# Browser-play fixture

`minimal-ines.base64` decodes to a deterministic 16-byte iNES header with one declared PRG bank and no copyrighted program data. Tests use it only to prove the allowlisted `.nes` format boundary; it is intentionally not a playable commercial game.

`playable-nrom.nes.gz.base64` is a gzip-compressed, deterministic 24,592-byte
iNES/NROM-128 cartridge created specifically for Ludarium. Its original 6502
program initializes the PPU, selects a blue backdrop and loops forever; the CHR
bank is empty. It contains no third-party game code, graphics, audio or data.
The decompressed SHA-256 is
`6b87142fb0a7e125b13c5fcd7afa8b13066a44bc97150d24ade8bd2d0e5fd5e7`.
The live browser-play gate materializes it only below isolated candidate
appdata and mounts that directory read-only.

Browser-play integration tests create the decoded bytes in an isolated temporary read-only fixture root. Executable, script, traversal, oversized and unsupported requests are generated separately and must fail closed.

`generate-fixtures.mjs` deterministically creates original, minimal fixtures for
SNES, GB, GBC, GBA, N64, NDS and PSP. They contain only headers and an architecture-specific
infinite loop authored for Ludarium; there is no third-party game program, artwork, audio,
firmware or BIOS. A fixture is not sufficient to enable a core by itself: the candidate gate
must still prove a local core canvas, scoped Range delivery and non-empty savestate capture.
The generator refuses output if any pinned SHA-256 changes. The N64 fixture additionally embeds
libdragon's open-source IPL3 compatibility bootcode from commit
`35f85a0797324a5ed0c723203e33ab3c1da94fdd` under the Unlicense. It remains a negative fixture:
the bundled Mupen core did not complete the live gate, so Ludarium continues to fail closed for N64.

The positive N64 release gate downloads Mupen64Plus' own GPL-licensed 2008 demo ROM from the
historical `mupen64plus-core` commit `57d08111ae9e95938c43ec160ac9b5a50f9da089`.
The compressed SHA-256 is `9dbe0a7b4d2473060a1745c0424abad5278d40f2ff99995a4142bb07286183af`;
the 1,048,576-byte `.v64` SHA-256 is
`b5fe9d650a67091c97838386f5102ad94c79232240f9c5bcc72334097d76224c`.
It is materialized only below isolated candidate appdata and proves N64Wasm WebGL startup,
capability-scoped delivery, state capture, cancellation and evidence-bound restore.

The PSP fixture is an original open homebrew program in `psp/main.c`, built as `EBOOT.PBP`
with the official `pspdev/pspdev` container pinned to
`sha256:c1dd948b190e9141242cf321316eb2b54562b274c9be78e24a66fe6d30a5dc24`.
`SOURCE_DATE_EPOCH=0` and gzip `-n -9` make the checked-in payload reproducible. The PBP is
130,008 bytes with SHA-256 `2ff952ec933c67ee6911049d77201da572aa7241e3f2ee7ff935ed61646964f4`;
the compressed file SHA-256 is `6e405203a2bab4a7ab3d705e0b937d2ecc8350489f051dbfb58d194e577b02f4`.
It contains no Sony firmware, keys, SDK data or commercial content.