feat: opt-in observer autostart so instinct minting runs automatically

[ikeikeikeike]

Why

Instinct minting (bough observer start) was a manual, per-machine step. This
adds instinct.observer.autostart — the "opt-in once, then automatic" switch:
with it on, the UserPromptSubmit hook ensures the observer daemon is running
for the monorepo, so instincts mint automatically without remembering a manual
start. Independent of the Claude Code plugin PR (#103); this is pure bough core.

What

Area	Change
config	instinct.observer.{autostart,interval_sec} (off / 10-min default, floored 60s)
hook.go	dispatchObserverAutostart on UserPromptSubmit — once per turn, silent, best-effort
observer_daemon.go	extract startObserverDaemon (shared with observer start) + observerDaemonRunning
doctor.go	report autostart posture (OFF / ON idle / ON running)

Off by default — the daemon spawns claude --print, so bough never starts it
silently; minting stays capped by the self-DoS limiter. Auto-mints instincts
only; clustering into skills/agents/commands stays the explicit bough evolve --generate.

Verification

Live smoke (fresh temp repo; daemon run under a claude-less PATH → zero LLM
calls): gate ON → observer running, gate OFF → not running, bough doctor
shows the posture, no residue. go test ./internal/... + golangci-lint green.

[ikeikeikeike]

Check-then-write-pidfile race: resolveObserverProject canonicalises every worktree of a monorepo to the same root/pid path, and dispatchObserverAutostart now runs this on every UserPromptSubmit from a fresh bough hook handle process. Two sessions in different worktrees of the same monorepo can race here - both call daemonRunning(pidPath, ...) before either has written the pid file, both see "not running", and both spawn their own detached daemon. Only the last pidfile write is visible to observer stop/doctor, so the other keeps ticking as an undiscoverable orphan, doubling the LLM call rate.

Adding a short-lived lock file (<pidPath>.lock, atomic O_EXCL, reclaimed if stale) around this check-then-spawn section so concurrent callers can't both pass the gate. Pushing that change now.

[ikeikeikeike]

This discards all four startObserverDaemon return values including err. If os.Executable() fails, child.Start() fails (permissions, ulimit, OOM), or the pid-file write fails, an operator who opted into autostart gets no daemon, no error, and no log entry anywhere - bough doctor will keep reporting "autostart ON - not running yet" forever with no trail explaining why. The manual bough observer start path surfaces the exact same failure as a clear error.

Since this hook's stdout carries the injected instinct block and must stay silent, logging the error to the observer's own log file (the same place status/doctor already point to) instead of discarding it. Pushing that change now.

[ikeikeikeike]

This ad hoc filepath.Join(root, ".bough.yaml") + BOUGH_CONFIG check never falls back to .worktree-isolation.yaml, which resolveConfigPath (and Load's own doc comment) still support as a deprecation-warned v0.3 name. A monorepo that has not renamed it yet sets instinct.observer.autostart: true there, loadConfigQuiet errors on the missing canonical path, and this silently returns without ever starting the daemon - bough doctor's autostart line then also (independently) reports OFF, masking the operator's actual config.

Switching to resolveConfigPath via a small shared resolveObserverConfig helper (also used by doctor.go's posture line) fixes the fallback and removes the undocumented BOUGH_CONFIG one-off in favor of the canonical --config flag resolution every other command uses. Pushing that change now.

[ikeikeikeike]

This cwd -> resolveMonorepoRoot -> cfgPath (+ BOUGH_CONFIG override) -> loadConfigQuiet block is now copy-pasted a third time (the pre-existing dispatchEvolveClaudeMD has the same six lines, and doctor.go's new autostart-posture block reimplements it again).

Fixed together with the finding on line 519 below: extracted resolveObserverConfig (uses resolveConfigPath) and pointed doctor.go's autostart line at the same resolveConfigPath call, so this hook path and bough doctor's reported posture can't drift apart. Left the pre-existing dispatchEvolveClaudeMD copy alone since it isn't part of this diff and changing it would go beyond this PR's scope.

[ikeikeikeike]

Fair point: when the daemon is already running, this still redoes a full liveness check (including a ps subprocess spawn via pidIsObserverDaemon) on every single UserPromptSubmit turn.

Not fixing this one: since each bough hook handle invocation is a fresh process (no in-memory cache survives between turns), avoiding the ps call would need either a persistent cross-invocation cache (a new subsystem, disproportionate to this PR) or weakening the identity check to a bare syscall.Kill(pid, 0) - which would risk a false "already running" on a recycled pid and silently mask a real double-daemon state, exactly the failure class the finding above (and this PR's lock fix) is trying to close. Leaving it as a known, intentional trade-off rather than guessing at a fix.

[ikeikeikeike]

Retrospective review found a still-live duplicate-daemon gap here (as part of a broader sweep — see PR #118 for the fix).

startObserverDaemon's check-then-spawn section trusts the pid file alone (daemonRunning), but observer stop / status / doctor's posture check already fall back to a process-table scan (findDaemonByRoot) when the pid file is missing, stale, or never captured a spawn race — the fix PR #47 shipped for #45. That fallback was never carried into this shared startObserverDaemon, so a live daemon left behind with no (or a wrong) pid file makes this spawn a second daemon for the same root.

That gap was tolerable while observer start was a rare, deliberate operator command. This PR wires the exact same gate onto every UserPromptSubmit via autostart, turning a rare edge case into a standing risk of silently doubling the minting rate — one instance of the exact failure class this review pass was told to watch for on an autostart feature.

Two related issues in the same area, also fixed in PR #118:

• dispatchObserverAutostart (internal/cli/hook.go) only logs a spawn failure when startObserverDaemon returns a non-empty logPath — but it returns "" for its two earliest failure modes (resolveObserverProject / EnsureProjectDirs erroring), so those failures vanish with zero trace, contradicting this function's own doc comment.
• InstinctObserver.IntervalSec's validate:"omitempty,min=60" tag rejects the entire .bough.yaml for a sub-60 interval_sec, even though observerAutostartInterval already floors that value gracefully at read time — a typo silently breaks every unrelated feature sharing the same config load.