protolabsai-protoagent-302-304

diff --git a/graph/output_format.py b/graph/output_format.py
index 79cc3fc..ebd472f 100644
--- a/graph/output_format.py
+++ b/graph/output_format.py
@@ -67,6 +67,51 @@ Optionally, after `</output>`, you may self-report confidence:
 
 
 _OUTPUT_RE = re.compile(r"<output>([\s\S]*?)</output>", re.IGNORECASE)
+
+
+def _mask_backtick_code(text: str) -> str:
+    """Return *text* with Markdown inline-code spans replaced by spaces.
+
+    Protocol markers are often discussed in prose as ```<output>```.  Those
+    markers are content, not protocol.  Masking (rather than deleting) keeps
+    regex match offsets usable against the original text.  An unmatched
+    backtick is treated as opening a span as well; this is conservative for
+    streaming, where the closing backtick may arrive in a later chunk.
+    """
+    chars = list(text)
+    i = 0
+    while i < len(text):
+        if text[i] != "`":
+            i += 1
+            continue
+        end = i
+        while end < len(text) and text[end] == "`":
+            end += 1
+        run = text[i:end]
+        close = text.find(run, end)
+        if close < 0:
+            close = len(text)
+        for pos in range(i, min(close + len(run), len(text))):
+            if chars[pos] != "\n":
+                chars[pos] = " "
+        i = min(close + len(run), len(text))
+    return "".join(chars)
+
+
+def _search_outside_code(pattern: re.Pattern[str], text: str) -> re.Match[str] | None:
+    """Search for a protocol pattern while ignoring Markdown code spans."""
+    masked = _mask_backtick_code(text)
+    return pattern.search(masked)
+
+
+def _sub_outside_code(pattern: re.Pattern[str], text: str, repl: str = "") -> str:
+    """Apply a protocol substitution only to markers outside code spans."""
+    masked = _mask_backtick_code(text)
+    matches = list(pattern.finditer(masked))
+    for match in reversed(matches):
+        text = text[:match.start()] + repl + text[match.end():]
+    return text
+
 _SCRATCH_RE = re.compile(r"<scratch_pad>[\s\S]*?</scratch_pad>", re.IGNORECASE)
 _ORPHAN_SCRATCH_OPEN_RE = re.compile(r"<scratch_pad>[\s\S]*$", re.IGNORECASE)
 _THINK_RE = re.compile(r"<think>[\s\S]*?</think>", re.IGNORECASE)
@@ -89,15 +134,15 @@ def _strip_reasoning(text: str) -> str:
     Idempotent — real user content should never contain literal tag
     markers, so applying this twice is safe.
     """
-    text = _THINK_RE.sub("", text)
-    text = _ORPHAN_THINK_OPEN_RE.sub("", text)
-    text = _ORPHAN_THINK_CLOSE_RE.sub("", text)
-    text = _SCRATCH_RE.sub("", text)
-    text = _ORPHAN_SCRATCH_OPEN_RE.sub("", text)
+    text = _sub_outside_code(_THINK_RE, text)
+    text = _sub_outside_code(_ORPHAN_THINK_OPEN_RE, text)
+    text = _sub_outside_code(_ORPHAN_THINK_CLOSE_RE, text)
+    text = _sub_outside_code(_SCRATCH_RE, text)
+    text = _sub_outside_code(_ORPHAN_SCRATCH_OPEN_RE, text)
     # Confidence tags ride a DataPart, never the user-facing text. Strip them
     # in case the model emits them inside (or right after) <output>.
-    text = _CONFIDENCE_EXPL_BLOCK_RE.sub("", text)
-    text = _CONFIDENCE_BLOCK_RE.sub("", text)
+    text = _sub_outside_code(_CONFIDENCE_EXPL_BLOCK_RE, text)
+    text = _sub_outside_code(_CONFIDENCE_BLOCK_RE, text)
     return text
 
