From d9cd4772d26353b2c236aa7730970a44b4760404 Mon Sep 17 00:00:00 2001
From: BinFlip <code@binflip.rs>
Date: Sun, 13 Sep 2026 19:07:20 -0700
Subject: [PATCH] chore: release 0.3.2

- ObjectInfo::has_method_table() gates method iteration on a non-zero
  method count, and diagnostics() flags an uninitialized methods_va.
- code_entries() / code_entrypoints() drop unreadable slots and objects
  instead of aborting the walk.
- Replace em-dashes with plain hyphens across docs, comments, and
  diagnostic message strings.
- Use as_chunks::<2>() for UTF-16LE decoding (clippy 1.98
  chunks_exact_to_as_chunks).
- Refresh transitive dependencies.
---
 CHANGELOG.md               | 102 ++++++++++++++++++++++++-------------
 Cargo.lock                 |  37 +++++++++-----
 Cargo.toml                 |   4 +-
 README.md                  |  12 ++---
 build.rs                   |   4 +-
 data/opcodes.csv           |   2 +-
 examples/dump.rs           |   4 +-
 src/entrypoint.rs          |   4 +-
 src/error.rs               |  14 ++---
 src/lib.rs                 |  16 +++---
 src/pcode/calltarget.rs    |   6 +--
 src/pcode/decoder.rs       |  28 +++++-----
 src/pcode/opcode.rs        |  22 ++++----
 src/pcode/semantics.rs     |   2 +-
 src/project/methodentry.rs |   2 +-
 src/project/methodlink.rs  |   6 +--
 src/project/pcodemethod.rs |   6 +--
 src/project/vbcontrol.rs   |   2 +-
 src/project/vbobject.rs    |  67 +++++++++++++++---------
 src/project/vbproject.rs   |  79 ++++++++++++++++++----------
 src/trace.rs               |   6 +--
 src/util.rs                |   2 +-
 src/vb/bstr.rs             |   7 +--
 src/vb/comreg.rs           |  12 ++---
 src/vb/constantpool.rs     |   4 +-
 src/vb/control.rs          |   8 +--
 src/vb/controlprop.rs      |  28 +++++-----
 src/vb/events.rs           |   8 +--
 src/vb/exports.rs          |  54 ++++++++++----------
 src/vb/external.rs         |  84 +++++++++++++++---------------
 src/vb/flags.rs            |   4 +-
 src/vb/formdata.rs         |  28 +++++-----
 src/vb/functype.rs         |  43 ++++++++--------
 src/vb/guitable.rs         |  20 ++++----
 src/vb/header.rs           |   2 +-
 src/vb/object.rs           | 100 ++++++++++++++++++++++++++----------
 src/vb/objecttable.rs      |   4 +-
 src/vb/privateobj.rs       |  32 ++++++------
 src/vb/procedure.rs        |  30 +++++------
 src/vb/projectdata.rs      |   8 +--
 src/vb/projectinfo2.rs     |   8 +--
 src/vb/property.rs         |  20 ++++----
 src/vb/publicbytes.rs      |  38 +++++++-------
 src/vb/varstub.rs          |  10 ++--
 44 files changed, 557 insertions(+), 422 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index dd7439f..4014b09 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,12 +6,43 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
-## [0.3.1]
+## [0.3.2] - 2026-09-13
+
+### Added
+
+- `ObjectInfo::has_method_table()` - `true` only when `methods_va` is non-zero,
+  differs from `constants_va`, and the object's own `method_count` is non-zero.
+- `VbProject::diagnostics()` reports an `Info` `Quirk` at site `method_table`
+  when `methods_va` is set but the object's method count is zero (the pointer
+  is uninitialized, not a dispatch table).
+
+### Fixed
+
+- `VbObject::has_method_table()` now delegates to
+  `ObjectInfo::has_method_table()`. An object with a zero method count no longer
+  has a descriptor-supplied count iterated over its uninitialized table pointer.
+- `VbObject::code_entries()` and `VbProject::code_entrypoints()` are fail-soft
+  per slot: an unreadable method slot, `proc_size`, or object is dropped (with a
+  `tracing` warn event under the `tracing` feature) instead of aborting the
+  whole walk.
+
+### Changed
+
+- Replaced em-dashes with plain hyphens across docs, comments, and
+  `ParseDiagnostic` message strings. Consumers matching on exact diagnostic
+  message text will see the new punctuation; match on `site` / `kind` instead.
+- Refreshed transitive dependencies (`cargo update`). Direct dependencies were
+  already current.
+- UTF-16LE decoding in `BStr::to_string_lossy()` and `FuncTypDesc` string
+  defaults uses `as_chunks::<2>()` instead of `chunks_exact(2)`, satisfying the
+  `chunks_exact_to_as_chunks` lint added in clippy 1.98. No behaviour change.
+
+## [0.3.1] - 2026-08-09
 
 ### Changed
 
 - Recorded ATRAPS LLC as copyright holder and added a `NOTICE` file. The Apache-2.0
-  appendix was never filled in — it still carried the literal
+  appendix was never filled in - it still carried the literal
   `[yyyy] [name of copyright owner]` placeholder, so nothing in this repo stated
   who owned it. No functional change.
 - Dropped the deprecated `authors` field and repointed `repository` at the organisation.
@@ -20,11 +51,11 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   gated rather than invisible.
 - Publishing now uses crates.io trusted publishing instead of a stored registry token.
 
-## [0.3.0] — 2026-06-09
+## [0.3.0] - 2026-06-09
 
 ### Added
 
-- `CallApiStub::ordinal()`, `flags()`, and `is_by_ordinal()` — the
+- `CallApiStub::ordinal()`, `flags()`, and `is_by_ordinal()` - the
   `DllFunctionCall` descriptor is 16 bytes (not 8), carrying an import ordinal
   and a by-ordinal flag (bit 1) after the name pointers. Verified against
   MSVBVM60.DLL `sub_660315de`. By-ordinal imports omit the API name from the
@@ -33,18 +64,18 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   `CallApiStub`, exposing ordinal / by-ordinal state for declared imports
   (e.g. `Declare ... Alias "#123"`).
 - `controlprop::CleanupAction` plus `ControlPropertyType::cleanup_action()`
-  and `is_reference()` — the runtime resource-release classification
+  and `is_reference()` - the runtime resource-release classification
   (`FreeString` / `FreeVariant` / `ReleaseObject` / `DestroyArray` /
   `UnlockArray` / `DestructRecord`) for each class/form instance member,
   recovered from `CleanupSingleEntry` (0x66016AAA).
-- `decoder::ErrorFlow` plus `Instruction::error_flow()` — classifies a
+- `decoder::ErrorFlow` plus `Instruction::error_flow()` - classifies a
   `Resume` / `OnErrorGoto` instruction's signed operand into its source-level
   construct (`Resume`, `Resume Next`, `Resume <label>`, `On Error GoTo <label>`,
   `On Error Resume Next`, `On Error GoTo 0`). Verified against `op_Lead2_Resume`
   and `op_OnErrorGoto`.
 - `Instruction::is_bos()` / `bos_distance()`, `OpcodeInfo::is_bos()`,
   `OpcodeSemantics::Bos`, and `PCodeMethod::statement_markers()` returning
-  `StatementMarker { offset, distance }` — `LargeBos` is now modelled as a
+  `StatementMarker { offset, distance }` - `LargeBos` is now modelled as a
   beginning-of-statement marker whose `u8` operand is the byte distance to the
   next statement boundary (`0` = last). This partitions a procedure's P-Code
   into source statements.
@@ -88,7 +119,7 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   to a 4-byte boundary). A lone trailing `0x00` previously looked like a
   truncated `LargeBos`; the iterator now ends cleanly at an all-zero tail.
 
-## [0.2.1] — 2026-05-04
+## [0.2.1] - 2026-05-04
 
 Patch release focused on parser integration ergonomics and stable
 persistence surfaces.
@@ -118,7 +149,7 @@ persistence surfaces.
 - Documented the `PCodeMethod::instructions()` upper bound from the on-disk
   `u16` procedure-size field.
 
-## [0.2.0] — 2026-04-26
+## [0.2.0] - 2026-04-26
 
 A breaking-change release focused on adversarial-input safety, richer
 typed walkers, and a tagged stream of code entry points. Verified
@@ -143,58 +174,58 @@ and `VB6.EXE` (v6.00.8176).
 
 #### Predicates and forward-compat aliases
 
-- `OpcodeInfo::is_terminator()` and `OpcodeInfo::is_call()` —
+- `OpcodeInfo::is_terminator()` and `OpcodeInfo::is_call()` -
   convenience predicates for CFG-style basic-block splitting.
 - `CompilationMode { Pcode, Native, Mixed }` enum and
-  `VbProject::compilation_mode()` — combines the project-level
+  `VbProject::compilation_mode()` - combines the project-level
   `lpNativeCode` flag with a per-object `has_pcode()` scan, so
   mixed-mode binaries surface explicitly.
-- `PCodeMethod::cleanup_entries()` — re-export of the cleanup-table
+- `PCodeMethod::cleanup_entries()` - re-export of the cleanup-table
   iterator on `ProcDscInfo` for ergonomic consumer access.
-- `ConstantPool::entries_with_hints()` — reserved signature aliasing
+- `ConstantPool::entries_with_hints()` - reserved signature aliasing
   `entries()` for forward compatibility with future hint-enriched entries.
-- `VbObject::form_designer_data()` — reserved signature aliasing
+- `VbObject::form_designer_data()` - reserved signature aliasing
   `form_data_from_gui_entry()`.
 
 #### Joined walkers and aggregators
 
 - `VbObject::events()` and `VbObject::events_all_slots()` returning
-  `Vec<EventBinding>` — joined walker over controls × event sink slots ×
+  `Vec<EventBinding>` - joined walker over controls × event sink slots ×
   per-control-type event-name templates.
 - `EventBinding { control_index, control_name, control_type, event_slot,
   event_name, handler_va }` with `is_connected()` and `label()` helpers.
 - `VbProject::gui_entries_with_form_data()` returning
   `GuiEntriesWithFormData` iterator yielding `GuiEntryWithFormData
-  { entry, form_data }` pairs — pre-pairs each form metadata entry with
+  { entry, form_data }` pairs - pre-pairs each form metadata entry with
   its parsed form binary.
-- `VbProject::code_entrypoints()` — single-call aggregator returning
+- `VbProject::code_entrypoints()` - single-call aggregator returning
   `Vec<CodeEntrypoint>` over per-object dispatch + thunks + events +
   `Sub Main`. Each carries an `EntrypointKind` tag.
 - `EntrypointKind { PCodeStub, NativeProc, NativeThunk, EventHandler,
   SubMain }` (`#[non_exhaustive]`).
 - `InterfaceMetadata::typelib_path_va()` and
-  `InterfaceMetadata::data_slot_va()` — raw VA accessors for the +0x10
+  `InterfaceMetadata::data_slot_va()` - raw VA accessors for the +0x10
   and +0x18 fields, with explicit "purpose undocumented" doc on +0x18.
 
 #### Operand and constant pool typed accessors
 
-- `Instruction::data_type()` — exposes the parent opcode's
+- `Instruction::data_type()` - exposes the parent opcode's
   `PCodeDataType` for the instruction's stack result.
-- `Instruction::operand_type(idx)` — per-slot inferred type, validated
+- `Instruction::operand_type(idx)` - per-slot inferred type, validated
   against operand presence.
-- `ConstantPool::string_at(index)` — indexed BSTR accessor returning
+- `ConstantPool::string_at(index)` - indexed BSTR accessor returning
   `Result<Option<BStr>, Error>`.
-- `ConstantPool::api_stub_at(index)` — indexed `CallApiStub` resolution
+- `ConstantPool::api_stub_at(index)` - indexed `CallApiStub` resolution
   returning `Result<Option<CallApiStub>, Error>`.
 
 #### Diagnostics and optional tracing
 
-- Optional `tracing` cargo feature (`--features tracing`) — emits
+- Optional `tracing` cargo feature (`--features tracing`) - emits
   `target = "visualbasic::dropped"` `warn` events at silent fail-soft
   sites (`code_entries`, `events_inner`, `ImportResolver`,
   `CallResolver`). Default builds carry zero `tracing` dependency
   weight; helpers compile to no-ops.
-- `VbProject::diagnostics()` returning `Vec<ParseDiagnostic>` — eager
+- `VbProject::diagnostics()` returning `Vec<ParseDiagnostic>` - eager
   parse-health probe flagging missing `Sub Main`, mixed compilation
   mode, suspicious-absent `OptionalObjectInfo`/`PrivateObjectDescriptor`,
   and method-table overlap.
@@ -203,15 +234,15 @@ and `VB6.EXE` (v6.00.8176).
 
 #### Recognition error discrimination
 
-- `Error::NotRecognized` — valid PE container but no VB6 marker.
-- `Error::TruncatedContainer { context }` — recognized as VB6 but a
+- `Error::NotRecognized` - valid PE container but no VB6 marker.
+- `Error::TruncatedContainer { context }` - recognized as VB6 but a
   structure read overran the buffer.
-- `Error::UnrecognizedFormat { reason }` — not a recognizable PE
+- `Error::UnrecognizedFormat { reason }` - not a recognizable PE
   container at all (or PE32+).
 - `RecognitionFailure { NotRecognized, TruncatedContainer,
   UnrecognizedFormat, CompressedAndOpaque }` (`#[non_exhaustive]`)
   with `Error::recognition_failure() -> Option<RecognitionFailure>`
-  classifier — lets consumers silently deny non-VB6 files and only
+  classifier - lets consumers silently deny non-VB6 files and only
   warn on truncation cases. `CompressedAndOpaque` is reserved for a
   future heuristic and not yet emitted.
 
