fix(core): Defer TwP sampling by reading trace state from the scope by andreiborza · Pull Request #21549 · getsentry/sentry-javascript

andreiborza · 2026-06-15T13:21:41Z

In Tracing-without-Performance (spans disabled), a root placeholder previously froze a negative sampling decision in the DSC, which suppressed downstream sampling instead of leaving the decision to a performance-enabled service further along the trace.

The scope is the source of truth for a TwP placeholder's trace state:

getTraceData reads the sampling decision from the scope (deferred for a new trace, the upstream decision for a
continued trace), so the outgoing sentry-trace header omits the flag instead of asserting -0. The span id comes from the scope's propagationSpanId (a fresh id is generated when the scope has none).
getDynamicSamplingContextFromSpan resolves a placeholder's DSC from its captured scope (continued traces keep the incoming DSC; new traces derive it from the client).

The scope is only consulted for genuine TwP placeholders. A non-recording span in tracing mode, the child of an unsampled span, or an ignored span carries an explicit negative decision and keeps propagating -0 via spanToTraceHeader.

A new (head-of-trace) TwP trace does not stamp a local transaction in its DSC; continued traces still propagate the upstream decision and DSC.

No DSC is written to the scope at span start, preserving the browser's "scope stays DSC-free between navigations" behavior.

This is an alternative to #21406

In Tracing-without-Performance (spans disabled), a root placeholder previously froze a negative sampling decision in the DSC, which suppressed downstream sampling instead of leaving the decision to a performance-enabled service further along the trace. The scope is the source of truth for a TwP placeholder's trace state: - `getTraceData` reads the sampling decision from the scope (deferred for a new trace, the upstream decision for a continued trace) while keeping the placeholder's stable span id, so the outgoing `sentry-trace` header omits the flag instead of asserting `-0`. - `getDynamicSamplingContextFromSpan` resolves a placeholder's DSC from its captured scope (continued traces keep the incoming DSC; new traces derive it from the client). A new (head-of-trace) TwP trace does not stamp a local `transaction` in its DSC; continued traces still propagate the upstream decision and DSC. No DSC is written to the scope at span start, preserving the browser's "scope stays DSC-free between navigations" behavior.

