周五走人后代理还在合 PR：周一早上 main 已经偏了，刹车装在哪？（中英切换）

Friday 18:00. The Tech Lead closes the laptop on machine-4. The last commit on main is an afternoon-reviewed null-guard on discounts. Payments, auth, and migrations are untouched. The repo rule says "merge when CI is green" — a weekday default, also baked into AGENTS.md on machines 1–3.

Saturday 02:00, machine-1's agent finishes a SameSite fix behind the CDN. CI green. gh pr merge. Saturday morning, machine-2 bumps eslint and regenerates the lockfile. Sunday afternoon, machine-3 lands CREATE INDEX CONCURRENTLY on orders.user_id. In between: Stripe webhook retries on 429, a workflow cache tweak, a one-line terraform cleanup. Every PR is green. No human pressed the button — the rule said merge, so the agents merged.

Monday 09:00, machine-4 opens GitHub: main has moved seven to ten commits past Friday. Payment paths changed, cookie policy changed, a production migration already ran, lockfile and CI workflow are no longer Friday's. The question is not "which open overnight PRs do I kill in 90 minutes" (/overnight-agent-pr-morning-triage/). It is: for commits already on main while humans were away, where should the brake have been?

Scene: three people, seven machines, one wrong default

Roles stay fixed: machines 1–3 open PRs at high frequency, 4–5 review, 6 validates on Windows, 7 merges/ops. "CI green → merge" works on weekdays because 4–5 are still looking and 7 is still on shift. Friday 18:00 to Monday 09:00, humans leave; the default does not change.

Agents do not invent a "weekend policy". They see: tests green, no enforced do-not-merge check, token can merge. The weekend becomes an unattended merge window. Today is Saturday 2026-11-07 — this essay is about the window that is open right now, not a retrospective template.

Lab: one weekend, five brakes

On this box a JSON fixture schedules 13 agent PRs (drive-by cleanup, medium refactors, auth, payments, migration, lockfile, workflow, infra) across Fri 18:00 → Mon 09:00 (Asia/Taipei). A 40-weekend Monte Carlo adds light CI flake and a 10% chance a human blesses one medium PR before leaving. Merge counts are simulated — no live GitHub merge API. A separate toy git timeline is a real repo on disk for Monday's diff.

Primary weekend (no human:weekend-ok) headlines:

• A / B: merged 10, high-risk 6, Monday understand 258 min, revert hard (score 100). B matches A exactly — a label without enforcement is not a brake.
• C / D: merged 0, high-risk 0, Monday 5 min, revert none.
• E: merged 2 (drive-bys), high-risk 0, Monday 14 min, revert easy.

40-weekend averages: A/B merged 12.35, hard revert 100%; C/D merged 0.17 (rare bless), hard 0%; E merged 2.17, hard 0%. When a human blesses medium PR #505 before leaving, C merges 1 and E merges 2 — blessing is an escape hatch, not the default lane.

High-risk prefixes are pinned in policy: src/auth/, src/payments/, migrations/, lockfiles, .github/workflows/, infra/. A/B drag all of them onto main; C/D/E keep high-risk off without a bless.

Toy repo: Friday SHA → Monday SHA

A linear toy repo on this box. Friday baseline d54365f: 10% discount, SameSite=Lax, single-shot webhook, no 0042 migration. After an A-path subset of merges, Monday tip 5be3b99, seven commits in git log, git diff --stat covering auth, payments, billing, migration, lockfile, workflow.

git revert of the migration commit is clean on linear history — the file disappears. In production, CREATE INDEX CONCURRENTLY is not something git revert undoes: the index already exists. Lockfile and workflow rollbacks also cost a release. That is why A's revert label is hard: not because git syntax is hard, but because changes that already hit reality are hard to take back.

