac8218e..c5e3a20d85 100644
--- a/scripts/verify-exercised-tests.js
+++ b/scripts/verify-exercised-tests.js
@@ -347,10 +347,10 @@ function parseExportAssignments (run) {
 function findTestFiles (repoRoot) {
   const commonGlobOpts = { cwd: repoRoot, nodir: true, windowsPathsNoEscape: true, ignore: DEFAULT_IGNORE_GLOBS }
 
-  const files = [
-    ...globSyncCached('**/*.spec.js', commonGlobOpts),
-    ...globSyncCached('**/*.test.mjs', commonGlobOpts),
-  ]
+  // Collect every test-file naming convention used in the repo so an unrun spec
+  // can never slip through untracked. Kept deliberately wide (js/mjs/cjs) even
+  // where no file currently uses an extension, so a future one is caught.
+  const files = globSyncCached('**/*.@(spec|test).@(js|mjs|cjs)', commonGlobOpts)
 
   files.sort((a, b) => a.localeCompare(b, 'en'))
   return files
@@ -883,7 +883,7 @@ function getTraceCoreCategoriesFromScripts (scripts) {
  * @returns {Set<string>}
  */
 function findDdTraceTestCategories (repoRoot) {
-  const files = globSyncCached('packages/dd-trace/test/*/**/*.spec.js', {
+  const files = globSyncCached('packages/dd-trace/test/*/**/*.@(spec|test).@(js|mjs|cjs)', {
     cwd: repoRoot,
     nodir: true,
     windowsPathsNoEscape: true,
@@ -912,7 +912,7 @@ function findDdTraceTestCategories (repoRoot) {
  * @returns {string[]}
  */
 function listDdTraceCategorySpecFiles (repoRoot, category) {
-  const files = globSyncCached(`packages/dd-trace/test/${category}/**/*.spec.js`, {
+  const files = globSyncCached(`packages/dd-trace/test/${category}/**/*.@(spec|test).@(js|mjs|cjs)`, {
     cwd: repoRoot,
     nodir: true,
     windowsPathsNoEscape: true,
@@ -953,7 +953,7 @@ function isCategoryCoveredByOtherScript (scriptPrefixes, category) {
  * @returns {Set<string>}
  */
 function buildAppsecPluginTestSet (repoRoot) {
-  const files = globSyncCached('packages/dd-trace/test/appsec/**/*.plugin.spec.js', {
+  const files = globSyncCached('packages/dd-trace/test/appsec/**/*.plugin.@(spec|test).@(js|mjs|cjs)', {
     cwd: repoRoot,
     nodir: true,
     windowsPathsNoEscape: true,
@@ -965,7 +965,7 @@ function buildAppsecPluginTestSet (repoRoot) {
   for (const f of files) {
     const base = path.basename(f)
     // e.g. graphql.apollo-server-express.plugin.spec.js -> apollo-server-express
-    const m = base.match(/\.([^.]+)\.plugin\.spec\.js$/)
+    const m = base.match(/\.([^.]+)\.plugin\.(?:spec|test)\.[mc]?js$/)
     if (m && m[1]) out.add(m[1])
   }
   return out
@@ -976,7 +976,7 @@ function buildAppsecPluginTestSet (repoRoot) {
  * @returns {Set<string>}
  */
 function buildLlmobsPluginTestSet (repoRoot) {
-  const files = globSyncCached('packages/dd-trace/test/llmobs/plugins/*/*.spec.js', {
+  const files = globSyncCached('packages/dd-trace/test/llmobs/plugins/*/*.@(spec|test).@(js|mjs|cjs)', {
     cwd: repoRoot,
     nodir: true,
     windowsPathsNoEscape: true,
diff --git a/vendor/package-lock.json b/vendor/package-lock.json
index 1f89fa32fd..085b8bc688 100644
--- a/vendor/package-lock.json
+++ b/vendor/package-lock.json
@@ -26,11 +26,11 @@
         "module-details-from-path": "^1.0.4",
         "mutexify": "^1.4.0",
         "pprof-format": "^2.2.2",
-        "protobufjs": "^8.6.4",
+        "protobufjs": "^8.6.5",
         "retry": "^0.13.1",
         "rfdc": "^1.4.1",
         "semifies": "^1.0.0",
-        "shell-quote": "^1.8.4",
+        "shell-quote": "^1.9.0",
         "source-map": "^0.7.4",
         "tlhunter-sorted-set": "^0.1.0",
         "ttl-set": "^1.0.0"
@@ -672,9 +672,9 @@
       "license": "MIT"
     },
     "node_modules/protobufjs": {
-      "version": "8.6.4",
-      "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-8.6.4.tgz",
-      "integrity": "sha512-/+XMv9JalknuncEJSwsyEVlwcxVLKx2iaoSUXFZA86MJkdqyOdfrlB1sB7S6aKyUk9tl20YY+SgQe5J2sJHTcg==",
+      "version": "8.6.5",
+      "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-8.6.5.tgz",
+      "integrity": "sha512-zeE5LPpencAGXvsxyOYmEgJhxzHY8IsmPAFzstZVhDSVT8QH03q6gMZwZRaQGApevZbAL6u28ugs4CC+YKB2jQ==",
       "license": "BSD-3-Clause",
       "dependencies": {
         "long": "^5.3.2"
@@ -711,9 +711,9 @@
       "license": "Apache-2.0"
     },
     "node_modules/shell-quote": {
-      "version": "1.8.4",
-      "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.4.tgz",
-      "integrity": "sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==",
+      "version": "1.9.0",
+      "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.9.0.tgz",
+      "integrity": "sha512-Iov+JwFv/2HcTpcwNMKd8+IWNb8tboQJNQTkAY/LLVK7gGH9jy+LGkVqPxfekHl+yMmiqXszdGWXgkfml7hjqA==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
diff --git a/vendor/package.json b/vendor/package.json
index 276749f582..2dc734b2cd 100644
--- a/vendor/package.json
+++ b/vendor/package.json
@@ -23,11 +23,11 @@
     "module-details-from-path": "^1.0.4",
     "mutexify": "^1.4.0",
     "pprof-format": "^2.2.2",
-    "protobufjs": "^8.6.4",
+    "protobufjs": "^8.6.5",
     "retry": "^0.13.1",
     "rfdc": "^1.4.1",
     "semifies": "^1.0.0",
-    "shell-quote": "^1.8.4",
+    "shell-quote": "^1.9.0",
     "source-map": "^0.7.4",
     "tlhunter-sorted-set": "^0.1.0",
     "ttl-set": "^1.0.0"
diff --git a/yarn.lock b/yarn.lock
index 1c04c7f2bc..5eea56ddd6 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1260,10 +1260,10 @@ available-typed-arrays@^1.0.7:
   dependencies:
     possible-typed-array-names "^1.0.0"
 
