diff --git a/scripts/deploy-standard-workflows.sh b/scripts/deploy-standard-workflows.sh
index 3daf65b6e..c08763249 100755
--- a/scripts/deploy-standard-workflows.sh
+++ b/scripts/deploy-standard-workflows.sh
@@ -158,6 +158,9 @@ DEPLOYABLE_WORKFLOWS=(
   pr-auto-review.yml
   feature-ideation.yml
   pr-review.yml
+  idea-enhancer.yml
+  idea-triage.yml
+  initiative-planner.yml
 )
 
 # Deployable workflows whose stub BODY carries a documented per-repo edit the
@@ -220,6 +223,11 @@ readonly REPLACE_IF_PRESENT_WORKFLOWS=(
 # the sweep must never read, replace or re-pin it.
 declare -A ENGINE_HOST_REPOS=(
   ["pr-review.yml"]="$ENGINE_HOST_REPO"
+  # The central BMAD idea engines live under these names in .github-private; their
+  # callers here are stubs, so the sweep must not treat the engines as consumers.
+  ["idea-enhancer.yml"]="$ENGINE_HOST_REPO"
+  ["idea-triage.yml"]="$ENGINE_HOST_REPO"
+  ["initiative-planner.yml"]="$ENGINE_HOST_REPO"
 )
 
 # is_replace_if_present_workflow <name.yml> -> 0 if the workflow deploys only over
@@ -601,6 +609,85 @@ merge_guarded_surfaces() {
   return 0
 }
 
+# stub_has_stale_stable_header <existing_content> <template> <repo> -> 0 if the stub carries a
+# comment naming its agent's stable channel (`<base>/stable`, `<base>/v<M>-stable`,
+# `<base> stable channel`) that the template no longer carries (#1297). Such a header
+# contradicts a ring pin; the pin alone is compliant, so without this check the sweep
+# would never ship the comment-only header fix to existing ring repos. In ring repos,
+# even a currently stable-pinned stub must migrate its header because the in-place
+# repin will change the pin to ring, leaving the header contradictory.
+stub_has_stale_stable_header() {
+  local existing="$1" template="$2" repo="$3" base re tier
+  base="$(reusable_base_of "$template")"
+  [[ -n "$base" ]] || return 1
+  re="^[[:space:]]*#.*(${base}/(v[0-9]+-)?stable|${base} stable channel)"
+  grep -qE "$re" <<< "$existing" || return 1
+  # A stable-pinned stub's header agrees with its pin, BUT only when the repo is
+  # stable-tier. In ring-managed repos, a stable-pinned stub is itself an anomaly
+  # that the repin will fix; the header must migrate too, so don't exempt in ring.
+  if ring_is_ring_reusable "$base" && [[ -n "$repo" ]]; then
+    tier="$(ring_tier_for_repo "$base" "$repo" 2>/dev/null)" || tier=""
+    # Ring-managed repo with a tier: the stub should be ring-pinned, so the header
+    # is stale regardless of the current pin.
+    if [[ -n "$tier" ]] && [[ "$tier" != "stable" ]]; then
+      # The template may still carry the stable wording; ring renders (ring_repin_uses)
+      # and the header cleanup neutralize it, so the template never exempts a ring repo.
+      return 0  # Flag as stale
+    fi
+  fi
+  ! grep -qE "$re" "$template" || return 1
+  # Non-ring reusable or stable-tier repo: apply the exemption (don't flag if
+  # the stub is stable-pinned, since the header agrees with the pin).
+  ! grep -qE "^[[:space:]]*uses:.*@${base}/(v[0-9]+-)?stable([[:space:]]|\$)" <<< "$existing"
+}
+
+# strip_stale_stable_header <base> [<template>] -> stdin minus the stale stable-channel
+# header. With <template>, the stub's whole leading comment block (everything above the
+# first top-level YAML key) is replaced by the template's canonical, tier-neutral header,
+# so a multiline legacy bullet is never left half-deleted. The body is kept verbatim, so
+# per-repo edits (e.g. workflow_run.workflows) survive and the next sweep sees no stale
+# header (#1297). Without <template>, only the lines naming the stable channel are dropped.
