@mikrojs/firmware 0.16.0 → 0.17.0-next.20260722220623

package/components/mikrojs/CMakeLists.txt

@@ -41,6 +41,11 @@ if(CONFIG_BT_ENABLED)
     list(APPEND _MIK_BLE_SRCS "mik_ble.cpp" "mik_ble_c_shim.c")
 endif()
 
+# mik_ota.cpp includes <miniz.h> for tinfl (gunzip). On the esp32c6 the
+# implementation is in the chip mask ROM and the header comes from the
+# always-available `esp_rom` common dependency, so no REQUIRES entry is needed.
+# A target without ROM miniz needs the `miniz` managed component adding to
+# idf_component.yml.
 idf_component_register(
     INCLUDE_DIRS "include" "${MIK_INCLUDE_DIR}"
     REQUIRES bt littlefs esp_adc esp_app_format esp_driver_gpio esp_driver_i2c esp_driver_i2s esp_driver_ledc esp_driver_rmt esp_driver_spi esp_psram esp_timer esp_http_client esp_http_server esp-tls esp_netif esp_event esp_wifi nvs_flash esp_driver_uart esp_driver_usb_serial_jtag spi_flash
@@ -55,6 +60,7 @@ idf_component_register(
     "${MIK_SRC_DIR}/fs.cpp"
     "${MIK_SRC_DIR}/mem.cpp"
     "${MIK_SRC_DIR}/mik_app_config.cpp"
+    "${MIK_SRC_DIR}/mik_app_store.cpp"
     "${MIK_SRC_DIR}/mik_color.cpp"
     "${MIK_SRC_DIR}/mik_console.cpp"
     "${MIK_SRC_DIR}/mik_inspect.cpp"
@@ -90,6 +96,7 @@ idf_component_register(
     "mik_pin.cpp"
     "mik_pwm.cpp"
     "mik_nvs_kv.cpp"
+    "mik_ota.cpp"
     "mik_recovery.cpp"
     "mik_rtc.cpp"
     "mik_serial_io.cpp"
@@ -143,8 +150,8 @@ endif()
 include("${MIK_BYTECODE_CMAKE}")
 
 # Force linker to include self-registering native modules
-set(_MIK_MODULES cbor pin i2c i2s spi http http_server wifi rtc nvs_kv sntp sleep neopixel pwm uart)
-set(_MIK_BYTECODE_MODULES abort cbor env result schema fs http/helpers http/request http/server i2c i2s kv/nvs kv/rtc kv/shared module neopixel observable observable/lazy observable/operators pin pwm reader sleep spi sntp stdio stream sys test uart udp wifi)
+set(_MIK_MODULES cbor pin i2c i2s spi http http_server wifi rtc nvs_kv sntp sleep neopixel pwm uart ota)
+set(_MIK_BYTECODE_MODULES abort cbor env result schema fs http/helpers http/request http/server i2c i2s kv/nvs kv/rtc kv/shared module neopixel observable observable/lazy observable/operators ota pin pwm reader sleep spi sntp stdio stream sys test uart udp wifi)
 if(CONFIG_BT_ENABLED)
     list(APPEND _MIK_MODULES ble)
     list(APPEND _MIK_BYTECODE_MODULES ble)

package/components/mikrojs/include/mikrojs_esp32.h

@@ -20,6 +20,29 @@ void MIK_Main(void);
 /* Deploy recovery (mik_deploy.cpp) */
 void MIK_DeployRecover(void);
 
+/* OTA boot reconcile (mik_ota.cpp). Runs before the JS app loads: reflash
+ * guard, trial verdict, and a deferred clean-heap install of a staged build
+ * (may esp_restart). Call right after MIK_DeployRecover(). */
+void mik__ota_boot_reconcile(void);
+
+/* Adopt a streamed .tgz as the live app with no trial, recording it as the OTA
+ * rollback baseline (.ota-last-good.tgz). Backs MIK_CMD_DEPLOY_BUILD: a deploy
+ * (not an OTA download) becomes the known-good build. Verifies the build
+ * against `checksum` (lowercase hex, may be empty to skip), installs it, sets
+ * state GOOD with no trial, and clears any pending build. Returns false with
+ * *err pointing at a static reason string on failure. */
+bool mik__ota_adopt_build(const char* tgz_path, const char* checksum, const char** err);
+
+/* True while the running build is an unconfirmed OTA trial (mik_ota.cpp). Lets
+ * the boot path treat a JS-level fatal during a trial as a failed trial. */
+bool mik__ota_in_trial(void);
+
+/* Record that the running trial build hit a fatal JS error (an uncaught
+ * exception or unhandled rejection), so the next reconcile reverts it even
+ * though the reboot looks like a clean software reset. No-op outside a trial.
+ * `detail` is a short message kept for the revert diagnostic. */
+void mik__ota_note_trial_failure(const char* detail);
+
 /* Safe-mode recovery window (mik_recovery.cpp).
  * Opens a brief window (typ. 500ms) right after console init that watches
  * for two triggers and returns true if either fires:

