fix: address concrete terminology review findings

scripts/verify-concrete-terms.spec.ts

@@ -1,5 +1,8 @@
+import { mkdtempSync, rmSync, symlinkSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
 import { describe, expect, it } from 'vitest'
-import { findConcreteTermViolations } from './verify-concrete-terms.ts'
+import { findConcreteTermViolations, readTrackedSource } from './verify-concrete-terms.ts'
 
 const blockedTerm = 'prove' + 'nance'
 
@@ -21,6 +24,27 @@ describe('concrete terminology policy', () => {
       .toEqual([{ file: 'packages/example/src/source.ts', line: 1 }])
   })
 
+  it('normalizes compatibility characters before scanning', () => {
+    const fullwidthTerm = blockedTerm.split('')
+      .map(character => String.fromCodePoint(character.charCodeAt(0) + 0xfee0))
+      .join('')
+    expect(findConcreteTermViolations('packages/example/src/source.ts', fullwidthTerm))
+      .toEqual([{ file: 'packages/example/src/source.ts', line: 1 }])
+  })
+
+  it.skipIf(process.platform === 'win32')('reads the target of a dangling tracked symlink', () => {
+    const repoRoot = mkdtempSync(join(tmpdir(), 'dsh-concrete-terms-'))
+    try {
+      symlinkSync(`../${blockedTerm}-target`, join(repoRoot, 'tracked-link'))
+      expect(findConcreteTermViolations(
+        'tracked-link',
+        readTrackedSource(repoRoot, 'tracked-link') ?? '',
+      )).toEqual([{ file: 'tracked-link', line: 1 }])
+    } finally {
+      rmSync(repoRoot, { recursive: true, force: true })
+    }
+  })
+
   it('accepts exact replacement terms', () => {
     expect(findConcreteTermViolations(
       'packages/example/src/origin.ts',

scripts/verify-concrete-terms.ts

@@ -1,7 +1,7 @@
 /** Reject one ambiguous origin label from maintained tracked files. */
 
 import { execFileSync } from 'node:child_process'
-import { existsSync, lstatSync, readFileSync, readlinkSync } from 'node:fs'
+import { lstatSync, readFileSync, readlinkSync } from 'node:fs'
 import { resolve } from 'node:path'
 import { pathToFileURL } from 'node:url'
 
@@ -55,10 +55,16 @@ function trackedFiles(repoRoot: string): string[] {
   return files
 }
 
-function readTrackedSource(repoRoot: string, file: string): string | undefined {
+/**
+ * Read one tracked file without following a symlink to its target.
+ * @param repoRoot - Repository root containing the tracked path.
+ * @param file - Repository-relative tracked path.
+ * @returns File text, the symlink target, or undefined when the path is absent or not a file.
+ */
+export function readTrackedSource(repoRoot: string, file: string): string | undefined {
   const path = resolve(repoRoot, file)
-  if (!existsSync(path)) return undefined
-  const stat = lstatSync(path)
+  const stat = lstatSync(path, { throwIfNoEntry: false })
+  if (stat === undefined) return undefined
   if (stat.isSymbolicLink()) return readlinkSync(path)
   return stat.isFile() ? readFileSync(path, 'utf8') : undefined
 }