@mikrojs/native 0.20.1 → 0.20.2-next.20260907205905

package/include/mikrojs/mikrojs.h

@@ -93,7 +93,9 @@ void MIK_FreeRuntime(MIKRuntime* mik_rt);
  *   -EINVAL   runtime or entry is null/empty
  *   -ENOENT   entry (and its .bjs variant) not on disk
  *   -EFAULT   module evaluation threw
- * Emits no diagnostic output — callers decide whether and how to log. */
+ * A synchronous throw (a missing import, a syntax error) is reported like an
+ * uncaught exception found by MIK_Loop: error handler, dump, MIK_Stop. A
+ * rejected eval promise is reported by the next loop's rejection flush. */
 int MIK_RunEntry(MIKRuntime* mik_rt, const char* entry);
 
 /* MIK_RunEntry variant that, on -EFAULT, copies the thrown exception's

package/include/mikrojs/ota_env.h

@@ -146,13 +146,15 @@ struct MIKOtaEnv {
     MIKOtaKvStatus (*kv_get_blob)(void* opaque, const char* key, uint8_t* out_buf,
                                   size_t* inout_len);
     bool (*kv_set_blob)(void* opaque, const char* key, const uint8_t* data, size_t len);
-    /* NOTE: the string and integer getters are still two-valued. Their callers
-     * (the retry-budget store) read a failure as absence, which hands the budget
-     * back a boot early. Same class of bug as the blob case above; worth the same
-     * treatment when the policy's error handling is revisited. */
-    bool (*kv_get_str)(void* opaque, const char* key, char* out_buf, size_t max_len);
+    /* Same contract as kv_get_blob: absent and failed are different answers.
+     * The retry budget lives behind these two, and every fallback a caller
+     * would pick for "absent" grants the device more than it has earned: an
+     * unspent budget, a url that looks new, no bad build on record. Stored
+     * bytes that do not decode report MIK_OTA_KV_ERROR too: garbage is not
+     * absence either. */
+    MIKOtaKvStatus (*kv_get_str)(void* opaque, const char* key, char* out_buf, size_t max_len);
     bool (*kv_set_str)(void* opaque, const char* key, const char* val);
-    bool (*kv_get_i32)(void* opaque, const char* key, int32_t* out_val);
+    MIKOtaKvStatus (*kv_get_i32)(void* opaque, const char* key, int32_t* out_val);
     bool (*kv_set_i32)(void* opaque, const char* key, int32_t val);
     bool (*kv_remove)(void* opaque, const char* key);
 

package/include/mikrojs/ota_policy.h

@@ -92,8 +92,24 @@ public:
     void SetDecline(const MIKOtaDeclineRecord& record);
     void ClearDecline();
 
+    /* True once any read on this store has failed (as opposed to finding the
+     * key absent). Each getter has to answer with something, and the honest
+     * fallback for an unreadable key is the same everywhere: nothing stored.
+     * That reads as an unspent budget, a url that never matched, no abandoned
+     * build, every one of them more permission than the device has earned.
+     * Callers that are about to widen what the device may do consult this
+     * instead, and do nothing on an unreadable store; the next boot re-reads
+     * the real values. Latches for the life of one policy operation, which is
+     * how long a store lives. */
+    bool ReadFailed() const { return read_failed_; }
+
 private:
+    /* Runs every read through one place so the latch cannot be forgotten. */
+    MIKOtaKvStatus ReadStr(const char* key, char* out, size_t max_len) const;
+    MIKOtaKvStatus ReadI32(const char* key, int32_t* out) const;
+
     const MIKOtaEnv* env_;
+    mutable bool read_failed_ = false;
 };
 
 /* Validate untrusted offer fields into a well-formed MIKOtaOffer */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mikrojs/native",
-  "version": "0.20.1",
+  "version": "0.20.2-next.20260907205905",
   "description": "Mikro.js C++ runtime library and Node.js native addon",
   "keywords": [
     "esp32",
@@ -84,18 +84,18 @@
     "./runtime/wifi/types": "./runtime/wifi/types.ts"
   },
   "dependencies": {
+    "@mikrojs/quickjs": "0.20.2-next.20260907205905+8b6f502",
     "cmake-js": "^8.0.0",
-    "node-addon-api": "^8.7.0",
-    "node-gyp-build": "^4.8.4",
-    "@mikrojs/quickjs": "0.20.1"
+    "node-addon-api": "^8.9.2",
+    "node-gyp-build": "^4.8.4"
   },
   "devDependencies": {
-    "@swc/core": "^1.15.30",
+    "@mikrojs/registry": "0.20.2-next.20260907205905+8b6f502",
+    "@mikrojs/schema": "0.20.2-next.20260907205905+8b6f502",
+    "@swc/core": "^1.16.2",
     "@types/node": "^24.12.2",
-    "esbuild": "^0.28.0",
-    "terser": "^5.46.2",
-    "@mikrojs/registry": "0.20.1",
-    "@mikrojs/schema": "0.20.1"
+    "esbuild": "^0.28.2",
+    "terser": "^5.51.2"
   },
   "engines": {
     "node": ">=24.0.0"

package/runtime/kv/shared.ts

@@ -58,18 +58,12 @@ export function makeCreateValue(native: NativeKvFns) {
     const onReadError = options?.onReadError ?? (() => undefined)
 
     function doGet(): unknown {
+      let v: unknown
+      // Only the native read is guarded: a throw from parse() or from the
+      // handler itself is a caller bug, and treating it as corruption would
+      // delete data that read back fine.
       try {
-        const v = native.get(key)
-        if (v === undefined) return hasInitialValue ? initialValue : undefined
-        if (schema) {
-          const result = parse(schema, v)
-          if (!result.ok) {
-            // Schema mismatch: data decoded fine, don't delete it
-            return onReadError(result.error)
-          }
-          return result.value
-        }
-        return v
+        v = native.get(key)
       } catch (e) {
         // TypeError is the native's corruption marker (stored bytes that do
         // not decode): delete and heal. Anything else is a transient read
@@ -83,6 +77,14 @@ export function makeCreateValue(native: NativeKvFns) {
         }
         return onReadError(e)
       }
+      if (v === undefined) return hasInitialValue ? initialValue : undefined
+      if (schema) {
+        const result = parse(schema, v)
+        // Schema mismatch: data decoded fine, don't delete it
+        if (!result.ok) return onReadError(result.error)
+        return result.value
+      }
+      return v
     }
 
     function doSet(value: unknown) {

package/src/mik_abort.cpp

@@ -52,8 +52,7 @@ static JSValue mik__abort_lazy_get(JSContext* ctx, JSValue this_val, int magic)
          * would surface a bare 'null'. Mirrors the module loader's
          * missing-builtin fallback. */
         if (!JS_HasException(ctx)) {
-            JS_ThrowReferenceError(ctx,
-                                   "Builtin module 'mikro/abort' is not available in this build");
+            JS_ThrowTypeError(ctx, "Failed to resolve module specifier 'mikro/abort'");
         }
         JS_FreeValue(ctx, global_obj);
         return JS_EXCEPTION;

package/src/mik_console.cpp

@@ -3,7 +3,6 @@
 #include <cstring>
 #include <string>
 #include <unistd.h>
-#include <vector>
 
 #include <quickjs.h>
 
@@ -122,41 +121,6 @@ static std::string mik__format(JSContext* ctx, int argc, JSValue* argv, bool col
     return result;
 }
 
-/* ── Error formatting (port of console.ts formatError) ───────────── */
-
-static std::string mik__format_error(JSContext* ctx, JSValue error) {
-    JSValue stack_val = JS_GetPropertyStr(ctx, error, "stack");
-    JSValue msg_val = JS_GetPropertyStr(ctx, error, "message");
-
-    const char* stack = JS_ToCString(ctx, stack_val);
-    const char* msg = JS_ToCString(ctx, msg_val);
-
-    std::string result;
-    if (stack && msg && strstr(stack, msg)) {
-        /* Stack already includes message */
-        result = stack;
-    } else {
-        JSValue name_val = JS_GetPropertyStr(ctx, error, "name");
-        const char* name = JS_ToCString(ctx, name_val);
-        result = name ? name : "Error";
-        result += ": ";
-        result += msg ? msg : "";
-        if (stack) {
-            result += "\n";
-            result += stack;
-        }
-        if (name) JS_FreeCString(ctx, name);
-        JS_FreeValue(ctx, name_val);
-    }
-
-    if (stack) JS_FreeCString(ctx, stack);
-    if (msg) JS_FreeCString(ctx, msg);
-    JS_FreeValue(ctx, stack_val);
-    JS_FreeValue(ctx, msg_val);
-
-    return result;
-}
-
 /* ── Console methods ─────────────────────────────────────────────── */
 
 static JSValue mik__console_log(JSContext* ctx, JSValue this_val, int argc, JSValue* argv) {
@@ -205,24 +169,9 @@ static JSValue mik__console_error_warn(JSContext* ctx, JSValue this_val, int arg
                                        int magic) {
     uint8_t msg_type = magic == 0 ? MIK_MSG_ERROR : MIK_MSG_WARN;
 
-    /* Map Error objects to their stack traces */
-    std::vector<JSValue> mapped;
-    mapped.reserve(argc);
-
-    for (int i = 0; i < argc; i++) {
-        if (JS_IsError(argv[i])) {
-            std::string err_str = mik__format_error(ctx, argv[i]);
-            mapped.push_back(JS_NewString(ctx, err_str.c_str()));
-        } else {
-            mapped.push_back(JS_DupValue(ctx, argv[i]));
-        }
-    }
-
-    std::string output = mik__format(ctx, argc, mapped.data(), true);
-
-    for (auto& v : mapped) {
-        JS_FreeValue(ctx, v);
-    }
+    /* Error arguments render through inspect: name, message, extra fields,
+     * stack and cause chain. Same output as console.log for the same value. */
+    std::string output = mik__format(ctx, argc, argv, true);
 
     if (mik__repl_is_protocol_mode()) {
         mik__repl_proto_send_output(msg_type, output.c_str(), output.size());
@@ -236,6 +185,152 @@ static JSValue mik__console_error_warn(JSContext* ctx, JSValue this_val, int arg
 
