Isn't the first section no-longer accurate for several years? I understood that, while we serialize the end of turn markers in a text format like `</think>`, internally they are a dedicated token that cannot be forged (a user message containing `</think>` would encode to a different sequence of tokens). Am I mistaken about this?

Obviously, this doesn't really affect the results of the paper, but it feels like it's the obvious first-line of defense: at least the model has a solid fence between the different roles.