Tell the agent its handoff was rejected instead of looping on the file

A refused handoff had no feedback loop. PrepareRelease read the report, the
parser refused it, the worker recorded the error in health, and the next
boundary read the same bytes and refused them again. Run 10 spent four leases
that way and the agent was never told anything.

The plan-progress path already had the answer: answerRefusedProgress says why,
drops the file, and lets the agent write a corrected one. The release path now
does the same, gated on a typed ErrInvalidHandoffAnswer so a transport or Git
failure keeps its retry.

This is the silent-loop shape CLAUDE.md names, in a path nobody had checked.
The three format fixes above it each removed one trigger; this removes the
loop.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CVbaKucEYBjMqVeUgJUsc1

internal/herdr/adapter.go

@@ -5,6 +5,7 @@ import (
 	"crypto/sha256"
 	"encoding/hex"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"log"
 	"orchestra/internal/continuity"
@@ -408,13 +409,20 @@ func (a CLIAdapter) Release(ctx context.Context, s Session) (string, error) {
 	return p.Ref, nil
 }
 
+// ErrInvalidHandoffAnswer marks a handoff the agent authored badly, as opposed
+// to a transport or Git failure. The distinction is the whole point: a bad
+// answer is the agent's to correct, and without a way to tell one from the
+// other the release loop re-read the same refused file at every boundary until
+// the task hit retry_limit. Run 10 spent four leases that way.
+var ErrInvalidHandoffAnswer = errors.New("invalid handoff answer")
+
 // canonicalHandoff keeps Git-derived protocol facts on the worker that owns
 // the checkout. Every authored field comes from the validated agent answer;
 // it never fabricates task intent or a circular next action.
 func canonicalHandoff(s Session, answer, command string) (continuity.Handoff, error) {
 	authored, err := parseHandoffAnswer(answer)
 	if err != nil {
-		return continuity.Handoff{}, fmt.Errorf("adapter: invalid handoff answer: %w", err)
+		return continuity.Handoff{}, fmt.Errorf("adapter: %w: %s", ErrInvalidHandoffAnswer, err)
 	}
 	sha, err := HeadSHA(s.Worktree)
 	if err != nil {

internal/herdr/adapter_test.go

@@ -4,6 +4,7 @@ import (
 	"bufio"
 	"context"
 	"encoding/json"
+	"errors"
 	"net"
 	"orchestra/internal/continuity"
 	"os"
@@ -428,3 +429,23 @@ func TestHandoffPromptStatesTheLimitOnEveryBoundedField(t *testing.T) {
 		}
 	}
 }
+
+// A badly authored handoff must be distinguishable from a transport failure,
+// because only the first is the agent's to correct. Run 10 spent four leases
+// re-reading the same refused report at every boundary.
+func TestInvalidHandoffAnswerIsTyped(t *testing.T) {
+	long := strings.Repeat("x", 219)
+	_, err := canonicalHandoff(Session{Worktree: t.TempDir()}, `NEXT: a
+WHY: b
+REMAINING: c
+DEAD ENDS: NONE
+OPEN Q: `+long+`
+LEARNED: e
+`, "")
+	if !errors.Is(err, ErrInvalidHandoffAnswer) {
+		t.Fatalf("an over-long authored field must be ErrInvalidHandoffAnswer, got %v", err)
+	}
+	if !strings.Contains(err.Error(), "219") {
+		t.Errorf("the refusal does not name the length: %v", err)
+	}
+}