Untrusted <|rag|> remains text.