Add SuperSlab Prefault Box with 4MB MAP_POPULATE bug fix

New Feature: ss_prefault_box.h
- Box for controlling SuperSlab page prefaulting policy
- ENV: HAKMEM_SS_PREFAULT (0=OFF, 1=POPULATE, 2=TOUCH)
- Default: OFF (safe mode until further optimization)

Bug Fix: 4MB MAP_POPULATE regression
- Problem: Fallback path allocated 4MB (2x size for alignment) with MAP_POPULATE
  causing 52x slower mmap (0.585ms → 30.6ms) and 35% throughput regression
- Solution: Remove MAP_POPULATE from 4MB allocation, apply madvise(MADV_WILLNEED)
  only to the aligned 2MB region after trimming prefix/suffix

Changes:
- core/box/ss_prefault_box.h: New prefault policy box (header-only)
- core/box/ss_allocation_box.c: Integrate prefault box, call ss_prefault_region()
- core/superslab_cache.c: Fix fallback path - no MAP_POPULATE on 4MB,
  always munmap prefix/suffix, use MADV_WILLNEED for 2MB only
- docs/specs/ENV_VARS*.md: Document HAKMEM_SS_PREFAULT

Performance:
- bench_random_mixed: 4.32M ops/s (regression fixed, slight improvement)
- bench_tiny_hot: 157M ops/s with prefault=1 (no crash)

Box Theory:
- OS layer (ss_os_acquire): "how to mmap"
- Prefault Box: "when to page-in"
- Allocation Box: "when to call prefault"

🤖 Generated with Claude Code

Co-Authored-By: Claude <noreply@anthropic.com>

docs/specs/ENV_VARS.md

@@ -176,6 +176,14 @@ SuperSlab cache / precharge（Phase 6.24+）
 - HAKMEM_TINY_SS_POPULATE_ONCE=1
   - 次回 `mmap` で取得する SuperSlab を 1 回だけ `MAP_POPULATE` で fault-in（A/B 用のワンショットプリタッチ）。
 
+SuperSlab prefault（PF 削減のための前倒し）
+- HAKMEM_SS_PREFAULT=0/1/2/3
+  - 0: OFF（安全デフォルト。`g_ss_populate_once` によるワンショット `MAP_POPULATE` のみ）
+  - 1: POPULATE — 新規 SuperSlab の `mmap` で常に `MAP_POPULATE` を付与し、page fault を kernel 側で事前解消（perf 計測用）。
+  - 2: TOUCH — `MAP_POPULATE` に加えて `ss_prefault_region()` で SuperSlab 全域を 1 回 4KB stride で touch（PF をほぼゼロにしたい実験用）。
+  - 3: ASYNC — 予約値（現状は TOUCH と同等の扱いだが、将来的に BG thread prefault 用に拡張予定）。
+  - Box: `core/box/ss_prefault_box.h`（ポリシー決定）＋ `core/box/ss_allocation_box.c`（mmap 直後の実行）。
+
 Harvest / Guard（mmap前の収穫ゲート）
 - HAKMEM_TINY_SS_CAP=N
   - Tiny 各クラスにおける SuperSlab 上限（0=無制限）。

docs/specs/ENV_VARS_COMPLETE.md

@@ -151,6 +151,44 @@ From `/mnt/workdisk/public_share/hakmem/core/hakmem_tiny_stats.h`:
 - **Purpose**: Interval between partial slab checks
 - **Impact**: Lower = more aggressive trimming
 
+#### HAKMEM_TINY_SS_CACHE
+- **Default**: 0 (disabled)
+- **Purpose**: Per-class SuperSlab cache capacity
+- **Impact**: Limits how many freed SuperSlabs are kept in LRU cache before munmap
+
+#### HAKMEM_TINY_SS_CACHE_C{0..7}
+- **Default**: unset (inherits `HAKMEM_TINY_SS_CACHE`)
+- **Purpose**: Per-class overrides for cache capacity
+- **Impact**: Fine-grained control of cache size per Tiny class
+
+#### HAKMEM_TINY_SS_PRECHARGE
+- **Default**: 0
+- **Purpose**: Precharge (pre-allocate) SuperSlabs into cache at startup/runtime
+- **Impact**: Reduces first-use page faults by having warm SuperSlabs ready
+
+#### HAKMEM_TINY_SS_PRECHARGE_C{0..7}
+- **Default**: unset (inherits `HAKMEM_TINY_SS_PRECHARGE`)
+- **Purpose**: Per-class precharge targets
+- **Impact**: e.g., `HAKMEM_TINY_SS_PRECHARGE_C0=4` precharges 4 SuperSlabs for class 0
+
+#### HAKMEM_TINY_SS_POPULATE_ONCE
+- **Default**: 0
+- **Purpose**: Use `MAP_POPULATE` for the next SuperSlab allocation only
+- **Impact**: One-shot prefault for A/B testing; superseded by `HAKMEM_SS_PREFAULT` for常時運用
+
+#### HAKMEM_SS_PREFAULT
+- **Default**: `0` (OFF, safety-first default)
+- **Type**: integer (0–3)
+- **Purpose**: Control SuperSlab prefault strategy to reduce kernel page fault overhead (enabled explicitly when tuning).
+- **Values**:
+  - `0` = OFF — legacy behavior, only `HAKMEM_TINY_SS_POPULATE_ONCE` may trigger a one-shot `MAP_POPULATE`（現状の安全デフォルト）。
+  - `1` = POPULATE — always pass `populate=1` to `ss_os_acquire()` (use `MAP_POPULATE` for every new SuperSlab). **要 perf 確認。**
+  - `2` = TOUCH — POPULATE + `ss_prefault_region()` touches each page once (4KB stride) after `mmap`（実験用）。
+  - `3` = ASYNC — reserved for future background-prefault implementation (currently treated as TOUCH).
+- **Implementation**:
+  - Policy Box: `core/box/ss_prefault_box.h`
+  - Integration: `core/box/ss_allocation_box.c` calls `ss_prefault_policy()` to set `populate` and `ss_prefault_region()` immediately after `ss_os_acquire()`.
+
 ---
 
 ### 4. Remote Free & Background Processing