P-Tier + Tiny Route Policy: Aggressive Superslab Management + Safe Routing

## Phase 1: Utilization-Aware Superslab Tiering (案B実装済)

- Add ss_tier_box.h: Classify SuperSlabs into HOT/DRAINING/FREE based on utilization
  - HOT (>25%): Accept new allocations
  - DRAINING (≤25%): Drain only, no new allocs
  - FREE (0%): Ready for eager munmap

- Enhanced shared_pool_release_slab():
  - Check tier transition after each slab release
  - If tier→FREE: Force remaining slots to EMPTY and call superslab_free() immediately
  - Bypasses LRU cache to prevent registry bloat from accumulating DRAINING SuperSlabs

- Test results (bench_random_mixed_hakmem):
  - 1M iterations: ✅ ~1.03M ops/s (previously passed)
  - 10M iterations: ✅ ~1.15M ops/s (previously: registry full error)
  - 50M iterations: ✅ ~1.08M ops/s (stress test)

## Phase 2: Tiny Front Routing Policy (新規Box)

- Add tiny_route_box.h/c: Single 8-byte table for class→routing decisions
  - ROUTE_TINY_ONLY: Tiny front exclusive (no fallback)
  - ROUTE_TINY_FIRST: Try Tiny, fallback to Pool if fails
  - ROUTE_POOL_ONLY: Skip Tiny entirely

- Profiles via HAKMEM_TINY_PROFILE ENV:
  - "hot": C0-C3=TINY_ONLY, C4-C6=TINY_FIRST, C7=POOL_ONLY
  - "conservative" (default): All TINY_FIRST
  - "off": All POOL_ONLY (disable Tiny)
  - "full": All TINY_ONLY (microbench mode)

- A/B test results (ws=256, 100k ops random_mixed):
  - Default (conservative): ~2.90M ops/s
  - hot: ~2.65M ops/s (more conservative)
  - off: ~2.86M ops/s
  - full: ~2.98M ops/s (slightly best)

## Design Rationale

### Registry Pressure Fix (案B)
- Problem: DRAINING tier SS occupied registry indefinitely
- Solution: When total_active_blocks→0, immediately free to clear registry slot
- Result: No more "registry full" errors under stress

### Routing Policy Box (新)
- Problem: Tiny front optimization scattered across ENV/branches
- Solution: Centralize routing in single table, select profiles via ENV
- Benefit: Safe A/B testing without touching hot path code
- Future: Integrate with RSS budget/learning layers for dynamic profile switching

## Next Steps (性能最適化)
- Profile Tiny front internals (TLS SLL, FastCache, Superslab backend latency)
- Identify bottleneck between current ~2.9M ops/s and mimalloc ~100M ops/s
- Consider:
  - Reduce shared pool lock contention
  - Optimize unified cache hit rate
  - Streamline Superslab carving logic

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

core/box/tiny_alloc_gate_box.h

@@ -30,6 +30,7 @@
 #include "tiny_ptr_bridge_box.h"     // Tiny Superslab Bridge
 #include "../tiny_region_id.h"       // Header 読み出し
 #include "../front/malloc_tiny_fast.h" // 既存 Tiny Fast Path
+#include "tiny_route_box.h"            // Tiny Front Routing Policy
 
 // 将来の拡張用コンテキスト:
 //  - size      : 要求サイズ
@@ -133,15 +134,59 @@ static inline int tiny_alloc_gate_validate(TinyAllocGateContext* ctx)
 
