NOTE: I was not yet able to confirm that this is working as intended, but I am pretty sure it is at least a step in the right direction.

Previously, we failed to support ESI correctly: The fetch node would run ESI on the client side, such that the delivery node would receive an already ESI processed object.

The concept of this change is:

Custom code on the fetch node decides on beresp.do_esi. vcl_deliver on the fetch node sets the "E" bit of a new flags header if obj.can_esi is true, which reflects beresp.do_esi and disables ESI processing.

When the delivery node receives an object from the fetch nodes, it sets beresp.do_esi based on the flags header.

Ultimately, beresp.do_esi == obj.can_esi is identical on the fetch and delivery nodes.