Nabb does not aim. He brackets. One stone falls short, one falls long, and the third one lands wherever you were always going to be standing — which is why the only defence against him is to never be standing anywhere for long.
A light stone and a name called in the open. The bracket opens at one.
One stage further and a heavier stone. This is the inverse of every prior telegraph in this bestiary — Barknuckle's Marked Tide checks where you are when the wave lands; Nabb's threat is accumulated in advance, so there is nothing to react to at the end.
Back to one, from scratch. Keeping the whole party in motion for the entire fight is the actual answer, and it is exactly what a settled firing line does not want to do.
5d10+15 with a Reflex save for half, and knockdown plus daze on a failure. Then he clears the book and starts ranging somebody else.
Goblin Coast's prior ceiling was Barknuckle at CR9 (Grisla Wrecklight and Mother Tideglass sit at CR8, the trash tops out at the CR6 bugbear). This batch is pitched one notch above at CR10, with Malbrek alone as a CR11 apex — enough to matter without turning a starter coastline into a mid-game area.
He is the bestiary's first Warsling Sniper, and the first ranged-artillery boss anywhere in it. The blueprint carries a real sling and real bullets in the ammunition slot: per REFERENCE.md's archer note, the ranged AI flags do nothing at all without a weapon actually equipped, which is the bug that has silently broken archer NPCs in this module before.
No spells and no epic spell — the class has no spellcasting at any level, and CR10 is ten caster levels short of Epic Spellcasting regardless.