Each turn is a new prompt with old history
From the model's perspective, every turn is a fresh forward pass over the entire message history. There is no "continuing from before" — the model re-reads everything every time. That changes the contract: the system prompt has to keep being true, the persona has to keep being held, the rules have to keep applying — across N turns of user input that may try to push them.
The contract that survives
- System prompt is the constitutive frame; it's re-read on every turn.
- Each turn's user input is fresh and untrusted.
- Prior assistant outputs are now part of the model's context — and may include retrieved content the user could be using to inject.
- Stop sequences and refusals from earlier turns don't carry forward unless the system prompt re-asserts them.
The bug pattern
A prompt that works on turn 1 starts misbehaving by turn 8. Almost always: the system prompt was written assuming a single turn, and accumulated user-side context drifts the model away from it.