 /* ── Uncaught error reporting ─────────────────────────────────────── */
 
+/* Bounded stack-buffer writer for the uncaught path: never touches the
+ * C++ heap (see mik__report_uncaught). Silently truncates when full. */
+struct MIKBoundedBuf {
+    char* buf;
+    size_t cap;
+    size_t pos = 0;
+    void append(const char* s, size_t len) {
+        if (pos >= cap - 1) return;
+        size_t avail = cap - 1 - pos;
+        size_t n = len < avail ? len : avail;
+        memcpy(buf + pos, s, n);
+        pos += n;
+    }
+    void cstr(const char* s) {
+        if (s) append(s, strlen(s));
+    }
+};
+
+/* One primitive as a log token (strings quoted). Objects print as
+ * [object]: nested inspection would need the C++ heap. */
+static void mik__append_primitive(JSContext* ctx, JSValue v, MIKBoundedBuf& out) {
+    if (JS_IsObject(v)) {
+        out.cstr("[object]");
+        return;
+    }
+    /* Allocation-free spellings first: a null rejection is how QuickJS
+     * reports OOM, so this must work with no heap at all */
+    if (JS_IsNull(v)) {
+        out.cstr("null");
+        return;
+    }
+    if (JS_IsUndefined(v)) {
+        out.cstr("undefined");
+        return;
+    }
+    if (JS_IsBool(v)) {
+        out.cstr(JS_ToBool(ctx, v) ? "true" : "false");
+        return;
+    }
+    if (JS_VALUE_GET_TAG(v) == JS_TAG_INT) {
+        char num[16];
+        int n = snprintf(num, sizeof(num), "%d", JS_VALUE_GET_INT(v));
+        if (n > 0) out.append(num, (size_t)n);
+        return;
+    }
+    bool quote = JS_IsString(v);
+    /* JS-heap allocation only; returns NULL on OOM instead of throwing */
+    const char* s = JS_ToCString(ctx, v);
+    if (!s) {
+        /* Symbols reject ToString */
+        JS_FreeValue(ctx, JS_GetException(ctx));
+        out.cstr("[primitive]");
+        return;
+    }
+    if (quote) out.cstr("'");
+    out.cstr(s);
+    if (quote) out.cstr("'");
+    JS_FreeCString(ctx, s);
+}
+
+/* "Name: message { extra: fields }" then the stack frames, `indent`
+ * prefixed to every frame line. Also fits a plain object (a Result error
+ * as a panic cause has name/message and no stack). */
+static void mik__append_error_head(JSContext* ctx, JSValue exc, const char* indent, MIKBoundedBuf& out) {
+    JSValue name_val = JS_GetPropertyStr(ctx, exc, "name");
+    JSValue msg_val = JS_GetPropertyStr(ctx, exc, "message");
+    if (JS_IsException(name_val) || JS_IsException(msg_val)) {
+        JS_FreeValue(ctx, JS_GetException(ctx));
+    }
+    /* Non-string name/message count as absent (a native Result error has
+     * code + message and no name) */
+    const char* name = JS_IsString(name_val) ? JS_ToCString(ctx, name_val) : nullptr;
+    const char* emsg = JS_IsString(msg_val) ? JS_ToCString(ctx, msg_val) : nullptr;
+
+    if (name && name[0]) {
+        out.cstr(name);
+        if (emsg && emsg[0]) {
+            out.cstr(": ");
+            out.cstr(emsg);
+        }
+    } else if (emsg && emsg[0]) {
+        out.cstr(emsg);
+    } else {
+        out.cstr("[object]");
+    }
+
+    if (name) JS_FreeCString(ctx, name);
+    if (emsg) JS_FreeCString(ctx, emsg);
+    JS_FreeValue(ctx, name_val);
+    JS_FreeValue(ctx, msg_val);
+
+    /* Own enumerable fields beyond the standard ones: code, errno, path... */
+    JSPropertyEnum* ptab = nullptr;
+    uint32_t plen = 0;
+    if (JS_GetOwnPropertyNames(ctx, &ptab, &plen, exc, JS_GPN_STRING_MASK | JS_GPN_ENUM_ONLY) ==
+        0) {
+        bool first = true;
+        for (uint32_t i = 0; i < plen; i++) {
+            const char* key = JS_AtomToCString(ctx, ptab[i].atom);
+            if (key && strcmp(key, "name") != 0 && strcmp(key, "message") != 0 &&
+                strcmp(key, "stack") != 0 && strcmp(key, "cause") != 0) {
+                JSValue v = JS_GetProperty(ctx, exc, ptab[i].atom);
+                if (JS_IsException(v)) {
+                    JS_FreeValue(ctx, JS_GetException(ctx));
+                } else {
+                    out.cstr(first ? " { " : ", ");
+                    first = false;
+                    out.cstr(key);
+                    out.cstr(": ");
+                    mik__append_primitive(ctx, v, out);
+                }
+                JS_FreeValue(ctx, v);
+            }
+            if (key) JS_FreeCString(ctx, key);
+            JS_FreeAtom(ctx, ptab[i].atom);
+        }
+        if (!first) out.cstr(" }");
+        js_free(ctx, ptab);
+    } else {
+        JS_FreeValue(ctx, JS_GetException(ctx));
+    }
+
+    JSValue stack_val = JS_GetPropertyStr(ctx, exc, "stack");
+    if (JS_IsString(stack_val)) {
+        const char* stack = JS_ToCString(ctx, stack_val);
+        if (stack) {
+            const char* p = stack;
+            while (*p) {
+                const char* nl = strchr(p, '\n');
+                size_t len = nl ? (size_t)(nl - p) : strlen(p);
+                if (len) {
+                    out.cstr("\n");
+                    out.cstr(indent);
+                    out.append(p, len);
+                }
+                if (!nl) break;
+                p = nl + 1;
+            }
+            JS_FreeCString(ctx, stack);
+        }
+    } else if (JS_IsException(stack_val)) {
+        JS_FreeValue(ctx, JS_GetException(ctx));
+    }
+    JS_FreeValue(ctx, stack_val);
+}
+
 /* Dedup across report paths: one error can reach this function more than
  * once for a single failure. The sync throw path (mik_dump_error) can report
  * an error whose promise still sits in the deferred flush queue, e.g. an
@@ -275,77 +370,59 @@ bool mik__report_uncaught(JSContext* ctx, JSValue exc, bool in_promise) {
      * abort() — masking the real OOM the reporter was trying to surface.
      * Messages longer than the buffer get truncated, which beats
      * aborting. */
-    char buf[512];
-    size_t pos = 0;
-    auto append = [&](const char* s, size_t len) {
-        if (pos >= sizeof(buf) - 1) return;
-        size_t avail = sizeof(buf) - 1 - pos;
-        size_t n = len < avail ? len : avail;
-        memcpy(buf + pos, s, n);
-        pos += n;
-    };
-    auto append_cstr = [&](const char* s) {
-        if (s) append(s, strlen(s));
-    };
+    char buf[1024];
+    MIKBoundedBuf out{buf, sizeof(buf)};
 
