diff --git a/scripts/test-layout/layout-adapters.json b/scripts/test-layout/layout-adapters.json
index 8a9364f4817..bc0de6973f1 100644
--- a/scripts/test-layout/layout-adapters.json
+++ b/scripts/test-layout/layout-adapters.json
@@ -1,6 +1,7 @@
 {
   "anthropic-active-limit-routing.test.ts": "adapters/anthropic",
   "web-search-eof.test.ts": "web-search",
+  "web-search-memory-citation.test.ts": "web-search",
   "openai-chat-single-system.test.ts": "adapters/openai",
   "fix-search-frame-shapes.test.ts": "web-search",
   "fix-search-orphan-source.test.ts": "web-search",
diff --git a/src/bridge/response-json.ts b/src/bridge/response-json.ts
index 935c018aadf..58e1c23f3eb 100644
--- a/src/bridge/response-json.ts
+++ b/src/bridge/response-json.ts
@@ -31,6 +31,7 @@ import {
 } from "../responses/thought-signature-replay";
 import {
   createCitationMarkerFilter,
+  escapeMemoryCitationMentions,
   stripCitationMarkers,
   type CitationMarkerFilter,
 } from "../responses/citation-markers";
@@ -99,6 +100,12 @@ function buildResponseJSONWithBudget(
     bareCustomToolNames?: ReadonlySet<string>;
     /** See `bridgeToResponsesSSE`: enforcement is separate from normalization (#4735). */
     enforceDeclaredToolNames?: boolean;
+    /**
+     * Escape a quoted `<oai-mem-citation>` tag in visible text (default true). The Codex client
+     * parses the tag and hides the rest of the answer; Chat Completions and Messages deliveries,
+     * whose clients never parse it, pass false so their text stays byte-for-byte.
+     */
+    escapeMemoryCitationTags?: boolean;
     /** Declared parameter schema per tool name; repairs integral-float integer args (#1611). */
     toolParameterSchemas?: ReadonlyMap<string, Record<string, unknown>>;
     freeformToolNames?: Set<string>;
@@ -256,7 +263,9 @@ function buildResponseJSONWithBudget(
     // ChatGPT-backend citation markers arrive as literal private-use characters that the
     // Codex TUI prints verbatim (#3150). Strip them here rather than at the accumulator so
     // the retained byte accounting above still describes what the upstream actually sent.
-    const text = stripCitationMarkers(currentTextStr);
+    // A quoted memory-citation tag is escaped for the Codex client only (citation-markers.ts).
+    const stripped = stripCitationMarkers(currentTextStr);
+    const text = options?.escapeMemoryCitationTags === false ? stripped : escapeMemoryCitationMentions(stripped);
     const sourceBytes = pendingWebSources.reduce((sum, source) => sum + bytesOf(JSON.stringify(source)), 0);
     const annotations = pendingWebSources.map(s => ({
       type: "url_citation", url: s.url, title: s.title || s.url, start_index: 0, end_index: 0,
@@ -406,7 +415,7 @@ function buildResponseJSONWithBudget(
           flushSummaryReasoning();
           flushRawReasoning();
           flushToolCall();
-          for (const item of anthropicProgressItems(e.text, e.anthropicThinkingSignature, budget)) pushOutput(item as OutputItem);
+          for (const item of anthropicProgressItems(e.text, e.anthropicThinkingSignature, budget, options?.escapeMemoryCitationTags !== false)) pushOutput(item as OutputItem);
           break;
         }
         // Only flush on an explicit phase change. A later delta that omits `phase` must keep
diff --git a/src/bridge/sse.ts b/src/bridge/sse.ts
index a660936eabd..54cba077dc9 100644
--- a/src/bridge/sse.ts
+++ b/src/bridge/sse.ts
@@ -39,8 +39,12 @@ import {
 import { resolveStallTimeoutSec } from "../stall-timeout";
 import {
   createCitationMarkerFilter,
+  createMemoryCitationEscaper,
+  escapeMemoryCitationMentions,
+  passthroughMemoryCitationEscaper,
   stripCitationMarkers,
   type CitationMarkerFilter,
+  type MemoryCitationEscaper,
 } from "../responses/citation-markers";
 import { declaresCodeModeExec, normalizeDeclaredToolName } from "../types";
 import { appendSafeWebSearchSource, safeWebSearchSources } from "../web-search/sources";
@@ -132,6 +136,12 @@ export function bridgeToResponsesSSE(
      * would reach the client under the invented name instead of the normalized one.
      */
     enforceDeclaredToolNames?: boolean;
+    /**
+     * Escape a quoted `<oai-mem-citation>` tag in visible text (default true). The Codex client
+     * parses the tag and hides the rest of the answer; Chat Completions and Messages deliveries,
+     * whose clients never parse it, pass false so their text stays byte-for-byte.
+     */
+    escapeMemoryCitationTags?: boolean;
     /**
      * Deliver a non-retryable upstream refusal as `response.failed` with a terminal-refusal code
      * instead of `response.incomplete` (see `./terminal-refusal`). Set only for the Responses
@@ -167,6 +177,8 @@ export function bridgeToResponsesSSE(
     };
   },
 ): ReadableStream<Uint8Array> {
+  const escapeTags = options?.escapeMemoryCitationTags !== false;
+  const escapeVisibleTags = (text: string): string => escapeTags ? escapeMemoryCitationMentions(text) : text;
   const proxyIncompleteContext = options?.proxyErrorContext ?? {};
   const replayCacheScope = options?.replayCacheScope;
   const maxOutputCompletion = createMaxOutputCompletion(options);
@@ -381,6 +393,9 @@ export function bridgeToResponsesSSE(
         outputIndex: number;
         text: StringChunks;
         citationFilter: CitationMarkerFilter;
+        memoryCitationEscaper: MemoryCitationEscaper;
+        /** Bytes the escaper currently holds, charged to the translator budget. */
+        heldBytes: number;
         phase?: OcxMessagePhase;
       } | null = null;
       let currentReasoning: { itemId: string; outputIndex: number; text: StringChunks } | null = null;
@@ -570,13 +585,20 @@ export function bridgeToResponsesSSE(
         // accumulated text: closeCurrentMessage re-sends it in output_text.done and
         // output_item.done, so filtering only the deltas would leave the markers in both.
         const trailing = currentMsg.citationFilter.flush();
-        if (trailing) {
+        const escapedTrailing = trailing ? currentMsg.memoryCitationEscaper.push(trailing) : "";
+        // A held tail is a partial tag whose whole-message context is now known: resolve it once
+        // against the accumulated text so a real block's trailing close tag survives.
+        const heldTail = currentMsg.memoryCitationEscaper.pending();
+        const resolvedTail = heldTail ? escapeVisibleTags(heldTail) : "";
+        currentMsg.heldBytes = replaceRetainedString(currentMsg.heldBytes, "", "live_transient");
+        const finalDelta = escapedTrailing + resolvedTail;
+        if (finalDelta) {
           emit("response.output_text.delta", {
             item_id: currentMsg.itemId, output_index: currentMsg.outputIndex,
-            content_index: 0, delta: trailing,
+            content_index: 0, delta: finalDelta,
           });
         }
-        const messageText = stripCitationMarkers(joinChunks(currentMsg.text));
+        const messageText = escapeVisibleTags(stripCitationMarkers(joinChunks(currentMsg.text)));
         // Chat Completions has no message-phase field. Keep its live item provisional, then
         // classify it only when the next adapter event proves whether this text led into more
         // work or completed the turn. Explicit adapter phases always outrank this inference.
