Phase 6-2.3~6-2.5: Critical bug fixes + SuperSlab optimization (WIP)

## Phase 6-2.3: Fix 4T Larson crash (active counter bug) ✅
**Problem:** 4T Larson crashed with "free(): invalid pointer", OOM errors
**Root cause:** core/hakmem_tiny_refill_p0.inc.h:103
  - P0 batch refill moved freelist blocks to TLS cache
  - Active counter NOT incremented → double-decrement on free
  - Counter underflows → SuperSlab appears full → OOM → crash
**Fix:** Added ss_active_add(tls->ss, from_freelist);
**Result:** 4T stable at 838K ops/s ✅

## Phase 6-2.4: Fix SEGV in random_mixed/mid_large_mt benchmarks ✅
**Problem:** bench_random_mixed_hakmem, bench_mid_large_mt_hakmem → immediate SEGV
**Root cause #1:** core/box/hak_free_api.inc.h:92-95
  - "Guess loop" dereferenced unmapped memory when registry lookup failed
**Root cause #2:** core/box/hak_free_api.inc.h:115
  - Header magic check dereferenced unmapped memory
**Fix:**
  1. Removed dangerous guess loop (lines 92-95)
  2. Added hak_is_memory_readable() check before dereferencing header
     (core/hakmem_internal.h:277-294 - uses mincore() syscall)
**Result:**
  - random_mixed (2KB): SEGV → 2.22M ops/s ✅
  - random_mixed (4KB): SEGV → 2.58M ops/s ✅
  - Larson 4T: no regression (838K ops/s) ✅

## Phase 6-2.5: Performance investigation + SuperSlab fix (WIP) ⚠️
**Problem:** Severe performance gaps (19-26x slower than system malloc)
**Investigation:** Task agent identified root cause
  - hak_is_memory_readable() syscall overhead (100-300 cycles per free)
  - ALL frees hit unmapped_header_fallback path
  - SuperSlab lookup NEVER called
  - Why? g_use_superslab = 0 (disabled by diet mode)

**Root cause:** core/hakmem_tiny_init.inc:104-105
  - Diet mode (default ON) disables SuperSlab
  - SuperSlab defaults to 1 (hakmem_config.c:334)
  - BUT diet mode overrides it to 0 during init

**Fix:** Separate SuperSlab from diet mode
  - SuperSlab: Performance-critical (fast alloc/free)
  - Diet mode: Memory efficiency (magazine capacity limits only)
  - Both are independent features, should not interfere

**Status:** ⚠️ INCOMPLETE - New SEGV discovered after fix
  - SuperSlab lookup now works (confirmed via debug output)
  - But benchmark crashes (Exit 139) after ~20 lookups
  - Needs further investigation

**Files modified:**
- core/hakmem_tiny_init.inc:99-109 - Removed diet mode override
- PERFORMANCE_INVESTIGATION_REPORT.md - Task agent analysis (303x instruction gap)

**Next steps:**
- Investigate new SEGV (likely SuperSlab free path bug)
- OR: Revert Phase 6-2.5 changes if blocking progress

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

core/hakmem_tiny.c

@@ -362,9 +362,28 @@ extern int g_use_superslab;
 
 #if !HAKMEM_BUILD_RELEASE
 static inline void tiny_debug_track_alloc_ret(int cls, void* ptr) {
-    (void)cls;
-    if (!__builtin_expect(g_debug_remote_guard, 0)) return;
     if (!ptr) return;
+    if (g_use_superslab && __builtin_expect(tiny_refill_failfast_level() >= 2, 0)) {
+        SuperSlab* ss = hak_super_lookup(ptr);
+        if (!(ss && ss->magic == SUPERSLAB_MAGIC)) {
+            tiny_failfast_abort_ptr("alloc_ret_lookup", ss, -1, ptr, "lookup_fail");
+        } else {
+            int slab_idx = slab_index_for(ss, ptr);
+            if (slab_idx < 0) {
+                tiny_failfast_abort_ptr("alloc_ret_slabidx", ss, slab_idx, ptr, "slab_idx_mismatch");
+            } else {
+                size_t blk = g_tiny_class_sizes[cls];
+                uintptr_t base = (uintptr_t)tiny_slab_base_for(ss, slab_idx);
+                uintptr_t delta = (uintptr_t)ptr - base;
+                if (blk == 0 || (delta % blk) != 0) {
+                    tiny_failfast_abort_ptr("alloc_ret_align", ss, slab_idx, ptr, "misaligned");
+                } else if (delta / blk >= ss->slabs[slab_idx].capacity) {
+                    tiny_failfast_abort_ptr("alloc_ret_range", ss, slab_idx, ptr, "out_of_capacity");
+                }
+            }
+        }
+    }
+    if (!__builtin_expect(g_debug_remote_guard, 0)) return;
     if (!g_use_superslab) return;
     SuperSlab* ss = hak_super_lookup(ptr);
     if (!(ss && ss->magic == SUPERSLAB_MAGIC)) return;
@@ -836,12 +855,6 @@ SuperSlab* ss_partial_adopt(int class_idx) {
     return NULL;
 }
 
-static inline uint8_t* tiny_slab_base_for(SuperSlab* ss, int slab_idx) {
-    uint8_t* base = (uint8_t*)slab_data_start(ss, slab_idx);
-    if (slab_idx == 0) base += 1024;
-    return base;
-}
-
 static inline void tiny_tls_bind_slab(TinyTLSSlab* tls, SuperSlab* ss, int slab_idx) {
     tls->ss = ss;
     tls->slab_idx = (uint8_t)slab_idx;