docs: strip em dashes from public-facing markdown

README, docs/, skills/, scripts/ READMEs and the top-level handoff.
Mechanical: scripts/strip-emdash.py turns a dash into a comma (colon in
headings, a hyphen inside box drawings and table cells) and folds
line-wrapped dashes back onto their line. plans/ follows separately.

Author: gluck

HANDOFF-trunks.md

@@ -1,4 +1,4 @@
-# HANDOFF — the presentation hierarchy: promote, ls, and delete
+# HANDOFF: the presentation hierarchy: promote, ls, and delete
 
 Worktree   `~/dev/figaro-qua/trunkfix`
 Branch     `fix/trunk-presentation` @ `4bc5ad0c`

docs/store/architecture.md

@@ -24,7 +24,7 @@ below it, and the public surface a consumer addresses is the *top* layer
                               │ depends on
   ┌───────────────────────────▼─────────────────────────────────┐
   │  segment          append-only segment files + ValueHash;     │
-  │  (segment.go,     the leaf — no deps on the layers above     │
+  │  (segment.go,     the leaf - no deps on the layers above     │
   │   hash.go)                                                    │
   └─────────────────────────────────────────────────────────────┘
 ```
@@ -36,15 +36,15 @@ files are all internal mechanism the upper layers manage on its behalf.
 
 ---
 
-## `segment` — the leaf
+## `segment`: the leaf
 
 **File:** `segment/segment.go`, `segment/hash.go`
 
 An append-only file framed by a `SegmentCodec`. A `Segment` owns one
 file, a `baseIndex`, a count, and an in-memory offset index rebuilt by
 `recover()` on open (the standard WAL recovery: scan forward, accept
 clean frames, truncate any torn tail). It has no knowledge of forks,
-channels, or trunks — it is the bottom of the stack and depends on
+channels, or trunks, it is the bottom of the stack and depends on
 nothing above it.
 
 Provides:
@@ -60,12 +60,12 @@ Provides:
   canonicalizes JSON (object keys sorted, whitespace stripped, numbers
   preserved via `json.Number`) and returns the truncated SHA-256
   (16 hex chars / 64 bits) of the canonical form. JSON-equal inputs hash
-  identically regardless of key order or formatting — the property the
+  identically regardless of key order or formatting, the property the
   upper layers rely on to compare entries by value.
 
 ---
 
-## `disk.Log` — the fork engine over segments
+## `disk.Log`: the fork engine over segments
 
 **File:** `disk/log.go`, `disk/fork.go`. **Depends on:** `segment`.
 
@@ -84,7 +84,7 @@ by delegating to the parent chain (`Read`, `Range`, `HeaderAt`,
 `StateAt` all walk up when `idx < forkBase`). This is the watermark
 boundary: own-range entries live in this log's own segments, the
 inherited prefix lives in ancestors. `LastIndex` of an empty-own fork
-reports `forkBase-1` — it sits immediately after the parent's tail.
+reports `forkBase-1`, it sits immediately after the parent's tail.
 Reducible (header-mode) logs additionally carry a per-segment watermark
 header computed by `OnSegmentOpen`; `StateAt(idx)` folds the segment's
 watermark with its entries up to `idx`.
@@ -108,13 +108,13 @@ only source for indices at and beyond that boundary.
   log keeps the prefix `[FirstIndex, atIdx-1]` and becomes read-only; the
   suffix moves into an "old-future" subdir; a fresh empty child subdir is
   created, writable from `atIdx`. Branch points are N-ary and
-  re-splittable. The *heuristic* re-home applies — on a re-split (own
+  re-splittable. The *heuristic* re-home applies, on a re-split (own
   segments split) all existing children move into the old-future.
 - `ForkRehome(atIdx, child, oldFuture, rehome)` forks with an *explicit*
   re-home list instead of the heuristic. The xwal joint fork uses this so
   every channel re-homes the **same** children (decided once from the
   main channel) and the triune's trees stay in lockstep.
-- `ChildForkBases()` returns each child subdir's `.fork` base — the input
+- `ChildForkBases()` returns each child subdir's `.fork` base, the input
   the joint fork uses to decide which children re-home.
 
 **Empty-log handling.** An empty root forks at index 1; an **empty-own**
@@ -131,7 +131,7 @@ still has the sentinel.