github-actions · 2026-06-15T13:31:26Z

size-limit report 📦

Path	Size	% Change	Change
@sentry/browser	27.44 kB	+0.14%	+37 B 🔺
@sentry/browser - with treeshaking flags	25.87 kB	+0.14%	+34 B 🔺
@sentry/browser (incl. Tracing)	45.87 kB	+0.38%	+172 B 🔺
@sentry/browser (incl. Tracing + Span Streaming)	48.1 kB	+0.33%	+157 B 🔺
@sentry/browser (incl. Tracing, Profiling)	50.64 kB	+0.28%	+138 B 🔺
@sentry/browser (incl. Tracing, Replay)	85.07 kB	+0.18%	+152 B 🔺
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags	74.67 kB	+0.2%	+144 B 🔺
@sentry/browser (incl. Tracing, Replay with Canvas)	89.77 kB	+0.18%	+154 B 🔺
@sentry/browser (incl. Tracing, Replay, Feedback)	102.43 kB	+0.13%	+126 B 🔺
@sentry/browser (incl. Feedback)	44.62 kB	+0.12%	+52 B 🔺
@sentry/browser (incl. sendFeedback)	32.24 kB	+0.12%	+38 B 🔺
@sentry/browser (incl. FeedbackAsync)	37.37 kB	+0.15%	+53 B 🔺
@sentry/browser (incl. Metrics)	28.51 kB	+0.14%	+38 B 🔺
@sentry/browser (incl. Logs)	28.75 kB	+0.14%	+39 B 🔺
@sentry/browser (incl. Metrics & Logs)	29.44 kB	+0.15%	+42 B 🔺
@sentry/react	29.23 kB	+0.11%	+31 B 🔺
@sentry/react (incl. Tracing)	48.16 kB	+0.34%	+159 B 🔺
@sentry/vue	32.55 kB	+0.41%	+131 B 🔺
@sentry/vue (incl. Tracing)	47.74 kB	+0.31%	+147 B 🔺
@sentry/svelte	27.46 kB	+0.14%	+37 B 🔺
CDN Bundle	29.85 kB	+0.22%	+63 B 🔺
CDN Bundle (incl. Tracing)	48.27 kB	+0.16%	+74 B 🔺
CDN Bundle (incl. Logs, Metrics)	31.39 kB	+0.21%	+63 B 🔺
CDN Bundle (incl. Tracing, Logs, Metrics)	49.57 kB	+0.15%	+74 B 🔺
CDN Bundle (incl. Replay, Logs, Metrics)	70.7 kB	+0.11%	+74 B 🔺
CDN Bundle (incl. Tracing, Replay)	85.6 kB	+0.1%	+77 B 🔺
CDN Bundle (incl. Tracing, Replay, Logs, Metrics)	86.86 kB	+0.11%	+93 B 🔺
CDN Bundle (incl. Tracing, Replay, Feedback)	91.44 kB	+0.09%	+77 B 🔺
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics)	92.69 kB	+0.08%	+73 B 🔺
CDN Bundle - uncompressed	88.77 kB	+0.21%	+183 B 🔺
CDN Bundle (incl. Tracing) - uncompressed	146.02 kB	+0.15%	+218 B 🔺
CDN Bundle (incl. Logs, Metrics) - uncompressed	93.48 kB	+0.2%	+183 B 🔺
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed	149.99 kB	+0.15%	+218 B 🔺
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed	218.3 kB	+0.09%	+183 B 🔺
CDN Bundle (incl. Tracing, Replay) - uncompressed	264.88 kB	+0.09%	+218 B 🔺
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed	268.84 kB	+0.09%	+218 B 🔺
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed	278.58 kB	+0.08%	+218 B 🔺
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed	282.53 kB	+0.08%	+218 B 🔺
@sentry/nextjs (client)	50.57 kB	+0.24%	+120 B 🔺
@sentry/sveltekit (client)	46.26 kB	+0.3%	+138 B 🔺
@sentry/core/server	76.12 kB	+0.07%	+49 B 🔺
@sentry/core/browser	63.28 kB	+0.1%	+59 B 🔺
@sentry/node-core	61.85 kB	+0.21%	+127 B 🔺
@sentry/node	128.74 kB	+0.06%	+71 B 🔺
@sentry/node - without tracing	74.21 kB	+0.15%	+106 B 🔺
@sentry/aws-serverless	85.57 kB	+0.13%	+111 B 🔺
@sentry/cloudflare (withSentry) - minified	174.45 kB	+0.16%	+262 B 🔺
@sentry/cloudflare (withSentry)	436.34 kB	+0.22%	+932 B 🔺

View base workflow run

mydea · 2026-06-15T13:37:27Z


  if (!client || !hasSpansEnabled()) {
-    const span = new SentryNonRecordingSpan();
+    const propagationContext = {


I don't think this is actually necessary, do we ever put traceId/spanId/sampled/dsc on the isolation scope? I think this is always on the same type of scope, but not 100% sure...

Right, we only ever need the traceId from there, which isn't affected. Removed in d1d9d2d

mydea · 2026-06-15T13:38:58Z

+  // A non-recording span is a Tracing-without-Performance placeholder that carries no sampling
+  // decision of its own — the scope is the source of truth. We keep the placeholder's (stable)
+  // span id but read the sampling decision from the scope.
+  const isNonRecordingSpan = span instanceof SentryNonRecordingSpan;


this is fine but possibly brittle, if packages are badly deduped or similar. if we can find a different, non-identidy based way to check this that would possibly be more robust, but not necessarily required here IMHO

Added branding + a utility in 51b7626

mydea · 2026-06-15T13:39:45Z

+    traceData.traceparent =
+      span && !isNonRecordingSpan
+        ? spanToTraceparentHeader(span)
+        : scopeToTraceparentHeader(scope, span?.spanContext().spanId);


does this make sense? if it is non-recording the span.spanContext should not have a valid spanId, I guess...?