+strip_stale_stable_header() {
+  local base="$1" template="${2:-}"
+  if [[ -n "$template" && -r "$template" ]]; then
+    # Body comment blocks (consecutive comment lines) that name the stable channel are
+    # dropped whole too, so a legacy `# Pinned to the moving ... stable channel` block under
+    # `jobs:` does not survive and keep the detector true forever.
+    awk -v tpl="$template" -v base="$base" -v re="^[[:space:]]*#.*(${base}/(v[0-9]+-)?stable|${base} stable channel)" '
+      BEGIN {
+        while ((getline l < tpl) > 0) { if (l ~ /^[^#[:space:]]/) break; hdr = hdr l "\n" }
+        # The template header may still name the stable channel; render it tier-neutral
+        # (same wording as ring_repin_uses) so cleanup never reinstalls it.
+        gsub(base "/(v[0-9]+-)?stable", base "/<tier>", hdr)
+        gsub(base " stable channel", base "/<tier> channel", hdr)
+      }
+      function flush() { if (!stale) printf "%s", blk; blk = ""; stale = 0 }
+      !body && /^[^#[:space:]]/ { body = 1; printf "%s", hdr }
+      body && /^[[:space:]]*#/ { blk = blk $0 "\n"; if ($0 ~ re) stale = 1; next }
+      body { flush(); print; next }
+      END { if (body) flush() }
+    '
+    return 0
+  fi
+  grep -vE "^[[:space:]]*#.*(${base}/(v[0-9]+-)?stable|${base} stable channel)" || true
+}
+
+# Workflows an adopter may or may not have (BMAD idea pipeline). The sweep never
+# seeds them; it only migrates an existing caller, re-pinning its OWN body in place.
+readonly PRESENT_ONLY_WORKFLOWS=(
+  idea-enhancer.yml
+  idea-triage.yml
+  initiative-planner.yml
+)
+
+is_present_only_workflow() {
+  local w="$1" p
+  for p in "${PRESENT_ONLY_WORKFLOWS[@]}"; do
+    [[ "$w" == "$p" ]] && return 0
+  done
+  return 1
+}
+
 # is_already_compliant <existing_content> <template> <repo> -> 0 if the deployed
 # stub needs no re-deploy. A stub is compliant only when it is BOTH pin-compliant
 # (is_pin_compliant, below) AND — when its template carries a real `secrets: inherit`
@@ -615,7 +702,8 @@ merge_guarded_surfaces() {
 # rendered at the repo's tier channel (stub_body_matches_template): its callers
 # predate the template and carry per-repo edits, which are drift. So must every stub
 # in a FULL_BODY_COMPARE_REPOS repo (repo-template, #1285) other than a
-# BODY_PRESERVING_WORKFLOWS one, whose per-repo body is never re-synced.
+# BODY_PRESERVING_WORKFLOWS or PRESENT_ONLY_WORKFLOWS one, whose per-repo body is
+# re-pinned in place and never re-synced from the template.
 #
 # A pin-correct stub whose guarded `on:` / `permissions:` / `concurrency:` surface
 # differs from the template is ALSO drift (#1236): the audit flags it
@@ -634,8 +722,10 @@ is_already_compliant() {
      && ! stub_has_s7635_marker <<< "$existing_content"; then
     return 1
   fi
+  stub_has_stale_stable_header "$existing_content" "$template" "$repo" && return 1
   if is_replace_if_present_workflow "$workflow" \
-     || { is_full_body_compare_repo "$repo" && ! is_body_preserving_workflow "$workflow"; }; then
+     || { is_full_body_compare_repo "$repo" && ! is_body_preserving_workflow "$workflow" \
+          && ! is_present_only_workflow "$workflow"; }; then
     stub_body_matches_template "$existing_content" "$template" "$repo" || return 1
   fi
   if ! is_skipped_repo "$repo" && ! is_body_preserving_workflow "$workflow" \
@@ -887,6 +977,17 @@ deploy_repo() {
         repin_source="$(mktemp)"; _TMPFILES+=("$repin_source")
         printf '%s\n' "$existing_content" > "$repin_source"
       fi
+    elif is_present_only_workflow "$workflow"; then
+      # Optional pipeline stub: never seed; otherwise re-pin its OWN body in place.