 
 ---
 
-## `xwal.XWAL` — the multi-channel "triune" join
+## `xwal.XWAL`: the multi-channel "triune" join
 
 **File:** `xwal/xwal.go`, `xwal/fork.go`. **Depends on:** `disk.Log`.
 
@@ -147,14 +147,14 @@ provider-owned payload bytes. Decoding accepts both frame shapes.
 
 A `Config` describes the join at creation:
 
-- `Main` — the main channel name.
-- `Channels` — the `ChannelSpec` list (name, kind, reducer key, runtime
+- `Main`, the main channel name.
+- `Channels`, the `ChannelSpec` list (name, kind, reducer key, runtime
   `SyncMode`, persisted `Opaque` payload encoding).
-- `Registry` — maps reducer names to `Reducer{Reduce, Initial}`;
+- `Registry`, maps reducer names to `Reducer{Reduce, Initial}`;
   resolved on every open (functions are never persisted).
-- `Codec` — `"jsonl"` (default) or `"binary"`; persisted in the manifest.
-- `Genesis` — custom main-channel genesis payload (creation only).
-- `MintTrunkID` — pluggable opaque trunk-id generator (consumed by the
+- `Codec`, `"jsonl"` (default) or `"binary"`; persisted in the manifest.
+- `Genesis`, custom main-channel genesis payload (creation only).
+- `MintTrunkID`, pluggable opaque trunk-id generator (consumed by the
   Trunks layer).
 
 After first open the on-disk `xwal.json` manifest is authoritative for channel
@@ -172,7 +172,7 @@ Repeated and last-wins lookups remain O(1) once their suffix is indexed.
 **Forks all channels as a unit** (`fork.go`). `XWAL.Fork(atMainLT,
 child, oldFuture)` builds a `forkPlan`: the main channel forks at
 `atMainLT`, each related channel forks at its own boundary
-(`boundaryFor` — the first own entry whose main LT ≥ `atMainLT`, or
+(`boundaryFor`, the first own entry whose main LT ≥ `atMainLT`, or
 own-tail+1 if it has not caught up; empty-own channels fork at their own
 first index). The re-home set is decided once from the main channel and
 applied to every channel by name via `ForkRehome`. A `.xwal-fork-pending`
@@ -198,17 +198,17 @@ invalidate the cache.
 
 ---
 
-## `xwal.Trunks` — the trunk-addressed view
+## `xwal.Trunks`: the trunk-addressed view
 
 **File:** `xwal/trunks.go`. **Depends on:** `xwal.XWAL`.
 
 `Trunks` is the surface a consumer addresses. A **trunk** is one
-continuation chain across all channels (the triune forked as a unit) —
-the stable handle — while the per-fork **node** is plumbing.
+continuation chain across all channels (the triune forked as a unit),
+the stable handle, while the per-fork **node** is plumbing.
 
 **DISK IS THE SOLE SOURCE OF TRUTH.** The node tree *is* the main
 channel's directory tree: `nN` subdirs plus `.fork` markers. Everything
-about a node is derivable from that tree by walking it — *except* a
+about a node is derivable from that tree by walking it, *except* a
 node's trunk id. That single non-derivable datum, and only that, is
 persisted: a `.trunk` file per node dir (in the main channel), sitting
 alongside `.fork`. The in-memory structure (`nodes`, `heads`, sequence
@@ -270,7 +270,7 @@ invariant.
 
 Every record xwal writes carries a server timestamp (`t`, unix millis) in
 its frame, stamped at append time from `Config.Now` (a test seam;
-defaults to the real clock). It is mandatory and supplied by xwal itself —
+defaults to the real clock). It is mandatory and supplied by xwal itself,
 callers cannot set or omit it. Records written before timestamps existed
 simply lack the field and decode with `TS == 0`; they are tolerated
 forever and never migrated (the JSONL `_hash` covers the payload, so old
@@ -284,7 +284,7 @@ that asks it N times per listing:
   per-node `atomic.Int64` counters (16 bytes per node ever addressed,
   retained for the life of the `Trunks`). An XWAL opened through Trunks
   wires its internal `lastTS` pointer to the registry's counter, so every
-  append through any handle — and every `sharedView` of it — advances the
+  append through any handle, and every `sharedView` of it, advances the
   one counter a listing reads. Open, close, and hot-store eviction do not
   touch it. This is not a cache of derived data: it is the same primitive
   the appender bumps, merely kept.
