Box TLS-SLL + free boundary hardening: normalize C0–C6 to base (ptr-1) at free boundary; route all caches/freelists via base; replace remaining g_tls_sll_head direct writes with Box API (tls_sll_push/splice) in refill/magazine/ultra; keep C7 excluded. Fixes rbp=0xa0 free crash by preventing header overwrite and centralizing TLS-SLL invariants.

core/link_stubs.c

@@ -0,0 +1,19 @@
+#include <stddef.h>
+#include <stdlib.h>
+
+// Weak, no-op stubs to satisfy link in configurations where
+// optional components are compiled out or gated by flags.
+// Real implementations (when present) will override these.
+
+__attribute__((weak)) void hak_tiny_prewarm_tls_cache(void) {}
+
+__attribute__((weak)) void* pool_alloc(size_t size) {
+    // Fallback to malloc if Pool TLS not linked
+    return malloc(size);
+}
+
+__attribute__((weak)) void pool_free(void* ptr) {
+    // Fallback to free if Pool TLS not linked
+    free(ptr);
+}
+