tmbx: the description refusal skips a foreign block, like the one above it (#399)

[hugolytics]

Takes the three LOW items from #399 — the slice that is fixes rather than decisions. The decision items on that ticket (capping a planning turn, the FakeCalendar wire map, withholding material_put, the retraction gap) are deliberately left open; each is a call for Hugo, not an implementation, and #399 stays open for them.

The bug: a foreign block deadlocks the day, by the other door

#398 taught _dead_link_violation to skip a block tmbx does not own. The reason is a deadlock: the refusal names one remedy — clear the link with an explicit null — and that null is a write to a foreign event, which _foreign_touches refuses outright. So checking a foreign block refuses every commit of that day forever, with no way out.

_long_description_violation sits one screen below it and never learned the same thing. A foreign block carrying a live handle and an over-long description refused every commit of that day, and both remedies that message offers — shorten the description, or drop the link — are foreign writes that cannot happen. Nothing tmbx owns is broken; the day simply cannot be planned.

Same one-word fix, foreign_handles, already in scope at the call site.

The docstring now records the pairing rather than just the fix: the two refusals share a deadlock, so a filter added to either belongs on both. That is the part that would have prevented this landing a release late.

A guard that could not fail

_write_event_args claimed the private map was "included only when at least one of those eight is set", and an if private: implemented it. Both stopped being true when _private_properties began writing None as an empty string rather than dropping the key — it returns a fixed eight-entry map that is never falsy.

Nothing changes on the wire. test_an_event_with_no_identity_sends_every_key_empty already pinned the real behaviour; this aligns the code and its prose with the test that was already right.

A union nothing was gating

After gather(..., return_exceptions=True) in timeboxing_host.resolve, narrowing by looping over the pair narrows only the loop variable — so constraints and work stayed T | BaseException, and work.facts below is an attribute access on that union. Runtime was always correct; no type checker gates this path today, which is the only reason it went unnoticed. Narrowed one name at a time, constraints first, which is the order the comment above it promises.

Rubric proof

• The deadlock test fails without the fix — test_a_foreign_blocks_long_description_does_not_refuse_the_day raises PlanViolation: EVT1: description is 1025 characters, over the 1024-character limit on the unfixed code. It uses a live handle, not a dead one, so the dead-link check passes the block through and this refusal is the only one that can fire.
• The guard test is not vacuous. test_an_owned_blocks_long_description_still_refuses passed on its first run, so per CLAUDE.md it was broken on purpose: over-narrowing the filter to skip every block fails it plus three pre-existing refusal tests.
• Suite: 3032 passed, 10 skipped, 1 xfailed across tests/unit tests/integration tests/e2e; tests/unit/tmbx + tests/memory 851 passed. Offline, no model calls.

For the human reviewer

• The foreign-block exclusion is right for the length refusal specifically. It is not the same argument as the dead-link one: a dead handle has no url to write, whereas a long description is a real constraint that simply cannot be acted on for a block tmbx may not write. Both end in the same deadlock, but confirm the conclusion is wanted for this one.
• Removing if private: is genuinely inert. It is dead by construction rather than by test, so it is worth a second pair of eyes on _private_properties returning a fixed eight-entry map.

Docs for this round are #410, landing on this branch per the CLAUDE.md rule that a round carries its docs ticket into the same PR.

🤖 Generated with Claude Code

[hugolytics]

Docs for #410 have landed on this branch — 0c933cd, docs/architecture/materials-and-work-links.md only. It documents _long_description_violation (which the doc never mentioned), corrects the _dead_link_violation paragraph that has been wrong since #398, and records the shared foreign-block deadlock so the next commit-time refusal gets the same question asked of it.

Two notes on branch state:

This branch is based on 8dd10d4, not current main (b2ffb21, #408). GitHub reports the PR MERGEABLE/CLEAN, so no rebase is needed to merge. I did rebase locally onto b2ffb21 and re-ran the full offline suite there — 3338 passed, 10 skipped, 1 xfailed across tests/unit tests/integration tests/e2e tests/memory — so it is verified green against main including #408, even though what is pushed here predates it.

I could not push that rebase. git push --force-with-lease and git reset --hard are both blocked by this session's own permission settings. Nothing is wrong with the branch; it simply cannot be force-updated from here. If you want the linear history, the rebase is git rebase origin/main and a force-push — otherwise merging as-is is fine and loses nothing.