diff --git a/check_addr b/check_addr
new file mode 100755
index 00000000..720fccb6
Binary files /dev/null and b/check_addr differ
diff --git a/check_addr.c b/check_addr.c
new file mode 100644
index 00000000..635aef00
--- /dev/null
+++ b/check_addr.c
@@ -0,0 +1,16 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+int main() {
+    void* p = malloc(10);
+    printf("Malloc ptr: %p\n", p);
+    unsigned long long addr = (unsigned long long)p;
+    if (addr > 0x00007fffffffffffULL) {
+        printf("Address > 48-bit detected!\n");
+    } else {
+        printf("Address within 48-bit range.\n");
+    }
+    free(p);
+    return 0;
+}
+
diff --git a/check_addr_mmap b/check_addr_mmap
new file mode 100755
index 00000000..203fd142
Binary files /dev/null and b/check_addr_mmap differ
diff --git a/check_addr_mmap.c b/check_addr_mmap.c
new file mode 100644
index 00000000..0efbdeb0
--- /dev/null
+++ b/check_addr_mmap.c
@@ -0,0 +1,23 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/mman.h>
+
+int main() {
+    void* p = malloc(10);
+    printf("Malloc ptr: %p\n", p);
+    
+    void* m = mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
+    printf("Mmap ptr:   %p\n", m);
+
+    unsigned long long addr = (unsigned long long)m;
+    if (addr > 0x00007fffffffffffULL) {
+        printf("Mmap Address > 48-bit detected!\n");
+    } else {
+        printf("Mmap Address within 48-bit range.\n");
+    }
+    
+    free(p);
+    munmap(m, 4096);
+    return 0;
+}
+
diff --git a/core/box/carve_push_box.d b/core/box/carve_push_box.d
index ba99a90d..e6b6c644 100644
--- a/core/box/carve_push_box.d
+++ b/core/box/carve_push_box.d
@@ -27,8 +27,9 @@ core/box/carve_push_box.o: core/box/carve_push_box.c \
  core/box/../ptr_trace.h core/box/../box/tiny_next_ptr_box.h \
  core/hakmem_tiny_config.h core/tiny_nextptr.h core/hakmem_build_flags.h \
  core/tiny_region_id.h core/superslab/superslab_inline.h \
- core/box/../tiny_debug_ring.h core/box/../superslab/superslab_inline.h \
- core/box/tiny_header_box.h core/box/../tiny_nextptr.h \
+ core/box/tiny_layout_box.h core/box/tiny_header_box.h \
+ core/box/tiny_layout_box.h core/box/../tiny_debug_ring.h \
+ core/box/../superslab/superslab_inline.h core/box/tiny_header_box.h \
  core/box/../tiny_refill_opt.h core/box/../tiny_region_id.h \
  core/box/../box/slab_freelist_atomic.h \
  core/box/../box/../superslab/superslab_types.h \
@@ -83,10 +84,12 @@ core/tiny_nextptr.h:
 core/hakmem_build_flags.h:
 core/tiny_region_id.h:
 core/superslab/superslab_inline.h:
+core/box/tiny_layout_box.h:
+core/box/tiny_header_box.h:
+core/box/tiny_layout_box.h:
 core/box/../tiny_debug_ring.h:
 core/box/../superslab/superslab_inline.h:
 core/box/tiny_header_box.h:
-core/box/../tiny_nextptr.h:
 core/box/../tiny_refill_opt.h:
 core/box/../tiny_region_id.h:
 core/box/../box/slab_freelist_atomic.h:
diff --git a/core/box/front_gate_box.d b/core/box/front_gate_box.d
index e6884f18..312850eb 100644
--- a/core/box/front_gate_box.d
+++ b/core/box/front_gate_box.d
@@ -12,17 +12,19 @@ core/box/front_gate_box.o: core/box/front_gate_box.c \
  core/superslab/superslab_types.h core/superslab/../tiny_box_geometry.h \
  core/tiny_debug_ring.h core/tiny_remote.h core/box/ss_addr_map_box.h \
  core/box/../hakmem_build_flags.h core/tiny_debug_api.h \
- core/box/tls_sll_box.h core/box/../hakmem_internal.h \
- core/box/../hakmem.h core/box/../hakmem_build_flags.h \
- core/box/../hakmem_config.h core/box/../hakmem_features.h \
- core/box/../hakmem_sys.h core/box/../hakmem_whale.h \
- core/box/../box/ptr_type_box.h core/box/../hakmem_tiny_config.h \
+ core/box/tiny_layout_box.h core/box/../hakmem_tiny_config.h \
+ core/box/tiny_header_box.h core/box/tiny_layout_box.h \
+ core/box/../tiny_region_id.h core/box/tls_sll_box.h \
+ core/box/../hakmem_internal.h core/box/../hakmem.h \
+ core/box/../hakmem_build_flags.h core/box/../hakmem_config.h \
+ core/box/../hakmem_features.h core/box/../hakmem_sys.h \
+ core/box/../hakmem_whale.h core/box/../box/ptr_type_box.h \
  core/box/../hakmem_debug_master.h core/box/../tiny_remote.h \
- core/box/../tiny_region_id.h core/box/../hakmem_tiny_integrity.h \
- core/box/../hakmem_tiny.h core/box/../ptr_track.h \
- core/box/../ptr_trace.h core/box/../tiny_debug_ring.h \
- core/box/../superslab/superslab_inline.h core/box/tiny_header_box.h \
- core/box/../tiny_nextptr.h core/box/ptr_conversion_box.h
+ core/box/../hakmem_tiny_integrity.h core/box/../hakmem_tiny.h \
+ core/box/../ptr_track.h core/box/../ptr_trace.h \
+ core/box/../tiny_debug_ring.h core/box/../superslab/superslab_inline.h \
+ core/box/tiny_header_box.h core/box/ptr_conversion_box.h \
+ core/box/ptr_type_box.h
 core/box/front_gate_box.h:
 core/hakmem_tiny.h:
 core/hakmem_build_flags.h:
@@ -52,6 +54,11 @@ core/tiny_remote.h:
 core/box/ss_addr_map_box.h:
 core/box/../hakmem_build_flags.h:
 core/tiny_debug_api.h:
+core/box/tiny_layout_box.h:
+core/box/../hakmem_tiny_config.h:
+core/box/tiny_header_box.h:
+core/box/tiny_layout_box.h:
+core/box/../tiny_region_id.h:
 core/box/tls_sll_box.h:
 core/box/../hakmem_internal.h:
 core/box/../hakmem.h:
@@ -61,10 +68,8 @@ core/box/../hakmem_features.h:
 core/box/../hakmem_sys.h:
 core/box/../hakmem_whale.h:
 core/box/../box/ptr_type_box.h:
-core/box/../hakmem_tiny_config.h:
 core/box/../hakmem_debug_master.h:
 core/box/../tiny_remote.h:
-core/box/../tiny_region_id.h:
 core/box/../hakmem_tiny_integrity.h:
 core/box/../hakmem_tiny.h:
 core/box/../ptr_track.h:
@@ -72,5 +77,5 @@ core/box/../ptr_trace.h:
 core/box/../tiny_debug_ring.h:
 core/box/../superslab/superslab_inline.h:
 core/box/tiny_header_box.h:
-core/box/../tiny_nextptr.h:
 core/box/ptr_conversion_box.h:
+core/box/ptr_type_box.h:
diff --git a/core/box/hak_core_init.inc.h b/core/box/hak_core_init.inc.h
index 3c1b8907..057b008a 100644
--- a/core/box/hak_core_init.inc.h
+++ b/core/box/hak_core_init.inc.h
@@ -10,14 +10,18 @@
 
 // Debug-only SIGSEGV handler (gated by HAKMEM_DEBUG_SEGV)
 static void hakmem_sigsegv_handler(int sig) {
-#ifdef __GLIBC__
-    void* bt[64]; int n = backtrace(bt, 64);
-    fprintf(stderr, "\n[HAKMEM][SIGSEGV] dumping backtrace (%d frames)\n", n);
-    backtrace_symbols_fd(bt, n, fileno(stderr));
-#else
     (void)sig;
-    fprintf(stderr, "\n[HAKMEM][SIGSEGV] (execinfo unavailable)\n");
+    const char* msg = "\n[HAKMEM] Segmentation Fault\n";
+    (void)write(2, msg, 29);
+
+#if !HAKMEM_BUILD_RELEASE
+    // Dump Class 1 (16B) last push info for debugging
+    tiny_debug_dump_last_push(1);
 #endif
+
+    // Restore default handler and re-raise
+    signal(sig, SIG_DFL);
+    raise(sig);
 }
 
