Record Android cursor guard verification

ober

5d6092b24df5448804854b8bcefed07fc7409469

diff --git a/data/error-fixes.sexp b/data/error-fixes.sexp
index 1093e51..1b0da88 100644
--- a/data/error-fixes.sexp
+++ b/data/error-fixes.sexp
@@ -2718,32 +2718,50 @@
     .
     "#if defined(__FreeBSD__)\n    arc4random_buf(out, n);\n    return 0;\n#else\n    int fd = open(\"/dev/urandom\", O_RDONLY | O_CLOEXEC | O_NOFOLLOW);\n    /* checked read loop */\n#endif")
    ("explanation"
-    .
-    "On FreeBSD, /dev/urandom is a symlink to /dev/random. A hardened open with O_NOFOLLOW rejects that symlink with EMLINK, whose strerror text is 'Too many links', even though the surrounding cache directory is healthy.")
+     .
+     "On FreeBSD, /dev/urandom is a symlink to /dev/random. A hardened open with O_NOFOLLOW rejects that symlink with EMLINK, whose strerror text is 'Too many links', even though the surrounding cache directory is healthy.")
    ("fix"
-    .
-    "Trace the failing syscall before changing directory logic. On FreeBSD use arc4random_buf (or getentropy) for cryptographic random bytes; retain the checked O_NOFOLLOW /dev/urandom path only on platforms where it is not a symlink.")
+     .
+     "Trace the failing syscall before changing directory logic. On FreeBSD use arc4random_buf (or getentropy) for cryptographic random bytes; retain the checked O_NOFOLLOW /dev/urandom path only on platforms where it is not a symlink.")
    ("id" . "freebsd-urandom-nofollow-emlink")
-   ("pattern" . "create private extraction directory: Too many links")
+   ("pattern"
+     .
+     "create private extraction directory: Too many links")
    ("type" . "runtime"))
  (("code_example"
     .
     "# Keep unstable optional backends opt-in rather than in Cargo's normal bundle.\n[features]\nfull = [\"tls\", \"crypto\", \"duckdb_feat\", \"postgres_feat\", \"wasm\"]\npcap = [\"rscap\"]")
    ("explanation"
-    .
-    "rscap 0.3.1 stores a raw pointer inside its Linux packet ring, so its Sniffer is not Send. Placing Sniffer handles behind a process-wide OnceLock<Mutex<...>> therefore fails the static Sync requirement on supported Rust toolchains.")
+     .
+     "rscap 0.3.1 stores a raw pointer inside its Linux packet ring, so its Sniffer is not Send. Placing Sniffer handles behind a process-wide OnceLock<Mutex<...>> therefore fails the static Sync requirement on supported Rust toolchains.")
    ("fix"
-    .
-    "Do not enable rscap through the normal/full native bundle until its Sniffer has a sound Send implementation or the wrapper is redesigned for thread-local ownership. Keep packet capture behind an explicit Cargo feature and verify the default native library has no packet-capture symbols.")
+     .
+     "Do not enable rscap through the normal/full native bundle until its Sniffer has a sound Send implementation or the wrapper is redesigned for thread-local ownership. Keep packet capture behind an explicit Cargo feature and verify the default native library has no packet-capture symbols.")
    ("id" . "rscap-sniffer-not-send-static-registry")
-   ("pattern" . "cannot be sent between threads safely.*(PacketRxRing|Sniffer)")
+   ("pattern"
+     .
+     "cannot be sent between threads safely.*(PacketRxRing|Sniffer)")
    ("type" . "rust-compile"))
  (("explanation"
     .
     "MCP clients commonly speak JSON-RPC over stdio using `Content-Length: N\\r\\n\\r\\n` framing. A newline-only server tries to parse the header line as JSON, emits `unexpected character`, and many clients then close the transport.")
    ("fix"
-    .
-    "Make the MCP stdio loop accept both legacy newline-delimited JSON and framed `Content-Length` messages. Reply with the same framing mode used by the request, then rebuild and reinstall `jmcp`; existing closed connector processes must be restarted.")
+     .
+     "Make the MCP stdio loop accept both legacy newline-delimited JSON and framed `Content-Length` messages. Reply with the same framing mode used by the request, then rebuild and reinstall `jmcp`; existing closed connector processes must be restarted.")
    ("id" . "mcp-content-length-framing-transport-closed")
    ("pattern" . "Transport closed|unexpected character")
-   ("type" . "mcp-transport")))
+   ("type" . "mcp-transport"))
+ (("code_example"
+    .
+    ";; Correct unbox path for an eqref-carried fixnum/char:\n<expr-producing-eqref>\n0xfb 0x16 0x6c  ;; ref.cast i31\n0xfb 0x1d       ;; i31.get_s\n;; then shift/tag handling as needed")
+   ("explanation"
+     .
+     "Jerboa's Wasm-GC value model carries Scheme values as `eqref`, but WebAssembly validates `i31.get_s`/`i31.get_u` only on `i31ref`. A just-created `ref.i31` may flow directly, but locals, globals, function results, and aggregate fields typed as `eqref` must be narrowed before extraction.")
+   ("fix"
+     .
+     "Insert an explicit Wasm-GC `ref.cast i31` (heap type `i31`, byte `0x6c`) before `i31.get_s` or `i31.get_u` when the value is carried as the backend's universal `eqref`.")
+   ("id" . "wasm-gc-eqref-i31-cast")
+   ("pattern"
+     .
+     "i31\\.get_[su].*expected type i31ref, found .* type eqref")
+   ("type" . "wasm-gc-validation")))