@@ -243,7 +274,7 @@ let frame = method.frame_size()?;
 let v = obj.method_count()?;
 ```
 
-The fallible signatures match the malware-analysis posture — every
+The fallible signatures match the malware-analysis posture - every
 read can now surface `Error::Truncated` rather than panicking on a
 short slice.
 
@@ -254,7 +285,7 @@ For `VbObject`, `VbProject::project_name`, `VbControl::name`,
 `prog_id` / `class_name`, and `CallApiStub::library_name` /
 `function_name`:
 
-- The string accessor returns `Cow<'a, str>` (lossy UTF-8) — borrows
+- The string accessor returns `Cow<'a, str>` (lossy UTF-8) - borrows
   for valid UTF-8 (the common case for ASCII identifiers), allocates
   only on U+FFFD substitution.
 - The byte form is preserved as `*_bytes()`.
@@ -290,7 +321,7 @@ Affects `vbobject.rs`, `pcodemethod.rs`, `methodlink.rs`,
 
 ### Removed
 
-- `Error::VbHeaderNotFound` — superseded by the discriminated variants
+- `Error::VbHeaderNotFound` - superseded by the discriminated variants
   above. Match on `Error::recognition_failure()` to map old
   `VbHeaderNotFound` semantics to the new
   `RecognitionFailure::NotRecognized`.
@@ -306,7 +337,7 @@ Affects `vbobject.rs`, `pcodemethod.rs`, `methodlink.rs`,
 
 - The full crate parse path was audited under
   `clippy::{unwrap_used, expect_used, panic, arithmetic_side_effects,
-  indexing_slicing}` — **no input byte sequence can panic the parser.**
+  indexing_slicing}` - **no input byte sequence can panic the parser.**
   ~538 lint sites in the library and ~215 in `build.rs` were converted
   to checked alternatives. `build.rs` runs at compile time on
   CSV input from `data/` and is exempt from the per-byte lints.
@@ -316,7 +347,7 @@ Affects `vbobject.rs`, `pcodemethod.rs`, `methodlink.rs`,
 - Verified `ProcCallEngine_Body` (0x66108C00) and `op_Lead2_Resume`
   (0x6610F212) in MSVBVM60: only `+0x06`, `+0x0C`, `+0x10`, `+0x18`,
   `+0x1C` of `ProcDscInfo` are read by the runtime. There is **no**
-  `wLocalsNameTableOffset` field — per-procedure local-variable names
+  `wLocalsNameTableOffset` field - per-procedure local-variable names
   are not recoverable from compiled binaries (documented in `TODO.md`).
 - Verified `EbLoadRunTime` (0x6602F6CE): `PublicVarTable` entries
   carry only `frame_offset + type_code`. Variable names are
@@ -325,11 +356,12 @@ Affects `vbobject.rs`, `pcodemethod.rs`, `methodlink.rs`,
   static defaults don't exist in compiled binaries (documented in
   `TODO.md`).
 
-## [0.1.0] — 2026-03-31
+## [0.1.0] - 2026-03-31
 
 Initial public release.
 
-[Unreleased]: https://github.com/ATRAPSLLC/visualbasic-rs/compare/v0.3.1...HEAD
+[Unreleased]: https://github.com/ATRAPSLLC/visualbasic-rs/compare/v0.3.2...HEAD
+[0.3.2]: https://github.com/ATRAPSLLC/visualbasic-rs/compare/v0.3.1...v0.3.2
 [0.3.1]: https://github.com/ATRAPSLLC/visualbasic-rs/compare/v0.3.0...v0.3.1
 [0.3.0]: https://github.com/ATRAPSLLC/visualbasic-rs/compare/v0.2.1...v0.3.0
 [0.2.1]: https://github.com/ATRAPSLLC/visualbasic-rs/compare/v0.2.0...v0.2.1
diff --git a/Cargo.lock b/Cargo.lock
index 62ce85c..c417ea0 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -25,9 +25,9 @@ checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"
 
 [[package]]
 name = "bitflags"
-version = "2.13.1"
+version = "2.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
+checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"
 
 [[package]]
 name = "cfg-if"
@@ -105,9 +105,9 @@ checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
 
 [[package]]
 name = "log"
-version = "0.4.33"
+version = "0.4.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
+checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
 
 [[package]]
 name = "num-traits"
@@ -280,13 +280,13 @@ dependencies = [
 
 [[package]]
 name = "scroll_derive"
-version = "0.13.1"
+version = "0.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed76efe62313ab6610570951494bdaa81568026e0318eaa55f167de70eeea67d"
+checksum = "e1a36a382ed65dbcc0ab47fd5e9a94112417ccd34560a392ef3b7b0f0ec39148"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 3.0.5",
 ]
 
 [[package]]
@@ -300,6 +300,17 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "syn"
+version = "3.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12df2e0110f65b775f769bb17ef989067a1d931b2eb822bd4346631eeada89f9"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
 [[package]]
 name = "tempfile"
 version = "3.27.0"
@@ -346,7 +357,7 @@ checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
 
 [[package]]
 name = "visualbasic"
-version = "0.3.1"
+version = "0.3.2"
 dependencies = [
  "goblin",
  "proptest",
@@ -394,20 +405,20 @@ checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
 
 [[package]]
 name = "zerocopy"
-version = "0.8.56"
+version = "0.8.57"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "556764e583adb45a9f8d413c2a147fa7e8d821e48e12b14fd560b607998b75eb"
+checksum = "d35102a9f36d089ccae9e4c6802bc118be4487b80aaffc0ab4e0cf5ce92d2873"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.56"
+version = "0.8.57"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2ab42fc20575779bd240faa45f94a74256f755c0fa9e89f0ede20d91d0cdfc1"
+checksum = "146c01f5ab44258da43cf276c74a2763db2ff3969c9c652c3f2de07041d0b2bc"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index e0b3878..caff93c 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "visualbasic"
-version = "0.3.1"
+version = "0.3.2"
 edition = "2024"
 rust-version = "1.88"
 description = "Parse and inspect Visual Basic 6 compiled binaries"
@@ -31,7 +31,7 @@ default = []
 # Emits structured `tracing` events at the per-iteration silent-skip sites
 # (decode errors, malformed entries, unparseable controls, etc.). Useful
 # for diagnosing why a parse silently dropped data without changing the
-# fail-soft semantics. No effect when disabled — the helpers compile to
+# fail-soft semantics. No effect when disabled - the helpers compile to
 # no-ops.
 tracing = ["dep:tracing"]
 
diff --git a/README.md b/README.md
index 91b950e..8e802c5 100644
--- a/README.md
+++ b/README.md
@@ -61,23 +61,23 @@ for obj in project.objects()? {
 For consumer code that wants a single tagged stream rather than walking
 each substructure by hand:
 
-- [`VbProject::code_entrypoints()`] — every code VA in the project
+- [`VbProject::code_entrypoints()`] - every code VA in the project
   (P-Code stubs, native procs, native thunks, event handlers, `Sub Main`)
   in one `Vec<CodeEntrypoint>`.
-- [`VbObject::events()`] — joined `(control, event_slot, handler_va)`
+- [`VbObject::events()`] - joined `(control, event_slot, handler_va)`
   bindings for a form, with per-control-type event-name resolution.
-- [`VbProject::gui_entries_with_form_data()`] — pairs each GUI table
+- [`VbProject::gui_entries_with_form_data()`] - pairs each GUI table
   entry with its parsed form binary in one iterator.
-- [`VbProject::compilation_mode()`] — distinguishes `Pcode` / `Native` /
+- [`VbProject::compilation_mode()`] - distinguishes `Pcode` / `Native` /
   `Mixed` binaries (combines the project flag with a per-object scan).
-- [`VbProject::diagnostics()`] — eager parse-health probe surfacing
+- [`VbProject::diagnostics()`] - eager parse-health probe surfacing
   missing optional structures and known-anomaly patterns.
 
 ## Cargo features
 
 | Feature | Default | Effect |
 |---|---|---|
-| `tracing` | off | Emits structured `tracing::warn!` events at silent fail-soft sites. No effect when disabled — the helpers compile to no-ops. |
+| `tracing` | off | Emits structured `tracing::warn!` events at silent fail-soft sites. No effect when disabled - the helpers compile to no-ops. |
 
 ## Example tool
 
diff --git a/build.rs b/build.rs
index 79fa5ca..5461c11 100644
--- a/build.rs
+++ b/build.rs
@@ -8,8 +8,8 @@
 )]
 //!
 //! Reads CSVs at build time and produces:
-//! - `opcode_generated.rs` — 6 static `[OpcodeInfo; 256]` opcode arrays
-//! - `vb6_data_generated.rs` — control GUIDs, event templates, VB6 constants
+//! - `opcode_generated.rs` - 6 static `[OpcodeInfo; 256]` opcode arrays
+//! - `vb6_data_generated.rs` - control GUIDs, event templates, VB6 constants
 
 use std::collections::HashMap;
 use std::env;
diff --git a/data/opcodes.csv b/data/opcodes.csv
index 06bd473..8d8ac02 100644
--- a/data/opcodes.csv
+++ b/data/opcodes.csv
@@ -1,4 +1,4 @@
-# VB6 P-Code opcodes — encoding + verified runtime semantics
+# VB6 P-Code opcodes - encoding + verified runtime semantics
 # Merged from opcodes.csv (encoding) and opcode_semantics.csv (semantics)
 #
 # Encoding columns:
diff --git a/examples/dump.rs b/examples/dump.rs
index 2da779c..4d1b9ef 100644
--- a/examples/dump.rs
+++ b/examples/dump.rs
@@ -1,4 +1,4 @@
-//! Full VB6 project dump — ildasm-style text output.
+//! Full VB6 project dump - ildasm-style text output.
 //!
 //! Usage:
 //!   cargo run --example dump -- <path-to-vb6-exe>
@@ -406,7 +406,7 @@ fn resolve_external(
             if let Some(decl) = ext.as_declare(map) {
                 let lib = decl.library_name(map).unwrap_or("?");
                 let func = decl.function_name(map).unwrap_or("?");
-                // Surface by-ordinal imports — the API name is absent and the
+                // Surface by-ordinal imports - the API name is absent and the
                 // runtime resolves via GetProcAddress(ordinal), a name-hiding tell.
                 match decl.api_stub(map) {
                     Some(stub) if stub.is_by_ordinal() => {
diff --git a/src/entrypoint.rs b/src/entrypoint.rs
index 365516d..7cecef4 100644
--- a/src/entrypoint.rs
+++ b/src/entrypoint.rs
@@ -7,7 +7,7 @@
 //! call    ThunRTMain          ; 0xE8 <rel32>  (or indirect call)
 //! ```
 //!
-//! VB6 ActiveX DLLs/OCXs use a different pattern — the DllMain entry
+//! VB6 ActiveX DLLs/OCXs use a different pattern - the DllMain entry
 //! does NOT contain the VBHeader VA. Instead, the DLL exports
 //! (`DllGetClassObject`, `DllRegisterServer`, etc.) each push it:
 //!
@@ -54,7 +54,7 @@ const VB5_MAGIC: &[u8; 4] = b"VB5!";
 ///
 /// - [`Error::EntryPointNotPush`] if both methods fail.
 pub fn extract_vb_header_va(map: &AddressMap<'_>, entry_point_rva: u32) -> Result<u32, Error> {
-    // Method 1: EXE entry point — push imm32 (0x68 xx xx xx xx)
+    // Method 1: EXE entry point - push imm32 (0x68 xx xx xx xx)
     if let Ok(code) = map.slice_from_rva(entry_point_rva, MIN_ENTRY_BYTES)
         && let Some(&[PUSH_IMM32, b0, b1, b2, b3]) = code.first_chunk::<5>()
     {
diff --git a/src/error.rs b/src/error.rs
index 7993388..c9c961a 100644
--- a/src/error.rs
+++ b/src/error.rs
@@ -82,7 +82,7 @@ pub enum Error {
     /// a VB6 file at all (e.g., a Delphi/MFC/CRT-only PE).
     ///
     /// Consumers tagging files as "VB6 or not" should treat this as the
-    /// quiet-path negative — log nothing or only at debug level.
+    /// quiet-path negative - log nothing or only at debug level.
     NotRecognized,
 
     /// The container looks like VB6 but a structural read overran the file.
@@ -93,7 +93,7 @@ pub enum Error {
     /// [`ObjectTable`](crate::vb::objecttable::ObjectTable) at the
     /// referenced VA falls off the end of the buffer or off the end of
     /// any PE section. Indicates a truncated, corrupt, or section-table-
-    /// inconsistent file — log at warn level and surface to the analyst.
+    /// inconsistent file - log at warn level and surface to the analyst.
     TruncatedContainer {
         /// Which structure failed to read fully.
         context: &'static str,
@@ -107,7 +107,7 @@ pub enum Error {
     /// Distinct from [`NotRecognized`](Self::NotRecognized) which fires
     /// only after the PE walk succeeded.
     UnrecognizedFormat {
-        /// Short reason — `"goblin: <message>"` or `"PE32+ unsupported"`.
+        /// Short reason - `"goblin: <message>"` or `"PE32+ unsupported"`.
         reason: String,
     },
 
@@ -272,7 +272,7 @@ impl Error {
     ///   [`Error::Not32Bit`] (no PE container or PE32+).
     /// - `None` for downstream errors that occur **after** the
     ///   project structure has been recognized (per-field reads,
-    ///   address-translation failures, etc.) — those are not
+    ///   address-translation failures, etc.) - those are not
     ///   recognition failures and consumers should not silently
     ///   suppress them.
     ///
@@ -309,15 +309,15 @@ pub enum RecognitionFailure {
     /// Consumer recommendation: log at debug level or not at all.
     NotRecognized,
     /// Recognized as VB6 but a structural read overran the file/section.
-    /// Consumer recommendation: log at warn level — truncated or
+    /// Consumer recommendation: log at warn level - truncated or
     /// inconsistent file worth investigating.
     TruncatedContainer,
     /// Not a recognizable PE container (or PE32+, which isn't VB6).
-    /// Consumer recommendation: log at debug level — file isn't even
+    /// Consumer recommendation: log at debug level - file isn't even
     /// a candidate.
     UnrecognizedFormat,
     /// **Reserved.** Future heuristic for detecting packed/protected
-    /// VB6 binaries. The crate does not currently emit this variant —
+    /// VB6 binaries. The crate does not currently emit this variant -
     /// it is exposed so downstream `match` arms can include it now and
     /// not break when the heuristic lands.
     CompressedAndOpaque,
diff --git a/src/lib.rs b/src/lib.rs
index 7983789..76eeaaa 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -46,7 +46,7 @@
 //! VB6 binaries from the wild include malware samples that may be truncated,
 //! have inconsistent structure-size fields, or carry intentionally adversarial
 //! VAs. Every public API in this crate falls into one of three behavioural
-//! categories — pick the one that matches your call site:
+//! categories - pick the one that matches your call site:
 //!
 //! ## 1. Fail-loud at the byte boundary (primitive accessors)
 //!
@@ -66,12 +66,12 @@
 //! [`InstructionIterator`](crate::pcode::decoder::InstructionIterator),
 //! [`PCodeMethodIterator`](crate::project::PCodeMethodIterator), and
 //! [`ConstPoolIter`](crate::vb::constantpool::ConstPoolIter) yield
-//! `Item = Result<T, Error>` per entry — they emit one `Err` per malformed
+//! `Item = Result<T, Error>` per entry - they emit one `Err` per malformed
 //! row and *keep going*, so a single bad entry does not poison the whole
 //! sweep. Match on each `Item` to pull successes, log failures, or stop
 //! early on first error per your policy. Iteration ends only when the
 //! underlying byte stream is exhausted (or a structural-truncation
-//! `Err` is yielded — most iterators continue past per-entry errors).
+//! `Err` is yielded - most iterators continue past per-entry errors).
 //!
 //! ## 3. Silent fail-soft (high-level joins)
 //!
@@ -91,9 +91,9 @@
 //! Parse failures during the recognition phase are classified by
 //! [`Error::recognition_failure`] into one of:
 //!
-//! - [`RecognitionFailure::NotRecognized`] — valid PE but no VB6 marker.
-//! - [`RecognitionFailure::TruncatedContainer`] — looks VB6 but truncated.
-//! - [`RecognitionFailure::UnrecognizedFormat`] — not a PE container at all.
+//! - [`RecognitionFailure::NotRecognized`] - valid PE but no VB6 marker.
+//! - [`RecognitionFailure::TruncatedContainer`] - looks VB6 but truncated.
+//! - [`RecognitionFailure::UnrecognizedFormat`] - not a PE container at all.
 //!
 //! Consumers tagging files as "VB6 or not" should match on this
 //! classification to silently skip non-VB6 files and only log the
@@ -103,7 +103,7 @@
 //!
 //! The crate is built under the lint set
 //! `clippy::{unwrap_used, expect_used, panic, arithmetic_side_effects,
-//! indexing_slicing}` — every byte read goes through a checked helper, every
+//! indexing_slicing}` - every byte read goes through a checked helper, every
 //! offset computation uses `checked_add` / `wrapping_add` / `saturating_add`
 //! depending on semantics, and every slice access uses `.get(...)` rather
 //! than `[]`. **No input byte sequence can panic this parser.** Tests are
@@ -160,7 +160,7 @@ pub use project::{
 // Thread-safety guarantee: VbProject and PCodeMethod borrow from a `&[u8]`
 // file buffer, hold no interior mutability, and contain no raw pointers or
 // `Cell`/`RefCell`. They are therefore both `Send` and `Sync` whenever the
-// borrowed buffer is — i.e., always, for any `&'a [u8]` input. This static
+// borrowed buffer is - i.e., always, for any `&'a [u8]` input. This static
 // assertion makes that guarantee a compile-time invariant: a future change
 // that adds a non-Send/non-Sync field will break the build here, not silently
 // at a downstream `.await` point.
diff --git a/src/pcode/calltarget.rs b/src/pcode/calltarget.rs
index 0f5965b..74c6dc2 100644
--- a/src/pcode/calltarget.rs
+++ b/src/pcode/calltarget.rs
@@ -5,10 +5,10 @@
 //! or `"Timer1"` with vtable offset.
 //!
 //! Two resolver types are provided:
-//! - [`ImportResolver`]: Lightweight — needs only an [`AddressMap`] and the
+//! - [`ImportResolver`]: Lightweight - needs only an [`AddressMap`] and the
 //!   external table VA/count. Resolves `%x` imports without a full
 //!   [`VbProject`].
-//! - [`CallResolver`]: Full — wraps [`ImportResolver`] and adds `%v`/`%c`
+//! - [`CallResolver`]: Full - wraps [`ImportResolver`] and adds `%v`/`%c`
 //!   resolution that requires project context.
 
 use crate::{
@@ -46,7 +46,7 @@ pub enum CallTarget {
 /// Lightweight import resolver for `%x` (ExternalCall) operands.
 ///
 /// Resolves import indices to `CallTarget::Api` entries using only the
-/// address map and external table location — no [`VbProject`] required.
+/// address map and external table location - no [`VbProject`] required.
 ///
