Fix C7 TLS SLL corruption: Protect next pointer from user data overwrites

## Root Cause
C7 (1024B allocations, 2048B stride) was using offset=1 for freelist next
pointers, storing them at `base[1..8]`. Since user pointer is `base+1`, users
could overwrite the next pointer area, corrupting the TLS SLL freelist.

## The Bug Sequence
1. Block freed → TLS SLL push stores next at `base[1..8]`
2. Block allocated → User gets `base+1`, can modify `base[1..2047]`
3. User writes data → Overwrites `base[1..8]` (next pointer area!)
4. Block freed again → tiny_next_load() reads garbage from `base[1..8]`
5. TLS SLL head becomes invalid (0xfe, 0xdb, 0x58, etc.)

## Why This Was Reverted
Previous fix (C7 offset=0) was reverted with comment:
  "C7も header を保持して class 判別を壊さないことを優先"
  (Prioritize preserving C7 header to avoid breaking class identification)

This reasoning was FLAWED because:
- Header IS restored during allocation (HAK_RET_ALLOC), not freelist ops
- Class identification at free time reads from ptr-1 = base[0] (after restoration)
- During freelist, header CAN be sacrificed (not visible to user)
- The revert CREATED the race condition by exposing base[1..8] to user

## Fix Applied

### 1. Revert C7 offset to 0 (tiny_nextptr.h:54)
```c
// BEFORE (BROKEN):
return (class_idx == 0) ? 0u : 1u;

// AFTER (FIXED):
return (class_idx == 0 || class_idx == 7) ? 0u : 1u;
```

### 2. Remove C7 header restoration in freelist (tiny_nextptr.h:84)
```c
// BEFORE (BROKEN):
if (class_idx != 0) {  // Restores header for all classes including C7

// AFTER (FIXED):
if (class_idx != 0 && class_idx != 7) {  // Only C1-C6 restore headers
```

### 3. Bonus: Remove premature slab release (tls_sll_drain_box.h:182-189)
Removed `shared_pool_release_slab()` call from drain path that could cause
use-after-free when blocks from same slab remain in TLS SLL.

## Why This Fix Works

**Memory Layout** (C7 in freelist):
```
Address:     base      base+1        base+2048
            ┌────┬──────────────────────┐
Content:    │next│  (user accessible)  │
            └────┴──────────────────────┘
            8B ptr  ← USER CANNOT TOUCH base[0]
```

- **Next pointer at base[0]**: Protected from user modification ✓
- **User pointer at base+1**: User sees base[1..2047] only ✓
- **Header restored during allocation**: HAK_RET_ALLOC writes 0xa7 at base[0] ✓
- **Class ID preserved**: tiny_region_id_read_header(ptr) reads ptr-1 = base[0] ✓

## Verification Results

### Before Fix
- **Errors**: 33 TLS_SLL_POP_INVALID per 100K iterations (0.033%)
- **Performance**: 1.8M ops/s (corruption caused slow path fallback)
- **Symptoms**: Invalid TLS SLL heads (0xfe, 0xdb, 0x58, 0x80, 0xc2, etc.)

### After Fix
- **Errors**: 0 per 200K iterations ✅
- **Performance**: 10.0M ops/s (+456%!) ✅
- **C7 direct test**: 5.5M ops/s, 100K iterations, 0 errors ✅

## Files Modified
- core/tiny_nextptr.h (lines 49-54, 82-84) - C7 offset=0, no header restoration
- core/box/tls_sll_drain_box.h (lines 182-189) - Remove premature slab release

## Architectural Lesson

**Design Principle**: Freelist metadata MUST be stored in memory NOT accessible to user.

| Class | Offset | Next Storage | User Access | Result |
|-------|--------|--------------|-------------|--------|
| C0 | 0 | base[0] | base[1..7] | Safe ✓ |
| C1-C6 | 1 | base[1..8] | base[1..N] | Safe (header at base[0]) ✓ |
| C7 (broken) | 1 | base[1..8] | base[1..2047] | **CORRUPTED** ✗ |
| C7 (fixed) | 0 | base[0] | base[1..2047] | Safe ✓ |

🧹 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

core/box/tls_sll_drain_box.h

@@ -179,20 +179,14 @@ static inline uint32_t tiny_tls_sll_drain(int class_idx, uint32_t batch_size) {
 
         drained++;
 
-        // CRITICAL: Check if slab became empty and release to shared pool
-        // (This logic is in tiny_superslab_free.inc.h:223-236)
-        if (meta->used == 0) {
-            // Debug: Log when used reaches 0 (slab becomes empty)
-            if (g_debug) {
-                fprintf(stderr, "[TLS_SLL_DRAIN] EMPTY: class=%d ss=%p slab=%d (meta->used=0) -> releasing to pool\n",
-                        class_idx, (void*)ss, slab_idx);
-            }
-
-            // Release empty slab to shared pool
-            // This will eventually free the SuperSlab and add to LRU cache
-            extern void shared_pool_release_slab(SuperSlab* ss, int slab_idx);
-            shared_pool_release_slab(ss, slab_idx);
-        }
+        // BUG FIX: DO NOT release slab here even if meta->used == 0
+        // Reason: Other blocks from the same slab may still be queued in TLS SLL
+        //         waiting to be drained. Releasing the slab prematurely causes:
+        //         1. SuperSlab reused for different class
+        //         2. hak_super_lookup() returns NULL for remaining blocks
+        //         3. TLS_SLL_POP_INVALID errors and corruption
+        // Solution: Let LRU eviction and normal lifecycle handle empty slab release.
+        //           Empty slabs will naturally be reclaimed when SuperSlab is idle.
     }
 
     if (g_debug && drained > 0) {

core/tiny_nextptr.h

@@ -46,11 +46,12 @@
 // Compute freelist next-pointer offset within a block for the given class.
 static inline __attribute__((always_inline)) size_t tiny_next_off(int class_idx) {
 #if HAKMEM_TINY_HEADER_CLASSIDX
-    // Phase E1-CORRECT REVISED (C7 corruption fix):
-    // Class 0 → offset 0 (8B block、header後に8Bポインタは入らない)
-    // Class 1-7 → offset 1 (header保持、nextはheader直後)
-    //   C7も header を保持して class 判別を壊さないことを優先
-    return (class_idx == 0) ? 0u : 1u;
+    // Phase E1-CORRECT FINAL (C7 user data corruption fix):
+    // Class 0, 7 → offset 0 (freelist中はheader潰す - next pointerをuser dataから保護)
+    //   - C0: 8B block, header後に8Bポインタ入らない (物理制約)
+    //   - C7: 2048B block, nextを base[0] に格納してuser accessible領域から隔離 (設計選択)
+    // Class 1-6 → offset 1 (header保持 - 十分なpayloadあり、user dataと干渉しない)
+    return (class_idx == 0 || class_idx == 7) ? 0u : 1u;
 #else
     (void)class_idx;
     return 0u;
@@ -78,7 +79,9 @@ static inline __attribute__((always_inline)) void tiny_next_store(void* base, in
     size_t off = tiny_next_off(class_idx);
 
 #if HAKMEM_TINY_HEADER_CLASSIDX
-    if (class_idx != 0) {
+    // Only restore header for C1-C6 (offset=1 classes)
+    // C0, C7 use offset=0, so header will be overwritten by next pointer
+    if (class_idx != 0 && class_idx != 7) {
         uint8_t expected = (uint8_t)(HEADER_MAGIC | (class_idx & HEADER_CLASS_MASK));
         uint8_t got = *(uint8_t*)base;
         if (__builtin_expect(got != expected, 0)) {