Detect encoded placeholder anchors and unblock Chat continuation

frontend/taskdeck-web/src/api/chatApi.ts

@@ -13,8 +13,8 @@ export const chatApi = {
     return data
   },
 
-  async getSession(sessionId: string): Promise<ChatSession> {
-    const { data } = await http.get<ChatSession>(`/llm/chat/sessions/${encodeURIComponent(sessionId)}`)
+  async getSession(sessionId: string, options?: { skipRetry?: boolean }): Promise<ChatSession> {
+    const { data } = await http.get<ChatSession>(`/llm/chat/sessions/${encodeURIComponent(sessionId)}`, options)
     return data
   },
 

frontend/taskdeck-web/src/composables/useAutomationChat.ts

@@ -284,7 +284,9 @@ export function useAutomationChat() {
 
   async function refreshSelectedSession(sessionId: string) {
     try {
-      const result = await chatApi.getSession(sessionId)
+      // The send already succeeded and its messages are retained locally. A
+      // failed reconciliation must not hold continuation behind read retries.
+      const result = await chatApi.getSession(sessionId, { skipRetry: true })
       if (isDisposed || requestedSessionId !== sessionId || selectedSession.value?.id !== sessionId) return
       localMessagesBySession.delete(sessionId)
       sessionWriteGenerations.set(sessionId, (sessionWriteGenerations.get(sessionId) ?? 0) + 1)

frontend/taskdeck-web/src/tests/api/chatApi.spec.ts

@@ -43,6 +43,14 @@ describe('chatApi', () => {
     })
   })
 
+  it('can fail fast for a post-send reconciliation read', async () => {
+    const failure = new Error('Refresh unavailable')
+    vi.mocked(http.get).mockRejectedValue(failure)
+
+    await expect(chatApi.getSession('session/1', { skipRetry: true })).rejects.toBe(failure)
+    expect(http.get).toHaveBeenCalledWith('/llm/chat/sessions/session%2F1', { skipRetry: true })
+  })
+
   it('loads provider health', async () => {
     const healthPayload = {
       isAvailable: true,

frontend/taskdeck-web/src/tests/composables/useAutomationChat.spec.ts

@@ -544,6 +544,9 @@ describe('useAutomationChat', () => {
       chat.messageContent.value = 'new instruction'
       await chat.handleSendMessage()
 
+      expect(chatApiMocks.getSession).toHaveBeenNthCalledWith(1, 's1')
+      expect(chatApiMocks.getSession).toHaveBeenLastCalledWith('s1', { skipRetry: true })
+      expect(chat.sendingMessage.value).toBe(false)
       expect(chat.selectedSession.value?.recentMessages.map((message) => message.content)).toEqual([
         'older instruction',
         'No board linked',

frontend/taskdeck-web/src/tests/guards/deadAnchors.spec.ts

@@ -19,8 +19,8 @@ import { baseParse, ElementTypes, NodeTypes, parserOptions } from '@vue/compiler
  * WHAT THIS DOES NOT MECHANIZE. The dogfooding pass that produced GH-1932 and
  * GH-1934 found dead affordances of several other shapes; this guard does not
  * cover them, and passing it is not evidence that they are gone:
- *  - HTML-entity or control-character obfuscation of a scheme
- *    (`href="javascript:..."`) is not decoded, so it is not detected.
+ *  - Control characters inside a scheme are not normalized. Static href HTML
+ *    entities are decoded once by Vue's parser; bound expressions remain raw.
  *  - Runtime-assembled hrefs and dynamic event names are out of reach: this
  *    guard reads SFC source, not Vue's rendered event table.
  *  - Button action hidden behind a runtime-bound `:type` is not inferred.
@@ -337,7 +337,8 @@ function markupOnly(source: string): string {
 
 /** True when any href on `tag` is the bare `#` placeholder, statically or inside a bound expression. */
 function hasPlaceholderHref(tag: string): boolean {
-  for (const [, binding, , value] of tag.matchAll(HREF_ATTR)) {
+  for (const [, binding, quote, rawValue] of tag.matchAll(HREF_ATTR)) {
+    let value = rawValue
     // A bound href's value is a JS expression: a bare `#` literal anywhere in
     // it is the placeholder, however it is reached (`dead ?? '#'`).
     if (binding) {
@@ -350,6 +351,14 @@ function hasPlaceholderHref(tag: string): boolean {
       if (JAVASCRIPT_SCHEME_LITERAL.test(value)) return true
       continue
     }
+    // Use the same attribute decoding as Vue, preserving the source delimiter.
+    // Parsing the isolated attribute also avoids interpreting decoded text as
+    // markup or recursively decoding a literal entity such as s.
+    const element = baseParse(`<a href=${quote}${rawValue}${quote}></a>`, parserOptions).children[0]
+    if (element?.type === NodeTypes.ELEMENT) {
+      const href = element.props[0]
+      if (href?.type === NodeTypes.ATTRIBUTE && href.value) value = href.value.content
+    }
     // A static href's value IS the URL. `#` alone is the placeholder;
     // `#section-id` is a real in-page target and must survive.
     if (value.trim() === '#') return true
@@ -780,6 +789,24 @@ describe('dead affordances', () => {
     expect(findDeadAnchors('<template>\n<a\n  href="#"\n  class="x"\n>Dead</a>\n</template>')).toHaveLength(1)
   })
 
+  it('detects entity-encoded static placeholder hrefs without decoding twice', () => {
+    for (const href of [
+      'java&#115;cript:void(0)',
+      'java&#x73;cript:void(0)',
+      'javascript&colon;void(0)',
+      '&#35;',
+    ]) {
+      const source = `<template><a href="${href}">Open details</a></template>`
+      expect(findDeadAnchors(source), href).toHaveLength(1)
+    }
+    for (const href of ['/search?q=a&amp;b=c', '&#35;details', 'java&amp;#115;cript:void(0)']) {
+      expect(findDeadAnchors(`<template><a href="${href}">Navigate</a></template>`), href).toEqual([])
+    }
+    expect(
+      findDeadAnchors('<template><a href="&#35;" @click.prevent="open">Open</a></template>'),
+    ).toEqual([])
+  })
+
   it('detects empty and javascript: placeholder hrefs', () => {
     // GH-1949 residuals. Both shapes were named as uncovered in this guard's
     // own header from 2026-08-23 until this slice; neither exists in src/.

frontend/taskdeck-web/src/tests/store/chatApi.integration.spec.ts

@@ -158,15 +158,15 @@ describe('chatApi — integration (mocked HTTP)', () => {
       expect(result.recentMessages).toHaveLength(2)
       expect(result.recentMessages[0].role).toBe('User')
       expect(result.recentMessages[1].role).toBe('Assistant')
-      expect(http.get).toHaveBeenCalledWith('/llm/chat/sessions/session-1')
+      expect(http.get).toHaveBeenCalledWith('/llm/chat/sessions/session-1', undefined)
     })
 
     it('URL-encodes special characters in the session ID', async () => {
       vi.mocked(http.get).mockResolvedValue({ data: makeChatSession({ id: 'session/special' }) })
 
       await chatApi.getSession('session/special')
 
-      expect(http.get).toHaveBeenCalledWith('/llm/chat/sessions/session%2Fspecial')
+      expect(http.get).toHaveBeenCalledWith('/llm/chat/sessions/session%2Fspecial', undefined)
     })
 
     it('propagates 404 when session does not exist', async () => {