The installer reads the version the system states in its own file,
without running anything: batocera.version, recalbox.version (a release
only), RetroBat's system/version.info, VERSION_ID in os-release on Lakka
and EmuELEC. When it differs from the version the list was built for, a
line says so before the install and again with the result, and the new
version event carries it for the screen. An unknown version says
nothing, and the install never stops on it.
install/<platform>.json wrote the constant "1.0" as the version of the
list it was built from. The manifest now carries the version the platform
YAML records, and generate_pack refuses a YAML without one.
inherits: no longer passes a parent's version to a child: Lakka was
published as RetroArch v1.22.2 in its manifest, pack name and site page.
lakka.yml records v6.1, the Lakka-LibreELEC tag its target list is read
at. The MiSTer scraper refuses a BiosDB without a timestamp instead of
writing an empty version.
A pack's manifest.json records list_version, so an install from the pack
alone knows it too. Manifests regenerated twice and compared: only
version and generated changed.
The run header, the menu, its game data split and g, the plan, the
screen's plan and game data row and both results now divide one tally
of the list the run keeps. Case variants were counted on the run and
missing from the screen's split, g counted the whole list under a head
narrowed by c, and the result left out the data tree files. The wiki
examples come from real runs of 2026-10-27.
Ubuntu 24.04 blocks the unprivileged user namespaces bubblewrap needs, so the campaign refused to run the fake cores and four FakeCorePasses tests failed, also inside the no-jsonschema replay. CI now installs bubblewrap, lifts the AppArmor restriction and proves a sandbox starts. Locally the tests name the missing sandbox instead of failing on a KeyError.
One table of roles from the 16 basic colours (accent, success,
warning, failure, muted, strong, selected) read by the full screen and
by the end of a line-mode run. Status words take their role from one
pattern table, the text never changes, and colour is off with NO_COLOR,
TERM dumb or unset, a terminfo entry naming fewer than 8 colours, or an
output that is not a terminal.
Colour goldens keep the escape codes, and a test strips them back to
the text goldens.
--offline given with the variable set is named as the option, and the
runs the screen starts get it only when the user gave it. The first
install page stays under its 400 words, the 3.8 runs skip only the
pack test that needs generate_pack.
The options and environment tables say what --no-input finds and when
it stops, and how the words name RETROBIOS_INSTALL_OFFLINE. A test holds
the options screen to leave out parallel downloads offline.
Long messages scroll with their position, a small window says why the
questions come line by line, one bar rule per width, the folder a
config names sits under it and wraps whole, the help while typing a
filter lists what does not type, the plan names --core and --region,
pc finds the computer setups, rows keep sizes near their names, a
partial result counts once, a quit is said as one, the WSL browser
names drives by letter and No connection names the pack.
A full or read-only card is freed or unlocked, checked again first,
never left for another drive. Line mode names --dest where it said
choose another one, numbers out of range, the folder copied from, the
frontend's save directory and the command after Enter. The words name
RETROBIOS_INSTALL_OFFLINE when it, not --offline, made a run offline.
The installer knew BIOS files from game data and no count showed it.
The plan, the line menu and the result count them apart for a list that
marks game data, the plan gets a game data row and the menu a g key,
each toggling it in one press, and one sentence says what game data is.
A Termux run named /sdcard and /storage/emulated/0 for one storage, read
saves/<core> as a folder, split a backup path and the restore command
inside their words and named no folder for missing game data. Paths are
spelled as the BIOS folder was named, folders per core are said in
words, the result keeps paths and commands whole, and the game data line
names the folder it goes in.
Started with no job-control shell, a Ctrl-Z stopped the screen and its
launcher for good. The key now stops it only when its process group is
a shell's job, and the bar says why otherwise.
The MinUI family's lists record cores and regions and no system: every
narrowing was refused with a remedy that fetched the same list. Each
option is now refused by the axis missing, with what works, and a pack
names its platform's list only when that list records the axis. Line
mode names what c chooses and skips a question with one answer, and
Options leaves out parallel downloads when nothing is downloaded.
RetroArch's folder question numbered a Batocera SHARE drive and filled
its root. A drive is now offered by its own system's BIOS folder, one
nothing names by its bios folder, and another system's is left out and
named with the options that reach it. A list or pack card setups read
too opens on those setups, in both modes.
Pack and list paths with a control character are refused, the names a
list records, card labels, folders and events pass one filter, and a
folder a configuration names with one is not taken.
A KNULLI card renamed in its menu was read as a Batocera SHARE drive.