 /// Construct from [`AddressMap`] + external table VA + count (available
 /// from [`ProjectData`](crate::vb::projectdata::ProjectData)), or from
diff --git a/src/pcode/decoder.rs b/src/pcode/decoder.rs
index 90c9a4f..98e41bf 100644
--- a/src/pcode/decoder.rs
+++ b/src/pcode/decoder.rs
@@ -51,7 +51,7 @@ pub struct Instruction {
 impl Instruction {
     /// Returns the type the opcode imprints on its evaluation-stack result, if any.
     ///
-    /// Mirrors the `data_type` field on the parent [`OpcodeInfo`] — for
+    /// Mirrors the `data_type` field on the parent [`OpcodeInfo`] - for
     /// example `LitI4` returns `Some(PCodeDataType::I4)`, `FStR8` returns
     /// `Some(PCodeDataType::R8)`, control-flow / Nop / Stack opcodes return
     /// `None`. Build-time-resolved from the opcode's mnemonic suffix; no
@@ -69,7 +69,7 @@ impl Instruction {
     /// Returns the inferred type of the operand at slot `index`, if any.
     ///
     /// Today this projects the parent opcode's
-    /// [`data_type`](Self::data_type) for every operand slot — VB6 P-Code
+    /// [`data_type`](Self::data_type) for every operand slot - VB6 P-Code
     /// opcodes are monomorphic in their operand kinds (a `LitI4` always
     /// produces `I4`, an `FStR8` always stores `R8`), so the per-operand
     /// type equals the per-instruction type when one is defined. The
@@ -153,17 +153,17 @@ impl Instruction {
 /// disassembler from printing a sentinel as `loc_FFFF`).
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum ErrorFlow {
-    /// `On Error GoTo <label>` — installs the handler at the given P-Code offset.
+    /// `On Error GoTo <label>` - installs the handler at the given P-Code offset.
     OnErrorGoto(u16),
-    /// `On Error Resume Next` — operand `-1` (`0xFFFF`).
+    /// `On Error Resume Next` - operand `-1` (`0xFFFF`).
     OnErrorResumeNext,
-    /// `On Error GoTo 0` — disables error handling; operand `-2` (`0xFFFE`).
+    /// `On Error GoTo 0` - disables error handling; operand `-2` (`0xFFFE`).
     OnErrorGotoZero,
-    /// `Resume <label>` — resumes at the given P-Code offset.
+    /// `Resume <label>` - resumes at the given P-Code offset.
     ResumeLabel(u16),
-    /// `Resume Next` — resumes after the faulting statement; operand `-1` (`0xFFFF`).
+    /// `Resume Next` - resumes after the faulting statement; operand `-1` (`0xFFFF`).
     ResumeNext,
-    /// bare `Resume` — re-executes the faulting statement; operand `-2` (`0xFFFE`).
+    /// bare `Resume` - re-executes the faulting statement; operand `-2` (`0xFFFE`).
     Resume,
 }
 
@@ -235,7 +235,7 @@ impl<'a> InstructionIterator<'a> {
     /// bytes, so `proc_size` can include 1–3 trailing pad bytes after the final
     /// terminator. A partial "instruction" made entirely of those pad bytes
     /// (e.g. a lone `0x00`, which would otherwise look like a truncated
-    /// `LargeBos`) is not a decode error — it is the end of the real stream.
+    /// `LargeBos`) is not a decode error - it is the end of the real stream.
     fn tail_is_zero_padding(&self, start: usize) -> bool {
         self.bytes
             .get(start..self.limit)
@@ -253,7 +253,7 @@ impl Iterator for InstructionIterator<'_> {
 
         // VB6 pads each procedure's P-Code to a 4-byte boundary with zero
         // bytes. Once everything remaining is `0x00`, the real instruction
-        // stream is over — stop cleanly rather than decoding the padding (a
+        // stream is over - stop cleanly rather than decoding the padding (a
         // lone trailing `0x00` otherwise looks like a truncated `LargeBos`,
         // and an even pad like `00 00` like a spurious BOS marker). Real code
         // never reaches an all-zero tail: procedures end on a terminator, not
@@ -372,7 +372,7 @@ impl Iterator for InstructionIterator<'_> {
 
             // Ensure pos advances to the declared instruction size even when
             // the operand format is empty or incomplete. Many opcodes have
-            // size > 1 but no documented operand format specifiers — we still
+            // size > 1 but no documented operand format specifiers - we still
             // need to skip over their operand bytes to stay aligned.
             let lead_extra = opcode_bytes_consumed.saturating_sub(1);
             let expected_end = start
@@ -558,7 +558,7 @@ mod tests {
 
     #[test]
     fn test_trailing_double_zero_padding_no_spurious_bos() {
-        // ExitProc (0x14) then two 0x00 pad bytes — a clean `00 00` would decode
+        // ExitProc (0x14) then two 0x00 pad bytes - a clean `00 00` would decode
         // as a LargeBos; as trailing padding it must be dropped, leaving one insn.
         let insns = decode_all(&[0x14, 0x00, 0x00]);
         assert_eq!(insns.len(), 1);
@@ -640,7 +640,7 @@ mod tests {
 
     #[test]
     fn test_data_type_and_operand_type() {
-        // LitI4 — should report I4 as both instruction- and operand-type.
+        // LitI4 - should report I4 as both instruction- and operand-type.
         let insns = decode_all(&[0xF5, 0x78, 0x56, 0x34, 0x12]);
         let insn = &insns[0];
         assert_eq!(insn.data_type(), Some(PCodeDataType::I4));
@@ -650,7 +650,7 @@ mod tests {
         let insn = &insns[0];
         assert_eq!(insn.data_type(), Some(PCodeDataType::I2));
         assert_eq!(insn.operand_type(0), Some(PCodeDataType::I2));
-        // ExitProc — Return semantics, no data type.
+        // ExitProc - Return semantics, no data type.
         let insns = decode_all(&[0x14]);
         let insn = &insns[0];
         assert_eq!(insn.data_type(), None);
diff --git a/src/pcode/opcode.rs b/src/pcode/opcode.rs
index 7ba5706..fbc7f67 100644
--- a/src/pcode/opcode.rs
+++ b/src/pcode/opcode.rs
@@ -42,7 +42,7 @@ pub enum DispatchTable {
 /// traced from MSVBVM60.DLL handler disassembly.
 ///
 /// All semantic fields (`semantics`, `data_type`) are resolved at
-/// **build time** from the CSV data — no runtime string parsing.
+/// **build time** from the CSV data - no runtime string parsing.
 #[derive(Debug, Clone, Copy)]
 pub struct OpcodeInfo {
     /// Which dispatch table this opcode belongs to.
@@ -137,7 +137,7 @@ impl OpcodeInfo {
     ///
     /// Includes returns ([`OpcodeSemantics::Return`]) and unconditional
     /// branches ([`OpcodeSemantics::Branch`] with `conditional: false`).
-    /// Conditional branches **do not** terminate — control falls through
+    /// Conditional branches **do not** terminate - control falls through
     /// to the next instruction on the not-taken path.
     ///
     /// Useful for CFG construction and basic-block splitting.
@@ -162,7 +162,7 @@ impl OpcodeInfo {
 
     /// Returns `true` if this opcode is a beginning-of-statement marker.
     ///
-    /// Matches [`OpcodeSemantics::Bos`] — the `LargeBos` markers (primary
+    /// Matches [`OpcodeSemantics::Bos`] - the `LargeBos` markers (primary
     /// `0x00`/`0x02`, Lead1 `0xC4`, Lead4 `0x1C`) the compiler emits at the
     /// start of each source statement. Their 1-byte operand is the byte
     /// distance to the next BOS (`0` = last statement). Useful for grouping a
@@ -177,7 +177,7 @@ impl OpcodeInfo {
 /// somehow falls outside the 256-entry dispatch table.
 ///
 /// Statically the cast `u8 as usize` cannot exceed 255 and the tables are
-/// `[OpcodeInfo; 256]`, so this fallback is unreachable at runtime — it
+/// `[OpcodeInfo; 256]`, so this fallback is unreachable at runtime - it
 /// exists to satisfy `clippy::indexing_slicing` without resorting to
 /// unchecked indexing in the generated code.
 pub static UNKNOWN_OPCODE: OpcodeInfo = OpcodeInfo {
@@ -354,23 +354,23 @@ mod tests {
 
     #[test]
     fn test_is_terminator() {
-        // ExitProc (0x14) — Return semantics, terminates the block.
+        // ExitProc (0x14) - Return semantics, terminates the block.
         assert!(PRIMARY_TABLE[0x14].is_terminator());
-        // Branch (0x1E) — unconditional Branch{conditional:false}, terminates.
+        // Branch (0x1E) - unconditional Branch{conditional:false}, terminates.
         assert!(PRIMARY_TABLE[0x1E].is_terminator());
-        // BranchT (0x1C) — conditional, does NOT terminate (falls through).
+        // BranchT (0x1C) - conditional, does NOT terminate (falls through).
         assert!(!PRIMARY_TABLE[0x1C].is_terminator());
-        // BranchF (0x1D) — conditional, does NOT terminate.
+        // BranchF (0x1D) - conditional, does NOT terminate.
         assert!(!PRIMARY_TABLE[0x1D].is_terminator());
-        // AddI2 (0xA9) — arithmetic, not a terminator.
+        // AddI2 (0xA9) - arithmetic, not a terminator.
         assert!(!PRIMARY_TABLE[0xA9].is_terminator());
-        // FLdRfVar (0x04) — load, not a terminator.
+        // FLdRfVar (0x04) - load, not a terminator.
         assert!(!PRIMARY_TABLE[0x04].is_terminator());
     }
 
     #[test]
     fn test_is_call() {
-        // ImpAdCallI4 lives in Lead3 — find any Call-classified opcode.
+        // ImpAdCallI4 lives in Lead3 - find any Call-classified opcode.
         let any_primary_call = PRIMARY_TABLE.iter().any(|o| o.is_call());
         let any_lead3_call = LEAD3_TABLE.iter().any(|o| o.is_call());
         // At least one of the primary or Lead3 tables must contain calls.
diff --git a/src/pcode/semantics.rs b/src/pcode/semantics.rs
index 94af309..7e30604 100644
--- a/src/pcode/semantics.rs
+++ b/src/pcode/semantics.rs
@@ -2,7 +2,7 @@
 //!
 //! Provides typed enums for classifying every P-Code opcode by its
 //! data type and semantic operation. All classification is performed
-//! at **build time** by `build.rs` — the generated opcode tables contain
+//! at **build time** by `build.rs` - the generated opcode tables contain
 //! fully typed enum values with zero runtime string parsing.
 
 /// Data type operated on by a P-Code instruction.
diff --git a/src/project/methodentry.rs b/src/project/methodentry.rs
index 85d756a..920428d 100644
--- a/src/project/methodentry.rs
+++ b/src/project/methodentry.rs
@@ -98,7 +98,7 @@ impl<'a> MethodEntry<'a> {
         let maybe_proc_table = read_u32_le(stub_data, 0)?;
         let maybe_proc_size = read_u16_le(stub_data, 8)?;
         if map.is_va_in_image(maybe_proc_table) && maybe_proc_size > 0 && maybe_proc_size < 0x8000 {
-            // Looks like a valid ProcDscInfo — try to parse as P-Code
+            // Looks like a valid ProcDscInfo - try to parse as P-Code
             if let Ok(pcode) = PCodeMethod::parse(map, methods_va, index) {
                 return Ok(MethodEntry::PCode(pcode));
             }
diff --git a/src/project/methodlink.rs b/src/project/methodlink.rs
index f882193..5576afb 100644
--- a/src/project/methodlink.rs
+++ b/src/project/methodlink.rs
@@ -17,7 +17,7 @@
 //! ```
 //!
 //! The `this_adjust` values observed:
-//! - `0xFFFF`: placeholder — the method uses runtime vtable dispatch, not
+//! - `0xFFFF`: placeholder - the method uses runtime vtable dispatch, not
 //!   direct COM interface delegation. Common for standalone class modules.
 //! - Non-zero small values (e.g., `0x33`, `0x93`): real COM interface offset
 //!   adjustment. Matches the event sink thunk adjustments for the same object.
@@ -43,7 +43,7 @@ pub struct MethodLink {
     pub code_va: u32,
     /// COM `this` pointer adjustment from the SUB instruction.
     ///
-    /// - `Some(0xFFFF)`: placeholder — runtime vtable dispatch method.
+    /// - `Some(0xFFFF)`: placeholder - runtime vtable dispatch method.
     /// - `Some(n)`: real interface offset adjustment (n bytes subtracted from `this`).
     /// - `None`: no SUB instruction follows the JMP (direct call, no adjustment).
     pub this_adjust: Option<u32>,
@@ -127,7 +127,7 @@ impl<'a, 'p> Iterator for MethodLinkIterator<'a, 'p> {
                 .wrapping_add(5)
                 .wrapping_add(i64::from(rel32)) as u32
         } else {
-            // Not a JMP — the thunk VA IS the code VA
+            // Not a JMP - the thunk VA IS the code VA
             thunk_va
         };
 
diff --git a/src/project/pcodemethod.rs b/src/project/pcodemethod.rs
index d9eb4f1..e380399 100644
--- a/src/project/pcodemethod.rs
+++ b/src/project/pcodemethod.rs
@@ -103,7 +103,7 @@ impl<'a> PCodeMethod<'a> {
             method_va
         };
 
-        // Parse ProcDscInfo — read MIN_SIZE first to get total_size, then re-read full
+        // Parse ProcDscInfo - read MIN_SIZE first to get total_size, then re-read full
         let pdi_header = map.slice_from_va(proc_dsc_va, ProcDscInfo::MIN_SIZE)?;
         let pdi_tmp = ProcDscInfo::parse(pdi_header)?;
         let full_size = (pdi_tmp.total_size()? as usize).max(ProcDscInfo::MIN_SIZE);
@@ -194,7 +194,7 @@ impl<'a> PCodeMethod<'a> {
 
     /// VA of the call stub or direct ProcDscInfo pointer.
     ///
-    /// This is the raw VA from the method dispatch table entry — the
+    /// This is the raw VA from the method dispatch table entry - the
     /// native stub code (`mov edx, <RTMI>; call ProcCallEngine`) that
     /// launches the P-Code interpreter for this method.
     #[inline]
@@ -250,7 +250,7 @@ impl<'a> PCodeMethod<'a> {
     ///
     /// The cleanup table describes resource-release thunks (BSTR free,
     /// VARIANT free, object Release) that the runtime invokes on procedure
-    /// exit and on the error path. The table is **P-Code only** —
+    /// exit and on the error path. The table is **P-Code only** -
     /// native-compiled methods emit cleanup calls inline in their x86 code.
     ///
     /// This is a forwarder for [`ProcDscInfo::cleanup_entries`] kept on
diff --git a/src/project/vbcontrol.rs b/src/project/vbcontrol.rs
index f0086bd..07ea429 100644
--- a/src/project/vbcontrol.rs
+++ b/src/project/vbcontrol.rs
@@ -40,7 +40,7 @@ pub struct VbControl<'a> {
     /// Authoritative control type from form binary data (`cType` byte).
     ///
     /// When available, this is more reliable than GUID-based identification
-    /// (GUID fuzzy matching fails for malware samples — 8/12 controls
+    /// (GUID fuzzy matching fails for malware samples - 8/12 controls
     /// misidentified in the vb_inject sample).
     form_control_type: Option<FormControlType>,
 }
diff --git a/src/project/vbobject.rs b/src/project/vbobject.rs
index 3b455d9..a07b14a 100644
--- a/src/project/vbobject.rs
+++ b/src/project/vbobject.rs
@@ -175,7 +175,7 @@ impl<'a, 'p: 'a> VbObject<'a, 'p> {
         // OptionalObjectInfo (0x40 bytes) sits between ObjectInfo and the
         // constants table when there is room. For standard modules, the
         // constants table starts immediately after ObjectInfo (gap == 0)
-        // and no OptionalObjectInfo exists — regardless of the flag bit.
+        // and no OptionalObjectInfo exists - regardless of the flag bit.
         let optional_info = if descriptor.has_optional_info() {
             let opt_va = descriptor
                 .object_info_va()?
@@ -242,7 +242,7 @@ impl<'a, 'p: 'a> VbObject<'a, 'p> {
     ///
     /// Contains function type descriptors, parameter name tables, and
     /// public function/variable counts. Not available for standard modules
-    /// (BAS files) — those have `private_object_va == 0xFFFFFFFF`.
+    /// (BAS files) - those have `private_object_va == 0xFFFFFFFF`.
     #[inline]
     pub fn private_object(&self) -> Option<&PrivateObjectDescriptor<'a>> {
         self.private_object.as_ref()
@@ -300,7 +300,7 @@ impl<'a, 'p: 'a> VbObject<'a, 'p> {
 
     /// Reads the object name as raw bytes from the PE image.
     ///
-    /// Returns the slice exactly as stored — no decoding, no fallback.
+    /// Returns the slice exactly as stored - no decoding, no fallback.
     /// Prefer [`name`](Self::name) for display.
     ///
     /// # Errors
@@ -353,7 +353,7 @@ impl<'a, 'p: 'a> VbObject<'a, 'p> {
     /// Returns the number of methods in this object.
     ///
     /// Uses the larger of `ObjectInfo.method_count()` and
-    /// `PublicObjectDescriptor.method_count()` — they can differ in
+    /// `PublicObjectDescriptor.method_count()` - they can differ in
     /// native-compiled binaries where the ObjectInfo count may undercount.
     ///
     /// # Errors
@@ -435,7 +435,7 @@ impl<'a, 'p: 'a> VbObject<'a, 'p> {
     ///
     /// Like [`controls`](Self::controls), but each yielded control has its
     /// [`form_control_type`](crate::project::VbControl::form_control_type) populated from the
-    /// form binary data `cType` byte — the **authoritative** control type.
+    /// form binary data `cType` byte - the **authoritative** control type.
     ///
     /// Use this when form data is available (parsed from
     /// [`GuiTableEntry::form_data_va`](crate::vb::guitable::GuiTableEntry::form_data_va)).
@@ -489,23 +489,24 @@ impl<'a, 'p: 'a> VbObject<'a, 'p> {
 
     /// Returns `true` if this object has a real method dispatch table.
     ///
-    /// When `methods_va == constants_va`, the "method table" is actually
-    /// the constants/variable pool and should not be iterated as methods.
+    /// Answered by [`ObjectInfo::has_method_table`]: the table is trusted only
+    /// when it is not the constants pool and the object's own method count is
+    /// non-zero. [`method_count`](Self::method_count) takes the larger of that
+    /// count and the descriptor's, so without the gate a descriptor count would
+    /// be iterated over a pointer the object never initialized.
     ///
     /// # Errors
     ///
-    /// Returns an error if the methods or constants VA cannot be read.
+    /// Returns an error if the method count or either VA cannot be read.
     pub fn has_method_table(&self) -> Result<bool, Error> {
-        let m = self.info.methods_va()?;
-        let c = self.info.constants_va()?;
-        Ok(m != 0 && m != c)
+        self.info.has_method_table()