 // Tiny Alloc Gatekeeper 本体:
 //   - malloc ラッパ (hak_wrappers) から呼ばれる Tiny fast alloc の入口。
-//   - 現状は malloc_tiny_fast(size) の薄いラッパで、診断 ON のときだけ
-//     返された USER ポインタに対して Bridge + Layout 検査を追加。
+//   - ルーティングポリシーに基づき Tiny front / Pool fallback を振り分け、
+//     診断 ON のときだけ返された USER ポインタに対して Bridge + Layout 検査を追加。
 static inline void* tiny_alloc_gate_fast(size_t size)
 {
-    // まずは従来どおり Tiny Fast Path で割り当て（USER ポインタを得る）
+    int class_idx = hak_tiny_size_to_class(size);
+    if (__builtin_expect(class_idx < 0 || class_idx >= TINY_NUM_CLASSES, 0)) {
+        // サイズが Tiny 管理外 → Pool/backend に任せる（NULL で Gate を抜けさせる）
+        return NULL;
+    }
+
+    TinyRoutePolicy route = tiny_route_get(class_idx);
+
+    // Pool-only: Tiny front は完全スキップ（Gate から見ると「Tiny では取れなかった」扱い）
+    if (__builtin_expect(route == ROUTE_POOL_ONLY, 0)) {
+        return NULL;
+    }
+
+    // まず Tiny Fast Path で割り当て（USER ポインタを得る）
     void* user_ptr = malloc_tiny_fast(size);
 
-    // Layer 3a（alloc 側）: 取得したポインタが明らかに異常な場合は
-    // Debug ビルドで早期に検出して Fail-Fast。
+    // Tiny-only: その結果をそのまま返す（NULL なら上位が扱う）
+    if (__builtin_expect(route == ROUTE_TINY_ONLY, 1)) {
+#if !HAKMEM_BUILD_RELEASE
+        // Layer 3a（alloc 側）: 明らかに異常なポインタは debug ビルドで早期検出
+        if (user_ptr) {
+            uintptr_t addr = (uintptr_t)user_ptr;
+            if (__builtin_expect(addr < 4096, 0)) {
+                fprintf(stderr,
+                        "[TINY_ALLOC_GATE_RANGE_INVALID] size=%zu user=%p\n",
+                        size, user_ptr);
+                fflush(stderr);
+                abort();
+            }
+        }
+
+        if (__builtin_expect(tiny_alloc_gate_diag_enabled(), 0) && user_ptr) {
+            TinyAllocGateContext ctx;
+            ctx.size = size;
+            ctx.user = HAK_USER_FROM_RAW(user_ptr);
+            ctx.class_idx = class_idx;
+            ctx.base = HAK_BASE_FROM_RAW(NULL);
+            ctx.bridge.ss = NULL;
+            ctx.bridge.meta = NULL;
+            ctx.bridge.slab_idx = -1;
+            ctx.bridge.meta_cls = 0xffu;
+
+            (void)tiny_alloc_gate_validate(&ctx);
+        }
+#endif
+        return user_ptr;
+    }
+
+    // ROUTE_TINY_FIRST: Tiny で取れなければ Pool/backend fallback を許可（NULL で Gate 脱出）
 #if !HAKMEM_BUILD_RELEASE
     if (user_ptr) {
         uintptr_t addr = (uintptr_t)user_ptr;
@@ -152,20 +197,20 @@ static inline void* tiny_alloc_gate_fast(size_t size)
             fflush(stderr);
             abort();
         }
-    }
 
-    if (__builtin_expect(tiny_alloc_gate_diag_enabled(), 0) && user_ptr) {
-        TinyAllocGateContext ctx;
-        ctx.size = size;
-        ctx.user = HAK_USER_FROM_RAW(user_ptr);
-        ctx.class_idx = hak_tiny_size_to_class(size);
-        ctx.base = HAK_BASE_FROM_RAW(NULL);
-        ctx.bridge.ss = NULL;
-        ctx.bridge.meta = NULL;
-        ctx.bridge.slab_idx = -1;
-        ctx.bridge.meta_cls = 0xffu;
+        if (__builtin_expect(tiny_alloc_gate_diag_enabled(), 0)) {
+            TinyAllocGateContext ctx;
+            ctx.size = size;
+            ctx.user = HAK_USER_FROM_RAW(user_ptr);
+            ctx.class_idx = class_idx;
+            ctx.base = HAK_BASE_FROM_RAW(NULL);
+            ctx.bridge.ss = NULL;
+            ctx.bridge.meta = NULL;
+            ctx.bridge.slab_idx = -1;
+            ctx.bridge.meta_cls = 0xffu;
 
-        (void)tiny_alloc_gate_validate(&ctx);
+            (void)tiny_alloc_gate_validate(&ctx);
+        }
     }
 #endif