 // Phase 7 Task 3: Pre-warm TLS cache helper
diff --git a/core/box/tls_sll_box.h b/core/box/tls_sll_box.h
index a9b5bcef..9ce38bfa 100644
--- a/core/box/tls_sll_box.h
+++ b/core/box/tls_sll_box.h
@@ -40,7 +40,8 @@
 #include "tiny_header_box.h"  // Header Box: Single Source of Truth for header operations
 
 // Per-thread debug shadow: last successful push base per class (release-safe)
-static __thread hak_base_ptr_t s_tls_sll_last_push[TINY_NUM_CLASSES] = {0};
+// Changed to extern to share across TUs (defined in hakmem_tiny.c)
+extern __thread hak_base_ptr_t s_tls_sll_last_push[TINY_NUM_CLASSES];
 
 // Per-thread callsite tracking: last push caller per class (debug-only)
 #if !HAKMEM_BUILD_RELEASE
@@ -116,7 +117,6 @@ static inline hak_base_ptr_t tls_sll_normalize_base(int class_idx, hak_base_ptr_
 // Narrow dump around TLS SLL array when corruption is detected (env-gated)
 static inline void tls_sll_dump_tls_window(int class_idx, const char* stage)
 {
-#if !HAKMEM_BUILD_RELEASE
     static _Atomic uint32_t g_tls_sll_diag_shots = 0;
     static int s_diag_enable = -1;
     if (__builtin_expect(s_diag_enable == -1, 0)) {
@@ -160,9 +160,6 @@ static inline void tls_sll_dump_tls_window(int class_idx, const char* stage)
     fprintf(stderr, " canary_before=%#llx canary_after=%#llx\n",
             (unsigned long long)g_tls_canary_before_sll,
             (unsigned long long)g_tls_canary_after_sll);
-#else
-    (void)class_idx; (void)stage;
-#endif
 }
 
 static inline void tls_sll_record_writer(int class_idx, const char* who)
@@ -365,6 +362,14 @@ static inline bool tls_sll_push_impl(int class_idx, hak_base_ptr_t ptr, uint32_t
         return false;
     }
 
+    // DEBUG: Strict address check on push to catch corruption early
+    uintptr_t ptr_val = (uintptr_t)raw_ptr;
+    if (ptr_val < 4096 || ptr_val > 0x00007fffffffffffULL) {
+        fprintf(stderr, "[TLS_SLL_PUSH_INVALID] cls=%d base=%p (val=%llx) from=%s\n",
+                class_idx, raw_ptr, (unsigned long long)ptr_val, where ? where : "(null)");
+        abort();
+    }
+
     // Header restoration using Header Box (C1-C6 only; C0/C7 skip)
     // Safe mode (HAKMEM_TINY_SLL_SAFEHEADER=1): never overwrite header; reject on magic mismatch.
     // Default mode: restore expected header.
@@ -541,6 +546,7 @@ static inline bool tls_sll_pop_impl(int class_idx, hak_base_ptr_t* out, const ch
             fprintf(stderr, "[TLS_SLL_POP_INVALID] cls=%d head=%p (val=%llx) dropped count=%llu\n",
                     class_idx, raw_base, (unsigned long long)base_addr, (unsigned long long)cnt + 1);
             s_log_limit[class_idx]++;
+            tls_sll_dump_tls_window(class_idx, "invalid_head"); // Added dump
         }
         // Help triage: show last successful push base for this thread/class
         if (!hak_base_is_null(s_tls_sll_last_push[class_idx]) && s_log_limit[class_idx] <= 4) {
diff --git a/core/box/unified_batch_box.d b/core/box/unified_batch_box.d
index ae3d5b63..2ae78582 100644
--- a/core/box/unified_batch_box.d
+++ b/core/box/unified_batch_box.d
@@ -30,9 +30,12 @@ core/box/unified_batch_box.o: core/box/unified_batch_box.c \
  core/box/../box/../ptr_track.h core/box/../box/../ptr_trace.h \
  core/box/../box/../box/tiny_next_ptr_box.h core/hakmem_tiny_config.h \
  core/tiny_nextptr.h core/hakmem_build_flags.h core/tiny_region_id.h \
- core/superslab/superslab_inline.h core/box/../box/../tiny_debug_ring.h \
+ core/superslab/superslab_inline.h core/box/tiny_layout_box.h \
+ core/box/../hakmem_tiny_config.h core/box/tiny_header_box.h \
+ core/box/../hakmem_build_flags.h core/box/tiny_layout_box.h \
+ core/box/../tiny_region_id.h core/box/../box/../tiny_debug_ring.h \
  core/box/../box/../superslab/superslab_inline.h \
- core/box/../box/tiny_header_box.h core/box/../box/../tiny_nextptr.h
+ core/box/../box/tiny_header_box.h
 core/box/unified_batch_box.h:
 core/box/carve_push_box.h:
 core/box/../box/tls_sll_box.h:
@@ -78,7 +81,12 @@ core/tiny_nextptr.h:
 core/hakmem_build_flags.h:
 core/tiny_region_id.h:
 core/superslab/superslab_inline.h:
+core/box/tiny_layout_box.h:
+core/box/../hakmem_tiny_config.h:
+core/box/tiny_header_box.h:
+core/box/../hakmem_build_flags.h:
+core/box/tiny_layout_box.h:
+core/box/../tiny_region_id.h:
 core/box/../box/../tiny_debug_ring.h:
 core/box/../box/../superslab/superslab_inline.h:
 core/box/../box/tiny_header_box.h:
-core/box/../box/../tiny_nextptr.h:
diff --git a/core/front/tiny_unified_cache.d b/core/front/tiny_unified_cache.d
index 288b7cc0..8281258b 100644
--- a/core/front/tiny_unified_cache.d
+++ b/core/front/tiny_unified_cache.d
@@ -22,7 +22,9 @@ core/front/tiny_unified_cache.o: core/front/tiny_unified_cache.c \
  core/box/ss_addr_map_box.h core/box/../hakmem_build_flags.h \
  core/superslab/superslab_inline.h core/hakmem_tiny.h core/hakmem_trace.h \
  core/hakmem_tiny_mini_mag.h core/box/hak_lane_classify.inc.h \
- core/box/ptr_type_box.h core/tiny_debug_api.h \
+ core/box/ptr_type_box.h core/tiny_debug_api.h core/box/tiny_layout_box.h \
+ core/box/../hakmem_tiny_config.h core/box/tiny_header_box.h \
+ core/box/tiny_layout_box.h core/box/../tiny_region_id.h \
  core/front/../hakmem_tiny_superslab.h \
  core/front/../superslab/superslab_inline.h \
  core/front/../box/pagefault_telemetry_box.h \
@@ -65,6 +67,11 @@ core/hakmem_tiny_mini_mag.h:
 core/box/hak_lane_classify.inc.h:
 core/box/ptr_type_box.h:
 core/tiny_debug_api.h:
+core/box/tiny_layout_box.h:
+core/box/../hakmem_tiny_config.h:
+core/box/tiny_header_box.h:
+core/box/tiny_layout_box.h:
+core/box/../tiny_region_id.h:
 core/front/../hakmem_tiny_superslab.h:
 core/front/../superslab/superslab_inline.h:
 core/front/../box/pagefault_telemetry_box.h:
diff --git a/core/hakmem.c b/core/hakmem.c
index 29f1a843..09f1c54e 100644
--- a/core/hakmem.c
+++ b/core/hakmem.c
@@ -57,16 +57,54 @@
 