     }
 
     /// Returns an iterator over all method table entries, classified by type.
     ///
     /// Each entry is classified as [`MethodEntry::Null`], [`MethodEntry::PCode`],
     /// [`MethodEntry::Native`], or [`MethodEntry::Runtime`]. This is the full
-    /// view of the dispatch table — use [`pcode_methods`](Self::pcode_methods)
+    /// view of the dispatch table - use [`pcode_methods`](Self::pcode_methods)
     /// if you only want P-Code methods.
     ///
     /// Returns an empty iterator if the object has no method table (e.g.,
@@ -598,18 +599,18 @@ impl<'a, 'p: 'a> VbObject<'a, 'p> {
     /// Returns all code entry points in this object.
     ///
     /// Combines three sources into a single `Vec`:
-    /// 1. **Method table** — P-Code and native methods from the dispatch table
-    /// 2. **Method link thunks** — native code bodies discovered via JMP thunks
-    /// 3. **Event handlers** — connected event sink handler VAs from controls
+    /// 1. **Method table** - P-Code and native methods from the dispatch table
+    /// 2. **Method link thunks** - native code bodies discovered via JMP thunks
+    /// 3. **Event handlers** - connected event sink handler VAs from controls
     ///
     /// Each entry includes a code VA and a human-readable label. Null entries
     /// and runtime VAs (pointing into MSVBVM60.DLL) are excluded.
     /// # Name Resolution
     ///
     /// Names are resolved using a three-tier fallback:
-    /// 1. Method name table (`method_name()`) — from PublicObjectDescriptor
-    /// 2. FuncTypDesc signature — from PrivateObjectDescriptor's type info
-    /// 3. Positional fallback — `method_NN` for methods, `Control_EventName` for events
+    /// 1. Method name table (`method_name()`) - from PublicObjectDescriptor
+    /// 2. FuncTypDesc signature - from PrivateObjectDescriptor's type info
+    /// 3. Positional fallback - `method_NN` for methods, `Control_EventName` for events
     ///
     /// When `form_data` is provided, event handler names use the exact
     /// `FormControlType` from the form binary (e.g., `Timer1_Timer` instead
@@ -631,10 +632,26 @@ impl<'a, 'p: 'a> VbObject<'a, 'p> {
         let ftd_map = self.build_func_type_desc_map()?;
 
         // 1. Method table entries
+        //    One unreadable slot is dropped on its own; it says nothing about the
+        //    slots beside it.
         if self.has_method_table()? {
             for (i, result) in self.methods()?.enumerate() {
-                match result? {
+                let entry = match result {
+                    Ok(entry) => entry,
+                    Err(e) => {
+                        crate::trace::warn_drop!("code_entries.methods", error = ?e);
+                        continue;
+                    }
+                };
+                match entry {
                     MethodEntry::PCode(pm) => {
+                        let pcode_size = match pm.proc_size() {
+                            Ok(size) => size,
+                            Err(e) => {
+                                crate::trace::warn_drop!("code_entries.proc_size", error = ?e);
+                                continue;
+                            }
+                        };
                         let name = self.resolve_method_name(i, &ftd_map);
                         entries.push(CodeEntry {
                             va: pm.pcode_va(),
@@ -643,7 +660,7 @@ impl<'a, 'p: 'a> VbObject<'a, 'p> {
                             name,
                             data_const_va: Some(pm.data_const_va()),
                             stub_va: Some(pm.stub_va()),
-                            pcode_size: Some(pm.proc_size()?),
+                            pcode_size: Some(pcode_size),
                         });
                     }
                     MethodEntry::Native { va } => {
@@ -767,7 +784,7 @@ impl<'a, 'p: 'a> VbObject<'a, 'p> {
         for &(fi, ref ftd) in ftd_map {
             if fi == index {
                 let name = format_signature(ftd, "", self.project.address_map());
-                // format_signature returns " ()" for empty name — strip prefix space
+                // format_signature returns " ()" for empty name - strip prefix space
                 let trimmed = name.trim();
                 if !trimmed.is_empty() && trimmed != "()" {
                     return Some(trimmed.to_string());
@@ -865,8 +882,8 @@ impl<'a, 'p: 'a> VbObject<'a, 'p> {
     /// Returns every event-handler slot on this object, including
     /// disconnected ones (`handler_va == 0`).
     ///
-    /// Like [`events`](Self::events) but does not filter out empty slots
-    /// — useful for completeness checks ("how many of this control's
+    /// Like [`events`](Self::events) but does not filter out empty slots -
+    /// useful for completeness checks ("how many of this control's
     /// 24 events are wired up?") or for surfacing the full slot
     /// template per control type.
     ///
@@ -1167,7 +1184,7 @@ pub enum CodeEntryKind {
 /// [`EventSinkVtable`](crate::vb::events::EventSinkVtable) header, and the
 /// [`eventname`](crate::vb::eventname) lookup tables.
 ///
-/// Only **connected** handlers are yielded — slots whose
+/// Only **connected** handlers are yielded - slots whose
 /// `event_handler_va == 0` (event not wired up by the user) are filtered
 /// out. Use [`VbObject::events_all_slots`] for the full per-slot view
 /// including disconnected events.
@@ -1184,7 +1201,7 @@ pub struct EventBinding<'a> {
     ///
     /// Resolution prefers form binary data (`cType` byte) over GUID
     /// fuzzy matching (which is unreliable for malware samples).
-    /// `None` when neither source resolves the type — in that case
+    /// `None` when neither source resolves the type - in that case
     /// [`event_name`](Self::event_name) falls back to the standard
     /// 24-event template.
     pub control_type: Option<FormControlType>,
diff --git a/src/project/vbproject.rs b/src/project/vbproject.rs
index 4887852..887b3fc 100644
--- a/src/project/vbproject.rs
+++ b/src/project/vbproject.rs
@@ -77,7 +77,7 @@ pub struct CodeEntrypoint<'a> {
     /// What kind of entry this is.
     pub kind: EntrypointKind,
     /// Human-readable label (method name, `"ControlName_EventName"`, or
-    /// `"Sub Main"`). Empty when no name could be resolved — the kind
+    /// `"Sub Main"`). Empty when no name could be resolved - the kind
     /// and `object_index` / `method_index` are still authoritative.
     pub name_hint: Cow<'a, str>,
     /// Index of the owning object (form/class/module) in the object
@@ -109,16 +109,16 @@ pub struct CodeEntrypoint<'a> {
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
 #[non_exhaustive]
 pub enum DiagnosticSeverity {
-    /// Routine/expected condition — surfaced for completeness, not a problem.
+    /// Routine/expected condition - surfaced for completeness, not a problem.
     /// Example: a standard `.bas` module legitimately has no
     /// `OptionalObjectInfo`; reporting that absence is informational.
     Info,
     /// Anomaly worth attention but recoverable. Example:
-    /// `methods_va == constants_va` — the method table overlaps the
+    /// `methods_va == constants_va` - the method table overlaps the
     /// constants pool, so method iteration will yield nothing useful, but
     /// the rest of the object can still be inspected.
     Warning,
-    /// Structural error — the affected substructure was unparseable and
+    /// Structural error - the affected substructure was unparseable and
     /// a downstream walker dropped it. Example: a control-table parse
     /// failure that stops the controls iterator early.
     Error,
@@ -172,7 +172,7 @@ pub enum CompilationMode {
     Pcode,
     /// Project flag indicates native AND no object holds P-Code methods.
     Native,
-    /// The project flag and per-object scan disagree — e.g. a P-Code
+    /// The project flag and per-object scan disagree - e.g. a P-Code
     /// project with native-compiled classes, or a native project where
     /// individual objects still carry P-Code dispatch entries. Treat
     /// each object's [`has_pcode`](crate::project::VbObject::has_pcode)
@@ -237,11 +237,11 @@ impl<'a> VbProject<'a> {
     /// Returns an [`Error`] whose [`recognition_failure`](Error::recognition_failure)
     /// classifies the failure mode:
     ///
-    /// - [`RecognitionFailure::UnrecognizedFormat`](crate::error::RecognitionFailure::UnrecognizedFormat) —
+    /// - [`RecognitionFailure::UnrecognizedFormat`](crate::error::RecognitionFailure::UnrecognizedFormat) -
     ///   not a valid PE32 container at all (or PE32+ which VB6 doesn't use).
-    /// - [`RecognitionFailure::NotRecognized`](crate::error::RecognitionFailure::NotRecognized) —
+    /// - [`RecognitionFailure::NotRecognized`](crate::error::RecognitionFailure::NotRecognized) -
     ///   PE walked OK but no VB6 marker (entry point or DLL-export pattern).
-    /// - [`RecognitionFailure::TruncatedContainer`](crate::error::RecognitionFailure::TruncatedContainer) —
+    /// - [`RecognitionFailure::TruncatedContainer`](crate::error::RecognitionFailure::TruncatedContainer) -
     ///   recognized as VB6 but a header/structure read overran the buffer.
     ///
     /// Consumers tagging files as "VB6 or not" should match on
@@ -420,7 +420,7 @@ impl<'a> VbProject<'a> {
     /// metadata structures are still accessible.
     ///
     /// Note: this reflects only the project-level `lpNativeCode` field. Some
-    /// VB6 binaries are **mixed** — the project-level flag says "native" but
+    /// VB6 binaries are **mixed** - the project-level flag says "native" but
     /// individual classes/forms still hold P-Code methods (or vice versa).
     /// Use [`compilation_mode`](Self::compilation_mode) for the
     /// per-object-aware classification.
@@ -436,16 +436,16 @@ impl<'a> VbProject<'a> {
     /// Classifies the binary's compilation mode by combining the project-level
     /// `lpNativeCode` flag with a per-object scan for P-Code methods.
     ///
-    /// - [`CompilationMode::Pcode`] — project flag says P-Code AND every
+    /// - [`CompilationMode::Pcode`] - project flag says P-Code AND every
     ///   object that has methods has P-Code methods (no native objects).
-    /// - [`CompilationMode::Native`] — project flag says native AND no
+    /// - [`CompilationMode::Native`] - project flag says native AND no
     ///   object holds P-Code methods.
-    /// - [`CompilationMode::Mixed`] — the two signals disagree, e.g. a
+    /// - [`CompilationMode::Mixed`] - the two signals disagree, e.g. a
     ///   P-Code project with some native-compiled classes, or a native
     ///   project where some objects still carry P-Code dispatch entries.
     ///
     /// This is the signal to use when deciding whether to expect P-Code in
-    /// a given object — `is_pcode()` alone misclassifies mixed-mode binaries.
+    /// a given object - `is_pcode()` alone misclassifies mixed-mode binaries.
     ///
     /// # Errors
     ///
@@ -579,7 +579,7 @@ impl<'a> VbProject<'a> {
     ///
     /// Walks the optional substructures and reports which were absent,
     /// which were present but anomalous, and which failed to parse.
-    /// Intended as a "parse health" probe for analyst UIs — a
+    /// Intended as a "parse health" probe for analyst UIs - a
     /// zero-element vec means everything the crate looked at is in
     /// expected shape.
     ///
@@ -590,7 +590,7 @@ impl<'a> VbProject<'a> {
     ///    `PrivateObjectDescriptor` (expected for modules), method-table
     ///    overlap (`methods_va == constants_va`).
     ///
-    /// This is a **best-effort** snapshot — it deliberately does not
+    /// This is a **best-effort** snapshot - it deliberately does not
     /// surface every possible quirk. New findings may be added in
     /// future versions; consumers should match on
     /// [`DiagnosticKind`] / [`DiagnosticSeverity`] using non-exhaustive
@@ -638,7 +638,7 @@ impl<'a> VbProject<'a> {
                 object_index: None,
                 site: "compilation_mode",
                 message: Cow::Borrowed(
-                    "project flag and per-object scan disagree — treat each object's has_pcode() as authoritative",
+                    "project flag and per-object scan disagree - treat each object's has_pcode() as authoritative",
                 ),
             });
         }
@@ -657,7 +657,7 @@ impl<'a> VbProject<'a> {
                     object_index,
                     site: "OptionalObjectInfo",
                     message: Cow::Borrowed(
-                        "OptionalObjectInfo missing for non-module object — controls/event sinks unavailable",
+                        "OptionalObjectInfo missing for non-module object - controls/event sinks unavailable",
                     ),
                 });
             }
@@ -670,7 +670,7 @@ impl<'a> VbProject<'a> {
                     object_index,
                     site: "PrivateObjectDescriptor",
                     message: Cow::Borrowed(
-                        "PrivateObjectDescriptor missing for class object — function type descriptors unavailable",
+                        "PrivateObjectDescriptor missing for class object - function type descriptors unavailable",
                     ),
                 });
             }
@@ -687,7 +687,17 @@ impl<'a> VbProject<'a> {
                         object_index,
                         site: "method_table",
                         message: Cow::Borrowed(
-                            "methods_va == constants_va — no method dispatch table for this object",
+                            "methods_va == constants_va - no method dispatch table for this object",
+                        ),
+                    });
+                } else if methods_va != 0 && info.method_count()? == 0 {
+                    out.push(ParseDiagnostic {
+                        kind: DiagnosticKind::Quirk,
+                        severity: DiagnosticSeverity::Info,
+                        object_index,
+                        site: "method_table",
+                        message: Cow::Borrowed(
+                            "method_count == 0 - methods_va is uninitialized, not a dispatch table",
                         ),
                     });
                 }
@@ -701,12 +711,12 @@ impl<'a> VbProject<'a> {
     ///
     /// Aggregates four sources into a single tagged stream:
     ///
-    /// 1. **Per-object method dispatch** — P-Code stubs and native methods
+    /// 1. **Per-object method dispatch** - P-Code stubs and native methods
     ///    from each object's [`code_entries`](crate::project::VbObject::code_entries).
-    /// 2. **Native method-link thunks** — JMP thunks that bridge COM vtable
+    /// 2. **Native method-link thunks** - JMP thunks that bridge COM vtable
     ///    dispatch to native code bodies (also via `code_entries`).
-    /// 3. **Event handlers** — connected control event handler VAs.
-    /// 4. **`Sub Main`** — the project-level entry procedure from
+    /// 3. **Event handlers** - connected control event handler VAs.
+    /// 4. **`Sub Main`** - the project-level entry procedure from
     ///    [`VbHeader::sub_main_va`], when non-zero.
     ///
     /// Each entry carries a tagged [`EntrypointKind`] so consumers can
@@ -733,10 +743,25 @@ impl<'a> VbProject<'a> {
         let mut out: Vec<CodeEntrypoint<'a>> = Vec::new();
 
         // 1-3. Per-object dispatch + thunks + events.
+        //    An object that does not read is dropped on its own: the entry points
+        //    of every other object are still real.
         for (obj_index, obj_result) in self.objects()?.enumerate() {
-            let obj = obj_result?;
+            let obj = match obj_result {
+                Ok(obj) => obj,
+                Err(e) => {
+                    crate::trace::warn_drop!("code_entrypoints.objects", error = ?e);
+                    continue;
+                }
+            };
             let object_index = u16::try_from(obj_index).ok();
-            for entry in obj.code_entries(None)? {
+            let entries = match obj.code_entries(None) {
+                Ok(entries) => entries,
+                Err(e) => {
+                    crate::trace::warn_drop!("code_entrypoints.code_entries", error = ?e);
+                    continue;
+                }
+            };
+            for entry in entries {
                 out.push(CodeEntrypoint {
                     va: entry.va,
                     kind: EntrypointKind::from(entry.kind),
@@ -752,7 +777,7 @@ impl<'a> VbProject<'a> {
         }
 
         // 4. Sub Main. `lpSubMain` (VbHeader +0x2C) is the *callable* address
-        //    the runtime invokes — for a P-Code module that is the dispatch
+        //    the runtime invokes - for a P-Code module that is the dispatch
         //    stub VA, for a native module the procedure VA. Both were already
         //    collected as per-object entries above, so resolve the target by
         //    matching that address rather than re-implementing stub detection:
@@ -801,7 +826,7 @@ impl<'a> VbProject<'a> {
     /// The pair's [`form_data`](GuiEntryWithFormData::form_data) is `None`
     /// when the entry has no form data (`form_data_va == 0` or `size == 0`)
     /// and `Some(parser)` when the form binary parses successfully.
-    /// Parse errors silently degrade to `None` — use
+    /// Parse errors silently degrade to `None` - use
     /// [`form_data_from_gui_entry`](crate::project::VbObject::form_data_from_gui_entry)
     /// directly if you need the parse error.
     ///
diff --git a/src/trace.rs b/src/trace.rs
index 8e5369c..7c3965f 100644