KNULLI is now named by about.info first, Batocera by its own hostname,
and a drive two systems fit is said instead of guessed. Runs without
questions see mounted cards as the screen does and stop on two setups.
The card marker table of the wiki is generated.
A step marked github_token: true receives the token. autorun accepts the key only on check_freshness.py, refresh_stale.py and python -m scripts.scraper.* tracked in this repository, refuses it on any other step and in the campaign job. The nightly steps declare it.
The site tests read the SHARE drive label and the line-mode wording
from the source, and the pack-systems test needs generate_pack.py,
which needs Python 3.9.
The rules lived only in the local commit-msg hook, which CI and other clones do not have, so autorun could only check a subject's shape there. scripts/commit_rules.py now holds them, the hook calls it, and autorun checks every job subject with it when the job list loads.
A pack's system titles, names and ids are read only without control
characters, and the systems list and the same-choice line go through
screen_text. The --yes row of the option table says it implies
--no-input.
Answers code_audit_17 and tui_audit_10: the folder found after o, SHARE
drive roots, one same-choice command, a counted confirm step in line
mode, counts from the narrowed list, read-only advice without sudo,
systems recorded in packs, Ctrl-Z stopping the whole job, and the
wording, layout and docs items.
Host git only fetches into bare mirrors no sandbox ever sees, https only, with no user or system config and overrides emptying hooks, fsmonitor, ssh and proxy commands and every filter driver the mirror defines. Each build is a git archive of the commit and of each submodule commit from its own mirror. Old working-tree clones are deleted. The core copied out must be a regular file inside the build folder, opened without following links.
make runs on a git archive export of the commit and its submodules, the clone and its .git never bound into the sandbox. Host-side git runs with no user or system config, no hooks, no fsmonitor and the file and ext transports refused.
Without a working bubblewrap the pass is refused and nothing third-party runs, probes require the sandbox and builds are refused, unless --allow-unsandboxed is given. A job report holding an alert raises an autorun alert.
bwrap now binds only /usr, the /lib* and /bin links and the files of /etc the loader, fonts, TLS, the clock and user lookups read. Home, /tmp and /mnt are empty, the core, content and staged system directory read-only, the scratch folder the one writable path, every namespace unshared. --require-sandbox refuses to run without it. The worker imports nothing from the repository.
core_probe starts its worker with only the --env values, the worker clears its own environment before loading the core, and a working bubblewrap runs it with a read-only tree, no network and the user's credentials masked. The record names the isolation used. A timeout kills the whole process group. campaign.py starts core_probe, git, make and romfetch with the allowlist, make inside the same sandbox. --record refuses a folder that is not a checkout root.
Every step, gate and recomputation runs with an allowlisted environment (PATH, HOME, LANG, LC_*, TZ, TMPDIR and the variables its env: key names). Names holding TOKEN, SECRET or PASS are dropped and refused in the registry. Only the push and the gh calls that read CI get GITHUB_TOKEN.
campaign.py takes buildbot nightlies (or a build of the pinned commit), the test content of tests/campaign/content.yml through romfetch, and runs core_probe for the files, boot, path, alias, variants and bench checks. A fixed rule table settles hle_fallback, required, path and aliases with the record ids as evidence, the rest goes to measurements/findings.jsonl. Resumable state, load, disk and budget guards, retries, content reference counting with an LRU cap, and an autorun job after the nightly.
The runner carried its own copy of the refused vocabulary, which put those words in a tracked file. It now runs the commit-msg hook on each job's subject when the job list loads, and checks only the shape where no hook exists.
Runs the jobs of automation/jobs.yml under one host lock, with load and disk guards, one idle retry on a host misread, artifacts computed twice, explicit-path commits in .cache/autorun/worktree, an opt-in push (--push) and a CI circuit breaker. First jobs: nightly refresh chain, large-files asset dry run, disk cleanup and check, weekly bios integrity. install-timers writes systemd user units without enabling them.
--findings FILE takes a check_freshness.py --json report written earlier, kept to the --only areas, so one full check can drive a refresh of a few areas.
The TERM probe test answers the setup question, first-install keeps
its button name on one line and under 400 words, and --page of the
installer doc script is named on the page.
Each line of measurements/<emulator>.jsonl now holds the whole run:
every repetition, core logs, per-frame hashes and raw timings. The gzip
data files, the data schema and the split and join code are gone, and
core_probe --record appends one line. record_version moves to 3.
The seven records are rewritten once: each new line equals its old line
joined with its data file, and rebuilds the first-layout file its id
hashes.
Abdessamad Derraz