@@ -0,0 +1,79 @@
+# RustyNES v2.9.0 — "Survey"
+
+The first release of the v2.9.x line that [ADR 0041](https://github.com/doublegate/RustyNES/blob/main/docs/adr/0041-hardware-release-is-v3.0.0.md) put before the SuperStation One core (**v3.0.0**). The v2.7.x and v2.8.x lines acted on four AI-written audits of the codebase. This release checks that work: all four scopes were audited again against the tree those lines left, by Claude subagents working read-only, one per scope. They re-verified **139 ledger rows, and none had regressed**. They also found **39 new defects**, the release's own work found three more, and review of the release pull requests found eleven more. Every one is fixed with a test that failed first and a mutation that the test catches, or recorded in its ledger with a reason. The reports are committed verbatim beside the originals in [`docs/audits/`](https://github.com/doublegate/RustyNES/tree/main/docs/audits).
+
+**No hardware has run any bitstream**; that is v2.9.2's subject.
+
+## A Power Cycle no longer erases your save
+
+Power-cycling (F3, or the menu) rebuilt the cartridge with all of its RAM cleared, battery-backed RAM included. That was harmless until v2.7.3, when the desktop began writing a game's battery RAM to a `.sav` whenever it changes. From then on, the next write after a Power Cycle replaced the player's save with zeros. Mobile, which keeps saves since v2.7.4, had the same defect. Battery RAM now survives a power cycle, as it does on a console. The full test-ROM suite is unchanged by it.
+
+Found on the way, and decided by the maintainer:
+
+- **Power-on movies start from cleared save RAM**, so a movie replays the same whether or not a save exists. v2.7.3 had recorded the opposite as a known limitation, and it was wrong in the other direction. The cleared RAM never reaches your `.sav`: a movie session writes any pending save first, then leaves the file alone until the ROM is reloaded.
+- **Opening TAStudio restarts the game from power-on.** A project exports as a power-on movie, but the editor anchored its first frame on the running game, so an exported movie replayed from somewhere else. It will not open while a movie is playing or recording, or under netplay.
+- **Netplay peers start from the same save RAM again.** The session start is a power cycle, which this release made keep battery RAM, so each peer would have begun with its own save. Sessions now start from cleared save RAM, as they did before, and the cleared RAM never reaches your `.sav`.
+
+## Crafted files no longer crash the app or exhaust memory
+
+- **HD packs.** A malformed `<overscan>` line crashed the app on every frame. `hires.txt` was read with no size limit: a 509 KiB zip took the loader past 500 MiB. HD-audio tracks had no length limit and were decoded once per declaration: one small file declared four times held 2.6 GiB. All three are bounded now, including the audio held before resampling.
+- **Patches.** A 27-byte BPS patch sitting beside a ROM grew the output to 1 GiB before failing. It now fails at the first action that exceeds the size the patch declares.
+
+## The Lua sandbox, closed again
+
+- **Finalizers.** A script's `__gc` finalizer ran with Lua's debug hooks switched off, so the per-frame instruction budget could not stop an endless one, and pressing Stop hung the app a second time. Scripts can no longer install one.
+- **Pattern matching.** `string.find`, `match`, `gmatch` and `gsub` run in C, where the budget cannot see them, and one backtracking pattern hung the app. They are now a Rust version of Lua's own matcher that charges its work to the budget, and `gsub`'s output is capped at every append. Across 145 cases its results and error messages match the C library's. It is derived from Lua 5.4's MIT-licensed `lstrlib.c`, and says so in the file header, `NOTICE` and `docs/originality-and-provenance.md`.
+- **Host memory.** The 64 MiB script heap limit did not cover strings a script hands to the host: 128 calls held a gigabyte. Every such path now has a limit.
+- **Stop.** Stopping a script now cancels its queued network requests. Loading the next script could previously freeze the window while they drained.
