style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

Em dashes (—) and en dashes (–) had spread across comments, docs, tests,
and a few UI strings, reading as AI-generated boilerplate rather than
house style. Replaced each with punctuation matching its context: colon
for explanatory clauses, comma for asides, plain hyphen for numeric/legal
ranges (e.g. "21-23§"), "to"/"till" for date ranges, parentheses for
paired-dash asides. messages/en.json and messages/sv.json were fixed by
hand together to keep sv/en in sync.

Left untouched where the dash is the functional subject rather than
decorative punctuation: date-range-parser.ts's separator regex,
charset-repair.ts's CP1252 byte-mapping table (and its test), the SIE
encoding mojibake docs, generic-csv.ts's minus-sign normalizer, the
agent system-prompt files that already instruct against em dashes, and
a golden iXBRL test fixture compared byte-for-byte.

Also fixes two bugs surfaced along the way: an off-by-one in
ApiKeysPanel's scope-label split (a leftover from an earlier partial
pass), and a charset-repair test that had lost the literal en-dash it
exists to verify.

Regenerated the agent atom seed migration (skills:generate) since 27
SKILL.md files changed. Added a CLAUDE.md rule against em/en dashes,
with an explicit carve-out for the functional-dash cases above.

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

app/api/extensions/cloud-backup/auto-sync/cron/route.ts

@@ -17,7 +17,7 @@ import type { GoogleDriveSchedule } from '@/extensions/general/cloud-backup/type
  * is either unset or more than 20 hours old. Triggers a full Drive backup for
  * each qualifying company via the shared `performSync()` helper.
  *
- * Uses the service role client — no user session, no RLS. Each row in
+ * Uses the service role client: no user session, no RLS. Each row in
  * `extension_data` carries its own `user_id` (the user who configured the
  * schedule), which we use as the "actor" when writing back the sync result.
  */
@@ -74,7 +74,7 @@ export const GET = withCronContext('cron.cloud_backup_auto_sync', async (_reques
   }
 
   const startTime = Date.now()
-  const TIME_BUDGET_MS = 250_000 // 4m10s — leaves 50s margin below Vercel's 300s Pro limit
+  const TIME_BUDGET_MS = 250_000 // 4m10s: leaves 50s margin below Vercel's 300s Pro limit
 
   const results: {
     companyId: string

app/api/extensions/enable-banking/callback/__tests__/route.test.ts

@@ -1,6 +1,6 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest'
 
-// Mock dependencies — factory must not reference outer variables
+// Mock dependencies: factory must not reference outer variables
 const mockCreateSession = vi.fn()
 const mockGetAccountBalance = vi.fn()
 vi.mock('@/extensions/general/enable-banking/lib/api-client', () => ({
@@ -70,7 +70,7 @@ describe('GET /api/extensions/enable-banking/callback', () => {
         // Find pending connection by oauth_state
         return mockChain({ data: { id: 'conn-1', user_id: 'user-1', company_id: 'company-1' }, error: null })
       }
-      // Update connection — capture the payload, then chain returns the
+      // Update connection: capture the payload, then chain returns the
       // updated row via .select().single() for the audit event emission.
       const chain: Record<string, unknown> = {}
       chain.update = vi.fn((payload: Record<string, unknown>) => {

app/api/extensions/enable-banking/callback/route.ts

@@ -8,7 +8,7 @@ import { upsertFromPsd2 } from '@/lib/cash-accounts/service'
 
 // This route emits bank_connection.consent_granted / .cash_account_mirror_failed
 // (ASVS V16 / GDPR Art.30 audit events). ensureInitialized() must run at module
-// load so registerEventLogHandler() has subscribed before the first emit() —
+// load so registerEventLogHandler() has subscribed before the first emit();
 // otherwise the audit row is silently dropped on a cold instance where this
 // redirect route is the first event-emitting code path to execute.
 ensureInitialized()
@@ -163,7 +163,7 @@ export async function GET(request: Request) {
 
     // GDPR Art.5(1)(c) / Art.25(1): data minimization. We only store the
     // metadata the user needs to pick which accounts to sync (uid, name, IBAN,
-    // currency). Balances are bank account financial data — we don't fetch
+    // currency). Balances are bank account financial data: we don't fetch
     // them here. The first sync (after the user enables specific accounts)
     // populates balance + balance_updated_at via lib/sync.ts. Accounts the
     // user deselects never have their balance pulled.
@@ -231,7 +231,7 @@ export async function GET(request: Request) {
         })
         // Persist the failure to event_log so a security review can see that
         // a PSD2 account returned by the bank was not mirrored into our
-        // routing table — otherwise this is only visible in console output
+        // routing table; otherwise this is only visible in console output
         // (ASVS V16 / ISO 27001 A.8.15 / SOC 2 CC7.2).
         try {
           await eventBus.emit({

app/api/extensions/enable-banking/sync/cron/route.ts

@@ -74,7 +74,7 @@ export const GET = withCronContext('cron.bank_sync', async (_request, ctx) => {
   }
 
   const startTime = Date.now()
-  const TIME_BUDGET_MS = 50_000 // 50s — leave 10s margin for Vercel timeout
+  const TIME_BUDGET_MS = 50_000 // 50s: leave 10s margin for Vercel timeout
   const baseUrl = process.env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000'
 
   const results: {
@@ -95,7 +95,7 @@ export const GET = withCronContext('cron.bank_sync', async (_request, ctx) => {
     }
 
     if (!(await hasCapability(supabase, connection.company_id, CAPABILITY.bank_sync))) {
-      ctx.log.info('skip — capability not entitled', { companyId: connection.company_id })
+      ctx.log.info('skip: capability not entitled', { companyId: connection.company_id })
       continue
     }
 
@@ -138,13 +138,13 @@ export const GET = withCronContext('cron.bank_sync', async (_request, ctx) => {
 
       const toDate = new Date().toISOString().split('T')[0]
       // First sync: 90-day lookback (PSD2 max). Subsequent: 7-day window.
-      // Gate on initial_sync_completed_at, not last_synced_at — manual "Sync now"
+      // Gate on initial_sync_completed_at, not last_synced_at: manual "Sync now"
       // sets last_synced_at without doing the deep backfill, and we want the cron
       // to still fall back to 90 days if the inline activation backfill failed.
       const isFirstSync = !connection.initial_sync_completed_at
       const lookbackDays = isFirstSync ? 90 : 7
       if (isFirstSync) {
-        ctx.log.info('first sync for connection — using 90-day lookback', {
+        ctx.log.info('first sync for connection: using 90-day lookback', {
           connectionId: connection.id,
           lookbackDays,
         })
@@ -160,7 +160,7 @@ export const GET = withCronContext('cron.bank_sync', async (_request, ctx) => {
       const accounts = allAccounts.filter(a => a.enabled !== false)
 
       if (accounts.length === 0) {
-        ctx.log.info('all accounts disabled — skipping sync', {
+        ctx.log.info('all accounts disabled: skipping sync', {
           connectionId: connection.id,
           totalAccounts: allAccounts.length,
         })
@@ -177,7 +177,7 @@ export const GET = withCronContext('cron.bank_sync', async (_request, ctx) => {
         continue
       }
 
-      // Detect SIE overlap — skip auto-categorization if the sync range
+      // Detect SIE overlap: skip auto-categorization if the sync range
       // overlaps with a completed SIE import to prevent double-booking
       const { data: sieOverlap } = await supabase
         .from('sie_imports')
@@ -189,7 +189,7 @@ export const GET = withCronContext('cron.bank_sync', async (_request, ctx) => {
         .maybeSingle()
 
       // First sync uses strategy=longest to pull the deepest history available
-      // from the ASPSP. Incremental syncs skip it — the implicit default is
+      // from the ASPSP. Incremental syncs skip it: the implicit default is
       // faster and we already have the older data.
       const syncOptions = {
         ...(sieOverlap ? { skipAutoCategorization: true } : {}),
@@ -274,7 +274,7 @@ export const GET = withCronContext('cron.bank_sync', async (_request, ctx) => {
       })
 
       // A dead PSD2 session (closed/expired/invalid consent) is a re-auth
-      // condition, not a transient failure — flip it to 'expired' (same state
+      // condition, not a transient failure: flip it to 'expired' (same state
       // the consent-elapsed branch uses) so the UI offers a reconnect instead
       // of a retry. Other errors stay 'error'.
       const isSessionDead = error instanceof SessionExpiredError
@@ -380,7 +380,7 @@ async function sendConsentExpiryNotification(
       .update({ last_expiry_notification_at: new Date().toISOString() })
       .eq('id', connection.id as string)
   } catch (error) {
-    // Notification failure must not break the cron job — log only.
+    // Notification failure must not break the cron job: log only.
     // eslint-disable-next-line no-console
     console.error('[bank-sync-cron] failed to send consent expiry notification:', error)
   }

app/api/extensions/ext/[...path]/__tests__/route.test.ts

@@ -48,7 +48,7 @@ function createPathParams(path: string[]) {
 describe('Extension Catch-All Route', () => {
   beforeEach(() => {
     vi.clearAllMocks()
-    // clearAllMocks doesn't reset implementations — re-assert the default so the
+    // clearAllMocks doesn't reset implementations: re-assert the default so the
     // AAL2 test's mockReturnValue(true) can't leak into later cases.
     mockShouldEnforceMfa.mockReturnValue(false)
     extensionRegistry.clear()

app/api/extensions/ext/[...path]/route.ts

@@ -23,7 +23,7 @@ function generateRequestId(): string {
  *      `Felreferens: req_…`
  *
  * Non-JSON responses (HTML for OAuth callbacks, file downloads) only get the
- * header — body rewriting is reserved for the canonical envelope shape.
+ * header: body rewriting is reserved for the canonical envelope shape.
  */
 async function decorateResponse(response: Response, requestId: string): Promise<Response> {
   if (!response.headers.get('X-Request-Id')) {
@@ -54,7 +54,7 @@ async function decorateResponse(response: Response, requestId: string): Promise<
           })
         }
       } catch {
-        // Body wasn't valid JSON — leave it alone.
+        // Body wasn't valid JSON: leave it alone.
       }
     }
   }
@@ -69,13 +69,13 @@ export const maxDuration = 300
 
 /**
  * Per-extension runtime feature flags. Lets ops toggle an integration off
- * without redeploying or removing it from extensions.config.json — useful
+ * without redeploying or removing it from extensions.config.json: useful
  * for phased rollouts (dev tenants → design partners → general).
  *
  * The flag is checked on every request. If the env var is not exactly the
  * string "true", the dispatcher returns 503 with `code: 'EXTENSION_DISABLED'`.
  *
- * Server-side env vars only — no NEXT_PUBLIC_ prefix. Next.js inlines
+ * Server-side env vars only: no NEXT_PUBLIC_ prefix. Next.js inlines
  * NEXT_PUBLIC_* into the client bundle at build time, so a flip on Vercel
  * without a redeploy would create split-brain (server returns 503,
  * client still renders the enabled flow). UI panels detect the 503 by
@@ -197,7 +197,7 @@ async function handleRequest(
 
   // Config sanity check: these flags are orthogonal and the combination is
   // nonsensical. `skipAuth` already implies no company resolution, so adding
-  // `skipCompanyContext: true` is at best redundant — and if a maintainer
+  // `skipCompanyContext: true` is at best redundant, and if a maintainer
   // intended "auth required, no company" but also wrote `skipAuth: true`,
   // the auth requirement would be silently dropped (skipAuth fires first
   // below). Fail loudly instead of masking the mistake.
@@ -210,7 +210,7 @@ async function handleRequest(
   }
 
   // For skipAuth routes (e.g. OAuth callbacks from external providers),
-  // skip user auth, toggle check, and AI consent — dispatch immediately
+  // skip user auth, toggle check, and AI consent: dispatch immediately
   if (matchedRoute.skipAuth) {
     let handlerRequest = request
     if (Object.keys(extractedParams).length > 0) {
@@ -232,7 +232,7 @@ async function handleRequest(
     return decorateResponse(response, requestId)
   }
 
-  // Auth check — requireAuth() enforces MFA (AAL2) on hosted, which the previous
+  // Auth check: requireAuth() enforces MFA (AAL2) on hosted, which the previous
   // inline supabase.auth.getUser() did not. This dispatcher is the single
   // chokepoint for the entire enabled-extension surface (banking sync, document
   // upload/booking, supplier-invoice flows, migration), so enforcing MFA here
@@ -263,7 +263,7 @@ async function handleRequest(
 
   // Routes that are authenticated but run before a company exists (TIC
   // /lookup during onboarding, for example) opt out of company resolution.
-  // Dispatch without a context — handlers that opt in must not rely on ctx.
+  // Dispatch without a context: handlers that opt in must not rely on ctx.
   if (matchedRoute.skipCompanyContext) {
     const response = await matchedRoute.handler(handlerRequest)
     log.info('extension call completed', {

app/api/extensions/push-notifications/cron/route.ts

@@ -10,7 +10,7 @@ import { withCronContext } from '@/lib/api/with-cron-context'
 import { errorResponse, errorResponseFromCode } from '@/lib/errors/get-structured-error'
 
 /**
- * GET /api/extensions/push-notifications/cron — daily 09:00 UTC.
+ * GET /api/extensions/push-notifications/cron: daily 09:00 UTC.
  * Sends due tax, invoice and missing-underlag push notifications.
  */
 export const GET = withCronContext('cron.push_notifications', async (_request, ctx) => {

app/api/extensions/skatteverket/agi/kvittenser/cron/route.ts

@@ -20,7 +20,7 @@ export const maxDuration = 60
  * signeradTid) is the canonical filing receipt. Without this cron,
  * `salary_runs.agi_submitted_at` only gets stamped when the user returns
  * to the panel and clicks "Hämta kvittens" or stays on the page long
- * enough for the in-browser timers to fire — which is unreliable, and
+ * enough for the in-browser timers to fire, which is unreliable, and
  * leaves the audit trail out of step with reality (BFNAR 2013:2 kap 8 +
  * BFL 5 kap 5§ require the behandlingshistorik to faithfully record
  * filing events).
@@ -30,7 +30,7 @@ export const maxDuration = 60
  * extension's per-user token, and on a hit promote the row to
  * `submitted` + stamp salary_runs.agi_submitted_at.
  *
- * Per-row errors are logged and skipped — one expired token shouldn't
+ * Per-row errors are logged and skipped: one expired token shouldn't
  * block other companies' reconciliation.
  *
  * Time budget: 50s (Vercel default 60s function timeout with 10s margin).
@@ -93,7 +93,7 @@ export async function GET(request: Request) {
     const period = formatRedovisningsperiod('monthly', decl.period_year as number, decl.period_month as number)
 
     if (!(await hasCapability(supabase, companyId, CAPABILITY.skatteverket))) {
-      console.info('[agi-kvittenser-cron] skip — capability not entitled', { companyId })
+      console.info('[agi-kvittenser-cron] skip: capability not entitled', { companyId })
       continue
     }
 
@@ -158,7 +158,7 @@ export async function GET(request: Request) {
         })
       }
 
-      // submitted_by is the token-owning auth.users row — the human who
+      // submitted_by is the token-owning auth.users row: the human who
       // connected via BankID. The legally load-bearing signer identity
       // is kvittens.signeradAv (a personnummer), which the token user_id
       // does NOT necessarily match (e.g. if the connected user is a

app/api/extensions/skatteverket/skattekonto/drift/route.ts

@@ -19,7 +19,7 @@ const log = createLogger('skattekonto-drift-route')
  *
  * Access is recorded through the structured logger (Sentry / Vercel logs)
  * because the response carries sensitive GL drift figures. Persisting every
- * dashboard tile poll into event_log would be too noisy — the structured
+ * dashboard tile poll into event_log would be too noisy: the structured
  * log line gives an auditable record without overrunning the 30-day event
  * log retention (SOC 2 CC8.1, ISO 27001 A.8.15).
  */

app/api/extensions/skatteverket/skattekonto/sync/cron/route.ts

@@ -17,7 +17,7 @@ export const maxDuration = 60
 /**
  * GET /api/extensions/skatteverket/skattekonto/sync/cron
  *
- * Daily skattekonto sync (cron 0 4 * * * — 04:00 UTC, 06:00 Swedish time).
+ * Daily skattekonto sync (cron 0 4 * * *: 04:00 UTC, 06:00 Swedish time).
  * Pulls saldo + transactions for every company that has a connected
  * Skatteverket token, and persists the results to skattekonto_transactions.
  *
@@ -26,7 +26,7 @@ export const maxDuration = 60
  *
  * Time budget: 50s (Vercel default 60s function timeout, 10s margin).
  *
- * Per-company errors are logged but do not abort the run — one expired
+ * Per-company errors are logged but do not abort the run: one expired
  * token shouldn't block 49 other working syncs.
  */
 export async function GET(request: Request) {
@@ -91,13 +91,13 @@ export async function GET(request: Request) {
     const companyId = token.company_id as string | null
 
     if (!companyId) {
-      // Pre-multi-tenant tokens may lack company_id. Skip — cannot scope.
+      // Pre-multi-tenant tokens may lack company_id. Skip: cannot scope.
       results.push({ userId, companyId: '(missing)', status: 'error', error: 'No company_id on token' })
       continue
     }
 
     if (!(await hasCapability(supabase, companyId, CAPABILITY.skatteverket))) {
-      console.info('[skattekonto-sync-cron] skip — capability not entitled', { companyId })
+      console.info('[skattekonto-sync-cron] skip: capability not entitled', { companyId })
       continue
     }
 
@@ -146,7 +146,7 @@ export async function GET(request: Request) {
     } catch (err) {
       const message = err instanceof Error ? err.message : 'Unknown error'
 
-      // Expired token / refresh exhausted is a known outcome — surface it
+      // Expired token / refresh exhausted is a known outcome: surface it
       // distinctly so ops can dashboard "X companies need to reconnect".
       if (
         err instanceof SkatteverketAuthError &&