Text from outside the model (the user's message, every tool result, and the memory block) is neutralised the moment it is first logged, so every later request replays the same bytes and a tag in that text cannot reach the model as one of its own control tokens. The model's own output, replay, and the system prompt are left byte-for-byte. Co-Authored-By: ornith-1.5-35b-a3b <agent@wntrmute.dev>