--- a/src/trace.rs
+++ b/src/trace.rs
@@ -3,8 +3,8 @@
 //! Several iterator and resolver paths in this crate **silently** drop
 //! malformed entries (`filter_map(|r| r.ok())`, `.ok()?` chains, etc.)
 //! rather than abort whole-structure parses. That fail-soft behavior is
-//! correct for adversarial malware analysis — one bad row should not
-//! poison the whole table — but it makes diagnosis difficult: you see
+//! correct for adversarial malware analysis - one bad row should not
+//! poison the whole table - but it makes diagnosis difficult: you see
 //! "23 entries parsed" without knowing whether 5 more were dropped.
 //!
 //! When the `tracing` feature is enabled, the macros in this module
@@ -31,7 +31,7 @@
 /// the dropped error / value formatted with `Debug`, recorded as a
 /// structured field when `tracing` is enabled.
 ///
-/// Expands to a no-op when the `tracing` feature is disabled — but still
+/// Expands to a no-op when the `tracing` feature is disabled - but still
 /// references the payload so `unused_variables` does not fire on the
 /// caller's `e` binding.
 #[macro_export]
diff --git a/src/util.rs b/src/util.rs
index 872c9be..22878f2 100644
--- a/src/util.rs
+++ b/src/util.rs
@@ -6,7 +6,7 @@
 //!
 //! Internally the helpers use [`slice::get`] and
 //! [`<[u8; N]>::try_from`](TryFrom) to convert validated slices into
-//! fixed-size arrays for [`u16::from_le_bytes`] / [`u32::from_le_bytes`] —
+//! fixed-size arrays for [`u16::from_le_bytes`] / [`u32::from_le_bytes`] -
 //! no panicking indexing or unchecked arithmetic.
 
 use crate::error::Error;
diff --git a/src/vb/bstr.rs b/src/vb/bstr.rs
index a1ddd4f..961ed03 100644
--- a/src/vb/bstr.rs
+++ b/src/vb/bstr.rs
@@ -132,9 +132,10 @@ impl<'a> BStr<'a> {
         }
         let u16s: Vec<u16> = self
             .data
-            .chunks_exact(2)
-            .filter_map(|pair| <[u8; 2]>::try_from(pair).ok())
-            .map(u16::from_le_bytes)
+            .as_chunks::<2>()
+            .0
+            .iter()
+            .map(|&pair| u16::from_le_bytes(pair))
             .collect();
         String::from_utf16_lossy(&u16s)
     }
diff --git a/src/vb/comreg.rs b/src/vb/comreg.rs
index 04ab714..0bda482 100644
--- a/src/vb/comreg.rs
+++ b/src/vb/comreg.rs
@@ -5,7 +5,7 @@
 //! list of per-object COM registration records with CLSIDs, ProgIDs,
 //! interface GUIDs, and registry metadata.
 //!
-//! All offsets within this structure are **self-relative** — add the
+//! All offsets within this structure are **self-relative** - add the
 //! offset value to the structure's base VA to resolve.
 //!
 //! # Layout verified against
@@ -294,7 +294,7 @@ impl<'a> ComRegData<'a> {
 /// | 0x2C | 4 | `bSourceIfaceGuids` (self-relative offset to event interface GUID array) |
 /// | 0x30 | 4 | `dwSourceIfaceCount` (number of event interface GUIDs) |
 /// | 0x34 | 4 | `dwMiscStatus` (OLE MiscStatus value for DVASPECT\_CONTENT) |
-/// | 0x38 | 2 | `wObjectFlags` (registration flags — see [`ComRegObject::object_flags`]) |
+/// | 0x38 | 2 | `wObjectFlags` (registration flags - see [`ComRegObject::object_flags`]) |
 /// | 0x3A | 2 | `wToolboxBitmap32` (resource ID for ToolboxBitmap32) |
 /// | 0x3C | 2 | `wDefaultIcon` (resource ID for DefaultIcon) |
 /// | 0x3E | 2 | `wExtendedFlags` (bit 0 = has designer data at +0x40) |
@@ -449,12 +449,12 @@ impl<'a> ComRegObject<'a> {
     /// | 0 | `0x0001` | Skip registration (return immediately) |
     /// | 1 | `0x0002` | Register `IPersistPropertyBag` CATID |
     /// | 2 | `0x0004` | Register safe-for-scripting CATID |
-    /// | 5 | `0x0020` | Control — `Control` subkey, `ToolboxBitmap32` |
-    /// | 7 | `0x0080` | DocObject — `DocObject`, `DefaultIcon`, `InprocHandler32`, `BrowserFlags`, `EditFlags` |
+    /// | 5 | `0x0020` | Control - `Control` subkey, `ToolboxBitmap32` |
+    /// | 7 | `0x0080` | DocObject - `DocObject`, `DefaultIcon`, `InprocHandler32`, `BrowserFlags`, `EditFlags` |
     ///
     /// Composite masks used by the runtime:
-    /// - `0x00B2` (bits 1,4,5,7): Automatable — `ProgID`, `TypeLib`, `VERSION`, interface registration
-    /// - `0x00A0` (bits 5,7): Control or DocObject — `MiscStatus`, `MiscStatus\1`
+    /// - `0x00B2` (bits 1,4,5,7): Automatable - `ProgID`, `TypeLib`, `VERSION`, interface registration
+    /// - `0x00A0` (bits 5,7): Control or DocObject - `MiscStatus`, `MiscStatus\1`
     #[inline]
     pub fn object_flags(&self) -> Result<u16, Error> {
         read_u16_le(self.bytes, 0x38)
diff --git a/src/vb/constantpool.rs b/src/vb/constantpool.rs
index 129ee09..a7d4f2f 100644
--- a/src/vb/constantpool.rs
+++ b/src/vb/constantpool.rs
@@ -139,7 +139,7 @@ impl<'a> ConstantPool<'a> {
     ///
     /// Returns `Ok(Some(bstr))` for valid string entries, `Ok(None)` for
     /// null entries (`pool[index] == 0`) and entries that don't look like
-    /// BSTRs (likely API stubs, GUIDs, or code refs — try
+    /// BSTRs (likely API stubs, GUIDs, or code refs - try
     /// [`api_stub_at`](Self::api_stub_at) for those). Returns `Err` only
     /// when address translation fails.
     ///
@@ -234,7 +234,7 @@ impl<'a> ConstantPool<'a> {
 
     /// Reserved signature for the future type-hint-enriched entry iterator.
     ///
-    /// Today this is a thin alias for [`entries`](Self::entries) — it yields
+    /// Today this is a thin alias for [`entries`](Self::entries) - it yields
     /// the same `ConstPoolEntry` items. The reserved name lets downstream
     /// code reference the "rich" iterator now without breakage when the
     /// hint-enriched implementation lands (planned: per-entry classification
diff --git a/src/vb/control.rs b/src/vb/control.rs
index 10ce4c1..2e5a9db 100644
--- a/src/vb/control.rs
+++ b/src/vb/control.rs
@@ -15,7 +15,7 @@ use crate::{
     util::{read_u16_le, read_u32_le},
 };
 
-/// A COM GUID (CLSID/IID) as stored in PE data — 16 bytes, little-endian.
+/// A COM GUID (CLSID/IID) as stored in PE data - 16 bytes, little-endian.
 #[derive(Clone, Copy, PartialEq, Eq)]
 pub struct Guid {
     /// Raw 16-byte GUID in binary form.
@@ -33,7 +33,7 @@ impl Guid {
 
     /// Returns a human-readable name if this is a well-known VB6 intrinsic control.
     ///
-    /// Uses **exact CLSID matching** only — no fuzzy/IID variant guessing.
+    /// Uses **exact CLSID matching** only - no fuzzy/IID variant guessing.
     /// The lookup table is generated at build time from `data/vb6_control_guids.csv`.
     ///
     /// For reliable control type identification, prefer
@@ -134,7 +134,7 @@ pub(crate) mod generated {
 ///
 /// The VA at +0x1C points to per-control-type data in the linker's workspace
 /// address space (typically 0x0073xxxx). Controls with the same CLSID share
-/// the same +0x1C value. This pointer is NOT patched to a valid PE VA — it's
+/// the same +0x1C value. This pointer is NOT patched to a valid PE VA - it's
 /// a vestigial linker artifact. In memory dumps it may be overwritten.
 ///
 /// # Name Resolution
@@ -222,7 +222,7 @@ impl<'a> ControlInfo<'a> {
 
     /// COM dispatch member type at offset 0x0E (`DESCKIND`).
     ///
-    /// Always 3 (`DESCKIND_TYPECOMP`) for normal controls — controls are type
+    /// Always 3 (`DESCKIND_TYPECOMP`) for normal controls - controls are type
     /// components in the COM IDispatch namespace. 0xFFFF for the form's default
     /// control (the implicit control with `index == 0xFFFF`). Used as the high
     /// word of the packed [`control_id`](Self::control_id) at +0x24 for hash
diff --git a/src/vb/controlprop.rs b/src/vb/controlprop.rs
index 1b520c9..488fb83 100644
--- a/src/vb/controlprop.rs
+++ b/src/vb/controlprop.rs
@@ -16,7 +16,7 @@
 //!   fixed-length string (nibble 4) it calls `SysAllocStringLen` with the char
 //!   count at entry+0x08; for an array (nibble 5) it builds the SafeArray.
 //! - `CleanupSingleEntry` (0x66016AAA) is the **destruct** side and is the
-//!   authoritative source of each member's resource type — it dispatches on the
+//!   authoritative source of each member's resource type - it dispatches on the
 //!   low nibble of the type byte to `SysFreeString` / `__vbaFreeVar` /
 //!   `IUnknown::Release` / `SafeArray*` / `__vbaRecDestructAnsi`.
 //! - `CalcPropertyDataSize` (0x660169D3) computes the entry stride; the MLIL of
@@ -31,9 +31,9 @@
 //!
 //! | Offset | Size | Field |
 //! |--------|------|-------|
-//! | 0x00 | 2 | `wFrameOffset` — target byte offset within instance data |
-//! | 0x02 | 1 | `bType` — bits \[3:0\] = [`ControlPropertyType`] nibble, bits \[7:4\] = modifiers |
-//! | 0x03 | 1 | `bFlags` — modifier flags (bit 2 = 6-byte floor, bit 5 = widen to 8) |
+//! | 0x00 | 2 | `wFrameOffset` - target byte offset within instance data |
+//! | 0x02 | 1 | `bType` - bits \[3:0\] = [`ControlPropertyType`] nibble, bits \[7:4\] = modifiers |
+//! | 0x03 | 1 | `bFlags` - modifier flags (bit 2 = 6-byte floor, bit 5 = widen to 8) |
 //! | 0x04 | var | Type-dependent data (e.g. +0x08 = string char count / array element info) |
 
 use std::fmt;
@@ -44,12 +44,12 @@ use crate::{error::Error, util::read_u16_le};
 ///
 /// Recovered from `CleanupSingleEntry` (0x66016AAA): the runtime walks the same
 /// entry array on object teardown and dispatches on the type nibble. This is
-/// the forensically meaningful classification — it states exactly which members
+/// the forensically meaningful classification - it states exactly which members
 /// hold heap resources (BSTRs, objects, arrays, records) versus plain inline
 /// values.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum CleanupAction {
-    /// Inline value member — no heap resource, nothing to release.
+    /// Inline value member - no heap resource, nothing to release.
     None,
     /// BSTR freed via `SysFreeString` (nibbles 1 and 4).
     FreeString,
@@ -91,20 +91,20 @@ impl fmt::Display for CleanupAction {
 /// raw nibble preserved.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum ControlPropertyType {
-    /// Nibble 1 — dynamic `String` (BSTR). Zero-initialized, freed on destruct.
+    /// Nibble 1 - dynamic `String` (BSTR). Zero-initialized, freed on destruct.
     String,
-    /// Nibble 2 — `Variant`. Cleared via `__vbaFreeVar` on destruct.
+    /// Nibble 2 - `Variant`. Cleared via `__vbaFreeVar` on destruct.
     Variant,
-    /// Nibble 3 — object reference (`Object` / typed class). Released on destruct.
+    /// Nibble 3 - object reference (`Object` / typed class). Released on destruct.
     Object,
-    /// Nibble 4 — fixed-length `String`. Allocated to a fixed char count
+    /// Nibble 4 - fixed-length `String`. Allocated to a fixed char count
     /// (`SysAllocStringLen`, length at entry+0x08) at init, freed on destruct.
     FixedString,
-    /// Nibble 5 — dynamic array (`SafeArray`). Built at init, destroyed on destruct.
+    /// Nibble 5 - dynamic array (`SafeArray`). Built at init, destroyed on destruct.
     Array,
-    /// Nibble 6 — fixed/locked array. Released via `SafeArrayUnlock` on destruct.
+    /// Nibble 6 - fixed/locked array. Released via `SafeArrayUnlock` on destruct.
     FixedArray,
-    /// Nibble 9 — user-defined type (record). Destructed recursively on teardown.
+    /// Nibble 9 - user-defined type (record). Destructed recursively on teardown.
     Udt,
     /// Inline value member with no heap resource (nibbles 0, 7, 8, 0xA, 0xB, 0xC).
     ///
@@ -297,7 +297,7 @@ impl<'a> ControlPropertyEntry<'a> {
                 context: "calc_safearray_total_size desc_offset+3",
             })?;
         if self.bytes.len() < needed {
-            // Not enough data — use a safe minimum.
+            // Not enough data - use a safe minimum.
             return Ok(0x28);
         }
         let dim_count = read_u16_le(self.bytes, desc_offset)? as usize;
diff --git a/src/vb/events.rs b/src/vb/events.rs
index a7d6ed4..2ec6603 100644
--- a/src/vb/events.rs
+++ b/src/vb/events.rs
@@ -26,7 +26,7 @@ use crate::{addressmap::AddressMap, error::Error, util::read_u32_le};
 /// event dispatch ID before falling through to the P-Code engine. The method
 /// dispatch table points to +0x07, where `eax` is cleared (direct call, no
 /// event). The `66 3D` at +0x05 is a `cmp ax, imm16` that harmlessly overlaps
-/// with the `xor eax, eax` bytes — a VB6 compiler space optimization.
+/// with the `xor eax, eax` bytes - a VB6 compiler space optimization.
 #[derive(Clone, Copy, Debug)]
 pub struct EventHandlerThunk {
     /// Event dispatch ID passed in eax (from `mov eax, imm32` at +0x00).
@@ -208,9 +208,9 @@ impl fmt::Display for IUnknownThunk {
 /// | 0x00 | Reserved (always 0) |
 /// | 0x04 | Back-pointer to this control's [`ControlInfo`](crate::vb::control::ControlInfo) entry |
 /// | 0x08 | Back-pointer to parent [`ObjectInfo`](crate::vb::object::ObjectInfo) |
-/// | 0x0C | `EVENT_SINK_QueryInterface` thunk VA — `jmp [IAT]` to MSVBVM60 |
-/// | 0x10 | `EVENT_SINK_AddRef` thunk VA — `jmp [IAT]` to MSVBVM60 |
-/// | 0x14 | `EVENT_SINK_Release` thunk VA — `jmp [IAT]` to MSVBVM60 |
+/// | 0x0C | `EVENT_SINK_QueryInterface` thunk VA - `jmp [IAT]` to MSVBVM60 |
+/// | 0x10 | `EVENT_SINK_AddRef` thunk VA - `jmp [IAT]` to MSVBVM60 |
+/// | 0x14 | `EVENT_SINK_Release` thunk VA - `jmp [IAT]` to MSVBVM60 |
 /// | 0x18+ | Event handler VAs (0 = not connected) |
 ///
 /// The IUnknown thunks at +0x0C-0x14 are 6-byte `FF 25 imm32` indirect jumps
diff --git a/src/vb/exports.rs b/src/vb/exports.rs
index f57c8d4..340daf1 100644
--- a/src/vb/exports.rs
+++ b/src/vb/exports.rs
@@ -21,64 +21,64 @@ pub enum CallingConv {
     /// `__cdecl`: all args on stack; caller cleans stack.
     Cdecl,
     /// Special: x87 FPU intrinsic, FDIV workaround, or custom register convention.
-    /// No standard parameter passing — skip during prototype application.
+    /// No standard parameter passing - skip during prototype application.
     Special,
 }
 
 /// Parameter or return type for an MSVBVM60 export.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum VbParamType {
-    /// `void` — no value.
+    /// `void` - no value.
     Void,
-    /// `int16_t` — 16-bit signed integer (VB6 `Integer`).
+    /// `int16_t` - 16-bit signed integer (VB6 `Integer`).
     Int16,
-    /// `uint16_t` — 16-bit unsigned integer.
+    /// `uint16_t` - 16-bit unsigned integer.
     UInt16,
-    /// `int32_t` — 32-bit signed integer (VB6 `Long`).
+    /// `int32_t` - 32-bit signed integer (VB6 `Long`).
     Int32,
-    /// `uint32_t` — 32-bit unsigned integer.
+    /// `uint32_t` - 32-bit unsigned integer.
     UInt32,
-    /// `int64_t` — 64-bit signed integer (VB6 `Currency` raw).
+    /// `int64_t` - 64-bit signed integer (VB6 `Currency` raw).
     Int64,
-    /// `uint8_t` — 8-bit unsigned (VB6 `Byte`).
+    /// `uint8_t` - 8-bit unsigned (VB6 `Byte`).
     UInt8,
-    /// `float` — 32-bit IEEE 754 (VB6 `Single`).
+    /// `float` - 32-bit IEEE 754 (VB6 `Single`).
     Float,
-    /// `double` — 64-bit IEEE 754 (VB6 `Double`).
+    /// `double` - 64-bit IEEE 754 (VB6 `Double`).
     Double,
-    /// `BOOL` — Win32 boolean (32-bit).
+    /// `BOOL` - Win32 boolean (32-bit).
     Bool,
-    /// `BSTR` — pointer to `SysAllocString`'d wide string.
+    /// `BSTR` - pointer to `SysAllocString`'d wide string.
     Bstr,
-    /// `BSTR*` — pointer to BSTR location.
+    /// `BSTR*` - pointer to BSTR location.
     BstrPtr,
-    /// `VARIANT*` — pointer to 16-byte COM VARIANT.
+    /// `VARIANT*` - pointer to 16-byte COM VARIANT.
     VariantPtr,
-    /// `SAFEARRAY*` — pointer to COM safe array.
+    /// `SAFEARRAY*` - pointer to COM safe array.
     SafeArrayPtr,
-    /// `SAFEARRAY**` — pointer to SAFEARRAY pointer.
+    /// `SAFEARRAY**` - pointer to SAFEARRAY pointer.
     SafeArrayPtrPtr,
-    /// `IUnknown*` — COM interface pointer.
+    /// `IUnknown*` - COM interface pointer.
     IUnknownPtr,
-    /// `IUnknown**` — pointer to COM interface pointer.
+    /// `IUnknown**` - pointer to COM interface pointer.
     IUnknownPtrPtr,
-    /// `IDispatch*` — COM dispatch interface pointer.
+    /// `IDispatch*` - COM dispatch interface pointer.
     IDispatchPtr,
-    /// `IDispatch**` — pointer to COM dispatch pointer.
+    /// `IDispatch**` - pointer to COM dispatch pointer.
     IDispatchPtrPtr,
-    /// `HRESULT` — 32-bit COM result code.
+    /// `HRESULT` - 32-bit COM result code.
     Hresult,
-    /// `GUID*` — pointer to 16-byte COM GUID.
+    /// `GUID*` - pointer to 16-byte COM GUID.
     GuidPtr,
-    /// `void*` — opaque pointer.
+    /// `void*` - opaque pointer.
     VoidPtr,
-    /// `int32_t*` — pointer to 32-bit integer.
+    /// `int32_t*` - pointer to 32-bit integer.
     Int32Ptr,
-    /// `int16_t*` — pointer to 16-bit integer.
+    /// `int16_t*` - pointer to 16-bit integer.
     Int16Ptr,
-    /// `uint8_t*` — pointer to byte.
+    /// `uint8_t*` - pointer to byte.
     UInt8Ptr,
-    /// `int64_t*` — pointer to 64-bit integer.
+    /// `int64_t*` - pointer to 64-bit integer.
     Int64Ptr,
 }
 
diff --git a/src/vb/external.rs b/src/vb/external.rs
index a15d66f..57cf25c 100644
--- a/src/vb/external.rs
+++ b/src/vb/external.rs
@@ -34,7 +34,7 @@ use crate::{
 /// View over a CallAPI stub structure (the `DllFunctionCall` descriptor).
 ///
 /// This is the structure the compiler-emitted native stub pushes before
-/// `jmp DllFunctionCall` — both for `ImpAdCall*` constant-pool API calls and
+/// `jmp DllFunctionCall` - both for `ImpAdCall*` constant-pool API calls and
 /// for `Declare` imports (via [`ExternalDeclareInfo::native_stub_va`]). The
 /// VB6 runtime reads it in `DllFunctionCall` → `sub_660315de` to resolve the
 /// import lazily via `LoadLibraryA` + `GetProcAddress`.
@@ -51,7 +51,7 @@ use crate::{
 /// | 0x00 | 4 | `lpLibraryName` (VA to null-terminated DLL name) | `LoadLibraryA` |
