Tiny Pool redesign: P0.1, P0.3, P1.1, P1.2 - Out-of-band class_idx lookup

This commit implements the first phase of Tiny Pool redesign based on
ChatGPT architecture review. The goal is to eliminate Header/Next pointer
conflicts by moving class_idx lookup out-of-band (to SuperSlab metadata).

## P0.1: C0(8B) class upgraded to 16B
- Size table changed: {16,32,64,128,256,512,1024,2048} (8 classes)
- LUT updated: 1..16 → class 0, 17..32 → class 1, etc.
- tiny_next_off: C0 now uses offset 1 (header preserved)
- Eliminates edge cases for 8B allocations

## P0.3: Slab reuse guard Box (tls_slab_reuse_guard_box.h)
- New Box for draining TLS SLL before slab reuse
- ENV gate: HAKMEM_TINY_SLAB_REUSE_GUARD=1
- Prevents stale pointers when slabs are recycled
- Follows Box theory: single responsibility, minimal API

## P1.1: SuperSlab class_map addition
- Added uint8_t class_map[SLABS_PER_SUPERSLAB_MAX] to SuperSlab
- Maps slab_idx → class_idx for out-of-band lookup
- Initialized to 255 (UNASSIGNED) on SuperSlab creation
- Set correctly on slab initialization in all backends

## P1.2: Free fast path uses class_map
- ENV gate: HAKMEM_TINY_USE_CLASS_MAP=1
- Free path can now get class_idx from class_map instead of Header
- Falls back to Header read if class_map returns invalid value
- Fixed Legacy Backend dynamic slab initialization bug

## Documentation added
- HAKMEM_ARCHITECTURE_OVERVIEW.md: 4-layer architecture analysis
- TLS_SLL_ARCHITECTURE_INVESTIGATION.md: Root cause analysis
- PTR_LIFECYCLE_TRACE_AND_ROOT_CAUSE_ANALYSIS.md: Pointer tracking
- TINY_REDESIGN_CHECKLIST.md: Implementation roadmap (P0-P3)

## Test results
- Baseline: 70% success rate (30% crash - pre-existing issue)
- class_map enabled: 70% success rate (same as baseline)
- Performance: ~30.5M ops/s (unchanged)

## Next steps (P1.3, P2, P3)
- P1.3: Add meta->active for accurate TLS/freelist sync
- P2: TLS SLL redesign with Box-based counting
- P3: Complete Header out-of-band migration

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

core/box/ss_allocation_box.c

@@ -232,6 +232,9 @@ SuperSlab* superslab_allocate(uint8_t size_class) {
     ss->lg_size = lg;  // Phase 8.3: Use ACE-determined lg_size (20=1MB, 21=2MB)
     ss->slab_bitmap = 0;
     ss->nonempty_mask = 0;  // Phase 6-2.1: ChatGPT Pro P0 - init nonempty mask
+    ss->freelist_mask = 0;  // P1.1 FIX: Initialize freelist_mask
+    ss->empty_mask = 0;     // P1.1 FIX: Initialize empty_mask
+    ss->empty_count = 0;    // P1.1 FIX: Initialize empty_count
     ss->partial_epoch = 0;
     ss->publish_hint = 0xFF;
 
@@ -247,6 +250,15 @@ SuperSlab* superslab_allocate(uint8_t size_class) {
     ss->lru_prev = NULL;
     ss->lru_next = NULL;
 
+    // Phase 3d-C: Initialize hot/cold fields
+    ss->hot_count = 0;
+    ss->cold_count = 0;
+    memset(ss->hot_indices, 0, sizeof(ss->hot_indices));
+    memset(ss->cold_indices, 0, sizeof(ss->cold_indices));
+
+    // Phase 12: Initialize next_chunk (legacy per-class chain)
+    ss->next_chunk = NULL;
+
     // Initialize all slab metadata (only up to max slabs for this size)
     int max_slabs = (int)(ss_size / SLAB_SIZE);
 
@@ -258,6 +270,10 @@ SuperSlab* superslab_allocate(uint8_t size_class) {
     memset(ss->remote_counts, 0, max_slabs * sizeof(uint32_t));
     memset(ss->slab_listed, 0, max_slabs * sizeof(uint32_t));
 
+    // P1.1: Initialize class_map to UNASSIGNED (255) for all slabs
+    // This ensures class_map is in a known state even before slabs are assigned
+    memset(ss->class_map, 255, max_slabs * sizeof(uint8_t));
+
     for (int i = 0; i < max_slabs; i++) {
         ss_slab_meta_freelist_set(ss, i, NULL);  // Explicit NULL (redundant after memset, but clear intent)
         ss_slab_meta_used_set(ss, i, 0);
@@ -422,6 +438,8 @@ void superslab_init_slab(SuperSlab* ss, int slab_idx, size_t block_size, uint32_
     for (int i = 0; i < TINY_NUM_CLASSES; i++) {
         if (g_tiny_class_sizes[i] == stride) {
             meta->class_idx = (uint8_t)i;
+            // P1.1: Update class_map for out-of-band lookup on free path
+            ss->class_map[slab_idx] = (uint8_t)i;
             break;
         }
     }