 // Optional early SIGSEGV handler (runs at load if env toggled)
 static void hakmem_sigsegv_handler_early(int sig) {
-#ifdef __GLIBC__
-    void* bt[64]; int n = backtrace(bt, 64);
-    fprintf(stderr, "\n[HAKMEM][EARLY SIGSEGV] backtrace (%d frames)\n", n);
-    backtrace_symbols_fd(bt, n, fileno(stderr));
-#else
-    (void)sig; fprintf(stderr, "\n[HAKMEM][EARLY SIGSEGV]\n");
-#endif
-    // Dump pointer trace ring if available
-    ptr_trace_dump_now("signal");
+    (void)sig;
+    const char* msg = "\n[HAKMEM] Segmentation Fault (Early Init)\n";
+    (void)write(2, msg, 42);
+    abort();
 }
+
+// Extern debug helper
+#if !HAKMEM_BUILD_RELEASE
+extern void tiny_debug_dump_last_push(int cls);
+#endif
+
+// Global variables moved out of static scope to resolve dependency issues
+int g_initialized = 0;
+int g_strict_free = 0;   // runtime: HAKMEM_SAFE_FREE=1 enables extra safety checks
+int g_invalid_free_log = 0; // runtime: HAKMEM_INVALID_FREE_LOG=1 to log invalid-free messages (extern visible)
+int g_invalid_free_mode = 1;  // 1 = skip invalid-free check (default), 0 = fallback to libc
+_Atomic int g_cached_strategy_id = 0;  // Cached strategy ID (updated every window closure)
+uint64_t g_evo_sample_mask = 0;  // 0 = disabled (default), (1<<N)-1 = sample every 2^N calls
+int g_site_rules_enabled = 0;  // default off to avoid contention in MT
+int g_bench_tiny_only = 0;     // bench preset: Tiny-only fast path
+int g_flush_tiny_on_exit = 0;  // HAKMEM_TINY_FLUSH_ON_EXIT=1
+int g_ultra_debug_on_exit = 0; // HAKMEM_TINY_ULTRA_DEBUG=1
+struct hkm_ace_controller g_ace_controller;
+_Atomic int g_initializing = 0;
+pthread_t g_init_thread;
+int g_jemalloc_loaded = -1;     // -1 unknown, 0/1 cached
+
+// Forward declarations for internal functions used in init/callback
+static void bigcache_free_callback(void* ptr, size_t size);
+static void hak_flush_tiny_exit(void);
+
+// Phase 6-1.7: Box Theory Refactoring - Wrapper function declarations
+#ifdef HAKMEM_TINY_PHASE6_BOX_REFACTOR
+    extern void* hak_tiny_alloc_fast_wrapper(size_t size);
+    extern void hak_tiny_free_fast_wrapper(void* ptr);
+#endif
+
+// KPI utils forward declarations
+static void get_page_faults(uint64_t* soft_pf, uint64_t* hard_pf);
+static uint64_t get_rss_kb(void);
+
+// KPI measurement helpers - MUST be included before hak_core_init.inc.h
+#include "box/hak_kpi_util.inc.h"
+
+#include "box/hak_core_init.inc.h"
+#include "box/hak_alloc_api.inc.h"
+#include "box/hak_free_api.inc.h"
+
 __attribute__((constructor)) static void hakmem_ctor_install_segv(void) {
     const char* dbg = getenv("HAKMEM_DEBUG_SEGV");
     if (dbg && atoi(dbg) != 0) {
@@ -84,9 +122,9 @@ __attribute__((constructor)) static void hakmem_ctor_install_segv(void) {
 }
 #endif
 
-// ============================================================================
+// ============================================================================ 
 // Configuration
-// ============================================================================
+// ============================================================================ 
 
 #define MAX_SITES 256           // Hash table size (power of 2)
 #define SAMPLING_RATE 1         // Sample ALL (PoC demo: no sampling)
@@ -97,38 +135,17 @@ __attribute__((constructor)) static void hakmem_ctor_install_segv(void) {
 // Phase 6.8: THP_POLICY/THPPolicy moved to hakmem_config.h
 
 
-// ============================================================================
+// ============================================================================ 
 // Global State
-// ============================================================================
-
-// NEW Phase ACE: Adaptive Control Engine
-static struct hkm_ace_controller g_ace_controller;
+// ============================================================================ 
 
 // Priority-2 Refactoring: ENV cache (eliminate ~2000 getenv syscalls/sec from hot paths)
 HakEnvCache g_hak_env_cache;
 
-static int g_initialized = 0;
-static int g_strict_free = 0;   // runtime: HAKMEM_SAFE_FREE=1 enables extra safety checks
-int g_invalid_free_log = 0; // runtime: HAKMEM_INVALID_FREE_LOG=1 to log invalid-free messages (extern visible)
-// Phase 7.4: Cache HAKMEM_INVALID_FREE to eliminate 44% CPU overhead (getenv on hot path)
-// Perf analysis showed getenv("HAKMEM_INVALID_FREE") consumed 43.96% of CPU time!
-static int g_invalid_free_mode = 1;  // 1 = skip invalid-free check (default), 0 = fallback to libc
-
 // Statistics
 static uint64_t g_malloc_count = 0;  // Used for optimization stats display
 
-// Phase 6.11.4 P0-2: Cached Strategy (atomic, updated by hak_evo_tick)
-static _Atomic int g_cached_strategy_id = 0;  // Cached strategy ID (updated every window closure)
-
-// Phase 6.15 P0.3: EVO Sampling Control (environment variable)
-static uint64_t g_evo_sample_mask = 0;  // 0 = disabled (default), (1<<N)-1 = sample every 2^N calls
-
-// Phase 6.15 P1: Site Rules enable (env: HAKMEM_SITE_RULES=1 to enable)
-static int g_site_rules_enabled = 0;  // default off to avoid contention in MT
-static int g_bench_tiny_only = 0;     // bench preset: Tiny-only fast path
 int g_ldpreload_mode = 0;  // 1 when running via LD_PRELOAD=libhakmem.so
-static int g_flush_tiny_on_exit = 0;  // HAKMEM_TINY_FLUSH_ON_EXIT=1
-static int g_ultra_debug_on_exit = 0; // HAKMEM_TINY_ULTRA_DEBUG=1
 // Debug: count free() wrapper entries to confirm free routing (optional)
 _Atomic uint64_t g_free_wrapper_calls = 0;
 // Cached LD_PRELOAD detection for wrapper hot paths (avoid getenv per call)
@@ -217,7 +234,6 @@ static inline int hak_force_libc_alloc(void) {
 
 // LD_PRELOAD safety: avoid interposing when jemalloc is present
 static int g_ld_block_jemalloc = -1;   // env: HAKMEM_LD_BLOCK_JEMALLOC (default 1)
-static int g_jemalloc_loaded = -1;     // -1 unknown, 0/1 cached
 static inline int hak_jemalloc_loaded(void) {
     if (g_jemalloc_loaded < 0) {
         void* h = dlopen("libjemalloc.so.2", RTLD_NOLOAD | RTLD_NOW);
@@ -235,9 +251,9 @@ static inline int hak_ld_block_jemalloc(void) {
     return g_ld_block_jemalloc;
 }
 
-// ============================================================================
+// ============================================================================ 
 // Phase 6.15 P1: Remove global lock; keep recursion guard only
-// ---------------------------------------------------------------------------
+// --------------------------------------------------------------------------- 
 // We no longer serialize all allocations with a single global mutex.
 // Instead, each submodule is responsible for its own fine‑grained locking.
 // We keep a per‑thread recursion guard so that internal use of malloc/free
@@ -255,8 +271,6 @@ int hak_in_wrapper(void) {
 }
 
 // Initialization guard
-static _Atomic int g_initializing = 0;
-static pthread_t g_init_thread;
 int hak_is_initializing(void) { return atomic_load_explicit(&g_initializing, memory_order_acquire); }
 
 // Wait helper for non-init threads to avoid libc fallback during init window
@@ -282,9 +296,9 @@ static inline int hak_init_wait_for_ready(void) {
     return 1;  // Init completed
 }
 
-// ============================================================================
+// ============================================================================ 
 // Phase 6-1.5: Ultra-Simple Fast Path Forward Declarations
-// ============================================================================
+// ============================================================================ 
 // Forward declarations for Phase 6 fast path variants
 // Phase 6-1.5: Alignment guessing (hakmem_tiny_ultra_simple.inc)
 #ifdef HAKMEM_TINY_PHASE6_ULTRA_SIMPLE
@@ -298,31 +312,25 @@ extern void* hak_tiny_alloc_metadata(size_t size);
 extern void hak_tiny_free_metadata(void* ptr);
 #endif
 
-// Phase 6-1.7: Box Theory Refactoring - Wrapper function declarations
-#ifdef HAKMEM_TINY_PHASE6_BOX_REFACTOR
-    extern void* hak_tiny_alloc_fast_wrapper(size_t size);
-    extern void hak_tiny_free_fast_wrapper(void* ptr);
-#endif
-
 #include "box/hak_exit_debug.inc.h"
 