@@ -293,19 +293,19 @@ that asks it N times per listing:
 - **Cold reads are a file read.** First query for a node this process has
   never opened runs a bounded tail probe: the lexically newest segment
   file per channel directory the node owns, scan to the last complete
-  frame, decode its `t`, take the max — no full `Open`, no segment
+  frame, decode its `t`, take the max, no full `Open`, no segment
   indexing, no watermark folds. Measured: ~36µs, ~73KB transient, 126
   allocs, paid once per node per process (the probe hydrates the retained
   counter). A full `Open` later merges monotonically (CAS-max) into the
   same counter, so probe and hydration can never regress an append.
 - **Never a wake.** LastTS opens (at most) segment files. Whether the
   consumer's node has an agent, a daemon, or anything else attached is
-  invisible from here — a listing over dormant nodes stays dormant.
+  invisible from here, a listing over dormant nodes stays dormant.
 
 The frame's `t` sits in ALPHABETICAL key position (`m, p/p64, t, x`)
 because the JSONL codec canonicalizes key order on disk; encoder output
 and disk output are byte-identical, and the fast-path frame decoder
 speaks that one grammar. (The first draft ordered the encoder differently
 from the disk and every meta-carrying segment read silently fell to the
-reflection path — found by benchmark comparison, not by tests, and pinned
+reflection path, found by benchmark comparison, not by tests, and pinned
 by canaries that round-trip the codec since.)

internal/store/crashtest/FINDINGS.md

@@ -17,7 +17,7 @@ findings are races against wall-clock delays, so a replay reproduces the
 same distribution (and usually the same findings) rather than the exact
 cycle indexes. Occurrence counts below are from the recorded campaign logs.
 
-## Kill mode (pure SIGKILL — completed writes survive in the page cache)
+## Kill mode (pure SIGKILL: completed writes survive in the page cache)
 
 ### K1. Fork commit is not crash-atomic: trunk id lost
 
@@ -36,20 +36,20 @@ next writer found zero trunks.
 forward"; in practice a mid-fork SIGKILL can leave a `.fork-pending`
 sentinel that every subsequent `OpenTrunks` refuses:
 
-- seed=11 store=6 cycle=3 childSeed=7342284354246113453 — sentinel left in
+- seed=11 store=6 cycle=3 childSeed=7342284354246113453, sentinel left in
   a related-channel branch dir (`notes/n0/n2/n3`); open fails "fork in
   progress" permanently.
-- seed=12 store=2 cycle=1 childSeed=6759699898442884760 — sentinel in
+- seed=12 store=2 cycle=1 childSeed=6759699898442884760, sentinel in
   `notes/n0`, same permanent failure.
-- seed=12 store=11 cycle=2 childSeed=4073270498405317002 — recovery is not
+- seed=12 store=11 cycle=2 childSeed=4073270498405317002, recovery is not
   idempotent: "recover interrupted fork: fork \"main\": open: fork in
   progress: dir contains .fork-pending sentinel: .../main". The roll-forward
   path itself trips over the sentinel it is supposed to consume.
 
 ### K3. Mid-fork kill can cut the HEAD of a related channel
 
 `head-cut`, seed=12 store=2 cycle=1: after reopen the notes channel starts
-at chanLT 2 — record 1 is gone. Loss from the front, so the surviving log
+at chanLT 2, record 1 is gone. Loss from the front, so the surviving log
 is not a prefix at all.
 
 ### K4. Positive results
@@ -62,8 +62,8 @@ crash windows look solid at e2f5c89; fork commit is the one broken window.
 ## Corrupt mode (torn-tail simulation)
 
 Repair at e2f5c89 assumes only the last segment of the writing node can be
-torn. A torn tail in any OTHER recently written segment — one sealed by
-rotation during the cycle, or a fork-parent segment — is not detected:
+torn. A torn tail in any OTHER recently written segment, one sealed by
+rotation during the cycle, or a fork-parent segment, is not detected:
 
 ### C1. Silent renumbering
 
@@ -128,7 +128,7 @@ never undetected payload corruption.
