Phase 10: FREE-TINY-FAST MONO LEGACY DIRECT (GO +1.89%)

Results:
- A/B test: +1.89% on Mixed (10-run, clean env)
- Baseline: 51.96M ops/s
- Optimized: 52.94M ops/s
- Improvement: +984K ops/s (+1.89%)
- C6-heavy verification: +7.86% (nonlegacy_mask works correctly, no misfires)

Strategy:
- Extend Phase 9 (C0-C3 DUALHOT) to C4-C7 LEGACY DIRECT
- Fail-Fast principle: Never misclassify MID/ULTRA/V7 as LEGACY
- nonlegacy_mask: Cached at init, hot path uses single bit operation

Success factors:
1. Performance improvement: +1.89% (1.9x GO threshold)
2. Safety verified: nonlegacy_mask prevents MID v3 misfire in C6-heavy
3. Phase 9 coexistence: C0-C3 (Phase 9) + C4-C7 (Phase 10) = full LEGACY coverage
4. Minimal overhead: Single bit operation in hot path (mask & (1u<<class))

Implementation:
- Patch 1: ENV gate box (free_tiny_fast_mono_legacy_direct_env_box.h)
  - ENV: HAKMEM_FREE_TINY_FAST_MONO_LEGACY_DIRECT=0/1 (default 0)
  - nonlegacy_mask cached (reuses free_policy_fast_v2_nonlegacy_mask())
  - Probe window: 64 (avoid bench_profile putenv race)
- Patch 2: Early-exit in free_tiny_fast() (malloc_tiny_fast.h)
  - Conditions: !nonlegacy_mask, route==LEGACY, !LARSON_FIX, done==1
  - Direct call: tiny_legacy_fallback_free_base()
- Patch 3: Visibility (free_path_stats_box.h)
  - mono_legacy_direct_hit counter (compile-out in release)
- Patch 4: cleanenv extension (run_mixed_10_cleanenv.sh)
  - ENV leak protection

Safety verification (C6-heavy):
- OFF: 19.75M ops/s
- ON: 21.30M ops/s (+7.86%)
- nonlegacy_mask correctly excludes C6 (MID v3 active)
- Improvement from C0-C5, C7 direct path acceleration

Files modified:
- core/bench_profile.h: add to MIXED_TINYV3_C7_SAFE preset
- core/front/malloc_tiny_fast.h: early-exit insertion
- core/box/free_path_stats_box.h: counter
- core/box/free_tiny_fast_mono_legacy_direct_env_box.h: NEW (ENV gate + nonlegacy_mask)
- scripts/run_mixed_10_cleanenv.sh: ENV leak protection

Health check: PASSED (all profiles)

Promotion: Added to MIXED_TINYV3_C7_SAFE preset (default ON, opt-out)

Rollback: HAKMEM_FREE_TINY_FAST_MONO_LEGACY_DIRECT=0

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

core/front/malloc_tiny_fast.h

@@ -73,6 +73,7 @@
 #include "../box/free_cold_shape_env_box.h" // Phase 5 E5-3a: Free cold path shape optimization
 #include "../box/free_cold_shape_stats_box.h" // Phase 5 E5-3a: Free cold shape stats
 #include "../box/free_tiny_fast_mono_dualhot_env_box.h" // Phase 9: MONO DUALHOT ENV gate
+#include "../box/free_tiny_fast_mono_legacy_direct_env_box.h" // Phase 10: MONO LEGACY DIRECT ENV gate
 
 // Helper: current thread id (low 32 bits) for owner check
 #ifndef TINY_SELF_U32_LOCAL_DEFINED
@@ -794,6 +795,35 @@ static inline int free_tiny_fast(void* ptr) {
         }
     }
 
+    // Phase 10: MONO LEGACY DIRECT early-exit for C4-C7 (skip policy snapshot, direct to legacy)
+    // Conditions:
+    //   - ENV: HAKMEM_FREE_TINY_FAST_MONO_LEGACY_DIRECT=1
+    //   - cached nonlegacy_mask: class is NOT in non-legacy mask (= ULTRA/MID/V7 not active)
+    //   - g_tiny_route_snapshot_done == 1 && route == TINY_ROUTE_LEGACY (断定できないときは既存経路)
+    //   - !HAKMEM_TINY_LARSON_FIX (cross-thread handling requires full validation)
+    if (free_tiny_fast_mono_legacy_direct_enabled()) {
+        // 1. Check nonlegacy mask (computed once at init)
+        uint8_t nonlegacy_mask = free_tiny_fast_mono_legacy_direct_nonlegacy_mask();
+        if ((nonlegacy_mask & (1u << class_idx)) == 0) {
+            // 2. Check route snapshot
+            if (g_tiny_route_snapshot_done == 1 && g_tiny_route_class[class_idx] == TINY_ROUTE_LEGACY) {
+                // 3. Check Larson fix
+                static __thread int g_larson_fix = -1;
+                if (__builtin_expect(g_larson_fix == -1, 0)) {
+                    const char* e = getenv("HAKMEM_TINY_LARSON_FIX");
+                    g_larson_fix = (e && *e && *e != '0') ? 1 : 0;
+                }
+
+                if (!g_larson_fix) {
+                    // Direct path: Skip policy snapshot, go straight to legacy fallback
+                    FREE_PATH_STAT_INC(mono_legacy_direct_hit);
+                    tiny_legacy_fallback_free_base(base, class_idx);
+                    return 1;
+                }
+            }
+        }
+    }
+
     // Phase v11b-1: C7 ULTRA early-exit (skip policy snapshot for most common case)
     // Phase 4 E1: Use ENV snapshot when enabled (consolidates 3 TLS reads → 1)
     bool c7_ultra_free;