-    append_cstr(in_promise ? "Uncaught (in promise) " : "Uncaught ");
+    out.cstr(in_promise ? "Uncaught (in promise) " : "Uncaught ");
 
     if (JS_IsObject(exc)) {
-        JSValue name_val = JS_GetPropertyStr(ctx, exc, "name");
-        JSValue msg_val = JS_GetPropertyStr(ctx, exc, "message");
-        const char* name = JS_ToCString(ctx, name_val);
-        const char* emsg = JS_ToCString(ctx, msg_val);
-
-        if (name && name[0]) {
-            append_cstr(name);
-            if (emsg && emsg[0]) {
-                append_cstr(": ");
-                append_cstr(emsg);
+        mik__append_error_head(ctx, exc, "", out);
+
+        /* Cause chain: a panic's cause is the Result error that triggered
+         * it, so this is usually the line that says what actually failed.
+         * Bounded depth; `seen` cuts cycles. */
+        static const char* const indents[] = {"", "  ", "    ", "      ", "        "};
+        void* seen[countof(indents)] = {JS_VALUE_GET_PTR(exc)};
+        JSValue cur = JS_DupValue(ctx, exc);
+        for (size_t level = 1; level < countof(indents); level++) {
+            JSValue cause = JS_GetPropertyStr(ctx, cur, "cause");
+            JS_FreeValue(ctx, cur);
+            cur = cause;
+            if (JS_IsException(cause)) {
+                JS_FreeValue(ctx, JS_GetException(ctx));
+                break;
             }
-        } else if (emsg && emsg[0]) {
-            append_cstr(emsg);
-        } else {
-            append_cstr("[object]");
-        }
-
-        if (name) JS_FreeCString(ctx, name);
-        if (emsg) JS_FreeCString(ctx, emsg);
-        JS_FreeValue(ctx, name_val);
-        JS_FreeValue(ctx, msg_val);
-
-        JSValue stack_val = JS_GetPropertyStr(ctx, exc, "stack");
-        if (JS_IsString(stack_val)) {
-            const char* stack = JS_ToCString(ctx, stack_val);
-            if (stack && stack[0]) {
-                append_cstr("\n");
-                append_cstr(stack);
+            if (JS_IsUndefined(cause)) break;
+            out.cstr("\n");
+            out.cstr(indents[level]);
+            out.cstr("[cause]: ");
+            if (!JS_IsObject(cause)) {
+                mik__append_primitive(ctx, cause, out);
+                break;
+            }
+            bool cyclic = false;
+            for (size_t j = 0; j < level; j++) {
+                if (seen[j] == JS_VALUE_GET_PTR(cause)) cyclic = true;
+            }
+            if (cyclic) {
+                out.cstr("[Circular]");
+                break;
             }
-            if (stack) JS_FreeCString(ctx, stack);
+            seen[level] = JS_VALUE_GET_PTR(cause);
+            mik__append_error_head(ctx, cause, indents[level], out);
         }
-        JS_FreeValue(ctx, stack_val);
+        JS_FreeValue(ctx, cur);
     } else {
         /* Describe primitive rejections by type without going through
          * mik_inspect (which allocates a std::string). */
-        if (JS_IsNull(exc)) {
-            append_cstr("null");
-        } else if (JS_IsUndefined(exc)) {
-            append_cstr("undefined");
-        } else if (JS_IsBool(exc)) {
-            append_cstr(JS_ToBool(ctx, exc) ? "true" : "false");
-        } else if (JS_IsNumber(exc)) {
-            double d = 0;
-            JS_ToFloat64(ctx, &d, exc);
-            char num[32];
-            int n = snprintf(num, sizeof(num), "%g", d);
-            if (n > 0) append(num, (size_t)n);
-        } else if (JS_IsString(exc)) {
+        if (JS_IsString(exc)) {
             const char* s = JS_ToCString(ctx, exc);
             if (s) {
-                append_cstr(s);
+                out.cstr(s);
                 JS_FreeCString(ctx, s);
             }
         } else {
-            append_cstr("[primitive]");
+            mik__append_primitive(ctx, exc, out);
         }
 
         /* Primitive rejections lose the throw-site stack (the async
@@ -359,17 +436,17 @@ bool mik__report_uncaught(JSContext* ctx, JSValue exc, bool in_promise) {
             int n = snprintf(note, sizeof(note),
                              "\n  (primitive rejection, systemFree=%zuB at report time)",
                              plat->get_free_system_mem());
-            if (n > 0) append(note, (size_t)n);
+            if (n > 0) out.append(note, (size_t)n);
         }
     }
 
     if (mik__repl_is_protocol_mode()) {
-        mik__repl_proto_send_output(MIK_MSG_ERROR, buf, pos);
+        mik__repl_proto_send_output(MIK_MSG_ERROR, buf, out.pos);
         return true;
     }
 
-    append_cstr("\r\n");
-    MIK_GetPlatform()->stderr_write(buf, pos);
+    out.cstr("\r\n");
+    MIK_GetPlatform()->stderr_write(buf, out.pos);
     return true;
 }
 

package/src/mik_inspect.cpp

@@ -18,6 +18,8 @@ struct InspectOpts {
     bool colors;
     bool show_hidden;
     std::vector<void*> seen;
+    /* Nesting of [cause] rendering, capped like mik__report_uncaught */
+    int cause_level = 0;
 };
 
 /* ── Helpers ─────────────────────────────────────────────────────── */
@@ -85,6 +87,7 @@ static std::string quote_key(const char* key) {
 /* ── Forward declaration ─────────────────────────────────────────── */
 
 static std::string inspect_value(JSContext* ctx, JSValue value, InspectOpts& opts, int depth);
+static std::string indent_continuation(const std::string& s);
 
 /* ── Custom inspect callback state (single-threaded JS) ──────────── */
 
@@ -263,7 +266,7 @@ static std::string inspect_array_items(JSContext* ctx, JSValue arr, uint32_t len
         if (JS_IsException(item)) {
             out += getter_threw(ctx, opts);
         } else {
-            out += inspect_value(ctx, item, opts, depth);
+            out += indent_continuation(inspect_value(ctx, item, opts, depth));
         }
         JS_FreeValue(ctx, item);
     }
@@ -318,7 +321,7 @@ static std::string inspect_properties(JSContext* ctx, JSValue obj, InspectOpts&
             if (JS_IsException(val)) {
                 out += getter_threw(ctx, opts);
             } else {
-                out += inspect_value(ctx, val, opts, depth);
+                out += indent_continuation(inspect_value(ctx, val, opts, depth));
             }
             JS_FreeValue(ctx, val);
         }
@@ -474,6 +477,51 @@ static std::string inspect_regexp(JSContext* ctx, JSValue value, InspectOpts& op
     return stylize("/(?:)/", MIK_TOKEN_REGEXP, opts);
 }
 
+/* Indent every line after the first by two spaces so a multi-line value
+ * (an error's stack frames, its own cause) nests visibly under its parent. */
+static std::string indent_continuation(const std::string& s) {
+    std::string out;
+    out.reserve(s.size() + 8);
+    for (char c : s) {
+        out += c;
+        if (c == '\n') out += "  ";
+    }
+    return out;
+}
+
+/* "\n  [cause]: <value>" for an own cause, or "". Shared by Errors and
+ * plain objects, since Result errors carry cause as an ordinary field.
+ * The chain is what a log line exists for, so it renders past the depth
+ * limit; the caller keeps the parent on the seen list to bound cycles. */
+static std::string inspect_cause(JSContext* ctx, JSValue value, InspectOpts& opts, int depth) {
+    JSValue cause = JS_GetPropertyStr(ctx, value, "cause");
+    if (JS_IsException(cause)) {
+        drain_exception(ctx);
+        return "";
+    }
+    /* Same cap as mik__report_uncaught; bounds recursion on the JS task stack */
+    static const int MAX_CAUSE_LEVEL = 4;
+    std::string out;
+    if (!JS_IsUndefined(cause)) {
+        out = "\n  [cause]: ";
+        if (opts.cause_level >= MAX_CAUSE_LEVEL) {
+            out += TRUNCATOR;
+        } else {
+            opts.cause_level++;
+            out += indent_continuation(inspect_value(ctx, cause, opts, depth < 1 ? 1 : depth));
+            opts.cause_level--;
+        }
+    }
+    JS_FreeValue(ctx, cause);
+    return out;
+}
+
+/* Errors render as
+ *   Name: message { extra: props }
+ *       at frame (file:line:col)
+ *     [cause]: <inspected cause>
+ * The header keeps name, message and every own enumerable field (code,
+ * errno, ...) on one line; the stack and the cause chain follow. */
 static std::string inspect_error(JSContext* ctx, JSValue value, InspectOpts& opts, int depth) {
     /* Get name and message */
     JSValue name_val = JS_GetPropertyStr(ctx, value, "name");
@@ -498,16 +546,40 @@ static std::string inspect_error(JSContext* ctx, JSValue value, InspectOpts& opt
     JS_FreeValue(ctx, name_val);
     JS_FreeValue(ctx, msg_val);
 
-    /* Inspect extra properties (skip standard error keys) */
+    if (is_seen(opts, value)) return result + " [Circular]";
+    opts.seen.push_back(JS_VALUE_GET_PTR(value));
+
+    /* Inspect extra properties (skip standard error keys; cause is rendered
+     * below so it reads the same whether QuickJS or a panic defined it) */
     static const char* const error_keys[] = {"stack",     "line",       "column",     "name",
                                              "message",   "fileName",   "lineNumber", "columnNumber",
-                                             "number",    "description"};
+                                             "number",    "description", "cause"};
     std::string props =
         inspect_properties(ctx, value, opts, depth, error_keys, countof(error_keys));
     if (!props.empty()) {
         result += " { " + props + " }";
     }
 