 
 # memory-first findings (branch memory-first merged at 8b888d7)
 
-Harness rebound to `xwal.OpenStore` (bind_trunks.go): no SyncChannel — the
+Harness rebound to `xwal.OpenStore` (bind_trunks.go): no SyncChannel, the
 durable lower bound is time-based (append stamp older than
 FlushInterval+slack before the kill must survive), plus Close-drain
 (everything durable once Close returns) and Kick as a scheduling hint.
@@ -151,7 +151,7 @@ cycles (seeds 41/42/43), plus the targeted flush-error test.
 
 seed=33 store=7 cycle=1 childSeed=602310214271270794: after a mid-fork
 kill, reopen fails "fork in progress: dir contains .fork-pending
-sentinel: .../state/n0" — permanently. 1 occurrence in 808 kill cycles.
+sentinel: .../state/n0", permanently. 1 occurrence in 808 kill cycles.
 
 ### M3 = C1-C5. Torn tails outside the active segment still misplace data
 
@@ -163,7 +163,7 @@ crash tails but does not detect a torn SEALED segment (rotated or
 fork-parent); subsequent records renumber or the store bricks, same
 failure shapes as e2f5c89.
 
-### M4. Repair is gated on `.unclean` — corruption after clean Close slips through
+### M4. Repair is gated on `.unclean`: corruption after clean Close slips through
 
 A1's declared risk, confirmed: 34 of the damaging corrupt cycles were
 `cleanclose` (child Closed cleanly, then bytes were torn, then reopen):
@@ -177,11 +177,11 @@ childSeed=2833144618262241349 (flip in `main/n0/...0039.jsonl`).
   `reducible-ahead` in 808 kill cycles (e2f5c89 produced both after any
   main-tail repair). The vectored coherent-cut flush works.
 - Kill-mode head-cut (K3): not observed in 808 cycles.
-- Durability contract: zero `durable-lost` — every append older than
+- Durability contract: zero `durable-lost`, every append older than
   FlushInterval(+500 ms slack) before the kill survived; Close-drain
   lost nothing (all cleanclose kill-mode cycles verified full survival);
   kill-mid-Close cycles repaired cleanly on reopen.
-- Flush-error path: TestFlushErrorReadOnlyRecovers — segment dirs made
+- Flush-error path: TestFlushErrorReadOnlyRecovers, segment dirs made
   read-only mid-run: appends keep succeeding in memory, flusher retries,
   full recovery after permissions restored, clean Close, zero loss.
 - Peer-goroutine append/fork interleaving: no divergence, no violations
@@ -193,7 +193,7 @@ childSeed=2833144618262241349 (flip in `main/n0/...0039.jsonl`).
 ## Expected-loss profile
 
 `append-lost` findings (contract-permitted flush lag): ~580 per 300-cycle
-kill run, nearly always 1-3 records per channel — the in-memory tail
+kill run, nearly always 1-3 records per channel, the in-memory tail
 since the last flusher pass. e2f5c89 showed zero here (its writes hit the
 page cache synchronously); this is the traded loss window of
 memory-first, bounded and honored.
@@ -202,6 +202,6 @@ memory-first, bounded and honored.
 
 Kill-mode known gaps: `append-lost`, `trunk-lost-mid-fork` (M1), plus
 fork-wreckage classes only when a fork was in flight (M2). Corrupt-mode
-known gaps: M3/M4 classes. Everything else — durable-lost, checksum,
-panic, mismatch/gap/head-cut outside fork or corruption windows — fails
+known gaps: M3/M4 classes. Everything else, durable-lost, checksum,
+panic, mismatch/gap/head-cut outside fork or corruption windows, fails
 the suite.

scripts/callpath/README.md

@@ -1,4 +1,4 @@
-# callpath — the disk-to-wire enumerator
+# callpath: the disk-to-wire enumerator
 
 A tool, not a list. **If it cannot be re-run after a refactor, it is a snapshot
 of someone's reading and it will be wrong within a day.**
@@ -16,10 +16,10 @@ Every one of these was paid for by a failure on 2026-08-18:
 - **THE ALGORITHM AND ITS PRECISION.** A VTA edge and a CHA edge are different
   claims. CHA admits every implementation of the interface method; VTA narrows
   by value flow. They are never printed identically.
