docs: ASCII typography and style normalization across all repo text

Replace every em dash with real punctuation (rewrites, not hyphen swaps)
in docs, code comments, scripts, configs, and the port records; convert
en dashes, curly quotes, ellipsis glyphs, arrows, and section signs to
ASCII; drop machine-writing tell phrases from living docs. ADR titles
now use a colon. The M2 bring-up DTS model string carried an em dash
into the patch series and its record echoes; fixed at both, and the full
series re-verified to apply cleanly onto pristine 6.18.46. One comment
in freshness.h deliberately names the em dash glyph the UI renders as
the unknown mark; that is data, kept as prose naming it.

Verified: cargo tests (sim, config-lint, rs485-bridge), shellcheck,
both driver MC/DC harnesses, patches-apply.

sim/src/cru.rs

@@ -2,17 +2,17 @@
 //!
 //! `reboot -f` does NOT reset the RV1106 (no PSCI/restart handler). The canonical
 //! reset is the CRU global-first software reset (rung 1), with the DesignWare
-//! watchdog as a backstop (rung 2) — the ladder in flared's `devmem::hard_reset`.
-//! This model lets that ladder, and the boot-mode → MaskRom recovery maneuver, be
+//! watchdog as a backstop (rung 2): the ladder in flared's `devmem::hard_reset`.
+//! This model lets that ladder, and the boot-mode -> MaskRom recovery maneuver, be
 //! exercised entirely on the host: run the pokes against a [`SimBus`], then
 //! [`CruSim::poll`] to see which rung fired and what boot mode a warm reset lands in.
 //!
 //! It bakes in the two hardware facts that cost real hardware time:
-//!   * the CRU global-reset register is `0xff3b0c08` magic `0xfdb9` — the offset
+//!   * the CRU global-reset register is `0xff3b0c08` magic `0xfdb9`: the offset
 //!     `0xff3a0614` from *other* Rockchip SoCs is a **silent no-op** here (the model
 //!     ignores it, so a regression that reverts to the wrong offset fails a test);
 //!   * the boot-mode register `0xff020200` **survives a warm reset** and is cleared
-//!     only by a power-on reset — the mechanism that makes "set MaskRom, then reset"
+//!     only by a power-on reset: the mechanism that makes "set MaskRom, then reset"
 //!     drop the SoC into BootROM download without the BOOT button.
 
 use crate::membus::MemBus;
@@ -20,7 +20,7 @@ use crate::membus::MemBus;
 /// Correct RV1106 global-first software reset (confirmed on hardware 2026-08-14).
 pub const CRU_GLB_SRST_FST: u64 = 0xff3b_0c08;
 pub const CRU_GLB_SRST_MAGIC: u32 = 0xfdb9;
-/// Wrong offset carried over from other Rockchip SoCs — a silent no-op on RV1106.
+/// Wrong offset carried over from other Rockchip SoCs: a silent no-op on RV1106.
 pub const CRU_WRONG_OFFSET: u64 = 0xff3a_0614;
 
 /// DesignWare watchdog (rung 2 backstop).
@@ -212,7 +212,7 @@ mod tests {
     }
 
     /// The boot-mode register survives a (warm) reset: set MaskRom, reset via CRU,
-    /// and the model lands in MaskRom — the on-demand BootROM-download maneuver.
+    /// and the model lands in MaskRom: the on-demand BootROM-download maneuver.
     #[test]
     fn maskrom_survives_warm_reset() {
         let bus = SimBus::new();
@@ -224,7 +224,7 @@ mod tests {
     }
 
     /// A power-on reset clears the boot-mode register (unlike a warm reset), so a
-    /// stale MaskRom request does not strand the device — it boots Normal.
+    /// stale MaskRom request does not strand the device: it boots Normal.
     #[test]
     fn power_on_reset_clears_maskrom_request() {
         let bus = SimBus::new();