+    /* QuickJS stacks are frame lines only ("    at ..."), no header line */
+    JSValue stack_val = JS_GetPropertyStr(ctx, value, "stack");
+    if (JS_IsException(stack_val)) drain_exception(ctx);
+    if (JS_IsString(stack_val)) {
+        const char* stack = JS_ToCString(ctx, stack_val);
+        if (stack) {
+            std::string frames(stack);
+            JS_FreeCString(ctx, stack);
+            while (!frames.empty() && frames.back() == '\n') frames.pop_back();
+            if (!frames.empty()) {
+                result += "\n";
+                result += frames;
+            }
+        }
+    }
+    JS_FreeValue(ctx, stack_val);
+
+    result += inspect_cause(ctx, value, opts, depth);
+
+    opts.seen.pop_back();
     return result;
 }
 
@@ -603,9 +675,9 @@ static std::string inspect_map(JSContext* ctx, JSValue value, InspectOpts& opts,
 
         if (!first) items += ", ";
         first = false;
-        items += inspect_value(ctx, key, opts, depth);
+        items += indent_continuation(inspect_value(ctx, key, opts, depth));
         items += " => ";
-        items += inspect_value(ctx, val, opts, depth);
+        items += indent_continuation(inspect_value(ctx, val, opts, depth));
 
         JS_FreeValue(ctx, key);
         JS_FreeValue(ctx, val);
@@ -673,7 +745,7 @@ static std::string inspect_set(JSContext* ctx, JSValue value, InspectOpts& opts,
         JSValue val = JS_GetPropertyStr(ctx, step, "value");
         if (!first) items += ", ";
         first = false;
-        items += inspect_value(ctx, val, opts, depth);
+        items += indent_continuation(inspect_value(ctx, val, opts, depth));
         JS_FreeValue(ctx, val);
         JS_FreeValue(ctx, step);
     }
@@ -746,11 +818,16 @@ static std::string inspect_object(JSContext* ctx, JSValue value, InspectOpts& op
 
     if (plen == 0) return "{}";
 
+    /* A cause field chains below the braces like an Error's, so a Result
+     * error wrapped around another keeps its whole chain readable */
+    static const char* const cause_key[] = {"cause"};
     opts.seen.push_back(JS_VALUE_GET_PTR(value));
-    std::string props = inspect_properties(ctx, value, opts, depth);
+    std::string props = inspect_properties(ctx, value, opts, depth, cause_key, 1);
+    std::string result = props.empty() ? "{}" : "{ " + props + " }";
+    result += inspect_cause(ctx, value, opts, depth);
     opts.seen.pop_back();
 
-    return "{ " + props + " }";
+    return result;
 }
 
 static std::string inspect_class(JSContext* ctx, JSValue value, const std::string& type_name,

package/src/mik_ota_client.cpp

@@ -354,10 +354,13 @@ bool MIKOtaClient::Enrollment(std::string* out_url, std::string* out_bearer) con
     char url[256] = {};
     char bearer[128] = {};
     if (!env_ || !env_->kv_get_str) return false;
-    if (!env_->kv_get_str(env_->opaque, "ota.registry", url, sizeof(url)) || url[0] == '\0') {
+    /* A read that failed reads as "not enrolled", which only makes the client
+     * skip the round. Erring the other way would send a half-read update key. */
+    if (env_->kv_get_str(env_->opaque, "ota.registry", url, sizeof(url)) != MIK_OTA_KV_OK ||
+        url[0] == '\0') {
         return false;
     }
-    if (!env_->kv_get_str(env_->opaque, "ota.updateKey", bearer, sizeof(bearer)) ||
+    if (env_->kv_get_str(env_->opaque, "ota.updateKey", bearer, sizeof(bearer)) != MIK_OTA_KV_OK ||
         bearer[0] == '\0') {
         return false;
     }

package/src/mik_ota_policy.cpp

@@ -13,6 +13,11 @@ namespace mikrojs {
 /* Staging attempts for one url before a checksum is abandoned. */
 constexpr int32_t MIK__OTA_MAX_TRIES = 3;
 
+/* The contract is 64 lowercase hex (see decline(), which enforces the format).
+ * Only the length is checked here, because a shorter checksum round-trips
+ * fine and the registry is free to use one. */
+constexpr size_t MIK__OTA_CHECKSUM_MAX = 64;
+
 const char* mik__ota_outcome_to_str(MIKOtaApplyOutcome outcome) {
     switch (outcome) {
         case MIKOtaApplyOutcome::kStaged:
@@ -48,10 +53,23 @@ std::string url_digest(const std::string& url) {
 
 }  // namespace
 
+MIKOtaKvStatus MIKOtaStore::ReadStr(const char* key, char* out, size_t max_len) const {
+    if (!env_ || !env_->kv_get_str) return MIK_OTA_KV_ABSENT;
+    MIKOtaKvStatus status = env_->kv_get_str(env_->opaque, key, out, max_len);
+    if (status == MIK_OTA_KV_ERROR) read_failed_ = true;
+    return status;
+}
+
+MIKOtaKvStatus MIKOtaStore::ReadI32(const char* key, int32_t* out) const {
+    if (!env_ || !env_->kv_get_i32) return MIK_OTA_KV_ABSENT;
+    MIKOtaKvStatus status = env_->kv_get_i32(env_->opaque, key, out);
+    if (status == MIK_OTA_KV_ERROR) read_failed_ = true;
+    return status;
+}
+
 bool MIKOtaStore::UrlMatches(const std::string& url) const {
-    if (!env_ || !env_->kv_get_str) return false;
     char buf[17] = {};
-    if (!env_->kv_get_str(env_->opaque, "ota.url", buf, sizeof(buf))) return false;
+    if (ReadStr("ota.url", buf, sizeof(buf)) != MIK_OTA_KV_OK) return false;
     return url_digest(url) == buf;
 }
 