@@ -982,13 +1004,15 @@ export function bridgeToResponsesSSE(
                 flushHiddenRawReasoning();
                 flushHiddenReasoningEnvelope();
                 if (currentToolCall) closeCurrentToolCall();
-                for (const item of anthropicProgressItems(event.text, event.anthropicThinkingSignature, budget)) {
+                for (const item of anthropicProgressItems(event.text, event.anthropicThinkingSignature, budget, escapeTags)) {
                   emit("response.output_item.added", { output_index: outputIndex, item: { ...item, ...(item.type === "message" ? { status: "in_progress", content: [] } : {}) } });
                   if (item.type === "message") {
                     const part = item.content![0];
                     emit("response.content_part.added", { item_id: item.id, output_index: outputIndex, content_index: 0, part: { ...part, text: "" } });
-                    emit("response.output_text.delta", { item_id: item.id, output_index: outputIndex, content_index: 0, delta: event.text });
-                    emit("response.output_text.done", { item_id: item.id, output_index: outputIndex, content_index: 0, text: event.text });
+                    // The visible copy is escaped; the carrier envelope above keeps the raw text.
+                    const visibleText = escapeVisibleTags(event.text);
+                    emit("response.output_text.delta", { item_id: item.id, output_index: outputIndex, content_index: 0, delta: visibleText });
+                    emit("response.output_text.done", { item_id: item.id, output_index: outputIndex, content_index: 0, text: visibleText });
                     emit("response.content_part.done", { item_id: item.id, output_index: outputIndex, content_index: 0, part });
                   }
                   emit("response.output_item.done", { output_index: outputIndex, item });
@@ -1026,6 +1050,8 @@ export function bridgeToResponsesSSE(
                 currentMsg = {
                   itemId, outputIndex, text: emptyChunks(),
                   citationFilter: createCitationMarkerFilter(),
+                  memoryCitationEscaper: escapeTags ? createMemoryCitationEscaper() : passthroughMemoryCitationEscaper,
+                  heldBytes: 0,
                   ...(event.phase ? { phase: event.phase } : {}),
                 };
               }
@@ -1038,10 +1064,19 @@ export function bridgeToResponsesSSE(
               // unterminated tail and releases it at close (#3150). The accumulator above
               // keeps the raw text; it is stripped once in closeCurrentMessage.
               const visible = currentMsg.citationFilter.push(event.text);
-              if (visible) {
+              // Escape a literal memory-citation tag: the Codex client hides everything from an
+              // opening tag to the first closing one (or to the end when none follows), so one
+              // quoted mention in prose swallows the rest of the answer and reads as a truncated
+              // turn. This runs per
+              // delta, so it uses the streaming escaper: a tag arrives split across deltas, and a
+              // whole-string match inside a single delta would miss it.
+              const emitted = visible ? currentMsg.memoryCitationEscaper.push(visible) : "";
+              currentMsg.heldBytes = replaceRetainedString(
+                currentMsg.heldBytes, currentMsg.memoryCitationEscaper.pending(), "live_transient");
+              if (emitted) {
                 emit("response.output_text.delta", {
                   item_id: currentMsg.itemId, output_index: currentMsg.outputIndex,
-                  content_index: 0, delta: visible,
+                  content_index: 0, delta: emitted,
                 });
               }
               break;
diff --git a/src/images/loop.ts b/src/images/loop.ts
index 503602d6618..589a51eaff0 100644
--- a/src/images/loop.ts
+++ b/src/images/loop.ts
@@ -391,6 +391,8 @@ export interface ImageBridgeDeps {
   forceEmptyResponseId?: boolean;
   /** Responses inbound only: deliver a non-retryable upstream refusal as `response.failed`. */
   terminalRefusalAsFailed?: boolean;
+  /** False for Chat/Messages inbound: their clients never parse `<oai-mem-citation>`, so text stays raw. */
+  escapeMemoryCitationTags?: boolean;
 }
 
 /**
@@ -1221,6 +1223,7 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
       ...(deps.clientToolCatalogRestriction ? { ...deps.clientToolCatalogRestriction, enforceDeclaredToolNames: false } : {}),
       ...(deps.forceEmptyResponseId ? { responseId: "" } : {}),
       ...(deps.terminalRefusalAsFailed ? { terminalRefusalAsFailed: true } : {}),
+      ...(deps.escapeMemoryCitationTags === false ? { escapeMemoryCitationTags: false } : {}),
       hideThinkingSummary: parsed.options.hideThinkingSummary,
       chatRawReasoningVisible: deps.chatRawReasoningVisible,
       hideRawReasoning: parsed.options.hideRawReasoning,
diff --git a/src/responses/anthropic-progress.ts b/src/responses/anthropic-progress.ts
index b6874af01e9..f53d763bb49 100644
--- a/src/responses/anthropic-progress.ts
+++ b/src/responses/anthropic-progress.ts
@@ -1,14 +1,19 @@
+import { escapeMemoryCitationMentions } from "./citation-markers";
 import { encodeReasoningEnvelope, decodeReasoningEnvelope, type ReasoningEnvelope } from "./reasoning-envelope";
 import type { TranslatorBudget } from "../lib/translator-budget";
 
-/** A visible update is a presentation copy of one original signed thinking block. */
-export function anthropicProgressItems(text: string, signature: string, budget?: TranslatorBudget) {
+/**
+ * A visible update is a presentation copy of one original signed thinking block. The copy is
+ * escaped for a quoted memory-citation tag; the envelope keeps the raw text so the signed payload
+ * is unchanged.
+ */
+export function anthropicProgressItems(text: string, signature: string, budget?: TranslatorBudget, escapeVisible = true) {
   const id = `msg_${crypto.randomUUID().replaceAll("-", "")}`;
   return [
     { type: "reasoning", id: `rs_${crypto.randomUUID().replaceAll("-", "")}`, summary: [],
       encrypted_content: encodeReasoningEnvelope({ sig: signature, txt: text, upd: id }, budget) },
     { type: "message", id, role: "assistant", status: "completed", phase: "commentary",
-      content: [{ type: "output_text", text, annotations: [] }] },
+      content: [{ type: "output_text", text: escapeVisible ? escapeMemoryCitationMentions(text) : text, annotations: [] }] },
   ];
 }
 
@@ -22,7 +27,8 @@ export function isAnthropicProgressMirror(item: unknown, envelope: ReasoningEnve
   if (msg.role !== "assistant" || msg.phase !== "commentary" || (msg.id !== undefined && msg.id !== envelope.upd)) return false;
   if (!Array.isArray(msg.content) || msg.content.length !== 1) return false;
   const part = msg.content[0] as { type?: unknown; text?: unknown } | undefined;
-  return part?.type === "output_text" && part.text === envelope.txt;
+  return part?.type === "output_text"
+    && (part.text === envelope.txt || part.text === escapeMemoryCitationMentions(envelope.txt));
 }
 
 export function anthropicProgressEnvelope(item: unknown, budget?: TranslatorBudget): ReasoningEnvelope | null {
diff --git a/src/responses/citation-markers.ts b/src/responses/citation-markers.ts
index d83036ba95f..2fd5e4aee80 100644
--- a/src/responses/citation-markers.ts
+++ b/src/responses/citation-markers.ts
@@ -62,6 +62,237 @@ export interface CitationMarkerFilter {
   flush(): string;
 }
 
+/**
+ * The memory-citation tags the Codex client parses as hidden markup (openai/codex
+ * `codex-rs/utils/stream-parser/src/citation.rs`): matching is literal and non-nested, the text
+ * from an opening tag to the FIRST closing tag is hidden, and an opening tag that never closes is
+ * auto-closed at the end of the stream, hiding everything after it. A model that quotes the tag
+ * ("output the `...` block at the end") therefore appears to truncate at the quote. Backticks do
+ * not protect it, because the client parses before any markdown rendering.
+ */
+const MEMORY_CITATION_OPEN = "<oai-mem-citation>";
+const MEMORY_CITATION_CLOSE = "</oai-mem-citation>";
+const MEMORY_CITATION_MENTION = /<(\/?oai-mem-citation>)/g;
+
+/**
+ * Body shape of a REAL memory-citation block: it opens with a complete `<citation_entries>` list, or
+ * with a complete ids list (`<rollout_ids>` or `<thread_ids>`) when the entries are absent. That matches
+ * the client's `parse_memory_citation` (`codex-rs/memories/read/src/citations.rs`), which accepts a block
+ * carrying either list and rejects one carrying neither.
+ *
+ * This is what separates a block the client should render from a mention of the tag name inside
+ * ordinary prose. Escaping both would break the real feature: the client would print the tags
+ * instead of the citation list, and the turn's memory references would silently disappear.
+ */
+const MEMORY_CITATION_BODY_ELEMENTS: ReadonlyArray<readonly [open: string, close: string]> = [
+  ["<citation_entries>", "</citation_entries>"],
+  ["<rollout_ids>", "</rollout_ids>"],
+  ["<thread_ids>", "</thread_ids>"],
+];
+
+/** First index at or after `from` (below `limit`) that is not whitespace. */
+function skipWhitespace(text: string, from: number, limit: number): number {
+  let at = from;
+  while (at < limit && /\s/.test(text[at]!)) at++;
+  return at;
+}
+
+/**
+ * Longest candidate block, in UTF-16 code units (JavaScript string length), that the streaming
+ * escaper holds while waiting for its closing tag; the whole-string form applies the same limit.
+ * Callers charge the held bytes to their translator budget (`live_transient`) as the hold grows.
+ */
+const MAX_MEMORY_CITATION_HOLD = 16_384;
+
+/**
+ * Whether the text right after an opening tag still could begin a real block.
+ *
+ * A real block puts `<citation_entries>` (usually on the next line) immediately after the open
+ * tag. Ordinary prose that quotes the tag puts a backtick, punctuation, or words there instead,
+ * so one short lookahead separates the two without buffering the whole block.
+ */
+function bodyCouldBeReal(afterOpen: string): boolean {
+  const trimmed = afterOpen.replace(/^\s+/, "");
+  return MEMORY_CITATION_BODY_ELEMENTS.some(([open]) => open.startsWith(trimmed) || trimmed.startsWith(open));
+}
+
+function isMemoryCitationBlock(body: string): boolean {
+  const trimmed = body.replace(/^\s+/, "");
+  return MEMORY_CITATION_BODY_ELEMENTS.some(([open, close]) => trimmed.startsWith(open) && trimmed.includes(close, open.length));
+}
+
+/**
+ * Whether an opening tag begins a real block: the entries list has to follow it directly.
+ *
+ * `isMemoryCitationBlock` over a whole body cannot answer this, because prose before a real block
+ * also spans a `<citation_entries>…</citation_entries>…<rollout_ids>` stretch when the search is
+ * anchored at the mention rather than at the block. The adjacency check is what makes the mention
+ * provably a mention.
+ */
+function opensRealBlock(text: string, openAt: number, closeCache?: { at: number }): number | undefined {
+  const afterOpen = openAt + MEMORY_CITATION_OPEN.length;
+  const bodyStart = skipWhitespace(text, afterOpen, Math.min(text.length, openAt + MAX_MEMORY_CITATION_HOLD));
+  if (!MEMORY_CITATION_BODY_ELEMENTS.some(([open]) => text.startsWith(open, bodyStart))) return undefined;
+  // Callers scanning one string for several opening tags share the next closing tag, so prose with
+  // many unclosed candidates costs one forward search instead of one per tag (-2: not searched yet).
+  let close: number;
+  if (closeCache) {
+    if (closeCache.at === -2 || (closeCache.at !== -1 && closeCache.at < bodyStart)) {
+      closeCache.at = text.indexOf(MEMORY_CITATION_CLOSE, bodyStart);
+    }
+    close = closeCache.at;
+  } else {
+    close = text.indexOf(MEMORY_CITATION_CLOSE, bodyStart);
+  }
+  if (close === -1) return undefined;
+  // The streaming escaper holds at most MAX_MEMORY_CITATION_HOLD of a candidate, so a block larger
+  // than that is a mention in BOTH forms; one size rule keeps deltas and `output_text.done` equal.
+  if (close + MEMORY_CITATION_CLOSE.length - openAt > MAX_MEMORY_CITATION_HOLD) return undefined;
+  return isMemoryCitationBlock(text.slice(afterOpen, close)) ? close + MEMORY_CITATION_CLOSE.length : undefined;
+}
+
+/**
+ * Neutralize a literal memory-citation tag so the client renders it as text.
+ *
+ * The client parses the tag as markup before markdown, so wrapping it in backticks does not
+ * protect it. The leading `<` becomes `&lt;`. In ordinary markdown text that renders as `<` again;
+ * inside an inline code span or a fenced block CommonMark does not decode entities, so the reader
+ * sees `&lt;oai-mem-citation>` literally. That visible difference is the trade-off for keeping the
+ * rest of the answer: the alternative is the client hiding everything after the quote.
+ *
+ * Only the Responses wire needs this: Chat Completions and Messages clients never parse the tag,
+ * so the bridges apply it behind `escapeMemoryCitationTags`.
+ */
+export function escapeMemoryCitationMentions(text: string): string {
+  if (!text.includes("oai-mem-citation")) return text;
+  // Claim real blocks FIRST, so a mention earlier in the prose cannot pair with a real block's
+  // closing tag and leave the block half-escaped. Everything outside a claimed block is a
+  // mention and gets escaped, tags included. Matching runs over the ORIGINAL string as one pass
+  // (appendReplacement), because `String.replace` would re-scan the text we just escaped.
