Configuration¶

All settings are accessible from Tender's QAM panel. Open the Quick Access Menu (... button), select Tender, and pick Settings from the menu at the bottom of the panel.

The Settings page¶

Settings is a wide page split in two: a list of eight sections on the left, and the focused section's controls on the right. Move onto a section in the list and the right-hand side changes at once — there is nothing to confirm.

Section	What is in it
Connections	the services Tender talks to: RomM (server URL, account, Sign out, Allow Insecure SSL) and SteamGridDB (the API key)
Save Sync	the save-sync switch and its settings (device, before launch, after exit, default slot, history limit, Sync All Saves Now) and the list of registered devices
Controller	Steam Input Mode and Apply to All Shortcuts
Steam Library	preferred region, collection games in platform groups, collection types in Steam names
Emulator sources	every emulator setup Tender found — RetroDECK, EmuDeck, a RetroArch of its own — as a numbered card with its health, Use this source, and arrows to move it up or down
Tender folder	where Tender keeps its own files: the current place, the internal storage, each writable drive with its free space, and Another folder…
Updates	the version you have and the release the last successful check found, an update that was rolled back or refused, the daily update check, and Check now
Interface	whether Tender's Quick Access entry sits above or below Decky Loader's
Advanced	log level

If you used an earlier version, everything is still here — the eight blocks the panel used to stack are grouped into five of the nine sections; Emulator sources, Tender folder, Updates and Interface are new. Registered Devices is now inside Save Sync, the SteamGridDB key is inside Connections, and the section that used to be called Library is now Steam Library: the Library page is about what gets synced out of RomM, this section is about how it looks once it is in Steam.

Signing in to RetroAchievements is not here yet. When it arrives it will live under Connections, with the other accounts.

Getting there from a notice¶

Four of the notices on Tender's main panel are doors into a section, and the action they are about lives only behind that door:

The notice says	Its button	Where it takes you
Cross-device playtime	Open Connections	Settings › Connections
Update to X failed (rolled back, refused, or the installer stopped)	Open Updates	Settings › Updates
Tender X is available	Open Updates	Settings › Updates

The main panel only names the condition, so there is one place to do each of these and no chance of two of them disagreeing. B takes you back to the main panel from anywhere on the page.

Where the sections below say "in Connection Settings", read it as Settings › Connections.

Connection Settings¶

The Connections section manages your RomM server connection.

RomM URL — the full URL of your RomM server, including port if needed (e.g. http://192.168.1.100:8080). Tap Edit to change it and OK (or Enter, or R2) to save it. A URL Tender does not take stays in the window with the reason below it in amber. A URL typed with no scheme at all (no http:// or https:// in front, e.g. romm.example.com or 192.168.1.100:8080) is not saved yet: the field then holds it with https:// in front, and the line under it reads "Added https:// — press OK to save it, or change it to http:// if your RomM answers only on http." Press OK again to save it. Tender does not fall back to http by itself: https is the default because signing in sends your RomM password to this address, and a wrong https only fails where a wrong http would send it unencrypted. Leave any user name and password out of it (https://user:password@host): Tender cannot sign in through the address, and the window says "Tender cannot sign in through a user name and password in the RomM URL — leave them out. Sign in to RomM under RomM Account; a login for a proxy in front of RomM goes into Custom headers." A login your proxy asks for goes into Custom headers instead.
RomM Account — shows Signed in once a token is stored, or Not signed in otherwise. Signing in registers this device with RomM — it appears in RomM's device list — whether or not save sync is on, because the play sessions Tender sends to RomM name the device as well. Tap Sign in to open a one-time prompt. The prompt offers three sign-in methods, chosen from the Sign-in method dropdown:
- Username & password (default) — enter your RomM username and password once. Tender exchanges them for a RomM Client API Token and stores only the token; your password is discarded after the token is minted and never saved. If your account cannot create API tokens, the status reports that.
- API token — paste a Client API Token you created in RomM's web UI. This is one of the two paths for accounts that have no password to mint from, such as OIDC / SSO logins. See Sign in with an API token (OIDC) below.
- Pairing code — the other, recommended OIDC path: instead of copying the token, enter the short-lived 8-character code RomM shows when you Pair a token. Tender fetches the token itself, so nothing is copied or pasted. See Sign in with an API token (OIDC) below.
Both the credentials and the pasted token are write-only — they are never pre-filled or shown back to you.