sim/src/hpmcu.rs

@@ -2,11 +2,11 @@
 //!
 //! A faithful software port of `flare-edge/hpmcu/watchdog/main.c`'s poll loop:
 //! it reads the Linux-owned mailbox words (magic + heartbeat counter), writes the
-//! MCU-owned state word, and fires (records a CRU reset) on the same deadlines —
+//! MCU-owned state word, and fires (records a CRU reset) on the same deadlines:
 //! boot-grace if userspace never arms it, heartbeat-timeout if a live heartbeat
 //! stops. Because it runs on a [`MemBus`], the *same* flared arm/beat protocol can
 //! be driven against it in a host unit test, with a virtual clock, in
-//! microseconds — the validation that was missing when a boot-loaded build of this
+//! microseconds: the validation that was missing when a boot-loaded build of this
 //! firmware had to be tested by flashing a panel.
 //!
 //! Deadlines are modelled in whole seconds (the firmware's cycle math exists only
@@ -215,7 +215,7 @@ mod tests {
     fn flared_arms_within_boot_grace_no_boot_loop() {
         // The exact safety property the boot-loaded watchdog needs: on a healthy
         // boot, flared comes up well before the 300s boot grace, arms the MCU, and
-        // keeps beating — so it transitions BOOT -> ARMED and never fires. (A
+        // keeps beating, so it transitions BOOT -> ARMED and never fires. (A
         // failure here would be the boot-loop we must never ship.)
         let bus = SimBus::new();
         let mut m = mcu(&bus);
@@ -247,7 +247,7 @@ mod tests {
         let bus = SimBus::new();
         let mut m = mcu(&bus);
         let mut counter = 0u32;
-        // Beat through t=600 (inclusive) — the last heartbeat lands at 600s.
+        // Beat through t=600 (inclusive): the last heartbeat lands at 600s.
         for now in (0..=600).step_by(5) {
             counter += 1;
             arm_beat(&bus, counter);

sim/src/lib.rs

@@ -1,4 +1,4 @@
-//! warden-sim — host-side hardware simulator for WardenOS.
+//! warden-sim: host-side hardware simulator for WardenOS.
 //!
 //! Lets driver and supervisor logic run and be tested on the host, with no panel,
 //! by modelling the RV1106 hardware the vendor SDK cannot: the register/SRAM bus

sim/src/membus.rs

@@ -5,13 +5,13 @@
 //! it as a 32-bit poke or peek at a physical address. `MemBus` is that operation,
 //! abstracted so the same driver/supervisor code runs against either:
 //!
-//!   * the **real** backend — an mmap of `/dev/mem` (lives in flared's
+//!   * the **real** backend: an mmap of `/dev/mem` (lives in flared's
 //!     `devmem.rs`; it will implement this trait so its logic is host-testable), or
-//!   * the **sim** backend — [`SimBus`], an in-memory word map.
+//!   * the **sim** backend: [`SimBus`], an in-memory word map.
 //!
 //! `SimBus` is `Clone` + internally `Arc<Mutex<..>>`, so the simulated MCU core
 //! and the "Linux side" can each hold a handle and read/write the *same* shared
-//! memory — exactly the two-core mailbox the real system uses — with no
+//! memory (exactly the two-core mailbox the real system uses) with no
 //! cache-maintenance dance to model (the real mailbox sits in the GRF uncached
 //! window).
 
@@ -36,7 +36,7 @@ impl SimBus {
         Self::default()
     }
 
-    /// Snapshot every written word (address-sorted) — for test assertions/dumps.
+    /// Snapshot every written word (address-sorted), for test assertions/dumps.
     pub fn dump(&self) -> Vec<(u64, u32)> {
         let g = self.words.lock().unwrap();
         let mut v: Vec<(u64, u32)> = g.iter().map(|(&a, &w)| (a, w)).collect();

sim/src/modbus.rs

@@ -1,16 +1,16 @@
-//! Modbus RTU **slave** simulator — the device end of the RS-485 seam.
+//! Modbus RTU **slave** simulator: the device end of the RS-485 seam.
 //!
 //! flare-edge's `warden-modbus` is the *master/scanner*: it probes RS-485 for
 //! VFDs and PDUs, identifies them, and reads their register maps. To harden that
 //! master to MC/DC we need something for it to talk to that behaves like a real
-//! slave — correct CRC framing, the data-plane function codes, exception replies,
+//! slave: correct CRC framing, the data-plane function codes, exception replies,
 //! and the annoying real-world faults (a cheap sensor that ignores a function, a
 //! device that NAKs an unsupported code). This is that slave, in host memory:
 //! feed it a request frame, get the response frame (or `None` when a real slave
 //! would stay silent). No serial port, no hardware, fully deterministic.
 //!
-//! Scope is the data plane — read/write of holding & input registers, coils, and
-//! discrete inputs (FC 0x01–0x06, 0x0F, 0x10) plus Report Slave ID (0x11) — which
+//! Scope is the data plane: read/write of holding & input registers, coils, and
+//! discrete inputs (FC 0x01-0x06, 0x0F, 0x10) plus Report Slave ID (0x11), which
 //! is what a VFD/PDU register poll actually exercises. Identification via MEI
 //! (0x2B/0x0E) is a documented follow-up.
 
