isn't removing a retail cartridge crashing the game too ?
removing a cartridge while playing is not the way to test if "gateway is running code on the console". It's just that the game is running on the console and crashes when the hardware containing the game's data is removed.
I've read a comment once (don't remember who said that) saying that redirecting game access from cartridge to SD would be easy.
I don't know if it's really easy or possible, but if emulators can load from a file why not the console? there are probably hardware checks (like voltage, eeprom size, etc.) but it can be patched?
In order to do this, I believe, a redirect is needed. But as you stated there are chcksums that need to pass first. Maybe verify the checks, apply the redirect to sd, and echo the answers the checksums are looking for. Just brainstorming......