Phase ALLOC-TINY-FAST-DUALHOT-1: WIP (regression), FREE DUALHOT confirmed +13%

**ALLOC-TINY-FAST-DUALHOT-1** (this phase):
- Implementation: malloc_tiny_fast() C0-C3 early-exit with policy snapshot skip
- ENV: HAKMEM_TINY_ALLOC_DUALHOT=0/1 (default OFF)
- A/B Result: -1.17% median regression (Mixed, 10-run)
- Root Cause: Branch prediction penalty on C4-C7 outweighs policy skip benefit
- Decision: Freeze as research box (default OFF)
- Difference from FREE: ALLOC requires structural changes (per-class paths)

**FREE-TINY-FAST-DUALHOT-1** (verified):
- A/B Confirmation: +13.00% improvement (42.08M → 47.81M ops/s, Mixed, 10-run)
- Success Criteria: +2% target ACHIEVED
- Health Check: PASS (verify_health_profiles.sh, ENV OFF/ON)
- Safety: HAKMEM_TINY_LARSON_FIX guard in place
- Decision: Promotion to MIXED_TINYV3_C7_SAFE profile candidate

**Next Steps**:
- Profile adoption of FREE DUALHOT for MIXED workload
- No further deep-dive on ALLOC optimization (deferred to future phases)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

core/front/malloc_tiny_fast.h

@@ -169,13 +169,18 @@ static inline void* malloc_tiny_fast(size_t size) {
     // Phase ALLOC-TINY-FAST-DUALHOT-1: C0-C3 direct path (second hot path)
     // Skip expensive policy snapshot and route determination for C0-C3.
     // Measurements show C0-C3 is 48% of allocations, not rare.
-    if (__builtin_expect(alloc_dualhot_enabled() && class_idx <= 3, 0)) {
-        // Direct to LEGACY unified cache (no policy snapshot)
-        void* ptr = tiny_hot_alloc_fast(class_idx);
-        if (TINY_HOT_LIKELY(ptr != NULL)) {
-            return ptr;
+    // NOTE:
+    //   Keep the default path unchanged (gate OFF) to avoid overhead.
+    //   When gate ON, treat C0-C3 as "second hot path" (likely taken in Mixed).
+    if (__builtin_expect(alloc_dualhot_enabled(), 0)) {
+        if (TINY_HOT_LIKELY(class_idx <= 3)) {
+            // Direct to LEGACY unified cache (no policy snapshot)
+            void* ptr = tiny_hot_alloc_fast(class_idx);
+            if (TINY_HOT_LIKELY(ptr != NULL)) {
+                return ptr;
+            }
+            return tiny_cold_refill_and_alloc(class_idx);
         }
-        return tiny_cold_refill_and_alloc(class_idx);
     }
 
     // 2. Policy snapshot (TLS cached, single read)