diff --git a/Makefile b/Makefile
index 1c98250a..62bf7598 100644
--- a/Makefile
+++ b/Makefile
@@ -218,7 +218,7 @@ LDFLAGS += $(EXTRA_LDFLAGS)
 
 # Targets
 TARGET = test_hakmem
-OBJS_BASE = hakmem.o hakmem_config.o hakmem_tiny_config.o hakmem_ucb1.o hakmem_bigcache.o hakmem_pool.o hakmem_l25_pool.o hakmem_site_rules.o hakmem_tiny.o core/box/ss_allocation_box.o superslab_stats.o superslab_cache.o superslab_ace.o superslab_slab.o superslab_backend.o core/superslab_head_stub.o hakmem_smallmid.o tiny_sticky.o tiny_remote.o tiny_publish.o tiny_debug_ring.o hakmem_tiny_magazine.o hakmem_tiny_stats.o hakmem_tiny_sfc.o hakmem_tiny_query.o hakmem_tiny_rss.o hakmem_tiny_registry.o hakmem_tiny_remote_target.o hakmem_tiny_bg_spill.o tiny_adaptive_sizing.o hakmem_super_registry.o hakmem_shared_pool.o hakmem_shared_pool_acquire.o hakmem_shared_pool_release.o hakmem_elo.o hakmem_batch.o hakmem_p2.o hakmem_sizeclass_dist.o hakmem_evo.o hakmem_debug.o hakmem_sys.o hakmem_whale.o hakmem_policy.o hakmem_ace.o hakmem_ace_stats.o hakmem_prof.o hakmem_learner.o hakmem_size_hist.o hakmem_learn_log.o hakmem_syscall.o hakmem_ace_metrics.o hakmem_ace_ucb1.o hakmem_ace_controller.o tiny_fastcache.o core/box/superslab_expansion_box.o core/box/integrity_box.o core/box/free_publish_box.o core/box/mailbox_box.o core/box/front_gate_box.o core/box/front_gate_classifier.o core/box/capacity_box.o core/box/carve_push_box.o core/box/prewarm_box.o core/box/ss_hot_prewarm_box.o core/box/front_metrics_box.o core/box/bench_fast_box.o core/box/ss_addr_map_box.o core/box/slab_recycling_box.o core/box/pagefault_telemetry_box.o core/box/tiny_sizeclass_hist_box.o core/box/tiny_env_box.o core/box/tiny_route_box.o core/box/free_front_v3_env_box.o core/box/free_path_stats_box.o core/box/tiny_c6_ultra_free_box.o core/box/tiny_c5_ultra_free_box.o core/box/tiny_page_box.o core/box/tiny_class_policy_box.o core/box/tiny_class_stats_box.o core/box/tiny_policy_learner_box.o core/box/ss_budget_box.o core/box/tiny_mem_stats_box.o core/box/c7_meta_used_counter_box.o core/box/wrapper_env_box.o core/box/madvise_guard_box.o core/box/libm_reloc_guard_box.o core/box/ptr_trace_box.o core/box/link_missing_stubs.o core/box/super_reg_box.o core/box/shared_pool_box.o core/box/remote_side_box.o core/page_arena.o core/front/tiny_unified_cache.o core/tiny_alloc_fast_push.o core/tiny_c7_ultra_segment.o core/tiny_c7_ultra.o core/link_stubs.o core/tiny_failfast.o core/tiny_destructors.o core/smallobject_hotbox_v3.o core/smallobject_hotbox_v4.o core/smallobject_hotbox_v5.o core/smallsegment_v5.o core/smallobject_cold_iface_v5.o core/smallsegment_v6.o core/smallobject_cold_iface_v6.o core/smallobject_core_v6.o
+OBJS_BASE = hakmem.o hakmem_config.o hakmem_tiny_config.o hakmem_ucb1.o hakmem_bigcache.o hakmem_pool.o hakmem_l25_pool.o hakmem_site_rules.o hakmem_tiny.o core/box/ss_allocation_box.o superslab_stats.o superslab_cache.o superslab_ace.o superslab_slab.o superslab_backend.o core/superslab_head_stub.o hakmem_smallmid.o tiny_sticky.o tiny_remote.o tiny_publish.o tiny_debug_ring.o hakmem_tiny_magazine.o hakmem_tiny_stats.o hakmem_tiny_sfc.o hakmem_tiny_query.o hakmem_tiny_rss.o hakmem_tiny_registry.o hakmem_tiny_remote_target.o hakmem_tiny_bg_spill.o tiny_adaptive_sizing.o hakmem_super_registry.o