gemini-3.5-flash-lite verbalizes its function call as pseudo-XML in the text stream instead of emitting a functionCall part

Gemini API
, ,
1 
When a tool is declared and the system prompt instructs the model to call it
on every response, gemini-3.5-flash-lite sometimes emits the call as
pseudo-XML **inside the user-visible text stream** instead of producing a
`functionCall` part:

```
C'est noté, tu habites en France ! Y a-t-il une règle spécifique de
Warmachine sur laquelle tu aimerais que je t'éclaire ?

<call:default_api:mandatory_tool xmlns:default_api="default_api" categoryNames:[greetings,QA],suggestedTitle:Règles de Warmachine et pays de pays/>
```

Setup:

- Model: `gemini-3.5-flash-lite`, Vertex AI, global endpoint,
  `streamGenerateContent`.
- `toolConfig: {"functionCallingConfig": {"mode": "VALIDATED"}}`.
- Three declared tools (a bookkeeping report with an enum parameter, a
  knowledge-base lookup, a form-filling tool).
- The system prompt ends with a protocol section demanding exactly one
  bookkeeping call per response.
- Multi-turn conversation; the previous model turn was a functionCall
  (form-filling) followed by its functionResponse.

The response contains NO functionCall part — the pseudo-XML sits in the
`text` part and reaches end users as-is. Note the `default_api` namespace,
which is not part of our prompt or tool names: it looks like an internal
training-format artifact surfacing in the wrong channel.

This looks related to (but distinct from) other wrong-channel reports:
python-style pseudo-calls in plain text (livekit/agents#5662), raw XML tags
in gemini-cli output (google-gemini/gemini-cli#22441), and JSON leakage in
mixed text+image responses (forum #113712).

Expected: either a proper functionCall part, or plain text without
tool-call syntax. Is there a recommended server-side mitigation, or is
client-side stripping the intended answer?

Repro: probabilistic (temperature 0 does not make it deterministic). We can
share the full request body if useful.

**AI assistance disclosure:** drafted with AI assistance (Claude); the leaked output and request shown are unedited production captures, verified by a human.