Replaces the shimmer-based graphql instrumentation in
packages/datadog-instrumentations/src/graphql.js with orchestrion AST
rewriting for the top-level execute / parse / validate entry points
(both CJS and ESM in graphql >= 0.10 and @graphql-tools/executor).

Plugin architecture changes:
  - packages/datadog-plugin-graphql/src/execute.js: takes over resolver
    wrapping that used to live in instrumentations; uses a single
    rootCtx per execute() call to coordinate execute-span creation and
    per-resolver bookkeeping. Resolve spans are recorded inline at
    first-encounter and finished from the resolver callback so encoder
    state stays hot across span finalization.
  - packages/datadog-plugin-graphql/src/resolve.js: deleted. The
    resolve-plugin sub-class was needed only because the old shimmer
    architecture published per-field events through a separate
    plugin; the orchestrion-based design folds that work into the
    execute plugin and uses a module-level _depthDisabled flag to
    short-circuit when tracer.use('graphql', { depth: 0 }).
  - packages/datadog-plugin-graphql/src/parse.js,validate.js: hooked
    via orchestrion publishes; documentSources mapping moved onto the
    parse plugin so the execute plugin can read raw query source for
    graphql.source tags + IAST taint tracking.

Correctness fixes wired up alongside the migration:
  - IAST taint tracking: orchestrion's bindStart now fires the same
    apm:graphql:resolve:start payload the old shimmer wrapper produced,
    using the actual args object graphql constructs internally rather
    than an AST-rebuilt copy. Restores taint propagation for hardcoded
    literal resolver arguments (e.g. books(title: "ls")) which the
    initial orchestrion port broke.
  - AppSec resolver blocking: passes the abort controller directly to
    the channel payload so AppSec subscribers can abort the resolver
    synchronously. packages/dd-trace/src/appsec/graphql.js updated to
    read req via getActiveRequest() (the storage('legacy') call only
    worked under the old shimmer setup).
  - Channel payload shape change in packages/dd-trace/src/appsec/
    channels.js to match the new bindStart contract.

Performance work folded in (per-execute and per-resolver):
  - Lazy-build info object and resolver args; only construct when the
    plugin actually needs them.
  - Eliminate per-field channel publishing — the per-execute rootCtx
    holds field records and we publish nothing per resolver in the
    APM-only path.
  - Collapse redundant path walks in the resolve bindStart so
    pathToArray runs once per resolver call.
  - Consolidate per-field stash + finish handler into one shared
    object; avoids reallocating ctx objects per resolver.
  - Short-circuit re-entrant execute() on the same contextValue
    (covers yoga's normalizedExecutor pattern that would otherwise
    double-span).
  - Hot fast-path when depth=0: cache the disabled state on a
    module-level flag in configure() so resolveAsync bails on a single
    property read, matching master's startResolveCh.hasSubscribers
    cost.
  - Port of #8309's signature-pipeline optimization onto the migrated
    execute plugin.

All 231 plugin-graphql tests pass.

Local sirun on plugin-graphql-long (100q × 5 iters per Node version)
shows per-process user-CPU vs master:
  with-depth-on-max:                   -340 ms  (-31%)
  with-depth-and-collapse-off:           tied
  with-tracer-graphql-disabled:         -50 ms  (-7%)
  with-depth-off:                       +130 ms (+21%)

The depth=0 regression is the only configuration where PR is slower
than master. It traces to orchestrion's publish format carrying raw
function args (master's shimmer wrapper pre-computed
{operation, args, docSource} before publishing). For variants with any
per-resolver work, PR's structural wins overtake this cost many times
over.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

…s objects

setWrappedFieldResolver was unconditionally writing fieldResolver onto
rawArgs[0], which throws TypeError when the caller passes a frozen args
object and silently double-wraps caller-supplied resolvers on reuse.

- Skip mutation entirely when Object.isExtensible returns false
- Skip when caller already has own fieldResolver property
- Same contract for positional-call path (rawArgs[6])

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

…imitives

The previous `normalizeContextValue` helper mutated the caller's execute args
to force `contextValue` to be an object (so it could key the contexts WeakMap),
substituting `{}` for any falsy/primitive value. Two regressions ride on that:

  - resolvers received a synthetic `{}` instead of what the caller passed, so
    user code observed a different contextValue with the tracer enabled than
    without — `forwards undefined to resolvers (positional form)` and its
    seven sibling tests (false/0/string/null/42/'request-1'/Symbol) caught
    this on master in #8502;
  - truthy primitives (`42`, `'request-1'`, `Symbol()`) bypassed the
    substitution and crashed at `contexts.set(contextValue, ctx)` with
    `TypeError: Invalid value used as weak map key`, killing the test runner
    process partway through the suite.

Drop the mutation. Use the caller's contextValue verbatim. Guard the WeakMap
write with `isWeakMapKey`; for non-keyable values, store rootCtx in a module-
level AsyncLocalStorage so `resolveAsync` can still find it via
`primitiveContextAls.getStore()` when the WeakMap lookup misses.

