Phase 4 E1: ENV Snapshot Consolidation - GO (+3.92% avg, +4.01% median)

Target: Consolidate 3 ENV gate TLS reads → 1 TLS read
- tiny_c7_ultra_enabled_env():    1.28% self
- tiny_front_v3_enabled():        1.01% self
- tiny_metadata_cache_enabled():  0.97% self
- Total overhead: 3.26% self (perf profile analysis)

Implementation:
- core/box/hakmem_env_snapshot_box.h (new): ENV snapshot struct & API
- core/box/hakmem_env_snapshot_box.c (new): TLS snapshot implementation
- core/front/malloc_tiny_fast.h: Migrated 5 call sites to snapshot
- core/box/tiny_legacy_fallback_box.h: Migrated 2 call sites
- core/box/tiny_metadata_cache_hot_box.h: Migrated 1 call site
- core/bench_profile.h: Added hakmem_env_snapshot_refresh_from_env()
- Makefile: Added hakmem_env_snapshot_box.o to build
- ENV gate: HAKMEM_ENV_SNAPSHOT=0/1 (default: 0, research box)

A/B Test Results (Mixed, 10-run, 20M iters):
- Baseline (E1=0): 43,617,549 ops/s (avg), 43,562,895 ops/s (median)
- Optimized (E1=1): 45,327,239 ops/s (avg), 45,309,218 ops/s (median)
- Improvement: avg +3.92%, median +4.01%

Decision: GO (+3.92% >= +2.5% threshold)
- Action: Keep as research box (default OFF) for Phase 4
- Next: Consider promotion to default in MIXED_TINYV3_C7_SAFE preset

Design Rationale:
- Shape optimizations (B3, D3) reached saturation (+0.56% NEUTRAL)
- Shift to memory/TLS overhead optimization (new optimization frontier)
- Pattern: Similar to existing tiny_front_v3_snapshot (proven approach)
- Expected: +1-3% from 3.26% ENV overhead → Achieved: +3.92%

Technical Details:
- Consolidation: 3 TLS reads → 1 TLS read (66% reduction)
- Learner interlock: tiny_metadata_cache_eff pre-computed in snapshot
- Version sync: Refreshes on small_policy_v7_version_changed()
- Fallback safety: Existing ENV gates still available when E1=0

🤖 Generated with Claude Code

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

core/box/tiny_legacy_fallback_box.h

@@ -10,6 +10,7 @@
 #include "free_path_stats_box.h"
 #include "tiny_front_hot_box.h"
 #include "tiny_metadata_cache_env_box.h"  // Phase 3 C2: Metadata cache ENV gate
+#include "hakmem_env_snapshot_box.h"  // Phase 4 E1: ENV snapshot consolidation
 
 // Purpose: Encapsulate legacy free logic (shared by multiple paths)
 // Called by: malloc_tiny_fast.h (free path) + tiny_c6_ultra_free_box.c (C6 fallback)
@@ -21,12 +22,21 @@
 //
 __attribute__((always_inline))
 static inline void tiny_legacy_fallback_free_base(void* base, uint32_t class_idx) {
-    const TinyFrontV3Snapshot* front_snap =
-        __builtin_expect(tiny_front_v3_enabled(), 0) ? tiny_front_v3_snapshot_get() : NULL;
+    // Phase 4 E1: Use ENV snapshot when enabled (consolidates 3 TLS reads → 1)
+    const TinyFrontV3Snapshot* front_snap;
+    bool metadata_cache_on;
+    if (__builtin_expect(hakmem_env_snapshot_enabled(), 0)) {
+        const HakmemEnvSnapshot* env = hakmem_env_snapshot();
+        front_snap = env->tiny_front_v3_enabled ? tiny_front_v3_snapshot_get() : NULL;
+        metadata_cache_on = env->tiny_metadata_cache_eff;  // Uses effective (cache && !learner)
+    } else {
+        front_snap = __builtin_expect(tiny_front_v3_enabled(), 0) ? tiny_front_v3_snapshot_get() : NULL;
+        metadata_cache_on = tiny_metadata_cache_enabled();
+    }
 
     // Phase 3 C2 Patch 2: First page cache hint (optional fast-path)
     // Check if pointer is in cached page (avoids metadata lookup in future optimizations)
-    if (__builtin_expect(tiny_metadata_cache_enabled(), 0)) {
+    if (__builtin_expect(metadata_cache_on, 0)) {
         // Note: This is a hint-only check. Even if it hits, we still use the standard path.
         // The cache will be populated during refill operations for future use.
         // Currently this just validates the cache state; actual optimization TBD.