 
@@ -120,17 +165,18 @@ def stream_visible_output(raw: str) -> str:
     as ``raw`` grows, the result only ever extends (until ``</output>`` closes
     it), so a caller can emit ``result[already_emitted:]`` each step.
     """
-    low = raw.lower()
+    masked = _mask_backtick_code(raw)
+    low = masked.lower()
     start = low.find("<output>")
     if start == -1:
         return ""  # still in scratch_pad — nothing user-facing yet
     after = raw[start + len("<output>") :]
-    close = after.lower().find("</output>")
+    close = _mask_backtick_code(after).lower().find("</output>")
     if close != -1:
         after = after[:close]
     # Strip provider reasoning that can appear inside the output region.
-    after = _THINK_RE.sub("", after)
-    after = _ORPHAN_THINK_OPEN_RE.sub("", after)
+    after = _sub_outside_code(_THINK_RE, after)
+    after = _sub_outside_code(_ORPHAN_THINK_OPEN_RE, after)
     # Hold back a partial trailing tag ("</outp", "<conf", a lone "<") so it
     # never flashes; the terminal replace delivers the full, clean text.
     lt = after.rfind("<")
@@ -181,16 +227,24 @@ def extract_output(text: str) -> str:
         return ""
 
     # 1. Closed <output>...</output>
-    m = _OUTPUT_RE.search(text)
+    m = _search_outside_code(_OUTPUT_RE, text)
     if m:
-        cleaned = _strip_reasoning(m.group(1)).strip()
+        # The match was located in the masked copy, so its offsets still point
+        # at the corresponding original content.  Slice by the fixed marker
+        # lengths rather than searching the original text again: prose inside
+        # the block may contain an earlier literal ``</output>``.
+        cleaned = _strip_reasoning(
+            text[m.start() + len("<output>") : m.end() - len("</output>")]
+        ).strip()
         if cleaned:
             return cleaned
 
     # 2. Orphan <output> opener (max_tokens truncation mid-output).
-    orphan = _ORPHAN_OUTPUT_OPEN_RE.search(text)
+    orphan = _search_outside_code(_ORPHAN_OUTPUT_OPEN_RE, text)
     if orphan:
-        cleaned = _strip_reasoning(orphan.group(1)).strip()
+        cleaned = _strip_reasoning(
+            text[orphan.start() + len("<output>") :]
+        ).strip()
         if cleaned:
             return cleaned
 
@@ -227,7 +281,9 @@ def is_dropped_scratch_turn(text: str) -> bool:
     """
     if not text:
         return False
-    lower = text.lower()
+    # A prose explanation such as ``The tag `<output>` means...`` is not a
+    # committed output block and must not prevent dropped-turn recovery.
+    lower = _mask_backtick_code(text).lower()
     if "<scratch_pad>" not in lower and "<think>" not in lower:
         return False
     return "<output>"
… [13 more characters]

diff --git a/graph/output_format.py b/graph/output_format.py
index 79cc3fc..f8b3a11 100644
--- a/graph/output_format.py
+++ b/graph/output_format.py
@@ -66,7 +66,62 @@ Optionally, after `</output>`, you may self-report confidence:
 """.strip()
 
 
-_OUTPUT_RE = re.compile(r"<output>([\s\S]*?)</output>", re.IGNORECASE)
+def _backtick_mask(text: str) -> list[bool]:
+    """Return the characters covered by paired Markdown backtick spans.
+
+    Protocol tags are often quoted in prose as ``<output>``.  A regexp cannot
+    distinguish those from the protocol, so mark paired backtick runs first.
+    Matching the run length also keeps fenced code (and double-backtick spans)
+    from becoming protocol markers.
+    """
+    mask = [False] * len(text)
+    runs = [(m.start(), m.end(), len(m.group(0)))
+            for m in re.finditer(r"`+", text)]
+    i = 0
+    while i < len(runs):
+        start, end, width = runs[i]
+        mate = next((j for j in range(i + 1, len(runs))
+                     if runs[j][2] == width), None)
+        if mate is None:
+            # While a response is still streaming, a code span may have its
+            # closing backtick in a later chunk.  Treat the unfinished span
+            # as quoted now, rather than briefly exposing its tag as a
+            # delimiter.
+            for pos in range(start, len(text)):
+                mask[pos] = True
+            i += 1
+            continue
+        _, mate_end, _ = runs[mate]
+        for pos in range(start, mate_end):
+            mask[pos] = True
+        i = mate + 1
+    return mask
+
+
+def _find_tag(text: str, name: str, start: int = 0, closing: bool = False) -> int:
+    """Find a genuine protocol tag, ignoring tags inside backtick spans."""
+    token = f"</{name}>" if closing else f"<{name}>"
+    mask = _backtick_mask(text)
+    pattern = re.compile(re.escape(token), re.IGNORECASE)
+    for match in pattern.finditer(text, start):
+        if not mask[match.start()]:
+            return match.start()
+    return -1
+
+
+def _strip_protocol_blocks(text: str, name: str) -> str:
+    """Strip genuine ``<name>...</name>`` blocks and orphaned openings."""
+    while True:
+        opening = _find_tag(text, name)
+        if opening < 0:
+            break
+        body_start = opening + len(name) + 2
+        closing = _find_tag(text, name, body_start, closing=True)
+        end = len(text) if closing < 0 else closing + len(name) + 3
+        text = text[:opening] + text[end:]
+    return text
+
+
 _SCRATCH_RE = re.compile(r"<scratch_pad>[\s\S]*?</scratch_pad>", re.IGNORECASE)
 _ORPHAN_SCRATCH_OPEN_RE = re.compile(r"<scratch_pad>[\s\S]*$", re.IGNORECASE)
 _THINK_RE = re.compile(r"<think>[\s\S]*?</think>", re.IGNORECASE)
@@ -83,21 +138,18 @@ _CONFIDENCE_EXPLANATION_RE = re.compile(
 
 
 def _strip_reasoning(text: str) -> str:
-    """Remove all reasoning markers (``<think>``, ``<scratch_pad>``, and
-    orphaned variants) from a complete response.
-
-    Idempotent — real user content should never contain literal tag
-    markers, so applying this twice is safe.
-    """
-    text = _THINK_RE.sub("", text)
-    text = _ORPHAN_THINK_OPEN_RE.sub("", text)
-    text = _ORPHAN_THINK_CLOSE_RE.sub("", text)
-    text = _SCRATCH_RE.sub("", text)
-    text = _ORPHAN_SCRATCH_OPEN_RE.sub("", text)
-    # Confidence tags ride a DataPart, never the user-facing text. Strip them
-    # in case the model emits them inside (or right after) <output>.
-    text = _CONFIDENCE_EXPL_BLOCK_RE.sub("", text)
-    text = _CONFIDENCE_BLOCK_RE.sub("", text)
+    """Remove genuine provider reasoning/protocol blocks, not quoted tags."""
+    text = _strip_protocol_blocks(text, "think")
+    text = _strip_protocol_blocks(text, "scratch_pad")
+    # An orphaned closing think tag was historically discarded too.
+    while True:
+        pos = _find_tag(text, "think", closing=True)
+        if pos < 0:
+            break
+        text = text[:pos] + text[pos + len("</think>"):]
+    # Confidence tags ride a DataPart, never the user-facing text.
+    text = _strip_protocol_blocks(text, "confidence_explanation")
+    text = _strip_protocol_blocks(text, "confidence")
     return text
 
 
@@ -120,17 +172,15 @@ def stream_visible_output(raw: str) -> str:
     as ``raw`` grows, the result only ever extends (until ``</output>`` closes
     it), so a caller can emit ``result[already_emitted:]`` each step.
     """
-    low = raw.lower()
-    start = low.find("<output>")
+    start = _find_tag(raw, "output")
     if start == -1:
         return ""  # still in scratch_pad — nothing user-facing yet
-    after = raw[start + len("<output>") :]
-    close = after.lower().find("</output>")
-    if close != -1:
-        after = after[:close]
-    # Strip provider reasoning that can appear inside the output region.
-    after = _THINK_RE.sub("", after)
-    after = _ORPHAN_THINK_OPEN_RE.sub("", after)
+    after_start = start + len("<output>")
+    close = _find_tag(raw, "output", after_start, closing=True)
+    after = raw[after_start:] if close == -1 else raw[after_start:close]
+    # Strip provider reasoning that can appear inside the output region,
+    # while retaining quoted (backtick-wrapped) tag examples.
+    after = _strip_protocol_blocks(after, "think")
     # Hold back a partial trailing tag ("</outp", "<conf", a lone "<") so it
     # never flashes; the terminal replace delivers the full, clean text.
     lt = after.rfind("<")
@@ -180,17 +230,14 @@ def extract_output(text: str) -> str:
     if not text or not text.strip():
         return ""
 
