全仓 go test -race 扫描（93 包）→ 全绿。修复 6 类数据竞争：frpc/frps 测试的锁外读与并发 Wait；oauth/repository 4 个 Pub/Sub 监听器 goroutine 读可变包变量（局部捕获 + done 通道等待）；oauth 测试换 db.Redis 前停监听器；【真实生产 bug】tls 响应快照与异步续签 goroutine 并发写 cert 竞争（先快照再起 goroutine）；upload/cache 监听器 goroutine 内读 db.Redis（调用方捕获）。

Result: {"status":"keep","total_issues":8,"golint_canonicalheader":0,"golint_errname":0,"golint_errorlint":1,"golint_exhaustive":0,"golint_forcetypeassert":0,"golint_gosec":0,"golint_intrange":0,"golint_modernize":3,"golint_nilnil":3,"golint_perfsprint":0,"golint_prealloc":0,"golint_recvcheck":1,"golint_usestdlibvars":0,"golint_wastedassign":0,"golint_total":8,"golint_test_testifylint":0,"golint_test_thelper":0,"golint_test_usetesting":0,"golint_test_total":0,"golint_vetx_total":0,"eslint_problems":0,"eslint_errors":0,"eslint_warnings":0,"tsc_errors":0,"vitest_failed":0,"vitest_total":116,"measure_s":74}

internal/apps/openflare/tls/acme_obtain_test.go

@@ -50,10 +50,19 @@ func TestApplyCertificateReturnsApplying(t *testing.T) {
 	})
 	require.NoError(t, err)
 
+	obtainDone := make(chan struct{})
 	restore := SetObtainCertificateFuncForTest(func(ctx context.Context, cert *model.TLSCertificate) error {
+		defer close(obtainDone)
 		return updateCertError(ctx, cert, "dns challenge failed")
 	})
-	defer restore()
+	defer func() {
+		select {
+		case <-obtainDone:
+		case <-time.After(2 * time.Second):
+			t.Fatal("async certificate obtain did not finish")
+		}
+		restore()
+	}()
 
 	cert, err := ApplyCertificate(ctx, ApplyInput{
 		Name:          "Test ACME Cert",

internal/apps/openflare/tls/logics.go

@@ -197,12 +197,17 @@ func ApplyCertificate(ctx context.Context, input ApplyInput) (*model.TLSCertific
 		return nil, err
 	}
 
+	// 先取响应快照再启动异步续签：sanitize 会整体拷贝 cert，若与异步 goroutine
+	// 的字段写入并发会构成数据竞争（生产真实问题）。
+	returned := sanitizeCertificateForResponse(cert)
+
+	obtainFn := obtainTLSCertificate // 捕获当前实现，避免 goroutine 内读可变包变量（测试热替换）
 	go func(c *model.TLSCertificate) {
 		asyncCtx := context.WithoutCancel(ctx)
-		_ = obtainTLSCertificate(asyncCtx, c)
+		_ = obtainFn(asyncCtx, c)
 	}(cert)
 
-	return sanitizeCertificateForResponse(cert), nil
+	return returned, nil
 }
 
 // UpdateACMECertificate 更新 ACME 证书配置。
@@ -225,12 +230,15 @@ func UpdateACMECertificate(ctx context.Context, id uint, input ApplyInput) (*mod
 		return nil, err
 	}
 
+	returned := sanitizeCertificateForResponse(cert)
+
+	obtainFn := obtainTLSCertificate // 捕获当前实现，避免 goroutine 内读可变包变量（测试热替换）
 	go func(c *model.TLSCertificate) {
 		asyncCtx := context.WithoutCancel(ctx)
-		_ = obtainTLSCertificate(asyncCtx, c)
+		_ = obtainFn(asyncCtx, c)
 	}(cert)
 
-	return sanitizeCertificateForResponse(cert), nil
+	return returned, nil
 }
 
 // ConvertCertificateToACME 将上传证书转为 ACME 管理。
@@ -257,9 +265,10 @@ func ConvertCertificateToACME(ctx context.Context, id uint, input ApplyInput) (*
 		return nil, err
 	}
 
+	obtainFn := obtainTLSCertificate // 捕获当前实现，避免 goroutine 内读可变包变量（测试热替换）
 	go func(c *model.TLSCertificate) {
 		asyncCtx := context.WithoutCancel(ctx)
-		if err := obtainTLSCertificate(asyncCtx, c); err != nil {
+		if err := obtainFn(asyncCtx, c); err != nil {
 			return
 		}
 		latest, err := repository.GetTLSCertificateByID(asyncCtx, c.ID)