Make native span ownership exception-safe

[lloeki]

AI-generated code disclosure: this PR was implemented with substantial AI assistance and manually reviewed and validated.

What does this PR do?

Makes raw native span ownership exception-safe across Ruby non-local exits, TypedData wrapping, batch transfer, warning and hash mutation paths, partial batches, and exporter configuration and runtime setup.

Motivation:

Ruby exceptions and non-local exits can interrupt native ownership transfer and leak or double-release spans unless every transition has an explicit cleanup path. This is the internal safety work tracked by APMSP-3829.

Change log entry

No.

Additional Notes:

• This is R1, the exception-safety change dd-trace-rb#6128. R1 and R0, the fork-safety change dd-trace-rb#6127, are independent and can be reviewed and merged in either order.
• Packaging must proceed with libdatadog-rb#65 merging and publishing v37, followed by libdatadog-rb#66 merging and publishing v38. R2, the v38 runtime uptake dd-trace-rb#6131, can then be finalized and merged.
• The libdatadog L0-L5 train consists of libdatadog#2302, libdatadog#2303, libdatadog#2305, libdatadog#2301, libdatadog#2304, and libdatadog#2300. Those changes must merge into v39 and be published by a matching future libdatadog-rb package before R3, the v39 payload API uptake dd-trace-rb#6143, can be finalized.
• R4 M1 dd-trace-rb#6130, R5 links dd-trace-rb#6129, and R6 events dd-trace-rb#6134 are parallel branches on R3, with recommended review and merge order M1, then links, then events. R7 M2 dd-trace-rb#6132 is based on R4, and R8 M3 dd-trace-rb#6133 is based on R7.
• Recommended overall merge order: independent R0/R1; libdatadog-rb v37 then v38; R2; libdatadog L0-L5 and the matching future libdatadog-rb package; R3; parallel R4-R6 in the recommended M1, links, events order; then R7 and R8.

How to test the change?

• Ran the native transport suite against libdatadog 36: 117 examples, 0 failures, covering allocation, wrapping, transfer, partial-batch, warning, hash mutation, configuration, and runtime failure paths.
• Ran the focused ruby_memcheck suite under Valgrind: 34 examples, 0 failures, with no reported leaks.
• Ran Standard and Steep successfully.

[dd-octo-sts]

Thank you for updating Change log entry section 👏

^{Visited at: 2026-07-30 12:12:06 UTC}

[datadog-prod-us1-3]

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 90.01% (-0.02%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 853a676 | Docs | Datadog PR Page | Give us feedback!}

[pr-commenter]

Benchmarks

Benchmark execution time: 2026-07-30 12:26:03

Comparing candidate commit 853a676 in PR branch lloeki/native-span-exception-safety-foundation with baseline commit 0a15637 in branch master.

📊 Benchmarking dashboard

Found 0 performance improvements and 0 performance regressions! Performance is the same for 48 metrics, 1 unstable metrics.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

• 🟩 = significantly better candidate vs. baseline
• 🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

Unstable benchmarks

These benchmarks have a confidence interval too wide to call a change; treat them as noise rather than signal.

scenario:tracing - trace.to_digest - Continue

• unstable throughput [-1478.841op/s; +1545.967op/s] or [-5.033%; +5.261%]