+      if [[ -z "$existing_sha" ]]; then
+        skip "$repo/$workflow (present-only: no existing caller — never seeded)"
+        continue
+      fi
+      mode="repin-in-place"
+      if [[ "$DRY_RUN" != "true" ]]; then
+        repin_source="$(mktemp)"; _TMPFILES+=("$repin_source")
+        printf '%s\n' "$existing_content" > "$repin_source"
+      fi
     elif is_body_preserving_workflow "$workflow"; then
       # feature-ideation carries a per-repo project_context the sweep must never
       # clobber. Seed the generic template ONLY when the stub is absent; when it
@@ -928,6 +1029,25 @@ deploy_repo() {
       fi
     fi
 
+    # Stale stable-channel header (#1297): migrate by editing the stub's OWN body, never
+    # by redeploying the template (that would reset per-repo edits such as
+    # pr-auto-review's workflow_run.workflows). Full-body-compared stubs are exempt —
+    # their drift is already resolved by a template redeploy.
+    if [[ "$DRY_RUN" != "true" && -n "$existing_sha" ]] \
+       && stub_has_stale_stable_header "$existing_content" "$template" "$repo"; then
+      base="$(reusable_base_of "$template")"
+      if [[ "$repin_source" == "$template" ]] && ! is_replace_if_present_workflow "$workflow" \
+         && ! { is_full_body_compare_repo "$repo" && ! is_body_preserving_workflow "$workflow"; } \
+         && is_pin_compliant "$existing_content" "$template" "$repo"; then
+        repin_source="$(mktemp)"; _TMPFILES+=("$repin_source")
+        printf '%s\n' "$existing_content" > "$repin_source"
+      fi
+      if [[ "$repin_source" != "$template" ]]; then
+        strip_stale_stable_header "$base" "$template" < "$repin_source" > "$repin_source.stripped"
+        mv "$repin_source.stripped" "$repin_source"
+      fi
+    fi
+
     # When repin_source is a copy of existing_content (meta-repo consumer or body-
     # preserving repin-in-place) and the template requires the S7635 marker but the
     # copy lacks it, inject the marker now. Without this, the deployed stub would
diff --git a/scripts/lib/ring-pins.sh b/scripts/lib/ring-pins.sh
index d4f087ce7..93d2e215b 100644
--- a/scripts/lib/ring-pins.sh
+++ b/scripts/lib/ring-pins.sh
@@ -455,11 +455,22 @@ ring_tag_exists() {
 # is re-pinned alongside `uses:` here. This only re-pins the VALUE of an input the
 # stub already forwards (never adds/forwards a new one), so it never introduces the
 # undeclared-input channel-skew defect (#1052).
+# When <newref> is not a stable channel, comment lines naming this agent's stable
+# channel (`<base>/v<M>-stable`, `<base> stable channel`) are rendered tier-neutral
+# (`<base>/<tier>`), so a header never contradicts the ring pin even while the
+# template still carries the stable wording (#1297).
 ring_repin_uses() {
-  local base="$1" newref="$2" file
+  local base="$1" newref="$2" file neutral=()
   file="$(ring_reusable_file "$base")"
   file="${file//./\\.}"
+  if [[ ! "$newref" =~ stable$ ]]; then
+    neutral=(
+      -e "/^[[:space:]]*#/s#${base}/(v[0-9]+-)?stable#${base}/<tier>#g"
+      -e "/^[[:space:]]*#/s#${base} stable channel#${base}/<tier> channel#g"
+    )
+  fi
   sed -E \
+    ${neutral[@]+"${neutral[@]}"} \
     -e "s#^([[:space:]]*uses:[[:space:]]*combsmith/[^@[:space:]]*/${file})@[^[:space:]]+#\1@${newref}#" \
     -e "s#^([[:space:]]*agent_ref:[[:space:]]*[\"']?)${base}/[^\"'[:space:]]+#\1${newref}#" \
     -e "s#^([[:space:]]*checkout_ref:[[:space:]]*[\"']?)${base}/[^\"'[:space:]]+#\1${newref}#"
diff --git a/test/scripts/deploy-standard-workflows/dry-run.bats b/test/scripts/deploy-standard-workflows/dry-run.bats
index f5b226854..fd98722f9 100644
--- a/test/scripts/deploy-standard-workflows/dry-run.bats
+++ b/test/scripts/deploy-standard-workflows/dry-run.bats
@@ -75,7 +75,8 @@ stub_pinning() {  # <ref> → base64 of the auto-rebase template re-pinned to <r