package/components/mikrojs/mik_config.cpp

@@ -96,6 +96,11 @@ bool mik__handle_config_command(MIKReplTransport* transport, uint8_t cmd_type,
 
         case MIK_CMD_CONFIG_SET: {
             /* Payload: u8 flags | u16le key_len | key | u16le val_len | value */
+            if (payload_len < 3) {
+                mik__proto_drain(transport, payload_len);
+                mik__proto_send_err(transport, "config header too short");
+                return true;
+            }
             uint8_t flags;
             if (!mik__proto_read_exact(transport, &flags, 1)) return false;
 
@@ -104,26 +109,35 @@ bool mik__handle_config_command(MIKReplTransport* transport, uint8_t cmd_type,
             uint16_t key_len = kl[0] | (kl[1] << 8);
 
             char key[64];
-            if (key_len >= sizeof(key)) {
+            if (key_len >= sizeof(key) || (uint32_t)key_len + 3 > payload_len) {
                 mik__proto_drain(transport, payload_len - 3);
                 mik__proto_send_err(transport, "key too long");
                 return true;
             }
             if (!mik__proto_read_exact(transport, key, key_len)) return false;
             key[key_len] = '\0';
+            uint32_t consumed = 3 + (uint32_t)key_len;
 
+            if (consumed + 2 > payload_len) {
+                mik__proto_drain(transport, payload_len - consumed);
+                mik__proto_send_err(transport, "config value header truncated");
+                return true;
+            }
             uint8_t vl[2];
             if (!mik__proto_read_exact(transport, vl, 2)) return false;
             uint16_t val_len = vl[0] | (vl[1] << 8);
+            consumed += 2;
 
             char value[512];
-            if (val_len >= sizeof(value)) {
-                mik__proto_drain(transport, val_len);
+            if (val_len >= sizeof(value) || consumed + (uint32_t)val_len > payload_len) {
+                mik__proto_drain(transport, payload_len - consumed);
                 mik__proto_send_err(transport, "value too long");
                 return true;
             }
             if (!mik__proto_read_exact(transport, value, val_len)) return false;
             value[val_len] = '\0';
+            consumed += val_len;
+            if (payload_len > consumed) mik__proto_drain(transport, payload_len - consumed);
 
             if (key_len > 15) {
                 mik__proto_send_err(transport, "key exceeds NVS 15-char limit");
@@ -142,24 +156,164 @@ bool mik__handle_config_command(MIKReplTransport* transport, uint8_t cmd_type,
 
         case MIK_CMD_CONFIG_DELETE: {
             /* Payload: u16le key_len | key */
+            if (payload_len < 2) {
+                mik__proto_drain(transport, payload_len);
+                mik__proto_send_err(transport, "config header too short");
+                return true;
+            }
             uint8_t kl[2];
             if (!mik__proto_read_exact(transport, kl, 2)) return false;
             uint16_t key_len = kl[0] | (kl[1] << 8);
 
             char key[64];
-            if (key_len >= sizeof(key)) {
-                mik__proto_drain(transport, key_len);
+            if (key_len >= sizeof(key) || (uint32_t)key_len + 2 > payload_len) {
+                mik__proto_drain(transport, payload_len - 2);
                 mik__proto_send_err(transport, "key too long");
                 return true;
             }
             if (!mik__proto_read_exact(transport, key, key_len)) return false;
             key[key_len] = '\0';
+            uint32_t consumed = 2 + (uint32_t)key_len;
+            if (payload_len > consumed) mik__proto_drain(transport, payload_len - consumed);
 
             uint8_t byte = mik__nvs_env_delete(key) ? 1 : 0;
             mik__proto_send(transport, MIK_MSG_OK, &byte, 1);
             return true;
         }
 