 // ============================================================================
 // KPI Measurement (for UCB1) - NEW!
 // ============================================================================
-
-#include "box/hak_kpi_util.inc.h"
+// NOTE: hak_kpi_util.inc.h is now included earlier (before hak_core_init.inc.h)
+// to resolve dependency on g_latency_histogram and related variables
 
 // ============================================================================
 // Internal Helpers
-// ============================================================================
+// ============================================================================ 
 
 // Phase 6.8: All legacy profiling functions removed
 // - hash_site(), get_site_profile(), infer_policy(), record_alloc(), allocate_with_policy()
 // Replaced by ELO-based allocation (hakmem_elo.c)
 
-// ============================================================================
+// ============================================================================ 
 // BigCache eviction callback
-// ============================================================================
+// ============================================================================ 
 
 // BigCache eviction callback (called when cache is full and needs to evict)
 static void bigcache_free_callback(void* ptr, size_t size) {
@@ -381,17 +389,15 @@ static void bigcache_free_callback(void* ptr, size_t size) {
     }
 }
 
-// ============================================================================
+// ============================================================================ 
 // Public API
-// ============================================================================
+// ============================================================================ 
 
 // Thread-safe one-time initialization
-#include "box/hak_core_init.inc.h"
+// (Now included earlier)
 
 // Phase 9.1: Force inline for performance (reduces call overhead by ~30-40%)
-__attribute__((always_inline))
-// hak_alloc_at() 本体は箱へ
-#include "box/hak_alloc_api.inc.h"
+// (Now included earlier)
 
 // Phase 9.1: Force inline for performance (reduces call overhead by ~30-40%)
 // Phase 6-1.7: Disable inline for box refactor to avoid recursive inlining
@@ -400,7 +406,7 @@ __attribute__((always_inline))
 inline
 #endif
 // hak_free_at() 本体は箱へ
-#include "box/hak_free_api.inc.h"
+// (Now included earlier)
 
 
 void hak_print_stats(void) {
@@ -416,9 +422,9 @@ void hak_print_stats(void) {
     printf("========================================\n\n");
 }
 
-// ============================================================================
+// ============================================================================ 
 // Standard C Library Wrappers (LD_PRELOAD) — boxed include
-// ============================================================================
+// ============================================================================ 
 #include "box/hak_wrappers.inc.h"
 
-// (wrappers moved to box/hak_wrappers.inc.h)
+// (wrappers moved to box/hak_wrappers.inc.h)
\ No newline at end of file
diff --git a/core/hakmem_tiny.c b/core/hakmem_tiny.c
index 2f7ff810..ba691c19 100644
--- a/core/hakmem_tiny.c
+++ b/core/hakmem_tiny.c
@@ -39,6 +39,26 @@ extern uint64_t g_bytes_allocated;  // from hakmem_tiny_superslab.c
 // Tiny allocator configuration, debug counters, and return helpers
 #include "hakmem_tiny_config_box.inc"
 
+// ============================================================================ 
+// Debug: TLS SLL last push tracking (for core/box/tls_sll_box.h)
+// ============================================================================ 
+__thread hak_base_ptr_t s_tls_sll_last_push[TINY_NUM_CLASSES] = {0};
+
+#if !HAKMEM_BUILD_RELEASE
+// Helper to dump last push from core/hakmem.c (SEGV handler)
+// Must be visible to other TUs (extern in hakmem_tiny.h or similar if needed,
+// but SEGV handler is in core/hakmem.c which can dlsym or weak link it)
+__attribute__((noinline))
+void tiny_debug_dump_last_push(int cls) {
+    hak_base_ptr_t p = s_tls_sll_last_push[cls];
+    void* raw = HAK_BASE_TO_RAW(p);
+    fprintf(stderr, "[DEBUG] s_tls_sll_last_push[%d] = %p\n", cls, raw);
+    if (raw && (uintptr_t)raw > 4096) {
+        unsigned long* vals = (unsigned long*)raw;
+        fprintf(stderr, "[DEBUG] Memory at %p: %016lx %016lx\n", raw, vals[0], vals[1]);
+    }
+}
+#endif
 // Forward declarations for static helpers used before definition
 struct TinySlab; // forward
 static void move_to_free_list(int class_idx, struct TinySlab* target_slab);
@@ -99,9 +119,9 @@ void* __attribute__((cold, noinline)) hak_tiny_alloc_slow(size_t size, int class
 static void* __attribute__((cold, noinline)) hak_tiny_alloc_slow(size_t size, int class_idx);
 #endif
 
-// ---------------------------------------------------------------------------
+// --------------------------------------------------------------------------- 
 // Box: adopt_gate_try (implementation moved from header for robust linkage)
-// ---------------------------------------------------------------------------
+// --------------------------------------------------------------------------- 
 #include "box/adopt_gate_box.h"
 extern SuperSlab* g_super_reg_by_class[TINY_NUM_CLASSES][SUPER_REG_PER_CLASS];
 extern int g_super_reg_class_size[TINY_NUM_CLASSES];
@@ -161,16 +181,16 @@ SuperSlab* adopt_gate_try(int class_idx, TinyTLSSlab* tls) {
 }
 
 
-// ============================================================================
+// ============================================================================ 
 // Global State - EXTRACTED to hakmem_tiny_globals_box.inc
-// ============================================================================
+// ============================================================================ 
 #include "hakmem_tiny_globals_box.inc"
 
 #include "hakmem_tiny_publish_box.inc"
 
-// ============================================================================
+// ============================================================================ 
 // EXTRACTED TO hakmem_tiny_fastcache.inc.h (Phase 2D-1)
-// ============================================================================
+// ============================================================================ 
 // Functions: tiny_fast_pop(), tiny_fast_push() - 28 lines (lines 377-404)
 // Forward declarations for functions defined in hakmem_tiny_fastcache.inc.h
 static inline void* tiny_fast_pop(int class_idx);
@@ -178,34 +198,34 @@ static inline int tiny_fast_push(int class_idx, void* ptr);
 static inline void* fastcache_pop(int class_idx);
 static inline int fastcache_push(int class_idx, void* ptr);
 
-// ============================================================================
+// ============================================================================ 
 // EXTRACTED TO hakmem_tiny_hot_pop.inc.h (Phase 2D-1)
-// ============================================================================
+// ============================================================================ 
 // Functions: tiny_hot_pop_class0(), tiny_hot_pop_class1(), tiny_hot_pop_class2(), tiny_hot_pop_class3()
 // 88 lines (lines 407-494)
 
 
-// ============================================================================
+// ============================================================================ 
 // Legacy Slow Allocation Path - EXTRACTED to hakmem_tiny_legacy_slow_box.inc
-// ============================================================================
+// ============================================================================ 
 #include "hakmem_tiny_legacy_slow_box.inc"
 
 
-// ============================================================================
+// ============================================================================ 
 // EXTRACTED TO hakmem_tiny_refill.inc.h (Phase 2D-1)
-// ============================================================================
+// ============================================================================ 
 // Function: tiny_fast_refill_and_take() - 39 lines (lines 584-622)
 
-// ============================================================================
+// ============================================================================ 
 // TLS/Frontend State & Configuration - EXTRACTED to hakmem_tiny_tls_state_box.inc
-// ============================================================================
+// ============================================================================ 
 #include "hakmem_tiny_tls_state_box.inc"
 
 #include "hakmem_tiny_intel.inc"
 
-// ============================================================================
+// ============================================================================ 
 // EXTRACTED TO hakmem_tiny_rss.c (Phase 2B-2)
-// ============================================================================
+// ============================================================================ 
 // EXTRACTED: static int get_rss_kb_self(void) {
 // EXTRACTED:     FILE* f = fopen("/proc/self/status", "r");
 // EXTRACTED:     if (!f) return 0;
@@ -294,9 +314,9 @@ enum { HAK_TIER_SLL=1, HAK_TIER_MAG=2, HAK_TIER_SLAB=3, HAK_TIER_SUPER=4, HAK_TI
 // Background refill workers and intelligence engine
 #include "hakmem_tiny_background.inc"
 
-// ============================================================================
+// ============================================================================ 
 // EXTRACTED TO hakmem_tiny_fastcache.inc.h (Phase 2D-1)
-// ============================================================================
+// ============================================================================ 
 // Functions: fastcache_pop(), fastcache_push(), quick_pop() - 25 lines (lines 873-896)
 