+
+## Save states refuse bad input cleanly
+
+- **A failed load leaves the game exactly as it was**, in RetroArch too. v2.7.4 made the desktop's Load State all-or-nothing, but the path the libretro core uses for every load was not.
+- **A two-screen Vs. cabinet restores both consoles or neither.**
+- **Crafted states can no longer freeze or crash the emulator** through out-of-range clocks, GTROM banks, a BS-5 DIP setting or the FDS sound counter.
+- **Eleven multicart boards no longer crash on an undersized ROM.** Images that already ran are unchanged.
+
+## The libretro core
+
+- **Only a cartridge with a battery gets a `.srm`.** 581 images in the local test corpus got one without a battery. An existing `.srm` for such a game is no longer read or written; it stays on disk.
+- **Famicom Disk System games keep their in-game saves**, in the same file the desktop uses. The Disk Control menu names each disk side.
+- **Vs. System games get their palette, DIP defaults, a coin button (L) and a service button (R).**
+- The memory map follows `libretro.h`'s rules, a save-state buffer smaller than the reported size is refused, the Four Score option survives a core restart, and the repository's `.info` is corrected. The upstream `.info` is updated at v3.0.0.
+
+## The MiSTer core
+
+- **The off-die build boots without the menu core.** The framework reports the SDRAM's size only if the menu core measured it since power-on. An autoboot (`bootcore=`) therefore left the off-die build in reset forever, with 128 MB fitted. The core now tests the memory itself when the framework has not answered. The probe writes two complementary patterns before reading either back, so an empty socket whose lines still hold the last value driven cannot pass it. It also refuses a 32 MB board, whose memory has one column bit fewer than this core's cartridge needs; the SuperStation One's 128 MB is unaffected.
+- **The off-die ROM download no longer loses bytes.** At full rate the bridge lost 164 of 512 bytes without reporting them. The core now tells the framework to wait while its write slot is full, and during the memory's power-up.
+- **The SDRAM read timing was checked at the wrong edge.** A hold constraint moved the check one clock early, so v2.8.4 reported +12.822 ns of hold margin where the real figure is **+1.181 ns**. That matters at v2.9.2, whose clock-phase tuning trades hold for setup. The path is now reported by name after every off-die compile, and a hold slack larger than one clock period fails the build check.
+- **NES 2.0 headers are read correctly.** A correct NES 2.0 image of mapper 71 was accepted as mapper 7. Images larger than the build's cartridge memory, MMC1 boards over 256 KiB of PRG, and images with a trainer are now refused with an on-screen message rather than loaded wrongly.
+- **The SDRAM tests run everywhere.** Four module gates that closed v2.8.4's fixes ran in neither the co-simulation ladder nor CI. Both run them now, with the new probe and header gates.
+- **SuperStation One.** This core needs its own `yc.txt` line, `RustyNES_60.1=183251937963`, because its video clock is six times the colour subcarrier rather than the NES core's twelve. [`HARDWARE_TESTING.md`](https://github.com/doublegate/RustyNES_MiSTer/blob/main/docs/HARDWARE_TESTING.md) now says so, and corrects its DIP-switch, encoder, scandoubler and power guidance.
+
+## Decided for v3.0.0
+
+[ADR 0042](https://github.com/doublegate/RustyNES/blob/main/docs/adr/0042-v3-removes-the-v2-7-5-deprecations-and-the-dead-nmi-edge-detector.md) records the maintainer's decision. v3.0.0 removes the items v2.7.5 deprecated and the dead NMI edge detector, whose two fields are in the save-state format, and renames `LockstepBus`. Nothing is removed in v2.9.x. The v2.7.4 mobile device checklist moves to its own release, v2.9.3.
