Phase ALLOC-TINY-FAST-DUALHOT-1 & Optimization Roadmap Update

Add comprehensive design docs and research boxes:
- docs/analysis/ALLOC_TINY_FAST_DUALHOT_1_DESIGN.md: ALLOC DUALHOT investigation
- docs/analysis/FREE_TINY_FAST_DUALHOT_1_DESIGN.md: FREE DUALHOT final specs
- docs/analysis/FREE_TINY_FAST_HOTCOLD_OPT_1_DESIGN.md: Hot/Cold split research
- docs/analysis/POOL_MID_INUSE_DEFERRED_DN_BATCH_DESIGN.md: Deferred batching design
- docs/analysis/POOL_MID_INUSE_DEFERRED_REGRESSION_ANALYSIS.md: Stats overhead findings
- docs/analysis/MID_DESC_CACHE_BENCHMARK_2025-12-12.md: Cache measurement results
- docs/analysis/LAST_MATCH_CACHE_IMPLEMENTATION.md: TLS cache investigation

Research boxes (SS page table):
- core/box/ss_pt_env_box.h: HAKMEM_SS_LOOKUP_KIND gate
- core/box/ss_pt_types_box.h: 2-level page table structures
- core/box/ss_pt_lookup_box.h: ss_pt_lookup() implementation
- core/box/ss_pt_register_box.h: Page table registration
- core/box/ss_pt_impl.c: Global definitions

Updates:
- docs/specs/ENV_VARS_COMPLETE.md: HOTCOLD, DEFERRED, SS_LOOKUP env vars
- core/box/hak_free_api.inc.h: FREE-DISPATCH-SSOT integration
- core/box/pool_mid_inuse_deferred_box.h: Deferred API updates
- core/box/pool_mid_inuse_deferred_stats_box.h: Stats collection
- core/hakmem_super_registry: SS page table integration

Current Status:
- FREE-TINY-FAST-DUALHOT-1: +13% improvement, ready for adoption
- ALLOC-TINY-FAST-DUALHOT-1: -2% regression, frozen as research box
- Next: Optimization roadmap per ROI (mimalloc gap 2.5x)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

core/hakmem_super_registry.c

@@ -4,6 +4,7 @@
 #include "box/ss_addr_map_box.h"     // Phase 9-1: SuperSlab address map
 #include "box/ss_cold_start_box.inc.h"  // Phase 11+: Cold Start prewarm defaults
 #include "hakmem_env_cache.h"        // Priority-2: ENV cache (eliminate syscalls)
+#include "box/ss_pt_register_box.h"  // Phase 9-2: Page table registration
 #include <stdlib.h>
 #include <string.h>
 #include <stdio.h>
@@ -135,6 +136,11 @@ int hak_super_register(uintptr_t base, SuperSlab* ss) {
     // Phase 9-1: Also register in new hash table (for optimized lookup)
     ss_map_insert(&g_ss_addr_map, (void*)base, ss);
 
+    // Phase 9-2: Register in page table (if enabled)
+    if (hak_ss_lookup_pt_enabled()) {
+        ss_pt_register(ss, (void*)base, lg);
+    }
+
     pthread_mutex_unlock(&g_super_reg_lock);
     return 1;
 }
@@ -214,6 +220,12 @@ hash_removed:
         // Phase 12: per-class registry no longer keyed; no per-class removal required.
     }
 
+    // Phase 9-2: Remove from page table (if enabled)
+    // Need to determine lg_size for unregistration
+    if (hak_ss_lookup_pt_enabled() && ss) {
+        ss_pt_unregister((void*)base, ss->lg_size);
+    }
+
     // Phase 9-1: Also remove from new hash table
     ss_map_remove(&g_ss_addr_map, (void*)base);