+  const blocks: Array<{ start: number; end: number }> = [];
+  const closeCache = { at: -2 };
+  let searchFrom = 0;
+  for (;;) {
+    const open = text.indexOf(MEMORY_CITATION_OPEN, searchFrom);
+    if (open === -1) break;
+    const end = opensRealBlock(text, open, closeCache);
+    if (end !== undefined) {
+      blocks.push({ start: open, end });
+      searchFrom = end;
+    } else {
+      searchFrom = open + MEMORY_CITATION_OPEN.length;
+    }
+  }
+  // Outside claimed blocks every tag is a mention; one linear regex pass escapes them all.
+  const escapedMentions = (segment: string): string => segment.replace(MEMORY_CITATION_MENTION, "&lt;$1");
+  if (blocks.length === 0) return escapedMentions(text);
+  let out = "";
+  let cursor = 0;
+  for (const block of blocks) {
+    out += escapedMentions(text.slice(cursor, block.start));
+    out += text.slice(block.start, block.end);
+    cursor = block.end;
+  }
+  out += escapedMentions(text.slice(cursor));
+  return out;
+}
+
+export interface MemoryCitationEscaper {
+  /** Feed one streaming delta; returns the portion safe to emit now. */
+  push(delta: string): string;
+  /** Text still withheld at the end of the stream; resolve it with `escapeMemoryCitationMentions`. */
+  pending(): string;
+}
+
+/** Escaper for deliveries that must not rewrite text (Chat Completions, Messages). */
+export const passthroughMemoryCitationEscaper: MemoryCitationEscaper = {
+  push: (delta: string) => delta,
+  pending: () => "",
+};
+
+/**
+ * Streaming form of `escapeMemoryCitationMentions`.
+ *
+ * A tag can straddle delta boundaries, so a per-delta regex would miss the mention that matters
+ * most: the model writing the tag name one token at a time. The escaper buffers until it can tell
+ * a mention from a real block. A real block is emitted verbatim, tags included, as soon as its
+ * `<citation_entries>` body starts — the client keeps it, which is the whole point of the block.
+ * Everything else is a mention and gets `&lt;`.
+ */
+export function createMemoryCitationEscaper(): MemoryCitationEscaper {
+  /**
+   * Unresolved tail. It starts at a `<` and is either a partial tag, or an opening tag whose block
+   * has not closed yet. A candidate block is held WHOLE until its closing tag arrives, because only
+   * the complete body (entries, then rollout ids) proves it is a real block rather than a mention.
+   */
+  let held = "";
+  const escapeOpen = "&lt;" + MEMORY_CITATION_OPEN.slice(1);
+  const escapeClose = "&lt;" + MEMORY_CITATION_CLOSE.slice(1);
+  return {
+    push(delta: string): string {
+      if (!held && !delta.includes("<")) return delta;
+      const input = held + delta;
+      held = "";
+      let out = "";
+      let i = 0;
+      while (i < input.length) {
+        const next = input.indexOf("<", i);
+        if (next === -1) {
+          out += input.slice(i);
+          break;
+        }
+        out += input.slice(i, next);
+        // Look no further than one hold limit ahead: a real block never exceeds it, and slicing the
+        // whole remainder for every tag would make one large delta of many tags quadratic.
+        const tail = input.slice(next, next + MAX_MEMORY_CITATION_HOLD + 1);
+        const remaining = input.length - next;
+        if (tail.startsWith(MEMORY_CITATION_CLOSE)) {
+          // A close tag outside a claimed block is prose.
+          out += escapeClose;
+          i = next + MEMORY_CITATION_CLOSE.length;
+          continue;
+        }
+        if (!tail.startsWith(MEMORY_CITATION_OPEN)) {
+          if (MEMORY_CITATION_OPEN.startsWith(tail) || MEMORY_CITATION_CLOSE.startsWith(tail)) {
+            // A tag is still arriving.
+            held = tail;
+            return out;
+          }
+          out += "<";
+          i = next + 1;
+          continue;
+        }
+        const afterOpen = tail.slice(MEMORY_CITATION_OPEN.length);
+        if (!bodyCouldBeReal(afterOpen)) {
+          out += escapeOpen;
+          i = next + MEMORY_CITATION_OPEN.length;
+          continue;
+        }
+        const end = opensRealBlock(tail, 0);
+        if (end !== undefined) {
+          // A complete real block is released verbatim, both tags included, so the delta stream
+          // equals what `escapeMemoryCitationMentions` keeps in the final text.
+          out += tail.slice(0, end);
+          i = next + end;
+          continue;
+        }
+        if (!tail.includes(MEMORY_CITATION_CLOSE, MEMORY_CITATION_OPEN.length) && remaining <= MAX_MEMORY_CITATION_HOLD) {
+          // The block may still close; hold it whole.
+          held = tail;
+          return out;
+        }
+        // Closed without a valid body, or too large to keep holding: a mention.
+        out += escapeOpen;
+        i = next + MEMORY_CITATION_OPEN.length;
+      }
+      return out;
+    },
+    pending(): string {
+      return held;
+    },
+  };
+}
+
 /**
  * Remove every complete citation span from a whole string.
  *
diff --git a/src/server/inference/client-encoder-delivery.ts b/src/server/inference/client-encoder-delivery.ts
index f2e9c10a752..54399816bdb 100644
--- a/src/server/inference/client-encoder-delivery.ts
+++ b/src/server/inference/client-encoder-delivery.ts
@@ -171,6 +171,8 @@ export async function deliverClientEncodedResponse(input: ClientEncodedDelivery)
         recordBufferedDelivery: false,
         // The client never receives this body, and its Chat/Messages wire has no envelope field.
         omitHiddenReasoningEnvelope: true,
+        // Keep the client's raw text: completion fingerprints compare it with what the client resends.
+        escapeMemoryCitationTags: false,
       });
     } catch {
       return undefined;
diff --git a/src/server/responses/adapter-delivery.ts b/src/server/responses/adapter-delivery.ts
index 29d48312252..65cdf2ec11f 100644
--- a/src/server/responses/adapter-delivery.ts
+++ b/src/server/responses/adapter-delivery.ts
@@ -270,6 +270,7 @@ export async function deliverAdapterResponse(
         bareCustomToolNames,
         enforceDeclaredToolNames: options.inboundWire !== "chat" && options.inboundWire !== "anthropic",
         terminalRefusalAsFailed: options.inboundWire !== "chat" && options.inboundWire !== "anthropic",
+        escapeMemoryCitationTags: options.inboundWire !== "chat" && options.inboundWire !== "anthropic",
         toolParameterSchemas,
         ...(options.onFirstOutput ? { onFirstOutput: options.onFirstOutput } : {}),
         ...(routedCompaction ? { compaction: true, compactionRetention: parsed._compactionRetention } : {}),
@@ -381,6 +382,7 @@ export async function deliverAdapterResponse(
       declaredToolNames,
       bareCustomToolNames,
       enforceDeclaredToolNames: options.inboundWire !== "chat" && options.inboundWire !== "anthropic",
+      escapeMemoryCitationTags: options.inboundWire !== "chat" && options.inboundWire !== "anthropic",
       toolParameterSchemas,
       freeformToolNames,
       toolSearchToolNames,
diff --git a/src/server/responses/run-turn-execution.ts b/src/server/responses/run-turn-execution.ts
index 03c0db9d71c..ba44ef99d96 100644
--- a/src/server/responses/run-turn-execution.ts
+++ b/src/server/responses/run-turn-execution.ts
@@ -941,6 +941,7 @@ export async function executeResponsesRunTurn(
           enforceDeclaredToolNames,
           // Same wire split: only a Responses client (Codex) needs the refusal as a failure.