   # and the surface-drift check (#1236) stays clean.
   local body
   body="$(sed -E "s|(auto-rebase-reusable\.yml)@[^[:space:]]+|\1@$1|" \
-    "${REPO_ROOT}/standards/workflows/auto-rebase.yml")"
+    "${REPO_ROOT}/standards/workflows/auto-rebase.yml" \
+    | bash -c 'source "$1"; ring_repin_uses "$2" "$3"' _ "$SCRIPT" auto-rebase "${1%% *}")"
   base64 -w 0 <<<"$body" 2>/dev/null || base64 -b 0 <<<"$body"
 }
 
diff --git a/test/scripts/deploy-standard-workflows/emit-vform.bats b/test/scripts/deploy-standard-workflows/emit-vform.bats
index 191bc29f4..9555bf187 100644
--- a/test/scripts/deploy-standard-workflows/emit-vform.bats
+++ b/test/scripts/deploy-standard-workflows/emit-vform.bats
@@ -84,7 +84,8 @@ stub_pinning() {  # <ref> → base64 of the auto-rebase template re-pinned to <r
   # concurrency: surfaces match and the surface-drift check (#1236) stays clean.
   local body
   body="$(sed -E "s|(auto-rebase-reusable\.yml)@[^[:space:]]+|\1@$1|" \
-    "${REPO_ROOT}/standards/workflows/auto-rebase.yml")"
+    "${REPO_ROOT}/standards/workflows/auto-rebase.yml" \
+    | bash -c 'source "$1"; ring_repin_uses "$2" "$3"' _ "$SCRIPT" auto-rebase "$1")"
   base64 -w 0 <<<"$body" 2>/dev/null || base64 -b 0 <<<"$body"
 }
 
@@ -112,7 +113,8 @@ devlead_stub_pinning_with_marker() {  # <ref> → base64 of the dev-lead templat
   local body
   body="$(sed -E -e "s|(dev-lead-reusable\.yml)@[^[:space:]]+|\1@$1|" \
     -e "s|^([[:space:]]*agent_ref:[[:space:]]*).*|\1$1|" \
-    "${REPO_ROOT}/standards/workflows/dev-lead.yml")"
+    "${REPO_ROOT}/standards/workflows/dev-lead.yml" \
+    | bash -c 'source "$1"; ring_repin_uses "$2" "$3"' _ "$SCRIPT" dev-lead "$1")"
   base64 -w 0 <<<"$body" 2>/dev/null || base64 -b 0 <<<"$body"
 }
 
diff --git a/test/scripts/deploy-standard-workflows/pr-review-replace-if-present.bats b/test/scripts/deploy-standard-workflows/pr-review-replace-if-present.bats
index f01d8034b..a77810d73 100644
--- a/test/scripts/deploy-standard-workflows/pr-review-replace-if-present.bats
+++ b/test/scripts/deploy-standard-workflows/pr-review-replace-if-present.bats
@@ -63,7 +63,8 @@ STUB
 # The template rendered at <channel> — what a correctly deployed caller looks like:
 # only the two pin lines move; the header prose keeps the template's channel.
 rendered_at() {  # <channel>
-  sed -E "/^[[:space:]]*(uses|agent_ref):/s#pr-review/v1-stable#$1#" "$TEMPLATE"
+  sed -E "/^[[:space:]]*(uses|agent_ref):/s#pr-review/v1-stable#$1#" "$TEMPLATE" \
+    | bash -c 'source "$1"; ring_repin_uses pr-review "$2"' _ "$SCRIPT" "$1"
 }
 
 # The legacy fleet caller shape (TalkTerm-like): bare pr-review/stable pin, an
diff --git a/test/scripts/deploy-standard-workflows/repo-template-full-body.bats b/test/scripts/deploy-standard-workflows/repo-template-full-body.bats
index bafe2e195..10640f9f2 100644
--- a/test/scripts/deploy-standard-workflows/repo-template-full-body.bats
+++ b/test/scripts/deploy-standard-workflows/repo-template-full-body.bats
@@ -67,7 +67,8 @@ STUB
 