 /// | 0x04 | 4 | `lpFunctionName` (VA to null-terminated API name) | `GetProcAddress` by name |
 /// | 0x08 | 2 | `wOrdinal` (import ordinal) | `GetProcAddress` by ordinal |
-/// | 0x0A | 2 | `wFlags` — **bit 1 (`0x02`) = resolve by ordinal** | path selector |
+/// | 0x0A | 2 | `wFlags` - **bit 1 (`0x02`) = resolve by ordinal** | path selector |
 /// | 0x0C | 4 | `lpResolveCache` (`+0x04` HMODULE, `+0x08` proc addr) | populated at first call |
 ///
 /// Only the first 8 bytes ([`SIZE`](Self::SIZE)) are required; the ordinal and
@@ -77,7 +77,7 @@ impl<'a> CallApiStub<'a> {
     /// Bit in [`flags`](Self::flags) indicating the import resolves by ordinal.
     ///
     /// When set, the runtime ignores [`function_name_va`](Self::function_name_va)
-    /// and calls `GetProcAddress` with [`ordinal`](Self::ordinal) instead — the
+    /// and calls `GetProcAddress` with [`ordinal`](Self::ordinal) instead - the
     /// API name is absent from the binary, a common API-hiding technique.
     pub const FLAG_BY_ORDINAL: u16 = 0x0002;
 
@@ -534,47 +534,47 @@ impl fmt::Display for VbBaseType {
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 #[repr(u16)]
 pub enum VarType {
-    /// VT_EMPTY (0) — no value.
+    /// VT_EMPTY (0) - no value.
     Empty = 0,
-    /// VT_NULL (1) — SQL-style null.
+    /// VT_NULL (1) - SQL-style null.
     Null = 1,
-    /// VT_I2 (2) — 16-bit signed integer. Data: 2 bytes.
+    /// VT_I2 (2) - 16-bit signed integer. Data: 2 bytes.
     I2 = 2,
-    /// VT_I4 (3) — 32-bit signed integer. Data: 4 bytes.
+    /// VT_I4 (3) - 32-bit signed integer. Data: 4 bytes.
     I4 = 3,
-    /// VT_R4 (4) — 32-bit float. Data: 4 bytes.
+    /// VT_R4 (4) - 32-bit float. Data: 4 bytes.
     R4 = 4,
-    /// VT_R8 (5) — 64-bit float. Data: 8 bytes.
+    /// VT_R8 (5) - 64-bit float. Data: 8 bytes.
     R8 = 5,
-    /// VT_CY (6) — Currency (64-bit fixed-point). Data: 8 bytes.
+    /// VT_CY (6) - Currency (64-bit fixed-point). Data: 8 bytes.
     Cy = 6,
-    /// VT_DATE (7) — Date (as f64). Data: 8 bytes.
+    /// VT_DATE (7) - Date (as f64). Data: 8 bytes.
     Date = 7,
-    /// VT_BSTR (8) — Unicode string. Data: u16 length + UTF-16LE bytes.
+    /// VT_BSTR (8) - Unicode string. Data: u16 length + UTF-16LE bytes.
     Bstr = 8,
-    /// VT_DISPATCH (9) — IDispatch pointer. Data: 4 bytes.
+    /// VT_DISPATCH (9) - IDispatch pointer. Data: 4 bytes.
     Dispatch = 9,
-    /// VT_ERROR (10) — SCODE. Data: 4 bytes.
+    /// VT_ERROR (10) - SCODE. Data: 4 bytes.
     Error = 10,
-    /// VT_BOOL (11) — Boolean (VARIANT_BOOL). Data: 2 bytes.
+    /// VT_BOOL (11) - Boolean (VARIANT_BOOL). Data: 2 bytes.
     Bool = 11,
-    /// VT_VARIANT (12) — Variant (nested). Data: variable.
+    /// VT_VARIANT (12) - Variant (nested). Data: variable.
     Variant = 12,
-    /// VT_UNKNOWN (13) — IUnknown pointer. Data: 4 bytes.
+    /// VT_UNKNOWN (13) - IUnknown pointer. Data: 4 bytes.
     Unknown = 13,
-    /// VT_DECIMAL (14) — 96-bit decimal. Data: 16 bytes.
+    /// VT_DECIMAL (14) - 96-bit decimal. Data: 16 bytes.
     Decimal = 14,
-    /// VT_I1 (16) — 8-bit signed integer. Data: 2 bytes (word-aligned).
+    /// VT_I1 (16) - 8-bit signed integer. Data: 2 bytes (word-aligned).
     I1 = 16,
-    /// VT_UI1 (17) — 8-bit unsigned integer. Data: 2 bytes (word-aligned).
+    /// VT_UI1 (17) - 8-bit unsigned integer. Data: 2 bytes (word-aligned).
     Ui1 = 17,
-    /// VT_UI2 (18) — 16-bit unsigned integer. Data: 2 bytes.
+    /// VT_UI2 (18) - 16-bit unsigned integer. Data: 2 bytes.
     Ui2 = 18,
-    /// VT_RECORD (19) — UDT / record. Data: 4 bytes.
+    /// VT_RECORD (19) - UDT / record. Data: 4 bytes.
     Record = 19,
-    /// VT_INT (22) — Machine-sized signed integer. Data: 4 bytes.
+    /// VT_INT (22) - Machine-sized signed integer. Data: 4 bytes.
     Int = 22,
-    /// VT_UINT (23) — Machine-sized unsigned integer. Data: 4 bytes.
+    /// VT_UINT (23) - Machine-sized unsigned integer. Data: 4 bytes.
     Uint = 23,
 }
 
@@ -617,7 +617,7 @@ impl VarType {
             Self::I2 => 2,
             Self::I4 | Self::R4 => 4,
             Self::R8 | Self::Cy | Self::Date => 8,
-            Self::Bstr => 0, // Variable — handled separately
+            Self::Bstr => 0, // Variable - handled separately
             Self::Dispatch | Self::Error => 4,
             Self::Bool => 2,
             Self::Variant => 0,
@@ -729,7 +729,7 @@ impl fmt::Display for ExternalKind {
 ///
 /// | Offset | Size | Field |
 /// |--------|------|-------|
-/// | 0x00 | 4 | `fExternalType` — see [`ExternalKind`] |
+/// | 0x00 | 4 | `fExternalType` - see [`ExternalKind`] |
 /// | 0x04 | 4 | `lpExternalObject` (VA to component descriptor) |
 #[derive(Clone, Copy, Debug)]
 pub struct ExternalTableEntry<'a> {
@@ -815,7 +815,7 @@ impl<'a> ExternalTableEntry<'a> {
 /// |--------|------|-------|
 /// | 0x00 | 4 | `lpLibraryName` (VA to DLL name string) |
 /// | 0x04 | 4 | `lpFunctionName` (VA to API function name string) |
-/// | 0x08 | 4 | `dwFlags` (always 0x00040000 — calling convention) |
+/// | 0x08 | 4 | `dwFlags` (always 0x00040000 - calling convention) |
 /// | 0x0C | 4 | `lpNativeStub` (VA to 12-byte native call stub in .data) |
 #[derive(Clone, Copy, Debug)]
 pub struct ExternalDeclareInfo<'a> {
@@ -863,7 +863,7 @@ impl<'a> ExternalDeclareInfo<'a> {
     /// Resolves the `DllFunctionCall` descriptor behind this declare's native stub.
     ///
     /// The stub at [`native_stub_va`](Self::native_stub_va) is a
-    /// `push <descriptor>; jmp DllFunctionCall` thunk — the same shape used by
+    /// `push <descriptor>; jmp DllFunctionCall` thunk - the same shape used by
     /// `ImpAdCall*` constant-pool entries. Resolving it exposes the
     /// [`CallApiStub::ordinal`] and [`CallApiStub::is_by_ordinal`] fields, so a
     /// `Declare ... Alias "#123"` ordinal import can be distinguished from a
@@ -957,24 +957,24 @@ impl<'a> ExternalTypelibInfo<'a> {
 ///
 /// | Offset | Size | Field |
 /// |--------|------|-------|
-/// | 0x00 | 4 | `dwEntrySize` — total entry size (self-relative advance to next) |
-/// | 0x04 | 4 | `bComponentInfo` — self-rel offset to component info block |
-/// | 0x08 | 4 | `bField08` — self-rel offset (interface data 1) |
-/// | 0x0C | 4 | `bField0C` — self-rel offset (interface data 2) |
-/// | 0x10 | 4 | `bField10` — self-rel offset (interface data 3) |
-/// | 0x14 | 4 | `bField14` — self-rel offset (interface data 4) |
-/// | 0x18 | 4 | `bEventHandlers` — self-rel offset to event handler array |
-/// | 0x1C | 4 | `bField1C` — self-rel offset (interface data 5) |
-/// | 0x20 | 4 | `dwInfoBlockSize` — component info block size (direct value) |
-/// | 0x24 | 4 | `bField24` — self-rel offset (0 = not present) |
-/// | 0x28 | 4 | `bOcxFilename` — self-rel offset to OCX filename string |
-/// | 0x2C | 4 | `bProgId` — self-rel offset to ProgID string (e.g., "TabDlg.SSTab") |
-/// | 0x30 | 4 | `bClassName` — self-rel offset to class name (e.g., "SSTab") |
+/// | 0x00 | 4 | `dwEntrySize` - total entry size (self-relative advance to next) |
+/// | 0x04 | 4 | `bComponentInfo` - self-rel offset to component info block |
+/// | 0x08 | 4 | `bField08` - self-rel offset (interface data 1) |
+/// | 0x0C | 4 | `bField0C` - self-rel offset (interface data 2) |
+/// | 0x10 | 4 | `bField10` - self-rel offset (interface data 3) |
+/// | 0x14 | 4 | `bField14` - self-rel offset (interface data 4) |
+/// | 0x18 | 4 | `bEventHandlers` - self-rel offset to event handler array |
+/// | 0x1C | 4 | `bField1C` - self-rel offset (interface data 5) |
+/// | 0x20 | 4 | `dwInfoBlockSize` - component info block size (direct value) |
+/// | 0x24 | 4 | `bField24` - self-rel offset (0 = not present) |
+/// | 0x28 | 4 | `bOcxFilename` - self-rel offset to OCX filename string |
+/// | 0x2C | 4 | `bProgId` - self-rel offset to ProgID string (e.g., "TabDlg.SSTab") |
+/// | 0x30 | 4 | `bClassName` - self-rel offset to class name (e.g., "SSTab") |
 ///
 /// # Component Info Block (at `bComponentInfo`)
 ///
 /// Variable-length block with at least 0x93 bytes:
-/// - +0x86 (u8): flags — bit 7 = uses special load path in runtime
+/// - +0x86 (u8): flags - bit 7 = uses special load path in runtime
 /// - +0x92 (u16): event handler count
 ///
 /// # Event Handler Array (at `bEventHandlers`)
diff --git a/src/vb/flags.rs b/src/vb/flags.rs
index e4b62da..0e69549 100644
--- a/src/vb/flags.rs
+++ b/src/vb/flags.rs
@@ -30,7 +30,7 @@ pub struct ObjectTypeFlags(pub u32);
 impl ObjectTypeFlags {
     /// Optional info structure is present (bit 0, always set in compiled binaries).
     pub const HAS_OPTIONAL_INFO: u32 = 0x01;
-    /// Object has COM interface — set for classes and forms, NOT for modules (bit 1).
+    /// Object has COM interface - set for classes and forms, NOT for modules (bit 1).
     pub const HAS_COM_INTERFACE: u32 = 0x02;
     /// Object is visual / has a form designer (bit 7).
     pub const IS_VISUAL: u32 = 0x80;
@@ -76,7 +76,7 @@ impl ObjectTypeFlags {
     /// Returns a human-readable kind string for this object type.
     ///
     /// Cannot distinguish UserControl from Class or UserDocument from Form
-    /// using flags alone — those require project-level context.
+    /// using flags alone - those require project-level context.
     pub fn kind_name(self) -> &'static str {
         if self.is_form() {
             "Form"
diff --git a/src/vb/formdata.rs b/src/vb/formdata.rs
index 8f0bd0f..8b4f462 100644
--- a/src/vb/formdata.rs
+++ b/src/vb/formdata.rs
@@ -7,13 +7,13 @@
 //! # Format Overview
 //!
 //! ```text
-//! [FormDataHeader]              — magic 0xCCFF, GUIDs, dimensions
-//! [form property stream]        — opcode+value pairs, terminated by 0xFF
+//! [FormDataHeader]              - magic 0xCCFF, GUIDs, dimensions
+//! [form property stream]        - opcode+value pairs, terminated by 0xFF
 //! [hierarchy markers + child control records]
-//!   0x01 [first child record]   — NEW marker
-//!   0x03 [sibling record]       — SIB marker
-//!   0x02                        — END marker
-//! [0x05 menu section]           — optional
+//!   0x01 [first child record]   - NEW marker
+//!   0x03 [sibling record]       - SIB marker
+//!   0x02                        - END marker
+//! [0x05 menu section]           - optional
 //! [0x04 form end]
 //! ```
 //!
@@ -400,13 +400,13 @@ impl<'a> FormDataHeader<'a> {
 /// # Record Layout
 ///
 /// ```text
-/// [u32 size]                    — total record size (bit 31 = has array index)
-/// [u8 cId]                      — control ID (links to ControlInfo.index)
-/// [u16_le name_len]             — name string length
-/// [name_len + 1 bytes]          — name + null terminator
-/// [u8 cType]                    — authoritative control type code
-/// [property bytes...]           — opcode + value pairs
-/// [0xFF]                        — property stream terminator
+/// [u32 size]                    - total record size (bit 31 = has array index)
+/// [u8 cId]                      - control ID (links to ControlInfo.index)
+/// [u16_le name_len]             - name string length
+/// [name_len + 1 bytes]          - name + null terminator
+/// [u8 cType]                    - authoritative control type code
+/// [property bytes...]           - opcode + value pairs
+/// [0xFF]                        - property stream terminator
 /// ```
 ///
 /// For control array members (bit 31 of size set), a 2-byte array index
@@ -731,7 +731,7 @@ impl<'a> FormDataParser<'a> {
             }
             pos = pos.saturating_add(1);
         }
-        // No marker found — return everything after header
+        // No marker found - return everything after header
         let end = data.len().min(start.saturating_add(256));
         data.get(start..end).unwrap_or(&[])
     }
diff --git a/src/vb/functype.rs b/src/vb/functype.rs
index 7538ac5..75e71a4 100644
--- a/src/vb/functype.rs
+++ b/src/vb/functype.rs
@@ -9,16 +9,16 @@
 //!
 //! | Offset | Size | Field |
 //! |--------|------|-------|
-//! | 0x00 | 1 | `bArgSize` — encodes arg count (bits 3-7) and property kind (bits 0-2) |
-//! | 0x01 | 1 | `bFlags` — bit 0: function has a return type |
-//! | 0x02 | 2 | `wVTableOffset` — COM vtable offset; bit 0 is runtime flag (mask off) |
-//! | 0x04 | 2 | `iObjectIndex` — signed; -1 (0xFFFF) = no COM object type reference |
+//! | 0x00 | 1 | `bArgSize` - encodes arg count (bits 3-7) and property kind (bits 0-2) |
+//! | 0x01 | 1 | `bFlags` - bit 0: function has a return type |
+//! | 0x02 | 2 | `wVTableOffset` - COM vtable offset; bit 0 is runtime flag (mask off) |
+//! | 0x04 | 2 | `iObjectIndex` - signed; -1 (0xFFFF) = no COM object type reference |
 //! | 0x06 | 2 | Reserved (always 0) |
-//! | 0x08 | 4 | `lpOptionalDefaults` — VA to optional param default values header (see below) |
-//! | 0x0C | 2 | `wNameIndex` — method DISPID for IDispatch::GetIDsOfNames resolution |
-//! | 0x0E | 1 | `bReturnType` — [`VbType`] byte for the return value |
-//! | 0x0F | 1 | `bFuncFlags` — 0x60 for regular Sub/Function, 0x68 for Property |
-//! | 0x10 | 4 | `lpParamNames` — VA to parameter name string pointer array |
+//! | 0x08 | 4 | `lpOptionalDefaults` - VA to optional param default values header (see below) |
+//! | 0x0C | 2 | `wNameIndex` - method DISPID for IDispatch::GetIDsOfNames resolution |
+//! | 0x0E | 1 | `bReturnType` - [`VbType`] byte for the return value |
+//! | 0x0F | 1 | `bFuncFlags` - 0x60 for regular Sub/Function, 0x68 for Property |
+//! | 0x10 | 4 | `lpParamNames` - VA to parameter name string pointer array |
 //! | 0x14 | 12 | Padding (always 0) |
 //!
 //! # Property Kind Encoding
@@ -158,7 +158,7 @@ impl<'a> FuncTypDesc<'a> {
     /// | Bit | Mask | Meaning |
     /// |-----|------|---------|
     /// | 0 | 0x01 | Has return type |
-    /// | 1 | 0x02 | Has ParamArray (variable argument list) — confirmed in `MarshalDispParamsToNative` |
+    /// | 1 | 0x02 | Has ParamArray (variable argument list) - confirmed in `MarshalDispParamsToNative` |
     /// | 2-7 | 0xFC | Bits 2-7 encode the named argument count (0x3F = none) |
     #[inline]
     pub fn flags(&self) -> u8 {
@@ -187,7 +187,7 @@ impl<'a> FuncTypDesc<'a> {
     /// VTable offset at offset 0x02 (2 bytes, little-endian).
     ///
     /// This is the byte offset into the COM vtable for this method.
-    /// Bit 0 is masked off — it indicates "has return type" redundantly
+    /// Bit 0 is masked off - it indicates "has return type" redundantly
     /// (same as `bFlags` bit 0). Confirmed in `ResolveDispatchToFuncTypDesc`
     /// which reads `*(ftd+2) & 1` to check this flag. The first user method
     /// typically starts at offset 0x1C (after IUnknown + IDispatch = 7 methods).
@@ -218,14 +218,14 @@ impl<'a> FuncTypDesc<'a> {
     /// Points to an 8-byte header structure used by the runtime's
     /// `OptionalDefaultsNext` (0x660F5FCA) for looking up default values
     /// of optional parameters. **Not** the arg type data (those are inline
-    /// at +0x20 — see [`arg_types`](Self::arg_types)).
+    /// at +0x20 - see [`arg_types`](Self::arg_types)).
     ///
     /// # Header Layout (at this VA)
     ///
     /// | Offset | Size | Field |
     /// |--------|------|-------|
-    /// | 0x00 | 4 | `dwTotalSize` — bytes in the defaults data area |
-    /// | 0x04 | 4 | `lpDefaults` — VA of first default value entry |
+    /// | 0x00 | 4 | `dwTotalSize` - bytes in the defaults data area |
+    /// | 0x04 | 4 | `lpDefaults` - VA of first default value entry |
     ///
     /// Each default value entry is:
     /// - `u16` VarType code (2=Integer, 3=Long, 8=BSTR, etc.)
@@ -340,9 +340,9 @@ impl<'a> FuncTypDesc<'a> {
 
     /// Returns the procedure kind keyword for display.
     ///
-    /// - `"Sub"` — no return type, not a property
-    /// - `"Function"` — has return type, not a property
-    /// - `"Property Get"` / `"Property Let"` / `"Property Set"` — property procedures
+    /// - `"Sub"` - no return type, not a property
+    /// - `"Function"` - has return type, not a property
+    /// - `"Property Get"` / `"Property Let"` / `"Property Set"` - property procedures
     pub fn kind_keyword(&self) -> &'static str {
         if self.is_property() {
             match self.property_kind() {
@@ -383,7 +383,7 @@ impl<'a> FuncTypDesc<'a> {
     /// ```
     ///
     /// To use this method, the `data` slice passed to [`parse`](Self::parse)
-    /// must extend beyond the 0x14-byte minimum — at least `0x20 + arg_count`
+    /// must extend beyond the 0x14-byte minimum - at least `0x20 + arg_count`
     /// bytes are needed. Use [`parse_extended`](Self::parse_extended) to
     /// ensure the slice is large enough.
     ///
@@ -518,9 +518,10 @@ impl<'a> FuncTypDesc<'a> {
                 };
                 let text = String::from_utf16_lossy(
                     &str_bytes
-                        .chunks_exact(2)
-                        .filter_map(|c| <[u8; 2]>::try_from(c).ok())
-                        .map(u16::from_le_bytes)
+                        .as_chunks::<2>()
+                        .0
+                        .iter()
+                        .map(|&c| u16::from_le_bytes(c))
                         .collect::<Vec<_>>(),
                 );
                 defaults.push(OptionalDefault {
diff --git a/src/vb/guitable.rs b/src/vb/guitable.rs
index 5245f2b..cbbb2c1 100644
--- a/src/vb/guitable.rs
+++ b/src/vb/guitable.rs
@@ -151,17 +151,17 @@ impl fmt::Display for GuiTypeFlags {
 ///
 /// | Offset | Size | Field |
 /// |--------|------|-------|
-/// | 0x00 | 4 | `dwEntrySize` — offset to next entry (self-relative) |
-/// | 0x04 | 16 | `uuidObject` — primary object GUID |
-/// | 0x14 | 16 | `uuidSecondary` — secondary GUID (zeros for standard Forms) |
-/// | 0x24 | 4 | `dwField24` — stored to runtime wrapper (zero for Forms) |
-/// | 0x28 | 4 | `dwObjectType` — type + flag bits (see below) |
-/// | 0x2C | 4 | `dwTypeDataDword` — non-zero for MDI (size/offset), 0 for others |
-/// | 0x30 | 16 | `guidTypeDataIID` — interface IID for MDI/UserControl, zeros for Form |
-/// | 0x40 | 4 | `dwFormDataSize` — compiled form binary size |
+/// | 0x00 | 4 | `dwEntrySize` - offset to next entry (self-relative) |
+/// | 0x04 | 16 | `uuidObject` - primary object GUID |
+/// | 0x14 | 16 | `uuidSecondary` - secondary GUID (zeros for standard Forms) |
+/// | 0x24 | 4 | `dwField24` - stored to runtime wrapper (zero for Forms) |
+/// | 0x28 | 4 | `dwObjectType` - type + flag bits (see below) |
+/// | 0x2C | 4 | `dwTypeDataDword` - non-zero for MDI (size/offset), 0 for others |
+/// | 0x30 | 16 | `guidTypeDataIID` - interface IID for MDI/UserControl, zeros for Form |
+/// | 0x40 | 4 | `dwFormDataSize` - compiled form binary size |
 /// | 0x44 | 4 | Reserved (zero) |
-/// | 0x48 | 4 | `lpFormData` — VA of form design/binary data |
-/// | 0x4C | 4 | `dwFormDataSize2` — secondary size field |
+/// | 0x48 | 4 | `lpFormData` - VA of form design/binary data |
+/// | 0x4C | 4 | `dwFormDataSize2` - secondary size field |
 ///
 /// # dwObjectType Bits
 ///
diff --git a/src/vb/header.rs b/src/vb/header.rs
index af95fe5..2a37ae8 100644
--- a/src/vb/header.rs
+++ b/src/vb/header.rs
@@ -8,7 +8,7 @@
 //! VB6.EXE v6.00.8176) actually writes `0x78` bytes (120), but the runtime
 //! never reads past offset `0x54` (`lpComRegisterData`). The fields at
 //! `0x58`–`0x64` (bSZ string offsets) and `0x68`–`0x77` (reserved) are
-//! dead data from the runtime's perspective — used only by the IDE/compiler.
+//! dead data from the runtime's perspective - used only by the IDE/compiler.
 
 use crate::{
     error::Error,
diff --git a/src/vb/object.rs b/src/vb/object.rs
index e0950b5..1e4ae20 100644
--- a/src/vb/object.rs
+++ b/src/vb/object.rs
@@ -32,7 +32,7 @@ use crate::{
 /// | 0x18 | 4 | `lpszObjectName` (null-terminated ANSI string VA) |
 /// | 0x1C | 4 | `dwMethodCount` |
 /// | 0x20 | 4 | `lpMethodNames` (VA; forms/classes only; 0 for modules) |
-/// | 0x24 | 4 | `oStaticVars` (always 0x0000FFFF — sentinel) |
+/// | 0x24 | 4 | `oStaticVars` (always 0x0000FFFF - sentinel) |
 /// | 0x28 | 4 | `fObjectType` (type flags, see below) |
 /// | 0x2C | 4 | Reserved (always 0) |
 ///
@@ -346,7 +346,7 @@ impl<'a> ObjectInfo<'a> {
     /// of a `mov edx, <rtmi_addr>; call ProcCallEngine` stub.
     ///
     /// Note: the P-Code engine does NOT use this field at runtime for
-    /// method dispatch — it goes through ProcDscInfo structures directly.
+    /// method dispatch - it goes through ProcDscInfo structures directly.
     /// This field is used during project loading to build dispatch tables.
     /// When `method_count() == 0`, this value may be uninitialized garbage.
     #[inline]
@@ -371,7 +371,7 @@ impl<'a> ObjectInfo<'a> {
     /// Use [`ConstantPool::new`](super::constantpool::ConstantPool::new) to create
     /// a reader for resolving string and API references from this base address.
     ///
-    /// This is the most heavily used ObjectInfo field at runtime — the
+    /// This is the most heavily used ObjectInfo field at runtime - the
     /// P-Code engine reads it at the start of every method execution to
     /// set up the constants pool base address. Also accessed via
     /// [`ProcDscInfo::object_info_va`](super::procedure::ProcDscInfo::object_info_va)
@@ -380,6 +380,22 @@ impl<'a> ObjectInfo<'a> {
     pub fn constants_va(&self) -> Result<u32, Error> {
         read_u32_le(self.bytes, 0x34)
     }
+
+    /// Returns `true` if this object carries a real method dispatch table.
+    ///
+    /// Two layouts mean it does not. A table address equal to
+    /// [`constants_va`](Self::constants_va) is the constants/variable pool, not a
+    /// table. A zero [`method_count`](Self::method_count) leaves
+    /// [`methods_va`](Self::methods_va) uninitialized, so whatever it holds is not
+    /// an address worth reading.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the method count or either VA cannot be read.
+    pub fn has_method_table(&self) -> Result<bool, Error> {
+        let methods = self.methods_va()?;
+        Ok(methods != 0 && methods != self.constants_va()? && self.method_count()? > 0)
+    }
 }
 
 /// View over an OptionalObjectInfo structure (0x40 bytes).
@@ -404,24 +420,24 @@ impl<'a> ObjectInfo<'a> {
 ///
 /// | Offset | Size | Field |
 /// |--------|------|-------|
-/// | 0x00 | 4 | `gui_guids_count` — GUI GUID table entry count |
-/// | 0x04 | 4 | `object_clsid_va` — VA of 16-byte object CLSID |
-/// | 0x08 | 4 | `null_08` — always 0 (reserved) |
-/// | 0x0C | 4 | `gui_guid_table_va` — VA of GUID VA-pointer array |
-/// | 0x10 | 4 | `default_iid_count` — default IID table entry count |
-/// | 0x14 | 4 | `events_iid_table_va` — VA of event source IID table |
-/// | 0x18 | 4 | `events_iid_count` — event source IID count |
-/// | 0x1C | 4 | `default_iid_table_va` — VA of default IID VA-pointer array |
-/// | 0x20 | 4 | `control_count` — number of controls |
-/// | 0x24 | 4 | `controls_va` — VA of ControlInfo array |
-/// | 0x28 | 2 | `method_link_count` — method link entries |
-/// | 0x2A | 2 | `pcode_count` — P-Code method count (`0x1B7` is the linker-emitted native marker; see [`Self::PCODE_COUNT_NATIVE_SENTINEL`]) |
-/// | 0x2C | 2 | `initialize_event_offset` — dispatch vtable byte offset |
-/// | 0x2E | 2 | `terminate_event_offset` — dispatch vtable byte offset |
-/// | 0x30 | 4 | `method_link_table_va` — VA of method link table |
-/// | 0x34 | 4 | `basic_class_object_va` — VA of runtime dispatch vtable |
-/// | 0x38 | 4 | `null_38` — always 0 (reserved) |
-/// | 0x3C | 4 | `field_3c` — non-zero, linker-internal VA (not patchable) |
+/// | 0x00 | 4 | `gui_guids_count` - GUI GUID table entry count |
+/// | 0x04 | 4 | `object_clsid_va` - VA of 16-byte object CLSID |
+/// | 0x08 | 4 | `null_08` - always 0 (reserved) |
+/// | 0x0C | 4 | `gui_guid_table_va` - VA of GUID VA-pointer array |
+/// | 0x10 | 4 | `default_iid_count` - default IID table entry count |
+/// | 0x14 | 4 | `events_iid_table_va` - VA of event source IID table |
+/// | 0x18 | 4 | `events_iid_count` - event source IID count |
+/// | 0x1C | 4 | `default_iid_table_va` - VA of default IID VA-pointer array |
+/// | 0x20 | 4 | `control_count` - number of controls |
+/// | 0x24 | 4 | `controls_va` - VA of ControlInfo array |
+/// | 0x28 | 2 | `method_link_count` - method link entries |
+/// | 0x2A | 2 | `pcode_count` - P-Code method count (`0x1B7` is the linker-emitted native marker; see [`Self::PCODE_COUNT_NATIVE_SENTINEL`]) |
+/// | 0x2C | 2 | `initialize_event_offset` - dispatch vtable byte offset |
+/// | 0x2E | 2 | `terminate_event_offset` - dispatch vtable byte offset |
+/// | 0x30 | 4 | `method_link_table_va` - VA of method link table |
+/// | 0x34 | 4 | `basic_class_object_va` - VA of runtime dispatch vtable |
+/// | 0x38 | 4 | `null_38` - always 0 (reserved) |
+/// | 0x3C | 4 | `field_3c` - non-zero, linker-internal VA (not patchable) |
 ///
 /// # GUID Tables
 ///
@@ -568,7 +584,7 @@ impl<'a> OptionalObjectInfo<'a> {
     /// Empirically every natively-compiled VB6 object surveyed has this
     /// exact value at +0x2A; no runtime path in `MSVBVM60.DLL_6.00.9848`
     /// reads `wPCodeCount` and checks against `0x1B7`, so the runtime
-    /// itself does not enforce a sentinel — the value is a compiler /
+    /// itself does not enforce a sentinel - the value is a compiler /
     /// linker default written when there is no P-Code dispatch table to
     /// describe. The dispatch path iterates the actual method table at
     /// `methods_va` instead, which is the authoritative source.
@@ -579,7 +595,7 @@ impl<'a> OptionalObjectInfo<'a> {
     /// when reverse-engineering the layout itself.
     pub const PCODE_COUNT_NATIVE_SENTINEL: u16 = 0x1B7;
 
-    /// Raw P-Code method count at offset 0x2A — see
+    /// Raw P-Code method count at offset 0x2A - see
     /// [`PCODE_COUNT_NATIVE_SENTINEL`](Self::PCODE_COUNT_NATIVE_SENTINEL).
     ///
     /// Returns the on-disk u16 verbatim. Almost every caller wants
@@ -689,7 +705,7 @@ impl<'a> OptionalObjectInfo<'a> {
     /// Linker-internal field at offset 0x3C.
     ///
     /// Non-zero in all tested samples, but contains an address outside the
-    /// PE image range — appears to be an unpatched linker-internal VA from
+    /// PE image range - appears to be an unpatched linker-internal VA from
     /// the VBA6.DLL compilation environment. Not read by the runtime.
     #[inline]
     pub fn field_3c(&self) -> Result<u32, Error> {
@@ -857,7 +873,7 @@ impl<'a> GuidTableIter<'a> {
 }
 
 impl<'a> Iterator for GuidTableIter<'a> {
-    /// Yields `(guid_va, Guid)` pairs — the VA of the GUID data and
+    /// Yields `(guid_va, Guid)` pairs - the VA of the GUID data and
     /// the parsed 16-byte GUID.
     type Item = (u32, Guid);
 
@@ -952,6 +968,38 @@ mod tests {
         assert_eq!(info.methods_va().unwrap(), 0x00404000);
     }
 
+    #[test]
+    fn test_object_info_method_table_requires_a_count() {
+        let mut data = vec![0u8; ObjectInfo::SIZE];
+        data[0x24..0x28].copy_from_slice(&0x00404000u32.to_le_bytes()); // methods_va
+        data[0x34..0x38].copy_from_slice(&0x00405000u32.to_le_bytes()); // constants_va
+
+        // A zero count leaves the table pointer uninitialized.
+        assert!(
+            !ObjectInfo::parse(&data)
+                .unwrap()
+                .has_method_table()
+                .unwrap()
+        );
+
+        data[0x20..0x22].copy_from_slice(&3u16.to_le_bytes()); // method_count
+        assert!(
+            ObjectInfo::parse(&data)
+                .unwrap()
+                .has_method_table()
+                .unwrap()
+        );
+
+        // The "table" at the constants pool is the pool.
+        data[0x24..0x28].copy_from_slice(&0x00405000u32.to_le_bytes());
+        assert!(
+            !ObjectInfo::parse(&data)
+                .unwrap()
+                .has_method_table()
+                .unwrap()
+        );
+    }
+
     #[test]
     fn test_object_info_too_short() {
         let data = vec![0u8; ObjectInfo::SIZE - 1];
@@ -977,7 +1025,7 @@ mod tests {
     fn test_optional_object_info_native_sentinel() {
         let mut data = vec![0u8; OptionalObjectInfo::SIZE];
         // Linker writes 0x1B7 (439) at +0x2A on natively compiled objects
-        // — see `OptionalObjectInfo::PCODE_COUNT_NATIVE_SENTINEL`.
+        // - see `OptionalObjectInfo::PCODE_COUNT_NATIVE_SENTINEL`.
         data[0x2A..0x2C]
             .copy_from_slice(&OptionalObjectInfo::PCODE_COUNT_NATIVE_SENTINEL.to_le_bytes());
         let opt = OptionalObjectInfo::parse(&data).unwrap();
diff --git a/src/vb/objecttable.rs b/src/vb/objecttable.rs
index 78b76b7..8320862 100644
--- a/src/vb/objecttable.rs
+++ b/src/vb/objecttable.rs
@@ -39,7 +39,7 @@ use crate::{
 /// | 0x44 | 4 | `dwLcid` (primary locale ID) |
 /// | 0x48 | 4 | `dwLcid2` (secondary locale ID) |
 /// | 0x4C | 4 | IDE data 3 (0 in compiled) |
-/// | 0x50 | 4 | `dwIdentifier` (always 2 — format version) |
+/// | 0x50 | 4 | `dwIdentifier` (always 2 - format version) |
 #[derive(Clone, Copy, Debug)]
 pub struct ObjectTable<'a> {
     bytes: &'a [u8],
@@ -87,7 +87,7 @@ impl<'a> ObjectTable<'a> {
     ///
     /// Points to compiler-allocated .data section space (zeroed on disk,
     /// populated at runtime by MSVBVM60). Always exactly 0x10 bytes after
-    /// [`project_object_va`](Self::project_object_va) — they are two
+    /// [`project_object_va`](Self::project_object_va) - they are two
     /// entry points into the same COM object.
     ///
     /// At runtime, the first DWORD at this address contains the VBHeader
diff --git a/src/vb/privateobj.rs b/src/vb/privateobj.rs
index ea2a815..4291f15 100644
--- a/src/vb/privateobj.rs
+++ b/src/vb/privateobj.rs
@@ -10,21 +10,21 @@
 //! | Offset | Size | Field |
 //! |--------|------|-------|
 //! | 0x00 | 4 | Reserved (always 0 in compiled binaries) |
-//! | 0x04 | 4 | `lpObjectInfo` — back-pointer to parent ObjectInfo |
+//! | 0x04 | 4 | `lpObjectInfo` - back-pointer to parent ObjectInfo |
 //! | 0x08 | 4 | Reserved (always 0xFFFFFFFF) |
 //! | 0x0C | 4 | Reserved (always 0 in compiled binaries) |
-//! | 0x10 | 2 | `wFuncCount` — number of public functions/methods |
-//! | 0x12 | 2 | `wFuncCount2` — secondary count (non-zero in ActiveX OCXs) |
-//! | 0x14 | 2 | `wVarCount` — number of public variables |
+//! | 0x10 | 2 | `wFuncCount` - number of public functions/methods |
+//! | 0x12 | 2 | `wFuncCount2` - secondary count (non-zero in ActiveX OCXs) |
+//! | 0x14 | 2 | `wVarCount` - number of public variables |
 //! | 0x16 | 2 | Padding (always 0) |
-//! | 0x18 | 4 | `lpFuncTypDescs` — VA to array of FuncTypDesc pointers |
-//! | 0x1C | 4 | `lpExtendedFuncData` — secondary FuncTypDesc metadata array (always 0 in compiled; IDE/debug only) |
-//! | 0x20 | 4 | `lpMethodNameTable` — secondary method name table (FuncTypDesc pointer array indexed by func index) |
-//! | 0x24 | 4 | `lpParamNames` — parameter name string table |
-//! | 0x28 | 4 | `lpVarStubs` — runtime stub reference table |
+//! | 0x18 | 4 | `lpFuncTypDescs` - VA to array of FuncTypDesc pointers |
+//! | 0x1C | 4 | `lpExtendedFuncData` - secondary FuncTypDesc metadata array (always 0 in compiled; IDE/debug only) |
+//! | 0x20 | 4 | `lpMethodNameTable` - secondary method name table (FuncTypDesc pointer array indexed by func index) |
+//! | 0x24 | 4 | `lpParamNames` - parameter name string table |
+//! | 0x28 | 4 | `lpVarStubs` - runtime stub reference table |
 //! | 0x2C | 12 | Reserved (always 0 in compiled binaries) |
-//! | 0x38 | 4 | `dwDescSize` — total size of function type descriptors area |
-//! | 0x3C | 4 | `dwFlags` — bit 2=valid, bit 8=class module |
+//! | 0x38 | 4 | `dwDescSize` - total size of function type descriptors area |
+//! | 0x3C | 4 | `dwFlags` - bit 2=valid, bit 8=class module |
 //!
 //! # Unknown Field Verification (2026-03-29)
 //!
@@ -107,7 +107,7 @@ impl<'a> PrivateObjectDescriptor<'a> {
     /// Secondary function count at offset 0x12 (u16).
     ///
     /// Non-zero in ActiveX DLLs/OCXs (e.g., CoolBar=13, EmbossedPicture=2).
-    /// **Not read by any code in MSVBVM60.DLL** — exhaustive search confirmed
+    /// **Not read by any code in MSVBVM60.DLL** - exhaustive search confirmed
     /// the runtime ignores this field. Likely vestigial or IDE-only metadata.
     #[inline]
     pub fn func_count2(&self) -> Result<u16, Error> {
@@ -156,7 +156,7 @@ impl<'a> PrivateObjectDescriptor<'a> {
     /// which VBA runtime functions implement the property accessors for a
     /// public variable. Use [`VarStubIter`](super::varstub::VarStubIter) to iterate.
     ///
-    /// **Not read by MSVBVM60.DLL at runtime** — compiler/IDE metadata only.
+    /// **Not read by MSVBVM60.DLL at runtime** - compiler/IDE metadata only.
     /// Still useful for analysis: reveals runtime function dependencies and
     /// method names for each public variable.
     #[inline]
@@ -173,8 +173,8 @@ impl<'a> PrivateObjectDescriptor<'a> {
     /// Object flags at offset 0x3C.
     ///
     /// Bit field with the following known flags:
-    /// - Bit 2 (`0x0004`): Always set — indicates a valid PrivateObjectDescriptor.
-    /// - Bit 8 (`0x0100`): Class module flag — set for `.cls` files.
+    /// - Bit 2 (`0x0004`): Always set - indicates a valid PrivateObjectDescriptor.
+    /// - Bit 8 (`0x0100`): Class module flag - set for `.cls` files.
     ///
     /// Observed values across 709 objects in 104 samples:
     /// - `0x0004` (557 objects): Forms, standard modules, UserControls, UserDocuments.
@@ -245,7 +245,7 @@ mod tests {
         assert!(!pod.is_class());
     }
 
-    // Real data from CoolBar in ComCt332.ocx — func_count2 is non-zero (13)
+    // Real data from CoolBar in ComCt332.ocx - func_count2 is non-zero (13)
     const COOLBAR_OCX: [u8; 0x40] = [
         0x00, 0x00, 0x00, 0x00, 0x84, 0x71, 0x08, 0x28, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00,
         0x00, 0x1E, 0x00, 0x0D, 0x00, 0x00, 0x00, 0x00, 0x00, 0x4C, 0x25, 0x09, 0x28, 0x00, 0x00,
diff --git a/src/vb/procedure.rs b/src/vb/procedure.rs
index 79b40a2..a7bff07 100644
--- a/src/vb/procedure.rs
+++ b/src/vb/procedure.rs
@@ -34,17 +34,17 @@ use crate::{
 ///
 /// This is the common table format used by both the primary cleanup table
 /// (at ProcDscInfo +0x18, processed by `InitLocalCleanupAll`) and the
-/// secondary table (immediately following table 1, purpose unknown —
+/// secondary table (immediately following table 1, purpose unknown -
 /// not processed by MSVBVM60.DLL during normal method entry/exit).
 ///
 /// # Layout
 ///
 /// | Offset | Size | Field |
 /// |--------|------|-------|
-/// | 0x00 | 2 | `wSize` — total table size in bytes (including this header) |
+/// | 0x00 | 2 | `wSize` - total table size in bytes (including this header) |
 /// | 0x02 | 2 | Reserved (always 0) |
-/// | 0x04 | 2 | `wCount` — entries to actively process on exit/error |
-/// | 0x06 | 2 | `wTotal` — total entry count in the table |
+/// | 0x04 | 2 | `wCount` - entries to actively process on exit/error |
+/// | 0x06 | 2 | `wTotal` - total entry count in the table |
 /// | 0x08 | 4 | Flags (bit 0 at byte +0x0B checked by `InitLocalCleanupEntries`) |
 /// | 0x0C | var | [`ControlPropertyEntry`](super::controlprop::ControlPropertyEntry) records |
 ///
@@ -92,7 +92,7 @@ impl<'a> CleanupTable<'a> {
 
     /// Total number of entries in the table at offset 0x06.
     ///