hakmem_shared_pool.o hakmem_shared_pool_acquire.o hakmem_shared_pool_release.o hakmem_elo.o hakmem_batch.o hakmem_p2.o hakmem_sizeclass_dist.o hakmem_evo.o hakmem_debug.o hakmem_sys.o hakmem_whale.o hakmem_policy.o hakmem_ace.o hakmem_ace_stats.o hakmem_prof.o hakmem_learner.o hakmem_size_hist.o hakmem_learn_log.o hakmem_syscall.o hakmem_ace_metrics.o hakmem_ace_ucb1.o hakmem_ace_controller.o tiny_fastcache.o core/box/superslab_expansion_box.o core/box/integrity_box.o core/box/free_publish_box.o core/box/mailbox_box.o core/box/front_gate_box.o core/box/front_gate_classifier.o core/box/capacity_box.o core/box/carve_push_box.o core/box/prewarm_box.o core/box/ss_hot_prewarm_box.o core/box/front_metrics_box.o core/box/bench_fast_box.o core/box/ss_addr_map_box.o core/box/slab_recycling_box.o core/box/pagefault_telemetry_box.o core/box/tiny_sizeclass_hist_box.o core/box/tiny_env_box.o core/box/tiny_route_box.o core/box/free_front_v3_env_box.o core/box/free_path_stats_box.o core/box/tiny_c6_ultra_free_box.o core/box/tiny_c5_ultra_free_box.o core/box/tiny_c4_ultra_free_box.o core/box/tiny_page_box.o core/box/tiny_class_policy_box.o core/box/tiny_class_stats_box.o core/box/tiny_policy_learner_box.o core/box/ss_budget_box.o core/box/tiny_mem_stats_box.o core/box/c7_meta_used_counter_box.o core/box/wrapper_env_box.o core/box/madvise_guard_box.o core/box/libm_reloc_guard_box.o core/box/ptr_trace_box.o core/box/link_missing_stubs.o core/box/super_reg_box.o core/box/shared_pool_box.o core/box/remote_side_box.o core/page_arena.o core/front/tiny_unified_cache.o core/tiny_alloc_fast_push.o core/tiny_c7_ultra_segment.o core/tiny_c7_ultra.o core/link_stubs.o core/tiny_failfast.o core/tiny_destructors.o core/smallobject_hotbox_v3.o core/smallobject_hotbox_v4.o core/smallobject_hotbox_v5.o core/smallsegment_v5.o core/smallobject_cold_iface_v5.o core/smallsegment_v6.o core/smallobject_cold_iface_v6.o core/smallobject_core_v6.o
 OBJS = $(OBJS_BASE)
 
 # Shared library
@@ -250,7 +250,7 @@ endif
 # Benchmark targets
 BENCH_HAKMEM = bench_allocators_hakmem
 BENCH_SYSTEM = bench_allocators_system
-BENCH_HAKMEM_OBJS_BASE = hakmem.o hakmem_config.o hakmem_tiny_config.o hakmem_ucb1.o hakmem_bigcache.o hakmem_pool.o hakmem_l25_pool.o hakmem_site_rules.o hakmem_tiny.o core/box/ss_allocation_box.o superslab_stats.o superslab_cache.o superslab_ace.o superslab_slab.o superslab_backend.o core/superslab_head_stub.o hakmem_smallmid.o tiny_sticky.o tiny_remote.o tiny_publish.o tiny_debug_ring.o hakmem_tiny_magazine.o hakmem_tiny_stats.o hakmem_tiny_sfc.o hakmem_tiny_query.o hakmem_tiny_rss.o hakmem_tiny_registry.o hakmem_tiny_remote_target.o hakmem_tiny_bg_spill.o tiny_adaptive_sizing.o hakmem_super_registry.o hakmem_shared_pool.o hakmem_shared_pool_acquire.o hakmem_shared_pool_release.o hakmem_elo.o hakmem_batch.o hakmem_p2.o hakmem_sizeclass_dist.o hakmem_evo.o hakmem_debug.o hakmem_sys.o hakmem_whale.o hakmem_policy.o hakmem_ace.o hakmem_ace_stats.o hakmem_prof.o hakmem_learner.o hakmem_size_hist.o hakmem_learn_log.o hakmem_syscall.o hakmem_ace_metrics.o hakmem_ace_ucb1.o hakmem_ace_controller.o tiny_fastcache.o core/box/superslab_expansion_box.o core/box/integrity_box.o core/box/free_publish_box.o core/box/mailbox_box.o core/box/front_gate_box.o core/box/front_gate_classifier.o core/box/capacity_box.o core/box/carve_push_box.o core/box/prewarm_box.o core/box/ss_hot_prewarm_box.o core/box/front_metrics_box.o core/box/bench_fast_box.o core/box/ss_addr_map_box.o core/box/slab_recycling_box.o core/box/pagefault_telemetry_box.o core/box/tiny_sizeclass_hist_box.o core/box/tiny_env_box.o core/box/tiny_route_box.o core/box/free_front_v3_env_box.o core/box/free_path_stats_box.o core/box/tiny_c6_ultra_free_box.o core/box/tiny_c5_ultra_free_box.o core/box/tiny_page_box.o core/box/tiny_class_policy_box.o core/box/tiny_class_stats_box.o core/box/tiny_policy_learner_box.o core/box/ss_budget_box.o core/box/tiny_mem_stats_box.o core/box/c7_meta_used_counter_box.o core/box/wrapper_env_box.o core/box/madvise_guard_box.o core/box/libm_reloc_guard_box.o core/box/ptr_trace_box.o core/box/link_missing_stubs.o core/box/super_reg_box.o core/box/shared_pool_box.o core/box/remote_side_box.o core/page_arena.o core/front/tiny_unified_cache.o core/tiny_alloc_fast_push.o core/tiny_c7_ultra_segment.o core/tiny_c7_ultra.o core/link_stubs.o core/tiny_failfast.o core/tiny_destructors.o core/smallobject_hotbox_v3.o core/smallobject_hotbox_v4.o core/smallobject_hotbox_v5.o core/smallsegment_v5.o core/smallobject_cold_iface_v5.o core/smallsegment_v6.o core/smallobject_cold_iface_v6.o core/smallobject_core_v6.o bench_allocators_hakmem.o
+BENCH_HAKMEM_OBJS_BASE = hakmem.o hakmem_config.o hakmem_tiny_config.o hakmem_ucb1.o hakmem_bigcache.o hakmem_pool.o hakmem_l25_pool.o hakmem_site_rules.o hakmem_tiny.o core/box/ss_allocation_box.o superslab_stats.o superslab_cache.o superslab_ace.o superslab_slab.o superslab_backend.o core/superslab_head_stub.o hakmem_smallmid.o tiny_sticky.o tiny_remote.o tiny_publish.o tiny_debug_ring.o hakmem_tiny_magazine.o hakmem_tiny_stats.o hakmem_tiny_sfc.o hakmem_tiny_query.o hakmem_tiny_rss.o hakmem_tiny_registry.o hakmem_tiny_remote_target.o hakmem_tiny_bg_spill.o tiny_adaptive_sizing.o hakmem_super_registry.o hakmem_shared_pool.o hakmem_shared_pool_acquire.o hakmem_shared_pool_release.o hakmem_elo.o hakmem_batch.o hakmem_p2.o hakmem_sizeclass_dist.o hakmem_evo.o hakmem_debug.o hakmem_sys.o hakmem_whale.o hakmem_policy.o hakmem_ace.o hakmem_ace_stats.o hakmem_prof.o hakmem_learner.o hakmem_size_hist.o hakmem_learn_log.o hakmem_syscall.o hakmem_ace_metrics.o hakmem_ace_ucb1.o hakmem_ace_controller.o tiny_fastcache.o core/box/superslab_expansion_box.o core/box/integrity_box.o core/box/free_publish_box.o core/box/mailbox_box.o core/box/front_gate_box.o core/box/front_gate_classifier.o core/box/capacity_box.o core/box/carve_push_box.o core/box/prewarm_box.o core/box/ss_hot_prewarm_box.o core/box/front_metrics_box.o core/box/bench_fast_box.o core/box/ss_addr_map_box.o core/box/slab_recycling_box.o core/box/pagefault_telemetry_box.o core/box/tiny_sizeclass_hist_box.o core/box/tiny_env_box.o core/box/tiny_route_box.o core/box/free_front_v3_env_box.o core/box/free_path_stats_box.o core/box/tiny_c6_ultra_free_box.o core/box/tiny_c5_ultra_free_box.o core/box/tiny_c4_ultra_free_box.o core/box/tiny_page_box.o core/box/tiny_class_policy_box.o core/box/tiny_class_stats_box.o core/box/tiny_policy_learner_box.o core/box/ss_budget_box.o core/box/tiny_mem_stats_box.o core/box/c7_meta_used_counter_box.o core/box/wrapper_env_box.o