-axios@^1.18.0:
-  version "1.18.0"
-  resolved "https://registry.yarnpkg.com/axios/-/axios-1.18.0.tgz#8a7f8854af280fcaae063272df2ed9f3837d2398"
-  integrity sha512-E32NzpYKp++W7XRe52rHiXV2ehxmh3wbdgO7MHeFM+vqxLBYHzt0ElkiImtOBxtOmyp0yoC8C6uESVV84Y2/hw==
+axios@^1.18.1:
+  version "1.18.1"
+  resolved "https://registry.yarnpkg.com/axios/-/axios-1.18.1.tgz#d63f9863bcd8938815c86f9e2abd380189d96dfe"
+  integrity sha512-3nTvFlvpn9Zu/RkHUqtc7/+al4UpRW5az71ap5zccp6e8RAYEzhMTecX8Dz1wWDYrPpUoB1HAQEGEAEvUr7S9g==
   dependencies:
     follow-redirects "^1.16.0"
     form-data "^4.0.5"
@@ -1998,10 +1998,10 @@ eslint-plugin-import@^2.32.0:
     string.prototype.trimend "^1.0.9"
     tsconfig-paths "^3.15.0"
 
-eslint-plugin-jsdoc@^63.0.6:
-  version "63.0.6"
-  resolved "https://registry.yarnpkg.com/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-63.0.6.tgz#ae504659abf5e01fd1afb1051adb8e4309cd899a"
-  integrity sha512-qXMUdwQf+igjSLe/DZqyY1baVR0+snEJ3l/+2odJjeoAG43PrcpA0tSaLw2dC1iHvfKzo1YnZLGvgxrvAViyfQ==
+eslint-plugin-jsdoc@^63.0.8:
+  version "63.0.8"
+  resolved "https://registry.yarnpkg.com/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-63.0.8.tgz#d8838d0b23983e11030d7acc54d5e338db921f72"
+  integrity sha512-0rLBDD03N6aL+axOtkSSaUoqhHOPKe+I1gS6dLEwm9zjqAd1e78Z7cilTnkNRQ8wOiEvzR6mvl6IDu7jiTR8UA==
   dependencies:
     "@es-joy/jsdoccomment" "~0.87.0"
     "@es-joy/resolve.exports" "1.2.0"
@@ -2026,10 +2026,10 @@ eslint-plugin-mocha@^11.3.0:
     "@eslint-community/eslint-utils" "^4.4.1"
     globals "^15.14.0"
 