Also pre-compute `baseTypeName` (List/NonNull-unwrapped type name) at field-
record creation instead of reading `returnType?.name` at span-tag time —
master #8502's fix for the field-type-tag bug, ported here so resolver spans
for wrapped types report the underlying name instead of `undefined`.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

…e-wrap guard

@BridgeAR's nits on packages/datadog-instrumentations/src/graphql.js:

  - Replace the hand-rolled `patchExecuteExport` (writable-vs-getter
    branch via try/catch + Object.defineProperty) with `shimmer.wrap`.
    shimmer handles both shapes via Object.getOwnPropertyDescriptor and
    the descriptor.writable/.configurable/.enumerable branches in
    packages/datadog-shimmer/src/shimmer.js (~L130-200).
  - Replace the `wrapped.__dd_wrapped = true` boolean property with a
    module-level `WeakSet` tracking already-wrapped function instances.
    The set is checked at the top of `wrapExecute`; idempotent across
    repeated module-load hook fires without polluting the function with
    a tracer-specific property.
  - Drop the conditional object-form narrowing of arguments[0]. The
    receiver (AppSec subscriber) is responsible for deciding what to do
    with the value it sees — passing through whatever the caller
    actually invoked execute() with is cleaner and matches the master
    pattern.
  - Trim the wall-of-text comments. Kept only the one paragraph
    explaining *why* the wrap exists outside the orchestrion try-block
    (dc-polyfill catches subscriber throws), since that's the
    non-obvious bit.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

…ddress review nits

Targets the per-resolver overhead that's been driving the +7-15%
instructions delta vs master on with-depth-on-max across Node 20/24/26.

execute.js — resolveAsync
  - Combined fast-path at the top: when depth=0 AND neither IAST nor
    AppSec has a subscriber, skip everything (rootCtx lookup, path walk,
    publishes, span machinery). This is the common production case.
  - pathString is computed exactly ONCE per resolver call, collapse-
    aware (`buildCollapsedPathStringFromNode` when collapse, else
    `buildPathStringFromNode`). The IAST publish and the field record
    share the same computed value — previously the field-record path
    recomputed it inside the `isFirst` branch and the collapse branch
    recomputed `collapsedKey` separately.
  - Same for `collapsedKey`: assigned once, reused for `mapKey` and the
    field record.
  - depth gate is now a single combined check
    `if (depthDisabled || !shouldInstrumentNode(...))` after publishes,
    not two separate checks.

execute.js — other
  - Drop the duplicate local `getSignature` — it already lives in
    `./utils.js` and exports cleanly. Import from there.
  - `getBaseTypeName` rename `t` → `cursor`, add a defensive null guard
    on the loop condition (`while (cursor && cursor.ofType)`).
  - `getParentField` inner shadow: rename the looked-up `field` to
    `innerField` so it doesn't shadow the function parameter.
  - `setWrappedFieldResolver` now returns the (possibly cloned) args
    view directly; `bindStart` assigns `ctx.ddArgs = setWrappedFieldResolver(...)`
    in one step instead of the previous `setWrappedFieldResolver(...);
    ctx.ddArgs = readArgs(ctx.arguments)` pair. Saves one function call +
    one property lookup per execute.

parse.js
  - Hoist the `if (document)` outer so the documentSources logic is one
    branch: read the cached source for an already-known document, or
    cache the new (document, source) mapping when both are present.

index.js
  - Add a one-line comment explaining why `resolve` has no noop fallback
    — it runs per-field (hot path), and `finishResolveSpan` gates with
    `if (this.config.hooks.resolve)` so absent-hook callers skip both
    the call and the per-field payload-object allocation.

benchmark/sirun/plugin-graphql-long/meta.json
  - Bump `with-depth-on-max` QUERIES 1100 → 1500 per @BridgeAR's note
    that the operations are faster now; gives the startup-guard ratio
    more margin and the bench more samples per partition.

.agents/skills/apm-integrations/references/orchestrion.md
  - New section "Propagating Synchronous Errors From bindStart" — captures
    the Proxy-on-arguments pattern we used for the
    `apm:graphql:execute:start` WAF abort contract. The wrapped fn's
    destructure triggers the Proxy trap, the orchestrion wrapper's
    catch+rethrow propagates the AbortError synchronously to the caller.
    Documents the constraint (subscriber/transform throws are swallowed
    by Node's diagnostics_channel), the contract, and the
    `error()`/`end()` shape that keeps `opSpan.error === 0` on the abort
    path.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

Addresses BridgeAR's review on the orchestrion execute plugin:

- Primitive/non-keyable contextValue no longer uses
  `primitiveContextAls.enterWith()` — that sets the ALS store on the
  caller's async frame and can leak past execute. Carry rootCtx on the
  orchestrion-scoped store (`ctx.currentStore.graphqlRootCtx`) that
  `runStores` already enters for execute instead; resolvers read it via
  `legacyStorage.getStore()` and it unwinds with the frame. Drops the
  AsyncLocalStorage import entirely.

- Restore the per-node pathString cache (`rootCtx.pathCache`) that master
  had. The branch was re-walking the whole path linked-list on every
  resolver call (O(depth) per call); the cache builds each pathString
  incrementally off the parent's cached value (O(1) amortized).
  Microbench (deeply nested resolvers): ~3.9x at depth 30, ~6.7x at
  depth 60, ~parity shallow. Reproducible across fresh processes.

- Guard the pathString build on `infoPath` so a missing `info.path`
  doesn't throw in either the collapse or non-collapse branch
  (`pathToArray`/`shouldInstrumentNode` already tolerate undefined).

- Extract the duplicated object-form arg detection shared by `readArgs`
  and `setWrappedFieldResolver` into one `isObjectForm` helper.

Co-Authored-By: Claude Opus 4.8 <[email protected]>