 # The template rendered at <channel> — only the reusable pin moves.
 rendered_at() {  # <channel>
-  sed -E "/^[[:space:]]*uses:/s#dependabot-rebase/v2-stable#$1#" "$TEMPLATE"
+  sed -E "/^[[:space:]]*uses:/s#dependabot-rebase/v2-stable#$1#" "$TEMPLATE" \
+    | bash -c 'source "$1"; ring_repin_uses dependabot-rebase "$2"' _ "$SCRIPT" "$1"
 }
 
 # The template at <channel> with a stale header comment — the #1075 shape: the
@@ -214,3 +215,19 @@ deploy_capture() {
   grep -qF 'TUNED-REPO-CONTEXT-SENTINEL' "$OUT/feature-ideation.yml"
   grep -qF 'feature-ideation-reusable.yml@feature-ideation/v1-stable' "$OUT/feature-ideation.yml"
 }
+
+# ── PRESENT_ONLY_WORKFLOWS are re-pinned in place, never body-compared ───────
+
+@test "repo-template: a present-only idea-triage.yml with a customized cron is already compliant" {
+  local t="${REPO_ROOT}/standards/workflows/idea-triage.yml"
+  local existing="${TT_TMP}/idea-triage.yml"
+  sed "s/'30 13 \* \* 1'/'5 4 * * 2'/" "$t" > "$existing"
+  ! diff -q "$existing" "$t" >/dev/null
+  GH_MATCHING_REFS="refs/tags/idea-triage/v1-stable
+refs/tags/idea-triage/v1-next
+refs/tags/idea-triage/v1-ring0
+refs/tags/idea-triage/v1-ring1"; export GH_MATCHING_REFS
+  install_gh_stub
+  run bash -c 'source "$1"; is_already_compliant "$(< "$2")" "$3" combsmith/repo-template' _ "$SCRIPT" "$existing" "$t"
+  [ "$status" -eq 0 ]
+}
diff --git a/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats b/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats
new file mode 100644
index 000000000..39f8c05f5
--- /dev/null
+++ b/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats
@@ -0,0 +1,211 @@
+#!/usr/bin/env bats
+# Issue #1297 — a synced stub's header never contradicts its own `uses:` pin.
+#
+# The sweep re-pins a ring-managed stub's `uses:` / `agent_ref:` / `checkout_ref:`
+# lines to the repo's ring channel (ring_repin_uses) but deploys the comments
+# verbatim. A template header naming `<agent>/v<N>-stable` therefore sits above a
+# `@<agent>/v<N>-ring1` pin in every ring repo, review bots flag the mismatch, and
+# agent passes "fix" it in the consumer — drifting the stub from the template.
+# The headers are tier-neutral instead, so:
+#   - no ring-managed template, rendered at a ring channel, still names the
+#     agent's stable channel anywhere;
+#   - a correctly swept ring-1 stub is still compliant (stub_body_matches_template).
+
+setup() {
+  TT_TMP="$(mktemp -d "$BATS_TEST_TMPDIR/hdr.XXXXXX")"
+  REPO_ROOT="$(cd -- "${BATS_TEST_DIRNAME}/../../.." && pwd)"
+  SCRIPT="${REPO_ROOT}/scripts/deploy-standard-workflows.sh"
+}
+
+teardown() { rm -rf "$TT_TMP"; }
+
+# Fake gh: serves v1 channel tags for every agent (matching-refs); nothing else.
+install_gh_stub() {
+  local bin="${TT_TMP}/bin"
+  mkdir -p "$bin"
+  cat > "$bin/gh" <<'STUB'
+#!/usr/bin/env bash
+if [ "${1:-}" = "api" ]; then
+  case "$2" in
+    *matching-refs/tags/*)
+      agent="${2##*matching-refs/tags/}"; agent="${agent%%/*}"
+      for c in stable next ring0 ring1; do echo "refs/tags/${agent}/v1-${c}"; done
+      exit 0 ;;
+  esac
+fi
+exit 0
+STUB
+  chmod +x "$bin/gh"
+  PATH="${bin}:${PATH}"; export PATH
+}
+
+# ring_rendered_templates — for every ring-managed channel-pinned template, print
+# "<template>\t<base>\t<ring1-ref>": the ring1 ref keeps the template's own major.