           terminalRefusalAsFailed: enforceDeclaredToolNames,
+          escapeMemoryCitationTags: enforceDeclaredToolNames,
           toolParameterSchemas,
           ...(options.onFirstOutput ? { onFirstOutput: options.onFirstOutput } : {}),
           ...(routedCompaction ? { compaction: true, compactionRetention: parsed._compactionRetention } : {}),
@@ -1109,6 +1110,7 @@ export async function executeResponsesRunTurn(
         toolNsMap,
         declaredToolNames,
         enforceDeclaredToolNames,
+        escapeMemoryCitationTags: enforceDeclaredToolNames,
         toolParameterSchemas,
         freeformToolNames,
         bareCustomToolNames,
diff --git a/src/server/responses/sidecar-execution.ts b/src/server/responses/sidecar-execution.ts
index 2a16f74ead1..e8a4d7d4e9f 100644
--- a/src/server/responses/sidecar-execution.ts
+++ b/src/server/responses/sidecar-execution.ts
@@ -621,6 +621,7 @@ export async function executeResponsesSidecars(
       onFirstOutput: noteSidecarOutput,
       ...(options.forceEmptyResponseId ? { forceEmptyResponseId: true } : {}),
       terminalRefusalAsFailed: inboundWire !== "chat" && inboundWire !== "anthropic",
+      escapeMemoryCitationTags: inboundWire !== "chat" && inboundWire !== "anthropic",
       onCompletedResponse: (response, providerState) => {
         if (!options.abortSignal?.aborted) thinkingRecovery.rememberSuccess(response);
         const served = transportState.replayOAuthCredentialSnapshot;
@@ -734,6 +735,7 @@ export async function executeResponsesSidecars(
       maxSearches: wsPlan.maxSearches,
       forceEmptyResponseId: true,
       terminalRefusalAsFailed: inboundWire !== "chat" && inboundWire !== "anthropic",
+      escapeMemoryCitationTags: inboundWire !== "chat" && inboundWire !== "anthropic",
       abortSignal: options.abortSignal,
       onFirstOutput: noteSidecarOutput,
       onRequestBuilt: request => {
diff --git a/src/web-search/loop.ts b/src/web-search/loop.ts
index e993f8b8129..cd8f941e5bf 100644
--- a/src/web-search/loop.ts
+++ b/src/web-search/loop.ts
@@ -390,6 +390,8 @@ export interface WebSearchLoopDeps {
   forceEmptyResponseId?: boolean;
   /** Responses inbound only: deliver a non-retryable upstream refusal as `response.failed`. */
   terminalRefusalAsFailed?: boolean;
+  /** False for Chat/Messages inbound: their clients never parse `<oai-mem-citation>`, so text stays raw. */
+  escapeMemoryCitationTags?: boolean;
   abortSignal?: AbortSignal;
   recordSidecarOutcome?: SidecarOutcomeRecorder;
   beforeSidecarDispatch?: () => void;
@@ -1337,6 +1339,7 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
       ...(deps.clientToolCatalogRestriction ? { ...deps.clientToolCatalogRestriction, enforceDeclaredToolNames: false } : {}),
       ...(deps.forceEmptyResponseId ? { responseId: "" } : {}),
       ...(deps.terminalRefusalAsFailed ? { terminalRefusalAsFailed: true } : {}),
+      ...(deps.escapeMemoryCitationTags === false ? { escapeMemoryCitationTags: false } : {}),
       hideThinkingSummary: parsed.options.hideThinkingSummary,
       chatRawReasoningVisible: deps.chatRawReasoningVisible,
       hideRawReasoning: parsed.options.hideRawReasoning,
diff --git a/structure/providers/anthropic-progress.md b/structure/providers/anthropic-progress.md
index 21719d60fed..21369a45a9a 100644
--- a/structure/providers/anthropic-progress.md
+++ b/structure/providers/anthropic-progress.md
@@ -33,7 +33,9 @@ envelope stores the exact signed text and signature plus `upd`, the following me
 Compaction ignores signed progress events: only ordinary summary text enters the checkpoint,
 and neither bridge emits the commentary pair during compaction.
 `src/responses/parser.ts` removes only the adjacent commentary copy with matching ID (or no ID),
-phase and exact text, leaving the original thinking block in source order. Edited copies remain.
+phase and text, leaving the original thinking block in source order. The text matches when it equals the
+signed text exactly or its memory-citation-escaped form (the visible copy on a Responses delivery escapes a
+quoted `<oai-mem-citation>` tag; the envelope keeps the raw text). Other edited copies remain.
 `src/claude/outbound.ts` restores the signed thinking block and consumes the presentation copy on
 both JSON and SSE conversions; ordinary locally hidden envelope text remains undisclosed.
 
diff --git a/structure/transports/responses-wire-shapes.md b/structure/transports/responses-wire-shapes.md
index 258182602b4..86a6d0f5a4d 100644
--- a/structure/transports/responses-wire-shapes.md
+++ b/structure/transports/responses-wire-shapes.md
@@ -595,6 +595,6 @@ such span in the parsed context — system prompt, string content and text parts
 that ASCII directive, following the app's own payload rules, and `parseRequest` applies it to the
 context it returns. `_rawBody` is not touched, so native passthrough stays byte-identical and stored
 `previous_response_id` history keeps the original text. The citation filter in
-`src/responses/citation-markers.ts` is separate and never removes these spans (#6040).
+`src/responses/citation-markers.ts` is separate and never removes these spans (#6040). Its memory-citation escaper neutralizes a quoted `<oai-mem-citation>` tag as `&lt;` on Responses deliveries only: the Codex client hides the text from an opening tag to the first closing tag, or to the end of the stream when none follows. A candidate block is held WHOLE until its closing tag and released verbatim only when its body opens with a complete `<citation_entries>` list, or with a complete `<rollout_ids>`/`<thread_ids>` list when the entries are absent (the client's parser accepts either), so streamed deltas equal the final `output_text.done` text; an invalid, never-closed or over-16,384-UTF-16-unit candidate is escaped, by the same rule in the whole-string form. The visible copy of a signed progress update is escaped too, while its signed envelope keeps the raw text and the mirror check accepts either form. Both bridges take `escapeMemoryCitationTags` (default true); the delivery, run-turn and web-search/image sidecar paths pass false for Chat Completions and Messages, whose clients never parse the tag, and neither the Chat/Messages encoders nor their completion fold escape. Candidate scans look at most one hold limit ahead and share the next closing-tag search, so many unclosed candidates stay linear. Inside a code span the escape stays visible as `&lt;`, the accepted cost of keeping the rest of the answer. The Responses bridge keeps one escaper per message and charges its held bytes to the translator budget (`live_transient`), released when the message closes (`tests/responses/citation-markers.test.ts`).
