fix(agent): prevent historical OOB steer replay

[burak33bb]

Fixes #78237

Summary

Prevent an already-delivered mid-turn user message from being interpreted again as a fresh OUT-OF-BAND instruction during a long-running turn.

Root cause

Hermes appends trusted OOB messages to a tool result. That marker remains in immutable conversation history and is therefore included in later API requests.

The existing system-prompt contract established that the marker was trustworthy, but did not distinguish:

• a newly delivered marker in the latest tool-result batch, from
• a historical marker already followed by an assistant response.

A model could consequently interpret the historical marker as a new instruction and repeat previously completed, potentially non-idempotent work.

Fix

• Mark each OOB block as a single delivery at its exact conversation position.
• Explicitly state that replaying the block from history is not another delivery.
• Define a marker as fresh only when it belongs to the latest tool-result batch and no later assistant message follows it.
• Tell the model not to repeat completed work solely because an OOB record remains in history.

The fix does not mutate previous messages, rebuild the system prompt mid-conversation, or change message-role alternation, so prompt-cache stability is preserved.

Duplicate check

No PR currently references or fixes #78237.

Related work was inspected and is distinct:

• fix: deliver leftover /steer as out-of-band user message (#60543) #60555 delivers leftover /steer messages with the correct trust marker.
• fix(steer): preserve late steer after output truncation #63764 preserves late steer messages across output-truncation exits.
• fix(session-db): persist post-flush /steer mutation to SQLite #52604 persists post-flush steer mutations to SQLite.
• fix(prompt): remove fillable OOB marker template from system prompt to prevent model fabrication #65360 and fix(prompt): remove fillable OOB marker template, with prompt-contract regression tests #72831 prevent models from fabricating fake OOB markers.
• feat(anthropic): use native mid-conversation system messages on Fable 5/Mythos 5/Opus 4.8 #68275 adds native Anthropic mid-conversation steering.

None defines the one-shot lifetime of a genuine historical OOB marker.

Validation

• tests/run_agent/test_steer.py
• tests/agent/test_prompt_builder.py
• 83 targeted tests passed
• Ruff passed
• git diff --check passed

The broader tests/agent/test_system_prompt.py file has an unrelated pre-existing Windows path-normalization assertion (/hermes vs \hermes); the changed OOB suites are green.

[kshitijk4poor]

Merged via #79170 — your commits cherry-picked onto current main with authorship preserved (rebase merge).

Thank you for the contribution! The steer marker one-shot lifetime contract is a solid defense-in-depth improvement.