@@ -61,9 +79,8 @@ void MIKOtaStore::SetUrl(const std::string& url) {
 }
 
 std::string MIKOtaStore::GetAttempt() const {
-    if (!env_ || !env_->kv_get_str) return "";
     char buf[128] = {};
-    if (env_->kv_get_str(env_->opaque, "ota.att", buf, sizeof(buf))) {
+    if (ReadStr("ota.att", buf, sizeof(buf)) == MIK_OTA_KV_OK) {
         return buf;
     }
     return "";
@@ -75,12 +92,14 @@ void MIKOtaStore::SetAttempt(const std::string& checksum) {
 }
 
 int32_t MIKOtaStore::GetTries() const {
-    if (!env_ || !env_->kv_get_i32) return 0;
     int32_t val = 0;
-    if (env_->kv_get_i32(env_->opaque, "ota.tries", &val)) {
+    if (ReadI32("ota.tries", &val) == MIK_OTA_KV_OK) {
         return val;
     }
-    return 0;
+    /* An unreadable budget counts as spent, which is what stops the attempt in
+     * apply_begin. Defaulting to "fully available" is the one mistake here that
+     * ends in a build reinstalling itself forever. */
+    return read_failed_ ? MIK__OTA_MAX_TRIES : 0;
 }
 
 void MIKOtaStore::SetTries(int32_t n) {
@@ -89,9 +108,8 @@ void MIKOtaStore::SetTries(int32_t n) {
 }
 
 std::string MIKOtaStore::GetBad() const {
-    if (!env_ || !env_->kv_get_str) return "";
     char buf[128] = {};
-    if (env_->kv_get_str(env_->opaque, "ota.bad", buf, sizeof(buf))) {
+    if (ReadStr("ota.bad", buf, sizeof(buf)) == MIK_OTA_KV_OK) {
         return buf;
     }
     return "";
@@ -103,9 +121,8 @@ void MIKOtaStore::SetBad(const std::string& checksum) {
 }
 
 bool MIKOtaStore::GetInFlight() const {
-    if (!env_ || !env_->kv_get_i32) return false;
     int32_t val = 0;
-    if (env_->kv_get_i32(env_->opaque, "ota.inflight", &val)) {
+    if (ReadI32("ota.inflight", &val) == MIK_OTA_KV_OK) {
         return val == 1;
     }
     return false;
@@ -117,16 +134,15 @@ void MIKOtaStore::SetInFlight(bool in_flight) {
 }
 
 bool MIKOtaStore::GetDecline(MIKOtaDeclineRecord* out) const {
-    if (!env_ || !env_->kv_get_str) return false;
-    if (!env_->kv_get_str(env_->opaque, "ota.declined", out->checksum, sizeof(out->checksum)) ||
+    if (ReadStr("ota.declined", out->checksum, sizeof(out->checksum)) != MIK_OTA_KV_OK ||
         out->checksum[0] == '\0') {
         return false;
     }
-    if (!env_->kv_get_str(env_->opaque, "ota.declReason", out->reason, sizeof(out->reason)) ||
+    if (ReadStr("ota.declReason", out->reason, sizeof(out->reason)) != MIK_OTA_KV_OK ||
         out->reason[0] == '\0') {
         return false;
     }
-    if (!env_->kv_get_str(env_->opaque, "ota.declDetail", out->detail, sizeof(out->detail))) {
+    if (ReadStr("ota.declDetail", out->detail, sizeof(out->detail)) != MIK_OTA_KV_OK) {
         out->detail[0] = '\0';
     }
     return true;
@@ -181,6 +197,18 @@ bool mik__ota_parse_offer(const char* url, const char* checksum, int64_t size, b
         return false;
     }
 
+    /* ota.att and ota.bad read back through a 128-byte buffer, and a stored
+     * value too long to decode reports a failed read, not an absent one. That
+     * stops every later offer, including a good one, and nothing rewrites the
+     * key. Bound it here, at the one place untrusted registry fields become an
+     * offer, rather than letting an unreadable value into the store. */
+    if (strlen(checksum) > MIK__OTA_CHECKSUM_MAX) {
+        if (out_warn_reason) {
+            *out_warn_reason = "checksum too long";
+        }
+        return false;
+    }
+
     if (size <= 0) {
         if (out_warn_reason) {
             *out_warn_reason = "invalid size";
@@ -202,7 +230,10 @@ MIKOtaReconcileOutcome mik__ota_policy_reconcile(const MIKOtaEnv* env) {
     MIKOtaStore store(env);
     if (store.GetInFlight()) {
         store.SetInFlight(false);
-    } else {
+    } else if (!store.ReadFailed()) {
+        /* Only a boot we can prove was clean hands the budget back. An
+         * unreadable flag reads as "not in flight", and the attempt it would
+         * forget is the one that just took the device down. */
         store.SetTries(0);
     }
     MIKOtaReconcileOutcome outcome = {};
@@ -345,7 +376,23 @@ bool mik__ota_policy_apply_begin(const MIKOtaEnv* env, const MIKOtaOffer& offer,
 
