@@ -39,7 +39,11 @@ Each release of Research-Kit, newest first. The version is `KIT_VERSION` in
   items, table cells and headings: `x &lt; 5 and y &gt; 2` had come out as `x 2`, and a link
   label inside an item lost everything from its `<` to the item's end, because the block
   pass decoded entities and the page-level pass then stripped the decoded `<...>` as a tag.
-  Entities are decoded once, at the end (output-reliability audit G3, 2026-10-03).
+  Entities are decoded once, at the end (output-reliability audit G3, 2026-10-03). The
+  review of that fix found a link's label still decoded on its own before the tag-stripping
+  pass, so `<a>limit &lt; 10 and burst &gt; 2</a>` in a paragraph came out `[limit 2](/x)`
+  and `&amp;lt;` was decoded twice; the label is no longer decoded apart, a `&nbsp;`-only
+  link is dropped in a list item as in a paragraph, and `&#38;lt;` decodes once, to `&lt;`.
 - A search provider whose `search()` throws is a failed search that says so (`<provider>
   threw: <message>`), degraded and recorded like any other, so the run and its accounting
   finish: re-thrown, it ended `research` and `decompose` mid-run, and the searches paid for
 
@@ -453,7 +453,7 @@ node research-kit/bin/selftest.mjs            # all of it
 node research-kit/bin/selftest.mjs gate hook  # just these files
 ```
 
-1547 tests, offline, no key and no network. The runner **awaits** every test, so `ok` means
+1548 tests, offline, no key and no network. The runner **awaits** every test, so `ok` means
 the assertions settled (ADR-0021), and each test is raced against a watchdog
 (`RESEARCH_KIT_TEST_TIMEOUT`, default 60s).
 
 
@@ -193,10 +193,14 @@ function codePoint(n) {
 
 export function decodeEntities(text) {
   const named = { amp: '&', lt: '<', gt: '>', quot: '"', apos: "'", nbsp: ' ', mdash: '—', ndash: '–', hellip: '…', rsquo: '’', lsquo: '‘', ldquo: '“', rdquo: '”' };
-  return String(text)
-    .replace(/&#x([0-9a-f]+);/gi, (_, hex) => codePoint(parseInt(hex, 16)))
-    .replace(/&#(\d+);/g, (_, dec) => codePoint(Number(dec)))
-    .replace(/&([a-z]+);/gi, (all, key) => named[key.toLowerCase()] ?? all);
+  // One pass over every reference kind at once: three passes in turn decoded `&#38;lt;` to
+  // `&lt;` and then to `<`, so a page spelling an ampersand numerically was read twice
+  // (found 2026-10-03, review of the G3 fix).
+  return String(text).replace(/&(#x[0-9a-f]+|#\d+|[a-z]+);/gi, (all, ref) => {
+    if (/^#x/i.test(ref)) return codePoint(parseInt(ref.slice(2), 16));
+    if (ref[0] === '#') return codePoint(Number(ref.slice(1)));
+    return named[ref.toLowerCase()] ?? all;
+  });
 }
 
 /**
@@ -334,13 +338,16 @@ const LINK = { open: /<a\b/gi, tag: { find: /href=/gi, match: /href=["']([^"']*)
 /**
  * Inline markup to Markdown. `decode: false` leaves entities as written, for a body that a
  * later pass will strip tags from and decode (the block passes above); the page-level pass
- * decodes once.
+ * decodes once. A link's label is never decoded on its own: the tag-stripping pass below
+ * runs over it afterwards, and a `<` decoded first was read there as a tag (`[limit 2](/x)`
+ * for `limit &lt; 10 and burst &gt; 2`, in a paragraph; found 2026-10-03, review of the G3
+ * fix). Its emptiness is judged on the decoded text, so `&nbsp;` alone is as empty as a space.
  */
 function inline(html, { decode = true } = {}) {
   const finish = (text) => (decode ? decodeEntities(text) : text);
   let text = replacePairs(String(html), LINK, (p) => {
-    const label = finish(stripTags(p.body, '').text).trim();
-    return label ? `[${label}](${p.tag[1]})` : '';
+    const label = stripTags(p.body, '').text.trim();
+    return decodeEntities(label).trim() ? `[${label}](${p.tag[1]})` : '';
   });
   text = replacePairs(text, named('strong|b'), (p) => `**${p.body}**`);
   text = replacePairs(text, named('em|i'), (p) => `*${p.body}*`);
 
@@ -16,10 +16,12 @@ function codePoint(n) {
 
 export function decodeEntities(text) {
   const named = { amp: '&', lt: '<', gt: '>', quot: '"', apos: "'", nbsp: ' ', mdash: '—', ndash: '–', hellip: '…', rsquo: '’', lsquo: '‘', ldquo: '“', rdquo: '”' };
-  return String(text)
-    .replace(/&#x([0-9a-f]+);/gi, (_, hex) => codePoint(parseInt(hex, 16)))
-    .replace(/&#(\d+);/g, (_, dec) => codePoint(Number(dec)))
-    .replace(/&([a-z]+);/gi, (all, key) => named[key.toLowerCase()] ?? all);
+  // One pass, like the converter (2026-10-03): `&#38;lt;` is the text `&lt;`, decoded once.
