From a622842e9e72cd394f13a03a338a17b717f0f74e Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Fri, 25 Sep 2026 21:41:18 +0800
Subject: [PATCH] =?UTF-8?q?=E2=9B=84=20Sync=202026-09-25=2021:41:17?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 luci-app-fwlive/Makefile                           |  2 +-
 .../root/usr/libexec/fwlive-adaptive-cap.sh        | 14 +++++++++++---
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/luci-app-fwlive/Makefile b/luci-app-fwlive/Makefile
index b00138931..1310aaabb 100644
--- a/luci-app-fwlive/Makefile
+++ b/luci-app-fwlive/Makefile
@@ -12,7 +12,7 @@ LUCI_DEPENDS:=+luci-base +logd +jsonfilter
 LUCI_PKGARCH:=all
 
 PKG_VERSION:=0.1.45
-PKG_RELEASE:=36
+PKG_RELEASE:=37
 
 # Reproducible build: honor SOURCE_DATE_EPOCH from the build environment (set by docker-sdk.sh / CI).
 ifdef SOURCE_DATE_EPOCH
diff --git a/luci-app-fwlive/root/usr/libexec/fwlive-adaptive-cap.sh b/luci-app-fwlive/root/usr/libexec/fwlive-adaptive-cap.sh
index 3a543adb2..04e73d467 100755
--- a/luci-app-fwlive/root/usr/libexec/fwlive-adaptive-cap.sh
+++ b/luci-app-fwlive/root/usr/libexec/fwlive-adaptive-cap.sh
@@ -15,8 +15,10 @@
 # Hot-path budget: ≤1 flock exec per update (release by closing the fd when the
 # subshell exits — no flock -u). /proc/uptime + state I/O via shell builtins/
 # redirects (no sed/cat/jsonfilter on the adaptive path). Fail-open on missing
-# flock, lock busy, or corrupt state. Lock-busy ⇒ unlocked last-writer-wins is
-# acceptable (state stays one valid JSON line; ordering is not guaranteed).
+# flock, lock busy, or corrupt state. Fail-closed if the lock file cannot be
+# opened (skip the write; do not record unlocked). Lock-busy ⇒ unlocked
+# last-writer-wins is acceptable (state stays one valid JSON line; ordering
+# is not guaranteed).
 # Failed ubus log.read must NOT call record() — a ~0 ms failure is not "cold"
 # health and must not clear an existing hot/shed cap.
 # Outside the measured duration interval: plan (pre), record/merge (post).
@@ -225,7 +227,8 @@ fwlive_adaptive_write_state() {
 # missing/busy. Release by exiting the subshell (closes fd 9) — no flock -u.
 # Busy ⇒ run unlocked: last-writer-wins is acceptable (valid one-line JSON;
 # ordering under contention is not guaranteed).
-# Lock-open failure (redirection) also fail-opens unlocked so record() still runs.
+# Lock-open failure (redirection): fail-closed — skip the write; do not run
+# record() unlocked. Probe fd 9 first so a set -eu caller does not abort.
 fwlive_adaptive_with_lock() {
 	if ! command -v flock >/dev/null 2>&1; then
 		"$@"
@@ -251,6 +254,11 @@ fwlive_adaptive_with_lock() {
 		"$@"
 		return $?
 	fi
+	# Probe in a subshell first: a failed fd-9 redirection aborts a POSIX
+	# non-interactive shell (set -eu) before any fallback can run.
+	if ! ( exec 9>>"$_lock" ) 2>/dev/null; then
+		return 0
+	fi
 	(
 		if flock -n 9; then
 			"$@"