     // (d) device has given up on this build
     MIKOtaStore store(env);
-    if (!offer.checksum.empty() && offer.checksum == store.GetBad()) {
+    std::string bad = store.GetBad();
+    bool url_matches = store.UrlMatches(offer.url);
+    std::string attempt = store.GetAttempt();
+
+    // Read first, then decide: every value above reads as absent when the store
+    // could not answer, and each of those defaults grants the attempt
+    // something: no abandoned build, a url that never matched (a fresh
+    // budget). A store this device cannot read is one it has no business
+    // re-keying, and the heap pressure behind the failure is no state to start
+    // a download in anyway. Nothing is written here, so the next boot decides
+    // on the real values.
+    if (store.ReadFailed()) {
+        if (out_outcome) *out_outcome = MIKOtaApplyOutcome::kExhausted;
+        return true;
+    }
+
+    if (!offer.checksum.empty() && offer.checksum == bad) {
         if (out_outcome) *out_outcome = MIKOtaApplyOutcome::kAbandoned;
         return true;
     }
@@ -354,7 +401,7 @@ bool mik__ota_policy_apply_begin(const MIKOtaEnv* env, const MIKOtaOffer& offer,
     // attempts against this exact build at this exact url; the checksum is not
     // abandoned, because everything counted here is transient by construction
     // (a corrupt build is abandoned in apply_end instead).
-    if (!store.UrlMatches(offer.url) || offer.checksum != store.GetAttempt()) {
+    if (!url_matches || offer.checksum != attempt) {
         store.SetUrl(offer.url);
         store.SetAttempt(offer.checksum);
         store.SetTries(0);

package/src/mikrojs.cpp

@@ -1211,20 +1211,33 @@ int MIK_RunEntryErr(MIKRuntime* mik_rt, const char* entry, char* err_buf, size_t
             rejected = true;
         }
     }
-    if (failed && err_buf && err_buf_size > 0) {
-        /* Capture the failure's string form for the caller. Without an
-         * err_buf the pending exception is intentionally left on ctx,
-         * matching MIK_RunEntry's historical behavior. */
+    if (failed) {
         JSValue exc = rejected ? JS_PromiseResult(ctx, result) : JS_GetException(ctx);
-        const char* msg = JS_ToCString(ctx, exc);
-        if (msg) {
-            snprintf(err_buf, err_buf_size, "%s", msg);
-            JS_FreeCString(ctx, msg);
-        } else {
-            /* Stringifying the exception itself threw (e.g. OOM) — drop
-             * the secondary exception so it can't leak into later evals. */
-            JSValue stray = JS_GetException(ctx);
-            JS_FreeValue(ctx, stray);
+        if (err_buf && err_buf_size > 0) {
+            /* Capture the failure's string form for the caller. */
+            const char* msg = JS_ToCString(ctx, exc);
+            if (msg) {
+                snprintf(err_buf, err_buf_size, "%s", msg);
+                JS_FreeCString(ctx, msg);
+            } else {
+                /* Stringifying the exception itself threw (e.g. OOM) — drop
+                 * the secondary exception so it can't leak into later evals. */
+                JSValue stray = JS_GetException(ctx);
+                JS_FreeValue(ctx, stray);
+            }
+        }
+        /* A synchronous throw (a missing import, a syntax error) exists only
+         * as the pending exception consumed above, so report it here the way
+         * MIK_Loop reports one it finds pending: handler, dump, stop. Left
+         * unreported, the device idles in silence. A rejected eval promise is
+         * still queued for the loop's rejection flush, which reports it the
+         * same way. */
+        if (!rejected) {
+            if (mik_rt->error_handler_fn) {
+                mik_rt->error_handler_fn(ctx, exc, mik_rt->error_handler_opaque);
+            }
+            mik_dump_error1(ctx, exc);
+            MIK_Stop(mik_rt);
         }
         JS_FreeValue(ctx, exc);
     }

package/src/modules.cpp

@@ -234,8 +234,9 @@ static JSModuleDef* mik_module_loader_inner(JSContext* ctx, const char* module_n
             }
         }
         /* Native module not found — this is a device-only module that isn't
-         * available in the current build (e.g. running on desktop). */
-        JS_ThrowReferenceError(ctx, "Native module '%s' is not available", module_name);
+         * available in the current build (e.g. running on desktop). Same
+         * wording as every other unresolvable specifier (and browsers). */
+        JS_ThrowTypeError(ctx, "Failed to resolve module specifier '%s'", module_name);
         return nullptr;
     }
 
@@ -265,8 +266,7 @@ static JSModuleDef* mik_module_loader_inner(JSContext* ctx, const char* module_n
          * returns JS_UNINITIALIZED from an empty exception slot, and
          * re-throwing that surfaced as a bare "[uninitialized]" error. */
         if (!JS_HasException(ctx)) {
-            JS_ThrowReferenceError(ctx, "Builtin module '%s' is not available in this build",
-                                   module_name);
+            JS_ThrowTypeError(ctx, "Failed to resolve module specifier '%s'", module_name);
         }
         return NULL;
     }
@@ -996,7 +996,7 @@ JSValue mik__load_module_ns(JSContext* ctx, const char* importer, const char* sp
         JSValue p = JS_LoadModule(ctx, importer, specifier);
         if (JS_IsException(p)) {
             /* Propagate the loader's real error (e.g. a syntax error in a
-             * virtual stub), not a generic not-available message. */
+             * virtual stub), not a generic resolution failure. */
             JS_FreeAtom(ctx, name);
             return p;
         }
@@ -1016,7 +1016,7 @@ JSValue mik__load_module_ns(JSContext* ctx, const char* importer, const char* sp
     }
     JS_FreeAtom(ctx, name);
     if (!m) {
-        return JS_ThrowReferenceError(ctx, "Native module '%s' is not available", specifier);
+        return JS_ThrowTypeError(ctx, "Failed to resolve module specifier '%s'", specifier);
     }
     /* 5 == EVALUATED; quickjs.h documents the numbering but exports no enum. */
     if (require_evaluated && JS_GetModuleStatus(ctx, m) != 5) {