 `tests/responses/visualization-directives.test.ts` pins the payload rules, the linear-time scan and
 the parser and Anthropic request paths.
diff --git a/tests/fixtures/test-layout-expected.json b/tests/fixtures/test-layout-expected.json
index 396d96c173f..2ae09cd00a6 100644
--- a/tests/fixtures/test-layout-expected.json
+++ b/tests/fixtures/test-layout-expected.json
@@ -33,7 +33,7 @@
   "fix-jsonc-cr-comments.test.ts": "lib",
   "definite-overflow-verdict.test.ts": "lib",
   "fix-jsonc-empty-comma.test.ts": "lib",
-  "web-search-eof.test.ts": "web-search",
+  "web-search-eof.test.ts": "web-search", "web-search-memory-citation.test.ts": "web-search",
   "fix-search-frame-shapes.test.ts": "web-search",
   "fix-search-orphan-source.test.ts": "web-search",
   "fix-search-unicode-clamp.test.ts": "web-search",
diff --git a/tests/responses/citation-markers.test.ts b/tests/responses/citation-markers.test.ts
index 618a3a22e7f..08bc40c06f9 100644
--- a/tests/responses/citation-markers.test.ts
+++ b/tests/responses/citation-markers.test.ts
@@ -4,9 +4,18 @@ import {
   CITATION_MARKER_SEPARATOR,
   CITATION_MARKER_START,
   createCitationMarkerFilter,
+  createMemoryCitationEscaper,
+  escapeMemoryCitationMentions,
   hasCitationMarker,
   stripCitationMarkers,
 } from "../../src/responses/citation-markers";
+import { encodeChatCompletionSse } from "../../src/protocols/encoders/chat";
+import { bridgeToResponsesSSE } from "../../src/bridge";
+import { buildResponseJSON } from "../../src/bridge/response-json";
+import type { AdapterEvent } from "../../src/types";
+import { createTestTranslatorBudget } from "../helpers/translator-budget";
+import { isAnthropicProgressMirror } from "../../src/responses/anthropic-progress";
+import { decodeReasoningEnvelope } from "../../src/responses/reasoning-envelope";
 
 /**
  * #3150: the ChatGPT backend delimits inline citations with private-use characters
@@ -23,6 +32,12 @@ const P = CITATION_MARKER_SEPARATOR;
 const E = CITATION_MARKER_END;
 const span = `${S}cite${P}turn1view0${P}turn1view1${E}`;
 
+/** Text of the first assistant message in a buffered Responses body. */
+function messageText(body: Record<string, unknown>): string {
+  const output = body.output as Array<{ type?: string; content?: Array<{ text?: string }> }>;
+  return output.find(item => item.type === "message")?.content?.[0]?.text ?? "";
+}
+
 describe("citation marker stripping (#3150)", () => {
   test("a complete span is removed and the surrounding text survives", () => {
     expect(stripCitationMarkers(`The setting is supported. ${span} Next.`))
@@ -218,4 +233,253 @@ describe("non-citation directive spans pass through (#6039)", () => {
     expect(filter.push(`ualize${P}{"path"`)).toBe(`ualize${P}{"path"`);
     expect(filter.flush()).toBe("");
   });
+
+  // The Codex client treats a literal <oai-mem-citation> as markup: it keeps the LAST block and
+  // drops everything between the first opening tag and the last closing one. A model that quotes
+  // the tag name in prose therefore loses the rest of its answer, which is the "truncated at a
+  // backtick" report. Escaping the leading `<` keeps the characters visible without matching.
+  test("a literal memory-citation tag in prose is escaped, not left to the client", () => {
+    expect(escapeMemoryCitationMentions("put the `<oai-mem-citation>` block last"))
+      .toBe("put the `&lt;oai-mem-citation>` block last");
+    expect(escapeMemoryCitationMentions("</oai-mem-citation>"))
+      .toBe("&lt;/oai-mem-citation>");
+    // Text that merely shares a prefix is untouched.
+    expect(escapeMemoryCitationMentions("<oai-mem-citationless> and <p> tags"))
+      .toBe("<oai-mem-citationless> and <p> tags");
+  });
+
+  test("a real memory-citation block keeps its tags so the client can still render it", () => {
+    const block = "<oai-mem-citation>\n<citation_entries>\nMEMORY.md:1-2|note=[x]\n</citation_entries>\n"
+      + "<rollout_ids>\n0123\n</rollout_ids>\n</oai-mem-citation>";
+    // A mention before the block is escaped, the block itself survives byte for byte.
+    expect(escapeMemoryCitationMentions(`put the \`<oai-mem-citation>\` block last.\n\n${block}`))
+      .toBe(`put the \`&lt;oai-mem-citation>\` block last.\n\n${block}`);
+    expect(escapeMemoryCitationMentions(block)).toBe(block);
+  });
+
+  test("the streaming escaper escapes a tag split across deltas", () => {
+    const escaper = createMemoryCitationEscaper();
+    const chunks = ["answer: ", "<", "oai", "-mem-cit", "ation", ">", " rest"];
+    const out = chunks.map(chunk => escaper.push(chunk)).join("") + escaper.pending();
+    expect(out).toBe("answer: &lt;oai-mem-citation> rest");
+  });
+
+  test("the streaming escaper releases a tail that stops looking like a tag", () => {
+    const escaper = createMemoryCitationEscaper();
+    // "<o" could still open the tag, so it is held; "ps" proves it cannot and releases it.
+    expect(escaper.push("a <o")).toBe("a ");
+    expect(escaper.push("ps b")).toBe("<ops b");
+    expect(escaper.pending()).toBe("");
+    // An unterminated open tag is released verbatim at close, so no text is invented or lost.
