Tell the agent its handoff was rejected instead of looping on the file

A refused handoff had no feedback loop. PrepareRelease read the report, the
parser refused it, the worker recorded the error in health, and the next
boundary read the same bytes and refused them again. Run 10 spent four leases
that way and the agent was never told anything.

The plan-progress path already had the answer: answerRefusedProgress says why,
drops the file, and lets the agent write a corrected one. The release path now
does the same, gated on a typed ErrInvalidHandoffAnswer so a transport or Git
failure keeps its retry.

This is the silent-loop shape CLAUDE.md names, in a path nobody had checked.
The three format fixes above it each removed one trigger; this removes the
loop.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CVbaKucEYBjMqVeUgJUsc1

cmd/orchestra-worker/main.go

@@ -157,6 +157,7 @@ func tail(s string, max int) string {
 	}
 	return s[len(s)-max:]
 }
+
 type workerState struct {
 	Cursor      uint64                        `json:"cursor"`
 	Sessions    map[string]herdr.Session      `json:"sessions"`
@@ -847,6 +848,15 @@ func (w *worker) advanceRelease(ctx context.Context, id string, s herdr.Session)
 			w.releases[id] = tx
 			_ = w.save()
 			w.recordError(fmt.Errorf("release %s prepare: %w", id, err))
+			// A badly authored handoff is the agent's to correct, and it is
+			// the only release failure that is. Recording it in worker health
+			// alone left the release re-reading the same refused file at every
+			// boundary until the lease expired, four times over in run 10.
+			// Same shape as answerRefusedProgress: say why, drop the file, let
+			// the next rotation prompt produce a better one.
+			if errors.Is(err, herdr.ErrInvalidHandoffAnswer) {
+				w.answerRefusedHandoff(ctx, id, s, err)
+			}
 			return
 		}
 		tx.Ref, tx.AnchorSHA, tx.Phase, tx.LastError, tx.UpdatedAt = prepared.Ref, prepared.AnchorSHA, "anchor_pushed", "", time.Now().UTC()
@@ -2175,6 +2185,22 @@ func (w *worker) tellProgressOutcome(ctx context.Context, id string, s herdr.Ses
 	log.Printf("plan phase %s of %s: %s", phase, id, status)
 }
 
+// answerRefusedHandoff tells the agent why its handoff was rejected and drops
+// the file, so the next rotation prompt is answered afresh rather than the
+// same refused bytes being re-read forever.
+func (w *worker) answerRefusedHandoff(ctx context.Context, id string, s herdr.Session, cause error) {
+	text := "Orchestra rejected your handoff answer: " + cause.Error() +
+		"\n\nWrite " + herdr.HandoffReportFile + " again, correcting that, and stop. Do not repeat the rejected answer."
+	if err := w.sendPrompt(ctx, s, text); err != nil {
+		w.recordError(fmt.Errorf("deliver handoff refusal %s: %w", id, err))
+		return
+	}
+	if err := os.Remove(filepath.Join(s.Worktree, herdr.HandoffReportFile)); err != nil && !os.IsNotExist(err) {
+		w.recordError(fmt.Errorf("drop refused handoff %s: %w", id, err))
+	}
+	log.Printf("handoff %s refused: %v", id, cause)
+}
+
 // answerRefusedProgress tells the implementer why its request was refused and
 // drops the file so a corrected one can be written. Recording a refusal only
 // in worker health leaves a live session rewriting the same rejected file at