+        case MIK_CMD_KV_SET: {
+            /* Payload: u8 ns | u16le key_len | key | u16le val_len | value.
+             * ns selects the namespace (0 = mik.kv, 1 = mik.sys). The value is
+             * stored as a CBOR text-string blob, matching what `mikro/kv/nvs`
+             * writes, so JS reads it back as a plain string. */
+            if (payload_len < 3) {
+                mik__proto_drain(transport, payload_len);
+                mik__proto_send_err(transport, "kv header too short");
+                return true;
+            }
+            uint8_t ns;
+            if (!mik__proto_read_exact(transport, &ns, 1)) return false;
+            if (ns > 1) {
+                mik__proto_drain(transport, payload_len - 1);
+                mik__proto_send_err(transport, "unknown kv namespace");
+                return true;
+            }
+
+            uint8_t kl[2];
+            if (!mik__proto_read_exact(transport, kl, 2)) return false;
+            uint16_t key_len = kl[0] | (kl[1] << 8);
+
+            char key[64];
+            if (key_len >= sizeof(key) || (uint32_t)key_len + 3 > payload_len) {
+                mik__proto_drain(transport, payload_len - 3);
+                mik__proto_send_err(transport, "key too long");
+                return true;
+            }
+            if (!mik__proto_read_exact(transport, key, key_len)) return false;
+            key[key_len] = '\0';
+            uint32_t consumed = 3 + (uint32_t)key_len;
+
+            if (consumed + 2 > payload_len) {
+                mik__proto_drain(transport, payload_len - consumed);
+                mik__proto_send_err(transport, "kv value header truncated");
+                return true;
+            }
+            uint8_t vl[2];
+            if (!mik__proto_read_exact(transport, vl, 2)) return false;
+            uint16_t val_len = vl[0] | (vl[1] << 8);
+            consumed += 2;
+
+            char value[512];
+            if (val_len >= sizeof(value) || consumed + (uint32_t)val_len > payload_len) {
+                mik__proto_drain(transport, payload_len - consumed);
+                mik__proto_send_err(transport, "value too long");
+                return true;
+            }
+            if (!mik__proto_read_exact(transport, value, val_len)) return false;
+            value[val_len] = '\0';
+            consumed += val_len;
+            if (payload_len > consumed) mik__proto_drain(transport, payload_len - consumed);
+
+            if (key_len == 0 || key_len > 15) {
+                mik__proto_send_err(transport, "key exceeds NVS 15-char limit");
+                return true;
+            }
+
+            nanocbor_encoder_t enc;
+            uint8_t blob[sizeof(value) + 4];
+            nanocbor_encoder_init(&enc, blob, sizeof(blob));
+            if (nanocbor_put_tstrn(&enc, value, val_len) < 0) {
+                mik__proto_send_err(transport, "cbor encode failed");
+                return true;
+            }
+            size_t blob_len = nanocbor_encoded_len(&enc);
+
+            nvs_handle_t handle;
+            esp_err_t err = nvs_open(ns == 1 ? "mik.sys" : "mik.kv", NVS_READWRITE, &handle);
+            if (err == ESP_OK) {
+                err = nvs_set_blob(handle, key, blob, blob_len);
+                if (err == ESP_OK) err = nvs_commit(handle);
+                nvs_close(handle);
+            }
+            if (err == ESP_OK) {
+                mik__proto_send_ok(transport);
+            } else {
+                mik__proto_send_err(transport, "nvs write failed");
+            }
+            return true;
+        }
+
+        case MIK_CMD_KV_DELETE: {
+            /* Payload: u8 ns | u16le key_len | key */
+            if (payload_len < 3) {
+                mik__proto_drain(transport, payload_len);
+                mik__proto_send_err(transport, "kv header too short");
+                return true;
+            }
+            uint8_t ns;
+            if (!mik__proto_read_exact(transport, &ns, 1)) return false;
+            if (ns > 1) {
+                mik__proto_drain(transport, payload_len - 1);
+                mik__proto_send_err(transport, "unknown kv namespace");
+                return true;
+            }
+
+            uint8_t kl[2];
+            if (!mik__proto_read_exact(transport, kl, 2)) return false;
+            uint16_t key_len = kl[0] | (kl[1] << 8);
+
+            char key[64];
+            if (key_len >= sizeof(key) || (uint32_t)key_len + 3 > payload_len) {
+                mik__proto_drain(transport, payload_len - 3);
+                mik__proto_send_err(transport, "key too long");
+                return true;
+            }
+            if (!mik__proto_read_exact(transport, key, key_len)) return false;
+            key[key_len] = '\0';
+            uint32_t consumed = 3 + (uint32_t)key_len;
+            if (payload_len > consumed) mik__proto_drain(transport, payload_len - consumed);
+
+            bool existed = false;
+            esp_err_t err = ESP_FAIL;
+            nvs_handle_t handle;
+            if (nvs_open(ns == 1 ? "mik.sys" : "mik.kv", NVS_READWRITE, &handle) == ESP_OK) {
+                size_t len = 0;
+                existed = nvs_get_blob(handle, key, nullptr, &len) == ESP_OK;
+                err = nvs_erase_key(handle, key);
+                /* Deleting a key that was never there is a successful no-op. */
+                if (err == ESP_ERR_NVS_NOT_FOUND) err = ESP_OK;
+                if (err == ESP_OK) err = nvs_commit(handle);
+                nvs_close(handle);
+            }
+            if (err != ESP_OK) {
+                mik__proto_send_err(transport, "nvs delete failed");
+                return true;
+            }
+            uint8_t byte = existed ? 1 : 0;
+            mik__proto_send(transport, MIK_MSG_OK, &byte, 1);
+            return true;
+        }
+
         default:
             mik__proto_drain(transport, payload_len);
             return false;