core/box/madvise_guard_box.o core/box/libm_reloc_guard_box.o core/box/ptr_trace_box.o core/box/link_missing_stubs.o core/box/super_reg_box.o core/box/shared_pool_box.o core/box/remote_side_box.o core/page_arena.o core/front/tiny_unified_cache.o core/tiny_alloc_fast_push.o core/tiny_c7_ultra_segment.o core/tiny_c7_ultra.o core/link_stubs.o core/tiny_failfast.o core/tiny_destructors.o core/smallobject_hotbox_v3.o core/smallobject_hotbox_v4.o core/smallobject_hotbox_v5.o core/smallsegment_v5.o core/smallobject_cold_iface_v5.o core/smallsegment_v6.o core/smallobject_cold_iface_v6.o core/smallobject_core_v6.o bench_allocators_hakmem.o
 BENCH_HAKMEM_OBJS = $(BENCH_HAKMEM_OBJS_BASE)
 ifeq ($(POOL_TLS_PHASE1),1)
 BENCH_HAKMEM_OBJS += pool_tls.o pool_refill.o pool_tls_arena.o pool_tls_registry.o pool_tls_remote.o
@@ -427,7 +427,7 @@ test-box-refactor: box-refactor
 	./larson_hakmem 10 8 128 1024 1 12345 4
 
 # Phase 4: Tiny Pool benchmarks (properly linked with hakmem)
-TINY_BENCH_OBJS_BASE = hakmem.o hakmem_config.o hakmem_tiny_config.o hakmem_ucb1.o hakmem_bigcache.o hakmem_pool.o hakmem_l25_pool.o hakmem_site_rules.o hakmem_tiny.o core/box/ss_allocation_box.o superslab_stats.o superslab_cache.o superslab_ace.o superslab_slab.o superslab_backend.o core/superslab_head_stub.o hakmem_smallmid.o core/box/superslab_expansion_box.o core/box/integrity_box.o core/box/mailbox_box.o core/box/front_gate_box.o core/box/front_gate_classifier.o core/box/free_publish_box.o core/box/capacity_box.o core/box/carve_push_box.o core/box/prewarm_box.o core/box/ss_hot_prewarm_box.o core/box/front_metrics_box.o core/box/bench_fast_box.o core/box/ss_addr_map_box.o core/box/slab_recycling_box.o core/box/pagefault_telemetry_box.o core/box/tiny_sizeclass_hist_box.o core/box/tiny_env_box.o core/box/tiny_route_box.o core/box/free_front_v3_env_box.o core/box/free_path_stats_box.o core/box/tiny_c6_ultra_free_box.o core/box/tiny_c5_ultra_free_box.o core/box/tiny_page_box.o core/box/tiny_class_policy_box.o core/box/tiny_class_stats_box.o core/box/tiny_policy_learner_box.o core/box/ss_budget_box.o core/box/tiny_mem_stats_box.o core/box/c7_meta_used_counter_box.o core/box/wrapper_env_box.o core/box/madvise_guard_box.o core/box/libm_reloc_guard_box.o core/box/ptr_trace_box.o core/box/link_missing_stubs.o core/box/super_reg_box.o core/box/shared_pool_box.o core/box/remote_side_box.o core/page_arena.o core/front/tiny_unified_cache.o tiny_sticky.o tiny_remote.o tiny_publish.o tiny_debug_ring.o hakmem_tiny_magazine.o hakmem_tiny_stats.o hakmem_tiny_sfc.o hakmem_tiny_query.o hakmem_tiny_rss.o hakmem_tiny_registry.o hakmem_tiny_remote_target.o hakmem_tiny_bg_spill.o tiny_adaptive_sizing.o hakmem_super_registry.o hakmem_shared_pool.o hakmem_shared_pool_acquire.o hakmem_shared_pool_release.o hakmem_elo.o hakmem_batch.o hakmem_p2.o hakmem_sizeclass_dist.o hakmem_evo.o hakmem_debug.o hakmem_sys.o hakmem_whale.o hakmem_policy.o hakmem_ace.o hakmem_ace_stats.o hakmem_prof.o hakmem_learner.o hakmem_size_hist.o hakmem_learn_log.o hakmem_syscall.o hakmem_ace_metrics.o hakmem_ace_ucb1.o hakmem_ace_controller.o tiny_fastcache.o core/tiny_alloc_fast_push.o core/tiny_c7_ultra_segment.o core/tiny_c7_ultra.o core/link_stubs.o core/tiny_failfast.o core/tiny_destructors.o core/smallobject_hotbox_v3.o core/smallobject_hotbox_v4.o core/smallobject_hotbox_v5.o core/smallsegment_v5.o core/smallobject_cold_iface_v5.o core/smallsegment_v6.o core/smallobject_cold_iface_v6.o core/smallobject_core_v6.o
