minimal-ines.base64 decodes to a deterministic 16-byte iNES header with one declared PRG bank and no copyrighted program data. Tests use it only to prove the allowlisted .nes format boundary; it is intentionally not a playable commercial game.

playable-nrom.nes.gz.base64 is a gzip-compressed, deterministic 24,592-byte iNES/NROM-128 cartridge created specifically for Ludarium. Its original 6502 program initializes the PPU, selects a blue backdrop and loops forever; the CHR bank is empty. It contains no third-party game code, graphics, audio or data. The decompressed SHA-256 is 6b87142fb0a7e125b13c5fcd7afa8b13066a44bc97150d24ade8bd2d0e5fd5e7. The live browser-play gate materializes it only below isolated candidate appdata and mounts that directory read-only.

Browser-play integration tests create the decoded bytes in an isolated temporary read-only fixture root. Executable, script, traversal, oversized and unsupported requests are generated separately and must fail closed.

generate-fixtures.mjs deterministically creates original, minimal fixtures for SNES, GB, GBC, GBA, N64, NDS and PSP. They contain only headers and an architecture-specific infinite loop authored for Ludarium; there is no third-party game program, artwork, audio, firmware or BIOS. A fixture is not sufficient to enable a core by itself: the candidate gate must still prove a local core canvas, scoped Range delivery and non-empty savestate capture. The generator refuses output if any pinned SHA-256 changes. The N64 fixture additionally embeds libdragon's open-source IPL3 compatibility bootcode from commit 35f85a0797324a5ed0c723203e33ab3c1da94fdd under the Unlicense. It remains a negative fixture: the bundled Mupen core did not complete the live gate, so Ludarium continues to fail closed for N64.

The positive N64 release gate downloads Mupen64Plus' own GPL-licensed 2008 demo ROM from the historical mupen64plus-core commit 57d08111ae9e95938c43ec160ac9b5a50f9da089. The compressed SHA-256 is 9dbe0a7b4d2473060a1745c0424abad5278d40f2ff99995a4142bb07286183af; the 1,048,576-byte .v64 SHA-256 is b5fe9d650a67091c97838386f5102ad94c79232240f9c5bcc72334097d76224c. It is materialized only below isolated candidate appdata and proves N64Wasm WebGL startup, capability-scoped delivery, state capture, cancellation and evidence-bound restore.

The PSP fixture is an original open homebrew program in psp/main.c, built as EBOOT.PBP with the official pspdev/pspdev container pinned to sha256:c1dd948b190e9141242cf321316eb2b54562b274c9be78e24a66fe6d30a5dc24. SOURCE_DATE_EPOCH=0 and gzip -n -9 make the checked-in payload reproducible. The PBP is 130,008 bytes with SHA-256 2ff952ec933c67ee6911049d77201da572aa7241e3f2ee7ff935ed61646964f4; the compressed file SHA-256 is 6e405203a2bab4a7ab3d705e0b937d2ecc8350489f051dbfb58d194e577b02f4. It contains no Sony firmware, keys, SDK data or commercial content.