 // Ultra-fast try-only variant: attempt a direct SuperSlab bump/freelist pop
@@ -320,46 +340,45 @@ static inline void* hak_tiny_alloc_superslab_try_fast(int class_idx) {
     return NULL;
 }
 
-// ============================================================================
+// ============================================================================ 
 // EXTRACTED TO hakmem_tiny_refill.inc.h (Phase 2D-1)
-// ============================================================================
+// ============================================================================ 
 // Functions: quick_refill_from_sll(), quick_refill_from_mag() - 31 lines (lines 918-949)
 
-// ============================================================================
+// ============================================================================ 
 // EXTRACTED TO hakmem_tiny_refill.inc.h (Phase 2D-1)
-// ============================================================================
+// ============================================================================ 
 // Function: sll_refill_small_from_ss() - 45 lines (lines 952-996)
 
 // Phase 2C-3: TLS operations module (included after helper function definitions)
 #include "hakmem_tiny_tls_ops.h"
 
 // New TLS list refill: owner-only bulk take from TLS-cached SuperSlab slab
-// ============================================================================
+// ============================================================================ 
 // EXTRACTED TO hakmem_tiny_tls_ops.h (Phase 2C-3)
-// ============================================================================
+// ============================================================================ 
 // Function: tls_refill_from_tls_slab() - 101 lines
 // Hot path refill operation, moved to inline function in header
 
-// ============================================================================
+// ============================================================================ 
 // EXTRACTED TO hakmem_tiny_tls_ops.h (Phase 2C-3)
-// ============================================================================
+// ============================================================================ 
 // Function: tls_list_spill_excess() - 97 lines
 // Hot path spill operation, moved to inline function in header
 
-// ============================================================================
+// ============================================================================ 
 // EXTRACTED TO hakmem_tiny_refill.inc.h (Phase 2D-1)
-// ============================================================================
+// ============================================================================ 
 // Function: superslab_tls_bump_fast() - 45 lines (lines 1016-1060)
 
-// ============================================================================
+// ============================================================================ 
 // EXTRACTED TO hakmem_tiny_refill.inc.h (Phase 2D-1)
-// ============================================================================
+// ============================================================================ 
 // Function: frontend_refill_fc() - 44 lines (lines 1063-1106)
 
 
 
 
-
 // SLL capacity policy: for hot tiny classes (0..3), allow larger SLL up to multiplier * mag_cap
 // for >=4 keep current conservative half (to limit footprint).
 
@@ -367,25 +386,25 @@ static inline void* hak_tiny_alloc_superslab_try_fast(int class_idx) {
 #include "hakmem_tiny_sll_cap_box.inc"
 
 
-// ============================================================================
+// ============================================================================ 
 // EXTRACTED TO hakmem_tiny_refill.inc.h (Phase 2D-1)
-// ============================================================================
+// ============================================================================ 
 // Function: bulk_mag_to_sll_if_room() - 22 lines (lines 1133-1154)
 
 // Ultra-Mode Batch Configuration - REMOVED (dead code cleanup 2025-11-27)
 
 #include "hakmem_tiny_remote.inc"
 
-// ============================================================================
+// ============================================================================ 
 // Internal Helpers
-// ============================================================================
+// ============================================================================ 
 
 // Step 2: Slab Registry Operations
 
 // Hash function for slab_base (64KB aligned)
-// ============================================================================
+// ============================================================================ 
 // EXTRACTED TO hakmem_tiny_registry.c (Phase 2B-3)
-// ============================================================================
+// ============================================================================ 
 // EXTRACTED: static inline int registry_hash(uintptr_t slab_base) {
 // EXTRACTED:     return (slab_base >> 16) & SLAB_REGISTRY_MASK;
 // EXTRACTED: }
@@ -443,9 +462,9 @@ static inline void* hak_tiny_alloc_superslab_try_fast(int class_idx) {
 
 // Lookup slab by base address (O(1) average)
 
-// ============================================================================
+// ============================================================================ 
 // Registry Lookup & Owner Slab Discovery - EXTRACTED to hakmem_tiny_slab_lookup_box.inc
-// ============================================================================
+// ============================================================================ 
 #include "hakmem_tiny_slab_lookup_box.inc"
 
 
@@ -455,27 +474,27 @@ static inline void* hak_tiny_alloc_superslab_try_fast(int class_idx) {
 // Function: move_to_free_list() - 20 lines (lines 1126-1145)
 // Move slab to free list
 
-// ============================================================================
+// ============================================================================ 
 // Public API
-// ============================================================================
+// ============================================================================ 
 
-// ============================================================================
+// ============================================================================ 
 // Phase 2D-2: Initialization function (extracted to hakmem_tiny_init.inc)
-// ============================================================================
+// ============================================================================ 
 #include "hakmem_tiny_init.inc"
 
-// ============================================================================
+// ============================================================================ 
 // 3-Layer Architecture (2025-11-01 Simplification)
-// ============================================================================
+// ============================================================================ 
 // Layer 1: TLS Bump Allocator (ultra-fast, 2-3 instructions/op)
 #include "hakmem_tiny_bump.inc.h"
 
 // Layer 2: TLS Small Magazine (fast, 5-10 instructions/op)
 #include "hakmem_tiny_smallmag.inc.h"
 
-// ============================================================================
+// ============================================================================ 
 // Phase 6 Fast Path Options (mutually exclusive)
-// ============================================================================
+// ============================================================================ 
 // Choose ONE of the following Phase 6 optimizations:
 //
 // Phase 6-1.5: Alignment Guessing (LEGACY - committed 2025-11-02)
@@ -492,7 +511,7 @@ static inline void* hak_tiny_alloc_superslab_try_fast(int class_idx) {
 //   - Method: Store pool_type + size_class in 8-byte header
 //   - Benefit: Extends to ALL pools (Tiny/Mid/L25/Whale)
 //   - Eliminates: Registry lookups, mid_lookup, owner checks
-// ============================================================================
+// ============================================================================ 
 
 // Forward declarations for Phase 6 alloc/free functions
 #ifdef HAKMEM_TINY_PHASE6_ULTRA_SIMPLE
@@ -505,9 +524,9 @@ static inline void* hak_tiny_alloc_superslab_try_fast(int class_idx) {
 #endif
 
 
-// ============================================================================
+// ============================================================================ 
 // Phase 6 Wrapper Functions - EXTRACTED to hakmem_tiny_phase6_wrappers_box.inc
-// ============================================================================
+// ============================================================================ 
 #include "hakmem_tiny_phase6_wrappers_box.inc"
 
 
@@ -538,9 +557,9 @@ __attribute__((weak)) int sll_refill_batch_from_ss(int class_idx, int max_take)
 }
 #endif
 
-// ============================================================================
+// ============================================================================ 
 // EXTRACTED TO hakmem_tiny_lifecycle.inc (Phase 2D-3)
-// ============================================================================
+// ============================================================================ 
 // Function: hak_tiny_trim() - 116 lines (lines 1164-1279)
 // Public trim and cleanup operation for lifecycle management
 
@@ -565,9 +584,9 @@ static inline int ultra_validate_sll_head(int class_idx, void* head) {
 extern __thread int g_tls_in_wrapper;
 #endif
 
-// ============================================================================
+// ============================================================================ 
 // EXTRACTED TO hakmem_tiny_lifecycle.inc (Phase 2D-3)
-// ============================================================================
+// ============================================================================ 
 // Function: tiny_tls_cache_drain() - 90 lines (lines 1314-1403)
 // Static function for draining TLS caches
 //
@@ -643,7 +662,7 @@ static void tiny_tls_sll_diag_atexit(void) {
 }
 