+    const held = createMemoryCitationEscaper();
+    expect(held.push("tail <oai-mem")).toBe("tail ");
+    expect(held.pending()).toBe("<oai-mem");
+  });
+
+  const REAL_BLOCK = "<oai-mem-citation>\n<citation_entries>\nMEMORY.md:1-2|note=[x]\n</citation_entries>\n"
+    + "<rollout_ids>\n0123\n</rollout_ids>\n</oai-mem-citation>";
+
+  /** Feed a string to the escaper in the given pieces and resolve what it still holds. */
+  const streamed = (pieces: string[]): string => {
+    const escaper = createMemoryCitationEscaper();
+    return pieces.map(piece => escaper.push(piece)).join("") + escapeMemoryCitationMentions(escaper.pending());
+  };
+
+  test("a real block split one character at a time keeps both tags, equal to the final text", () => {
+    const text = `see this\n\n${REAL_BLOCK}`;
+    expect(streamed([...text])).toBe(text);
+    expect(streamed([...text])).toBe(escapeMemoryCitationMentions(text));
+  });
+
+  test("an incomplete or invalid block is a mention and is escaped like the final text", () => {
+    for (const text of [
+      "x <oai-mem-citation><citation_entries>e</citation_entries></oai-mem-citation> y",
+      "x <oai-mem-citation><citation_entries>never closes",
+      "quoted <oai-mem-citation> prose </oai-mem-citation> more",
+    ]) {
+      expect(streamed([...text])).toBe(escapeMemoryCitationMentions(text));
+    }
+  });
+
+  test("delta/done parity holds for every two-way split of a mixed text", () => {
+    const text = `a \`<oai-mem-citation>\` b ${REAL_BLOCK} c </oai-mem-citation> d`;
+    const expected = escapeMemoryCitationMentions(text);
+    for (let cut = 0; cut <= text.length; cut++) {
+      expect(streamed([text.slice(0, cut), text.slice(cut)])).toBe(expected);
+    }
+  });
+
+  async function* replay(events: AdapterEvent[]): AsyncGenerator<AdapterEvent> {
+    for (const event of events) yield event;
+  }
+  const textEvents = (pieces: string[]): AdapterEvent[] => [
+    ...pieces.map(text => ({ type: "text_delta", text }) as AdapterEvent),
+    { type: "done" } as AdapterEvent,
+  ];
+
+  test("the Chat encoder never rewrites the tag: Chat clients do not parse it", async () => {
+    const chatText = async (pieces: string[]) => {
+      const raw = await new Response(encodeChatCompletionSse(replay(textEvents(pieces)), {
+        model: "client-model", translatorBudget: createTestTranslatorBudget(),
+      })).text();
+      return raw.split("\n").filter(line => line.startsWith("data: {")).map(line => {
+        const content = (JSON.parse(line.slice(6)) as { choices?: Array<{ delta?: { content?: string } }> }).choices?.[0]?.delta?.content;
+        return content ?? "";
+      }).join("");
+    };
+    expect(await chatText(["quoted <oai-mem-", "citation> prose"])).toBe("quoted <oai-mem-citation> prose");
+    const real = `lead\n${REAL_BLOCK}`;
+    expect(await chatText([...real])).toBe(real);
+  });
+
+  const bridgeText = async (pieces: string[], escapeMemoryCitationTags?: boolean) => {
+    const raw = await new Response(bridgeToResponsesSSE(
+      replay(textEvents(pieces)), "internal/model", undefined, undefined, undefined, undefined, 2_000,
+      { translatorBudget: createTestTranslatorBudget(), enforceDeclaredToolNames: false,
+        ...(escapeMemoryCitationTags === undefined ? {} : { escapeMemoryCitationTags }) },
+    )).text();
+    const frames = raw.split("\n\n").map(block => block.split("\n").find(line => line.startsWith("data: "))).filter(line => line && line !== "data: [DONE]")
+      .map(line => JSON.parse(line!.slice(6)) as { type?: string; delta?: string; text?: string });
+    return {
+      deltas: frames.filter(f => f.type === "response.output_text.delta").map(f => f.delta ?? "").join(""),
+      done: frames.find(f => f.type === "response.output_text.done")?.text ?? "",
+    };
+  };
+
+  test("Chat and Messages deliveries through the Responses bridge keep the raw tag", async () => {
+    const raw = await bridgeText(["quoted <oai-mem-", "citation> prose"], false);
+    expect(raw).toEqual({ deltas: "quoted <oai-mem-citation> prose", done: "quoted <oai-mem-citation> prose" });
+    const json = buildResponseJSON(textEvents(["quoted <oai-mem-citation> prose"]), "internal/model", { escapeMemoryCitationTags: false });
+    expect(messageText(json)).toBe("quoted <oai-mem-citation> prose");
+  });
+
+  test("a buffered Responses body escapes the mention and keeps a real block", () => {
+    const json = buildResponseJSON(textEvents([`quoted <oai-mem-citation> prose\n${REAL_BLOCK}`]), "internal/model");
+    expect(messageText(json)).toBe(`quoted &lt;oai-mem-citation> prose\n${REAL_BLOCK}`);
+  });
+
+  test("a block carrying only an ids list is real too, as the client accepts it", async () => {
+    for (const ids of ["rollout_ids", "thread_ids"]) {
+      const block = `<oai-mem-citation>
+<${ids}>
+0123
+</${ids}>
+</oai-mem-citation>`;
+      const text = `answer
+${block}`;
+      expect(escapeMemoryCitationMentions(text)).toBe(text);
+      expect(streamed([...text])).toBe(text);
+    }
+    // Neither list: still a mention.
+    expect(escapeMemoryCitationMentions("<oai-mem-citation><notes>x</notes></oai-mem-citation>"))
+      .toBe("&lt;oai-mem-citation><notes>x</notes>&lt;/oai-mem-citation>");
+  });
+
+  test("many unclosed candidates stay linear in both forms", () => {
+    const text = "<oai-mem-citation><citation_entries>x ".repeat(80_000) + "</oai-mem-citation>";
+    const started = performance.now();
+    const whole = escapeMemoryCitationMentions(text);
+    const escaper = createMemoryCitationEscaper();
+    const pieces = text.match(/[\s\S]{1,200000}/g)!;
+    const stream = pieces.map(piece => escaper.push(piece)).join("") + escapeMemoryCitationMentions(escaper.pending());
+    expect(stream).toBe(whole);
+    expect(whole.startsWith("&lt;oai-mem-citation><citation_entries>x ")).toBe(true);
+    // The earlier quadratic scan took about 13 s on this 3 MB input; the bounded one takes well under a second.
+    expect(performance.now() - started).toBeLessThan(4_000);
+  });
+
+  test("a real block without an ids list still counts as real, as the client parses it", async () => {
+    const entriesOnly = "<oai-mem-citation>\n<citation_entries>\nMEMORY.md:1-2|note=[x]\n</citation_entries>\n</oai-mem-citation>";
+    const text = `answer\n${entriesOnly}`;
+    expect(escapeMemoryCitationMentions(text)).toBe(text);
+    expect(streamed([...text])).toBe(text);
+    expect(await bridgeText([...text])).toEqual({ deltas: text, done: text });
+  });
+
+  test("the Responses bridge streams the same text it reports as done", async () => {
+    const run = async (pieces: string[]) => {
+      const raw = await new Response(bridgeToResponsesSSE(
+        replay(textEvents(pieces)), "internal/model", undefined, undefined, undefined, undefined, 2_000,
+        { translatorBudget: createTestTranslatorBudget(), enforceDeclaredToolNames: false },
+      )).text();
+      const frames = raw.split("\n\n").map(block => block.split("\n").find(line => line.startsWith("data: "))).filter(line => line && line !== "data: [DONE]")
+        .map(line => JSON.parse(line!.slice(6)) as { type?: string; delta?: string; text?: string });
+      return {
+        deltas: frames.filter(f => f.type === "response.output_text.delta").map(f => f.delta ?? "").join(""),
+        done: frames.find(f => f.type === "response.output_text.done")?.text ?? "",
+      };
+    };
+    const real = `lead\n${REAL_BLOCK}`;
+    const block = await run([...real]);
+    expect(block.deltas).toBe(real);
+    expect(block.done).toBe(real);
+    const mention = await run(["quoted <oai-mem-", "citation> prose"]);
+    expect(mention.deltas).toBe("quoted &lt;oai-mem-citation> prose");
+    expect(mention.done).toBe(mention.deltas);
+  });
+
+  test("a held candidate block is charged to the translator budget and released at close", async () => {
+    const body = "MEMORY.md:1-2|note=[x]\n".repeat(150);
+    const candidate = `<oai-mem-citation>\n<citation_entries>\n${body}`;
+    const pieces: string[] = [];
+    for (let at = 0; at < candidate.length; at += 500) pieces.push(candidate.slice(at, at + 500));
+    const peak = async (text: string[]) => {
+      const budget = createTestTranslatorBudget();
+      await new Response(bridgeToResponsesSSE(
+        replay(textEvents(text)), "internal/model", undefined, undefined, undefined, undefined, 2_000,
+        { translatorBudget: budget, enforceDeclaredToolNames: false },
+      )).text();
+      return budget.snapshot();
+    };
+    const held = await peak(pieces);
+    // Same bytes and newlines, but not a tag, so nothing is held.
