Phase 3 C3: Static Routing A/B Test ADOPT (+2.20% Mixed gain)

Step 2 & 3 Complete:
- A/B test (Mixed 10-run): STATIC_ROUTE=0 (38.91M) → =1 (39.77M) = +2.20% avg
  - Median gain: +1.98%
  - Result: ✅ GO (exceeds +1.0% threshold)

- Decision: ✅ ADOPT into MIXED_TINYV3_C7_SAFE preset
  - bench_profile.h line 77: HAKMEM_TINY_STATIC_ROUTE=1 default
  - Learner auto-disables static route when HAKMEM_SMALL_LEARNER_V7_ENABLED=1

Implementation Summary:
- core/box/tiny_static_route_box.{h,c}: Research box (Step 1A)
- core/front/malloc_tiny_fast.h: Route lookup integration (Step 1B, lines 249-256)
- core/bench_profile.h: Bench sync + preset adoption

Cumulative Phase 2-3 Gains:
- B3 (Routing shape): +2.89%
- B4 (Wrapper split): +1.47%
- C3 (Static routing): +2.20%
- Total: ~6.8% (35.2M → ~39.8M ops/s)

Next: Phase 3 C1 (TLS Prefetch, expected +2-4%)

🤖 Generated with Claude Code

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

core/box/tiny_layout_box.h

@@ -6,9 +6,11 @@
  *
  * Current Design (Phase E1-CORRECT):
  * - All classes (0-7) have 1-byte header
- * - User pointer = base + 1 for classes 0-6, base + 0 for class 7
- *   (Note: Class 7 is headerless in practice but marked for consistency)
- * - No external code should hardcode offsets
+ * - User pointer = base + 1 for ALL classes (0-7)
+ * - Freed blocks store next pointers intrusively:
+ *   - C0/C7: next at base+0 (header overwritten while free)
+ *   - C1-C6: next at base+1 (header preserved while free)
+ * - No external code should hardcode offsets; use this box API
  */
 
 #ifndef TINY_LAYOUT_BOX_H
@@ -24,6 +26,8 @@
   #define HAKMEM_TINY_HEADERLESS 0
 #endif
 
+#include "../hakmem_build_flags.h"
+
 // Define all class-specific layout parameters
 // Current: Defined in g_tiny_class_sizes[8] in hakmem_tiny.c
 // This file makes them accessible via a unified Box API
@@ -33,12 +37,12 @@ static inline size_t tiny_header_size(int class_idx) {
 #if HAKMEM_TINY_HEADERLESS
     (void)class_idx;
     return 0;
+#elif HAKMEM_TINY_HEADER_CLASSIDX
+    (void)class_idx;
+    return 1;
 #else
-    // Phase 1: 1 byte header if enabled
-    // C0 (8B): offset 0 (8B stride too small for header + 8B pointer - would overflow)
-    // C7 (2048B): offset 0 (overwrites header in freelist - largest class can tolerate)
-    // C1-C6: offset 1 (header preserved - user data is not disturbed)
-    return (0x7Eu >> class_idx) & 1u;
+    (void)class_idx;
+    return 0;
 #endif
 }
 
@@ -63,12 +67,26 @@ static inline size_t tiny_user_offset(int class_idx) {
     (void)class_idx;
     return 0;  // Headerless: user = base
 #elif HAKMEM_TINY_HEADER_CLASSIDX
-    // C0 (8B): offset 0 (8B stride too small for header + 8B pointer - would overflow)
-    // C7 (2048B): offset 0 (overwrites header in freelist - largest class can tolerate)
-    // C1-C6: offset 1 (header preserved - user data is not disturbed)
-    // Optimized: Use bitmask lookup instead of branching
+    (void)class_idx;
+    // Phase E1-CORRECT: All classes have 1-byte header → user = base + 1
+    return 1u;
+#else
+    (void)class_idx;
+    return 0u;
+#endif
+}
+
+// Offset for storing the freelist next pointer inside a freed block.
+// This is distinct from tiny_user_offset():
+//   - User offset is always +1 in header mode.
+//   - Next offset is 0 for C0/C7 (cannot preserve header while free), else 1.
+static inline size_t tiny_nextptr_offset(int class_idx) {
+#if HAKMEM_TINY_HEADERLESS
+    (void)class_idx;
+    return 0;
+#elif HAKMEM_TINY_HEADER_CLASSIDX
     // Bit pattern: C0=0, C1-C6=1, C7=0 → 0b01111110 = 0x7E
-    return (0x7Eu >> class_idx) & 1u;
+    return (0x7Eu >> ((unsigned)class_idx & 7u)) & 1u;
 #else
     (void)class_idx;
     return 0u;