emulators.xemu.Xemu

Provider key, xemu.

On; with the ROM cache enabled, launch boots a local copy of the ROM.

Human-readable name.

Bootable disc formats, .iso only.

The emulator log file.

True; prepare_restore empties the staging dir and _clear_stale_saves empties the title's trees on the image.

SIGTERM grace before SIGKILL (env XEMU_STOP_WAIT, default 15).

The HDD image xemu mounts, resolved once per session.

Host-side directory the dump and restore read and write.

The image's parent directory, which the save subtrees hang off.

The staging directory name, scoping dump and restore to it.

Resolve the HDD image and staging directory for this session.

Remove the staging directory and everything under it, logging a failure.

Stop xemu, recording whether it had to be killed rather than asked.

QEMU flushes the HDD image on the clean shutdown SIGTERM starts and not on SIGKILL, so an escalation leaves the image holding whatever happened to be written through when the process died. The post-close extraction reads that same image seconds later and cannot tell the difference on its own, so the escalation is recorded here for it.

Pre-launch hook: empty the launched title's save trees on the image.

The HDD image outlives the session. prepare_restore empties the host side staging directory, but nothing empties the image itself, and _inject_saves only writes the files the incoming archive names. So whatever the last player left under this title survives every file the archive does not overwrite: readable by this player from inside the game, and swept back out by _extract_saves at exit into this player's archive, where it overwrites what RomM held for them.

The sweep is scoped to this title's directory under each top level save directory, which is exactly what the exit extraction reads back, so nothing this session can archive is left holding another session's data. It stops there: another title's directory is not in this session's dump, and the dashboard's own TDATA is what the image needs to boot. Without a title id there is nothing to scope to and nothing is cleared, which is safe here because that session archives nothing either (see _save_roots).

The roots are resolved here rather than through _save_roots because the two want opposite answers for the same disk. A top level directory that is missing means the extraction cannot know the save set and has to report a failure, while for a clear it means there is demonstrably no save data to leak, which is a clean zero. Reusing it would make the first session on a freshly formatted image look like a failed clear.

Only the files go. The directories stay, both because an empty tree contributes nothing to an extraction and because _inject_saves matches its path components against the directories already on the disk, which is how an archive whose case differs still lands in place.

Pre-launch hook: write every staged file into the FATX E partition.

Hidden entries and symlinks in the staging dir are skipped. Directory components are matched case-insensitively against the disk so an archive whose case differs lands in the existing directory.

A failed injection is reported apart from an empty one rather than as another zero: the two look identical to the caller, but a session whose restore never reached the image must not archive over the player's saves at exit, and one that simply had nothing to restore may.

The partition directories this session's saves live under.

Copy every file under roots out of the image into dest.

Put a finished extraction in place as the staging directory.

Post-close hook: copy the title's save data out of the FATX E partition.

The extraction runs into a scratch directory and is swapped over the staging one only once it has finished. The dump ships whatever staging holds, so clearing it up front would turn a failed read into an empty archive uploaded over the title's real saves; leaving the session's restored files in place instead means the dump finds nothing newer than the launch baseline and uploads nothing at all.

An extraction that finds nothing is treated the same way: swapping the empty result in would drop whatever the activate restored into staging earlier in the session, which is the one copy of the player's saves the broker still holds. Reporting zero and leaving staging alone costs at most a session of progress; the swap costs the save.

Files land carrying fresh mtimes, so that baseline filter ships all of them: the archive is the title's complete save set, not a delta. Without a title id nothing is extracted; see _save_roots.

The disc image to boot for path.

Get the image and staging dir ready before the archive is extracted.

Stops anything holding the image, makes sure it is raw, and empties the staging dir: leftovers from the previous session's dump would otherwise mix into the injection, and the newer-file guard could skip archive members over them. Marks the restore pending so the next launch injects what lands.

Declare what xemu takes: the title's UDATA and TDATA trees, and nothing else.

FATX names are 42 bytes at most and compare without regard to case, so the spec carries both facts for the shared name and clash checks.

File one declared save file under the session's title.

Take the session's title from the disc's certificate, then from RomM's Xbox id.

RomM's id names the session for the routes that report it, but not for an import: place_import places a save only under a title id the disc itself gave, since that is the only one the clear and the dump scope to.

Inject any restored saves, pin display settings and boot the disc.

Stop xemu and stage the launched title's saves for the dump.

A failed extraction leaves the staging directory alone rather than emptying it, so the dump uploads nothing instead of an empty archive over the title's real saves. A session whose restore never reached the image is not extracted at all for the same reason: the disk holds the pre-restore save set, and archiving that would overwrite the player's own with an older one.

A forced exit is reported rather than allowed to skip the extraction. SIGKILL costs the guest's unflushed writes, so what comes off the image can be stale, but it is still the only copy of the session and the dump's newer-file baseline keeps it from replacing anything untouched.