package/components/mikrojs/mik_deploy.cpp

@@ -9,6 +9,7 @@
 #include <freertos/FreeRTOS.h>
 #include <freertos/task.h>
 
+#include "mikrojs/app_store.h"
 #include "mikrojs/mikrojs.h"
 #include "mikrojs/platform.h"
 #include "mikrojs/private.h"
@@ -16,9 +17,11 @@
 
 static const char* FS_BASE = "/appfs";
 static const char* DEPLOY_TMP = "/appfs/.deploy-tmp";
-static const char* DEPLOY_OLD = "/appfs/.deploy-old";
 static const char* APP_DIR = "/appfs/app";
 static const char* CHECKSUMS_PATH = "/appfs/app/.checksums";
+/* Where DEPLOY_PUT("/.build.tgz", ...) streams the OTA build (DEPLOY_TMP +
+ * "/.build.tgz"). Adopted by MIK_CMD_DEPLOY_BUILD. */
+static const char* BUILD_TGZ_PATH = "/appfs/.deploy-tmp/.build.tgz";
 
 /* ── Checksums manifest ─────────────────────────────────────────── */
 
@@ -239,19 +242,7 @@ static bool copy_file(const char* src, const char* dst) {
 /* ── Deploy recovery ─────────────────────────────────────────────── */
 
 void MIK_DeployRecover(void) {
-    bool has_app = path_exists(APP_DIR);
-    bool has_old = path_exists(DEPLOY_OLD);
-    bool has_tmp = path_exists(DEPLOY_TMP);
-
-    if (!has_app && has_old) {
-        rename(DEPLOY_OLD, APP_DIR);
-    } else if (has_old) {
-        rmdir_recursive(DEPLOY_OLD);
-    }
-
-    if (has_tmp) {
-        rmdir_recursive(DEPLOY_TMP);
-    }
+    mik__app_recover(FS_BASE);
 }
 
 /* ── Unified protocol deploy handler ────────────────────────────── */
@@ -540,36 +531,64 @@ bool mik__handle_deploy_command(MIKReplTransport* transport, uint8_t cmd_type,
             }
 
             /* Atomic swap: staging dir → app dir */
-            if (path_exists(APP_DIR) && !s_deploy_erased) {
-                rmdir_recursive(DEPLOY_OLD);
-                if (rename(APP_DIR, DEPLOY_OLD) != 0) {
-                    mik__proto_send_err(transport, "rename app to old failed");
-                    deploy_cleanup();
-                    return true;
-                }
+            MIKAppCommitResult commit = mik__app_commit(FS_BASE, s_deploy_erased);
+            if (commit == MIK_APP_COMMIT_STASH_FAILED) {
+                mik__proto_send_err(transport, "rename app to old failed");
+                deploy_cleanup();
+                return true;
             }
-
-            char staged_app[512];
-            snprintf(staged_app, sizeof(staged_app), "%s/app", DEPLOY_TMP);
-            if (path_exists(staged_app)) {
-                if (rename(staged_app, APP_DIR) != 0) {
-                    if (path_exists(DEPLOY_OLD)) {
-                        rename(DEPLOY_OLD, APP_DIR);
-                    }
-                    mik__proto_send_err(transport, "rename staged to app failed");
-                    deploy_cleanup();
-                    return true;
-                }
+            if (commit == MIK_APP_COMMIT_SWAP_FAILED) {
+                mik__proto_send_err(transport, "rename staged to app failed");
+                deploy_cleanup();
+                return true;
             }
 