-    # 1. Closed <output>...</output>
-    m = _OUTPUT_RE.search(text)
-    if m:
-        cleaned = _strip_reasoning(m.group(1)).strip()
-        if cleaned:
-            return cleaned
-
-    # 2. Orphan <output> opener (max_tokens truncation mid-output).
-    orphan = _ORPHAN_OUTPUT_OPEN_RE.search(text)
-    if orphan:
-        cleaned = _strip_reasoning(orphan.group(1)).strip()
+    # 1. Closed <ou
… [453 more characters]

diff --git a/graph/output_format.py b/graph/output_format.py
index 79cc3fc..20ff84a 100644
--- a/graph/output_format.py
+++ b/graph/output_format.py
@@ -82,6 +82,58 @@ _CONFIDENCE_EXPLANATION_RE = re.compile(
 )
 
 
+def _code_spans(text: str) -> list[tuple[int, int]]:
+    """Return Markdown code-span ranges (the contents of backticks).
+
+    Models commonly explain this protocol with inline code such as
+    ``<output>``.  Those mentions are prose, not protocol markers.  Matching
+    the length of the opening backtick run also handles Markdown's double
+    backticks without treating a backtick inside the span as its terminator.
+    """
+    spans: list[tuple[int, int]] = []
+    i = 0
+    while i < len(text):
+        if text[i] != "`":
+            i += 1
+            continue
+        start = i
+        while i < len(text) and text[i] == "`":
+            i += 1
+        width = i - start
+        closing = text.find("`" * width, i)
+        if closing == -1:
+            spans.append((start, len(text)))
+            break
+        spans.append((start, closing + width))
+        i = closing + width
+    return spans
+
+
+def _outside_code(position: int, spans: list[tuple[int, int]]) -> bool:
+    return not any(start <= position < end for start, end in spans)
+
+
+def _find_protocol_tag(text: str, tag: str, start: int = 0) -> int:
+    """Find *tag* outside Markdown inline-code spans, or return ``-1``."""
+    spans = _code_spans(text)
+    pattern = re.compile(re.escape(tag), re.IGNORECASE)
+    for match in pattern.finditer(text, start):
+        if _outside_code(match.start(), spans):
+            return match.start()
+    return -1
+
+
+def _replace_outside_code(text: str, pattern: re.Pattern[str], replacement: str) -> str:
+    """Apply a protocol regex only when its opening marker is not in code."""
+    spans = _code_spans(text)
+    return pattern.sub(
+        lambda match: replacement
+        if _outside_code(match.start(), spans)
+        else match.group(0),
+        text,
+    )
+
+
 def _strip_reasoning(text: str) -> str:
     """Remove all reasoning markers (``<think>``, ``<scratch_pad>``, and
     orphaned variants) from a complete response.
@@ -89,15 +141,15 @@ def _strip_reasoning(text: str) -> str:
     Idempotent — real user content should never contain literal tag
     markers, so applying this twice is safe.
     """
-    text = _THINK_RE.sub("", text)
-    text = _ORPHAN_THINK_OPEN_RE.sub("", text)
-    text = _ORPHAN_THINK_CLOSE_RE.sub("", text)
-    text = _SCRATCH_RE.sub("", text)
-    text = _ORPHAN_SCRATCH_OPEN_RE.sub("", text)
+    text = _replace_outside_code(text, _THINK_RE, "")
+    text = _replace_outside_code(text, _ORPHAN_THINK_OPEN_RE, "")
+    text = _replace_outside_code(text, _ORPHAN_THINK_CLOSE_RE, "")
+    text = _replace_outside_code(text, _SCRATCH_RE, "")
+    text = _replace_outside_code(text, _ORPHAN_SCRATCH_OPEN_RE, "")
     # Confidence tags ride a DataPart, never the user-facing text. Strip them
     # in case the model emits them inside (or right after) <output>.
-    text = _CONFIDENCE_EXPL_BLOCK_RE.sub("", text)
-    text = _CONFIDENCE_BLOCK_RE.sub("", text)
+    text = _replace_outside_code(text, _CONFIDENCE_EXPL_BLOCK_RE, "")
+    text = _replace_outside_code(text, _CONFIDENCE_BLOCK_RE, "")
     return text
 