@@ -22,7 +22,7 @@ pub mod exc {
 }
 
 /// Modbus RTU CRC16 (poly 0xA001, low byte first on the wire). Identical to the
-/// master's `crc16` — the two must agree or nothing frames.
+/// master's `crc16`: the two must agree or nothing frames.
 pub fn crc16(bytes: &[u8]) -> u16 {
     let mut crc: u16 = 0xFFFF;
     for &b in bytes {
@@ -63,7 +63,7 @@ pub struct ModbusSlave {
     discrete: Vec<bool>,
     slave_id: Vec<u8>,
     /// Silently drop this many upcoming requests (models a device that ignores a
-    /// function, or a flaky bus) — the master must time out and move on.
+    /// function, or a flaky bus): the master must time out and move on.
     drop_next: usize,
     /// Force every function to answer with this exception (models a device that
     /// NAKs everything but a narrow set) until cleared.
@@ -303,7 +303,7 @@ impl ModbusSlave {
     }
 }
 
-/// Build an RTU request frame (with CRC) — convenience for tests and for driving
+/// Build an RTU request frame (with CRC): convenience for tests and for driving
 /// the master's parser. `pdu` is everything between the address and the CRC
 /// (i.e. `fc` followed by its data).
 pub fn request(address: u8, pdu: &[u8]) -> Vec<u8> {
@@ -408,7 +408,7 @@ mod tests {
     }
 
     /// A device that ignores the next request (the "cheap sensor" the master
-    /// comment warns about) — the master must fall through to the next function.
+    /// comment warns about): the master must fall through to the next function.
     #[test]
     fn drop_next_models_a_silent_device() {
         let mut s = ModbusSlave::new(1, 8, 0);

sim/src/npu.rs

@@ -1,13 +1,13 @@
-//! NPU load model — the `/proc/rknpu/load` surface.
+//! NPU load model: the `/proc/rknpu/load` surface.
 //!
 //! The rknpu driver exposes utilisation at `/proc/rknpu/load` as `"NPU load:  N%"`,
-//! and the file exists only once `rknpu.ko` is loaded — so a *missing* file means
+//! and the file exists only once `rknpu.ko` is loaded, so a *missing* file means
 //! the driver is absent, not idle (sysmon reports absent as 0 and labels the
 //! screen). This models both a present NPU at a chosen load and an absent one, and
 //! mirrors sysmon's parse (`strchr(buf, ':')` then the leading integer) so the
 //! driver's reader can be exercised against realistic text.
 //!
-//! (Only `/proc/rknpu/load` is modelled. `/proc/rknpu/volt` is deliberately NOT —
+//! (Only `/proc/rknpu/load` is modelled. `/proc/rknpu/volt` is deliberately NOT:
 //! reading it SIGSEGVs the reader on this board, so no code should ever open it.)
 
 /// A modelled NPU. `present == false` models rknpu.ko not loaded (no proc file).

sim/src/rga.rs

@@ -1,9 +1,9 @@
-//! RGA 2D blitter model — a recording `improcess` fake.
+//! RGA 2D blitter model: a recording `improcess` fake.
 //!
 //! `warden_rga.c` offloads copies/scales/format-conversions to the RGA via
 //! librga's `improcess(src, dst, ..., IM_SYNC)`, and falls back to the CPU draw
 //! path when it returns anything but `IM_STATUS_SUCCESS`. The blit *pixels* are
-//! not modelled — what matters for testing is the **dispatch** logic: which ops
+//! not modelled. What matters for testing is the **dispatch** logic: which ops
 //! get sent, with what geometry/format, and that a non-success status drives the
 //! CPU fallback. So the sim records each requested op and returns a programmable
 //! status. It rides its own call seam (behind the driver's `#if WARDEN_USE_RGA`),
@@ -18,7 +18,7 @@ pub struct Rect {
     pub h: i32,
 }
 
-/// A surface descriptor — the subset of im2d `rga_buffer_t` the dispatch cares
+/// A surface descriptor: the subset of im2d `rga_buffer_t` the dispatch cares
 /// about (dimensions + pixel format).
 #[derive(Clone, Copy, PartialEq, Eq, Debug)]
 pub struct Surface {
@@ -141,7 +141,7 @@ mod tests {
             r.improcess(surf(10, 10), surf(10, 10), rect(10, 10), rect(10, 10)),
             ImStatus::Failed
         );
-        // the op is still recorded — the driver dispatched it, then fell back.
+        // the op is still recorded: the driver dispatched it, then fell back.
         assert_eq!(r.count(), 1);
     }