diff --git a/core/box/pool_api.inc.h b/core/box/pool_api.inc.h
index dba46234..c203344a 100644
--- a/core/box/pool_api.inc.h
+++ b/core/box/pool_api.inc.h
@@ -10,44 +10,9 @@
 #include "box/pool_stats_box.h"       // Pool statistics & monitoring
 #include "box/pool_mid_desc_cache_box.h"  // Mid descriptor TLS cache
 #include "box/pool_free_v1_box.h"     // Pool v1 free implementation (L0-SplitBox + L1-FastBox/SlowBox)
+#include "box/pool_block_to_user_box.h"  // Pool block to user pointer helpers
 #include <stdint.h>
 
-// Thin helper to keep the hot path straight-line when converting a PoolBlock to
-// a user pointer. All sampling/stat updates remain here so the callers stay
-// small.
-static inline void* hak_pool_block_to_user(PoolBlock* b, int class_idx, uintptr_t site_id) {
-    void* raw = (void*)b;
-    AllocHeader* hdr = (AllocHeader*)raw;
-    mid_set_header(hdr, g_class_sizes[class_idx], site_id);
-    void* user = (char*)raw + HEADER_SIZE;
-    mid_page_inuse_inc(raw);
-    t_pool_rng ^= t_pool_rng << 13;
-    t_pool_rng ^= t_pool_rng >> 17;
-    t_pool_rng ^= t_pool_rng << 5;
-    if ((t_pool_rng & ((1u << g_count_sample_exp) - 1u)) == 0u) {
-        g_pool.hits[class_idx]++;
-    }
-    pagefault_telemetry_touch(PF_BUCKET_MID, user);
-    return user;
-}
-
-// Legacy inline conversion used when v2 helper is disabled.
-static inline void* hak_pool_block_to_user_legacy(PoolBlock* b, int class_idx, uintptr_t site_id) {
-    void* raw = (void*)b;
-    AllocHeader* hdr = (AllocHeader*)raw;
-    mid_set_header(hdr, g_class_sizes[class_idx], site_id);
-    void* user = (char*)raw + HEADER_SIZE;
-    mid_page_inuse_inc(raw);
-    t_pool_rng ^= t_pool_rng << 13;
-    t_pool_rng ^= t_pool_rng >> 17;
-    t_pool_rng ^= t_pool_rng << 5;
-    if ((t_pool_rng & ((1u << g_count_sample_exp) - 1u)) == 0u) {
-        g_pool.hits[class_idx]++;
-    }
-    pagefault_telemetry_touch(PF_BUCKET_MID, user);
-    return user;
-}
-
 static inline void* hak_pool_try_alloc_v2_impl(size_t size, uintptr_t site_id) {
     // Debug: IMMEDIATE output to verify function is called
     static int first_call = 1;
diff --git a/core/box/pool_block_to_user_box.h b/core/box/pool_block_to_user_box.h
new file mode 100644
index 00000000..7c225b92
--- /dev/null
+++ b/core/box/pool_block_to_user_box.h
@@ -0,0 +1,60 @@
+// pool_block_to_user_box.h — Box: Pool Block to User Pointer Helpers
+//
+// Purpose: Thin helpers to convert PoolBlock to user pointers
+// Pattern: Inline helpers for hot path allocation finalization
+// Phase: Pool API Modularization - Step 4
+// Dependencies: Assumes pool_api.inc.h includes this after hakmem_internal.h
+//               (provides AllocHeader, PoolBlock, g_pool, g_class_sizes, etc.)
+
+#ifndef POOL_BLOCK_TO_USER_BOX_H
+#define POOL_BLOCK_TO_USER_BOX_H
+
+#include "pagefault_telemetry_box.h"  // PF_BUCKET_MID
+#include <stdint.h>
+
+// Forward declarations
+extern void mid_set_header(AllocHeader* hdr, size_t size, uintptr_t site_id);
+extern void mid_page_inuse_inc(void* raw);
+
+// Assumed available from caller includes:
+// - AllocHeader, PoolBlock (from hakmem_internal.h / pool_tls_types.inc.h)
+// - g_pool, g_class_sizes, t_pool_rng, g_count_sample_exp (from hakmem_pool.c)
+// - HEADER_SIZE (from hakmem_internal.h)
+
+// Thin helper to keep the hot path straight-line when converting a PoolBlock to
+// a user pointer. All sampling/stat updates remain here so the callers stay
+// small.
+static inline void* hak_pool_block_to_user(PoolBlock* b, int class_idx, uintptr_t site_id) {
+    void* raw = (void*)b;
+    AllocHeader* hdr = (AllocHeader*)raw;
+    mid_set_header(hdr, g_class_sizes[class_idx], site_id);
+    void* user = (char*)raw + HEADER_SIZE;
+    mid_page_inuse_inc(raw);
+    t_pool_rng ^= t_pool_rng << 13;
+    t_pool_rng ^= t_pool_rng >> 17;
+    t_pool_rng ^= t_pool_rng << 5;
+    if ((t_pool_rng & ((1u << g_count_sample_exp) - 1u)) == 0u) {
+        g_pool.hits[class_idx]++;
+    }
+    pagefault_telemetry_touch(PF_BUCKET_MID, user);
+    return user;
+}
+
+// Legacy inline conversion used when v2 helper is disabled.
+static inline void* hak_pool_block_to_user_legacy(PoolBlock* b, int class_idx, uintptr_t site_id) {
+    void* raw = (void*)b;
+    AllocHeader* hdr = (AllocHeader*)raw;
+    mid_set_header(hdr, g_class_sizes[class_idx], site_id);
+    void* user = (char*)raw + HEADER_SIZE;
+    mid_page_inuse_inc(raw);
+    t_pool_rng ^= t_pool_rng << 13;
+    t_pool_rng ^= t_pool_rng >> 17;
+    t_pool_rng ^= t_pool_rng << 5;
+    if ((t_pool_rng & ((1u << g_count_sample_exp) - 1u)) == 0u) {
+        g_pool.hits[class_idx]++;
+    }
+    pagefault_telemetry_touch(PF_BUCKET_MID, user);
+    return user;
+}
+
+#endif  // POOL_BLOCK_TO_USER_BOX_H