It does have a valid id, but I simplified this to not pass a span id. This does mean in some cases the span id might differ, e.g. when starting a manual span in TwP

Sentry.startSpan({...}), () => { Sentry.captureException(...); fetch(...) })

The span id of startSpan and the error event trace are the same, but the fetch call ends up with a new span id. This shouldn't be a problem since we aren't sending spans anyway in this mode.

Updated in 6a7c654

mydea · 2026-06-15T13:43:07Z

+  // For a non-recording placeholder (Tracing without Performance), the DSC is not carried on the
+  // span — the scope is the source of truth. Resolve it from the span's captured scope: continued
+  // traces keep the incoming DSC, new traces derive it from the client (without a local transaction).
+  if (rootSpan instanceof SentryNonRecordingSpan) {


do we need this, actually? Would we not skip even calling this if the span is a non recording span?

Yes this is needed, this is the one unifying place where we can get the DSC from. This simplifies not having to add checks for SentryNonRecordingSpans at all other callsites (e.g. in getTraceData, applySpanToEvent etc).

mydea · 2026-06-16T07:58:50Z


+// Non-enumerable brand used to detect non-recording spans via {@link spanIsNonRecordingSpan}
+// without `instanceof`, which is brittle when `@sentry/core` is duplicated across packages.
+const NON_RECORDING_SPAN_FIELD = '_sentryNonRecordingSpan';


just an idea, but we could use aSymbol.for() here, then we'd not need to handle the minification thing.

Updated in 14cf773

JPeer264

Actually pretty smart to put that into the DSC into the scope for TwP.

Not approving just yet because of my comment and the Symbol comment of Francesco.

JPeer264 · 2026-06-16T08:35:45Z

+// Tracing is enabled (not TwP), but the route is a raw, non-parametrized URL so the
+// http.server span source is `url`. The span name must therefore be omitted from the
+// DSC (raw URLs may contain PII), even though a real transaction is recorded.
+export default Sentry.withSentry(


q: Was this issue specifically related to Cloudflare? Just wondering why there is specifically a CF test for it

It's not CF specific but it tests a core behavior of getDynamicSamplingContextFromSpan that we didn't test before.

I wanted to make sure that a in a non TwP case the transaction is also scrubbed when the source is url.

JPeer264 · 2026-06-16T08:36:22Z

+// Tracing is enabled (not TwP), but the route is a raw, non-parametrized URL so the
+// http.server span source is `url`. The span name must therefore be omitted from the
+// DSC (raw URLs may contain PII), even though a real transaction is recorded.
+export default Sentry.withSentry(


m: This test is also passing on the latest develop, so I'm not sure if this should have reproduced anything specific or if it should just check if the old behavior is the same.

mydea · 2026-06-16T12:00:43Z

-    const span = new SentryNonRecordingSpan();
+    // The placeholder is a thin marker; it carries no sampling decision or DSC. Both are read from
+    // the scope: the sampling decision in `getTraceData`, the DSC in `getDynamicSamplingContextFromSpan`.
+    const span = new SentryNonRecordingSpan({ traceId: scope.getPropagationContext().traceId });


l: do we need the traceId here?

For pure TwP non-recording spans not really, but for non recording spans that are not sampled we need it. I'd argue it's easier to keep it in both cases instead of having to micro manage it whenever we are using one or the other, wdyt?

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit b65741e. Configure here.}

cursor · 2026-06-16T14:35:08Z

+    const capturedScope = getCapturedScopesOnSpan(rootSpan).scope;
+    if (capturedScope) {
+      return applyLocalSampleRateToDsc(getDynamicSamplingContextFromScope(client, capturedScope));
+    }


Scope DSC without TwP guard

Medium Severity

getDynamicSamplingContextFromSpan resolves baggage from the captured scope for every non-recording span that has one, but getTraceData only defers to the scope for TwP (!hasSpansEnabled()). The onlyIfParent placeholder always captures scopes, so with tracing enabled sentry-trace still encodes -0 via spanToTraceHeader while baggage can reflect the scope (e.g. upstream sentry-sampled=true), breaking header agreement.

Additional Locations (1)

packages/core/src/tracing/trace.ts#L331-L336

^{Reviewed by Cursor Bugbot for commit b65741e. Configure here.}

logaretm

Just a few questions, trying to learn more about this whole thing 😅

logaretm · 2026-06-16T16:36:03Z

+  // For a non-recording placeholder (Tracing without Performance), the DSC is not carried on the
+  // span; the scope is the source of truth. Resolve it from the span's captured scope: continued
+  // traces keep the incoming DSC, new traces derive it from the client (without a local transaction).
+  if (spanIsNonRecordingSpan(rootSpan)) {


q: Should this also have a hasSpansEnabled() check?

logaretm · 2026-06-16T16:39:34Z

+  if (spanIsNonRecordingSpan(rootSpan)) {
+    const capturedScope = getCapturedScopesOnSpan(rootSpan).scope;
+    if (capturedScope) {
+      return applyLocalSampleRateToDsc(getDynamicSamplingContextFromScope(client, capturedScope));


q: Not sure about this one, could this mutate the dsc value and do we want that?

logaretm · 2026-06-16T16:43:27Z

  }

-  const sentryTrace = span ? spanToTraceHeader(span) : scopeToTraceHeader(scope);
+  const sentryTrace = span && !isTwpPlaceholder ? spanToTraceHeader(span) : scopeToTraceHeader(scope);


q: For head of trace TwP wouldn't have a propagationSpanId, so wouldn't this create a new trace id every time? is that intended.

mydea reviewed Jun 15, 2026

View reviewed changes

Remove unneccessary propagationcontext spread

d1d9d2d

cursor Bot reviewed Jun 15, 2026

View reviewed changes

Comment thread packages/core/src/utils/traceData.ts Outdated

Use propagationSpanId

6a7c654

cursor Bot reviewed Jun 15, 2026

View reviewed changes

Comment thread packages/core/src/utils/traceData.ts Outdated

andreiborza added 2 commits June 15, 2026 19:59

Add spanIsNonRecordingSpan utility

51b7626

Keep explicit unsampled decision for non-recording spans in tracing mode

e550e1f

andreiborza marked this pull request as ready for review June 15, 2026 19:27

andreiborza requested a review from a team as a code owner June 15, 2026 19:27

andreiborza requested review from JPeer264, logaretm and mydea and removed request for a team June 15, 2026 19:27

andreiborza mentioned this pull request Jun 15, 2026

fix(core): Allow non-recording spans to carry explicit sampling decisions #21406

Closed

mydea reviewed Jun 16, 2026

View reviewed changes

JPeer264 reviewed Jun 16, 2026

View reviewed changes

mydea reviewed Jun 16, 2026

View reviewed changes

Replace branding with Symbol.for

14cf773

sentry Bot reviewed Jun 16, 2026

View reviewed changes

Comment thread packages/core/src/tracing/trace.ts

Ensure onlyIfParent spans have correct traceId in TwP

8b31869

cursor Bot reviewed Jun 16, 2026

View reviewed changes

Comment thread packages/core/src/tracing/trace.ts

andreiborza requested a review from JPeer264 June 16, 2026 14:22

Preserve continued trace DSC for onlyIfParent placeholders

b65741e

cursor Bot reviewed Jun 16, 2026

View reviewed changes

JPeer264 approved these changes Jun 16, 2026

View reviewed changes

logaretm reviewed Jun 16, 2026

View reviewed changes

Uh oh!

Conversation

andreiborza commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

size-limit report 📦

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

andreiborza Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

JPeer264 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Jun 16, 2026

Choose a reason for hiding this comment

Scope DSC without TwP guard

Uh oh!

logaretm left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

andreiborza commented Jun 15, 2026 •

edited

Loading

github-actions Bot commented Jun 15, 2026 •

edited

Loading

andreiborza Jun 15, 2026 •

edited

Loading