Once you are signed in, this button reads Sign in again and a Sign out button appears below it (see Sign out).
Custom headers — extra HTTP headers sent with every request to your RomM server. Shows how many are configured, or (none). Only needed when your server sits behind a proxy that authenticates requests itself — see Custom headers for an authenticating proxy below.
Allow Insecure SSL — shown only for https:// URLs; skips certificate checks for a self-signed server. Anyone who can intercept the connection can then read what Tender sends — your RomM token, your password when you sign in with it, and any custom headers — and use your account, so turn it on only on a network you trust. While it is on, every start of the backend writes a warning to its log saying certificate verification is off.

Tender checks the connection for you — there is no manual "Test Connection" button. The Connection row on Tender's main QAM panel shows the live status whenever you open it, and names the problem when it can't connect (for example Sign-in rejected, Server unreachable, No server URL, or Remove login from RomM URL).

Custom headers for an authenticating proxy¶

If your RomM server sits behind a proxy that authenticates requests before they reach RomM — Pangolin, Cloudflare Access, Authelia, Authentik forward-auth — the proxy rejects Tender's requests and you cannot connect at all. A browser gets past it because you logged in to the proxy there; Tender has no such session.

The way through is a header the proxy accepts. Tap Edit on the Custom headers row, add a row per header, enter its name and value, and save. From then on every request Tender sends to your RomM server carries them — including the sign-in itself, since the proxy sits in front of that too.

Where they go. Tender puts them on the requests it sends to the RomM server you configured, and on no other request it sends — they are credentials for your front door. Tender does reach other hosts: SteamGridDB for artwork, and a metadata provider's CDN for a cover image RomM has no local copy of. Neither carries them.

One case is outside Tender's hands: if your server answers with a redirect to a different host, the HTTP library carries the headers along to it, the same way it already carries your RomM API token. That is worth knowing if your RomM URL is plain http://, where anyone on the network between you and the server could insert such a redirect. Over https:// to a server you control it is not a practical concern.

What they cannot be. These names are refused when you save, so nothing you enter can quietly replace a header Tender or its HTTP library already sets: Authorization, User-Agent, Content-Type, Content-Length, Host, Accept-Encoding, Range, If-None-Match and If-Modified-Since.

Authorization is the one worth explaining. Proxy documentation often suggests it — Pangolin documents a Basic-auth Authorization header — but that is exactly the header your RomM API token travels in. One request cannot carry both, so Tender refuses it rather than silently sending one and dropping the other. A proxy built for non-browser clients usually offers a header of its own as well; use that one.

Worked example — Pangolin. Issue a resource access token in Pangolin, then enter its two parts as rows:

Name	Value
`P-Access-Token`	the token Pangolin generated
`P-Access-Token-Id`	the token's id

Save, then check the Connection row on the main QAM panel — it should stop reporting a rejection.

Values are write-only. A saved value is never sent back to the panel: reopening the editor shows each header's name with an empty value field marked •••• stored. Leave it empty to keep the stored value, or type to replace it. Removing a row and saving deletes that header. Values are never written to Tender's log.

Sign out¶

The Sign out button (shown only while signed in) forgets the stored token on this device: it clears the token, its server-side id, its origin, and its provenance from Tender's settings, but keeps the server URL and the SSL setting so you do not have to re-enter them. It asks for confirmation first.

Signing out never deletes or revokes the token in RomM — the token stays valid on the server. A token Tender minted from your username and password can only be deleted during a same-server re-sign-in (the stored token deliberately lacks the permission to delete itself), and a token you supplied (pasted or paired) is yours to manage. To revoke a token for good, delete it in RomM's web UI under Settings › API Tokens.

If you just want to switch accounts or re-authenticate, prefer Sign in again over signing out and back in. For username/password accounts, re-signing in on the same server revokes the token Tender minted before — a path that a sign-out then sign-in cannot take, since sign-out has already forgotten the old token's id. RomM caps the number of Client API Tokens per user, so avoiding stranded minted tokens matters.

If you log in to RomM through an identity provider (OIDC / SSO), your RomM account has no password, so Tender cannot mint a token for you. Instead you create a Client API Token yourself in RomM's web UI and hand it to Tender. There are two ways to do that — pairing code (recommended) and pasting the token — and both grant the same scopes and carry the same warnings (see Required scopes below).

