Phase ALLOC-TINY-FAST-DUALHOT-1 & Optimization Roadmap Update

Add comprehensive design docs and research boxes:
- docs/analysis/ALLOC_TINY_FAST_DUALHOT_1_DESIGN.md: ALLOC DUALHOT investigation
- docs/analysis/FREE_TINY_FAST_DUALHOT_1_DESIGN.md: FREE DUALHOT final specs
- docs/analysis/FREE_TINY_FAST_HOTCOLD_OPT_1_DESIGN.md: Hot/Cold split research
- docs/analysis/POOL_MID_INUSE_DEFERRED_DN_BATCH_DESIGN.md: Deferred batching design
- docs/analysis/POOL_MID_INUSE_DEFERRED_REGRESSION_ANALYSIS.md: Stats overhead findings
- docs/analysis/MID_DESC_CACHE_BENCHMARK_2025-12-12.md: Cache measurement results
- docs/analysis/LAST_MATCH_CACHE_IMPLEMENTATION.md: TLS cache investigation

Research boxes (SS page table):
- core/box/ss_pt_env_box.h: HAKMEM_SS_LOOKUP_KIND gate
- core/box/ss_pt_types_box.h: 2-level page table structures
- core/box/ss_pt_lookup_box.h: ss_pt_lookup() implementation
- core/box/ss_pt_register_box.h: Page table registration
- core/box/ss_pt_impl.c: Global definitions

Updates:
- docs/specs/ENV_VARS_COMPLETE.md: HOTCOLD, DEFERRED, SS_LOOKUP env vars
- core/box/hak_free_api.inc.h: FREE-DISPATCH-SSOT integration
- core/box/pool_mid_inuse_deferred_box.h: Deferred API updates
- core/box/pool_mid_inuse_deferred_stats_box.h: Stats collection
- core/hakmem_super_registry: SS page table integration

Current Status:
- FREE-TINY-FAST-DUALHOT-1: +13% improvement, ready for adoption
- ALLOC-TINY-FAST-DUALHOT-1: -2% regression, frozen as research box
- Next: Optimization roadmap per ROI (mimalloc gap 2.5x)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

core/box/hak_free_api.inc.h

@@ -224,19 +224,42 @@ void hak_free_at(void* ptr, size_t size, hak_callsite_t site) {
     // ========== Mid/L25/Tiny Registry Lookup (Headerless) ==========
     // MIDCAND: Could be Mid/Large/C7, needs registry lookup
 
-    // Phase MID-V3: Try v3 ownership first (RegionIdBox-based)
-    // ENV-controlled, default OFF
-    if (__builtin_expect(mid_v3_enabled(), 0)) {
+    // Phase FREE-DISPATCH-SSOT: Single Source of Truth for region lookup
+    // ENV: HAKMEM_FREE_DISPATCH_SSOT (default: 0 for backward compat, 1 for optimized)
+    // Problem: Old code did region_id_lookup TWICE in MID-V3 path (once inside mid_hot_v3_free, once after)
+    // Fix: Do lookup ONCE at top, dispatch based on kind
+    static int g_free_dispatch_ssot = -1;
+    if (__builtin_expect(g_free_dispatch_ssot == -1, 0)) {
+        const char* env = getenv("HAKMEM_FREE_DISPATCH_SSOT");
+        g_free_dispatch_ssot = (env && *env == '1') ? 1 : 0;
+    }
+
+    if (g_free_dispatch_ssot && __builtin_expect(mid_v3_enabled(), 0)) {
+        // SSOT=1: Single lookup, then dispatch
+        extern RegionLookupV6 region_id_lookup_cached_v6(void* ptr);
+        RegionLookupV6 lk = region_id_lookup_cached_v6(ptr);
+
+        if (lk.kind == REGION_KIND_MID_V3) {
+            // Owned by MID-V3: call free handler directly (no internal lookup)
+            // Note: We pass the pre-looked-up info implicitly via TLS cache
+            mid_hot_v3_free(ptr);
+
+            if (mid_v3_debug_enabled()) {
+                static _Atomic int free_log_count = 0;
+                if (atomic_fetch_add(&free_log_count, 1) < 10) {
+                    fprintf(stderr, "[MID_V3] Free SSOT: ptr=%p\n", ptr);
+                }
+            }
+            goto done;
+        }
+        // Not MID-V3: fall through to other dispatch paths below
+    } else if (__builtin_expect(mid_v3_enabled(), 0)) {
+        // SSOT=0: Legacy double-lookup path (for A/B comparison)
         // RegionIdBox lookup to check if v3 owns this pointer
         // mid_hot_v3_free() will check internally and return early if not owned
         mid_hot_v3_free(ptr);
 
         // Check if v3 actually owned it by doing a quick verification
-        // For now, we'll use the existence check via RegionIdBox
-        // If v3 handled it, it would have returned already
-        // We need to check if v3 took ownership - simplified: always check other paths too
-        // Better approach: mid_hot_v3_free returns bool or we check ownership first
-
         // For safety, check ownership explicitly before continuing
         // This prevents double-free if v3 handled it
         extern RegionLookupV6 region_id_lookup_v6(void* ptr);