Escapes the fragment's tag literals in a piece of text so they cannot be mistaken for the real
trailing fragment. Applied to every non-system message in the OUTGOING copy of the history under
'trailingMessage' placement — user turns, action results, sub-agent results, anything the model or
an external source wrote — never to stored data, and never to the fragment itself.
This closes tag SPOOFING only. A model that follows imperative text inside a tool result will do so
with or without our tags (measured: Gemini 2.5 Flash/Pro obey; Claude Opus 5 refuses); that exposure
is pre-existing, layout-independent, and addressed structurally elsewhere.
Escapes the fragment's tag literals in a piece of text so they cannot be mistaken for the real trailing fragment. Applied to every non-system message in the OUTGOING copy of the history under
'trailingMessage'placement — user turns, action results, sub-agent results, anything the model or an external source wrote — never to stored data, and never to the fragment itself.This closes tag SPOOFING only. A model that follows imperative text inside a tool result will do so with or without our tags (measured: Gemini 2.5 Flash/Pro obey; Claude Opus 5 refuses); that exposure is pre-existing, layout-independent, and addressed structurally elsewhere.