FABRIC-2.md: confirm and close hotwords_cache_promote() NULL-write item

Ruling recorded: real defect, unreachable under all four call sites' existing NULL guards, leave as-is.

FABRIC-2.md

@@ -173,8 +173,17 @@ and recorded.
   bug to fix now.
 - [ ] `tools/README.md` documents a `fbtest.c` example that does not actually exist in
   `tools/` — stale-doc discrepancy.
-- [ ] `hotwords_cache_promote()` has a NULL-write bug on a full cache. Unreachable under
-  today's workloads, not fixed.
+- [x] **`hotwords_cache_promote()` has a NULL-write bug on a full cache.** Confirmed
+  2026-08-13: the full-cache branch (`src/physics_hotwords_cache.c:362-371`) writes `word`
+  into `cache->cache[cache->lru_index]` unconditionally once `cache->cache_count >=
+  HOTWORDS_CACHE_SIZE` — it does not check `word` for NULL on that path, unlike the
+  slot-available branch below it, which does. A NULL `word` would silently evict a live
+  cache entry and replace it with NULL. Confirmed unreachable in practice: all four call
+  sites (`physics_hotwords_cache.c:284`, `physics_execution_hooks.c:140`,
+  `rolling_window_of_truth.c:787`, `src/starkernel/vm/vm_core.c:731`) only call
+  `hotwords_cache_promote()` after a `DictEntry*` NULL check has already passed. **Ruling:**
+  flag and leave as-is, matching the `arch_mmu_init()`/block_subsystem precedent — real
+  defect, no live trigger, not fixed without explicit instruction.
 - [ ] `heartbeat_trust()` has zero callers — dead code.
 - [ ] `m5_time_trust`/`m5_variance` are declared and never used.
 - [ ] `src/*.c.bak` files (`vm.c.bak`, `doe_metrics.c.bak`, `inference_engine.c.bak`) remain