Tiny: fix header/stride mismatch and harden refill paths

- Root cause: header-based class indexing (HEADER_CLASSIDX=1) wrote a 1-byte
  header during allocation, but linear carve/refill and initial slab capacity
  still used bare class block sizes. This mismatch could overrun slab usable
  space and corrupt freelists, causing reproducible SEGV at ~100k iters.

Changes
- Superslab: compute capacity with effective stride (block_size + header for
  classes 0..6; class7 remains headerless) in superslab_init_slab(). Add a
  debug-only bound check in superslab_alloc_from_slab() to fail fast if carve
  would exceed usable bytes.
- Refill (non-P0 and P0): use header-aware stride for all linear carving and
  TLS window bump operations. Ensure alignment/validation in tiny_refill_opt.h
  also uses stride, not raw class size.
- Drain: keep existing defense-in-depth for remote sentinel and sanitize nodes
  before splicing into freelist (already present).

Notes
- This unifies the memory layout across alloc/linear-carve/refill with a single
  stride definition and keeps class7 (1024B) headerless as designed.
- Debug builds add fail-fast checks; release builds remain lean.

Next
- Re-run Tiny benches (256/1024B) in debug to confirm stability, then in
  release. If any remaining crash persists, bisect with HAKMEM_TINY_P0_BATCH_REFILL=0
  to isolate P0 batch carve, and continue reducing branch-miss as planned.

core/hakmem_tiny_superslab.c

@@ -184,8 +184,13 @@ static void log_superslab_oom_once(size_t ss_size, size_t alloc_size, int err) {
     g_hakmem_lock_depth--;  // Now safe to restore (all libc calls complete)
 }
 
+// Global counters for debugging (non-static for external access)
+_Atomic uint64_t g_ss_mmap_count = 0;
+_Atomic uint64_t g_final_fallback_mmap_count = 0;
+
 static void* ss_os_acquire(uint8_t size_class, size_t ss_size, uintptr_t ss_mask, int populate) {
     void* ptr = NULL;
+    static int log_count = 0;
 
 #ifdef MAP_ALIGNED_SUPER
     int map_flags = MAP_PRIVATE | MAP_ANONYMOUS | MAP_ALIGNED_SUPER;
@@ -199,6 +204,7 @@ static void* ss_os_acquire(uint8_t size_class, size_t ss_size, uintptr_t ss_mask
                map_flags,
                -1, 0);
     if (ptr != MAP_FAILED) {
+        atomic_fetch_add(&g_ss_mmap_count, 1);
         if (((uintptr_t)ptr & ss_mask) == 0) {
             ss_stats_os_alloc(size_class, ss_size);
             return ptr;
@@ -221,6 +227,14 @@ static void* ss_os_acquire(uint8_t size_class, size_t ss_size, uintptr_t ss_mask
                      PROT_READ | PROT_WRITE,
                      flags,
                      -1, 0);
+    if (raw != MAP_FAILED) {
+        uint64_t count = atomic_fetch_add(&g_ss_mmap_count, 1) + 1;
+        if (log_count < 10) {
+            fprintf(stderr, "[SUPERSLAB_MMAP] #%lu: class=%d size=%zu (total SuperSlab mmaps so far)\n",
+                    (unsigned long)count, size_class, ss_size);
+            log_count++;
+        }
+    }
     if (raw == MAP_FAILED) {
         log_superslab_oom_once(ss_size, alloc_size, errno);
         return NULL;
@@ -717,15 +731,22 @@ void superslab_init_slab(SuperSlab* ss, int slab_idx, size_t block_size, uint32_
     //
     // Phase 6-2.5: Use constants from hakmem_tiny_superslab_constants.h
     size_t usable_size = (slab_idx == 0) ? SUPERSLAB_SLAB0_USABLE_SIZE : SUPERSLAB_SLAB_USABLE_SIZE;
-    int capacity = (int)(usable_size / block_size);
+    // Header-aware stride: include 1-byte header for classes 0-6 when enabled
+    size_t stride = block_size;
+#if HAKMEM_TINY_HEADER_CLASSIDX
+    if (__builtin_expect(ss->size_class != 7, 1)) {
+        stride += 1;
+    }
+#endif
+    int capacity = (int)(usable_size / stride);
 
     // Diagnostic: Verify capacity for class 7 slab 0 (one-shot)
     if (ss->size_class == 7 && slab_idx == 0) {
         static _Atomic int g_cap_log_printed = 0;
         if (atomic_load(&g_cap_log_printed) == 0 &&
             atomic_exchange(&g_cap_log_printed, 1) == 0) {
-            fprintf(stderr, "[SUPERSLAB_INIT] class 7 slab 0: usable_size=%zu block_size=%zu capacity=%d\n",
-                    usable_size, block_size, capacity);
+            fprintf(stderr, "[SUPERSLAB_INIT] class 7 slab 0: usable_size=%zu stride=%zu capacity=%d\n",
+                    usable_size, stride, capacity);
             fprintf(stderr, "[SUPERSLAB_INIT] Expected: 63488 / 1024 = 62 blocks\n");
             if (capacity != 62) {
                 fprintf(stderr, "[SUPERSLAB_INIT] WARNING: capacity=%d (expected 62!)\n", capacity);