+ring_rendered_templates() {
+  bash -c '
+    source "$1"
+    for t in "$2"/standards/workflows/*.yml; do
+      base="$(reusable_base_of "$t")"
+      [ -n "$base" ] && ring_is_ring_reusable "$base" || continue
+      ref="$(reusable_uses_of "$t")"; ref="${ref##*@}"
+      [[ "$ref" =~ ^${base}/v([0-9]+)-stable$ ]] || continue
+      printf "%s\t%s\t%s\n" "$t" "$base" "${base}/v${BASH_REMATCH[1]}-ring1"
+    done
+  ' _ "$SCRIPT" "$REPO_ROOT"
+}
+
+@test "fixture: the channel-pinned templates are enumerated" {
+  run ring_rendered_templates
+  [ "$status" -eq 0 ]
+  local n
+  n="$(grep -c . <<< "$output")"
+  [ "$n" -ge 10 ]
+  grep -qF 'persona-mention.yml' <<< "$output"
+  grep -qF 'pr-review.yml' <<< "$output"
+}
+
+@test "every ring-managed template, rendered at ring1, names no stable channel for its agent" {
+  local rows t base ref rendered bad=""
+  rows="$(ring_rendered_templates)"
+  while IFS=$'\t' read -r t base ref; do
+    rendered="$(bash -c 'source "$1"; ring_repin_uses "$2" "$3" < "$4"' _ "$SCRIPT" "$base" "$ref" "$t")"
+    # The pin itself moved…
+    grep -qF "@${ref}" <<< "$rendered" || bad+="${t##*/}: pin not re-pinned"$'\n'
+    # …and nothing else in the stub still names the agent's stable channel.
+    if grep -nE "${base}/(v[0-9]+-)?stable|${base} stable channel" <<< "$rendered" >"$TT_TMP/hits"; then
+      bad+="${t##*/}: $(tr '\n' ' ' < "$TT_TMP/hits")"$'\n'
+    fi
+  done <<< "$rows"
+  if [ -n "$bad" ]; then printf '%s' "$bad"; return 1; fi
+}
+
+@test "sweep: every ring-managed template's existing stubs with stale headers are flagged as non-compliant (not skipped)" {
+  install_gh_stub
+  local rows t base ref rendered old bad=""
+  rows="$(ring_rendered_templates)"
+  while IFS=$'\t' read -r t base ref; do
+    rendered="$(bash -c 'source "$1"; ring_repin_uses "$2" "$3" < "$4"' _ "$SCRIPT" "$base" "$ref" "$t")"
+    # Simulate an existing ring-1 stub that still carries the old stable-channel header
+    old="$(printf '# pinned to the \`%s/v1-stable\` channel\n%s\n' "$base" "$rendered")"
+    # Verify it is NOT compliant (would be processed, not skipped, by the sweep)
+    run bash -c 'source "$1"; is_already_compliant "$2" "$3" combsmith/test-repo' _ "$SCRIPT" "$old" "$t"
+    [ "$status" -eq 1 ] || bad+="${t##*/}: stale header not flagged as non-compliant"$'\n'
+  done <<< "$rows"
+  if [ -n "$bad" ]; then printf '%s' "$bad"; return 1; fi
+}
+
+@test "ring-1 repo: a correctly swept persona-mention stub is compliant and its header agrees with its pin" {
+  install_gh_stub
+  local t="${REPO_ROOT}/standards/workflows/persona-mention.yml" swept
+  swept="$(bash -c 'source "$1"; ring_repin_uses persona-mention persona-mention/v1-ring1 < "$2"' _ "$SCRIPT" "$t")"
+  grep -qE '^ +uses:.*persona-mention-reusable\.yml@persona-mention/v1-ring1' <<< "$swept"
+  run grep -E 'persona-mention/(v[0-9]+-)?stable' <<< "$swept"
+  [ "$status" -eq 1 ]
+  run bash -c 'source "$1"; stub_body_matches_template "$2" "$3" combsmith/TalkTerm' _ "$SCRIPT" "$swept" "$t"
+  [ "$status" -eq 0 ]
+  # Still drift: the same stub left on the stable pin in a ring-1 repo.
