Phase POLICY-FAST-PATH-V2 complete + MID-V35-HOTPATH-OPT-1 design

## Phase POLICY-FAST-PATH-V2 (FROZEN)
- Implementation complete: free_policy_fast_v2_box.h + malloc_tiny_fast.h integration
- A/B Results:
  - Mixed (ws=400): -1.6% regression ❌ (branch cost > skip benefit)
  - C6-heavy (ws=200): +5.4% improvement ✅
- Decision: Default OFF, FROZEN (ws<300 / C6-heavy research only)
- Learning: Large WS causes branch misprediction to dominate

## Phase 3-GRADUATE + ENV probe fix
- 64-probe retry for getenv() stability during bench_profile putenv()
- C6 ULTRA intrusive freelist: FROZEN (research box)

## Phase MID-V35-HOTPATH-OPT-1-DESIGN
- Design doc for next optimization target
- Target: MID v3.5 alloc/free hot path (C5-C6)
- Boxes: Stats Gate, TLS Layout, Boundary Check elimination
- Expected: +3-9% on Mixed mainline

Files:
- core/box/free_policy_fast_v2_box.h (new)
- core/box/free_path_stats_box.h/c (policy_fast_v2_skip counter)
- core/front/malloc_tiny_fast.h (fast-path integration)
- docs/analysis/MID_V35_HOTPATH_OPT_1_DESIGN.md (new)
- docs/analysis/PHASE_3_GRADUATE_*.md (new)
- CURRENT_TASK.md (phase status update)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

core/front/malloc_tiny_fast.h

@@ -62,6 +62,7 @@
 #include "../box/tiny_front_stats_box.h"  // Front class distribution counters
 #include "../box/free_path_stats_box.h" // Phase FREE-LEGACY-BREAKDOWN-1: Free path stats
 #include "../box/alloc_gate_stats_box.h" // Phase ALLOC-GATE-OPT-1: Alloc gate stats
+#include "../box/free_policy_fast_v2_box.h" // Phase POLICY-FAST-PATH-V2: Policy snapshot bypass
 
 // Helper: current thread id (low 32 bits) for owner check
 #ifndef TINY_SELF_U32_LOCAL_DEFINED
@@ -269,6 +270,12 @@ static inline int free_tiny_fast(void* ptr) {
         return 1;
     }
 
+    // Phase POLICY-FAST-PATH-V2: Skip policy snapshot for known-legacy classes
+    if (free_policy_fast_v2_can_skip((uint8_t)class_idx)) {
+        FREE_PATH_STAT_INC(policy_fast_v2_skip);
+        goto legacy_fallback;
+    }
+
     // Phase v11b-1: Policy-based single switch (replaces serial ULTRA checks)
     const SmallPolicyV7* policy_free = small_policy_v7_snapshot();
     SmallRouteKind route_kind_free = policy_free->route_kind[class_idx];
@@ -313,6 +320,7 @@ static inline int free_tiny_fast(void* ptr) {
             break;
     }
 
+legacy_fallback:
     // LEGACY fallback path
     tiny_route_kind_t route = tiny_route_for_class((uint8_t)class_idx);
     const int use_tiny_heap = tiny_route_is_heap_kind(route);