+TINY_BENCH_OBJS_BASE = hakmem.o hakmem_config.o hakmem_tiny_config.o hakmem_ucb1.o hakmem_bigcache.o hakmem_pool.o hakmem_l25_pool.o hakmem_site_rules.o hakmem_tiny.o core/box/ss_allocation_box.o superslab_stats.o superslab_cache.o superslab_ace.o superslab_slab.o superslab_backend.o core/superslab_head_stub.o hakmem_smallmid.o core/box/superslab_expansion_box.o core/box/integrity_box.o core/box/mailbox_box.o core/box/front_gate_box.o core/box/front_gate_classifier.o core/box/free_publish_box.o core/box/capacity_box.o core/box/carve_push_box.o core/box/prewarm_box.o core/box/ss_hot_prewarm_box.o core/box/front_metrics_box.o core/box/bench_fast_box.o core/box/ss_addr_map_box.o core/box/slab_recycling_box.o core/box/pagefault_telemetry_box.o core/box/tiny_sizeclass_hist_box.o core/box/tiny_env_box.o core/box/tiny_route_box.o core/box/free_front_v3_env_box.o core/box/free_path_stats_box.o core/box/tiny_c6_ultra_free_box.o core/box/tiny_c5_ultra_free_box.o core/box/tiny_c4_ultra_free_box.o core/box/tiny_page_box.o core/box/tiny_class_policy_box.o core/box/tiny_class_stats_box.o core/box/tiny_policy_learner_box.o core/box/ss_budget_box.o core/box/tiny_mem_stats_box.o core/box/c7_meta_used_counter_box.o core/box/wrapper_env_box.o core/box/madvise_guard_box.o core/box/libm_reloc_guard_box.o core/box/ptr_trace_box.o core/box/link_missing_stubs.o core/box/super_reg_box.o core/box/shared_pool_box.o core/box/remote_side_box.o core/page_arena.o core/front/tiny_unified_cache.o tiny_sticky.o tiny_remote.o tiny_publish.o tiny_debug_ring.o hakmem_tiny_magazine.o hakmem_tiny_stats.o hakmem_tiny_sfc.o hakmem_tiny_query.o hakmem_tiny_rss.o hakmem_tiny_registry.o hakmem_tiny_remote_target.o hakmem_tiny_bg_spill.o tiny_adaptive_sizing.o hakmem_super_registry.o hakmem_shared_pool.o hakmem_shared_pool_acquire.o hakmem_shared_pool_release.o hakmem_elo.o hakmem_batch.o hakmem_p2.o hakmem_sizeclass_dist.o hakmem_evo.o hakmem_debug.o hakmem_sys.o hakmem_whale.o hakmem_policy.o hakmem_ace.o hakmem_ace_stats.o hakmem_prof.o hakmem_learner.o hakmem_size_hist.o hakmem_learn_log.o hakmem_syscall.o hakmem_ace_metrics.o hakmem_ace_ucb1.o hakmem_ace_controller.o tiny_fastcache.o core/tiny_alloc_fast_push.o core/tiny_c7_ultra_segment.o core/tiny_c7_ultra.o core/link_stubs.o core/tiny_failfast.o core/tiny_destructors.o core/smallobject_hotbox_v3.o core/smallobject_hotbox_v4.o core/smallobject_hotbox_v5.o core/smallsegment_v5.o core/smallobject_cold_iface_v5.o core/smallsegment_v6.o core/smallobject_cold_iface_v6.o core/smallobject_core_v6.o
 TINY_BENCH_OBJS = $(TINY_BENCH_OBJS_BASE)
 ifeq ($(POOL_TLS_PHASE1),1)
 TINY_BENCH_OBJS += pool_tls.o pool_refill.o core/pool_tls_arena.o pool_tls_registry.o pool_tls_remote.o
diff --git a/core/box/free_path_stats_box.c b/core/box/free_path_stats_box.c
index 3e200324..5dade849 100644
--- a/core/box/free_path_stats_box.c
+++ b/core/box/free_path_stats_box.c
@@ -16,13 +16,15 @@ static void free_path_stats_dump(void) {
         return;
     }
 
