Captured baseline FPS + sample-based hot-function breakdown across
6 ROMs (yarc, jagniccc, Iron Soldier 1/2, Doom, Skyhammer) on
Apple Silicon.

Result contradicts the assumptions in spikes #123 (OP) and #124
(blitter):

  yarc.j64        -> GPUExec ~74% of frame time
  Iron Soldier    -> DSPExec ~67% of frame time
  Skyhammer fast  -> GPU+DSP ~57% of frame time, blitter <2%
  Skyhammer acc   -> blitter ~21%, but only on opt-in accurate
  OP              -> 1% on Iron Soldier, doesn't crack top-15 elsewhere
  68K             -> 0.7-2.6% everywhere; JIT not worth the licensing

The right next perf target is GPU/DSP RISC dynarec or cached IR
(half of issue #122).  Both share the same Tom RISC ISA, so a
single dispatcher attacks both.

docs/op-perf-profile.md captures the methodology, the ROM-by-ROM
numbers, and the recommendation.

Drive-by: quote $(BENCH_ROM) in the Makefile benchmark recipe so
ROM paths with spaces / parens (every commercial ROM filename)
work.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

Original profile only sampled headless boot/menu state, which doesn't
exercise the blitter much.  Added --load-state to test_benchmark
(handles RetroArch RASTATE container by extracting the MEM chunk),
loaded the user's AvP state6 save (active gameplay), and re-profiled.

Result: the spike reports' hypothesis about the blitter was right --
it just didn't show up in boot profiles.

  AvP gameplay, fast blitter:
    DSP ~63% (same as before), blitter 5%, GPU 4%, OP 1%
  AvP gameplay, accurate blitter:
    BlitterMidsummer2+ADDARRAY+DATA ~34% (matches docs/spike #124),
    DSP ~31%, GPU small

OP stays at ~1% even on gameplay -- closing #123 as wontfix-for-now is
still the honest call.

Updated recommendation: two genuine targets, suggested order:
  1. Accurate-blitter SIMD widening (#124) -- smaller surface, lower
     risk, immediate visible win for AvP-style accurate-blitter
     slowdown.  ADDARRAY (src/tom/blitter.c:2090-2094) is the obvious
     first target.
  2. RISC dynarec / cached IR (#122 RISC half) -- bigger lift, helps
     every game on every blitter mode.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

Three concerns flagged by automated review on PR #128:

* Validate fseek/ftell/malloc/fread when reading the state file
  (negative size, NULL malloc, short read) instead of trusting them.
* Bounds-check RASTATE chunk_size against the buffer end before
  treating any bytes past the chunk header as payload, so a
  truncated/corrupt container can't push retro_unserialize past the
  allocation.
* Route every state-load failure through a single cleanup label that
  closes the FILE, frees the buffer, and tears down retro_load_game /
  retro_init / dlopen before returning, matching the cleanup in the
  normal exit path.

No functional change for valid state files.  Smoke-tested with
make benchmark (no --load-state) -- still reports FPS as before.

Co-Authored-By: Claude Opus 4.7 <[email protected]>