-            rmdir_recursive(DEPLOY_OLD);
-            rmdir_recursive(DEPLOY_TMP);
             stamp_checksums_manifest();
             mik__proto_send_ok(transport);
             deploy_cleanup();
             return true;
         }
 
+        case MIK_CMD_DEPLOY_BUILD: {
+            /* Adopt a streamed .tgz as the live app via the OTA install path,
+             * establishing the rollback baseline. The build was streamed via
+             * PUT("/.build.tgz") + chunks into BUILD_TGZ_PATH.
+             * Payload: u16le checksum_len | checksum. */
+            if (payload_len < 2) {
+                mik__proto_drain(transport, payload_len);
+                mik__proto_send_err(transport, "build header too short");
+                deploy_cleanup();
+                return true;
+            }
+            uint8_t cl[2];
+            if (!mik__proto_read_exact(transport, cl, 2)) return false;
+            uint16_t chk_len = cl[0] | (cl[1] << 8);
+
+            char checksum[96];
+            if (chk_len >= sizeof(checksum) || (uint32_t)chk_len + 2 > payload_len) {
+                mik__proto_drain(transport, payload_len - 2);
+                mik__proto_send_err(transport, "build checksum too long");
+                deploy_cleanup();
+                return true;
+            }
+            if (!mik__proto_read_exact(transport, checksum, chk_len)) return false;
+            checksum[chk_len] = '\0';
+            uint32_t consumed = 2 + (uint32_t)chk_len;
+            if (payload_len > consumed) mik__proto_drain(transport, payload_len - consumed);
+
+            /* Flush the staged .tgz to disk before adopt reads it back. */
+            put_close_and_clear();
+
+            const char* err = nullptr;
+            if (mik__ota_adopt_build(BUILD_TGZ_PATH, checksum, &err)) {
+                mik__proto_send_ok(transport);
+            } else {
+                mik__proto_send_err(transport, err ? err : "build install failed");
+            }
+            deploy_cleanup();
+            return true;
+        }
+
         case MIK_CMD_DEPLOY_ABORT:
             mik__proto_drain(transport, payload_len);
             rmdir_recursive(DEPLOY_TMP);

package/components/mikrojs/mik_main.cpp

@@ -21,6 +21,41 @@
 
 static const char* TAG = "mikrojs";
 
+/* Error handler armed during a normal boot: when the app hits a fatal JS error
+ * (uncaught exception or unhandled rejection) while running an OTA trial build,
+ * flag the trial so the next reconcile reverts it. A JS error reboots as a clean
+ * software reset, which the trial state machine can't otherwise tell from a
+ * healthy restart. No-op outside a trial. */
+static void ota_trial_error_handler(JSContext* ctx, JSValue error, void* /*opaque*/) {
+    if (!mik__ota_in_trial()) {
+        return;
+    }
+    char detail[160] = "uncaught error";
+    if (JS_IsObject(error)) {
+        JSValue name_v = JS_GetPropertyStr(ctx, error, "name");
+        JSValue msg_v = JS_GetPropertyStr(ctx, error, "message");
+        const char* name = JS_ToCString(ctx, name_v);
+        const char* msg = JS_ToCString(ctx, msg_v);
+        if (name && name[0] && msg && msg[0]) {
+            snprintf(detail, sizeof(detail), "%s: %s", name, msg);
+        } else if (msg && msg[0]) {
+            snprintf(detail, sizeof(detail), "%s", msg);
+        } else if (name && name[0]) {
+            snprintf(detail, sizeof(detail), "%s", name);
+        }
+        /* A throwing getter (or a toString that throws) leaves an exception
+         * pending on ctx that nothing downstream would ever clear. */
+        if (!name || !msg) {
+            JS_FreeValue(ctx, JS_GetException(ctx));
+        }
+        if (name) JS_FreeCString(ctx, name);
+        if (msg) JS_FreeCString(ctx, msg);
+        JS_FreeValue(ctx, name_v);
+        JS_FreeValue(ctx, msg_v);
+    }
+    mik__ota_note_trial_failure(detail);
+}
+
 /* Apply the MIK_LOG_LEVEL env var (if set in NVS) to our log tags.
  *
  * The firmware compiles in all levels up to DEBUG
@@ -163,8 +198,9 @@ static bool platform_command_handler(MIKReplTransport* transport, uint8_t cmd_ty
         return true;
     }
 
