diff --git a/Makefile b/Makefile
index 13ec0d9c..bc388392 100644
--- a/Makefile
+++ b/Makefile
@@ -218,7 +218,7 @@ LDFLAGS += $(EXTRA_LDFLAGS)
 
 # Targets
 TARGET = test_hakmem
-OBJS_BASE = hakmem.o hakmem_config.o hakmem_tiny_config.o hakmem_ucb1.o hakmem_bigcache.o hakmem_pool.o hakmem_l25_pool.o hakmem_site_rules.o hakmem_tiny.o core/box/ss_allocation_box.o superslab_stats.o superslab_cache.o superslab_ace.o superslab_slab.o superslab_backend.o core/superslab_head_stub.o hakmem_smallmid.o tiny_sticky.o tiny_remote.o tiny_publish.o tiny_debug_ring.o hakmem_tiny_magazine.o hakmem_tiny_stats.o hakmem_tiny_sfc.o hakmem_tiny_query.o hakmem_tiny_rss.o hakmem_tiny_registry.o hakmem_tiny_remote_target.o hakmem_tiny_bg_spill.o tiny_adaptive_sizing.o hakmem_super_registry.o hakmem_shared_pool.o hakmem_shared_pool_acquire.o hakmem_shared_pool_release.o hakmem_elo.o hakmem_batch.o hakmem_p2.o hakmem_sizeclass_dist.o hakmem_evo.o hakmem_debug.o hakmem_sys.o hakmem_whale.o hakmem_policy.o hakmem_ace.o hakmem_ace_stats.o hakmem_prof.o hakmem_learner.o hakmem_size_hist.o hakmem_learn_log.o hakmem_syscall.o hakmem_ace_metrics.o hakmem_ace_ucb1.o hakmem_ace_controller.o tiny_fastcache.o core/box/superslab_expansion_box.o core/box/integrity_box.o core/box/free_publish_box.o core/box/mailbox_box.o core/box/front_gate_box.o core/box/front_gate_classifier.o core/box/capacity_box.o core/box/carve_push_box.o core/box/prewarm_box.o core/box/ss_hot_prewarm_box.o core/box/front_metrics_box.o core/box/bench_fast_box.o core/box/ss_addr_map_box.o core/box/ss_pt_impl.o core/box/slab_recycling_box.o core/box/pagefault_telemetry_box.o core/box/tiny_sizeclass_hist_box.o core/box/tiny_env_box.o core/box/tiny_route_box.o core/box/free_front_v3_env_box.o core/box/free_path_stats_box.o core/box/free_dispatch_stats_box.o core/box/alloc_gate_stats_box.o core/box/tiny_c6_ultra_free_box.o core/box/tiny_c5_ultra_free_box.o core/box/tiny_c4_ultra_free_box.o core/box/tiny_ultra_tls_box.o core/box/tiny_page_box.o core/box/tiny_class_policy_box.o core/box/tiny_class_stats_box.o core/box/tiny_policy_learner_box.o core/box/ss_budget_box.o core/box/tiny_mem_stats_box.o core/box/c7_meta_used_counter_box.o core/box/tiny_static_route_box.o core/box/wrapper_env_box.o core/box/madvise_guard_box.o core/box/libm_reloc_guard_box.o core/box/ptr_trace_box.o core/box/link_missing_stubs.o core/box/super_reg_box.o core/box/shared_pool_box.o core/box/remote_side_box.o core/page_arena.o core/front/tiny_unified_cache.o core/tiny_alloc_fast_push.o core/tiny_c7_ultra_segment.o core/tiny_c7_ultra.o core/link_stubs.o core/tiny_failfast.o core/tiny_destructors.o core/smallobject_hotbox_v3.o core/smallobject_hotbox_v4.o core/smallobject_hotbox_v5.o core/smallsegment_v5.o core/smallobject_cold_iface_v5.o core/smallsegment_v6.o core/smallobject_cold_iface_v6.o core/smallobject_core_v6.o core/region_id_v6.o core/smallsegment_v7.o core/smallobject_cold_iface_v7.o core/mid_hotbox_v3.o core/smallobject_policy_v7.o core/smallobject_segment_mid_v3.o core/smallobject_cold_iface_mid_v3.o core/smallobject_stats_mid_v3.o core/smallobject_learner_v2.o core/smallobject_mid_v35.o
+OBJS_BASE = hakmem.o hakmem_config.o hakmem_tiny_config.o hakmem_ucb1.o hakmem_bigcache.o hakmem_pool.o hakmem_l25_pool.o hakmem_site_rules.o hakmem_tiny.o core/box/ss_allocation_box.o superslab_stats.o superslab_cache.o superslab_ace.o superslab_slab.o superslab_backend.o core/superslab_head_stub.o hakmem_smallmid.o tiny_sticky.o tiny_remote.o tiny_publish.o tiny_debug_ring.o hakmem_tiny_magazine.o hakmem_tiny_stats.o hakmem_tiny_sfc.o hakmem_tiny_query.o hakmem_tiny_rss.o hakmem_tiny_registry.o hakmem_tiny_remote_target.o hakmem_tiny_bg_spill.o tiny_adaptive_sizing.o hakmem_super_registry.o hakmem_shared_pool.o hakmem_shared_pool_acquire.o hakmem_shared_pool_release.o hakmem_elo.o hakmem_batch.o hakmem_p2.o hakmem_sizeclass_dist.o hakmem_evo.o hakmem_debug.o hakmem_sys.o hakmem_whale.o hakmem_policy.o hakmem_ace.o hakmem_ace_stats.o hakmem_prof.o hakmem_learner.o hakmem_size_hist.o hakmem_learn_log.o hakmem_syscall.o hakmem_ace_metrics.o hakmem_ace_ucb1.o hakmem_ace_controller.o tiny_fastcache.o core/box/superslab_expansion_box.o core/box/integrity_box.o core/box/free_publish_box.o