+    const free = await peak(pieces.map(piece => piece.replace("<oai-mem-citation>", "<oai-mem-citatioX>")));
+    // The never-closed candidate is held whole, so the bridge's high-water mark carries it ...
+    expect(held.highWaterBytes).toBeGreaterThanOrEqual(free.highWaterBytes + Buffer.byteLength(candidate) / 2);
+    // ... and everything is released once the message closes.
+    // (The escaped `&lt;` adds a few bytes to the retained text, nothing more.)
+    expect(Math.abs(held.currentBytes - free.currentBytes)).toBeLessThanOrEqual(16);
+  });
+
+  test("an oversized candidate stops being held and is escaped like the final text", () => {
+    const huge = `<oai-mem-citation>\n<citation_entries>\n${"y".repeat(40_000)}`;
+    const escaper = createMemoryCitationEscaper();
+    const out = [...huge.match(/[\s\S]{1,4000}/g)!].map(piece => escaper.push(piece)).join("");
+    expect(Buffer.byteLength(escaper.pending())).toBeLessThanOrEqual(16_384 + 4_000);
+    expect(out + escapeMemoryCitationMentions(escaper.pending())).toBe(escapeMemoryCitationMentions(huge));
+  });
+
+  test("a block above the hold limit is a mention in the streamed and the final text alike", () => {
+    const big = `<oai-mem-citation>\n<citation_entries>\n${"MEMORY.md:1-2|note=[x]\n".repeat(900)}</citation_entries>\n`
+      + "<rollout_ids>\n0123\n</rollout_ids>\n</oai-mem-citation>";
+    expect(big.length).toBeGreaterThan(16_384);
+    const finalText = escapeMemoryCitationMentions(big);
+    expect(finalText.startsWith("&lt;oai-mem-citation>")).toBe(true);
+    expect(streamed(big.match(/[\s\S]{1,1000}/g)!)).toBe(finalText);
+  });
+
+  test("signed progress text escapes only its visible copy, and the mirror check still matches", async () => {
+    const raw = "quoted <oai-mem-citation> prose";
+    const sse = await new Response(bridgeToResponsesSSE(
+      replay([
+        { type: "text_delta", text: raw, anthropicThinkingSignature: "SyntheticProgressSignature123456==" } as AdapterEvent,
+        { type: "done" } as AdapterEvent,
+      ]), "internal/model", undefined, undefined, undefined, undefined, 2_000,
+      { translatorBudget: createTestTranslatorBudget(), enforceDeclaredToolNames: false },
+    )).text();
+    const frames = sse.split("\n\n").map(block => block.split("\n").find(line => line.startsWith("data: ")))
+      .filter(line => line && line !== "data: [DONE]").map(line => JSON.parse(line!.slice(6)) as {
+        type?: string; text?: string; delta?: string; item?: { type?: string; encrypted_content?: string; content?: unknown[] };
+      });
+    const escaped = "quoted &lt;oai-mem-citation> prose";
+    expect(frames.find(f => f.type === "response.output_text.delta")?.delta).toBe(escaped);
+    expect(frames.find(f => f.type === "response.output_text.done")?.text).toBe(escaped);
+    const items = frames.filter(f => f.type === "response.output_item.done").map(f => f.item!);
+    const carrier = items.find(item => item.type === "reasoning")!;
+    const envelope = decodeReasoningEnvelope(carrier.encrypted_content!);
+    expect(envelope?.txt).toBe(raw);
+    const visible = items.find(item => item.type === "message") as { content?: Array<{ text?: string }> } | undefined;
+    expect(visible?.content?.[0]?.text).toBe(escaped);
+    expect(isAnthropicProgressMirror(visible, envelope)).toBe(true);
+  });
 });
diff --git a/tests/web-search/web-search-memory-citation.test.ts b/tests/web-search/web-search-memory-citation.test.ts
new file mode 100644
index 00000000000..f936e7b4495
--- /dev/null
+++ b/tests/web-search/web-search-memory-citation.test.ts
@@ -0,0 +1,45 @@
+import { expect, test } from "bun:test";
+import type { AdapterEvent } from "../../src/types";
+import type { ProviderAdapter } from "../../src/adapters/base";
+import { parseRequest } from "../../src/responses/parser";
+import { runWithWebSearch } from "../../src/web-search/loop";
+import { createTestTranslatorBudget } from "../helpers/translator-budget";
+
+/**
+ * #8044: the web-search sidecar bridges every inbound wire through the Responses SSE writer. A
+ * quoted memory-citation tag is escaped for the Codex client, while a Chat Completions or Messages
+ * caller (escapeMemoryCitationTags: false from sidecar-execution) receives the raw text.
+ */
+async function answer(escapeMemoryCitationTags?: boolean): Promise<string> {
+  const adapter: ProviderAdapter = {
+    name: "mock-answer",
+    buildRequest: () => ({ url: "https://routed.test/v1", method: "POST", headers: {}, body: "{}" }),
+    fetchResponse: async () => new Response("ok"),
+    async *parseStream() {
+      yield { type: "text_delta", text: "quoted <oai-mem-" } satisfies AdapterEvent;
+      yield { type: "text_delta", text: "citation> prose" } satisfies AdapterEvent;
+      yield { type: "done", usage: { inputTokens: 1, outputTokens: 1, totalTokens: 2 } } satisfies AdapterEvent;
+    },
+    async parseResponse() { throw new Error("parseResponse must be unreachable"); },
+  };
+  const response = await runWithWebSearch({
+    parsed: parseRequest({ model: "routed/model", input: "hi", stream: true, tools: [{ type: "web_search" }] }),
+    adapter,
+    incomingMeta: { headers: new Headers(), translatorBudget: createTestTranslatorBudget() },
+    backend: "exa",
+    exaApiKey: "synthetic-exa-key",
+    hostedTool: { type: "web_search" },
+    selectedForwardHeaders: new Headers(),
+    settings: { model: "exa-fixture-model", reasoning: "low", timeoutMs: 30_000 },
+    maxSearches: 1,
+    ...(escapeMemoryCitationTags === undefined ? {} : { escapeMemoryCitationTags }),
+  });
+  const frames = (await response.text()).split("\n").filter(line => line.startsWith("data: {"))
+    .map(line => JSON.parse(line.slice(6)) as { type?: string; text?: string });
+  return frames.find(frame => frame.type === "response.output_text.done")?.text ?? "";
+}
+
+test("the web-search sidecar escapes a quoted tag for Responses and keeps it raw for Chat/Messages", async () => {
+  expect(await answer()).toBe("quoted &lt;oai-mem-citation> prose");
+  expect(await answer(false)).toBe("quoted <oai-mem-citation> prose");
+});