Start the same way for either method:

In RomM's web UI, open Settings › API Tokens (also called Client API Tokens) and create a new token.
Grant the scopes listed below — make sure the write scopes are included. Without them, downloads work but save upload, device sync, and playtime tracking fail with a permissions error.

Pairing code (recommended)¶

Pairing hands the device the token over a short-lived one-time code, so you never copy or type the token itself.

Create the token with the scopes above (steps 1–2).
On that token in RomM's web UI, click Pair. RomM shows an 8-character pairing code, valid for 60 seconds.
In Tender's Connection Settings, tap Sign in, switch the Sign-in method dropdown to Pairing code, enter the code, and confirm — within the 60-second window. Tender exchanges the code for the token itself.

Pairing rotates the token's secret. Exchanging a pairing code hands the device a freshly rotated secret for that token — any raw token value you copied earlier stops working. Use one token per device so pairing a new device never invalidates another.

Paste the token¶

Create the token with the scopes above (steps 1–2).
Copy the token value (RomM shows it only once).
In Tender's Connection Settings, tap Sign in, switch the Sign-in method dropdown to API token, paste the token, and confirm.

Both methods validate the token at sign-in with an authenticated probe against your RomM profile: a wrong, revoked, or expired credential is rejected there with an actionable message. Sign-in only confirms that the token authenticates, though — Tender cannot verify the token's granted scopes, so double-check that you granted the write scopes (assets.write, devices.write, roms.user.write) when creating it. A missing write scope is not caught at sign-in: a token without assets.write or roms.user.write surfaces later as a permissions error on the affected action (save upload or playtime). A token without devices.write cannot register this device: until it is registered, the Saves tab, the save-slot setup and the previous versions say it could not be registered with RomM — see Troubleshooting.

Required scopes¶

Scope	Access	What it is used for
`me.read`	read	Your RomM profile — validates the token at sign-in and reads your RetroAchievements username
`platforms.read`	read	Listing your platforms
`roms.read`	read	Listing and reading ROM metadata (the library)
`roms.user.read`	read	Your per-user ROM data — native play-session history
`collections.read`	read	Reading your collections (user, smart, virtual)
`firmware.read`	read	Listing and downloading BIOS / firmware
`assets.read`	read	Downloading save files
`devices.read`	read	Reading your registered devices (device sync)
`assets.write`	write	Uploading save files
`devices.write`	write	Registering this device and opening device-sync sessions
`roms.user.write`	write	Writing your per-user ROM data — playtime ingest

All eleven scopes are within RomM's Viewer role, so a token created by any account (including OIDC accounts) can carry them. me.write is deliberately not requested — a pasted token cannot mint or delete tokens.

Tender never deletes a pasted token. Signing out and back in, or switching servers, leaves your token untouched on the RomM server — you manage its lifecycle in RomM's web UI. (This differs from the username/password method, where Tender revokes the token it minted when you re-sign-in on the same server.)

Note the reverse case too: if you previously signed in with your username and password and then switch to a pasted token on the same server, the token Tender minted earlier is left behind on RomM — it can only revoke that during a same-server password re-sign-in (it has no password once you switch to a token). Revoke the old token manually in RomM's web UI if you no longer want it.

SteamGridDB API Key¶

Under Settings › Connections, below the RomM group — SteamGridDB is one of the two services Tender talks to.

Tender uses SteamGridDB to fetch additional artwork for your games — hero banners, logos, wide grid images, and the icons beside each game in Steam's library list. RomM provides cover art, but SteamGridDB fills in the rest so your games look like first-class Steam titles.

To set this up:

Create a free account at steamgriddb.com
Go to your API preferences and copy your API key
In Settings › Connections, tap Edit next to API Key under "SteamGridDB" and paste your key
Tap Save — the key is checked against SteamGridDB first, so an invalid key is rejected inline and only a working key is stored

To remove the key, tap Remove beside Edit; it is there only while a key is stored, and the row then reads "Not configured". The artwork Tender already downloaded and the images already set in Steam stay; only new downloads stop.

Without an API key, Tender downloads no hero banner, logo, wide grid image or icon, and no cover from SteamGridDB in place of a missing one; games still get cover art from RomM.