core/box/mailbox_box.o core/box/front_gate_box.o core/box/front_gate_classifier.o core/box/capacity_box.o core/box/carve_push_box.o core/box/prewarm_box.o core/box/ss_hot_prewarm_box.o core/box/front_metrics_box.o core/box/bench_fast_box.o core/box/ss_addr_map_box.o core/box/ss_pt_impl.o core/box/slab_recycling_box.o core/box/pagefault_telemetry_box.o core/box/tiny_sizeclass_hist_box.o core/box/tiny_env_box.o core/box/tiny_route_box.o core/box/free_front_v3_env_box.o core/box/free_path_stats_box.o core/box/free_dispatch_stats_box.o core/box/alloc_gate_stats_box.o core/box/tiny_c6_ultra_free_box.o core/box/tiny_c5_ultra_free_box.o core/box/tiny_c4_ultra_free_box.o core/box/tiny_ultra_tls_box.o core/box/tiny_page_box.o core/box/tiny_class_policy_box.o core/box/tiny_class_stats_box.o core/box/tiny_policy_learner_box.o core/box/ss_budget_box.o core/box/tiny_mem_stats_box.o core/box/c7_meta_used_counter_box.o core/box/tiny_static_route_box.o core/box/tiny_metadata_cache_hot_box.o core/box/wrapper_env_box.o core/box/madvise_guard_box.o core/box/libm_reloc_guard_box.o core/box/ptr_trace_box.o core/box/link_missing_stubs.o core/box/super_reg_box.o core/box/shared_pool_box.o core/box/remote_side_box.o core/page_arena.o core/front/tiny_unified_cache.o core/tiny_alloc_fast_push.o core/tiny_c7_ultra_segment.o core/tiny_c7_ultra.o core/link_stubs.o core/tiny_failfast.o core/tiny_destructors.o core/smallobject_hotbox_v3.o core/smallobject_hotbox_v4.o core/smallobject_hotbox_v5.o core/smallsegment_v5.o core/smallobject_cold_iface_v5.o core/smallsegment_v6.o core/smallobject_cold_iface_v6.o core/smallobject_core_v6.o core/region_id_v6.o core/smallsegment_v7.o core/smallobject_cold_iface_v7.o core/mid_hotbox_v3.o core/smallobject_policy_v7.o core/smallobject_segment_mid_v3.o core/smallobject_cold_iface_mid_v3.o core/smallobject_stats_mid_v3.o core/smallobject_learner_v2.o core/smallobject_mid_v35.o
 OBJS = $(OBJS_BASE)
 
 # Shared library
@@ -250,7 +250,7 @@ endif
 # Benchmark targets
 BENCH_HAKMEM = bench_allocators_hakmem
 BENCH_SYSTEM = bench_allocators_system
-BENCH_HAKMEM_OBJS_BASE = hakmem.o hakmem_config.o hakmem_tiny_config.o hakmem_ucb1.o hakmem_bigcache.o hakmem_pool.o hakmem_l25_pool.o hakmem_site_rules.o hakmem_tiny.o core/box/ss_allocation_box.o superslab_stats.o superslab_cache.o superslab_ace.o superslab_slab.o superslab_backend.o core/superslab_head_stub.o hakmem_smallmid.o tiny_sticky.o tiny_remote.o tiny_publish.o tiny_debug_ring.o hakmem_tiny_magazine.o hakmem_tiny_stats.o hakmem_tiny_sfc.o hakmem_tiny_query.o hakmem_tiny_rss.o hakmem_tiny_registry.o hakmem_tiny_remote_target.o hakmem_tiny_bg_spill.o tiny_adaptive_sizing.o hakmem_super_registry.o hakmem_shared_pool.o hakmem_shared_pool_acquire.o hakmem_shared_pool_release.o hakmem_elo.o hakmem_batch.o hakmem_p2.o hakmem_sizeclass_dist.o hakmem_evo.o hakmem_debug.o hakmem_sys.o hakmem_whale.o hakmem_policy.o hakmem_ace.o hakmem_ace_stats.o hakmem_prof.o hakmem_learner.o hakmem_size_hist.o hakmem_learn_log.o hakmem_syscall.o hakmem_ace_metrics.o hakmem_ace_ucb1.o hakmem_ace_controller.o tiny_fastcache.o core/box/superslab_expansion_box.o core/box/integrity_box.o core/box/free_publish_box.o core/box/mailbox_box.o core/box/front_gate_box.o core/box/front_gate_classifier.o core/box/capacity_box.o core/box/carve_push_box.o core/box/prewarm_box.o core/box/ss_hot_prewarm_box.o core/box/front_metrics_box.o core/box/bench_fast_box.o core/box/ss_addr_map_box.o core/box/slab_recycling_box.o core/box/pagefault_telemetry_box.o core/box/tiny_sizeclass_hist_box.o core/box/tiny_env_box.o core/box/tiny_route_box.o core/box/free_front_v3_env_box.o core/box/free_path_stats_box.o core/box/free_dispatch_stats_box.o core/box/alloc_gate_stats_box.o core/box/tiny_c6_ultra_free_box.o core/box/tiny_c5_ultra_free_box.o core/box/tiny_c4_ultra_free_box.o core/box/tiny_ultra_tls_box.o core/box/tiny_page_box.o core/box/tiny_class_policy_box.o core/box/tiny_class_stats_box.o core/box/tiny_policy_learner_box.o core/box/ss_budget_box.o core/box/tiny_mem_stats_box.o core/box/c7_meta_used_counter_box.o core/box/tiny_static_route_box.o core/box/wrapper_env_box.o core/box/madvise_guard_box.o core/box/libm_reloc_guard_box.o core/box/ptr_trace_box.o core/box/link_missing_stubs.o