-    fprintf(stderr, "[FREE_PATH_STATS] total=%lu c7_ultra=%lu c6_ultra_free=%lu c6_ultra_alloc=%lu c5_ultra_free=%lu c5_ultra_alloc=%lu small_v3=%lu v6=%lu tiny_v1=%lu pool_v1=%lu remote=%lu super_lookup=%lu legacy_fb=%lu\n",
+    fprintf(stderr, "[FREE_PATH_STATS] total=%lu c7_ultra=%lu c6_ultra_free=%lu c6_ultra_alloc=%lu c5_ultra_free=%lu c5_ultra_alloc=%lu c4_ultra_free=%lu c4_ultra_alloc=%lu small_v3=%lu v6=%lu tiny_v1=%lu pool_v1=%lu remote=%lu super_lookup=%lu legacy_fb=%lu\n",
             g_free_path_stats.total_calls,
             g_free_path_stats.c7_ultra_fast,
             g_free_path_stats.c6_ultra_free_fast,  // Phase 4-2
             g_free_path_stats.c6_ultra_alloc_hit,  // Phase 4-4
             g_free_path_stats.c5_ultra_free_fast,  // Phase 5-1
             g_free_path_stats.c5_ultra_alloc_hit,  // Phase 5-2
+            g_free_path_stats.c4_ultra_free_fast,  // Phase 6
+            g_free_path_stats.c4_ultra_alloc_hit,  // Phase 6
             g_free_path_stats.smallheap_v3_fast,
             g_free_path_stats.smallheap_v6_fast,
             g_free_path_stats.tiny_heap_v1_fast,
diff --git a/core/box/free_path_stats_box.h b/core/box/free_path_stats_box.h
index 501e0224..aa4d3fb5 100644
--- a/core/box/free_path_stats_box.h
+++ b/core/box/free_path_stats_box.h
@@ -13,6 +13,8 @@ typedef struct FreePathStats {
     uint64_t c6_ultra_alloc_hit;   // Phase 4-4: C6 ULTRA-alloc (TLS pop)
     uint64_t c5_ultra_free_fast;   // Phase 5-1: C5 ULTRA-free
     uint64_t c5_ultra_alloc_hit;   // Phase 5-2: C5 ULTRA-alloc (TLS pop)
+    uint64_t c4_ultra_free_fast;   // Phase 6: C4 ULTRA-free (cap=64)
+    uint64_t c4_ultra_alloc_hit;   // Phase 6: C4 ULTRA-alloc (TLS pop)
     uint64_t smallheap_v3_fast;
     uint64_t smallheap_v6_fast;
     uint64_t tiny_heap_v1_fast;
diff --git a/core/box/tiny_c4_ultra_free_box.c b/core/box/tiny_c4_ultra_free_box.c
new file mode 100644
index 00000000..ae7046f0
--- /dev/null
+++ b/core/box/tiny_c4_ultra_free_box.c
@@ -0,0 +1,49 @@
+#include "tiny_c4_ultra_free_box.h"
+#include "tiny_legacy_fallback_box.h"  // Phase REFACTOR-2: Unified legacy fallback
+#include "free_path_stats_box.h"
+#include "tiny_front_v3_env_box.h"
+#include "../hakmem.h"  // For HAK_BASE_FROM_RAW
+#include "../front/tiny_unified_cache.h"
+#include "tiny_front_hot_box.h"
+#include "../superslab/superslab_inline.h"  // For ss_fast_lookup
+#include <string.h>
+
+// TLS context
+static __thread TinyC4UltraFreeTLS g_c4_ultra_free_tls = {0};
+
+TinyC4UltraFreeTLS* tiny_c4_ultra_free_tls(void) {
+    return &g_c4_ultra_free_tls;
+}
+
+// Fast path: TLS cache push
+void tiny_c4_ultra_free_fast(void* base, uint32_t class_idx) {
+    TinyC4UltraFreeTLS* ctx = &g_c4_ultra_free_tls;
+
+    // Phase 6: Learn segment on first C4 free (same as C5/C6)
+    if (unlikely(ctx->seg_base == 0)) {
+        SuperSlab* ss = ss_fast_lookup(base);
+        if (ss != NULL) {
+            ctx->seg_base = (uintptr_t)ss;
+            ctx->seg_end  = ctx->seg_base + (1u << ss->lg_size);
+        }
+    }
+
+    // Check if ptr is in our segment AND cache has room
+    if (likely(ctx->seg_base != 0 &&
+               (uintptr_t)base >= ctx->seg_base &&
+               (uintptr_t)base < ctx->seg_end &&
+               ctx->count < TINY_C4_ULTRA_FREE_CAP)) {
+        // Push to TLS cache
+        ctx->freelist[ctx->count++] = base;
+        FREE_PATH_STAT_INC(c4_ultra_free_fast);