Tender finds a game on SteamGridDB by the SteamGridDB id your RomM server holds for it. How RomM gets those ids, and what to do for a game it has none for, is under Game not found on SteamGridDB.

Steam Input Mode¶

Controls how Steam handles controller input for ROM shortcuts. Found in Settings › Controller.

Mode	Description
Default (Recommended)	Uses your global Steam Input settings. Works well with RetroDECK's default configuration.
Force On	Explicitly enables Steam Input wrapping. Normalizes the controller as standard XInput, which RetroArch autoconfig expects.
Force Off	Raw HID passthrough. Only for advanced users — may break RetroArch menu navigation.

After changing the mode, tap Apply to All Shortcuts to update all existing ROM shortcuts. The button reads Applying to all shortcuts… beside a spinner and stops responding while the run is going — a second tap is refused rather than starting a second pass over the same shortcuts.

The mode lives in Steam's own localconfig.vdf, and the line under the button says when it could not be written there. Nothing is changed for any shortcut in that case:

The line under the button says	What happened
Not applied — no Steam user was found on this device	No Steam user folder was found under Steam's `userdata`
Not applied — Steam's localconfig.vdf was not found	That Steam user has no `config/localconfig.vdf` yet
Not applied — Steam's localconfig.vdf could not be read	The file is there but could not be opened or parsed
Not applied — Steam's localconfig.vdf could not be written	Writing the changed file failed, for example on a full or read-only disk

Preferred region¶

A dropdown in Settings › Steam Library. When a game exists in your RomM library as several regional dumps (versions), this decides which region Tender prefers when it picks the version to bind and the name it gives the Steam shortcut.

Option	Effect
Default (World > USA > Europe)	Prefer World, then USA, then Europe, then Japan, then any other region alphabetically (fixed order)
a specific region (World, USA, Japan, …)	Put that region at the top of the order; everything else keeps the default order behind it

"Default" is a fixed order, not auto-detection. It always prefers World > USA > Europe > Japan (then other regions alphabetically, then dumps with no region); Tender never looks at your language or system region.

The dropdown's options are the fixed anchors — Default, World, USA, Europe, Japan — followed by every other region actually present in the games you have already synced (read from the local database, sorted alphabetically; no server request). If your synced library has no other regions, only the anchors are shown.

When you change it, a short modal explains the effect and asks you to confirm. The choice is saved immediately, but it takes effect on the next sync and only affects games synced from then on. It never switches the version or renames an existing shortcut — shortcut names are fixed when the shortcut is first created, to protect its artwork, collections and playtime. Already-synced games keep their bound version and name; run a sync to apply the new preference to new games. See Multiple versions of a game for the full picture.

Emulator sources¶

An emulator source is a setup Tender can ask which emulators a system offers, which BIOS files they want and where they keep saves: RetroDECK, EmuDeck, or a RetroArch installed on its own (RetroArch (Flatpak) or RetroArch (native)). Tender lists every source it finds as a card, numbered by its place in the order — the number filled blue while the source is switched on, an empty grey ring and a grey name while it is off. Each card holds:

the source's name, with two arrows at the end of its line that move it up or down the order, which is the order the sources are used in; the first card's up arrow and the last card's down arrow do nothing. The card slides into its new place and the arrow you pressed keeps the focus — the other arrow takes it once the source reaches the top or the bottom — so press again to move the source further;
the folder it lives in — left out where the source's own settings file does not name it, and for a RetroArch without a frontend while its settings file is missing, because the folder Tender would show is then only the source's usual place;
what its health says, one line per problem, each led by a warning sign; with none, a green check and No problems found. where Tender read the source's emulator list;
where it could not, Source's emulator list is not established., with a warning sign, unless a line already says why — a problem with ES-DE's systems file, a source not set up yet, or one of the two lines below;
EmuDeck's emulator list cannot be read yet., with a warning sign, for EmuDeck, whose list Tender cannot read yet;
Tender cannot start games through source yet., with an information sign, for every source but RetroDECK — Tender starts games through RetroDECK only, and a game such a source answers for does not start. A RetroArch without a frontend has no emulator list at all, so for it this line stands in place of the "not established" one;
Use this source, under a thin line at the bottom of the card: a source switched off offers no emulators and is never asked about a game. It stays listed, so you can switch it on again.

