Phase 15: Box BenchMeta separation + ExternalGuard debug + investigation report

- Implement Box BenchMeta pattern in bench_random_mixed.c (BENCH_META_CALLOC/FREE)
- Add enhanced debug logging to external_guard_box.h (caller tracking, FG classification)
- Document investigation in PHASE15_BUG_ANALYSIS.md

Issue: Page-aligned MIDCAND pointer not in SuperSlab registry → ExternalGuard → crash
Hypothesis: May be pre-existing SuperSlab bug (not Phase 15-specific)
Next: Test in Phase 14-C to verify

core/tiny_alloc_fast.inc.h

@@ -29,6 +29,7 @@
 #ifdef HAKMEM_TINY_HEADER_CLASSIDX
 #include "front/tiny_front_c23.h"      // Phase B: Ultra-simple C2/C3 front
 #include "front/tiny_heap_v2.h"        // Phase 13-A: TinyHeapV2 magazine front
+#include "front/tiny_ultra_hot.h"      // Phase 14: TinyUltraHot C1/C2 ultra-fast path
 #endif
 #include <stdio.h>
 
@@ -602,6 +603,28 @@ static inline void* tiny_alloc_fast(size_t size) {
     }
 #endif
 
+    // Phase 14-C: TinyUltraHot Borrowing Design (正史から借りる設計)
+    // ENV-gated: HAKMEM_TINY_ULTRA_HOT=1 (default: ON)
+    // Targets C2-C5 (16B-128B)
+    // Design: UltraHot は TLS SLL から借りたブロックを magazine に保持
+    //   - Hit: magazine から返す (L0, fastest)
+    //   - Miss: TLS SLL から refill して再試行
+    if (__builtin_expect(ultra_hot_enabled(), 1)) {
+        void* base = ultra_hot_alloc(size);
+        if (base) {
+            HAK_RET_ALLOC(class_idx, base);  // Header write + return USER pointer
+        }
+        // Miss → TLS SLL から借りて refill（正史から借用）
+        if (class_idx >= 2 && class_idx <= 5) {
+            ultra_hot_try_refill(class_idx);
+            // Retry after refill
+            base = ultra_hot_alloc(size);
+            if (base) {
+                HAK_RET_ALLOC(class_idx, base);
+            }
+        }
+    }
+
     // Phase 13-A: TinyHeapV2 (per-thread magazine, experimental)
     // ENV-gated: HAKMEM_TINY_HEAP_V2=1
     // Targets class 0-3 (8-64B) only, falls back to existing path if NULL