fix(plan-tune): reject never-ask on one-way ids at --write

[szsunyuan]

Why (in your own words)

I set never-ask on plan-eng-review-arch-finding and --stats said it worked. The next --check still asked, with a note that one-way doors ignore that pref. So the file lied: it stored a preference that can never fire.

--write is what I want to stop. If the id is one-way, refuse never-ask and ask-only-for-one-way (exit 1, name the door type, don't touch the file). --stats should say INERT_ONE_WAY for leftovers already on disk, not NEVER_ASK: 1. always-ask on a one-way id is fine — that matches what --check already does.

Fixes #2488. Related: #2489 (closed — registry path made this easier to hit), #2490 (product split, out of scope), #2390 / #2429 (same --write function, unknown-source exit 2, already on tip).

Why this shape

Issue author asked for reject-at-write plus honest --stats for prefs written before the fix. Storing the value and labeling it INERT is the weaker pair — not done.

CONTRIBUTING's wave rule: if two PRs fix the same thing, keep the smaller one. This is 2 files, on current main. Fine to absorb into a wave.

What it does

• --write never-ask / ask-only-for-one-way on a one-way id exits 1, names door_type: one-way, does not write, does not append an event.
• --write always-ask on a one-way id still succeeds.
• Origin gate still runs first: a poisoning source on a one-way id exits 2, not 1.
• --stats counts leftover one-way suppressing prefs as INERT_ONE_WAY. Working NEVER_ASK is only prefs that --check would actually AUTO_DECIDE.
• --check tests that still need a planted one-way pref write the file directly, because --write now refuses them.

What it deliberately does not do

• Split plan-eng-review-arch-finding (Split plan-eng-review-arch-finding: one-way architecture forks vs two-way code-derived defect findings (the only safely-tunable class is currently unreachable) #2490)
• Change ask-only-for-one-way alias semantics
• Reject --write on *-split-* ids (that carve-out stays --check-only)
• Keyword-net --write (no summary on the write path)
• Hooks, registry, skill templates, VERSION / CHANGELOG / README
• A migration (schema unchanged; --stats is honesty for old files)
• /ship (wave stamps version)

AI was used for assistance.

Live evidence

Same isolated GSTACK_HOME, same payload, cwd = repo:

{"question_id":"plan-eng-review-arch-finding","preference":"never-ask","source":"plan-tune"}

Before (upstream/main binary):

$ bin/gstack-question-preference --write '{"question_id":"plan-eng-review-arch-finding","preference":"never-ask","source":"plan-tune"}'
OK: plan-eng-review-arch-finding → never-ask (source: plan-tune)

$ bin/gstack-question-preference --read
{
  "plan-eng-review-arch-finding": "never-ask"
}

$ bin/gstack-question-preference --stats
TOTAL: 1
ALWAYS_ASK: 0
NEVER_ASK: 1
ASK_ONLY_ONE_WAY: 0

$ bin/gstack-question-preference --check plan-eng-review-arch-finding
ASK_NORMALLY
NOTE: one-way door overrides your never-ask preference for safety.

After (this branch):

$ bin/gstack-question-preference --write '{"question_id":"plan-eng-review-arch-finding","preference":"never-ask","source":"plan-tune"}'
gstack-question-preference: cannot set never-ask on one-way question "plan-eng-review-arch-finding" (door_type: one-way)

$ bin/gstack-question-preference --read
{}

$ bin/gstack-question-preference --stats
TOTAL: 0
ALWAYS_ASK: 0
NEVER_ASK: 0
ASK_ONLY_ONE_WAY: 0
INERT_ONE_WAY: 0

Planted leftover file (a pref written before this reject existed):

$ bin/gstack-question-preference --stats
TOTAL: 1
ALWAYS_ASK: 0
NEVER_ASK: 0
ASK_ONLY_ONE_WAY: 0
INERT_ONE_WAY: 1

$ bin/gstack-question-preference --check plan-eng-review-arch-finding
ASK_NORMALLY
NOTE: one-way door overrides your never-ask preference for safety.

Scope

• Changed: bin/gstack-question-preference, test/gstack-question-preference.test.ts
• Verified live by: the transcripts above, plus bun test test/gstack-question-preference.test.ts (52 pass)
• Did NOT test: Tier 2/3 evals. Full bun run test browse/playwright/pdf shards failed here (missing Chromium, make-pdf timeouts) — none of those files are in this diff.

Liveness proof (required)

• Liveness screenshot attached: GSTACK PR typed live into a real surface (not edited onto the image)

Checklist

• Liveness screenshot attached: GSTACK PR typed live into a real surface (not edited onto the image)
• This is not a generated-file-only diff (I edited the source, not a generated SKILL.md)
• No ETHOS.md edits, and no changes to voice / founder perspective / YC references
• New public command / external service / host adapter has an accepted issue linked (or N/A)
• Linked issue or reproduction: gstack-question-preference --write accepts never-ask on one-way ids: preference stores, --stats reports it configured, --check refuses it forever #2488

Test plan

• bun test test/gstack-question-preference.test.ts → 52 pass
• Live --write on plan-eng-review-arch-finding + never-ask → exit 1, file stays {}
• Live --write always-ask on the same id still succeeds
• Live --stats on a planted one-way never-ask → INERT_ONE_WAY: 1, NEVER_ASK: 0
• Poisoning source on a one-way id still exits 2

Fork PRs do not get eval secrets; the free file above is the gate.

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here