-    /// May exceed [`count`](Self::count) — entries beyond `count` exist
+    /// May exceed [`count`](Self::count) - entries beyond `count` exist
     /// in the table but are not actively processed for cleanup.
     #[inline]
     pub fn total(&self) -> Result<u16, Error> {
@@ -173,7 +173,7 @@ impl<'a> CleanupTable<'a> {
 ///   +0x0C  var  ControlPropertyEntry[] records
 ///
 /// +0x18 + primary_size: Secondary CleanupTable (NOT processed by runtime)
-///   Same header format as primary table. Purpose unknown —
+///   Same header format as primary table. Purpose unknown -
 ///   not read by MSVBVM60.DLL during method entry/exit.
 ///   Always present (minimum 0x0C bytes).
 /// ```
@@ -201,7 +201,7 @@ impl<'a> ProcDscInfo<'a> {
     /// Parses a ProcDscInfo from the given byte slice.
     ///
     /// Reads at least [`MIN_SIZE`](Self::MIN_SIZE) bytes. The full structure
-    /// may be larger — use [`total_size`](Self::total_size) to determine
+    /// may be larger - use [`total_size`](Self::total_size) to determine
     /// the actual extent.
     ///
     /// # Errors
@@ -324,7 +324,7 @@ impl<'a> ProcDscInfo<'a> {
     ///
     /// Self-relative offset from the start of `ProcDscInfo` to a per-procedure
     /// fixup table consulted by the runtime's `Resume Next` handler
-    /// (`op_Lead2_Resume` at 0x6610F212) — and **only** on a narrow fallback
+    /// (`op_Lead2_Resume` at 0x6610F212) - and **only** on a narrow fallback
     /// path. Earlier revisions of this crate mislabelled the field
     /// `wBosSkipTableOffset` and treated it as a per-opcode instruction-size
     /// table; subsequent reverse engineering (see below) shows that is wrong.
@@ -335,15 +335,15 @@ impl<'a> ProcDscInfo<'a> {
     /// `Resume <label>` (positive) jumps directly; bare `Resume` (`-2`)
     /// re-dispatches the faulting statement; `Resume Next` (`-1`) advances to the
     /// next statement. That advance normally uses the **inline length byte of the
-    /// `LargeBos` statement marker** at the saved position — *not* this field.
+    /// `LargeBos` statement marker** at the saved position - *not* this field.
     /// This field's table is the rare fallback used only when the saved position
     /// is **not** a BOS marker.
     ///
     /// # Why it is almost always zero
     ///
     /// Across a 100-binary VB6 malware corpus this field is `0` for the vast
-    /// majority of methods — including 457 of 461 methods that contain a literal
-    /// `Resume` opcode — because the fallback path is essentially never compiled.
+    /// majority of methods - including 457 of 461 methods that contain a literal
+    /// `Resume` opcode - because the fallback path is essentially never compiled.
     /// `0` is therefore the normal, expected value, **not** "missing data." A
     /// small population of (non-error) methods carry a non-zero value equal to
     /// the procedure's `total_size`/`actual_size` that points at the following
@@ -360,7 +360,7 @@ impl<'a> ProcDscInfo<'a> {
     /// Equal to `(OptionalObjectInfo.initialize_event_offset / 4) - 1`,
     /// i.e., the 0-based index of the last dispatch table slot before the
     /// Initialize event. Constant across all methods within the same object.
-    /// Not read by MSVBVM60.DLL at runtime — compiler metadata only.
+    /// Not read by MSVBVM60.DLL at runtime - compiler metadata only.
     ///
     /// Known values: Class=2, Form/UserDoc=25, UserControl=25.
     #[inline]
@@ -407,7 +407,7 @@ impl<'a> ProcDscInfo<'a> {
 
     /// Total number of cleanup entries at offset 0x1E.
     ///
-    /// May be larger than [`cleanup_count`](Self::cleanup_count) — entries
+    /// May be larger than [`cleanup_count`](Self::cleanup_count) - entries
     /// beyond `count` exist but are not actively processed for resource release.
     #[inline]
     pub fn cleanup_total(&self) -> u16 {
@@ -443,7 +443,7 @@ impl<'a> ProcDscInfo<'a> {
     ///
     /// This table has the same header format as the primary table and is
     /// always present (minimum 0x0C bytes). It is **not** processed by
-    /// MSVBVM60.DLL during normal method entry/exit — its purpose is
+    /// MSVBVM60.DLL during normal method entry/exit - its purpose is
     /// unknown (possibly compiler/IDE metadata).
     ///
     /// Located at `ProcDscInfo + total_size`, i.e., immediately after the
@@ -577,7 +577,7 @@ impl fmt::Display for ProcOptFlags {
 /// the frame pointer as `arg1` and access slots via `arg1[-N]` indexing.
 ///
 /// This struct documents the layout for P-Code analysis and lifting.
-/// The frame is NOT stored in the PE file — it exists only at runtime.
+/// The frame is NOT stored in the PE file - it exists only at runtime.
 ///
 /// # Stack Layout (high to low addresses)
 ///
diff --git a/src/vb/projectdata.rs b/src/vb/projectdata.rs
index 7f51652..b9f2ea5 100644
--- a/src/vb/projectdata.rs
+++ b/src/vb/projectdata.rs
@@ -20,11 +20,11 @@ use crate::{
 /// | 0x00 | 4 | `dwVersion` (always 0x1F4 = VB 5.00) |
 /// | 0x04 | 4 | `lpObjectTable` (.text VA) |
 /// | 0x08 | 4 | Reserved (always 0) |
-/// | 0x0C | 4 | `lpCodeStart` (.text VA — start of native/P-Code region) |
-/// | 0x10 | 4 | `lpCodeEnd` (.text VA — end of code region) |
+/// | 0x0C | 4 | `lpCodeStart` (.text VA - start of native/P-Code region) |
+/// | 0x10 | 4 | `lpCodeEnd` (.text VA - end of code region) |
 /// | 0x14 | 4 | `dwDataSize` (size of VB object structures in bytes) |
-/// | 0x18 | 4 | `lpThreadSpace` (.data VA — per-object data area base) |
-/// | 0x1C | 4 | `lpVbaSeh` (.text VA — `__vbaExceptHandler` import thunk) |
+/// | 0x18 | 4 | `lpThreadSpace` (.data VA - per-object data area base) |
+/// | 0x1C | 4 | `lpVbaSeh` (.text VA - `__vbaExceptHandler` import thunk) |
 /// | 0x20 | 4 | `lpNativeCode` (.data VA; **0 = P-Code!**) |
 /// | 0x24 | 528 | `szPathInfo` (null-terminated VBP path; often zeroed in malware) |
 /// | 0x234 | 4 | `lpExternalTable` (.text VA) |
diff --git a/src/vb/projectinfo2.rs b/src/vb/projectinfo2.rs
index 94f1cce..f314afc 100644
--- a/src/vb/projectinfo2.rs
+++ b/src/vb/projectinfo2.rs
@@ -1,4 +1,4 @@
-//! ProjectInfo2 structure parser — COM dispatch interface metadata.
+//! ProjectInfo2 structure parser - COM dispatch interface metadata.
 //!
 //! The `ProjectInfo2` structure is pointed to by `ObjectTable.lpProjectInfo2`
 //! (+0x08). It contains COM type information for the project's forms and
@@ -151,12 +151,12 @@ impl<'a> InterfaceMetadata<'a> {
     /// VA of the typelib path string at offset 0x10.
     ///
     /// Points to a null-terminated ANSI path identifying the source typelib
-    /// for this interface — typically the path of the OCX/DLL whose typelib
+    /// for this interface - typically the path of the OCX/DLL whose typelib
     /// declares the dispatch interface (e.g. `"C:\Windows\System32\Comctl32.ocx"`).
     /// May be `0` for project-internal interfaces with no external typelib.
     ///
     /// Pair with [`typelib_guid_va`](Self::typelib_guid_va) to get the
-    /// typelib's CLSID — together they identify which DLL/OCX provides
+    /// typelib's CLSID - together they identify which DLL/OCX provides
     /// the type information for this interface (a supply-chain signal
     /// useful for malware triage).
     ///
@@ -449,7 +449,7 @@ fn extract_all_name_blocks(data: &[u8]) -> Vec<Vec<&str>> {
             continue;
         }
 
-        // Found a valid identifier — extract the full block
+        // Found a valid identifier - extract the full block
         let (block, end) = extract_name_block(data, pos);
         if !block.is_empty() {
             blocks.push(block);
diff --git a/src/vb/property.rs b/src/vb/property.rs
index 5ef58bc..a0e5036 100644
--- a/src/vb/property.rs
+++ b/src/vb/property.rs
@@ -31,9 +31,9 @@ const STD_DATA_FORMAT_MAGIC: u32 = 0x6B263850;
 /// `StdDataFormat` COM object from MSSTDFMT.DLL.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum DataFormatType {
-    /// General format — no special formatting applied.
+    /// General format - no special formatting applied.
     General = 0,
-    /// Number format — uses the format string for numeric display.
+    /// Number format - uses the format string for numeric display.
     Number = 1,
     /// Currency format.
     Currency = 2,
@@ -41,7 +41,7 @@ pub enum DataFormatType {
     ShortDate = 3,
     /// Long date format.
     LongDate = 4,
-    /// Custom format — fully user-defined via the format string.
+    /// Custom format - fully user-defined via the format string.
     /// When this type is active, TrueValue/FalseValue/NullValue
     /// VARIANT entries are also serialized.
     Custom = 5,
@@ -115,7 +115,7 @@ impl fmt::Display for DataFormatType {
 ///
 /// # Version History
 ///
-/// - `0x60000`: Original format — header + format string + custom values only.
+/// - `0x60000`: Original format - header + format string + custom values only.
 /// - `0x60001`: Adds FirstDayOfWeek trailer field.
 /// - `0x60002`: Adds FirstWeekOfYear trailer field (current/most common).
 #[derive(Debug, Clone)]
@@ -218,7 +218,7 @@ impl PropType {
 
 /// Returns the property name and type for a form binary property opcode.
 ///
-/// Property opcodes are **context-dependent** — the same index means different
+/// Property opcodes are **context-dependent** - the same index means different
 /// properties for different control types.
 ///
 /// Returns `None` for unknown opcodes.
@@ -642,7 +642,7 @@ fn parse_utf16_str(data: &[u8]) -> Option<(String, usize)> {
 /// A decoded property value from a form binary property stream.
 #[derive(Debug, Clone)]
 pub enum PropertyValue {
-    /// Flag-only — opcode emitted with no value data.
+    /// Flag-only - opcode emitted with no value data.
     Flag,
     /// Boolean/enum byte (1 byte).
     Byte(u8),
@@ -889,7 +889,7 @@ impl<'a> PropertyIter<'a> {
                 Some(PropertyValue::DataFormat(df))
             }
 
-            // Unknown ser_type — treat as flag
+            // Unknown ser_type - treat as flag
             _ => Some(PropertyValue::Flag),
         }
     }
@@ -906,7 +906,7 @@ impl<'a> Iterator for PropertyIter<'a> {
 
         let opcode_offset = self.pos;
 
-        // Known property — decode via ser_type dispatch
+        // Known property - decode via ser_type dispatch
         if let Some(desc) = property_descriptor(self.ctype, opcode) {
             self.pos = self.pos.checked_add(1)?; // consume opcode byte
             let value_offset = self.pos;
@@ -927,7 +927,7 @@ impl<'a> Iterator for PropertyIter<'a> {
             });
         }
 
-        // Unknown opcode — try lookahead to skip flag-like unknowns
+        // Unknown opcode - try lookahead to skip flag-like unknowns
         self.pos = self.pos.checked_add(1)?;
         if let Some(&next) = self.data.get(self.pos)
             && (next == 0xFF || property_info(self.ctype, next).is_some())
@@ -993,7 +993,7 @@ pub fn decode_form_type(
             FormControlType::UserControl
         }
         // Form and MDIForm gui types. UserDocument also uses Form gui type
-        // in practice — the Form table handles it correctly since the property
+        // in practice - the Form table handles it correctly since the property
         // streams overlap at common indices. The UserDocument table has additional
         // document-specific properties at indices 76+ (ScrollBars, Viewport, etc.)
         // that are only emitted for real UserDocument streams.
diff --git a/src/vb/publicbytes.rs b/src/vb/publicbytes.rs
index e2f4bf8..9d9b4d6 100644
--- a/src/vb/publicbytes.rs
+++ b/src/vb/publicbytes.rs
@@ -3,9 +3,9 @@
 //! The `PublicObjectDescriptor.public_bytes_va` field points to a structure
 //! that varies by object type:
 //!
-//! - **Standard modules (.bas)**: [`PublicVarTable`] — variable descriptor table
+//! - **Standard modules (.bas)**: [`PublicVarTable`] - variable descriptor table
 //!   with frame offsets and type codes for each public variable.
-//! - **Classes/Forms**: [`ClassFormPublicBytes`] — COM interface GUIDs, instance
+//! - **Classes/Forms**: [`ClassFormPublicBytes`] - COM interface GUIDs, instance
 //!   size, and runtime function stubs.
 //!
 //! Both formats share `+0x02` as a u16 read by `EbLoadRunTime` in the runtime.
@@ -17,17 +17,17 @@
 //!
 //! | Offset | Size | Field |
 //! |--------|------|-------|
-//! | 0x00 | 2 | `wTotalSize` — total byte size of the structure |
-//! | 0x02 | 2 | `wDataFrameSize` — instance data frame size in bytes |
+//! | 0x00 | 2 | `wTotalSize` - total byte size of the structure |
+//! | 0x02 | 2 | `wDataFrameSize` - instance data frame size in bytes |
 //! | 0x04 | 2 | Reserved (0) |
-//! | 0x06 | 2 | `wVarCount` — number of public variable descriptors |
+//! | 0x06 | 2 | `wVarCount` - number of public variable descriptors |
 //!
 //! After the 8-byte header, variable descriptors follow as 4-byte entries:
 //!
 //! | Offset | Size | Field |
 //! |--------|------|-------|
-//! | 0x00 | 2 | `wFrameOffset` — byte offset within the module's public data area |
-//! | 0x02 | 2 | `wTypeCode` — variable type (see below) |
+//! | 0x00 | 2 | `wFrameOffset` - byte offset within the module's public data area |
+//! | 0x02 | 2 | `wTypeCode` - variable type (see below) |
 //!
 //! # Known Type Codes
 //!
@@ -42,8 +42,8 @@
 //!
 //! Reverse-engineered from pe\_x86\_vb\_loader sample. The format is confirmed
 //! for standard modules (`mod_Variaveis`, `modUtil`). Class/form objects use
-//! a different format at the same VA — the per-instance member descriptor
-//! table — parsed by [`ClassFormPublicBytes`] and
+//! a different format at the same VA - the per-instance member descriptor
+//! table - parsed by [`ClassFormPublicBytes`] and
 //! [`controlprop`](super::controlprop) (member types and resource-cleanup
 //! classification verified against the runtime init/cleanup dispatchers).
 
@@ -64,10 +64,10 @@ use crate::{
 ///
 /// | Offset | Size | Field |
 /// |--------|------|-------|
-/// | 0x00 | 2 | `wTotalSize` — total byte size of the structure |
-/// | 0x02 | 2 | `wDataFrameSize` — instance data frame size in bytes (see below) |
-/// | 0x04 | 2 | `wExtraCount` — number of non-variable entries mixed in |
-/// | 0x06 | 2 | `wVarCount` — total entry count (includes extra entries) |
+/// | 0x00 | 2 | `wTotalSize` - total byte size of the structure |
+/// | 0x02 | 2 | `wDataFrameSize` - instance data frame size in bytes (see below) |
+/// | 0x04 | 2 | `wExtraCount` - number of non-variable entries mixed in |
+/// | 0x06 | 2 | `wVarCount` - total entry count (includes extra entries) |
 /// | 0x08 | 4 | Padding (always 0) |
 ///
 /// # Data Frame Size (+0x02)
@@ -202,7 +202,7 @@ impl<'a> PublicVarTable<'a> {
 /// # Available data
 ///
 /// Each entry is exactly 4 bytes: `frame_offset` (u16) + `type_code` (u16).
-/// There is **no per-entry name VA** in `PublicVarTable` — the runtime
+/// There is **no per-entry name VA** in `PublicVarTable` - the runtime
 /// (`EbLoadRunTime` at `0x6602F6CE`) reads only the table header for the
 /// instance-buffer size and never inspects entries for names.
 ///
@@ -336,10 +336,10 @@ impl Iterator for PublicVarIter<'_> {
 ///
 /// | Offset | Size | Field | Runtime reads? |
 /// |--------|------|-------|----------------|
-/// | 0x00 | 2 | `wDataSize` — compiler metadata (header size) | No |
-/// | 0x02 | 2 | `wInstanceSize` — per-object instance size in bytes | Yes |
-/// | 0x04 | 2 | `wPropertyCount` — property init entries in the array | Yes |
-/// | 0x06 | 2 | `wControlCount` — total control init entries | Yes |
+/// | 0x00 | 2 | `wDataSize` - compiler metadata (header size) | No |
+/// | 0x02 | 2 | `wInstanceSize` - per-object instance size in bytes | Yes |
+/// | 0x04 | 2 | `wPropertyCount` - property init entries in the array | Yes |
+/// | 0x06 | 2 | `wControlCount` - total control init entries | Yes |
 /// | 0x08 | 4 | Reserved / flags | No |
 /// | 0x0C | var | Control/property init entries (typed, variable-length) | Yes (when counts > 0) |
 ///
@@ -471,7 +471,7 @@ mod tests {
         0x00, 0x01, 0x00,
     ];
 
-    // Real data from modUtil — 1 public variable of type Long
+    // Real data from modUtil - 1 public variable of type Long
     const MOD_UTIL: [u8; 16] = [
         0x10, 0x00, 0x08, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03,
         0x00,
diff --git a/src/vb/varstub.rs b/src/vb/varstub.rs
index d5c64c1..ccac9d3 100644
--- a/src/vb/varstub.rs
+++ b/src/vb/varstub.rs
@@ -5,7 +5,7 @@
 //! descriptor that tells the compiler which VBA runtime helper functions
 //! implement the property Get/Let/Set accessors for a public variable.
 //!
-//! **Not read by MSVBVM60.DLL at runtime** — this is compiler/IDE metadata
+//! **Not read by MSVBVM60.DLL at runtime** - this is compiler/IDE metadata
 //! only. However, the data is present in compiled binaries and useful for
 //! understanding which runtime functions a variable depends on.
 //!
@@ -13,11 +13,11 @@
 //!
 //! | Offset | Size | Field |
 //! |--------|------|-------|
-//! | 0x00 | 2 | `wHeaderSize` — header bytes before name data (0x0C + params*4) |
-//! | 0x02 | 2 | `wDataSize` — size of name/data section after header |
+//! | 0x00 | 2 | `wHeaderSize` - header bytes before name data (0x0C + params*4) |
+//! | 0x02 | 2 | `wDataSize` - size of name/data section after header |
 //! | 0x04 | 2 | Reserved (zero) |
-//! | 0x06 | 2 | `wParamCount` — indexed property parameter count |
-//! | 0x08 | 2 | `wDataSize2` — copy of wDataSize |
+//! | 0x06 | 2 | `wParamCount` - indexed property parameter count |
+//! | 0x08 | 2 | `wDataSize2` - copy of wDataSize |
 //! | 0x0A | 1 | `bFlags1` |
 //! | 0x0B | 1 | `bFlags2` |
 //! | 0x0C | N×4 | Parameter descriptors: `[{u16 offset, u16 type}]` × wParamCount |