-eslint-plugin-n@^18.1.0:
-  version "18.1.0"
-  resolved "https://registry.yarnpkg.com/eslint-plugin-n/-/eslint-plugin-n-18.1.0.tgz#c1eadf2bc59704bf0078eca8d59743a7386b1081"
-  integrity sha512-hkUm9EtnFV2h2fE16jNVUfCVUqvPzI7fGLsFdun5lFt/pbmf2kCgDx6ymi9rx+NCUSggBmurJCZOfG20JBs/kg==
+eslint-plugin-n@^18.2.0:
+  version "18.2.0"
+  resolved "https://registry.yarnpkg.com/eslint-plugin-n/-/eslint-plugin-n-18.2.0.tgz#264530a08db399a2dc9b3d94d82a5181bb9c28ef"
+  integrity sha512-Hf7bfQ5qBC1U/E5jLM9s3pE5su4HHnPmPxVsYzHgS3X0Eg7/9cK7lf+JBx29YEyZ09DqJ34bS/bcb4Dyv3Th9w==
   dependencies:
     "@eslint-community/eslint-utils" "^4.5.0"
     enhanced-resolve "^5.17.1"
@@ -2511,10 +2511,10 @@ globals@^15.11.0, globals@^15.14.0:
   resolved "https://registry.yarnpkg.com/globals/-/globals-15.15.0.tgz#7c4761299d41c32b075715a4ce1ede7897ff72a8"
   integrity sha512-7ACyT3wmyp3I61S4fG682L0VA2RGD9otkqGJIwNUMF1SWUombIIk+af1unuDYgMm082aHYwD+mzJvv9Iu8dsgg==
 
-globals@^17.2.0, globals@^17.4.0, globals@^17.6.0:
-  version "17.6.0"
-  resolved "https://registry.yarnpkg.com/globals/-/globals-17.6.0.tgz#0f0be018d5cca8690e6375ead1f65c4bb96191fc"
-  integrity sha512-sepffkT8stwnIYbsMBpoCHJuJM5l98FUF2AnE07hfvE0m/qp3R586hw4jF4uadbhvg1ooIdzuu7CsfD2jzCaNA==
+globals@^17.4.0, globals@^17.6.0, globals@^17.7.0:
+  version "17.7.0"
+  resolved "https://registry.yarnpkg.com/globals/-/globals-17.7.0.tgz#553d55090b4dde8209ec2da42580d6e7e7d8b10d"
+  integrity sha512-Czmyns5dUsq4seFBR/Kdydhmo8y9kC79hiSkPn0YcGtNnYWnrgt0vjrSjx9tspoDGWm2CMarffRuLjM4xUz8xg==
 
 globalthis@^1.0.4:
   version "1.0.4"
@@ -2659,10 +2659,10 @@ import-fresh@^3.2.1:
     parent-module "^1.0.0"
     resolve-from "^4.0.0"
 
-import-in-the-middle@^3.1.0:
-  version "3.1.0"
-  resolved "https://registry.yarnpkg.com/import-in-the-middle/-/import-in-the-middle-3.1.0.tgz#0d0e88c93c276599bd4bf81835946d723656efab"
-  integrity sha512-c0AeAV8VcwZzfYE7euTZY3H+VXUPMVugiovdosq80lqEXJmOekg3zGUAYg6KImHMaMuBoTUfTv7xNpUFdy0hJA==
+import-in-the-middle@^3.2.0:
+  version "3.2.0"
+  resolved "https://registry.yarnpkg.com/import-in-the-middle/-/import-in-the-middle-3.2.0.tgz#ef596b83cdef975940239b2f04d874585910197a"
+  integrity sha512-vR2B6HKIhaBjcZr2bLpFiJ1VbzOlRQ7aby4/gw5WPIzToLjqpfWw3VJ4sk1uDchoOODEirvO2jyrSPtUSL5CrQ==
   dependencies:
     acorn "^8.15.0"
     acorn-import-attributes "^1.9.5"
@@ -4054,10 +4054,10 @@ semver@^6.0.0, semver@^6.3.1:
   resolved "https://registry.yarnpkg.com/semver/-/semver-6.3.1.tgz#556d2ef8689146e46dcea4bfdd095f3434dffcb4"
   integrity sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==
 
-semver@^7.5.0, semver@^7.5.3, semver@^7.5.4, semver@^7.6.3, semver@^7.7.4, semver@^7.8.2, semver@^7.8.4:
-  version "7.8.4"
-  resolved "https://registry.yarnpkg.com/semver/-/semver-7.8.4.tgz#c73eceebae0616934be8dff28a7fd70757c8e696"
-  integrity sha512-rUCObTnP32Q08R2uuIrt7r9PlEonuTmtuXYcW6s5kjdlj3xbnwe+21yXptAUYcMAABLkYYTtnmzb3w3EDZfueA==
+semver@^7.5.0, semver@^7.5.3, semver@^7.5.4, semver@^7.6.3, semver@^7.7.4, semver@^7.8.2, semver@^7.8.4, semver@^7.8.5:
+  version "7.8.5"
+  resolved "https://registry.yarnpkg.com/semver/-/semver-7.8.5.tgz#39b646037dd50c14fb451e7e4cac58ed8b863f69"
+  integrity sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==
 
 send@^1.1.0, send@^1.2.0:
   version "1.2.1"