diff --git a/docs/development/agent-workflow.md b/docs/development/agent-workflow.md
index f3e77705a..891a2e27b 100644
--- a/docs/development/agent-workflow.md
+++ b/docs/development/agent-workflow.md
@@ -58,7 +58,9 @@ Rendered HTML anchor hrefs and image sources use the same local-reference checks
as Markdown links, including decoded attributes and fragment validation.
Image references check file existence without interpreting image fragments as
Markdown headings; document links keep anchor checks even when sharing a target.
-HTML video, audio and source `src` assets use the same existence checks as images.
+HTML video, audio, source and track `src` assets and video posters use the same
+existence checks as images. Entity decoding uses full HTML text/attribute rules,
+including references whose semicolon may be omitted.
Inline guidance imports are rejected after punctuation as well as whitespace.
Declared scoped dependencies, scope wildcards and matching TypeScript path aliases
are recognized as package/alias mentions. Traversal and document-file imports are
diff --git a/tools/skills/agent-guidance-markdown.mjs b/tools/skills/agent-guidance-markdown.mjs
index 860824136..089b0ba53 100644
--- a/tools/skills/agent-guidance-markdown.mjs
+++ b/tools/skills/agent-guidance-markdown.mjs
@@ -45,11 +45,15 @@ function inlineText(tokens) {
.join('');
}
-function decodeEntities(text) {
- return text.replace(
- /&(?:#(?:x[0-9a-f]+|[0-9]+)|[a-z][a-z0-9]+);/giu,
- (entity) => parseFragment(entity).childNodes[0]?.value ?? entity
- );
+function decodeEntities(text, attribute = false) {
+ if (attribute) {
+ const html = ``;
+ return parseFragment(html).childNodes[0].attrs[0].value;
+ }
+ // RCDATA decodes the full HTML character-reference grammar without
+ // interpreting literal tags. The prefix preserves an initial newline.
+ const html = `