RetroDECK switched off. Every game starts through RetroDECK, so while RetroDECK is switched off no game starts: pressing Play on a game page, or starting a game from Steam's own library, recent games or a steam://rungameid link, starts nothing and says RetroDECK is switched off in Settings › Emulator sources, and Tender can only start games through RetroDECK yet. Switch it on again and games start as before. Where Tender cannot check the switch — it gets no answer in time, or cannot find out which emulator sources are installed — a dialog titled Emulator Source Unchecked asks Tender could not check whether the emulator source is switched on. Start anyway?: Start starts the game, Cancel starts nothing. While Tender itself is not running, no game starts from Steam's library at all (Starting a game).

A game page that is open while you switch or move a source shows the change at once: its emulators and its BIOS state are read again, and its saves too while save sync is on.

Which source answers for a game. While RetroDECK is found and switched on, a game's emulator, BIOS and save answers come from RetroDECK, wherever it stands in the order, because every game starts through it — even while it has not been set up yet, when it answers that it has not. Without it, the first source switched on in the order answers. A source found for the first time joins the end of the order, switched on.

Sources Tender cannot start games through. The main panel says Source is switched on in Settings › Emulator sources, but Tender cannot start games through it yet. for every switched-on source but RetroDECK, whether or not it is the one that answers, in a smaller card without a warning sign, since nothing is wrong; a source you switched off says it only on its card. Where such a source answers, the platform page and the emulator menu keep saying why there is no emulator list, and a game it answers does not start: its page, its emulator menu and Play say the same sentence.

Problems. Every problem a switched-on source reports also shows as a card on the main panel, named after the source — a RetroDECK that is installed but has not been set up yet (RetroDECK is installed but has not been set up yet. Start RetroDECK once and finish its first-run setup.), a settings file that is missing, unreadable or damaged, a settings file that does not name some of the source's folders (RetroDECK: its settings file file does not name its BIOS folder, so Tender does not use it., all such folders in one sentence, left out where a notice about the settings file already explains them), the source's own folder, its saves folder or its BIOS folder that does not exist (an SD card that is not inserted) — each only where the source's settings name that folder, since otherwise it is only the source's usual place — a ROM folder that does not exist, ES-DE's ROM folder setting that is not a full path, ES-DE's systems file that does not load (ES-DE then shows no systems, and Tender cannot tell which emulators the source offers), EmuDeck's RetroArch settings that cannot be read, or RetroDECK's RetroArch settings file that is missing (RetroArch then uses its built-in default folders). Three kinds stay on the source's card here only: texture packs or mods that do not reach an emulator, which concern nothing Tender does, a RetroDECK settings file whose version alone cannot be read (RetroDECK: its settings file file holds no version Tender can read; its folders are still read from it.), and every problem of a source you switched off. Where Tender cannot get an emulator list, the platform page, the emulator menu and a game's BIOS tab say why — no source found, every source switched off, a broken systems file, a RetroDECK that has not been set up yet, a list that cannot be read yet — rather than showing an empty list.

Tender folder¶

Tender keeps its own files in one folder, Tender/ — today the recovery bundles a cleanup seals. It lies in ~/Tender until you choose another place here. The line at the top names the place in use — In use: Internal storage, In use: SD card · Emulation, or In use: Another folder — with its state, Reachable, or why the folder cannot be used: Not connected, Missing or Not writable; the folder itself is under it.

Below it, one tile per place, two to a row; the tile of the place in use is outlined and marked In use, and pressing it does nothing.

Internal storage, tagged Default, puts the folder back in your home folder, ~/Tender.
Each writable drive mounted under /run/media/<user>/ gets a tile headed by its kind — SD card, USB drive, or Drive for any other — and tagged with its name, and puts the folder at that drive's root. Tender tells the kind from the device behind the mount, and keeps the kind and name with your choice. With no drive connected, a line says to insert an SD card or connect a drive.
Every tile shows the folder it would use and, at its foot, the space free there.
When the place in use is a drive that is not connected, its tile stays, greyed and outlined, with Not connected in place of the free space, and the line at the top still names it by the kind and name kept with your choice.
Another folder…, with the line "Type a path, for example a folder on one of the drives above", opens one window that stays open until a place is accepted. Its text field opens empty, with an example under it, and takes a path you type, starting with / or ~; Tender puts its folder Tender/ inside it. After OK, a refusal is shown under the field with your text kept for correcting. Where the last folder you typed is itself named Tender, the window asks whether you meant the folder above it, and where folders of the path do not exist yet it names them and asks before creating them — both questions in the same window, with their own buttons. Changing the text drops a shown question or refusal. A path on a drive that is not connected is refused. An accepted place closes the window; Cancel closes it with nothing chosen.