 
@@ -120,17 +172,17 @@ def stream_visible_output(raw: str) -> str:
     as ``raw`` grows, the result only ever extends (until ``</output>`` closes
     it), so a caller can emit ``result[already_emitted:]`` each step.
     """
-    low = raw.lower()
-    start = low.find("<output>")
+    start = _find_protocol_tag(raw, "<output>")
     if start == -1:
         return ""  # still in scratch_pad — nothing user-facing yet
-    after = raw[start + len("<output>") :]
-    close = after.lower().find("</output>")
+    after_start = start + len("<output>")
+    close = _find_protocol_tag(raw, "</output>", after_start)
+    after = raw[after_start:]
     if close != -1:
-        after = after[:close]
+        after = raw[after_start:close]
     # Strip provider reasoning that can appear inside the output region.
-    after = _THINK_RE.sub("", after)
-    after = _ORPHAN_THINK_OPEN_RE.sub("", after)
+    after = _replace_outside_code(after, _THINK_RE, "")
+    after = _replace_outside_code(after, _ORPHAN_THINK_OPEN_RE, "")
     # Hold back a partial trailing tag ("</outp", "<conf", a lone "<") so it
     # never flashes; the terminal replace delivers the full, clean text.
     lt = after.rfind("<")
@@ -180,17 +232,20 @@ def extract_output(text: str) -> str:
     if not text or not text.strip():
         return ""
 
-    # 1. Closed <output>...</output>
-    m = _OUTPUT_RE.search(text)
-    if m:
-        cleaned = _strip_reasoning(m.group(1)).strip()
-        if cleaned:
-            return cleaned
+    # 1. Closed <output>...</output>.  Do not let Markdown code examples
+    # masquerade as either boundary.
+    start = _find_protocol_tag(text, "<output>")
+    if start != -1:
+        content_start = start + len("<output>")
+        close = _find_protocol_tag(text, "</output>", content_start)
+        if close != -1:
+            cleaned = _strip_reasoning(text[content_start:close]).strip()
+            if cleaned:
+                return cleaned
 
     # 2. Orphan <output> opener (max_tokens truncation mid-output).
-    orphan = _ORPHAN_OUTPUT_OPEN_RE.search(text)
-    if orphan:
-        cleaned = _strip_reasoning(orphan.group(1)).strip()
+    if start != -1:
+        cleaned = _strip_reasoning(text[start + len("<output>"):]).strip()
         if cleaned:
             return cleaned
 
@@ -227,10 +282,14 @@ def is_dropped_scratch_turn(text: str) -> bool:
     """
     if not text:
         return False
-    lower = text.lower()
-    if "<scratch_pad>" not in lower and "<think>" not in lower:
+    if (
+        _find_protocol_tag(text, "<scratch_pad>") == -1
+        and _find_protocol_tag(text, "<think>") == -1
+    ):
        
… [333 more characters]

diff --git a/graph/output_format.py b/graph/output_format.py
index 79cc3fc..ca4c547 100644
--- a/graph/output_format.py
+++ b/graph/output_format.py
@@ -66,6 +66,65 @@ Optionally, after `</output>`, you may self-report confidence:
 """.strip()
 