+        return;
+    }
+
+    // Slow path: fallback to legacy (cache full or ptr not in segment)
+    tiny_c4_ultra_free_slow(base, class_idx);
+}
+
+// Slow path: fallback to legacy free
+void tiny_c4_ultra_free_slow(void* base, uint32_t class_idx) {
+    tiny_legacy_fallback_free_base(base, class_idx);
+}
diff --git a/core/box/tiny_c4_ultra_free_box.h b/core/box/tiny_c4_ultra_free_box.h
new file mode 100644
index 00000000..0278ada3
--- /dev/null
+++ b/core/box/tiny_c4_ultra_free_box.h
@@ -0,0 +1,30 @@
+#ifndef HAKMEM_TINY_C4_ULTRA_FREE_BOX_H
+#define HAKMEM_TINY_C4_ULTRA_FREE_BOX_H
+
+#include <stdint.h>
+#include <stdbool.h>
+#include "tiny_c4_ultra_free_env_box.h"
+
+#ifndef likely
+#define likely(x)   __builtin_expect(!!(x), 1)
+#define unlikely(x) __builtin_expect(!!(x), 0)
+#endif
+
+// TLS cache capacity (Phase 6: smaller for C4, tuned to L1 fit)
+#define TINY_C4_ULTRA_FREE_CAP 64
+
+// TLS context for C4 ULTRA-free
+typedef struct TinyC4UltraFreeTLS {
+    void*     freelist[TINY_C4_ULTRA_FREE_CAP];  // BASE pointers
+    uint8_t   count;
+    uint8_t   _pad[7];
+    uintptr_t seg_base;      // C4 segment range (0 = not initialized)
+    uintptr_t seg_end;
+} TinyC4UltraFreeTLS;
+
+// API
+TinyC4UltraFreeTLS* tiny_c4_ultra_free_tls(void);
+void tiny_c4_ultra_free_fast(void* base, uint32_t class_idx);
+void tiny_c4_ultra_free_slow(void* base, uint32_t class_idx);
+
+#endif // HAKMEM_TINY_C4_ULTRA_FREE_BOX_H
diff --git a/core/box/tiny_c4_ultra_free_env_box.h b/core/box/tiny_c4_ultra_free_env_box.h
new file mode 100644
index 00000000..b4b84011
--- /dev/null
+++ b/core/box/tiny_c4_ultra_free_env_box.h
@@ -0,0 +1,17 @@
+#ifndef HAKMEM_TINY_C4_ULTRA_FREE_ENV_BOX_H
+#define HAKMEM_TINY_C4_ULTRA_FREE_ENV_BOX_H
+
+#include <stdlib.h>
+#include <stdbool.h>
+
+// ENV: HAKMEM_TINY_C4_ULTRA_FREE_ENABLED (default 0)
+static inline bool tiny_c4_ultra_free_enabled(void) {
+    static int g_enabled = -1;
+    if (__builtin_expect(g_enabled == -1, 0)) {
+        const char* e = getenv("HAKMEM_TINY_C4_ULTRA_FREE_ENABLED");
+        g_enabled = (e && *e && *e != '0') ? 1 : 0;
+    }
+    return g_enabled;
+}
+
+#endif // HAKMEM_TINY_C4_ULTRA_FREE_ENV_BOX_H
diff --git a/core/box/tiny_ultra_classes_box.h b/core/box/tiny_ultra_classes_box.h
index 53af15e9..7e8124c0 100644
--- a/core/box/tiny_ultra_classes_box.h
+++ b/core/box/tiny_ultra_classes_box.h
@@ -1,15 +1,17 @@
 #ifndef HAKMEM_TINY_ULTRA_CLASSES_BOX_H
 #define HAKMEM_TINY_ULTRA_CLASSES_BOX_H
 
-// Purpose: Named constants for ULTRA tier classes (C5, C6, C7)
+// Purpose: Named constants for ULTRA tier classes (C4, C5, C6, C7)
+#define TINY_CLASS_C4 4
 #define TINY_CLASS_C5 5
 #define TINY_CLASS_C6 6
 #define TINY_CLASS_C7 7
 
 // Helper macros for class checking
+#define tiny_class_is_c4(idx)    ((idx) == TINY_CLASS_C4)
 #define tiny_class_is_c5(idx)    ((idx) == TINY_CLASS_C5)
 #define tiny_class_is_c6(idx)    ((idx) == TINY_CLASS_C6)
 #define tiny_class_is_c7(idx)    ((idx) == TINY_CLASS_C7)
-#define tiny_class_is_ultra(idx) (tiny_class_is_c5(idx) || tiny_class_is_c6(idx) || tiny_class_is_c7(idx))
+#define tiny_class_is_ultra(idx) (tiny_class_is_c4(idx) || tiny_class_is_c5(idx) || tiny_class_is_c6(idx) || tiny_class_is_c7(idx))
 
 #endif // HAKMEM_TINY_ULTRA_CLASSES_BOX_H