A place whose Tender/ would be the folder in use is answered as already Tender's folder, and so is a typed path that names the folder in use itself, such as ~/Tender while it lies there; one whose Tender/ would lie inside the folder in use, or hold it, is refused — all before any question.

A place is refused where Tender/ would lie inside an emulator source's ROM folder or inside the folder a source keeps a system's games in — also where that folder is a link to another drive — or would hold a ROM folder. So is a place Tender cannot write to, and a place you choose while Tender cannot read the emulator sources or a source cannot name its folders; the internal storage is never checked. Choosing a place switches where Tender keeps its files from then on; what lies in the old folder stays there. Where your data lives has the rest, including what Main says when the folder cannot be reached.

A toggle in Settings › Interface: Place Tender above Decky Loader. Where Decky Loader is installed too, both add an entry to the strip of icons down the side of the Quick Access Menu. On (the default), Tender's entry sits above Decky Loader's; off, below it.

It applies only where Decky Loader is installed — without it, Tender's entry sits at the end of the strip either way. A change takes effect the next time you open the Quick Access Menu.

Log Level¶

A dropdown in Settings › Advanced. Controls how much detail Tender writes to its log.

Level	Description
Error	Only errors — minimal output
Warn (default)	Errors and warnings
Info	General operational messages
Debug	Verbose output for troubleshooting

Leave this at Warn unless you're investigating an issue. Switch to Debug when reporting bugs or diagnosing problems.

Updates¶

Tender asks GitHub whether a newer release is out — at most once a day, when Steam loads it and again while it runs, unless you switch the daily check off. When there is one, a notice on the main panel says Tender X is available and names the version you have — a check made while the panel is open brings it up there and then. Open Updates takes you to Settings › Updates, where you can install it, and Dismiss puts the notice away for that version only — the next release brings it back.

Tender also says so in a message that goes by itself — once Steam has finished starting, or as soon as a check while Tender runs finds the release — so you hear of it without opening the panel: Tender X is available. Settings › Updates to install it. Tapping it does nothing. It says it once for each release: reopening the panel, restarting Steam or restarting Tender does not bring it back, and a release you found yourself with Check now does not say it at all. It says nothing while the daily check is switched off, for a release whose notice you dismissed, or while the main panel does not call that release available because an update to it failed (see below) — after the installer went back or refused the new version, that holds even once you dismissed the failure's notice. From the moment you press Install until the install has ended it waits; if the update did not go through, it comes then, unless one of the above holds it back.

While the notice is on the main panel, small blue dots show you the way to the release — on Tender's icon in the Quick Access menu, beside Settings on the main panel, and beside Updates in the Settings list — with the daily check switched off too. Once Settings › Updates has been open for about a second, whether you went there from the list or with Open Updates, the release counts as seen: the dots grow and fade out, and they stay away for that release, also after a restart. Moving through the Settings list past Updates does not count, and neither does closing the menu within that second. Seeing it there also means no message comes for it. The notice on the main panel stays until you dismiss it or install the update; dismissing it takes the dots away too, and so does installing the update. A newer release brings them back.

After an update, once Steam has finished starting, it says Tender updated to X in a message that goes by itself; after installing an earlier version, it says Tender is back on X instead. It says it once: reopening the panel, or restarting Steam, does not bring it back. The main panel also shows a notice, Tender was updated to X. or Tender is back on X., which stays — above the other update notices — until you press Dismiss, or until the Deck restarts (which restarts Tender).

If the new version did not start after an update, and the installer went back to the version you had, a notice on the main panel says Update to X failed — you are still on Y., and under it where the reason is. Troubleshooting says what to look at there. Open Updates takes you to Settings › Updates, and Dismiss puts the notice away for that failed update only; another one brings it back. It also goes away by itself once a later update goes through. While it is there, and after you dismiss it until a later update goes through, the main panel does not also call X available — you have just seen it fail — although a release newer than X brings back an is available notice for that release.

A failed update also says so in a message that goes by itself, once Steam has finished starting, so you hear of it without opening the panel. After the installer went back to the version you had or refused the new version, and after an installer that stopped Tender and then stopped without updating, it says Update to X failed. You are still on Y. Settings › Updates shows why. An install you started from Settings › Updates that fails while Tender runs says what stopped it — Update to X failed. The download failed. or Update to X failed. The installer stopped without updating., for example — and one a game stopped says Update to X was cancelled. A game was started. Nothing was changed. Where the panel was not loaded when such an install failed, the message comes when it next loads, unless Tender was restarted in between. Each failed update says it once: reopening the panel, restarting Steam or restarting Tender does not bring it back, and one whose notice you already dismissed on the main panel does not say it at all.

Settings › Updates shows:

Installed — the version you are running.
Available — the release the last successful check found, in green, None newer when you already have it, or Not known yet before a check has found anything — whether or not the daily check is switched on.
Install update — installs the release Available names; see Installing an update. Try again instead, for a version whose install already failed, was rolled back or was refused. A copy of Tender run from a source checkout says Development build — install updates with the installer. in its place.
Below the versions and the button, one block for what is happening: an install under way, or an update that did not go through. While the installer's note of a rolled-back update, or of one its pre-install check refused, is there and you are still on the version it names, the block says so — Update to X failed — Tender went back to Y. or Update to X failed — nothing was changed. — with the step it failed at and where the reason is, whether or not you dismissed the notice on the main panel. Where the installer ran, Show what the installer said stands under the block; see What the installer said.
Check for updates daily — on by default. Switch it off and Tender no longer asks GitHub by itself; what the last check found stays in Available and can still be installed.
Check now — asks straight away rather than waiting for the day to pass, whether or not the daily check is switched on, and brings back a notice you dismissed. What it found shows in Available; a line under the button appears only when there is more to say: that GitHub gave no usable answer, or that the check failed.

A release counts as out only once its download is attached together with GitHub's checksum for it and the checksum file the installer verifies it against, which happens a few minutes after the release is published; until then Tender says nothing about it. A release whose download comes without a valid checksum, or without that file, does not count as out while either is missing, because it could not be verified.

What the check sends where. When a day has passed since the last check — while the daily check is on, Tender looks when Steam loads it and once an hour while it runs — and whenever you press Check now, Tender asks GitHub's public API for the newest release of danielcopper/romm-tender. The request names the program and its version (for example romm-tender/1.0.0), and GitHub sees your IP address, as it does for any request. Nothing about your library, your RomM server or your accounts is sent. If the check gets no usable answer — you are offline, GitHub is down, or it refuses the request — nothing changes: whatever the last successful check found stays as it was, and Tender tries again once a day has passed.

Installing an update¶

Install update downloads the release, checks it against GitHub's checksum and starts the installer, which replaces Tender and restarts it. It is there for the release Available names, whether or not the daily check is switched on.

The button waits while an update would cut something short, and says what under Waiting for: — a game to close (named), library sync, game downloads, save sync (a slot switch or a save deletion counts too), BIOS downloads, a save directory move, a removed-game cleanup, a RetroDECK migration, or Other Tender work — anything else Tender is in the middle of, such as uninstalling games, removing shortcuts or switching a game's version. Where Steam lists a game as running but Tender cannot tell whether it still is, the list says so — "Steam lists Celeste as running, and Tender can't tell whether it still is. Quit it if it's open; if it has already closed, restart Steam." — and the button waits for it too. Could not check whether a game is running means Tender could not ask Steam, and it waits then too rather than assume nothing is running. An update reloads Steam's interface, and Tender reloads it at most twice in ten minutes; after two reloads the button waits until the time it names. Could not check when Steam's interface may be reloaded means Tender could not check that limit, and it waits then too. The list updates by itself every few seconds, and the button comes back on its own once nothing is left on it. A RetroDECK migration that is only waiting for your answer does not hold the button back: the question is still there after the update. Paused game downloads do not hold it back either — a line under the button says how many there are, because the restart cancels them.