+  return String(text).replace(/&(#x[0-9a-f]+|#\d+|[a-z]+);/gi, (all, ref) => {
+    if (/^#x/i.test(ref)) return codePoint(parseInt(ref.slice(2), 16));
+    if (ref[0] === '#') return codePoint(Number(ref.slice(1)));
+    return named[ref.toLowerCase()] ?? all;
+  });
 }
 
 /**
@@ -149,8 +151,8 @@ function inline(html, { decode = true } = {}) {
   return finish(
     String(html)
       .replace(/<a\b[^>]*href=["']([^"']*)["'][^>]*>([\s\S]*?)<\/a>/gi, (_, href, body) => {
-        const label = finish(body.replace(/<[^>]+>/g, '')).trim();
-        return label ? `[${label}](${href})` : '';
+        const label = body.replace(/<[^>]+>/g, '').trim();
+        return decodeEntities(label).trim() ? `[${label}](${href})` : '';
       })
       .replace(/<(strong|b)\b[^>]*>([\s\S]*?)<\/\1>/gi, '**$2**')
       .replace(/<(em|i)\b[^>]*>([\s\S]*?)<\/\1>/gi, '*$2*')
 
@@ -310,6 +310,29 @@ test('an entity inside a link label, bold text or code in a list item is decoded
   assert.equal(httpKeyless.htmlToMarkdown('<li>&amp;lt;b&amp;gt;</li>'), '- &lt;b&gt;');
 });
 
+// Found 2026-10-03 (review of the G3 fix): the G3 change left the page-level pass decoding
+// a link's label INSIDE the link pass, before the tag-stripping pass that follows it. So a
+// link in a paragraph or a div - the one place G3's test did not look - still lost its
+// comparison text (`[limit 2](/x)`) and still double-decoded `&amp;lt;`. The label is never
+// decoded on its own: entities are decoded once, at the end, wherever the link stands.
+test('comparison text inside a link label in a paragraph or a div survives, decoded once', () => {
+  assert.equal(httpKeyless.htmlToMarkdown('<p>See <a href="/x">limit &lt; 10 and burst &gt; 2</a> now.</p>'),
+    'See [limit < 10 and burst > 2](/x) now.');
+  assert.equal(httpKeyless.htmlToMarkdown('<div>See <a href="/x">limit &lt; 10</a> now.</div>'), 'See [limit < 10](/x) now.');
+  assert.equal(httpKeyless.htmlToMarkdown('<p><a href="/x">a &amp;lt; b</a></p>'), '[a &lt; b](/x)');
+  // A label that is only `&nbsp;` is as empty as one that is only a space, in a list item as
+  // in a paragraph: the link is dropped in both, so a page's blank icon links do not become
+  // `[ ](/x)` in its bulleted text.
+  const blank = httpKeyless.htmlToMarkdown('<ul><li><a href="/x">&nbsp;</a> item</li></ul><p><a href="/y">&nbsp;</a> para</p>');
+  assert.match(blank, /^- item$/m, 'the list item keeps its text and drops the blank link');
+  assert.match(blank, /^ ?para$/m, 'the paragraph the same');
+  assert.doesNotMatch(blank, /\[ *\]\(/, 'no empty link survives anywhere');
+  // A numeric reference that spells an ampersand is decoded once too: `&#38;lt;` is the text
+  // `&lt;`, not `<`.
+  assert.equal(httpKeyless.decodeEntities('&#38;lt; &#x26;gt; &amp;amp;'), '&lt; &gt; &amp;');
+  assert.equal(httpKeyless.htmlToMarkdown('<p>&#38;lt;b&#38;gt;</p>'), '&lt;b&gt;');
+});
+
 test('a page that marks its content with <main> is believed over a denser fragment', () => {
   // Found 2026-09-27: on a GitHub Docs page the keyless extractor kept the 262-character
   // summary and dropped the 17,385-character <main> around it - words-per-tag favours a