 
-// ============================================================================
+// ============================================================================ 
 // ACE Learning Layer & Tiny Guard - EXTRACTED to hakmem_tiny_ace_guard_box.inc
-// ============================================================================
-#include "hakmem_tiny_ace_guard_box.inc"
+// ============================================================================ 
+#include "hakmem_tiny_ace_guard_box.inc"
\ No newline at end of file
diff --git a/core/tiny_alloc_fast_push.d b/core/tiny_alloc_fast_push.d
index c8a24698..0b516fa9 100644
--- a/core/tiny_alloc_fast_push.d
+++ b/core/tiny_alloc_fast_push.d
@@ -24,8 +24,9 @@ core/tiny_alloc_fast_push.o: core/tiny_alloc_fast_push.c \
  core/box/../ptr_trace.h core/box/../box/tiny_next_ptr_box.h \
  core/hakmem_tiny_config.h core/tiny_nextptr.h core/hakmem_build_flags.h \
  core/tiny_region_id.h core/superslab/superslab_inline.h \
- core/box/../tiny_debug_ring.h core/box/../superslab/superslab_inline.h \
- core/box/tiny_header_box.h core/box/../tiny_nextptr.h \
+ core/box/tiny_layout_box.h core/box/tiny_header_box.h \
+ core/box/tiny_layout_box.h core/box/../tiny_debug_ring.h \
+ core/box/../superslab/superslab_inline.h core/box/tiny_header_box.h \
  core/box/front_gate_box.h core/hakmem_tiny.h
 core/hakmem_tiny_config.h:
 core/box/tls_sll_box.h:
@@ -71,9 +72,11 @@ core/tiny_nextptr.h:
 core/hakmem_build_flags.h:
 core/tiny_region_id.h:
 core/superslab/superslab_inline.h:
+core/box/tiny_layout_box.h:
+core/box/tiny_header_box.h:
+core/box/tiny_layout_box.h:
 core/box/../tiny_debug_ring.h:
 core/box/../superslab/superslab_inline.h:
 core/box/tiny_header_box.h:
-core/box/../tiny_nextptr.h:
 core/box/front_gate_box.h:
 core/hakmem_tiny.h:
diff --git a/debug_sll.gdb b/debug_sll.gdb
new file mode 100644
index 00000000..3021900d
--- /dev/null
+++ b/debug_sll.gdb
@@ -0,0 +1,7 @@
+start
+print &g_tls_sll[1].head
+watch *($1) if *($1) > 0x00007fffffffffffULL
+continue
+bt
+info registers
+x/4gx $1
diff --git a/hakmem.d b/hakmem.d
index 35543738..b66f4414 100644
--- a/hakmem.d
+++ b/hakmem.d
@@ -16,21 +16,23 @@ hakmem.o: core/hakmem.c core/hakmem.h core/hakmem_build_flags.h \
  core/box/tiny_next_ptr_box.h core/hakmem_tiny_config.h \
  core/tiny_nextptr.h core/tiny_region_id.h core/tiny_box_geometry.h \
  core/ptr_track.h core/hakmem_super_registry.h core/box/ss_addr_map_box.h \
- core/box/../hakmem_build_flags.h core/tiny_debug_api.h core/hakmem_elo.h \
- core/hakmem_ace_stats.h core/hakmem_batch.h core/hakmem_evo.h \
- core/hakmem_debug.h core/hakmem_prof.h core/hakmem_syscall.h \
- core/hakmem_ace_controller.h core/hakmem_ace_metrics.h \
- core/hakmem_ace_ucb1.h core/box/bench_fast_box.h core/ptr_trace.h \
- core/box/hak_exit_debug.inc.h core/box/hak_kpi_util.inc.h \
- core/box/hak_core_init.inc.h core/hakmem_phase7_config.h \
- core/box/ss_hot_prewarm_box.h core/box/hak_alloc_api.inc.h \
- core/box/../hakmem_tiny.h core/box/../hakmem_pool.h \
- core/box/../hakmem_smallmid.h core/box/mid_large_config_box.h \
- core/box/../hakmem_config.h core/box/../hakmem_features.h \
- core/box/hak_free_api.inc.h core/hakmem_tiny_superslab.h \
- core/box/../tiny_free_fast_v2.inc.h core/box/../tiny_region_id.h \
- core/box/../hakmem_build_flags.h core/box/../hakmem_tiny_config.h \
- core/box/../box/tls_sll_box.h core/box/../box/../hakmem_internal.h \
+ core/box/../hakmem_build_flags.h core/tiny_debug_api.h \
+ core/box/tiny_layout_box.h core/box/../hakmem_tiny_config.h \
+ core/box/tiny_header_box.h core/box/tiny_layout_box.h \
+ core/box/../tiny_region_id.h core/hakmem_elo.h core/hakmem_ace_stats.h \
+ core/hakmem_batch.h core/hakmem_evo.h core/hakmem_debug.h \
+ core/hakmem_prof.h core/hakmem_syscall.h core/hakmem_ace_controller.h \
+ core/hakmem_ace_metrics.h core/hakmem_ace_ucb1.h \
+ core/box/bench_fast_box.h core/ptr_trace.h core/box/hak_core_init.inc.h \
+ core/hakmem_phase7_config.h core/box/ss_hot_prewarm_box.h \
+ core/box/hak_alloc_api.inc.h core/box/../hakmem_tiny.h \
+ core/box/../hakmem_pool.h core/box/../hakmem_smallmid.h \
+ core/box/mid_large_config_box.h core/box/../hakmem_config.h \
+ core/box/../hakmem_features.h core/box/hak_free_api.inc.h \
+ core/hakmem_tiny_superslab.h core/box/../tiny_free_fast_v2.inc.h \
+ core/box/../tiny_region_id.h core/box/../hakmem_build_flags.h \
+ core/box/../hakmem_tiny_config.h core/box/../box/tls_sll_box.h \
+ core/box/../box/../hakmem_internal.h \
  core/box/../box/../hakmem_tiny_config.h \
  core/box/../box/../hakmem_build_flags.h \
  core/box/../box/../hakmem_debug_master.h \
@@ -39,9 +41,8 @@ hakmem.o: core/hakmem.c core/hakmem.h core/hakmem_build_flags.h \
  core/box/../box/../hakmem_tiny.h core/box/../box/../ptr_track.h \
  core/box/../box/../tiny_debug_ring.h \
  core/box/../box/../superslab/superslab_inline.h \
- core/box/../box/tiny_header_box.h core/box/../box/../tiny_nextptr.h \
- core/box/../box/tls_sll_drain_box.h core/box/../box/tls_sll_box.h \
- core/box/../box/slab_recycling_box.h \
+ core/box/../box/tiny_header_box.h core/box/../box/tls_sll_drain_box.h \
+ core/box/../box/tls_sll_box.h core/box/../box/slab_recycling_box.h \
  core/box/../box/../hakmem_tiny_superslab.h \
  core/box/../box/../hakmem_shared_pool.h \
  core/box/../box/../superslab/superslab_types.h \
@@ -53,9 +54,11 @@ hakmem.o: core/hakmem.c core/hakmem.h core/hakmem_build_flags.h \
  core/box/../hakmem_env_cache.h core/box/../superslab/superslab_inline.h \
  core/box/../box/ss_slab_meta_box.h \
  core/box/../box/slab_freelist_atomic.h core/box/../box/free_remote_box.h \
- core/hakmem_tiny_integrity.h core/box/front_gate_v2.h \
+ core/hakmem_tiny_integrity.h core/box/../box/ptr_conversion_box.h \
+ core/box/../box/tiny_layout_box.h core/box/front_gate_v2.h \
  core/box/external_guard_box.h core/box/ss_slab_meta_box.h \
- core/box/fg_tiny_gate_box.h core/box/hak_wrappers.inc.h \
+ core/box/fg_tiny_gate_box.h core/box/hak_exit_debug.inc.h \
+ core/box/hak_kpi_util.inc.h core/box/hak_wrappers.inc.h \
  core/box/front_gate_classifier.h core/box/../front/malloc_tiny_fast.h \
  core/box/../front/../hakmem_build_flags.h \
  core/box/../front/../hakmem_tiny_config.h \
@@ -70,7 +73,8 @@ hakmem.o: core/hakmem.c core/hakmem.h core/hakmem_build_flags.h \