Once you press it, the button says Installing… and a block under it shows how far the install got: what is happening, with the percent of the download and the time since you pressed, a bar, and the four steps Download, Verify, Check the new version and Install, each marked ✓ done, ● under way, ○ still to come or ✕ failed. While it downloads and verifies, the block says Starting a game now cancels the update. — Tender checks once more right before the installer starts, and stops there, with nothing changed, if a game is running.

When the installer has started, it first runs the new version's pre-install check, without stopping Tender: the block says Checking the new version. Once the check has passed, the installer stops Tender and the block says Tender is restarting, with Steam's interface reloads when it is done — usually within a minute, and up to about 5 minutes if Tender has to go back to Y. Tender reports nothing once the installer has started, so the panel tells the two apart by whether Tender still answers. From then on the panel loses touch with the old Tender, which is expected. Once a Tender answers again — the new version, or the one you had if the installer went back to it — Tender's notification Tender was restarted shows, and Tender's panel shows only a note in its place — "Tender was restarted — it reloads Steam's interface once no game is running." or "Tender was restarted — restart Steam to use it again." — followed by The update's result shows after that. (Tender says it was restarted). After the reload or the restart Tender says it was updated, or, if the new version did not answer once started, that the installer went back to the version you had. The check may take up to two minutes; the installer then waits up to a minute for the new version to answer, and up to a minute more for the one you had if it goes back; stopping Tender, saving your data and reloading Steam's interface come on top. Where the new version cannot even be put together, the check stops the installer there: nothing is replaced, Steam's interface does not reload, and the block says Update to X failed — nothing was changed. with Check the new version marked failed and The new version does not start., and the main panel says the update failed (The New Version Does Not Start). While the install runs, Tender refuses to start a library sync, a game download or a save sync.

If Tender is not back seven minutes after the installer started, the line in the block changes: Tender has not come back. when it no longer answers — the line names the journal to read and the command that starts it again — or The installer is taking unusually long. when it still answers and the installer has not stopped it yet.

If the install fails, the block turns amber, says Update to X failed — or Update to X was cancelled, where a game was started or Tender could not check whether one runs — marks the step that failed with ✕ where it was one of the four, and says why, and the button comes back as Try again. Nothing tries again by itself. Where the installer ran — it stopped without updating, or refused the new version — Show what the installer said stands under the block. An update from Settings did not go through says what each failure means and where to read more.

What the installer said¶

Show what the installer said is under the failure block in Settings › Updates wherever the installer ran: an update it went back from, one its pre-install check refused, and one where it stopped without updating. It is not there for a download that failed, a checksum that did not match, an installer that could not be started, or an update a game cancelled — the installer did not run for those, and Tender's log, backend.log, says why.

It opens a window titled What the installer said, which says Reading what the installer said… until Tender has the answer; pressing the button again meanwhile opens no second one. Where there is output, the title carries the time the installer ran, and The installer shows that installer's output — the run that belongs to this failure, not the latest one if the installer has run again since. After the installer went back to the version you had, a second part, X, when it tried to start, shows what the new version printed between the installer starting and going back — where the reason usually is, since the installer itself only says that the new version did not answer. The installer prints a line each time one of its steps — Checking, Installing, Service, Steam — gets further, and the window shows each step the installer reached once, in its last state: how the step ended, or, for a step the installer was cut off in, how far it got. Each part shows its last 300 lines and says how many earlier ones it leaves out, and a line longer than 500 characters is cut. Tender's own address, which the new version prints with the key that lets the panel in, shows that key as [hidden]. A step that failed and the installer's own failure lines are amber, a step done green, and a step under way grey. Move down through the lines with the D-pad, and press Close to go back.

Tender reads this from the Deck's system journal. Sometimes there is nothing to show, and the window says why instead, with no time in its title:

This output is no longer in the system journal — it keeps only the last hours of logs. The journal keeps a fixed amount for everything on the Deck, so older output is gone.
This update was run in a terminal, so its output is there, not in the journal. The installer ran by hand, so its output went to that terminal.
The installer left nothing in the journal for this update. Tender started the installer, and the journal, which still reaches back that far, holds nothing from it — it may never have started.
This failed update is no longer on record. The failure went away between the block showing it and the press — a later update went through, or a new install started.
Tender could not read what the installer said. The journal could not be read, or Tender did not answer.

Previous: Getting Started | Next: Syncing Your Library