Mechanism: why "CI green" is the wrong weekend default

1. CI green answers "tests passed", not "humans want this on main while asleep". Bind them in one rule and merge rights fall to agents the moment people leave.
2. Labels are not a control plane. merge-freeze / do-not-merge without a required check or merge queue is a comment to an agent holding a merge token. B ≡ A.
3. Native time-based rulesets are limited. The practical brake: Actions cron sets repo variable MERGE_FREEZE=true Friday 18:00 Asia/Taipei (UTC cron in the kit), flips it off Monday 09:00; a pull_request job runs merge_window_gate.py --check-env; branch protection / ruleset requires the check named merge-window. That is D — the install I recommend by default.
4. Bless labels are explicit exceptions. human:weekend-ok means a human owns "this may ship this weekend". Without it, in-window merges should fail.
5. E's quota and blocklist loosen the gate; they do not replace it. A few drive-bys cut Monday PR pile-up; auth/pay/migration/lockfile/workflow/infra still block. If weekend agents may only touch docs, E is enough; if main must not move, use C/D (merged 0).

The gate script passed fixtures on this box: Saturday without bless → exit 1; with human:weekend-ok → exit 0; Monday morning → exit 0; Friday 17:59 → exit 0, 18:00 → exit 1; under-quota README in quota mode → exit 0; payments path → exit 1.

Costs and when not to bother

• One more required check: on weekday daytime MERGE_FREEZE=false and the check should pass immediately — do not turn it into daily friction.
• Wrong cron timezone freezes early or late — pin Asia/Taipei in policy; convert to UTC for cron (kit: Fri 10:00 UTC / Mon 01:00 UTC).
• Hotfixes need a bless path and a clear owner for human:weekend-ok (usually a human on machines 4/5/7 — agents must not self-bless).
• Skip when: weekends already ban all merges and merge tokens are revoked; or one machine, human never leaves the merge button.
• Will not save you when: someone admin-bypasses / deletes the check; or CD runs migrations the moment they land — that needs a release brake, see boundaries.
• Not a review lease, Windows evidence fetch, Issue claim, or overnight open-PR triage. The trigger here is: after humans leave, may a green PR still enter main?

Failure scene: what Monday looks like under A

Spread the primary weekend's 10 merges by risk and machine-4's Monday queue looks like this:

1. Triage (~40 min). Which are drive-bys (slugify, CSS sort) and which touched money and login. Without a gate you must open auth, payments, migration, lockfile, workflow, and infra — six high-risk classes — just to sort.
2. Decide what may stay (~90–120 min). SameSite=None behind a CDN may be correct, but Friday never reviewed the threat model; Stripe 429 retries may break idempotency assumptions; CREATE INDEX CONCURRENTLY is already on the database — even if git revert deletes the migration file, the index remains.
3. Choose what to undo (time runs out). Lockfile and workflow rollbacks need another release; deleting an infra variable may already have hit the next apply. The 258 "understand" minutes do not yet include real fixes or coordination.

That is what "main has drifted" means: not an ugly diffstat, but the product assumptions at human departure rewritten legally under "green". Under B the process is identical — a red merge-freeze label hangs on the repo, and it never appears in the agent merge log.

Why agents "ignore" labels (and why scolding them fails)

Agents are not malicious. Their loop is usually: read AGENTS.md → open PR → wait for checks → gh pr merge. Unless you put "read repo labels / run the gate / respect the required check" into that loop and exit on failure, a label is UI decoration. Three failure modes we see across repos:

• The prompt says "don't merge on weekends" but the merge command has no pre-check → equals A.
• A human stuck do-not-merge, yet the agent's token is not constrained by that label (it only affects the human merge button or an unconfigured merge queue) → equals B.
• The check exists, but on red the agent --admin bypasses or turns protection off → the brake is removed by hand.

So the title's question — where does the brake go — means: on the merge path, not in the prompt. C puts it on a script exit code; D lifts the same semantics into a required GitHub check; E adds quota and a path blocklist on top. Prompts still matter; they are the manual, not the lock.

Three pits when installing D

1. Timezone. Cron is UTC. Asia/Taipei Friday 18:00 = Friday 10:00 UTC; Monday 09:00 = Monday 01:00 UTC. A cron written as "Friday 18:00 local" freezes the window early or late. Keep human-readable Taipei time in the policy JSON; put converted UTC in the workflow.
2. Fail open vs fail closed. If MERGE_FREEZE cannot be read, the sample defaults fail-open (treat as false) to avoid weekday false freezes. If your threat model is "rather slow than unattended merge", fail closed — missing variable means frozen. Pick one in AGENTS.md; do not leave it to vibe.
3. Variable write permission. The cron job that flips a repo variable needs more than the default GITHUB_TOKEN (fine-grained PAT or GitHub App). The kit's schedule step prints gh variable set by default so a sample push does not mutate your variables. Rehearse on an empty repo before wiring prod.

