Fix C0/C7 class confusion: Upgrade C7 stride to 2048B and fix meta->class_idx initialization

Root Cause:
1. C7 stride was 1024B, unable to serve 1024B user requests (need 1025B with header)
2. New SuperSlabs start with meta->class_idx=0 (mmap zero-init)
3. superslab_init_slab() only sets class_idx if meta->class_idx==255
4. Multiple code paths used conditional assignment (if class_idx==255), leaving C7 slabs with class_idx=0
5. This caused C7 blocks to be misidentified as C0, leading to HDR_META_MISMATCH errors

Changes:
1. Upgrade C7 stride: 1024B → 2048B (can now serve 1024B requests)
2. Update blocks_per_slab[7]: 64 → 32 (2048B stride / 64KB slab)
3. Update size-to-class LUT: entries 513-2048 now map to C7
4. Fix superslab_init_slab() fail-safe: only reinitialize if class_idx==255 (not 0)
5. Add explicit class_idx assignment in 6 initialization paths:
   - tiny_superslab_alloc.inc.h: superslab_refill() after init
   - hakmem_tiny_superslab.c: backend_shared after init (main path)
   - ss_unified_backend_box.c: unconditional assignment
   - ss_legacy_backend_box.c: explicit assignment
   - superslab_expansion_box.c: explicit assignment
   - ss_allocation_box.c: fail-safe condition fix

Fix P0 refill bug:
- Update obsolete array access after Phase 3d-B TLS SLL unification
- g_tls_sll_head[cls] → g_tls_sll[cls].head
- g_tls_sll_count[cls] → g_tls_sll[cls].count

Results:
- HDR_META_MISMATCH: eliminated (0 errors in 100K iterations)
- 1024B allocations now routed to C7 (Tiny fast path)
- NXT_MISALIGN warnings remain (legacy 1024B SuperSlabs, separate issue)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

core/box/superslab_expansion_box.c

@@ -67,6 +67,10 @@ ExpansionResult expansion_expand_with_tls_guarantee(
     size_t block_size = g_tiny_class_sizes[class_idx];
     superslab_init_slab(new_ss, 0, block_size, my_tid);
 
+    // CRITICAL FIX: Explicitly set class_idx to avoid C0/C7 confusion.
+    // New SuperSlabs start with meta->class_idx=0 (mmap zero-init).
+    new_ss->slabs[0].class_idx = (uint8_t)class_idx;
+
     // Now bind slab 0 to TLS state
     result.new_state.ss = new_ss;
     result.new_state.class_idx = class_idx;
@@ -78,6 +82,14 @@ ExpansionResult expansion_expand_with_tls_guarantee(
     // Formula: base = ss + (slab_idx * SLAB_SIZE) + (slab_idx == 0 ? SLAB0_OFFSET : 0)
     result.new_state.slab_base = (uint8_t*)new_ss + SUPERSLAB_SLAB0_DATA_OFFSET;
 
+    // Debug: log backend used for expansion (first few only)
+    static _Atomic uint32_t g_ss_backend_log = 0;
+    uint32_t n = atomic_fetch_add_explicit(&g_ss_backend_log, 1, memory_order_relaxed);
+    if (n < 4) {
+        fprintf(stderr, "[SS_BACKEND] expand legacy cls=%d ss=%p slab_idx=0 base=%p\n",
+                class_idx, (void*)new_ss, result.new_state.slab_base);
+    }
+
     result.success = true;
     result.error_code = 0;