fix(page): derive the extend bound from the geometry, not a 64 KiB literal

[Ttimmahlax]

Follows the Kairos RTOS step report (docs/plans/finished/fixed-prim-small-step.md, §8.6–8.7). PR #32 corrected the attribution; this fixes the defect that chase led to.

The defect

page_extend bounds its batch at 4 KiB of payload and computed it as:

let span_shift = 4 + (*page).slice_count.trailing_zeros();
let take = ((reserved >> span_shift).max(1)).min(reserved - capacity);

The identity is 4096 / bsize == reserved / (slice_count * 16), and the 16 is SEGMENT_SLICE_SIZE / 4096. So the literal 4 is log2(16) and holds only at the shipped 64 KiB slice.

Under --cfg ra_small_profile the slice is 4 KiB, the true factor is 1, and the bound was 256 bytes of payload instead of 4 KiB — sixteen times too small. For a 512-byte class 8 >> 4 == 0, .max(1) rescues it to one, and every page was extended one block at a time. A page with capacity == 1 has no second block, so the fast path could never hit and malloc_generic ran on 100% of allocations.

Measured

Counters, 100,000 alloc+free pairs, small profile — deterministic, no clock:

size	generic/op before	after	blocks/extend
512	1.0000	0.1250	8
513	1.0000	0.1667	6
1024	1.0000	0.2500	4

Page carve-and-retire churn: 195 per 100,000 → 24 / 32 / 49.

Timing, 32-bit host, ABBA-interleaved, reproduced three times: the 512-vs-513 step inverts from +8.6% (slower) to −36% (faster), and 512 in absolute terms goes 390,200 ns → ~200,000 ns for the same 50,000 pairs, about 1.9× faster.

Blast radius

The default geometry does not move. 65536.trailing_zeros() - 12 == 4, the old literal. The all-features x86-64 assembly diff against main changes exactly one symbol — the debug-record blob — with no executable function touched. This is a ra_small_profile fix.

Not claimed

Not measured on silicon; that rig is the consumer's. The prediction to falsify is §7's heap_4 A/B: 256–512 should stop being the only range rusty_alloc loses. Also still open, and untouched by this: the bin route enters malloc_generic on every op even after the fix.

Gates

20 suites at default / small profile / 256k geometry, gate-selftest 11/11, wasm 20,168 (baseline 20,169), unsafe census clean, clippy 0.

🤖 Generated with Claude Code