chore: replace em dashes with hyphens, add no-em-dash rule to CLAUDE.md

backup/archive.go

@@ -98,8 +98,8 @@ func indexMember(name string) string      { return "indexes/" + name + ".json" }
 // Reader is an opened archive.
 //
 // Open extracts to a temporary directory rather than streaming, because gzip
-// offers no random access and the manifest — which carries the checksums every
-// other member is judged against — is written last. Verifying before writing a
+// offers no random access and the manifest - which carries the checksums every
+// other member is judged against - is written last. Verifying before writing a
 // single document to the target is worth one pass over local disk. This is why
 // the container image needs a /tmp.
 type Reader struct {

backup/dump.go

@@ -148,8 +148,8 @@ func dumpIndexes(ctx context.Context, w *Writer, db *mongo.Database, name string
 	defer cur.Close(ctx)
 
 	// The specs are read as raw BSON and re-encoded as extended JSON, one
-	// element per index, so key order and every option the server reported —
-	// partialFilterExpression, collation, weights and the rest — survive
+	// element per index, so key order and every option the server reported -
+	// partialFilterExpression, collation, weights and the rest - survive
 	// verbatim. Decoding into bson.M would lose compound key order, and
 	// reconstructing an index from a hand-picked set of options would drop
 	// whatever was not picked.

backup/restore.go

@@ -72,7 +72,7 @@ func (o RestoreOptions) warn(format string, args ...any) {
 // The order is fixed and every check that can refuse does so before the first
 // write: format, checksums (done by Open), key policy, then target inspection.
 // A restore that has begun writing and then fails leaves a partial database
-// which the next run refuses to touch, which is correct — the alternative is a
+// which the next run refuses to touch, which is correct - the alternative is a
 // silent merge, and merging two control planes reconciles nothing.
 func Restore(ctx context.Context, opt RestoreOptions) (RestoreResult, error) {
 	m := opt.Archive.Manifest()
@@ -302,14 +302,14 @@ func splitBSON(raw []byte) (bson.Raw, []byte, error) {
 // The specs are handed to the createIndexes command exactly as the source
 // server reported them, rather than reconstructed into a mongo.IndexModel from
 // a hand-picked set of options. Reconstruction dropped every option nobody had
-// thought to pick — partialFilterExpression above all, which this codebase
+// thought to pick - partialFilterExpression above all, which this codebase
 // relies on for partial unique indexes, and which replayed as a full unique
 // index fails on any real database. It also lost compound key order, which is
 // significant.
 //
 // A unique index that will not build means the restored data violates it, and
-// the unique indexes here — (instance_id, email), instance slug, settings
-// instance, the ESO token hash — are tenant-isolation properties rather than
+// the unique indexes here - (instance_id, email), instance slug, settings
+// instance, the ESO token hash - are tenant-isolation properties rather than
 // optimisations. That aborts. A non-unique index failing is a performance
 // problem and warns.
 func replayIndexes(ctx context.Context, opt RestoreOptions, coll *mongo.Collection, name string) (int, error) {

backup/restore_test.go

@@ -243,7 +243,7 @@ func TestRestoreAbortsWhenAUniqueIndexCannotBuild(t *testing.T) {
 
 	// Built by hand rather than dumped: two documents that collide on email
 	// alongside an index specification declaring email unique. No live database
-	// would let those coexist, which is exactly the point — this is the shape
+	// would let those coexist, which is exactly the point - this is the shape
 	// of a corrupted or hand-edited archive, and restore must refuse rather
 	// than load the rows and leave the index missing.
 	a, err := bson.Marshal(bson.M{"email": "a@example.com"})
@@ -371,8 +371,8 @@ func TestIdIndexIsSkipped(t *testing.T) {
 }
 
 // TestRestoreReplaysPartialUniqueIndex is the regression guard for the defect
-// that made a restore abort on any real database: a partial unique index —
-// this codebase has them on workflow_steps and settings — replayed as a full
+// that made a restore abort on any real database: a partial unique index -
+// this codebase has them on workflow_steps and settings - replayed as a full
 // unique index hits duplicate keys, and a failing unique index is fatal.
 func TestRestoreReplaysPartialUniqueIndex(t *testing.T) {
 	client, _ := testDB(t)

backup/verify.go

@@ -109,8 +109,8 @@ func probe(ctx context.Context, opt VerifyOptions, rep *VerifyReport) error {
 		rep.ProbeDecrypted = true
 		return nil
 	}
-	// No ciphertext anywhere is an ordinary state — a deployment that has
-	// stored no secrets, keys or SSO configuration yet — and is not a failure.
+	// No ciphertext anywhere is an ordinary state - a deployment that has
+	// stored no secrets, keys or SSO configuration yet - and is not a failure.
 	return nil
 }
 
@@ -121,13 +121,13 @@ func probe(ctx context.Context, opt VerifyOptions, rep *VerifyReport) error {
 // This map MIRRORS BY HAND the bson tags in server/internal/models, which this
 // package cannot import: shared/ is a separate module and models is under
 // server/internal. It must change in the same commit as any rename of the
-// fields below — the same mirrored-constant hazard as web/lib/targets.ts and
+// fields below - the same mirrored-constant hazard as web/lib/targets.ts and
 // services.MaxWorkloadLogLines. The sources are:
 //
-//	keys             — models/key.go: private_key_enc, passphrase_enc
-//	secrets          — models/secret.go: encrypted_value
-//	auth_providers   — models/auth_provider.go: client_secret_enc
-//	console_sessions — models/console_session.go: rdp_user_enc, rdp_pass_enc
+//	keys             - models/key.go: private_key_enc, passphrase_enc
+//	secrets          - models/secret.go: encrypted_value
+//	auth_providers   - models/auth_provider.go: client_secret_enc
+//	console_sessions - models/console_session.go: rdp_user_enc, rdp_pass_enc
 //
 // settings is deliberately absent: it holds no ciphertext at all. The ESO read
 // token is stored as a SHA-256 hash, which no key opens.