governance(autonomy): the guardrail matrix is silent on the c3-this-run per-invocation merge widening

[kyle-sexton]

The autopilot + --merge c3-this-run typed pair widens a single invocation's merge authority to
C3, but the governing guardrail matrix does not acknowledge, authorize, or bound that mechanism
anywhere. Two audit passes independently reached this conclusion, and it is why review thread
PRRT_kwDOTCGFQM6TRjqD (#1147) was left open rather than resolved during the
stranded-review-findings sweep.

Evidence

• git grep -inE "this-run|per-invocation|single-run|single invocation" origin/main -- plugins/autonomy/
  returns zero hits. The matrix's only route to a C3 auto-merge remains predicate + recorded flip.
• plugins/source-control/skills/babysit-loop/evals/evals.json:95-99 asserts as expected behavior
  that the lane "widens the merge dimension to C3 for this invocation only" against a snapshot whose
  tracked babysit_loop_merge is c2-mechanical — the C3 cell is unpromoted and a C3 PR merges anyway.
• No ADR covers it: git grep -n "c3-this-run" origin/main -- docs/adr/ is empty.
• Shipped, not merely documented: plugins/source-control/skills/babysit-loop/SKILL.md:75, :131, :205;
  reference/pre-escalation-dispatch.md:5, :14, :34; reference/config-resolution.md:132-153.

What is NOT wrong

The exception itself is carefully specified at config-resolution.md:130-155: it requires BOTH typed
tokens on the invocation line, no config layer can supply either, c3-this-run is invalid as a config
value anywhere, it never persists, and it is bounded by an unconditional C4/C5 floor. An earlier
framing of this gap proposed "gate the exception" — that was withdrawn after reading the contract,
because the gating already exists. The defect is not a missing guard.

The defect is that plugins/autonomy/ — the governing matrix — is silent about a mechanism that
widens merge authority. A reader of the matrix cannot discover that the widening exists, and the
matrix is the artifact that is supposed to be authoritative on merge policy.

Two candidate fixes

1. Reconcile the matrix: name the per-invocation widening in plugins/autonomy/reference/
   guardrail docs as a sanctioned form, with its bound (both tokens required, never from config,
   never persisted, C4/C5 floor unconditional). The mechanism stays; the matrix stops being silent.
2. Gate on promotion: require the C3 cell already be promoted before the typed pair can widen.
   Stricter, and it would make babysit-loop/evals/evals.json:95-99 a failing expectation, so that
   eval encodes the current intent and would have to change deliberately.

Option 1 matches what the code already does. Option 2 changes behavior and needs a decision about
whether a per-invocation raise should require the matrix's ratified predicate at all. This is an
operator call, not an implementation detail.

Thread disposition

PRRT_kwDOTCGFQM6TRjqD (#1147, P1, bot-only) stays OPEN until this is settled. One audit pass
called it AFFIRM on the grounds that the finding's own wording ("when a repository enables a higher
merge rung") describes a standing raise, which this exception explicitly is not. The second pass
called CHALLENGE because the discharge test is whether the COMPLAINT reproduces — and its harm,
bypassing the class-specific merge floor for a scoped change, does reproduce via an unsanctioned
mechanism. The challenge was adopted: leaving a thread open costs one thread, resolving it wrongly
buries a live merge-authority gap.

Provenance

Stranded-review-findings sweep, 2026-08-08/09. The mechanism's exception landed in d8575516
(#1405), three days after thread TRjqD was filed, which is why the thread's own text does not
reach it.

[kyle-sexton]

Claimed in #2334.