Stage D batch 1: fix silent error sites in repl.c and inference_words.c (FABRIC-3.md §XXXII.6)

repl.c's sk_word_blk_attach_ack() and inference_words.c's array_ptr()
helper + infer_word_run()'s allocation guard now log a diagnostic via
log_message(LOG_ERROR, ...) before setting vm->error, matching
defer_words.c's own gold-standard pattern (§XXXII.3) -- these are
internal/background conditions (a malformed message-callback, a bad
array reference or allocation failure), not interactive usage mistakes,
so the fix keeps the fault and reports it rather than dropping it like
USE's own fix did.

Batched together (4 sites total, smaller combined than the next file)
rather than two separate acceptance cycles for negligible size.

Three-arch clean qemu acceptance passed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BWpNjdwPtFLuVLaAq44L9K

FABRIC-3.md

@@ -4515,3 +4515,32 @@ Matching §XXVIII's own gated-stage shape (each stage its own commit, its own fu
 **Nothing in this section has been implemented.** This write-up is the deliverable for this
 pass -- Stage A begins only once reviewed.
 
+### XXXII.6 -- Stage D: fixes, smallest file first
+
+Per direct instruction, batches ordered by file size (silent-site count), not by finding
+severity -- §XXXII.3's own "two findings above the rest" get fixed as part of whichever file's
+batch they fall in, not pulled forward.
+
+**Batch 1 -- DONE, 2026-09-15: `repl.c` (1 site) + `inference_words.c` (3 sites), combined into
+one commit.** Deliberately batched together rather than run two separate 3-arch acceptance
+cycles for 4 total sites -- their combined size is still smaller than the next file
+(`log_words.c`, 10 sites), so splitting them would add cost without adding review granularity.
+
+- `repl.c:231` (`sk_word_blk_attach_ack`, the `BLK-ATTACH-ACK` message-callback dispatched via
+  `VM-EXEC` from Artemis's own `MSG-TICK`, not a directly human-typed command): diagnostic added
+  via `log_message(LOG_ERROR, ...)`, matching `defer_words.c`'s gold-standard shape (report,
+  then still fault) since this condition -- the ack message arriving malformed -- indicates a
+  real protocol violation somewhere upstream, not an ordinary usage mistake to just recover from.
+- `inference_words.c`'s `array_ptr()` helper (lines 76-84, feeding `Q.VARIANCE`/
+  `INFER-DECAY-SLOPE`/`INFER-WINDOW-WIDTH`) and `infer_word_run()`'s allocation guard (line 142):
+  same shape -- `log_message(LOG_ERROR, ...)` added before each existing `vm->error = 1`, no
+  behavior change beyond the new diagnostic. Required adding `#include "log.h"` to this file (not
+  previously included). All three callers of `array_ptr()` already handle its `NULL` return by
+  pushing a safe default and continuing, so only the diagnostic was missing, not error recovery.
+
+**Verified:** three-architecture `clean qemu` acceptance (amd64/aarch64/riscv64) passed, standard
+regression unaffected. Not separately live-fired against either failure condition (both need a
+genuinely malformed message or an out-of-bounds array reference to trigger) -- the fix is
+mechanical (add a `log_message()` call, no logic change) and low-risk, matching this project's
+own precedent for this class of change.
+