+  run bash -c 'source "$1"; stub_body_matches_template "$(cat "$2")" "$2" combsmith/TalkTerm' _ "$SCRIPT" "$t"
+  [ "$status" -eq 1 ]
+}
+
+@test "ring-1 repo: a correctly swept pr-review stub is compliant and its header agrees with its pin" {
+  install_gh_stub
+  local t="${REPO_ROOT}/standards/workflows/pr-review.yml" swept
+  swept="$(bash -c 'source "$1"; ring_repin_uses pr-review pr-review/v1-ring1 < "$2"' _ "$SCRIPT" "$t")"
+  grep -qE '^ +uses:.*@pr-review/v1-ring1' <<< "$swept"
+  grep -qE '^ +agent_ref: *pr-review/v1-ring1' <<< "$swept"
+  run grep -E 'pr-review/(v[0-9]+-)?stable' <<< "$swept"
+  [ "$status" -eq 1 ]
+  run bash -c 'source "$1"; stub_body_matches_template "$2" "$3" combsmith/bmad-bgreat-suite' _ "$SCRIPT" "$swept" "$t"
+  [ "$status" -eq 0 ]
+}
+
+@test "ring-1 repo: a correctly pinned stub still carrying the old stable-channel header is NOT compliant (is_already_compliant)" {
+  install_gh_stub
+  local t="${REPO_ROOT}/standards/workflows/persona-mention.yml" swept old
+  swept="$(bash -c 'source "$1"; ring_repin_uses persona-mention persona-mention/v1-ring1 < "$2"' _ "$SCRIPT" "$t")"
+  old="$(printf '# pinned to the `persona-mention/v1-stable` channel\n%s\n' "$swept")"
+  run bash -c 'source "$1"; is_already_compliant "$2" "$3" combsmith/TalkTerm' _ "$SCRIPT" "$old" "$t"
+  [ "$status" -eq 1 ]
+  run bash -c 'source "$1"; is_already_compliant "$2" "$3" combsmith/TalkTerm' _ "$SCRIPT" "$swept" "$t"
+  [ "$status" -eq 0 ]
+}
+
+@test "stable-pinned stub with a stable-channel header is NOT drift (tier-restricted)" {
+  install_gh_stub
+  local t="${REPO_ROOT}/standards/workflows/persona-mention.yml" stable old
+  stable="$(cat "$t")"
+  old="$(printf '# pinned to the `persona-mention/v1-stable` channel\n%s\n' "$stable")"
+  # Pass a stable-tier repo so the exemption applies
+  run bash -c 'source "$1"; stub_has_stale_stable_header "$2" "$3" combsmith/stable-repo' _ "$SCRIPT" "$old" "$t"
+  [ "$status" -eq 1 ]
+}
+
+@test "strip_stale_stable_header drops only the stale comment lines and keeps per-repo edits" {
+  install_gh_stub
+  local body
+  body="$(printf '# pinned to the `pr-auto-review/v1-stable` channel\non:\n  workflow_run:\n    workflows: ["Build"]\n')"
+  run bash -c 'source "$1"; strip_stale_stable_header pr-auto-review <<< "$2"' _ "$SCRIPT" "$body"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *'workflows: ["Build"]'* ]]
+  [[ "$output" != *stable* ]]
+}
+
+@test "idea stubs are deployable and present-only (never seeded)" {
+  install_gh_stub
+  run bash -c 'source "$1"; for w in idea-enhancer.yml idea-triage.yml initiative-planner.yml; do is_deployable_workflow "$w" && is_present_only_workflow "$w" || exit 1; done' _ "$SCRIPT"
+  [ "$status" -eq 0 ]
+}
+
+@test "sweep: ring-pinned stub with stale header is flagged as drift and header is stripped" {
+  install_gh_stub
+  local t="${REPO_ROOT}/standards/workflows/persona-mention.yml" swept old
+  swept="$(bash -c 'source "$1"; ring_repin_uses persona-mention persona-mention/v1-ring1 < "$2"' _ "$SCRIPT" "$t")"
+  old="$(printf '# pinned to the \`persona-mention/v1-stable\` channel\n%s\n' "$swept")"