core/box/super_reg_box.o core/box/shared_pool_box.o core/box/remote_side_box.o core/page_arena.o core/front/tiny_unified_cache.o core/tiny_alloc_fast_push.o core/tiny_c7_ultra_segment.o core/tiny_c7_ultra.o core/link_stubs.o core/tiny_failfast.o core/tiny_destructors.o core/smallobject_hotbox_v3.o core/smallobject_hotbox_v4.o core/smallobject_hotbox_v5.o core/smallsegment_v5.o core/smallobject_cold_iface_v5.o core/smallsegment_v6.o core/smallobject_cold_iface_v6.o core/smallobject_core_v6.o core/region_id_v6.o core/smallsegment_v7.o core/smallobject_cold_iface_v7.o core/mid_hotbox_v3.o core/smallobject_policy_v7.o core/smallobject_segment_mid_v3.o core/smallobject_cold_iface_mid_v3.o core/smallobject_stats_mid_v3.o core/smallobject_learner_v2.o core/smallobject_mid_v35.o bench_allocators_hakmem.o
+BENCH_HAKMEM_OBJS_BASE = hakmem.o hakmem_config.o hakmem_tiny_config.o hakmem_ucb1.o hakmem_bigcache.o hakmem_pool.o hakmem_l25_pool.o hakmem_site_rules.o hakmem_tiny.o core/box/ss_allocation_box.o superslab_stats.o superslab_cache.o superslab_ace.o superslab_slab.o superslab_backend.o core/superslab_head_stub.o hakmem_smallmid.o tiny_sticky.o tiny_remote.o tiny_publish.o tiny_debug_ring.o hakmem_tiny_magazine.o hakmem_tiny_stats.o hakmem_tiny_sfc.o hakmem_tiny_query.o hakmem_tiny_rss.o hakmem_tiny_registry.o hakmem_tiny_remote_target.o hakmem_tiny_bg_spill.o tiny_adaptive_sizing.o hakmem_super_registry.o hakmem_shared_pool.o hakmem_shared_pool_acquire.o hakmem_shared_pool_release.o hakmem_elo.o hakmem_batch.o hakmem_p2.o hakmem_sizeclass_dist.o hakmem_evo.o hakmem_debug.o hakmem_sys.o hakmem_whale.o hakmem_policy.o hakmem_ace.o hakmem_ace_stats.o hakmem_prof.o hakmem_learner.o hakmem_size_hist.o hakmem_learn_log.o hakmem_syscall.o hakmem_ace_metrics.o hakmem_ace_ucb1.o hakmem_ace_controller.o tiny_fastcache.o core/box/superslab_expansion_box.o core/box/integrity_box.o core/box/free_publish_box.o core/box/mailbox_box.o core/box/front_gate_box.o core/box/front_gate_classifier.o core/box/capacity_box.o core/box/carve_push_box.o core/box/prewarm_box.o core/box/ss_hot_prewarm_box.o core/box/front_metrics_box.o core/box/bench_fast_box.o core/box/ss_addr_map_box.o core/box/slab_recycling_box.o core/box/pagefault_telemetry_box.o core/box/tiny_sizeclass_hist_box.o core/box/tiny_env_box.o core/box/tiny_route_box.o core/box/free_front_v3_env_box.o core/box/free_path_stats_box.o core/box/free_dispatch_stats_box.o core/box/alloc_gate_stats_box.o core/box/tiny_c6_ultra_free_box.o core/box/tiny_c5_ultra_free_box.o core/box/tiny_c4_ultra_free_box.o core/box/tiny_ultra_tls_box.o core/box/tiny_page_box.o core/box/tiny_class_policy_box.o core/box/tiny_class_stats_box.o core/box/tiny_policy_learner_box.o core/box/ss_budget_box.o core/box/tiny_mem_stats_box.o core/box/c7_meta_used_counter_box.o core/box/tiny_static_route_box.o core/box/tiny_metadata_cache_hot_box.o core/box/wrapper_env_box.o core/box/madvise_guard_box.o core/box/libm_reloc_guard_box.o core/box/ptr_trace_box.o core/box/link_missing_stubs.o core/box/super_reg_box.o core/box/shared_pool_box.o core/box/remote_side_box.o core/page_arena.o core/front/tiny_unified_cache.o core/tiny_alloc_fast_push.o core/tiny_c7_ultra_segment.o core/tiny_c7_ultra.o core/link_stubs.o core/tiny_failfast.o core/tiny_destructors.o core/smallobject_hotbox_v3.o core/smallobject_hotbox_v4.o core/smallobject_hotbox_v5.o core/smallsegment_v5.o core/smallobject_cold_iface_v5.o core/smallsegment_v6.o core/smallobject_cold_iface_v6.o core/smallobject_core_v6.o core/region_id_v6.o core/smallsegment_v7.o core/smallobject_cold_iface_v7.o core/mid_hotbox_v3.o core/smallobject_policy_v7.o core/smallobject_segment_mid_v3.o core/smallobject_cold_iface_mid_v3.o core/smallobject_stats_mid_v3.o core/smallobject_learner_v2.o core/smallobject_mid_v35.o bench_allocators_hakmem.o
 BENCH_HAKMEM_OBJS = $(BENCH_HAKMEM_OBJS_BASE)
 ifeq ($(POOL_TLS_PHASE1),1)
 BENCH_HAKMEM_OBJS += pool_tls.o pool_refill.o pool_tls_arena.o pool_tls_registry.o pool_tls_remote.o
@@ -427,7 +427,7 @@ test-box-refactor: box-refactor
 	./larson_hakmem 10 8 128 1024 1 12345 4
 
 # Phase 4: Tiny Pool benchmarks (properly linked with hakmem)
-TINY_BENCH_OBJS_BASE = hakmem.o hakmem_config.o hakmem_tiny_config.o hakmem_ucb1.o hakmem_bigcache.o hakmem_pool.o hakmem_l25_pool.o hakmem_site_rules.o hakmem_tiny.o core/box/ss_allocation_box.o superslab_stats.o superslab_cache.o superslab_ace.o superslab_slab.o superslab_backend.o core/superslab_head_stub.o hakmem_smallmid.o core/box/superslab_expansion_box.o core/box/integrity_box.o core/box/mailbox_box.o core/box/front_gate_box.o core/box/front_gate_classifier.o core/box/free_publish_box.o core/box/capacity_box.o core/box/carve_push_box.o core/box/prewarm_box.o core/box/ss_hot_prewarm_box.o core/box/front_metrics_box.o core/box/bench_fast_box.o core/box/ss_addr_map_box.o core/box/ss_pt_impl.o core/box/slab_recycling_box.o core/box/pagefault_telemetry_box.o core/box/tiny_sizeclass_hist_box.o core/box/tiny_env_box.o core/box/tiny_route_box.o core/box/free_front_v3_env_box.o core/box/free_path_stats_box.o core/box/free_dispatch_stats_box.o core/box/alloc_gate_stats_box.o core/box/tiny_c6_ultra_free_box.o core/box/tiny_c5_ultra_free_box.o core/box/tiny_c4_ultra_free_box.o core/box/tiny_ultra_tls_box.o core/box/tiny_page_box.o core/box/tiny_class_policy_box.o core/box/tiny_class_stats_box.o core/box/tiny_policy_learner_box.o core/box/ss_budget_box.o core/box/tiny_mem_stats_box.o core/box/c7_meta_used_counter_box.o core/box/tiny_static_route_box.o core/box/wrapper_env_box.o core/box/madvise_guard_box.o core/box/libm_reloc_guard_box.o core/box/ptr_trace_box.o core/box/link_missing_stubs.o core/box/super_reg_box.o core/box/shared_pool_box.o core/box/remote_side_box.o core/page_arena.o core/front/tiny_unified_cache.o tiny_sticky.o tiny_remote.o tiny_publish.o tiny_debug_ring.o hakmem_tiny_magazine.o hakmem_tiny_stats.o hakmem_tiny_sfc.o hakmem_tiny_query.o hakmem_tiny_rss.o hakmem_tiny_registry.o hakmem_tiny_remote_target.o hakmem_tiny_bg_spill.o tiny_adaptive_sizing.o hakmem_super_registry.o hakmem_shared_pool.o hakmem_shared_pool_acquire.o hakmem_shared_pool_release.o hakmem_elo.o hakmem_batch.o hakmem_p2.o hakmem_sizeclass_dist.o hakmem_evo.o hakmem_debug.o hakmem_sys.o hakmem_whale.o hakmem_policy.o hakmem_ace.o hakmem_ace_stats.o hakmem_prof.o hakmem_learner.o hakmem_size_hist.o hakmem_learn_log.o hakmem_syscall.o hakmem_ace_metrics.o hakmem_ace_ucb1.o hakmem_ace_controller.o tiny_fastcache.o core/tiny_alloc_fast_push.o core/tiny_c7_ultra_segment.o core/tiny_c7_ultra.o core/link_stubs.o core/tiny_failfast.o core/tiny_destructors.o core/smallobject_hotbox_v3.o core/smallobject_hotbox_v4.o core/smallobject_hotbox_v5.o core/smallsegment_v5.o core/smallobject_cold_iface_v5.o core/smallsegment_v6.o core/smallobject_cold_iface_v6.o core/smallobject_core_v6.o core/region_id_v6.o core/smallsegment_v7.o core/smallobject_cold_iface_v7.o core/mid_hotbox_v3.o core/smallobject_policy_v7.o core/smallobject_segment_mid_v3.o core/smallobject_cold_iface_mid_v3.o core/smallobject_stats_mid_v3.o core/smallobject_learner_v2.o core/smallobject_mid_v35.o
+TINY_BENCH_OBJS_BASE = hakmem.o hakmem_config.o hakmem_tiny_config.o hakmem_ucb1.o hakmem_bigcache.o hakmem_pool.o hakmem_l25_pool.o hakmem_site_rules.o hakmem_tiny.o core/box/ss_allocation_box.o superslab_stats.o superslab_cache.o superslab_ace.o superslab_slab.o superslab_backend.o core/superslab_head_stub.o hakmem_smallmid.o core/box/superslab_expansion_box.o core/box/integrity_box.o core/box/mailbox_box.o core/box/front_gate_box.o core/box/front_gate_classifier.o core/box/free_publish_box.o core/box/capacity_box.o core/box/carve_push_box.o core/box/prewarm_box.o core/box/ss_hot_prewarm_box.o core/box/front_metrics_box.o core/box/bench_fast_box.o core/box/ss_addr_map_box.o core/box/ss_pt_impl.o core/box/slab_recycling_box.o core/box/pagefault_telemetry_box.o core/box/tiny_sizeclass_hist_box.o core/box/tiny_env_box.o core/box/tiny_route_box.o core/box/free_front_v3_env_box.o core/box/free_path_stats_box.o core/box/free_dispatch_stats_box.o core/box/alloc_gate_stats_box.o core/box/tiny_c6_ultra_free_box.o core/box/tiny_c5_ultra_free_box.o core/box/tiny_c4_ultra_free_box.o core/box/tiny_ultra_tls_box.o core/box/tiny_page_box.o core/box/tiny_class_policy_box.o core/box/tiny_class_stats_box.o core/box/tiny_policy_learner_box.o core/box/ss_budget_box.o core/box/tiny_mem_stats_box.o core/box/c7_meta_used_counter_box.o core/box/tiny_static_route_box.o core/box/tiny_metadata_cache_hot_box.o core/box/wrapper_env_box.o core/box/madvise_guard_box.o core/box/libm_reloc_guard_box.o core/box/ptr_trace_box.o core/box/link_missing_stubs.o core/box/super_reg_box.o core/box/shared_pool_box.o core/box/remote_side_box.o core/page_arena.o core/front/tiny_unified_cache.o tiny_sticky.o tiny_remote.o tiny_publish.o tiny_debug_ring.o hakmem_tiny_magazine.o hakmem_tiny_stats.o hakmem_tiny_sfc.o hakmem_tiny_query.o hakmem_tiny_rss.o hakmem_tiny_registry.o hakmem_tiny_remote_target.o hakmem_tiny_bg_spill.o tiny_adaptive_sizing.o hakmem_super_registry.o hakmem_shared_pool.o hakmem_shared_pool_acquire.o hakmem_shared_pool_release.o hakmem_elo.o hakmem_batch.o hakmem_p2.o hakmem_sizeclass_dist.o hakmem_evo.o hakmem_debug.o hakmem_sys.o hakmem_whale.o hakmem_policy.o hakmem_ace.o hakmem_ace_stats.o hakmem_prof.o hakmem_learner.o hakmem_size_hist.o hakmem_learn_log.o hakmem_syscall.o hakmem_ace_metrics.o hakmem_ace_ucb1.o hakmem_ace_controller.o tiny_fastcache.o core/tiny_alloc_fast_push.o core/tiny_c7_ultra_segment.o core/tiny_c7_ultra.o core/link_stubs.o core/tiny_failfast.o core/tiny_destructors.o core/smallobject_hotbox_v3.o core/smallobject_hotbox_v4.o core/smallobject_hotbox_v5.o core/smallsegment_v5.o core/smallobject_cold_iface_v5.o core/smallsegment_v6.o core/smallobject_cold_iface_v6.o core/smallobject_core_v6.o core/region_id_v6.o core/smallsegment_v7.o core/smallobject_cold_iface_v7.o core/mid_hotbox_v3.o core/smallobject_policy_v7.o core/smallobject_segment_mid_v3.o core/smallobject_cold_iface_mid_v3.o core/smallobject_stats_mid_v3.o core/smallobject_learner_v2.o core/smallobject_mid_v35.o
 TINY_BENCH_OBJS = $(TINY_BENCH_OBJS_BASE)
 ifeq ($(POOL_TLS_PHASE1),1)
 TINY_BENCH_OBJS += pool_tls.o pool_refill.o core/pool_tls_arena.o pool_tls_registry.o pool_tls_remote.o
diff --git a/core/box/tiny_env_box.c b/core/box/tiny_env_box.c
index 8d89b1f0..28f1cacb 100644
--- a/core/box/tiny_env_box.c
+++ b/core/box/tiny_env_box.c
@@ -66,6 +66,7 @@ void tiny_env_init_once(void) {
     g_tiny_env.tension_drain_enable = env_flag("HAKMEM_TINY_TENSION_DRAIN_ENABLE", 1);
     g_tiny_env.tension_drain_threshold = env_int("HAKMEM_TINY_TENSION_DRAIN_THRESHOLD", 1024);
     g_tiny_env.alloc_route_shape = env_flag("HAKMEM_TINY_ALLOC_ROUTE_SHAPE", 0);
+    g_tiny_env.tiny_metadata_cache = env_flag("HAKMEM_TINY_METADATA_CACHE", 0);
 
     g_tiny_env.inited = 1;
 }
diff --git a/core/box/tiny_env_box.h b/core/box/tiny_env_box.h
index b149aac7..d3769347 100644
--- a/core/box/tiny_env_box.h
+++ b/core/box/tiny_env_box.h
@@ -42,6 +42,7 @@ typedef struct {
     int tension_drain_enable;   // HAKMEM_TINY_TENSION_DRAIN_ENABLE (default: 1)
     int tension_drain_threshold; // HAKMEM_TINY_TENSION_DRAIN_THRESHOLD (default: 1024)
     int alloc_route_shape;       // HAKMEM_TINY_ALLOC_ROUTE_SHAPE (default: 0)
+    int tiny_metadata_cache;     // HAKMEM_TINY_METADATA_CACHE (default: 0)
 } tiny_env_cfg_t;
 
 extern tiny_env_cfg_t g_tiny_env;
diff --git a/core/box/tiny_legacy_fallback_box.h b/core/box/tiny_legacy_fallback_box.h
index 06934365..17d5c697 100644
--- a/core/box/tiny_legacy_fallback_box.h
+++ b/core/box/tiny_legacy_fallback_box.h
@@ -4,10 +4,12 @@
 #include <stdbool.h>
 #include <stdint.h>
 #include "../front/tiny_unified_cache.h"
+#include "../front/tiny_first_page_cache.h"  // Phase 3 C2: First page inline cache
 #include "../hakmem.h"
 #include "tiny_front_v3_env_box.h"
 #include "free_path_stats_box.h"
 #include "tiny_front_hot_box.h"
+#include "tiny_metadata_cache_env_box.h"  // Phase 3 C2: Metadata cache ENV gate
 
 // Purpose: Encapsulate legacy free logic (shared by multiple paths)
 // Called by: malloc_tiny_fast.h (free path) + tiny_c6_ultra_free_box.c (C6 fallback)
@@ -22,6 +24,17 @@ static inline void tiny_legacy_fallback_free_base(void* base, uint32_t class_idx
     const TinyFrontV3Snapshot* front_snap =
         __builtin_expect(tiny_front_v3_enabled(), 0) ? tiny_front_v3_snapshot_get() : NULL;
 
+    // Phase 3 C2 Patch 2: First page cache hint (optional fast-path)
+    // Check if pointer is in cached page (avoids metadata lookup in future optimizations)
+    if (__builtin_expect(tiny_metadata_cache_enabled(), 0)) {
+        // Note: This is a hint-only check. Even if it hits, we still use the standard path.
+        // The cache will be populated during refill operations for future use.
+        // Currently this just validates the cache state; actual optimization TBD.
+        if (tiny_first_page_cache_hit(class_idx, base, 4096)) {
+            // Future: could optimize metadata access here
+        }
+    }
+
     // Legacy fallback - Unified Cache push
     if (!front_snap || front_snap->unified_cache_on) {
         if (unified_cache_push(class_idx, HAK_BASE_FROM_RAW(base))) {
diff --git a/core/box/tiny_metadata_cache_env_box.h b/core/box/tiny_metadata_cache_env_box.h
new file mode 100644
index 00000000..7a8d80ee
--- /dev/null
+++ b/core/box/tiny_metadata_cache_env_box.h
@@ -0,0 +1,58 @@
+// tiny_metadata_cache_env_box.h
+// Phase 3 C2: Metadata Cache ENV control
+//
+// Design:
+//   - ENV: HAKMEM_TINY_METADATA_CACHE=0/1 (default 0, OFF)
+//   - Lazy init, cached static
+//   - Safety: Disabled when learner v7 active (learner updates route_kind dynamically)
+//   - Probe window: 64 calls (tolerate early ENV instability)
+
+#ifndef HAK_TINY_METADATA_CACHE_ENV_BOX_H
+#define HAK_TINY_METADATA_CACHE_ENV_BOX_H
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <stdbool.h>
+#include "../hakmem_build_flags.h"
+
+// Forward declare the learner enabled check (to avoid header conflicts)
+extern bool small_learner_v2_enabled(void);
+
+static inline int tiny_metadata_cache_enabled(void) {
+    static int g = -1;
+    static int g_probe_left = 64;  // tolerate early getenv() instability (bench_profile putenv)
+
+    if (__builtin_expect(g == 1, 1)) return 1;
+    if (__builtin_expect(g == 0, 1)) return 0;
+
+    // Safety: disable if learner v7 is active (learner updates route_kind dynamically)
+    if (small_learner_v2_enabled()) {
+        g = 0;
+#if !HAKMEM_BUILD_RELEASE
+        fprintf(stderr, "[TINY_METADATA_CACHE] Disabled (learner v7 active)\n");
+        fflush(stderr);
+#endif
+        return 0;
+    }
+
+    const char* e = getenv("HAKMEM_TINY_METADATA_CACHE");
+    if (e && *e) {
+        g = (*e == '1') ? 1 : 0;
+#if !HAKMEM_BUILD_RELEASE
+        if (g) {
+            fprintf(stderr, "[TINY_METADATA_CACHE] Enabled (policy hot + first page cache)\n");
+            fflush(stderr);
+        }
+#endif
+        return g;
+    }
+
+    if (g_probe_left-- > 0) {
+        return 0;  // keep g==-1, retry later
+    }
+
+    g = 0;
+    return 0;
+}
+
+#endif // HAK_TINY_METADATA_CACHE_ENV_BOX_H
diff --git a/core/box/tiny_metadata_cache_hot_box.c b/core/box/tiny_metadata_cache_hot_box.c
new file mode 100644
index 00000000..27e8d90e
--- /dev/null
+++ b/core/box/tiny_metadata_cache_hot_box.c
@@ -0,0 +1,7 @@
+// tiny_metadata_cache_hot_box.c
+// Phase 3 C2 Patch 1: Policy Hot Cache implementation
+
+#include "tiny_metadata_cache_hot_box.h"
+
+// TLS Policy Hot Cache (9 bytes, zero-initialized)
+__thread TinyPolicyHot g_policy_hot = {0};
diff --git a/core/box/tiny_metadata_cache_hot_box.h b/core/box/tiny_metadata_cache_hot_box.h
new file mode 100644
index 00000000..254a2e35
--- /dev/null
+++ b/core/box/tiny_metadata_cache_hot_box.h
@@ -0,0 +1,73 @@
+// tiny_metadata_cache_hot_box.h
+// Phase 3 C2 Patch 1: Policy Hot Cache
+//
+// Purpose: Cache hot policy members (route_kind[8]) in TLS to eliminate policy_snapshot() calls
+//
+// Design:
+//   - TinyPolicyHot struct: route_kind[8] + learner_v7_enabled (9 bytes packed)
+//   - Refresh on policy version change
+//   - Fallback to policy_snapshot() if cache disabled or stale
+//
+// Integration:
+//   - malloc_tiny_fast.h: Use tiny_policy_hot_get_route() instead of policy_snapshot()
+//   - Refresh check: if (policy_version_changed()) tiny_policy_hot_refresh()
+
+#ifndef HAK_TINY_METADATA_CACHE_HOT_BOX_H
+#define HAK_TINY_METADATA_CACHE_HOT_BOX_H
+
+#include <stdint.h>
+#include "smallobject_policy_v7_box.h"
+#include "tiny_metadata_cache_env_box.h"
+
+// ============================================================================
+// Policy Hot Cache Structure
+// ============================================================================
+
+typedef struct {
+    uint8_t route_kind[8];      // C0-C7 route (copied from policy, not learner-synced)
+    uint8_t learner_v7_enabled; // Boolean: is learner v7 active?
+} TinyPolicyHot;  // 9 bytes packed, fits in 16-byte slot
+
+// ============================================================================
+// External TLS Variable
+// ============================================================================
+
+extern __thread TinyPolicyHot g_policy_hot;
+
+// ============================================================================
+// Policy Hot Cache API
+// ============================================================================
+
+/// Refresh policy hot cache from current policy snapshot
+/// Call this when policy version changes
+__attribute__((always_inline))
+static inline void tiny_policy_hot_refresh(void) {
+    const SmallPolicyV7* policy = small_policy_v7_snapshot();
+
+    // Copy route_kind array
+    for (int i = 0; i < 8; i++) {
+        g_policy_hot.route_kind[i] = (uint8_t)policy->route_kind[i];
+    }
+
+    // Check learner status
+    g_policy_hot.learner_v7_enabled = small_learner_v2_enabled() ? 1 : 0;
+}
+
+/// Get route kind from hot cache (with fallback to policy_snapshot)
+/// @param class_idx: Size class (0-7)
+/// @return: Route kind for this class
+__attribute__((always_inline))
+static inline SmallRouteKind tiny_policy_hot_get_route(uint32_t class_idx) {
+    if (__builtin_expect(tiny_metadata_cache_enabled() && !g_policy_hot.learner_v7_enabled, 0)) {
+        // Fast path: use cached route_kind
+        if (class_idx < 8) {
+            return (SmallRouteKind)g_policy_hot.route_kind[class_idx];
+        }
+    }
+
+    // Fallback: use policy_snapshot (learner active or cache disabled)
+    const SmallPolicyV7* policy = small_policy_v7_snapshot();
+    return policy->route_kind[class_idx];
+}
+
+#endif // HAK_TINY_METADATA_CACHE_HOT_BOX_H
diff --git a/core/front/malloc_tiny_fast.h b/core/front/malloc_tiny_fast.h
index ae4b01ab..c3922bd9 100644
--- a/core/front/malloc_tiny_fast.h
+++ b/core/front/malloc_tiny_fast.h
@@ -67,6 +67,7 @@
 #include "../box/free_policy_fast_v2_box.h" // Phase POLICY-FAST-PATH-V2: Policy snapshot bypass
 #include "../box/free_tiny_fast_hotcold_env_box.h" // Phase FREE-TINY-FAST-HOTCOLD-OPT-1: ENV control
 #include "../box/free_tiny_fast_hotcold_stats_box.h" // Phase FREE-TINY-FAST-HOTCOLD-OPT-1: Stats
+#include "../box/tiny_metadata_cache_hot_box.h" // Phase 3 C2: Policy hot cache (metadata cache optimization)
 
 // Helper: current thread id (low 32 bits) for owner check
 #ifndef TINY_SELF_U32_LOCAL_DEFINED
@@ -246,13 +247,13 @@ static inline void* malloc_tiny_fast_for_class(size_t size, int class_idx) {
         }
     }
 
-    // 2. Route selection: Static route table (Phase 3 C3) or policy snapshot (default)
+    // 2. Route selection: Static route table (Phase 3 C3) or policy hot cache (Phase 3 C2) or policy snapshot (default)
     SmallRouteKind route_kind;
     if (tiny_static_route_ready_fast()) {
         route_kind = tiny_static_route_get_kind_fast(class_idx);
     } else {
-        const SmallPolicyV7* policy = small_policy_v7_snapshot();
-        route_kind = policy->route_kind[class_idx];
+        // Phase 3 C2: Use policy hot cache if enabled (eliminates policy_snapshot() call)
+        route_kind = tiny_policy_hot_get_route(class_idx);
     }
 
     // Phase 2 B3: Routing dispatch (ENV gate HAKMEM_TINY_ALLOC_ROUTE_SHAPE)
diff --git a/core/front/tiny_first_page_cache.h b/core/front/tiny_first_page_cache.h
new file mode 100644
index 00000000..5345319e
--- /dev/null
+++ b/core/front/tiny_first_page_cache.h
@@ -0,0 +1,82 @@
+// tiny_first_page_cache.h
+// Phase 3 C2 Patch 2: First Page Inline Cache
+//
+// Purpose: Cache current slab page pointer in TLS to avoid superslab metadata lookup
+//
+// Design:
+//   - TinyFirstPageCache struct: first_page_base + first_page_free_count
+//   - Per-class cache (C0-C7)
+//   - Fast-path check in free path (before superslab lookup)
+//   - Auto-invalidate on refill/retire
+//
+// Integration:
+//   - tiny_legacy_fallback_free_base(): Check cache hit before superslab lookup
+//   - Refill/retire: Update cache with new page info
+
+#ifndef HAK_FRONT_TINY_FIRST_PAGE_CACHE_H
+#define HAK_FRONT_TINY_FIRST_PAGE_CACHE_H
+
+#include <stdint.h>
+#include <stdbool.h>
+#include "../hakmem_tiny_config.h"  // For TINY_NUM_CLASSES
+
+// ============================================================================
+// First Page Cache Structure
+// ============================================================================
+
+typedef struct {
+    void* first_page_base;          // Current page base pointer (avoid superslab lookup)
+    uint16_t first_page_free_count; // Free slots in current page (hint only)
+} TinyFirstPageCache;
+
+// ============================================================================
+// External TLS Variable
+// ============================================================================
+
+extern __thread TinyFirstPageCache g_first_page_cache[TINY_NUM_CLASSES];
+
+// ============================================================================
+// First Page Cache API
+// ============================================================================
+
+/// Check if ptr is in cached first page (fast path hint)
+/// @param class_idx: Size class (0-7)
+/// @param ptr: Pointer to check (BASE pointer)
+/// @param page_size: Page size for this class
+/// @return: true if ptr is in cached page, false otherwise
+__attribute__((always_inline))
+static inline bool tiny_first_page_cache_hit(uint32_t class_idx, void* ptr, size_t page_size) {
+    if (class_idx >= TINY_NUM_CLASSES) return false;
+
+    void* base = g_first_page_cache[class_idx].first_page_base;
+    if (base == NULL) return false;
+
+    // Check if ptr is within [base, base + page_size)
+    uintptr_t ptr_addr = (uintptr_t)ptr;
+    uintptr_t base_addr = (uintptr_t)base;
+    return (ptr_addr >= base_addr) && (ptr_addr < base_addr + page_size);
+}
+
+/// Update first page cache (on refill)
+/// @param class_idx: Size class (0-7)
+/// @param base: New page base pointer
+/// @param count: Free slots in page
+__attribute__((always_inline))
+static inline void tiny_first_page_cache_update(uint32_t class_idx, void* base, uint16_t count) {
+    if (class_idx >= TINY_NUM_CLASSES) return;
+
+    g_first_page_cache[class_idx].first_page_base = base;
+    g_first_page_cache[class_idx].first_page_free_count = count;
+}
+
+/// Invalidate first page cache (on retire or page full)
+/// @param class_idx: Size class (0-7)
+__attribute__((always_inline))
+static inline void tiny_first_page_cache_invalidate(uint32_t class_idx) {
+    if (class_idx >= TINY_NUM_CLASSES) return;
+
+    g_first_page_cache[class_idx].first_page_base = NULL;
+    g_first_page_cache[class_idx].first_page_free_count = 0;
+}
+
+#endif // HAK_FRONT_TINY_FIRST_PAGE_CACHE_H
diff --git a/core/front/tiny_unified_cache.c b/core/front/tiny_unified_cache.c
index 4113fb9c..e9cd8649 100644
--- a/core/front/tiny_unified_cache.c
+++ b/core/front/tiny_unified_cache.c
@@ -82,6 +82,10 @@ extern void ss_active_add(SuperSlab* ss, uint32_t n);       // From hakmem_tiny_
 
 __thread TinyUnifiedCache g_unified_cache[TINY_NUM_CLASSES];
 
+// Phase 3 C2 Patch 2: First Page Inline Cache (TLS per-class)
+#include "tiny_first_page_cache.h"
+__thread TinyFirstPageCache g_first_page_cache[TINY_NUM_CLASSES] = {0};
+
 // Warm Pool: Per-thread warm SuperSlab pools (one per class)
 __thread TinyWarmPool g_tiny_warm_pool[TINY_NUM_CLASSES] = {0};
 
diff --git a/core/front/tiny_unified_cache.h b/core/front/tiny_unified_cache.h
index 85e81211..54994e36 100644
--- a/core/front/tiny_unified_cache.h
+++ b/core/front/tiny_unified_cache.h
@@ -31,6 +31,15 @@
 #include "../box/ptr_type_box.h"    // Phantom pointer types (BASE/USER)
 #include "../box/tiny_front_config_box.h"  // Phase 8-Step1: Config macros
 
+// ============================================================================
+// Phase 3 C2 Patch 3: Bounds Check Compile-out
+// ============================================================================
+// Hardcode unified cache capacity as macro constants for compile-time optimization
+// This allows the compiler to optimize modulo operations into bitwise AND
+#define TINY_UNIFIED_CACHE_CAPACITY_POW2  11
+#define TINY_UNIFIED_CACHE_CAPACITY       (1 << TINY_UNIFIED_CACHE_CAPACITY_POW2)  // 2048
+#define TINY_UNIFIED_CACHE_MASK           (TINY_UNIFIED_CACHE_CAPACITY - 1)        // 2047
+
 // ============================================================================
 // Performance Measurement: Unified Cache (ENV-gated)
 // ============================================================================