-- **THE CUT** — pattern, tests on/off, package list. *Anything outside the cut
+- **THE CUT**, pattern, tests on/off, package list. *Anything outside the cut
   is invisible, not absent.*
 - **CALL PATHS ARE NOT DATA PATHS.** An absent path may mean the bytes crossed
-  **by value** — a `Log` returned by `Open` and invoked from another stack has
+  **by value**, a `Log` returned by `Open` and invoked from another stack has
   no call path from `Open` and is not unrelated. An empty result means one of
   three things and only one of them is a finding.
 - **STATIC vs DISPATCH[n]**, with the **candidate set as inline children**
@@ -30,7 +30,7 @@ Every one of these was paid for by a failure on 2026-08-18:
   that draws the syscall unconditionally **asserts a call most reads never
   make**.
 - **[GENERIC INSTANTIATION]** where one runtime frame appears as two symbols,
-  and type arguments on the symbol — because `decodeRecord[message.Message]`
+  and type arguments on the symbol, because `decodeRecord[message.Message]`
   and `decodeRecord[[]json.RawMessage]` are the fig IR channel and the
   translator channel, and printing them identically merges two different byte
   movements into one line.

scripts/live/README.md

@@ -3,7 +3,7 @@
 Each of these starts a real daemon against a real store and drives real
 verbs. They exist because **a green unit suite is not evidence about the
 product**: between them they found nine bugs during the state-layer work
-(session 3), and four of those were in the direction that loses data — a
+(session 3), and four of those were in the direction that loses data, a
 libretto stump drawn in `fig ls`, a fork entry point the CLI uses and the
 tests did not, a repair command that declined to repair, a study of a deleted
 form that could not be dropped after a restart.

scripts/strip-emdash.py

@@ -0,0 +1,74 @@
+#!/usr/bin/env python3
+"""Strip em dashes from markdown, mechanically and losslessly.
+
+Rules, in order:
+  1. A table cell holding only an em dash becomes "-" (the n/a marker).
+  2. An em dash alone at the end of a line becomes a comma on that line.
+  3. An em dash starting a line moves back as a comma on the previous line.
+  4. Inside a box-drawing line, " — " becomes " - " (same width).
+  5. In a heading, " — " becomes ": ".
+  6. Any other inline " — " becomes ", ".
+Anything left over is reported, not guessed at.
+"""
+import re
+import sys
+
+CELL = re.compile(r"(?<=\|)(\s*)—(\s*)(?=\|)")
+
+
+def strip(text: str) -> str:
+    prev = None
+    while prev != text:
+        prev = text
+        text = CELL.sub(lambda m: m.group(1) + "-" + m.group(2), text)
+
+    lines = text.split("\n")
+    for i, line in enumerate(lines):
+        # em dash left dangling at end of a wrapped line
+        lines[i] = re.sub(r"\s+—$", ",", lines[i])
+    for i, line in enumerate(lines):
+        m = re.match(r"^(\s*)—\s+", line)
+        if m and i > 0 and lines[i - 1].strip():
+            lines[i] = m.group(1) + line[m.end():]
+            if not lines[i - 1].rstrip().endswith((",", ":", ";")):
+                lines[i - 1] = re.sub(r"\s*$", ",", lines[i - 1])
+    text = "\n".join(lines)
+
+    lines = text.split("\n")
+    for i, line in enumerate(lines):
+        if "—" not in line:
+            continue
+        if re.search(r"[\u2500-\u257f]", line):        # box drawing: keep width
+            lines[i] = re.sub(r" +— +", " - ", line)
+        elif re.match(r"\s*#{1,6} ", line):             # heading: colon reads better
+            lines[i] = re.sub(r" +— +", ": ", line)
+        else:
+            lines[i] = re.sub(r" +— +", ", ", line)
+    text = "\n".join(lines)
+    text = re.sub(r",[ \t]*,", ",", text)
+    return text
+
+
+def main(paths):
+    left = 0
+    changed = 0
+    for p in paths:
+        with open(p, encoding="utf-8") as f:
+            src = f.read()
+        if "—" not in src:
+            continue
+        out = strip(src)
+        if out != src:
+            with open(p, "w", encoding="utf-8") as f:
+                f.write(out)
+            changed += 1
+        for n, line in enumerate(out.split("\n"), 1):
+            if "—" in line:
+                left += 1
+                print(f"LEFTOVER {p}:{n}: {line.strip()[:100]}", file=sys.stderr)
+    print(f"{changed} files rewritten, {left} em dashes left")
+    return 1 if left else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))