+
+## Verification
+
+| Check | Result |
+| --- | --- |
+| `cargo test --workspace --features test-roms` | 2,811 passed, 0 failed, 20 ignored |
+| AccuracyCoin / nestest | 144/144 / 0-diff |
+| fmt, clippy (every feature set, wasm), rustdoc, no_std build | clean |
+| Co-simulation, on-die | 171 passed, 0 failed, 1 expected failure |
+| Co-simulation, off-die (`USE_SDRAM=1`) | 172 passed, 0 failed, 1 expected failure |
+| Quartus 17.0.2, seed 5, on-die | setup +0.122 ns, hold +0.080 ns; 22,508 ALMs, 468 RAM blocks, 33 DSP |
+| Quartus 17.0.2, seed 5, off-die | setup +0.141 ns, hold +0.119 ns (SDRAM read hold +1.182 ns); 22,635 ALMs, 84 RAM blocks, 33 DSP |
+
+Each co-simulation figure is one uninterrupted run of the ladder from a clean checkout, plus the 16-gate blargg instruction battery run separately in that checkout with the ladder's own command. The off-die figure was re-run after review changed the SDRAM probe and presence floor (sibling `d34c28b`). The on-die run predates that change and still stands: the RTL review changed is either off-die only or in `emu.sv`, which no co-simulation includes, and every module gate it touches was re-run. The ladder skipped the battery because its oracle path pointed at a pinned clone that does not contain those ROMs; the ROMs used are byte-identical to the pinned commit's. Both bitstreams were recompiled after review changed the SDRAM probe and presence floor (sibling `d34c28b`), and both close. Setup margin fell from v2.8.4's +0.414 ns (on-die) and +0.270 ns (off-die) at the same seed, as it can when the RTL changes under a pinned seed; the seed sweep is v2.9.1's.
+
+**Next:** v2.9.1 (optimisation and the final seed sweeps), then the board at v2.9.2.
+
+## Install
+
+- Download the pre-built binaries for Linux, macOS, and Windows below.
+- The MiSTer core bitstreams are attached below: `RustyNES_MiSTer-v2.9.0.rbf` (on-die) and `RustyNES_MiSTer-v2.9.0-offdie.rbf` (cartridge in SDRAM; its name is provisional until v3.0.0). Neither has run on hardware.
+- The WebAssembly build is live at [doublegate.github.io/RustyNES](https://doublegate.github.io/RustyNES/).
+- The RetroArch core is in RetroArch's Online Updater on the platforms the libretro buildbot publishes to.
+- The re-audit reports and ledgers are in [`docs/audits/`](https://github.com/doublegate/RustyNES/tree/main/docs/audits), and the plan is [`to-dos/plans/v2.9.0-survey-plan.md`](https://github.com/doublegate/RustyNES/blob/main/to-dos/plans/v2.9.0-survey-plan.md).
+- Licensed under GPL-3.0-or-later.
@@ -545,6 +545,15 @@ jobs:
       # every PR rather than only on a full run.
       - if: runner.os == 'Linux'
         run: cargo test -p rustynes-mappers --no-default-features
+      # v2.9.0 — the same gap, for `av-record`. The `full` clippy step in `lint`
+      # has always LINTED it, and nothing ran it: `src/av_record.rs` is compiled
+      # only with the feature, so its 13 tests, and the av-record-gated paths in
+      # `app.rs`, `emu.rs` and `ui_shell.rs`, were invisible to every test job.
+      # Measured before adding this: 614 lib tests pass with the feature on.
+      # The whole lib rather than the one module, because the gated code is
+      # spread across four files. Linux only, for the same reason as above.
+      - if: runner.os == 'Linux'
+        run: cargo test -p rustynes-frontend --lib --features av-record
 
   test-roms:
     name: test (test-roms feature)
 
@@ -22,3 +22,9 @@ to-dos/archive/
 # that fed them — reference, not maintained prose, kept exactly as authored
 # (like ref-docs/).
 to-dos/plans/
+
+# The v2.9.0 re-audit reports: AI-written audit records kept EXACTLY as the
+# agents wrote them (docs/audits/README.md -- a report states findings, the
+# ledger beside it records what was done). Lint-fixing them would mean editing
+# the record; their ledgers are linted like any living doc.
+docs/audits/v2.9.0-*-reaudit.md