  core/box/../front/../box/../tiny_region_id.h \
  core/box/../front/../box/../front/tiny_unified_cache.h \
  core/box/../front/../box/tiny_front_cold_box.h \
- core/box/tiny_front_config_box.h core/box/wrapper_env_box.h
+ core/box/tiny_front_config_box.h core/box/wrapper_env_box.h \
+ core/box/../hakmem_internal.h core/box/../superslab/superslab_inline.h
 core/hakmem.h:
 core/hakmem_build_flags.h:
 core/hakmem_config.h:
@@ -114,6 +118,11 @@ core/hakmem_super_registry.h:
 core/box/ss_addr_map_box.h:
 core/box/../hakmem_build_flags.h:
 core/tiny_debug_api.h:
+core/box/tiny_layout_box.h:
+core/box/../hakmem_tiny_config.h:
+core/box/tiny_header_box.h:
+core/box/tiny_layout_box.h:
+core/box/../tiny_region_id.h:
 core/hakmem_elo.h:
 core/hakmem_ace_stats.h:
 core/hakmem_batch.h:
@@ -126,8 +135,6 @@ core/hakmem_ace_metrics.h:
 core/hakmem_ace_ucb1.h:
 core/box/bench_fast_box.h:
 core/ptr_trace.h:
-core/box/hak_exit_debug.inc.h:
-core/box/hak_kpi_util.inc.h:
 core/box/hak_core_init.inc.h:
 core/hakmem_phase7_config.h:
 core/box/ss_hot_prewarm_box.h:
@@ -157,7 +164,6 @@ core/box/../box/../ptr_track.h:
 core/box/../box/../tiny_debug_ring.h:
 core/box/../box/../superslab/superslab_inline.h:
 core/box/../box/tiny_header_box.h:
-core/box/../box/../tiny_nextptr.h:
 core/box/../box/tls_sll_drain_box.h:
 core/box/../box/tls_sll_box.h:
 core/box/../box/slab_recycling_box.h:
@@ -178,10 +184,14 @@ core/box/../box/ss_slab_meta_box.h:
 core/box/../box/slab_freelist_atomic.h:
 core/box/../box/free_remote_box.h:
 core/hakmem_tiny_integrity.h:
+core/box/../box/ptr_conversion_box.h:
+core/box/../box/tiny_layout_box.h:
 core/box/front_gate_v2.h:
 core/box/external_guard_box.h:
 core/box/ss_slab_meta_box.h:
 core/box/fg_tiny_gate_box.h:
+core/box/hak_exit_debug.inc.h:
+core/box/hak_kpi_util.inc.h:
 core/box/hak_wrappers.inc.h:
 core/box/front_gate_classifier.h:
 core/box/../front/malloc_tiny_fast.h:
@@ -201,3 +211,5 @@ core/box/../front/../box/../front/tiny_unified_cache.h:
 core/box/../front/../box/tiny_front_cold_box.h:
 core/box/tiny_front_config_box.h:
 core/box/wrapper_env_box.h:
+core/box/../hakmem_internal.h:
+core/box/../superslab/superslab_inline.h:
diff --git a/hakmem_shared_pool.d b/hakmem_shared_pool.d
index 02d12aa4..ed79c3b0 100644
--- a/hakmem_shared_pool.d
+++ b/hakmem_shared_pool.d
@@ -14,19 +14,20 @@ hakmem_shared_pool.o: core/hakmem_shared_pool.c \
  core/ptr_track.h core/hakmem_super_registry.h core/box/ss_addr_map_box.h \
  core/box/../hakmem_build_flags.h core/hakmem_tiny.h core/hakmem_trace.h \
  core/hakmem_tiny_mini_mag.h core/box/hak_lane_classify.inc.h \
- core/box/ptr_type_box.h core/tiny_debug_api.h core/box/ss_hot_cold_box.h \
- core/box/pagefault_telemetry_box.h core/box/tls_sll_drain_box.h \
- core/box/tls_sll_box.h core/box/../hakmem_internal.h \
- core/box/../hakmem.h core/box/../hakmem_build_flags.h \
- core/box/../hakmem_config.h core/box/../hakmem_features.h \
- core/box/../hakmem_sys.h core/box/../hakmem_whale.h \
- core/box/../box/ptr_type_box.h core/box/../hakmem_tiny_config.h \
+ core/box/ptr_type_box.h core/tiny_debug_api.h core/box/tiny_layout_box.h \
+ core/box/../hakmem_tiny_config.h core/box/tiny_header_box.h \
+ core/box/tiny_layout_box.h core/box/../tiny_region_id.h \
+ core/box/ss_hot_cold_box.h core/box/pagefault_telemetry_box.h \
+ core/box/tls_sll_drain_box.h core/box/tls_sll_box.h \
+ core/box/../hakmem_internal.h core/box/../hakmem.h \
+ core/box/../hakmem_build_flags.h core/box/../hakmem_config.h \
+ core/box/../hakmem_features.h core/box/../hakmem_sys.h \
+ core/box/../hakmem_whale.h core/box/../box/ptr_type_box.h \
  core/box/../hakmem_debug_master.h core/box/../tiny_remote.h \
- core/box/../tiny_region_id.h core/box/../hakmem_tiny_integrity.h \
- core/box/../hakmem_tiny.h core/box/../ptr_track.h \
- core/box/../ptr_trace.h core/box/../tiny_debug_ring.h \
- core/box/../superslab/superslab_inline.h core/box/tiny_header_box.h \
- core/box/../tiny_nextptr.h core/box/slab_recycling_box.h \
+ core/box/../hakmem_tiny_integrity.h core/box/../hakmem_tiny.h \
+ core/box/../ptr_track.h core/box/../ptr_trace.h \
+ core/box/../tiny_debug_ring.h core/box/../superslab/superslab_inline.h \
+ core/box/tiny_header_box.h core/box/slab_recycling_box.h \
  core/box/../hakmem_tiny_superslab.h core/box/ss_hot_cold_box.h \
  core/box/free_local_box.h core/hakmem_tiny_superslab.h \
  core/box/ptr_type_box.h core/box/free_publish_box.h core/hakmem_tiny.h \
@@ -66,6 +67,11 @@ core/hakmem_tiny_mini_mag.h:
 core/box/hak_lane_classify.inc.h:
 core/box/ptr_type_box.h:
 core/tiny_debug_api.h:
+core/box/tiny_layout_box.h:
+core/box/../hakmem_tiny_config.h:
+core/box/tiny_header_box.h:
+core/box/tiny_layout_box.h:
+core/box/../tiny_region_id.h:
 core/box/ss_hot_cold_box.h:
 core/box/pagefault_telemetry_box.h:
 core/box/tls_sll_drain_box.h:
@@ -78,10 +84,8 @@ core/box/../hakmem_features.h:
 core/box/../hakmem_sys.h:
 core/box/../hakmem_whale.h:
 core/box/../box/ptr_type_box.h:
-core/box/../hakmem_tiny_config.h:
 core/box/../hakmem_debug_master.h:
 core/box/../tiny_remote.h:
-core/box/../tiny_region_id.h:
 core/box/../hakmem_tiny_integrity.h:
 core/box/../hakmem_tiny.h:
 core/box/../ptr_track.h:
@@ -89,7 +93,6 @@ core/box/../ptr_trace.h:
 core/box/../tiny_debug_ring.h:
 core/box/../superslab/superslab_inline.h:
 core/box/tiny_header_box.h:
-core/box/../tiny_nextptr.h:
 core/box/slab_recycling_box.h:
 core/box/../hakmem_tiny_superslab.h:
 core/box/ss_hot_cold_box.h:
diff --git a/hakmem_tiny_bg_spill.d b/hakmem_tiny_bg_spill.d
index dbad8dc0..23f8f0df 100644
--- a/hakmem_tiny_bg_spill.d
+++ b/hakmem_tiny_bg_spill.d
@@ -10,7 +10,9 @@ hakmem_tiny_bg_spill.o: core/hakmem_tiny_bg_spill.c \
  core/tiny_debug_ring.h core/tiny_remote.h core/box/ss_addr_map_box.h \
  core/box/../hakmem_build_flags.h core/hakmem_tiny.h core/hakmem_trace.h \
  core/hakmem_tiny_mini_mag.h core/box/hak_lane_classify.inc.h \
- core/box/ptr_type_box.h core/tiny_debug_api.h
+ core/box/ptr_type_box.h core/tiny_debug_api.h core/box/tiny_layout_box.h \
+ core/box/../hakmem_tiny_config.h core/box/tiny_header_box.h \
+ core/box/tiny_layout_box.h core/box/../tiny_region_id.h
 core/hakmem_tiny_bg_spill.h:
 core/box/tiny_next_ptr_box.h:
 core/hakmem_tiny_config.h:
