diff --git a/core/box/ptr_conversion_box.h b/core/box/ptr_conversion_box.h
index ea0b9cfb..e0527f90 100644
--- a/core/box/ptr_conversion_box.h
+++ b/core/box/ptr_conversion_box.h
@@ -99,8 +99,11 @@ static inline void* ptr_user_to_base_blind(void* user_ptr) {
     // Headerless: base = user
     return user_ptr;
 #else
-    // Phase 1: All classes have 1 byte header -> base = user - 1
-    return (void*)((uint8_t*)user_ptr - 1);
+    // Phase 1: All classes 0-6 have 1 byte header, class 7 is headerless
+    // For blind conversion (no class info), assume standard header offset
+    // This works because class is determined AFTER base pointer calculation
+    size_t offset = TINY_HEADER_SIZE;  // From tiny_layout_box.h
+    return (void*)((uint8_t*)user_ptr - offset);
 #endif
 }
 
diff --git a/core/box/tiny_front_cold_box.h b/core/box/tiny_front_cold_box.h
index 1a8e9fdf..9dedbdc3 100644
--- a/core/box/tiny_front_cold_box.h
+++ b/core/box/tiny_front_cold_box.h
@@ -25,6 +25,7 @@
 #include "../hakmem_tiny_config.h"
 #include "../tiny_region_id.h"
 #include "../front/tiny_unified_cache.h"  // For TinyUnifiedCache, unified_cache_refill
+#include "tiny_layout_box.h"  // For tiny_user_offset()
 
 // ============================================================================
 // Box 3: Tiny Cold Refill + Alloc
@@ -76,7 +77,9 @@ static inline void* tiny_cold_refill_and_alloc(int class_idx) {
     // NOTE: Header already written by unified_cache_refill()
     // (Removed redundant tiny_region_id_write_header() - P2 fix)
     #if HAKMEM_TINY_HEADER_CLASSIDX
-    return (void*)((char*)base + 1);  // USER pointer
+    // Use centralized layout API for offset calculation
+    size_t user_offset = tiny_user_offset(class_idx);
+    return (void*)((char*)base + user_offset);  // USER pointer
     #else
     return base;
     #endif
diff --git a/core/box/tiny_front_hot_box.h b/core/box/tiny_front_hot_box.h
index baeac0e7..693c244b 100644
--- a/core/box/tiny_front_hot_box.h
+++ b/core/box/tiny_front_hot_box.h
@@ -29,6 +29,7 @@
 #include "../hakmem_tiny_config.h"
 #include "../tiny_region_id.h"
 #include "../front/tiny_unified_cache.h"  // For TinyUnifiedCache
+#include "tiny_layout_box.h"  // For tiny_user_offset()
 
 // ============================================================================
 // Branch Prediction Macros (Pointer Safety - Prediction Hints)
@@ -128,7 +129,9 @@ static inline void* tiny_hot_alloc_fast(int class_idx) {
         // Write header + return USER pointer (no branch)
         #if HAKMEM_TINY_HEADER_CLASSIDX
         tiny_region_id_write_header(base, class_idx);  // 1-byte header at BASE
-        return (void*)((char*)base + 1);  // Return USER pointer (BASE+1)
+        // Use centralized layout API for offset calculation
+        size_t user_offset = tiny_user_offset(class_idx);
+        return (void*)((char*)base + user_offset);  // Return USER pointer
         #else
         return base;  // No-header mode: return BASE directly
         #endif