 
+def _mask_backtick_spans(text: str) -> str:
+    """Return *text* with inline-code spans blanked, preserving offsets.
+
+    Protocol tags are markup only when they are outside markdown code spans.
+    Masking rather than removing spans lets callers use the existing regular
+    expressions and then take the corresponding slices from the original
+    text.  An unmatched backtick is treated as opening a span too; that is a
+    safer choice for a streaming/incomplete response and prevents prose
+    mentioning a tag from becoming protocol markup.
+    """
+    masked = list(text)
+    i = 0
+    opening: tuple[int, int] | None = None
+    while i < len(text):
+        if text[i] != "`":
+            i += 1
+            continue
+        j = i
+        while j < len(text) and text[j] == "`":
+            j += 1
+        run = j - i
+        if opening is None:
+            opening = (i, run)
+            # The backticks themselves are not relevant to tag matching.
+            for k in range(i, j):
+                masked[k] = " "
+        elif run == opening[1]:
+            for k in range(opening[0], j):
+                masked[k] = " "
+            opening = None
+        i = j
+    if opening is not None:
+        for k in range(opening[0], len(text)):
+            masked[k] = " "
+    return "".join(masked)
+
+
+def _protocol_search(pattern: re.Pattern[str], text: str) -> re.Match[str] | None:
+    return pattern.search(_mask_backtick_spans(text))
+
+
+def _protocol_sub(pattern: re.Pattern[str], repl: str, text: str) -> str:
+    """Substitute only genuine (non-code-span) protocol markup."""
+    masked = _mask_backtick_spans(text)
+    return pattern.sub(repl, text) if masked == text else _replace_spans(pattern, repl, text, masked)
+
+
+def _replace_spans(
+    pattern: re.Pattern[str], repl: str, text: str, masked: str,
+) -> str:
+    # ``repl`` is currently always the empty string, but use Match.expand so
+    # this remains a conventional substitution helper if that changes.
+    matches = list(pattern.finditer(masked))
+    for match in reversed(matches):
+        replacement = repl(match) if callable(repl) else repl
+        text = text[:match.start()] + replacement + text[match.end():]
+    return text
+
+
 _OUTPUT_RE = re.compile(r"<output>([\s\S]*?)</output>", re.IGNORECASE)
 _SCRATCH_RE = re.compile(r"<scratch_pad>[\s\S]*?</scratch_pad>", re.IGNORECASE)
 _ORPHAN_SCRATCH_OPEN_RE = re.compile(r"<scratch_pad>[\s\S]*$", re.IGNORECASE)
@@ -89,15 +148,15 @@ def _strip_reasoning(text: str) -> str:
     Idempotent — real user content should never contain literal tag
     markers, so applying this twice is safe.
     """
-    text = _THINK_RE.sub("", text)
-    text = _ORPHAN_THINK_OPEN_RE.sub("", text)
-    text = _ORPHAN_THINK_CLOSE_RE.sub("", text)
-    text = _SCRATCH_RE.sub("", text)
-    text = _ORPHAN_SCRATCH_OPEN_RE.sub("", text)
+    text = _protocol_sub(_THINK_RE, "", text)
+    text = _protocol_sub(_ORPHAN_THINK_OPEN_RE, "", text)
+    text = _protocol_sub(_ORPHAN_THINK_CLOSE_RE, "", text)
+    text = _protocol_sub(_SCRATCH_RE, "", text)
+    text = _protocol_sub(_ORPHAN_SCRATCH_OPEN_RE, "", text)
     # Confidence tags ride a DataPart, never the user-facing text. Strip them
     # in case the model emits them inside (or right after) <output>.
-    text = _CONFIDENCE_EXPL_BLOCK_RE.sub("", text)
-    text = _CONFIDENCE_BLOCK_RE.sub("", text)
+    text = _protocol_sub(_CONFIDENCE_EXPL_BLOCK_RE, "", text)
+    text = _protocol_sub(_CONFIDENCE_BLOCK_RE, "", text)
     return text
 
 
@@ -120,17 +179,18 @@ def stream_visible_output(raw: str) -> str:
     as ``raw`` grows, the result only ever extends (until ``</output>`` closes
     it), so a caller can emit ``result[already_emitted:]`` each step.
     """
-    low = raw.lower()
+    masked_raw = _mask_backtick_spans(raw)
+    low = masked_raw.lower()
     start = low.find("<output>")
     if start == -1:
         return ""  # still in scratch_pad — nothing user-facing yet
     after = raw[start + len("<output>") :]
-    close = after.lower().find("</output>")
+    close = _mask_backtick_spans(after).lower().find("</output>")
     if close != -1:
         after = after[:close]
     # Strip provider reasoning that can appear inside the output region.
-    after = _THINK_RE.sub("", after)
-    after = _ORPHAN_THINK_OPEN_RE.sub("", after)
+    after = _protocol_sub(_THINK_RE, "", after)
+    after = _protocol_sub(_ORPHAN_THINK_OPEN_RE, "", after)
     # Hold back a partial trailing tag ("</outp", "<conf", a lone "<") so it
     # never flashes; the terminal replace delivers the full, clean text.
     lt = after.rfind("<")
@@ -147,16 +207,16 @@ def extract_confidence(text: str) -> tuple[float | None, str | None]:
     The A2A handler clamps confidence to [0, 1] on write.
     """
     confidence: float | None = None
-    m = _CONFIDENCE_RE.search(text)
+    m = _protocol_search(_CONFIDENCE_RE, text)
     if m:
         try:
-            confidence = float(m.group(1))
+            confidence = float(text[m.start(1):m.end(1)])
         except ValueError:
             confidence = None
     explanation: str | None = None
-    me = _CONFIDENCE_EXPLANATION_RE.search(text)
+    me = _protocol_search(_CONFIDENCE_EXPLANATION_RE, text)
     if me:
-        explanation = me.group(1).strip() or None
+        explanation = text[me.start(1):me.end(1)].strip() or None
     return confidence, explanation
 
 
@@ -181,16 +241,16 @@ def extract_output(text: str) -> str:
         return ""
 
