Phase 12: Shared SuperSlab Pool implementation (WIP - runtime crash)

## Summary
Implemented Phase 12 Shared SuperSlab Pool (mimalloc-style) to address
SuperSlab allocation churn (877 SuperSlabs → 100-200 target).

## Implementation (ChatGPT + Claude)
1. **Metadata changes** (superslab_types.h):
   - Added class_idx to TinySlabMeta (per-slab dynamic class)
   - Removed size_class from SuperSlab (no longer per-SuperSlab)
   - Changed owner_tid (16-bit) → owner_tid_low (8-bit)

2. **Shared Pool** (hakmem_shared_pool.{h,c}):
   - Global pool shared by all size classes
   - shared_pool_acquire_slab() - Get free slab for class_idx
   - shared_pool_release_slab() - Return slab when empty
   - Per-class hints for fast path optimization

3. **Integration** (23 files modified):
   - Updated all ss->size_class → meta->class_idx
   - Updated all meta->owner_tid → meta->owner_tid_low
   - superslab_refill() now uses shared pool
   - Free path releases empty slabs back to pool

4. **Build system** (Makefile):
   - Added hakmem_shared_pool.o to OBJS_BASE and TINY_BENCH_OBJS_BASE

## Status: ⚠️ Build OK, Runtime CRASH

**Build**: ✅ SUCCESS
- All 23 files compile without errors
- Only warnings: superslab_allocate type mismatch (legacy code)

**Runtime**: ❌ SEGFAULT
- Crash location: sll_refill_small_from_ss()
- Exit code: 139 (SIGSEGV)
- Test case: ./bench_random_mixed_hakmem 1000 256 42

## Known Issues
1. **SEGFAULT in refill path** - Likely shared_pool_acquire_slab() issue
2. **Legacy superslab_allocate()** still exists (type mismatch warning)
3. **Remaining TODOs** from design doc:
   - SuperSlab physical layout integration
   - slab_handle.h cleanup
   - Remove old per-class head implementation

## Next Steps
1. Debug SEGFAULT (gdb backtrace shows sll_refill_small_from_ss)
2. Fix shared_pool_acquire_slab() or superslab_init_slab()
3. Basic functionality test (1K → 100K iterations)
4. Measure SuperSlab count reduction (877 → 100-200)
5. Performance benchmark (+650-860% expected)

## Files Changed (25 files)
core/box/free_local_box.c
core/box/free_remote_box.c
core/box/front_gate_classifier.c
core/hakmem_super_registry.c
core/hakmem_tiny.c
core/hakmem_tiny_bg_spill.c
core/hakmem_tiny_free.inc
core/hakmem_tiny_lifecycle.inc
core/hakmem_tiny_magazine.c
core/hakmem_tiny_query.c
core/hakmem_tiny_refill.inc.h
core/hakmem_tiny_superslab.c
core/hakmem_tiny_superslab.h
core/hakmem_tiny_tls_ops.h
core/slab_handle.h
core/superslab/superslab_inline.h
core/superslab/superslab_types.h
core/tiny_debug.h
core/tiny_free_fast.inc.h
core/tiny_free_magazine.inc.h
core/tiny_remote.c
core/tiny_superslab_alloc.inc.h
core/tiny_superslab_free.inc.h
Makefile

## New Files (3 files)
PHASE12_SHARED_SUPERSLAB_POOL_DESIGN.md
core/hakmem_shared_pool.c
core/hakmem_shared_pool.h

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: ChatGPT <chatgpt@openai.com>

core/box/front_gate_classifier.c

@@ -111,41 +111,43 @@ static inline ptr_classification_t registry_lookup(void* ptr) {
 
     // Query SuperSlab registry
     struct SuperSlab* ss = hak_super_lookup(ptr);
-    if (!ss) {
+    if (!ss || ss->magic != SUPERSLAB_MAGIC) {
         // Not in Tiny registry
         return result;
     }
 
-    // Found SuperSlab - determine slab index
+    // Found SuperSlab - determine slab index from ptr-1 (block base)
     result.ss = ss;
-    result.class_idx = ss->size_class;
 
-    // Calculate slab index
     uintptr_t ptr_addr = (uintptr_t)ptr;
     uintptr_t ss_addr = (uintptr_t)ss;
-
-    if (ptr_addr < ss_addr) {
-        // Pointer before SuperSlab base (invalid)
+    if (ptr_addr <= ss_addr) {
         result.kind = PTR_KIND_UNKNOWN;
         return result;
     }
 
-    size_t offset = ptr_addr - ss_addr;
-    result.slab_idx = (int)(offset / SLAB_SIZE);
-
-    // Validate slab index (ss_slabs_capacity defined in superslab_inline.h)
-    if (result.slab_idx < 0 || result.slab_idx >= ss_slabs_capacity(ss)) {
-        // Out of range
+    // Use block base for slab index to be consistent with free paths
+    uintptr_t base_addr = ptr_addr - 1;
+    size_t offset = base_addr - ss_addr;
+    int slab_idx = (int)(offset / SLAB_SIZE);
+    if (slab_idx < 0 || slab_idx >= ss_slabs_capacity(ss)) {
         result.kind = PTR_KIND_UNKNOWN;
         return result;
     }
 
-    // Valid Tiny allocation
-    // Only class 7 (1KB) is headerless. Other classes use header-based free path.
-    if (ss->size_class == 7) {
+    result.slab_idx = slab_idx;
+    TinySlabMeta* meta = &ss->slabs[slab_idx];
+    int cls = (meta->class_idx < TINY_NUM_CLASSES) ? (int)meta->class_idx : -1;
+    result.class_idx = cls;
+
+    if (cls == 7) {
+        // 1KB headerless tiny
         result.kind = PTR_KIND_TINY_HEADERLESS;
-    } else {
+    } else if (cls >= 0) {
+        // Other tiny classes with 1-byte header
         result.kind = PTR_KIND_TINY_HEADER;
+    } else {
+        result.kind = PTR_KIND_UNKNOWN;
     }
 
     return result;