diff --git a/core/front/malloc_tiny_fast.h b/core/front/malloc_tiny_fast.h
index 442193f4..dab1cbf7 100644
--- a/core/front/malloc_tiny_fast.h
+++ b/core/front/malloc_tiny_fast.h
@@ -48,7 +48,8 @@
 #include "../box/tiny_c7_ultra_box.h" // C7 ULTRA stub (UF-1, delegates to v3)
 #include "../box/tiny_c6_ultra_free_box.h" // Phase 4-2: C6 ULTRA-free (free-only, C6-only)
 #include "../box/tiny_c5_ultra_free_box.h" // Phase 5-1/5-2: C5 ULTRA-free + alloc integration
-#include "../box/tiny_ultra_classes_box.h" // Phase REFACTOR-1: Named constants for C6/C7
+#include "../box/tiny_c4_ultra_free_box.h" // Phase 6: C4 ULTRA-free + alloc integration (cap=64)
+#include "../box/tiny_ultra_classes_box.h" // Phase REFACTOR-1: Named constants for C4-C7
 #include "../box/tiny_legacy_fallback_box.h" // Phase REFACTOR-2: Legacy fallback logic unification
 #include "../box/tiny_ptr_convert_box.h" // Phase REFACTOR-3: Inline pointer macro centralization
 #include "../box/tiny_front_v3_env_box.h" // Tiny front v3 snapshot gate
@@ -193,6 +194,16 @@ static inline void* malloc_tiny_fast(size_t size) {
         }
     }
 
+    // Phase 6: C4 ULTRA free+alloc integration (same pattern as C5/C6, cap=64)
+    if (tiny_class_is_c4(class_idx) && tiny_c4_ultra_free_enabled()) {
+        TinyC4UltraFreeTLS* ctx = tiny_c4_ultra_free_tls();
+        if (TINY_HOT_LIKELY(ctx->count > 0)) {
+            void* base = ctx->freelist[--ctx->count];
+            FREE_PATH_STAT_INC(c4_ultra_alloc_hit);
+            return tiny_base_to_user_inline(base);
+        }
+    }
+
     switch (route) {
         case TINY_ROUTE_SMALL_HEAP_V6: {
             // Phase FREE-LEGACY-BREAKDOWN-1: v6 は既存のビルドエラーがあるため一時的にスキップ
@@ -336,6 +347,12 @@ static inline int free_tiny_fast(void* ptr) {
         return 1;
     }
 
+    // Phase 6: C4 ULTRA-free (C4-only, free-only, ENV gated, same pattern as C5/C6)
+    if (tiny_class_is_c4(class_idx) && tiny_c4_ultra_free_enabled()) {
+        tiny_c4_ultra_free_fast(base, class_idx);
+        return 1;
+    }
+
     // C7 v3 fast classify: bypass classify_ptr/ss_map_lookup for clear hits
     if (class_idx == 7 &&
         tiny_front_v3_enabled() &&
diff --git a/hakmem.d b/hakmem.d
index f7c762c4..1269e6be 100644
--- a/hakmem.d
+++ b/hakmem.d
@@ -111,6 +111,8 @@ hakmem.o: core/hakmem.c core/hakmem.h core/hakmem_build_flags.h \
  core/box/../front/../box/tiny_c6_ultra_free_env_box.h \
  core/box/../front/../box/tiny_c5_ultra_free_box.h \
  core/box/../front/../box/tiny_c5_ultra_free_env_box.h \
+ core/box/../front/../box/tiny_c4_ultra_free_box.h \
+ core/box/../front/../box/tiny_c4_ultra_free_env_box.h \
  core/box/../front/../box/tiny_ultra_classes_box.h \
  core/box/../front/../box/tiny_legacy_fallback_box.h \
  core/box/../front/../box/tiny_front_v3_env_box.h \
@@ -310,6 +312,8 @@ core/box/../front/../box/tiny_c6_ultra_free_box.h:
 core/box/../front/../box/tiny_c6_ultra_free_env_box.h:
 core/box/../front/../box/tiny_c5_ultra_free_box.h:
 core/box/../front/../box/tiny_c5_ultra_free_env_box.h:
+core/box/../front/../box/tiny_c4_ultra_free_box.h:
+core/box/../front/../box/tiny_c4_ultra_free_env_box.h:
 core/box/../front/../box/tiny_ultra_classes_box.h:
 core/box/../front/../box/tiny_legacy_fallback_box.h:
 core/box/../front/../box/tiny_front_v3_env_box.h: