Phase 9: FREE-TINY-FAST MONO DUALHOT (GO +2.72%)

Results:
- A/B test: +2.72% on Mixed (10-run, clean env)
- Baseline: 48.89M ops/s
- Optimized: 50.22M ops/s
- Improvement: +1.33M ops/s (+2.72%)
- Stability: Standard deviation reduced by 60.8% (2.44M → 955K ops/s)

Strategy:
- Transplant C0-C3 "second hot" path to monolithic free_tiny_fast()
- Early-exit within monolithic (no hot/cold split)
- FastLane free now benefits from C0-C3 direct path

Success factors:
1. Performance improvement: +2.72% (2.7x GO threshold)
2. Stability improvement: 2.6x more stable (stdev 60.8% reduction)
3. Learned from Phase 7 failure:
   - Phase 7: Function split (hot/cold) → NO-GO
   - Phase 9: Early-exit within monolithic → GO
4. FastLane free compatibility: C0-C3 direct path now works with FastLane
5. Policy snapshot overhead reduction: C0-C3 (48% of Mixed) skip route lookup

Implementation:
- Patch 1: ENV gate box (free_tiny_fast_mono_dualhot_env_box.h)
  - ENV: HAKMEM_FREE_TINY_FAST_MONO_DUALHOT=0/1 (default 0)
  - Probe window: 64 (avoid bench_profile putenv race)
- Patch 2: Early-exit in free_tiny_fast() (malloc_tiny_fast.h)
  - Conditions: class_idx <= 3, !LARSON_FIX, route==LEGACY
  - Direct call: tiny_legacy_fallback_free_base()
- Patch 3: Visibility (free_path_stats_box.h)
  - mono_dualhot_hit counter (compile-out in release)
- Patch 4: cleanenv extension (run_mixed_10_cleanenv.sh)
  - ENV leak protection

Files modified:
- core/bench_profile.h: add to MIXED_TINYV3_C7_SAFE preset
- core/front/malloc_tiny_fast.h: early-exit insertion
- core/box/free_path_stats_box.h: counter
- core/box/free_tiny_fast_mono_dualhot_env_box.h: NEW (ENV gate)
- scripts/run_mixed_10_cleanenv.sh: ENV leak protection

Health check: PASSED (all profiles)

Promotion: Added to MIXED_TINYV3_C7_SAFE preset (default ON, opt-out)

Rollback: HAKMEM_FREE_TINY_FAST_MONO_DUALHOT=0

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

core/front/malloc_tiny_fast.h

@@ -72,6 +72,7 @@
 #include "../box/hakmem_env_snapshot_box.h" // Phase 4 E1: ENV snapshot consolidation
 #include "../box/free_cold_shape_env_box.h" // Phase 5 E5-3a: Free cold path shape optimization
 #include "../box/free_cold_shape_stats_box.h" // Phase 5 E5-3a: Free cold shape stats
+#include "../box/free_tiny_fast_mono_dualhot_env_box.h" // Phase 9: MONO DUALHOT ENV gate
 
 // Helper: current thread id (low 32 bits) for owner check
 #ifndef TINY_SELF_U32_LOCAL_DEFINED
@@ -768,6 +769,31 @@ static inline int free_tiny_fast(void* ptr) {
     // Phase FREE-LEGACY-BREAKDOWN-1: カウンタ散布 (1. 関数入口)
     FREE_PATH_STAT_INC(total_calls);
 
+    // Phase 9: MONO DUALHOT early-exit for C0-C3 (skip policy snapshot, direct to legacy)
+    // Conditions:
+    //   - ENV: HAKMEM_FREE_TINY_FAST_MONO_DUALHOT=1
+    //   - class_idx <= 3 (C0-C3)
+    //   - !HAKMEM_TINY_LARSON_FIX (cross-thread handling requires full validation)
+    //   - g_tiny_route_snapshot_done == 1 && route == TINY_ROUTE_LEGACY (断定できないときは既存経路)
+    if ((unsigned)class_idx <= 3u) {
+        if (free_tiny_fast_mono_dualhot_enabled()) {
+            static __thread int g_larson_fix = -1;
+            if (__builtin_expect(g_larson_fix == -1, 0)) {
+                const char* e = getenv("HAKMEM_TINY_LARSON_FIX");
+                g_larson_fix = (e && *e && *e != '0') ? 1 : 0;
+            }
+
+            if (!g_larson_fix &&
+                g_tiny_route_snapshot_done == 1 &&
+                g_tiny_route_class[class_idx] == TINY_ROUTE_LEGACY) {
+                // Direct path: Skip policy snapshot, go straight to legacy fallback
+                FREE_PATH_STAT_INC(mono_dualhot_hit);
+                tiny_legacy_fallback_free_base(base, class_idx);
+                return 1;
+            }
+        }
+    }
+
     // Phase v11b-1: C7 ULTRA early-exit (skip policy snapshot for most common case)
     // Phase 4 E1: Use ENV snapshot when enabled (consolidates 3 TLS reads → 1)
     bool c7_ultra_free;