     # 1. Closed <output>...</output>
-    m = _OUTPUT_RE.search(text)
+    m = _protocol_search(_OUTPUT_RE, text)
     if m:
-        cleaned = _strip_reasoning(m.group(1)).strip()
+        cleaned = _strip_reasoni
… [791 more characters]

diff --git a/graph/output_format.py b/graph/output_format.py
index 79cc3fc..60374ea 100644
--- a/graph/output_format.py
+++ b/graph/output_format.py
@@ -101,6 +101,48 @@ def _strip_reasoning(text: str) -> str:
     return text
 
 
+
+# --- Backtick-wrapped tag mentions -------------------------------------------
+#
+# When the model explains its own protocol inside the answer ("wrap the
+# answer in `` `<output>` ``"), the literal tag text in prose must NOT be
+# treated as a real delimiter. We mask backtick-wrapped tag mentions with
+# sentinels before any boundary parsing, then restore them in whatever
+# text we return, so mentions survive verbatim in the user-facing answer
+# while genuine (unbackticked) delimiters still drive the protocol.
+
+_TAG_MENTION_PAIRS = (
+    (r"`<output>`", "\x00PO\x00"),
+    (r"`</output>`", "\x00PC\x00"),
+    (r"`<scratch_pad>`", "\x00SO\x00"),
+    (r"`</scratch_pad>`", "\x00SC\x00"),
+    (r"`</think>", "\x00TC\x00"),
+    (r"`</think>", "\x00TO\x00"),
+)
+_TAG_MENTION_RES = [
+    (re.compile(re.escape(lit), re.IGNORECASE), sent)
+    for lit, sent in _TAG_MENTION_PAIRS
+]
+_UNMASK_RES = [
+    (re.compile(re.escape(sent)), lit)
+    for lit, sent in _TAG_MENTION_PAIRS
+]
+
+
+def _mask_tag_mentions(text: str) -> str:
+    """Replace backtick-wrapped protocol-tag mentions with sentinels."""
+    for rx, sent in _TAG_MENTION_RES:
+        text = rx.sub(sent, text)
+    return text
+
+
+def _unmask_tag_mentions(text: str) -> str:
+    """Restore sentinels back to their literal backticked tag text."""
+    for rx, lit in _UNMASK_RES:
+        text = rx.sub(lit, text)
+    return text
+
+
 _ORPHAN_OUTPUT_OPEN_RE = re.compile(r"<output>([\s\S]*)$", re.IGNORECASE)
 
 
@@ -120,6 +162,7 @@ def stream_visible_output(raw: str) -> str:
     as ``raw`` grows, the result only ever extends (until ``</output>`` closes
     it), so a caller can emit ``result[already_emitted:]`` each step.
     """
+    raw = _mask_tag_mentions(raw)
     low = raw.lower()
     start = low.find("<output>")
     if start == -1:
@@ -136,7 +179,7 @@ def stream_visible_output(raw: str) -> str:
     lt = after.rfind("<")
     if lt != -1 and ">" not in after[lt:]:
         after = after[:lt]
-    return after
+    return _unmask_tag_mentions(after)
 
 
 def extract_confidence(text: str) -> tuple[float | None, str | None]:
@@ -179,25 +222,26 @@ def extract_output(text: str) -> str:
     """
     if not text or not text.strip():
         return ""
+    text = _mask_tag_mentions(text)
 
     # 1. Closed <output>...</output>
     m = _OUTPUT_RE.search(text)
     if m:
         cleaned = _strip_reasoning(m.group(1)).strip()
         if cleaned:
-            return cleaned
+            return _unmask_tag_mentions(cleaned)
 
     # 2. Orphan <output> opener (max_tokens truncation mid-output).
     orphan = _ORPHAN_OUTPUT_OPEN_RE.search(text)
     if orphan:
         cleaned = _strip_reasoning(orphan.group(1)).strip()
         if cleaned:
-            return cleaned
+            return _unmask_tag_mentions(cleaned)
 
     # 3. Last resort — strip reasoning, return what's left.
     fallback = _strip_reasoning(text).strip()
     if fallback:
-        return fallback
+        return _unmask_tag_mentions(fallback)
 
     preview = text[:400].replace("\n", "\\n")
     log.warning(
@@ -227,6 +271,7 @@ def is_dropped_scratch_turn(text: str) -> bool:
     """
     if not text:
         return False
+    text = _mask_tag_mentions(text)
     lower = text.lower()
     if "<scratch_pad>" not in lower and "<think>" not in lower:
         return False