C and D share numbers; pick D because agents can forget to run a script, and cannot (easily) skip a required check. Leaving the gate only on the agent side is back to "please be good".

Split from a release brake

A merge brake ≠ a release brake. Even if C/D allow a migration PR with human:weekend-ok, CD may still apply it to production on Saturday. This gate covers the git trunk; production release still needs environment rules, manual approve, or a pipeline condition that skips migrate on weekends. Missing both yields "main green and prod already drifted"; merge-gate alone yields at worst "main quiet, prod stays Friday". For a three-person seven-machine team, install the merge gate first — cheaper, smaller rollback surface.

Boundaries with sibling posts

• /overnight-agent-pr-morning-triage/: open PRs Monday morning, 90-minute kill order. This post is commits already on main over the weekend and their blast radius. They can coexist in one week: this post shrinks already-merged shock; that one clears the still-open queue.
• /revert-bad-pr-after-more-merges/: how to undo after the fact. This post tries to keep high-risk weekend merges off main so Monday needs fewer reverts. If you are already in an A-style Monday, read that revert closure first, then come back to install the gate.
• /approve-then-force-push-which-sha/: Approve vs HEAD SHA. This post is a time window, not a SHA anchor.
• /agent-machine-least-privilege/: review machines should not hold merge rights. Complementary: even when dev machines can merge, the window gate should still block unattended merges. Least privilege shrinks blast radius; the merge window shrinks the unattended surface.
• /two-agents-claim-same-issue/: who may start. This post: who may merge. Failed claims burn tokens; weekend mis-merges burn Monday morning and maybe a prod fix.

Copy-tomorrow minimum

1. Create label human:weekend-ok (and optional informational merge-freeze). Remember: label without a required check = strategy B.
2. Drop merge_window_gate.py + merge_window_policy.json into tools/; AGENTS.md: CI green ≠ mergeable; on gate exit 1 ban --admin bypass; ban agents self-applying human:weekend-ok.
3. Add the kit's .github/workflows/merge-window.yml: cron flips MERGE_FREEZE, PR runs the gate; tick required check merge-window in the ruleset. On an empty repo, green the three paths freeze-on / freeze-off / bless-allow first.
4. Pin high-risk paths in policy; weekend merges get a human on machines 4/5/7 adding human:weekend-ok plus a one-line reason in the PR.
5. If a few drive-bys are acceptable, enable E's quota (default 2); otherwise keep C/D's in-window default of zero.
6. Before leaving Friday, spend two minutes: will MERGE_FREEZE flip true at 18:00; is there an unmerged PR that must ship this weekend — bless it now, or leave.

Honesty: what ran, what did not

Ran on this box:

• simulate_weekend.py: A–E primary weekend + 40-weekend Monte Carlo; headlines above. Merge counts, high-risk counts, Monday minutes, revert scores are outputs of fixture strategy functions.
• merge_window_gate.py: calendar window, bless, quota, high-risk blocklist fixtures; Friday 17:59/18:00, Saturday, Monday boundaries; --live prints wiring only.
• Toy git: Friday d54365f → Monday 5be3b99 seven merges; git revert of the migration commit clean in history, with a note that production indexes are not undone by git.

Did not run:

• No live gh pr merge against shuizhengqi1/pages or any product repo.
• No real flip of a MERGE_FREEZE variable; the sample workflow is print-only by default.
• No seven-machine integration; "agents ignore labels" is a strategy assumption consistent with multi-repo behavior we see, but this lab did not attach seven runners.
• No claim that GitHub already ships a full wall-clock ruleset — if your enterprise plan gains one later, still keep a required check as backstop.

Kit: weekend-agent-merges-no-human-kit.tar.gz — gate script, simulator, results.json, policy, Actions sample, AGENTS.md snippet, label script, toy log.

One-line judgment: CI green proves tests passed, not that main should move while humans sleep. Smallest step today: stop asking "is this PR green?". Before humans leave, ask "is merge still open?" — if yes, and no gate check exists, Monday's main is not the product you left on Friday.