diff --git a/core/box/tiny_alloc_gate_box.h b/core/box/tiny_alloc_gate_box.h
index 709ebebe..f1f4166f 100644
--- a/core/box/tiny_alloc_gate_box.h
+++ b/core/box/tiny_alloc_gate_box.h
@@ -151,8 +151,8 @@ static inline void* tiny_alloc_gate_fast(size_t size)
         return NULL;
     }
 
-    // まず Tiny Fast Path で割り当て（USER ポインタを得る）
-    void* user_ptr = malloc_tiny_fast(size);
+    // Phase ALLOC-GATE-SSOT-1: Pass class_idx to *_for_class (eliminate duplicate size→class lookup)
+    void* user_ptr = malloc_tiny_fast_for_class(size, class_idx);
 
     // Tiny-only: その結果をそのまま返す（NULL なら上位が扱う）
     if (__builtin_expect(route == ROUTE_TINY_ONLY, 1)) {
diff --git a/core/front/malloc_tiny_fast.h b/core/front/malloc_tiny_fast.h
index 5df5f838..e4549cdf 100644
--- a/core/front/malloc_tiny_fast.h
+++ b/core/front/malloc_tiny_fast.h
@@ -130,29 +130,31 @@ static inline int front_gate_unified_enabled(void) {
 //   - NULL on failure (caller falls back to normal path)
 //
 
-// Phase ALLOC-TINY-FAST-DUALHOT-1: C0-C3 early-exit gate (default OFF)
+// Phase ALLOC-TINY-FAST-DUALHOT-2: Probe window ENV gate (safe from early putenv)
 static inline int alloc_dualhot_enabled(void) {
     static int g = -1;
+    static int g_probe_left = 64;  // Probe window: tolerate early putenv before gate init
     if (__builtin_expect(g == -1, 0)) {
         const char* e = getenv("HAKMEM_TINY_ALLOC_DUALHOT");
-        g = (e && *e && *e != '0') ? 1 : 0;
+        if (e && *e && *e != '0') {
+            g = 1;
+        } else if (g_probe_left > 0) {
+            g_probe_left--;
+            // Still probing: return "not yet set" without committing 0
+            if (e == NULL) {
+                return 0;  // Env not set (yet), but keep probing
+            }
+        } else {
+            g = 0;  // Probe window exhausted, commit to 0
+        }
     }
     return g;
 }
 
+// Phase ALLOC-GATE-SSOT-1: malloc_tiny_fast_for_class() - body (class_idx already known)
 __attribute__((always_inline))
-static inline void* malloc_tiny_fast(size_t size) {
-    // Phase ALLOC-GATE-OPT-1: カウンタ散布 (1. 関数入口)
-    ALLOC_GATE_STAT_INC(total_calls);
-
-    // Phase v11a-5: Simplified hot path with C7 ULTRA early-exit
-    // 1. size → class_idx (single call)
-    ALLOC_GATE_STAT_INC(size_to_class_calls);
-    int class_idx = hak_tiny_size_to_class(size);
-    if (__builtin_expect(class_idx < 0 || class_idx >= TINY_NUM_CLASSES, 0)) {
-        return NULL;
-    }
-
+static inline void* malloc_tiny_fast_for_class(size_t size, int class_idx) {
+    // Stats (class_idx already validated by gate)
     tiny_front_alloc_stat_inc(class_idx);
     ALLOC_GATE_STAT_INC_CLASS(class_idx);
 
@@ -166,14 +168,11 @@ static inline void* malloc_tiny_fast(size_t size) {
         // C7 ULTRA miss → fall through to policy-based routing
     }
 
-    // Phase ALLOC-TINY-FAST-DUALHOT-1: C0-C3 direct path (second hot path)
+    // Phase ALLOC-TINY-FAST-DUALHOT-2: C0-C3 direct path (second hot path)
     // Skip expensive policy snapshot and route determination for C0-C3.
-    // Measurements show C0-C3 is 48% of allocations, not rare.
-    // NOTE:
-    //   Keep the default path unchanged (gate OFF) to avoid overhead.
-    //   When gate ON, treat C0-C3 as "second hot path" (likely taken in Mixed).
-    if (__builtin_expect(alloc_dualhot_enabled(), 0)) {
-        if (TINY_HOT_LIKELY(class_idx <= 3)) {
+    // NOTE: Branch only taken if class_idx <= 3 (rare when OFF, frequent when ON)
+    if ((unsigned)class_idx <= 3u) {
+        if (alloc_dualhot_enabled()) {
             // Direct to LEGACY unified cache (no policy snapshot)
             void* ptr = tiny_hot_alloc_fast(class_idx);
             if (TINY_HOT_LIKELY(ptr != NULL)) {
@@ -246,6 +245,23 @@ static inline void* malloc_tiny_fast(size_t size) {
     return tiny_cold_refill_and_alloc(class_idx);
 }
 
+// Wrapper: size → class_idx conversion (SSOT)
+__attribute__((always_inline))
+static inline void* malloc_tiny_fast(size_t size) {
+    // Phase ALLOC-GATE-OPT-1: カウンタ散布 (1. 関数入口)
+    ALLOC_GATE_STAT_INC(total_calls);
+
+    // Phase ALLOC-GATE-SSOT-1: Single size→class conversion (SSOT)
+    ALLOC_GATE_STAT_INC(size_to_class_calls);
+    int class_idx = hak_tiny_size_to_class(size);
+    if (__builtin_expect(class_idx < 0 || class_idx >= TINY_NUM_CLASSES, 0)) {
+        return NULL;
+    }
+
+    // Delegate to *_for_class (stats tracked inside)
+    return malloc_tiny_fast_for_class(size, class_idx);
+}
+
 // ============================================================================
 // Phase FREE-TINY-FAST-HOTCOLD-OPT-1: Hot/Cold split helpers
 // ============================================================================