+  # Verify the stub with stale header is NOT compliant
+  run bash -c 'source "$1"; is_already_compliant "$2" "$3" combsmith/TalkTerm' _ "$SCRIPT" "$old" "$t"
+  [ "$status" -eq 1 ]
+  # Verify that stripping the header makes it compliant
+  local stripped
+  stripped="$(bash -c 'source "$1"; strip_stale_stable_header persona-mention <<< "$2"' _ "$SCRIPT" "$old")"
+  run bash -c 'source "$1"; is_already_compliant "$2" "$3" combsmith/TalkTerm' _ "$SCRIPT" "$stripped" "$t"
+  [ "$status" -eq 0 ]
+}
+
+@test "strip_stale_stable_header with a template replaces the whole legacy header block" {
+  install_gh_stub
+  local t="${REPO_ROOT}/standards/workflows/persona-mention.yml" old out
+  old="$(printf '# legacy header\n#   • You MUST NOT change: the `uses:` ref — it is pinned to the\n#     `persona-mention/v1-stable` channel, a moving tag.\n#     Never repoint it.\n%s\n' "$(sed -n '/^[^#[:space:]]/,$p' "$t")")"
+  out="$(bash -c 'source "$1"; strip_stale_stable_header persona-mention "$3" <<< "$2"' _ "$SCRIPT" "$old" "$t")"
+  # The template header, rendered tier-neutral (it may still name the stable channel).
+  [ "$(sed -n '/^[^#[:space:]]/q;p' <<< "$out")" = "$(sed -n '/^[^#[:space:]]/q;p' "$t" | bash -c 'source "$1"; ring_repin_uses persona-mention persona-mention/v1-ring1' _ "$SCRIPT")" ]
+  [[ "$out" != *legacy* ]]
+}
+
+@test "strip_stale_stable_header with a template also drops a stale comment block under jobs" {
+  install_gh_stub
+  local t="${REPO_ROOT}/standards/workflows/dev-lead.yml" old out
+  old="$(printf '# legacy header dev-lead/v1-stable\nname: x\njobs:\n  dev-lead:\n    # Pinned to the moving dev-lead stable channel tag, not @main,\n    # so a broken change cannot gate its own fix.\n    uses: foo\n    # keep me\n    with: 1\n')"
+  out="$(bash -c 'source "$1"; strip_stale_stable_header dev-lead "$3" <<< "$2"' _ "$SCRIPT" "$old" "$t")"
+  [[ "$out" != *"stable channel"* ]]
+  [[ "$out" != *"cannot gate"* ]]
+  [[ "$out" == *"# keep me"* ]]
+}
+
+@test "idea engines are engine-host targets in .github-private only" {
+  install_gh_stub
+  run bash -c 'source "$1"; for w in idea-enhancer.yml idea-triage.yml initiative-planner.yml; do is_engine_host_target "$w" .github-private || exit 1; ! is_engine_host_target "$w" TalkTerm || exit 2; done' _ "$SCRIPT"
+  [ "$status" -eq 0 ]
+}
+
+@test "ring repin renders a template's stable-channel comments tier-neutral; cleanup never reinstalls them" {
+  install_gh_stub
+  local t="${REPO_ROOT}/standards/workflows/persona-mention.yml" old out
+  old="$(printf '# legacy persona-mention/v1-stable\n%s\n' "$(sed -n '/^[^#[:space:]]/,$p' "$t")")"
+  out="$(bash -c 'source "$1"; strip_stale_stable_header persona-mention "$3" <<< "$2"' _ "$SCRIPT" "$old" "$t")"
+  run grep -E '^[[:space:]]*#.*(persona-mention/(v[0-9]+-)?stable|persona-mention stable channel)' <<< "$out"
+  [ "$status" -eq 1 ]
+  # Stable repin keeps the stable wording.
+  run bash -c 'source "$1"; ring_repin_uses persona-mention persona-mention/v1-stable < "$2"' _ "$SCRIPT" "$t"
+  grep -qF 'persona-mention/v1-stable' <<< "$output"
+}