fix(ci): re-anchor SOUNDNESS.adoc #555-stub/#560 row — clears soundness-ledger guard

[hyperpolymath]

What

Greens main's red CI. The build job's ./tools/check-soundness-ledger.sh guard fails because docs/SOUNDNESS.adoc cites an anchor fixture that doesn't exist:

ERROR: docs/SOUNDNESS.adoc cites anchor fixtures that no longer exist:
       - test/e2e/fixtures/stub_backend_return_dropped.affine

The #555-stub / #560 row (Lean/Why3 experimental backends drop return) was marked residual (pinned) and cited stub_backend_return_dropped.affine + test_stub_backend_return_xfail — but neither was ever committed (no git history at that path). So the guard's "every cited anchor exists" check fails, and the row's "pinned" claim was untrue.

Fix (honest + minimal)

The hole is real but genuinely unpinned, so:

• Downgrade the row residual (pinned) → open (tracked).
• Replace the phantom anchor with the truthful state: tracked by codegen wall 1: variable-string wasm backend ops (String.length / indexing / startsWith / fromCharCode) #560, not yet pinned by a fixture/test, experimental gating is the only current fence.
• Update the matching "Still open" bullet to agree.

No fabricated fixture/test — gaming the guard with a dangling fixture would violate the ledger's own honesty ethos ("Pinned-residual discipline"). Creating the real pin (fixture + xfail) remains the #560/#624 follow-up.

Verification

• ./tools/check-soundness-ledger.sh → exit 0 ("OK: soundness ledger intact…").
• ./tools/check-doc-truthing.sh → exit 0 (SOUNDNESS.adoc is in its scan too).
• All remaining cited fixtures confirmed present.

Diff: 1 file, 4/4 lines. Note: this is a pre-existing failure from the formal-soundness track (not the merge it rode in on); the :ground-truth-sha: stamp is intentionally not bumped since this is a bookkeeping correction, not a compiler re-verification.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Lz7pRcec2Z3tVtaAhvB3M8

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 41 issues detected

Severity	Count
🔴 Critical	2
🟠 High	23
🟡 Medium	16

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action denoland/setup-deno@v2 needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Shell execution -- validate input before passing to shell (1 occurrences, CWE-78)",
    "type": "js_exec_sync",
    "file": "/home/runner/work/affinescript/affinescript/packages/affinescript-cli/mod.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Shell execution -- validate input before passing to shell (2 occurrences, CWE-78)",
    "type": "js_exec_sync",
    "file": "/home/runner/work/affinescript/affinescript/packages/affine-vscode/mod.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Shell execution -- validate input before passing to shell (1 occurrences, CWE-78)",
    "type": "js_exec_sync",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-vite/src/affine-plugin-improved.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "expect() in hot path (32 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/affinescript/affinescript/affinescriptiser/src/codegen/wasm_gen.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "expect() in hot path (29 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/affinescript/affinescript/affinescriptiser/src/codegen/affine_gen.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unsafe block -- requires SAFETY comment (2 occurrences, CWE-676)",
    "type": "unsafe_block",
    "file": "/home/runner/work/affinescript/affinescript/runtime/src/panic.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unsafe block -- requires SAFETY comment (1 occurrences, CWE-676)",
    "type": "unsafe_block",
    "file": "/home/runner/work/affinescript/affinescript/runtime/src/alloc.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unsafe block -- requires SAFETY comment (3 occurrences, CWE-676)",
    "type": "unsafe_block",
    "file": "/home/runner/work/affinescript/affinescript/runtime/src/ffi.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence