Em dashes (—) and en dashes (–) had spread across comments, docs, tests,
and a few UI strings, reading as AI-generated boilerplate rather than
house style. Replaced each with punctuation matching its context: colon
for explanatory clauses, comma for asides, plain hyphen for numeric/legal
ranges (e.g. "21-23§"), "to"/"till" for date ranges, parentheses for
paired-dash asides. messages/en.json and messages/sv.json were fixed by
hand together to keep sv/en in sync.
Left untouched where the dash is the functional subject rather than
decorative punctuation: date-range-parser.ts's separator regex,
charset-repair.ts's CP1252 byte-mapping table (and its test), the SIE
encoding mojibake docs, generic-csv.ts's minus-sign normalizer, the
agent system-prompt files that already instruct against em dashes, and
a golden iXBRL test fixture compared byte-for-byte.
Also fixes two bugs surfaced along the way: an off-by-one in
ApiKeysPanel's scope-label split (a leftover from an earlier partial
pass), and a charset-repair test that had lost the literal en-dash it
exists to verify.
Regenerated the agent atom seed migration (skills:generate) since 27
SKILL.md files changed. Added a CLAUDE.md rule against em/en dashes,
with an explicit carve-out for the functional-dash cases above.
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
The house guard 'p_company_id NOT IN (SELECT public.user_company_ids())'
skips the deny branch on UNKNOWN (NULL on either side). Not exploitable
today (company_members.company_id is NOT NULL) but a NULL p_company_id
passes the guard, and the shape fails silently under change. 9 live
functions carried it (link_*_to_voucher, reserve/release_voucher_range,
mark_entry_as_opening_balance, retag_line_dimensions,
ensure_company_dimensions, company_has_capability, rotate_company_inbox).
- caller_is_company_member(uuid): NULL-safe membership predicate
(NULL -> false, always).
- Mechanical rewrite: every public function carrying the raw pattern is
re-created via pg_get_functiondef with the guard swapped — deliberate
over hand-copying 9 bodies (the stale-copy hazard behind the 07-03
constraint clobber). Probe-validated locally: pattern swapped, NULL
denied.
- pg-real ratchet: after full replay no public function may contain the
raw pattern (also blocks future reintroduction); detector self-test;
helper semantics (member/foreigner/NULL).
Existing tenant-guard suites re-assert deny semantics on the rewritten
functions in CI.
Part of dev_docs/mcp_optimization_plan.md (P2-3 follow-up, PR #872 review).
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
