[ashinpaugh]

Fixes #886.

singleflight reports shared=true to every caller of a coalesced flight, including the caller that executed it. Upstream() re-runs the handler for shared && sfWriter.disableCoalescing so that waiters don't reuse a private / Set-Cookie result, but the same branch also fired for the executing caller, which then ran next a second time into its own CustomWriter. Since CustomWriter.Header() is the client's header map, one response ended up with every upstream header twice (and sometimes a second body), and the upstream was called N+1 times.

This records whether the current caller executed the flight (set inside the DoChan callback; the channel receive orders that write before the read) and skips the re-run for it. Waiters behave as before.

Test: plugins/caddy/doubled_body_test.go runs Caddy with the cache and an upstream that adds its headers, stamps a unique X-Request-Id, sleeps 80ms and returns one JSON document. 8 concurrent identical requests per case, asserting one Content-Type, one X-Request-Id, a single JSON body and one upstream call per request, for a private response and a public one.

• With the fix: go test -race -count=1 -run TestConcurrent ./plugins/caddy passes.
• Without it (condition forced back): fails with want exactly one Content-Type, got ["application/ld+json" "application/ld+json"], the origin ran 2 times into ONE response (X-Request-Id ["exec-1" "exec-8"]), and want the origin called once per request (8), got 9.

Not included: the global disable_coalescing option is not copied into the handler config by FromApp (noted in #886), left for a separate change.

[netlify]

✅ Deploy Preview for teal-sprinkles-4c7f14 canceled.

Name	Link
🔨 Latest commit	23f54e2
🔍 Latest deploy log	https://app.netlify.com/projects/teal-sprinkles-4c7f14/deploys/6ae0d49943d32e4d64f3ef9f

[ashinpaugh]

Verification run against master (7f62bbb), mirroring this repo's CI (golangci-lint run, root go test, plugins/caddy go test) plus -race:

• TestConcurrent*: 5/5 green with the fix; with the guard reverted, TestConcurrentPrivateResponsesAreNotDoubled fails 5/5 on its assertions (two Content-Type, two upstream request ids, 9 upstream calls for 8 requests).
• Full plugins/caddy suite: 5/5 green on master and on this branch.
• go test -race ./pkg/... ./configurationtypes/...: green on both.
• golangci-lint (v2.15, go1.27): one finding, pkg/middleware/middleware_test.go:156 errcheck, identical on master and this branch.
• Already on master, unrelated to this change: under -race the full plugins/caddy suite fails on master with data races in the admin API (pkg/api Initialize/HandleRequest vs adminAPI.Provision) surfacing in TestAPIPlatformInvalidation/TestMustRevalidate; they only appear when other tests ran first in the process. TestRange, TestExpires and TestCacheableStatusCode also fail intermittently on master on timing (Age header off by a second).

Follow-up commit: the test's upstreams now run on httptest servers so the test is safe under -count.