-    /* Deploy commands (0x20-0x27) */
-    if (cmd_type >= MIK_CMD_DEPLOY_PUT && cmd_type <= MIK_CMD_DEPLOY_CHECKSUM) {
+    /* Deploy commands (0x20-0x27) plus the build-install command (0x2D) */
+    if ((cmd_type >= MIK_CMD_DEPLOY_PUT && cmd_type <= MIK_CMD_DEPLOY_CHECKSUM) ||
+        cmd_type == MIK_CMD_DEPLOY_BUILD) {
         return mik__handle_deploy_command(transport, cmd_type, payload_len);
     }
 
@@ -181,8 +217,8 @@ static bool platform_command_handler(MIKReplTransport* transport, uint8_t cmd_ty
         return true;
     }
 
-    /* Config commands (0x40-0x42) */
-    if (cmd_type >= MIK_CMD_CONFIG_LIST && cmd_type <= MIK_CMD_CONFIG_DELETE) {
+    /* Config + kv provisioning commands (0x40-0x44) */
+    if (cmd_type >= MIK_CMD_CONFIG_LIST && cmd_type <= MIK_CMD_KV_DELETE) {
         return mik__handle_config_command(transport, cmd_type, payload_len);
     }
 
@@ -291,6 +327,20 @@ void MIK_Main(void) {
     /* Recover from incomplete deploys */
     MIK_DeployRecover();
 
+    /* Reconcile OTA state before the JS app loads: reflash guard, trial
+     * verdict, and a deferred clean-heap install of a staged build (may
+     * restart). Runs after DeployRecover so an interrupted unpack's staging
+     * dir is already cleaned.
+     *
+     * Skipped in safe mode. The install budget bounds a crashing install, but
+     * safe mode is what a developer reaches for while it is still burning
+     * through that budget, and reconcile runs long before the REPL comes up:
+     * without this, the recovery window opens onto an install that panics
+     * before anything can be typed into it. */
+    if (!safe_mode) {
+        mik__ota_boot_reconcile();
+    }
+
     /* Load app config (mikro.config.json) if present */
     MIKConfig app_config;
     MIK_LoadConfig("/appfs", &app_config);
@@ -565,13 +615,24 @@ void MIK_Main(void) {
         if (safe_mode) {
             ESP_LOGW(TAG, "Safe mode: skipping entry point %s", app_config.entry_point);
         } else {
-            int rc = MIK_RunEntry(mik_rt, app_config.entry_point);
+            /* Catch async fatals (unhandled rejections) during an OTA trial. */
+            MIK_SetErrorHandler(mik_rt, ota_trial_error_handler, nullptr);
+            char entry_err[160] = {0};
+            int rc = MIK_RunEntryErr(mik_rt, app_config.entry_point, entry_err, sizeof(entry_err));
             if (rc == -EINVAL) {
                 ESP_LOGW(TAG, "No entry point configured (no \"main\" field in package.json)");
             } else if (rc == -ENOENT) {
                 ESP_LOGW(TAG, "Entry point not found: %s", app_config.entry_point);
             } else if (rc == -EFAULT) {
                 ESP_LOGE(TAG, "Failed to evaluate %s", app_config.entry_point);
+                /* A synchronous top-level throw doesn't reach the rejection handler
+                 * above. If this is a trial build, flag it and arm the panic restart
+                 * so reconcile reverts on the next (clean-looking) boot. */
+                if (mik__ota_in_trial()) {
+                    mik__ota_note_trial_failure(entry_err[0] ? entry_err
+                                                             : "entry failed to evaluate");
+                    MIK_Stop(mik_rt);
+                }
             }
         }
     }