@@ -38,3 +40,8 @@ core/hakmem_tiny_mini_mag.h:
 core/box/hak_lane_classify.inc.h:
 core/box/ptr_type_box.h:
 core/tiny_debug_api.h:
+core/box/tiny_layout_box.h:
+core/box/../hakmem_tiny_config.h:
+core/box/tiny_header_box.h:
+core/box/tiny_layout_box.h:
+core/box/../tiny_region_id.h:
diff --git a/hakmem_tiny_magazine.d b/hakmem_tiny_magazine.d
index 208dcfe4..02834aa6 100644
--- a/hakmem_tiny_magazine.d
+++ b/hakmem_tiny_magazine.d
@@ -15,7 +15,9 @@ hakmem_tiny_magazine.o: core/hakmem_tiny_magazine.c \
  core/hakmem_features.h core/hakmem_sys.h core/hakmem_whale.h \
  core/box/tiny_next_ptr_box.h core/hakmem_tiny_config.h \
  core/tiny_nextptr.h core/tiny_region_id.h core/tiny_box_geometry.h \
- core/ptr_track.h core/tiny_debug_api.h
+ core/ptr_track.h core/tiny_debug_api.h core/box/tiny_layout_box.h \
+ core/box/../hakmem_tiny_config.h core/box/tiny_header_box.h \
+ core/box/tiny_layout_box.h core/box/../tiny_region_id.h
 core/hakmem_tiny_magazine.h:
 core/hakmem_tiny.h:
 core/hakmem_build_flags.h:
@@ -52,3 +54,8 @@ core/tiny_region_id.h:
 core/tiny_box_geometry.h:
 core/ptr_track.h:
 core/tiny_debug_api.h:
+core/box/tiny_layout_box.h:
+core/box/../hakmem_tiny_config.h:
+core/box/tiny_header_box.h:
+core/box/tiny_layout_box.h:
+core/box/../tiny_region_id.h:
diff --git a/hakmem_tiny_sfc.d b/hakmem_tiny_sfc.d
index bbeb4bad..8b53d2fc 100644
--- a/hakmem_tiny_sfc.d
+++ b/hakmem_tiny_sfc.d
@@ -10,17 +10,18 @@ hakmem_tiny_sfc.o: core/hakmem_tiny_sfc.c core/tiny_alloc_fast_sfc.inc.h \
  core/superslab/superslab_types.h core/superslab/../tiny_box_geometry.h \
  core/tiny_debug_ring.h core/tiny_remote.h core/box/ss_addr_map_box.h \
  core/box/../hakmem_build_flags.h core/tiny_debug_api.h \
- core/hakmem_stats_master.h core/tiny_tls.h core/box/tls_sll_box.h \
- core/box/../hakmem_internal.h core/box/../hakmem.h \
- core/box/../hakmem_build_flags.h core/box/../hakmem_config.h \
- core/box/../hakmem_features.h core/box/../hakmem_sys.h \
- core/box/../hakmem_whale.h core/box/../box/ptr_type_box.h \
- core/box/../hakmem_tiny_config.h core/box/../hakmem_debug_master.h \
- core/box/../tiny_remote.h core/box/../tiny_region_id.h \
- core/box/../hakmem_tiny_integrity.h core/box/../hakmem_tiny.h \
- core/box/../ptr_track.h core/box/../ptr_trace.h \
- core/box/../tiny_debug_ring.h core/box/../superslab/superslab_inline.h \
- core/box/tiny_header_box.h core/box/../tiny_nextptr.h \
+ core/box/tiny_layout_box.h core/box/../hakmem_tiny_config.h \
+ core/box/tiny_header_box.h core/box/tiny_layout_box.h \
+ core/box/../tiny_region_id.h core/hakmem_stats_master.h core/tiny_tls.h \
+ core/box/tls_sll_box.h core/box/../hakmem_internal.h \
+ core/box/../hakmem.h core/box/../hakmem_build_flags.h \
+ core/box/../hakmem_config.h core/box/../hakmem_features.h \
+ core/box/../hakmem_sys.h core/box/../hakmem_whale.h \
+ core/box/../box/ptr_type_box.h core/box/../hakmem_debug_master.h \
+ core/box/../tiny_remote.h core/box/../hakmem_tiny_integrity.h \
+ core/box/../hakmem_tiny.h core/box/../ptr_track.h \
+ core/box/../ptr_trace.h core/box/../tiny_debug_ring.h \
+ core/box/../superslab/superslab_inline.h core/box/tiny_header_box.h \
  core/hakmem_env_cache.h
 core/tiny_alloc_fast_sfc.inc.h:
 core/hakmem_tiny.h:
@@ -49,6 +50,11 @@ core/tiny_remote.h:
 core/box/ss_addr_map_box.h:
 core/box/../hakmem_build_flags.h:
 core/tiny_debug_api.h:
+core/box/tiny_layout_box.h:
+core/box/../hakmem_tiny_config.h:
+core/box/tiny_header_box.h:
+core/box/tiny_layout_box.h:
+core/box/../tiny_region_id.h:
 core/hakmem_stats_master.h:
 core/tiny_tls.h:
 core/box/tls_sll_box.h:
@@ -60,10 +66,8 @@ core/box/../hakmem_features.h:
 core/box/../hakmem_sys.h:
 core/box/../hakmem_whale.h:
 core/box/../box/ptr_type_box.h:
-core/box/../hakmem_tiny_config.h:
 core/box/../hakmem_debug_master.h:
 core/box/../tiny_remote.h:
-core/box/../tiny_region_id.h:
 core/box/../hakmem_tiny_integrity.h:
 core/box/../hakmem_tiny.h:
 core/box/../ptr_track.h:
@@ -71,5 +75,4 @@ core/box/../ptr_trace.h:
 core/box/../tiny_debug_ring.h:
 core/box/../superslab/superslab_inline.h:
 core/box/tiny_header_box.h:
-core/box/../tiny_nextptr.h:
 core/hakmem_env_cache.h:
diff --git a/tiny_adaptive_sizing.d b/tiny_adaptive_sizing.d
index 263b44b8..74a7024f 100644
--- a/tiny_adaptive_sizing.d
+++ b/tiny_adaptive_sizing.d
@@ -10,7 +10,10 @@ tiny_adaptive_sizing.o: core/tiny_adaptive_sizing.c \
  core/hakmem_tiny_superslab_constants.h core/superslab/superslab_inline.h \
  core/superslab/superslab_types.h core/superslab/../tiny_box_geometry.h \
  core/tiny_debug_ring.h core/tiny_remote.h core/box/ss_addr_map_box.h \
- core/box/../hakmem_build_flags.h core/tiny_debug_api.h
+ core/box/../hakmem_build_flags.h core/tiny_debug_api.h \
+ core/box/tiny_layout_box.h core/box/../hakmem_tiny_config.h \
+ core/box/tiny_header_box.h core/box/tiny_layout_box.h \
+ core/box/../tiny_region_id.h
 core/tiny_adaptive_sizing.h:
 core/hakmem_tiny.h:
 core/hakmem_build_flags.h:
@@ -38,3 +41,8 @@ core/tiny_remote.h:
 core/box/ss_addr_map_box.h:
 core/box/../hakmem_build_flags.h:
 core/tiny_debug_api.h:
+core/box/tiny_layout_box.h:
+core/box/../hakmem_tiny_config.h:
+core/box/tiny_header_box.h:
+core/box/tiny_layout_box.h:
+core/box/../tiny_region_id.h:
diff --git a/tiny_fastcache.d b/tiny_fastcache.d
index 9c04a441..1c9a746d 100644
--- a/tiny_fastcache.d
+++ b/tiny_fastcache.d
@@ -10,7 +10,9 @@ tiny_fastcache.o: core/tiny_fastcache.c core/tiny_fastcache.h \
  core/tiny_debug_ring.h core/tiny_remote.h core/box/ss_addr_map_box.h \
  core/box/../hakmem_build_flags.h core/hakmem_tiny.h core/hakmem_trace.h \
  core/hakmem_tiny_mini_mag.h core/box/hak_lane_classify.inc.h \
- core/box/ptr_type_box.h core/tiny_debug_api.h
+ core/box/ptr_type_box.h core/tiny_debug_api.h core/box/tiny_layout_box.h \
+ core/box/../hakmem_tiny_config.h core/box/tiny_header_box.h \
+ core/box/tiny_layout_box.h core/box/../tiny_region_id.h
 core/tiny_fastcache.h:
 core/hakmem_env_cache.h:
 core/box/tiny_next_ptr_box.h:
@@ -39,3 +41,8 @@ core/hakmem_tiny_mini_mag.h:
 core/box/hak_lane_classify.inc.h:
 core/box/ptr_type_box.h:
 core/tiny_debug_api.h:
+core/box/tiny_layout_box.h:
+core/box/../hakmem_tiny_config.h:
+core/box/tiny_header_box.h:
+core/box/tiny_layout_box.h:
+core/box/../tiny_region_id.h: