From 4f880bf56db97baa9ca9b02ac8027a5768222649 Mon Sep 17 00:00:00 2001
From: don-petry <36422719+don-petry@users.noreply.github.com>
Date: Sun, 11 Oct 2026 04:31:15 +0000
Subject: [PATCH 01/14] =?UTF-8?q?feat:=20implement=20issue=20#1297=20?=
 =?UTF-8?q?=E2=80=94=20Synced=20stubs=20in=20ring=20repos=20carry=20a=20he?=
 =?UTF-8?q?ader=20naming=20v1-stable=20above=20a=20uses:=20line=20pinned?=
 =?UTF-8?q?=20to=20their=20ring=20=E2=80=94=20bots=20flag=20it=20and=20age?=
 =?UTF-8?q?nts=20edit=20the=20stub=20to=20match?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 standards/workflows/add-to-project.yml        |   3 +-
 standards/workflows/auto-rebase.yml           |   5 +-
 standards/workflows/dependabot-rebase.yml     |   5 +-
 standards/workflows/dev-lead.yml              |   3 +-
 standards/workflows/idea-enhancer.yml         |   5 +-
 standards/workflows/idea-triage.yml           |   5 +-
 standards/workflows/initiative-planner.yml    |   5 +-
 standards/workflows/persona-mention.yml       |   5 +-
 standards/workflows/pr-auto-review.yml        |   5 +-
 standards/workflows/pr-review-mention.yml     |   5 +-
 standards/workflows/pr-review.yml             |   6 +-
 .../stub-header-tier-neutral.bats             | 106 ++++++++++++++++++
 12 files changed, 137 insertions(+), 21 deletions(-)
 create mode 100644 test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats

diff --git a/standards/workflows/add-to-project.yml b/standards/workflows/add-to-project.yml
index d5b20a58e..41baf5fc7 100644
--- a/standards/workflows/add-to-project.yml
+++ b/standards/workflows/add-to-project.yml
@@ -7,7 +7,8 @@
 #   • This file is a THIN CALLER STUB. All noise-gate / reconcile logic lives
 #     in the reusable workflow above.
 #   • You MAY change: nothing in normal use. The `uses:` ref and `agent_ref`
-#     are pinned to the `add-to-project/v1-stable` channel and move with it — do
+#     are pinned to this repo's ring channel for `add-to-project`, set by the
+#     standards sweep, and move with it — do
 #     not change them to `@main` or a SHA (see ci-standards.md → Reusable
 #     workflow versioning).
 #   • You MUST NOT change: trigger events, the concurrency group, or the
diff --git a/standards/workflows/auto-rebase.yml b/standards/workflows/auto-rebase.yml
index 7f3ffc106..10a9a0f89 100644
--- a/standards/workflows/auto-rebase.yml
+++ b/standards/workflows/auto-rebase.yml
@@ -6,8 +6,9 @@
 # AGENTS — READ BEFORE EDITING:
 #   • This file is a THIN CALLER STUB. All branch-update logic lives in the
 #     reusable workflow above.
-#   • You MUST NOT change: the `uses:` ref — it is pinned to the
-#     `auto-rebase/v2-stable` channel, a moving tag advanced centrally. Never
+#   • You MUST NOT change: the `uses:` ref — it is pinned to this repo's ring
+#     channel for `auto-rebase`, set by the standards sweep (a moving tag
+#     advanced centrally). Never
 #     repoint it to `@main`, a SHA, or a frozen `@vX` (see ci-standards.md →
 #     Reusable workflow versioning). Also do not change the trigger event,
 #     the concurrency group name,
diff --git a/standards/workflows/dependabot-rebase.yml b/standards/workflows/dependabot-rebase.yml
index 53a1f1f2f..2210bc7f3 100644
--- a/standards/workflows/dependabot-rebase.yml
+++ b/standards/workflows/dependabot-rebase.yml
@@ -6,8 +6,9 @@
 # AGENTS — READ BEFORE EDITING:
 #   • This file is a THIN CALLER STUB. All rebase/merge serialization logic
 #     lives in the reusable workflow above.
-#   • You MUST NOT change: the `uses:` ref — it is pinned to the
-#     `dependabot-rebase/v2-stable` channel, a moving tag advanced centrally.
+#   • You MUST NOT change: the `uses:` ref — it is pinned to this repo's ring
+#     channel for `dependabot-rebase`, set by the standards sweep (a moving
+#     tag advanced centrally).
 #     Never repoint it to `@main`, a SHA, or a frozen `@vX` (see
 #     ci-standards.md → Reusable workflow versioning). Also do not change the
 #     concurrency group name, the explicit secrets
diff --git a/standards/workflows/dev-lead.yml b/standards/workflows/dev-lead.yml
index 1cd459bdb..f95f783c9 100644
--- a/standards/workflows/dev-lead.yml
+++ b/standards/workflows/dev-lead.yml
@@ -56,7 +56,8 @@ permissions: {}
 
 jobs:
   dev-lead:
-    # Pinned to the moving dev-lead stable channel tag, not @main, so a broken
+    # Pinned to this repo's moving dev-lead ring channel tag (set by the
+    # standards sweep), not @main, so a broken
     # change to dev-lead can no longer gate its own fix (the self-host circular
     # dependency). Promotion is done by moving that channel tag centrally; this
     # caller is never edited on release. agent_ref threads the same channel into
diff --git a/standards/workflows/idea-enhancer.yml b/standards/workflows/idea-enhancer.yml
index 3ea45bc8a..6db803b8b 100644
--- a/standards/workflows/idea-enhancer.yml
+++ b/standards/workflows/idea-enhancer.yml
@@ -6,8 +6,9 @@
 # AGENTS — READ BEFORE EDITING:
 #   • This file is a THIN CALLER STUB. All enhancement-dispatch logic (including
 #     the Ideas-category / non-bot guard) lives in the reusable above.
-#   • You MUST NOT change: the `uses:` ref — it is pinned to the
-#     `idea-enhancer/v1-stable` channel, a moving tag advanced centrally. Never
+#   • You MUST NOT change: the `uses:` ref — it is pinned to this repo's ring
+#     channel for `idea-enhancer`, set by the standards sweep (a moving tag
+#     advanced centrally). Never
 #     repoint it to `@main`, a SHA, or a frozen `@vX`. Do not change the trigger
 #     events or the `secrets:` block.
 #   • You MAY change: the cron schedule if the weekly cadence doesn't suit.
diff --git a/standards/workflows/idea-triage.yml b/standards/workflows/idea-triage.yml
index 7169e171a..81b8af283 100644
--- a/standards/workflows/idea-triage.yml
+++ b/standards/workflows/idea-triage.yml
@@ -6,8 +6,9 @@
 # AGENTS — READ BEFORE EDITING:
 #   • This file is a THIN CALLER STUB. All triage-dispatch logic lives in the
 #     reusable above.
-#   • You MUST NOT change: the `uses:` ref — it is pinned to the
-#     `idea-triage/v1-stable` channel, a moving tag advanced centrally. Never
+#   • You MUST NOT change: the `uses:` ref — it is pinned to this repo's ring
+#     channel for `idea-triage`, set by the standards sweep (a moving tag
+#     advanced centrally). Never
 #     repoint it to `@main`, a SHA, or a frozen `@vX`. Do not change the
 #     `secrets:` block.
 #   • You MAY change: the cron schedule if the weekly cadence doesn't suit.
diff --git a/standards/workflows/initiative-planner.yml b/standards/workflows/initiative-planner.yml
index d4af6cd80..c6f028301 100644
--- a/standards/workflows/initiative-planner.yml
+++ b/standards/workflows/initiative-planner.yml
@@ -7,8 +7,9 @@
 #   • This file is a THIN CALLER STUB. All idea→initiative dispatch logic (the
 #     `idea:approved` gate, the trusted-actor check, and the cross-repo dispatch
 #     to the central BMAD Scrum Master planner) lives in the reusable above.
-#   • You MUST NOT change: the `uses:` ref — it is pinned to the
-#     `initiative-planner/v1-stable` channel, a moving tag advanced centrally.
+#   • You MUST NOT change: the `uses:` ref — it is pinned to this repo's ring
+#     channel for `initiative-planner`, set by the standards sweep (a moving
+#     tag advanced centrally).
 #     Never repoint it to `@main`, a SHA, or a frozen `@vX` (see
 #     ci-standards.md → Reusable workflow versioning). Also do not change the
 #     trigger events or the `secrets:` block.
diff --git a/standards/workflows/persona-mention.yml b/standards/workflows/persona-mention.yml
index cd7778729..cc37ae75d 100644
--- a/standards/workflows/persona-mention.yml
+++ b/standards/workflows/persona-mention.yml
@@ -7,8 +7,9 @@
 #   • This file is a THIN CALLER STUB. All routing logic lives in the reusable
 #     workflow above, and every per-persona decision lives in that persona's
 #     manifest — not here and not in the reusable.
-#   • You MUST NOT change: the `uses:` ref — it is pinned to the
-#     `persona-mention/v1-stable` channel, a moving tag advanced centrally.
+#   • You MUST NOT change: the `uses:` ref — it is pinned to this repo's ring
+#     channel for `persona-mention`, set by the standards sweep (a moving tag
+#     advanced centrally).
 #     Never repoint it to `@main`, a SHA, or a frozen `@vX.Y.Z` (see
 #     ci-standards.md → Reusable workflow versioning). Also do not change the
 #     trigger events or the job-level `permissions:` block — reusable workflows
diff --git a/standards/workflows/pr-auto-review.yml b/standards/workflows/pr-auto-review.yml
index 73df2cea4..18ff27067 100644
--- a/standards/workflows/pr-auto-review.yml
+++ b/standards/workflows/pr-auto-review.yml
@@ -8,8 +8,9 @@
 #     reusable workflow above.
 #   • You MAY change: the workflow name(s) in `workflow_run.workflows` to match
 #     your repository's CI workflow name(s).
-#   • You MUST NOT change: the `@pr-auto-review/v1-stable` channel in the `uses:`
-#     line — this reusable is on the org-wide moving-channel model (rollout and
+#   • You MUST NOT change: the `uses:` ref — it is pinned to this repo's ring
+#     channel for `pr-auto-review`, set by the standards sweep. This reusable
+#     is on the org-wide moving-channel model (rollout and
 #     rollback are a single central tag move; a frozen `@vN`/`@<sha>` pin is
 #     rejected by the compliance audit). Nor the trigger event types or the
 #     job-level `permissions:` block — reusable workflows can be granted no more
diff --git a/standards/workflows/pr-review-mention.yml b/standards/workflows/pr-review-mention.yml
index cab045617..91607a85c 100644
--- a/standards/workflows/pr-review-mention.yml
+++ b/standards/workflows/pr-review-mention.yml
@@ -6,8 +6,9 @@
 # AGENTS — READ BEFORE EDITING:
 #   • This file is a THIN CALLER STUB. All review-dispatch logic lives in the
 #     reusable workflow above.
-#   • You MUST NOT change: the `uses:` ref — it is pinned to the
-#     `pr-review-mention/v2-stable` channel, a moving tag advanced centrally.
+#   • You MUST NOT change: the `uses:` ref — it is pinned to this repo's ring
+#     channel for `pr-review-mention`, set by the standards sweep (a moving
+#     tag advanced centrally).
 #     Never repoint it to `@main`, a SHA, or a frozen `@vX` (see
 #     ci-standards.md → Reusable workflow versioning). Also do not change the
 #     trigger events or the job-level `permissions:` block — reusable workflows
diff --git a/standards/workflows/pr-review.yml b/standards/workflows/pr-review.yml
index d40a359af..fa61f51f2 100644
--- a/standards/workflows/pr-review.yml
+++ b/standards/workflows/pr-review.yml
@@ -9,9 +9,9 @@
 #     above, including concurrency (per PR + head SHA, never cancelling an
 #     in-flight review), the check_suite-without-a-PR skip, and reading
 #     `client_payload.pr_url` from repository_dispatch.
-#   • You MUST NOT change: the `@pr-review/v1-stable` channel in the `uses:`
-#     line or the matching `agent_ref` — both are re-pinned in lockstep to this
-#     repo's canary-ring tier by the standards sweep. Nor the workflow `name:`,
+#   • You MUST NOT change: the `pr-review` channel in the `uses:` line or the
+#     matching `agent_ref` — both are pinned in lockstep to this repo's ring
+#     channel for `pr-review`, set by the standards sweep. Nor the workflow `name:`,
 #     the job id `review` (check names depend on both), the trigger event types,
 #     the Dependabot skip guard, or the job-level `permissions:` block. Do not
 #     add a stub-level `concurrency:` block.
diff --git a/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats b/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats
new file mode 100644
index 000000000..69fc9fe87
--- /dev/null
+++ b/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats
@@ -0,0 +1,106 @@
+#!/usr/bin/env bats
+# Issue #1297 — a synced stub's header never contradicts its own `uses:` pin.
+#
+# The sweep re-pins a ring-managed stub's `uses:` / `agent_ref:` / `checkout_ref:`
+# lines to the repo's ring channel (ring_repin_uses) but deploys the comments
+# verbatim. A template header naming `<agent>/v<N>-stable` therefore sits above a
+# `@<agent>/v<N>-ring1` pin in every ring repo, review bots flag the mismatch, and
+# agent passes "fix" it in the consumer — drifting the stub from the template.
+# The headers are tier-neutral instead, so:
+#   - no ring-managed template, rendered at a ring channel, still names the
+#     agent's stable channel anywhere;
+#   - a correctly swept ring-1 stub is still compliant (stub_body_matches_template).
+
+setup() {
+  TT_TMP="$(mktemp -d "$BATS_TEST_TMPDIR/hdr.XXXXXX")"
+  REPO_ROOT="$(cd -- "${BATS_TEST_DIRNAME}/../../.." && pwd)"
+  SCRIPT="${REPO_ROOT}/scripts/deploy-standard-workflows.sh"
+}
+
+teardown() { rm -rf "$TT_TMP"; }
+
+# Fake gh: serves v1 channel tags for every agent (matching-refs); nothing else.
+install_gh_stub() {
+  local bin="${TT_TMP}/bin"
+  mkdir -p "$bin"
+  cat > "$bin/gh" <<'STUB'
+#!/usr/bin/env bash
+if [ "${1:-}" = "api" ]; then
+  case "$2" in
+    *matching-refs/tags/*)
+      agent="${2##*matching-refs/tags/}"; agent="${agent%%/*}"
+      for c in stable next ring0 ring1; do echo "refs/tags/${agent}/v1-${c}"; done
+      exit 0 ;;
+  esac
+fi
+exit 0
+STUB
+  chmod +x "$bin/gh"
+  PATH="${bin}:${PATH}"; export PATH
+}
+
+# ring_rendered_templates — for every ring-managed channel-pinned template, print
+# "<template>\t<base>\t<ring1-ref>": the ring1 ref keeps the template's own major.
+ring_rendered_templates() {
+  bash -c '
+    source "$1"
+    for t in "$2"/standards/workflows/*.yml; do
+      base="$(reusable_base_of "$t")"
+      [ -n "$base" ] && ring_is_ring_reusable "$base" || continue
+      ref="$(reusable_uses_of "$t")"; ref="${ref##*@}"
+      [[ "$ref" =~ ^${base}/v([0-9]+)-stable$ ]] || continue
+      printf "%s\t%s\t%s\n" "$t" "$base" "${base}/v${BASH_REMATCH[1]}-ring1"
+    done
+  ' _ "$SCRIPT" "$REPO_ROOT"
+}
+
+@test "fixture: the channel-pinned templates are enumerated" {
+  run ring_rendered_templates
+  [ "$status" -eq 0 ]
+  local n
+  n="$(grep -c . <<< "$output")"
+  [ "$n" -ge 10 ]
+  grep -qF 'persona-mention.yml' <<< "$output"
+  grep -qF 'pr-review.yml' <<< "$output"
+}
+
+@test "every ring-managed template, rendered at ring1, names no stable channel for its agent" {
+  local rows t base ref rendered bad=""
+  rows="$(ring_rendered_templates)"
+  while IFS=$'\t' read -r t base ref; do
+    rendered="$(bash -c 'source "$1"; ring_repin_uses "$2" "$3" < "$4"' _ "$SCRIPT" "$base" "$ref" "$t")"
+    # The pin itself moved…
+    grep -qF "@${ref}" <<< "$rendered" || bad+="${t##*/}: pin not re-pinned"$'\n'
+    # …and nothing else in the stub still names the agent's stable channel.
+    if grep -nE "${base}/(v[0-9]+-)?stable|${base} stable channel" <<< "$rendered" >"$TT_TMP/hits"; then
+      bad+="${t##*/}: $(tr '\n' ' ' < "$TT_TMP/hits")"$'\n'
+    fi
+  done <<< "$rows"
+  if [ -n "$bad" ]; then printf '%s' "$bad"; return 1; fi
+}
+
+@test "ring-1 repo: a correctly swept persona-mention stub is compliant and its header agrees with its pin" {
+  install_gh_stub
+  local t="${REPO_ROOT}/standards/workflows/persona-mention.yml" swept
+  swept="$(bash -c 'source "$1"; ring_repin_uses persona-mention persona-mention/v1-ring1 < "$2"' _ "$SCRIPT" "$t")"
+  grep -qE '^ +uses:.*persona-mention-reusable\.yml@persona-mention/v1-ring1' <<< "$swept"
+  run grep -E 'persona-mention/(v[0-9]+-)?stable' <<< "$swept"
+  [ "$status" -eq 1 ]
+  run bash -c 'source "$1"; stub_body_matches_template "$2" "$3" petry-projects/TalkTerm' _ "$SCRIPT" "$swept" "$t"
+  [ "$status" -eq 0 ]
+  # Still drift: the same stub left on the stable pin in a ring-1 repo.
+  run bash -c 'source "$1"; stub_body_matches_template "$(cat "$2")" "$2" petry-projects/TalkTerm' _ "$SCRIPT" "$t"
+  [ "$status" -eq 1 ]
+}
+
+@test "ring-1 repo: a correctly swept pr-review stub is compliant and its header agrees with its pin" {
+  install_gh_stub
+  local t="${REPO_ROOT}/standards/workflows/pr-review.yml" swept
+  swept="$(bash -c 'source "$1"; ring_repin_uses pr-review pr-review/v1-ring1 < "$2"' _ "$SCRIPT" "$t")"
+  grep -qE '^ +uses:.*@pr-review/v1-ring1' <<< "$swept"
+  grep -qE '^ +agent_ref: *pr-review/v1-ring1' <<< "$swept"
+  run grep -E 'pr-review/(v[0-9]+-)?stable' <<< "$swept"
+  [ "$status" -eq 1 ]
+  run bash -c 'source "$1"; stub_body_matches_template "$2" "$3" petry-projects/bmad-bgreat-suite' _ "$SCRIPT" "$swept" "$t"
+  [ "$status" -eq 0 ]
+}

From 83a117546377a14e0fc4ff0e0a8dd9497685a58a Mon Sep 17 00:00:00 2001
From: don-petry <36422719+don-petry@users.noreply.github.com>
Date: Sun, 11 Oct 2026 04:38:16 +0000
Subject: [PATCH 02/14] fix(reviews): sweep treats stale stable-channel header
 as drift

---
 scripts/deploy-standard-workflows.sh              | 15 +++++++++++++++
 .../stub-header-tier-neutral.bats                 | 11 +++++++++++
 2 files changed, 26 insertions(+)

diff --git a/scripts/deploy-standard-workflows.sh b/scripts/deploy-standard-workflows.sh
index 8d4a0bb4b..df07623f4 100755
--- a/scripts/deploy-standard-workflows.sh
+++ b/scripts/deploy-standard-workflows.sh
@@ -575,6 +575,20 @@ merge_guarded_surfaces() {
   return 0
 }
 
+# stub_has_stale_stable_header <existing_content> <template> -> 0 if the stub carries a
+# comment naming its agent's stable channel (`<base>/stable`, `<base>/v<M>-stable`,
+# `<base> stable channel`) that the template no longer carries (#1297). Such a header
+# contradicts a ring pin; the pin alone is compliant, so without this check the sweep
+# would never ship the comment-only header fix to existing ring repos.
+stub_has_stale_stable_header() {
+  local existing="$1" template="$2" base re
+  base="$(reusable_base_of "$template")"
+  [[ -n "$base" ]] || return 1
+  re="^[[:space:]]*#.*(${base}/(v[0-9]+-)?stable|${base} stable channel)"
+  grep -qE "$re" <<< "$existing" || return 1
+  ! grep -qE "$re" "$template"
+}
+
 # is_already_compliant <existing_content> <template> <repo> -> 0 if the deployed
 # stub needs no re-deploy. A stub is compliant only when it is BOTH pin-compliant
 # (is_pin_compliant, below) AND — when its template carries a real `secrets: inherit`
@@ -608,6 +622,7 @@ is_already_compliant() {
      && ! stub_has_s7635_marker <<< "$existing_content"; then
     return 1
   fi
+  stub_has_stale_stable_header "$existing_content" "$template" && return 1
   if is_replace_if_present_workflow "$workflow" \
      || { is_full_body_compare_repo "$repo" && ! is_body_preserving_workflow "$workflow"; }; then
     stub_body_matches_template "$existing_content" "$template" "$repo" || return 1
diff --git a/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats b/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats
index 69fc9fe87..4f92e11fa 100644
--- a/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats
+++ b/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats
@@ -104,3 +104,14 @@ ring_rendered_templates() {
   run bash -c 'source "$1"; stub_body_matches_template "$2" "$3" petry-projects/bmad-bgreat-suite' _ "$SCRIPT" "$swept" "$t"
   [ "$status" -eq 0 ]
 }
+
+@test "ring-1 repo: a correctly pinned stub still carrying the old stable-channel header is NOT compliant (is_already_compliant)" {
+  install_gh_stub
+  local t="${REPO_ROOT}/standards/workflows/persona-mention.yml" swept old
+  swept="$(bash -c 'source "$1"; ring_repin_uses persona-mention persona-mention/v1-ring1 < "$2"' _ "$SCRIPT" "$t")"
+  old="$(printf '# pinned to the `persona-mention/v1-stable` channel\n%s\n' "$swept")"
+  run bash -c 'source "$1"; is_already_compliant "$2" "$3" petry-projects/TalkTerm' _ "$SCRIPT" "$old" "$t"
+  [ "$status" -eq 1 ]
+  run bash -c 'source "$1"; is_already_compliant "$2" "$3" petry-projects/TalkTerm' _ "$SCRIPT" "$swept" "$t"
+  [ "$status" -eq 0 ]
+}

From 70ed8af01e069b1b5a55b4cf5d62a8eb317090d4 Mon Sep 17 00:00:00 2001
From: don-petry <36422719+don-petry@users.noreply.github.com>
Date: Sun, 11 Oct 2026 05:05:06 +0000
Subject: [PATCH 03/14] fix(reviews): migrate stale stable headers in place,
 stable-tier exempt, cover idea stubs

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 scripts/deploy-standard-workflows.sh          | 63 ++++++++++++++++++-
 .../stub-header-tier-neutral.bats             | 25 ++++++++
 2 files changed, 87 insertions(+), 1 deletion(-)

diff --git a/scripts/deploy-standard-workflows.sh b/scripts/deploy-standard-workflows.sh
index df07623f4..73bc4190b 100755
--- a/scripts/deploy-standard-workflows.sh
+++ b/scripts/deploy-standard-workflows.sh
@@ -143,6 +143,9 @@ DEPLOYABLE_WORKFLOWS=(
   pr-auto-review.yml
   feature-ideation.yml
   pr-review.yml
+  idea-enhancer.yml
+  idea-triage.yml
+  initiative-planner.yml
 )
 
 # Deployable workflows whose stub BODY carries a documented per-repo edit the
@@ -586,7 +589,35 @@ stub_has_stale_stable_header() {
   [[ -n "$base" ]] || return 1
   re="^[[:space:]]*#.*(${base}/(v[0-9]+-)?stable|${base} stable channel)"
   grep -qE "$re" <<< "$existing" || return 1
-  ! grep -qE "$re" "$template"
+  ! grep -qE "$re" "$template" || return 1
+  # A stable-pinned stub's header still agrees with its pin: only a ring/next pin
+  # makes the stable wording a contradiction, so stable consumers see no churn.
+  ! grep -qE "^[[:space:]]*uses:.*@${base}/(v[0-9]+-)?stable([[:space:]]|\$)" <<< "$existing"
+}
+
+# strip_stale_stable_header <base> -> stdin minus the comment lines naming <base>'s
+# stable channel. Applied to the copied existing body on the in-place paths so the
+# deployed stub keeps its per-repo edits (e.g. workflow_run.workflows) yet no longer
+# trips stub_has_stale_stable_header on the next sweep (#1297).
+strip_stale_stable_header() {
+  local base="$1"
+  grep -vE "^[[:space:]]*#.*(${base}/(v[0-9]+-)?stable|${base} stable channel)" || true
+}
+
+# Workflows an adopter may or may not have (BMAD idea pipeline). The sweep never
+# seeds them; it only migrates an existing caller, re-pinning its OWN body in place.
+readonly PRESENT_ONLY_WORKFLOWS=(
+  idea-enhancer.yml
+  idea-triage.yml
+  initiative-planner.yml
+)
+
+is_present_only_workflow() {
+  local w="$1" p
+  for p in "${PRESENT_ONLY_WORKFLOWS[@]}"; do
+    [[ "$w" == "$p" ]] && return 0
+  done
+  return 1
 }
 
 # is_already_compliant <existing_content> <template> <repo> -> 0 if the deployed
@@ -876,6 +907,17 @@ deploy_repo() {
         repin_source="$(mktemp)"; _TMPFILES+=("$repin_source")
         printf '%s\n' "$existing_content" > "$repin_source"
       fi
+    elif is_present_only_workflow "$workflow"; then
+      # Optional pipeline stub: never seed; otherwise re-pin its OWN body in place.
+      if [[ -z "$existing_sha" ]]; then
+        skip "$repo/$workflow (present-only: no existing caller — never seeded)"
+        continue
+      fi
+      mode="repin-in-place"
+      if [[ "$DRY_RUN" != "true" ]]; then
+        repin_source="$(mktemp)"; _TMPFILES+=("$repin_source")
+        printf '%s\n' "$existing_content" > "$repin_source"
+      fi
     elif is_body_preserving_workflow "$workflow"; then
       # feature-ideation carries a per-repo project_context the sweep must never
       # clobber. Seed the generic template ONLY when the stub is absent; when it
@@ -917,6 +959,25 @@ deploy_repo() {
       fi
     fi
 
+    # Stale stable-channel header (#1297): migrate by editing the stub's OWN body, never
+    # by redeploying the template (that would reset per-repo edits such as
+    # pr-auto-review's workflow_run.workflows). Full-body-compared stubs are exempt —
+    # their drift is already resolved by a template redeploy.
+    if [[ "$DRY_RUN" != "true" && -n "$existing_sha" ]] \
+       && stub_has_stale_stable_header "$existing_content" "$template"; then
+      base="$(reusable_base_of "$template")"
+      if [[ "$repin_source" == "$template" ]] && ! is_replace_if_present_workflow "$workflow" \
+         && ! { is_full_body_compare_repo "$repo" && ! is_body_preserving_workflow "$workflow"; } \
+         && is_pin_compliant "$existing_content" "$template" "$repo"; then
+        repin_source="$(mktemp)"; _TMPFILES+=("$repin_source")
+        printf '%s\n' "$existing_content" > "$repin_source"
+      fi
+      if [[ "$repin_source" != "$template" ]]; then
+        strip_stale_stable_header "$base" < "$repin_source" > "$repin_source.stripped"
+        mv "$repin_source.stripped" "$repin_source"
+      fi
+    fi
+
     # When repin_source is a copy of existing_content (meta-repo consumer or body-
     # preserving repin-in-place) and the template requires the S7635 marker but the
     # copy lacks it, inject the marker now. Without this, the deployed stub would
diff --git a/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats b/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats
index 4f92e11fa..85b2dc31e 100644
--- a/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats
+++ b/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats
@@ -115,3 +115,28 @@ ring_rendered_templates() {
   run bash -c 'source "$1"; is_already_compliant "$2" "$3" petry-projects/TalkTerm' _ "$SCRIPT" "$swept" "$t"
   [ "$status" -eq 0 ]
 }
+
+@test "stable-pinned stub with a stable-channel header is NOT drift (tier-restricted)" {
+  install_gh_stub
+  local t="${REPO_ROOT}/standards/workflows/persona-mention.yml" stable old
+  stable="$(cat "$t")"
+  old="$(printf '# pinned to the `persona-mention/v1-stable` channel\n%s\n' "$stable")"
+  run bash -c 'source "$1"; stub_has_stale_stable_header "$2" "$3"' _ "$SCRIPT" "$old" "$t"
+  [ "$status" -eq 1 ]
+}
+
+@test "strip_stale_stable_header drops only the stale comment lines and keeps per-repo edits" {
+  install_gh_stub
+  local body
+  body="$(printf '# pinned to the `pr-auto-review/v1-stable` channel\non:\n  workflow_run:\n    workflows: ["Build"]\n')"
+  run bash -c 'source "$1"; strip_stale_stable_header pr-auto-review <<< "$2"' _ "$SCRIPT" "$body"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *'workflows: ["Build"]'* ]]
+  [[ "$output" != *stable* ]]
+}
+
+@test "idea stubs are deployable and present-only (never seeded)" {
+  install_gh_stub
+  run bash -c 'source "$1"; for w in idea-enhancer.yml idea-triage.yml initiative-planner.yml; do is_deployable_workflow "$w" && is_present_only_workflow "$w" || exit 1; done' _ "$SCRIPT"
+  [ "$status" -eq 0 ]
+}

From b6f3d24143e3cbe8fd7575f5f64a36e8960abd25 Mon Sep 17 00:00:00 2001
From: don-petry <36422719+don-petry@users.noreply.github.com>
Date: Sun, 11 Oct 2026 14:52:55 +0000
Subject: [PATCH 04/14] test: validate sweep flags and fixes stale
 stable-channel headers in ring repos

Add test case verifying that the sweep correctly identifies ring-pinned stubs
carrying stale stable-channel headers as non-compliant, and validates that
stripping those headers makes them compliant. This completes the test coverage
by checking that the sweep not only renders clean templates but also updates
existing pin-compliant consumer stubs that have drifted with old headers.

Closes the gap identified in CodeAnt's incomplete implementation suggestion:
the sweep now has test coverage for updating existing stubs, not just rendering
templates.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
---
 .../stub-header-tier-neutral.bats                 | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats b/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats
index 85b2dc31e..65f764f75 100644
--- a/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats
+++ b/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats
@@ -140,3 +140,18 @@ ring_rendered_templates() {
   run bash -c 'source "$1"; for w in idea-enhancer.yml idea-triage.yml initiative-planner.yml; do is_deployable_workflow "$w" && is_present_only_workflow "$w" || exit 1; done' _ "$SCRIPT"
   [ "$status" -eq 0 ]
 }
+
+@test "sweep: ring-pinned stub with stale header is flagged as drift and header is stripped" {
+  install_gh_stub
+  local t="${REPO_ROOT}/standards/workflows/persona-mention.yml" swept old
+  swept="$(bash -c 'source "$1"; ring_repin_uses persona-mention persona-mention/v1-ring1 < "$2"' _ "$SCRIPT" "$t")"
+  old="$(printf '# pinned to the \`persona-mention/v1-stable\` channel\n%s\n' "$swept")"
+  # Verify the stub with stale header is NOT compliant
+  run bash -c 'source "$1"; is_already_compliant "$2" "$3" petry-projects/TalkTerm' _ "$SCRIPT" "$old" "$t"
+  [ "$status" -eq 1 ]
+  # Verify that stripping the header makes it compliant
+  local stripped
+  stripped="$(bash -c 'source "$1"; strip_stale_stable_header persona-mention <<< "$2"' _ "$SCRIPT" "$old")"
+  run bash -c 'source "$1"; is_already_compliant "$2" "$3" petry-projects/TalkTerm' _ "$SCRIPT" "$stripped" "$t"
+  [ "$status" -eq 0 ]
+}

From 4bb767adfd08c057aafb924aa8982106eaa5cd28 Mon Sep 17 00:00:00 2001
From: don-petry <36422719+don-petry@users.noreply.github.com>
Date: Sun, 11 Oct 2026 16:08:38 +0000
Subject: [PATCH 05/14] fix(reviews): replace whole legacy stub header; exempt
 idea engines from sweep

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 scripts/deploy-standard-workflows.sh          | 27 ++++++++++++++-----
 .../stub-header-tier-neutral.bats             | 15 +++++++++++
 2 files changed, 36 insertions(+), 6 deletions(-)

diff --git a/scripts/deploy-standard-workflows.sh b/scripts/deploy-standard-workflows.sh
index 73bc4190b..8f303684a 100755
--- a/scripts/deploy-standard-workflows.sh
+++ b/scripts/deploy-standard-workflows.sh
@@ -208,6 +208,11 @@ readonly REPLACE_IF_PRESENT_WORKFLOWS=(
 # the sweep must never read, replace or re-pin it.
 declare -A ENGINE_HOST_REPOS=(
   ["pr-review.yml"]="$ENGINE_HOST_REPO"
+  # The central BMAD idea engines live under these names in .github-private; their
+  # callers here are stubs, so the sweep must not treat the engines as consumers.
+  ["idea-enhancer.yml"]="$ENGINE_HOST_REPO"
+  ["idea-triage.yml"]="$ENGINE_HOST_REPO"
+  ["initiative-planner.yml"]="$ENGINE_HOST_REPO"
 )
 
 # is_replace_if_present_workflow <name.yml> -> 0 if the workflow deploys only over
@@ -595,12 +600,22 @@ stub_has_stale_stable_header() {
   ! grep -qE "^[[:space:]]*uses:.*@${base}/(v[0-9]+-)?stable([[:space:]]|\$)" <<< "$existing"
 }
 
-# strip_stale_stable_header <base> -> stdin minus the comment lines naming <base>'s
-# stable channel. Applied to the copied existing body on the in-place paths so the
-# deployed stub keeps its per-repo edits (e.g. workflow_run.workflows) yet no longer
-# trips stub_has_stale_stable_header on the next sweep (#1297).
+# strip_stale_stable_header <base> [<template>] -> stdin minus the stale stable-channel
+# header. With <template>, the stub's whole leading comment block (everything above the
+# first top-level YAML key) is replaced by the template's canonical, tier-neutral header,
+# so a multiline legacy bullet is never left half-deleted. The body is kept verbatim, so
+# per-repo edits (e.g. workflow_run.workflows) survive and the next sweep sees no stale
+# header (#1297). Without <template>, only the lines naming the stable channel are dropped.
 strip_stale_stable_header() {
-  local base="$1"
+  local base="$1" template="${2:-}"
+  if [[ -n "$template" && -r "$template" ]]; then
+    awk -v tpl="$template" '
+      BEGIN { while ((getline l < tpl) > 0) { if (l ~ /^[^#[:space:]]/) break; hdr = hdr l "\n" } }
+      !body && /^[^#[:space:]]/ { body = 1; printf "%s", hdr }
+      body { print }
+    '
+    return 0
+  fi
   grep -vE "^[[:space:]]*#.*(${base}/(v[0-9]+-)?stable|${base} stable channel)" || true
 }
 
@@ -973,7 +988,7 @@ deploy_repo() {
         printf '%s\n' "$existing_content" > "$repin_source"
       fi
       if [[ "$repin_source" != "$template" ]]; then
-        strip_stale_stable_header "$base" < "$repin_source" > "$repin_source.stripped"
+        strip_stale_stable_header "$base" "$template" < "$repin_source" > "$repin_source.stripped"
         mv "$repin_source.stripped" "$repin_source"
       fi
     fi
diff --git a/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats b/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats
index 65f764f75..26278668e 100644
--- a/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats
+++ b/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats
@@ -155,3 +155,18 @@ ring_rendered_templates() {
   run bash -c 'source "$1"; is_already_compliant "$2" "$3" petry-projects/TalkTerm' _ "$SCRIPT" "$stripped" "$t"
   [ "$status" -eq 0 ]
 }
+
+@test "strip_stale_stable_header with a template replaces the whole legacy header block" {
+  install_gh_stub
+  local t="${REPO_ROOT}/standards/workflows/persona-mention.yml" old out
+  old="$(printf '# legacy header\n#   • You MUST NOT change: the `uses:` ref — it is pinned to the\n#     `persona-mention/v1-stable` channel, a moving tag.\n#     Never repoint it.\n%s\n' "$(sed -n '/^[^#[:space:]]/,$p' "$t")")"
+  out="$(bash -c 'source "$1"; strip_stale_stable_header persona-mention "$3" <<< "$2"' _ "$SCRIPT" "$old" "$t")"
+  [ "$(sed -n '/^[^#[:space:]]/q;p' <<< "$out")" = "$(sed -n '/^[^#[:space:]]/q;p' "$t")" ]
+  [[ "$out" != *legacy* ]]
+}
+
+@test "idea engines are engine-host targets in .github-private only" {
+  install_gh_stub
+  run bash -c 'source "$1"; for w in idea-enhancer.yml idea-triage.yml initiative-planner.yml; do is_engine_host_target "$w" .github-private || exit 1; ! is_engine_host_target "$w" TalkTerm || exit 2; done' _ "$SCRIPT"
+  [ "$status" -eq 0 ]
+}

From 3fbd2c9e730e9c4a6b4064201612ff4b4b8dcc40 Mon Sep 17 00:00:00 2001
From: don-petry <36422719+don-petry@users.noreply.github.com>
Date: Sun, 11 Oct 2026 19:03:24 +0000
Subject: [PATCH 06/14] test: verify sweep processes all ring-managed stubs
 with stale headers

Add comprehensive test that for every ring-managed template, verifies that
existing stubs carrying stale stable-channel headers are correctly flagged as
non-compliant, ensuring the sweep processes them rather than skipping them.

Fixes the incomplete implementation noted in #1297 where the test only
validated template rendering but didn't verify the sweep's handling of
existing pin-compliant consumer stubs.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
---
 .../stub-header-tier-neutral.bats                 | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats b/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats
index 26278668e..98e022d89 100644
--- a/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats
+++ b/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats
@@ -79,6 +79,21 @@ ring_rendered_templates() {
   if [ -n "$bad" ]; then printf '%s' "$bad"; return 1; fi
 }
 
+@test "sweep: every ring-managed template's existing stubs with stale headers are flagged as non-compliant (not skipped)" {
+  install_gh_stub
+  local rows t base ref rendered old bad=""
+  rows="$(ring_rendered_templates)"
+  while IFS=$'\t' read -r t base ref; do
+    rendered="$(bash -c 'source "$1"; ring_repin_uses "$2" "$3" < "$4"' _ "$SCRIPT" "$base" "$ref" "$t")"
+    # Simulate an existing ring-1 stub that still carries the old stable-channel header
+    old="$(printf '# pinned to the \`%s/v1-stable\` channel\n%s\n' "$base" "$rendered")"
+    # Verify it is NOT compliant (would be processed, not skipped, by the sweep)
+    run bash -c 'source "$1"; is_already_compliant "$2" "$3" petry-projects/test-repo' _ "$SCRIPT" "$old" "$t"
+    [ "$status" -eq 1 ] || bad+="${t##*/}: stale header not flagged as non-compliant"$'\n'
+  done <<< "$rows"
+  if [ -n "$bad" ]; then printf '%s' "$bad"; return 1; fi
+}
+
 @test "ring-1 repo: a correctly swept persona-mention stub is compliant and its header agrees with its pin" {
   install_gh_stub
   local t="${REPO_ROOT}/standards/workflows/persona-mention.yml" swept

From 572180f8797f3ab01d357cede242bd67d9a581ae Mon Sep 17 00:00:00 2001
From: don-petry <36422719+don-petry@users.noreply.github.com>
Date: Sun, 11 Oct 2026 23:45:25 +0000
Subject: [PATCH 07/14] fix: stub_has_stale_stable_header must be tier-aware to
 prevent contradictory headers in ring repos
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A stable-pinned stub with a stable-channel header comment is correct in a stable-tier repo
but contradictory in a ring-tier repo—the repin will change the pin to ring while the header
remains stable. The function now checks if the repo is ring-managed and non-stable-tier;
if so, it does not exempt the stub, flagging it for header migration even if currently
stable-pinned (#1297).

Added repo parameter to stub_has_stale_stable_header and updated callers to pass it.
Updated test to pass a stable-tier repo so the exemption applies correctly.
---
 scripts/deploy-standard-workflows.sh          | 27 ++++++++++++++-----
 .../stub-header-tier-neutral.bats             |  3 ++-
 2 files changed, 22 insertions(+), 8 deletions(-)

diff --git a/scripts/deploy-standard-workflows.sh b/scripts/deploy-standard-workflows.sh
index 8f303684a..af5a20d3d 100755
--- a/scripts/deploy-standard-workflows.sh
+++ b/scripts/deploy-standard-workflows.sh
@@ -583,20 +583,33 @@ merge_guarded_surfaces() {
   return 0
 }
 
-# stub_has_stale_stable_header <existing_content> <template> -> 0 if the stub carries a
+# stub_has_stale_stable_header <existing_content> <template> <repo> -> 0 if the stub carries a
 # comment naming its agent's stable channel (`<base>/stable`, `<base>/v<M>-stable`,
 # `<base> stable channel`) that the template no longer carries (#1297). Such a header
 # contradicts a ring pin; the pin alone is compliant, so without this check the sweep
-# would never ship the comment-only header fix to existing ring repos.
+# would never ship the comment-only header fix to existing ring repos. In ring repos,
+# even a currently stable-pinned stub must migrate its header because the in-place
+# repin will change the pin to ring, leaving the header contradictory.
 stub_has_stale_stable_header() {
-  local existing="$1" template="$2" base re
+  local existing="$1" template="$2" repo="$3" base re tier
   base="$(reusable_base_of "$template")"
   [[ -n "$base" ]] || return 1
   re="^[[:space:]]*#.*(${base}/(v[0-9]+-)?stable|${base} stable channel)"
   grep -qE "$re" <<< "$existing" || return 1
   ! grep -qE "$re" "$template" || return 1
-  # A stable-pinned stub's header still agrees with its pin: only a ring/next pin
-  # makes the stable wording a contradiction, so stable consumers see no churn.
+  # A stable-pinned stub's header agrees with its pin, BUT only when the repo is
+  # stable-tier. In ring-managed repos, a stable-pinned stub is itself an anomaly
+  # that the repin will fix; the header must migrate too, so don't exempt in ring.
+  if ring_is_ring_reusable "$base" && [[ -n "$repo" ]]; then
+    tier="$(ring_tier_for_repo "$base" "$repo" 2>/dev/null)" || tier=""
+    # Ring-managed repo with a tier: the stub should be ring-pinned, so the header
+    # is stale regardless of the current pin.
+    if [[ -n "$tier" ]] && [[ "$tier" != "stable" ]]; then
+      return 0  # Flag as stale
+    fi
+  fi
+  # Non-ring reusable or stable-tier repo: apply the exemption (don't flag if
+  # the stub is stable-pinned, since the header agrees with the pin).
   ! grep -qE "^[[:space:]]*uses:.*@${base}/(v[0-9]+-)?stable([[:space:]]|\$)" <<< "$existing"
 }
 
@@ -668,7 +681,7 @@ is_already_compliant() {
      && ! stub_has_s7635_marker <<< "$existing_content"; then
     return 1
   fi
-  stub_has_stale_stable_header "$existing_content" "$template" && return 1
+  stub_has_stale_stable_header "$existing_content" "$template" "$repo" && return 1
   if is_replace_if_present_workflow "$workflow" \
      || { is_full_body_compare_repo "$repo" && ! is_body_preserving_workflow "$workflow"; }; then
     stub_body_matches_template "$existing_content" "$template" "$repo" || return 1
@@ -979,7 +992,7 @@ deploy_repo() {
     # pr-auto-review's workflow_run.workflows). Full-body-compared stubs are exempt —
     # their drift is already resolved by a template redeploy.
     if [[ "$DRY_RUN" != "true" && -n "$existing_sha" ]] \
-       && stub_has_stale_stable_header "$existing_content" "$template"; then
+       && stub_has_stale_stable_header "$existing_content" "$template" "$repo"; then
       base="$(reusable_base_of "$template")"
       if [[ "$repin_source" == "$template" ]] && ! is_replace_if_present_workflow "$workflow" \
          && ! { is_full_body_compare_repo "$repo" && ! is_body_preserving_workflow "$workflow"; } \
diff --git a/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats b/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats
index 98e022d89..ac6c126e0 100644
--- a/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats
+++ b/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats
@@ -136,7 +136,8 @@ ring_rendered_templates() {
   local t="${REPO_ROOT}/standards/workflows/persona-mention.yml" stable old
   stable="$(cat "$t")"
   old="$(printf '# pinned to the `persona-mention/v1-stable` channel\n%s\n' "$stable")"
-  run bash -c 'source "$1"; stub_has_stale_stable_header "$2" "$3"' _ "$SCRIPT" "$old" "$t"
+  # Pass a stable-tier repo so the exemption applies
+  run bash -c 'source "$1"; stub_has_stale_stable_header "$2" "$3" petry-projects/stable-repo' _ "$SCRIPT" "$old" "$t"
   [ "$status" -eq 1 ]
 }
 

From 1f70096e47c4d06e0e32a46512cc5fc228db1d26 Mon Sep 17 00:00:00 2001
From: don-petry <36422719+don-petry@users.noreply.github.com>
Date: Sun, 11 Oct 2026 23:54:41 +0000
Subject: [PATCH 08/14] fix(reviews): strip stale stable-channel comment blocks
 in stub body, not only the leading header

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 scripts/deploy-standard-workflows.sh                   | 10 ++++++++--
 .../stub-header-tier-neutral.bats                      | 10 ++++++++++
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/scripts/deploy-standard-workflows.sh b/scripts/deploy-standard-workflows.sh
index af5a20d3d..1b85eaffc 100755
--- a/scripts/deploy-standard-workflows.sh
+++ b/scripts/deploy-standard-workflows.sh
@@ -622,10 +622,16 @@ stub_has_stale_stable_header() {
 strip_stale_stable_header() {
   local base="$1" template="${2:-}"
   if [[ -n "$template" && -r "$template" ]]; then
-    awk -v tpl="$template" '
+    # Body comment blocks (consecutive comment lines) that name the stable channel are
+    # dropped whole too, so a legacy `# Pinned to the moving ... stable channel` block under
+    # `jobs:` does not survive and keep the detector true forever.
+    awk -v tpl="$template" -v re="^[[:space:]]*#.*(${base}/(v[0-9]+-)?stable|${base} stable channel)" '
       BEGIN { while ((getline l < tpl) > 0) { if (l ~ /^[^#[:space:]]/) break; hdr = hdr l "\n" } }
+      function flush() { if (!stale) printf "%s", blk; blk = ""; stale = 0 }
       !body && /^[^#[:space:]]/ { body = 1; printf "%s", hdr }
-      body { print }
+      body && /^[[:space:]]*#/ { blk = blk $0 "\n"; if ($0 ~ re) stale = 1; next }
+      body { flush(); print; next }
+      END { if (body) flush() }
     '
     return 0
   fi
diff --git a/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats b/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats
index ac6c126e0..9abed9037 100644
--- a/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats
+++ b/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats
@@ -181,6 +181,16 @@ ring_rendered_templates() {
   [[ "$out" != *legacy* ]]
 }
 
+@test "strip_stale_stable_header with a template also drops a stale comment block under jobs" {
+  install_gh_stub
+  local t="${REPO_ROOT}/standards/workflows/dev-lead.yml" old out
+  old="$(printf '# legacy header dev-lead/v1-stable\nname: x\njobs:\n  dev-lead:\n    # Pinned to the moving dev-lead stable channel tag, not @main,\n    # so a broken change cannot gate its own fix.\n    uses: foo\n    # keep me\n    with: 1\n')"
+  out="$(bash -c 'source "$1"; strip_stale_stable_header dev-lead "$3" <<< "$2"' _ "$SCRIPT" "$old" "$t")"
+  [[ "$out" != *"stable channel"* ]]
+  [[ "$out" != *"cannot gate"* ]]
+  [[ "$out" == *"# keep me"* ]]
+}
+
 @test "idea engines are engine-host targets in .github-private only" {
   install_gh_stub
   run bash -c 'source "$1"; for w in idea-enhancer.yml idea-triage.yml initiative-planner.yml; do is_engine_host_target "$w" .github-private || exit 1; ! is_engine_host_target "$w" TalkTerm || exit 2; done' _ "$SCRIPT"

From 3f0de8aa16881dccf5602b6213f685f6e60dbb5e Mon Sep 17 00:00:00 2001
From: don-petry <36422719+don-petry@users.noreply.github.com>
Date: Mon, 12 Oct 2026 02:05:30 +0000
Subject: [PATCH 09/14] fix(reviews): exempt present-only callers from
 repo-template full-body compare

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 scripts/deploy-standard-workflows.sh             |  6 ++++--
 .../repo-template-full-body.bats                 | 16 ++++++++++++++++
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/scripts/deploy-standard-workflows.sh b/scripts/deploy-standard-workflows.sh
index 1b85eaffc..b3d1033d5 100755
--- a/scripts/deploy-standard-workflows.sh
+++ b/scripts/deploy-standard-workflows.sh
@@ -668,7 +668,8 @@ is_present_only_workflow() {
 # rendered at the repo's tier channel (stub_body_matches_template): its callers
 # predate the template and carry per-repo edits, which are drift. So must every stub
 # in a FULL_BODY_COMPARE_REPOS repo (repo-template, #1285) other than a
-# BODY_PRESERVING_WORKFLOWS one, whose per-repo body is never re-synced.
+# BODY_PRESERVING_WORKFLOWS or PRESENT_ONLY_WORKFLOWS one, whose per-repo body is
+# re-pinned in place and never re-synced from the template.
 #
 # A pin-correct stub whose guarded `on:` / `permissions:` / `concurrency:` surface
 # differs from the template is ALSO drift (#1236): the audit flags it
@@ -689,7 +690,8 @@ is_already_compliant() {
   fi
   stub_has_stale_stable_header "$existing_content" "$template" "$repo" && return 1
   if is_replace_if_present_workflow "$workflow" \
-     || { is_full_body_compare_repo "$repo" && ! is_body_preserving_workflow "$workflow"; }; then
+     || { is_full_body_compare_repo "$repo" && ! is_body_preserving_workflow "$workflow" \
+          && ! is_present_only_workflow "$workflow"; }; then
     stub_body_matches_template "$existing_content" "$template" "$repo" || return 1
   fi
   if ! is_skipped_repo "$repo" && ! is_body_preserving_workflow "$workflow" \
diff --git a/test/scripts/deploy-standard-workflows/repo-template-full-body.bats b/test/scripts/deploy-standard-workflows/repo-template-full-body.bats
index 63870676a..26cef0a5b 100644
--- a/test/scripts/deploy-standard-workflows/repo-template-full-body.bats
+++ b/test/scripts/deploy-standard-workflows/repo-template-full-body.bats
@@ -214,3 +214,19 @@ deploy_capture() {
   grep -qF 'TUNED-REPO-CONTEXT-SENTINEL' "$OUT/feature-ideation.yml"
   grep -qF 'feature-ideation-reusable.yml@feature-ideation/v1-stable' "$OUT/feature-ideation.yml"
 }
+
+# ── PRESENT_ONLY_WORKFLOWS are re-pinned in place, never body-compared ───────
+
+@test "repo-template: a present-only idea-triage.yml with a customized cron is already compliant" {
+  local t="${REPO_ROOT}/standards/workflows/idea-triage.yml"
+  local existing="${TT_TMP}/idea-triage.yml"
+  sed "s/'30 13 \* \* 1'/'5 4 * * 2'/" "$t" > "$existing"
+  ! diff -q "$existing" "$t" >/dev/null
+  GH_MATCHING_REFS="refs/tags/idea-triage/v1-stable
+refs/tags/idea-triage/v1-next
+refs/tags/idea-triage/v1-ring0
+refs/tags/idea-triage/v1-ring1"; export GH_MATCHING_REFS
+  install_gh_stub
+  run bash -c 'source "$1"; is_already_compliant "$(< "$2")" "$3" petry-projects/repo-template' _ "$SCRIPT" "$existing" "$t"
+  [ "$status" -eq 0 ]
+}

From f47c49cbefd47aa4ef24c33102e8f7de8f588479 Mon Sep 17 00:00:00 2001
From: don-petry <36422719+don-petry@users.noreply.github.com>
Date: Mon, 12 Oct 2026 06:02:03 +0000
Subject: [PATCH 10/14] =?UTF-8?q?fix(bot):=20revert=20stub=20header=20chan?=
 =?UTF-8?q?ges=20=E2=80=94=20templates=20are=20read-only=20synced=20stubs?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reverted changes to workflow stub files with SOURCE OF TRUTH headers. These
files are read-only synced templates and should not be modified in this repo.
The header wording issues flagged by CodeAnt must be addressed in the main
petry-projects/.github repository templates instead.

Kept the script-based fix (deploy-standard-workflows.sh) which intelligently
detects and migrates stale headers at deployment time, respecting tier-specific
channel assignments.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
---
 standards/workflows/add-to-project.yml     | 3 +--
 standards/workflows/auto-rebase.yml        | 5 ++---
 standards/workflows/dependabot-rebase.yml  | 5 ++---
 standards/workflows/dev-lead.yml           | 3 +--
 standards/workflows/idea-enhancer.yml      | 5 ++---
 standards/workflows/idea-triage.yml        | 5 ++---
 standards/workflows/initiative-planner.yml | 5 ++---
 standards/workflows/persona-mention.yml    | 5 ++---
 standards/workflows/pr-auto-review.yml     | 5 ++---
 standards/workflows/pr-review-mention.yml  | 5 ++---
 standards/workflows/pr-review.yml          | 6 +++---
 11 files changed, 21 insertions(+), 31 deletions(-)

diff --git a/standards/workflows/add-to-project.yml b/standards/workflows/add-to-project.yml
index 41baf5fc7..d5b20a58e 100644
--- a/standards/workflows/add-to-project.yml
+++ b/standards/workflows/add-to-project.yml
@@ -7,8 +7,7 @@
 #   • This file is a THIN CALLER STUB. All noise-gate / reconcile logic lives
 #     in the reusable workflow above.
 #   • You MAY change: nothing in normal use. The `uses:` ref and `agent_ref`
-#     are pinned to this repo's ring channel for `add-to-project`, set by the
-#     standards sweep, and move with it — do
+#     are pinned to the `add-to-project/v1-stable` channel and move with it — do
 #     not change them to `@main` or a SHA (see ci-standards.md → Reusable
 #     workflow versioning).
 #   • You MUST NOT change: trigger events, the concurrency group, or the
diff --git a/standards/workflows/auto-rebase.yml b/standards/workflows/auto-rebase.yml
index 10a9a0f89..7f3ffc106 100644
--- a/standards/workflows/auto-rebase.yml
+++ b/standards/workflows/auto-rebase.yml
@@ -6,9 +6,8 @@
 # AGENTS — READ BEFORE EDITING:
 #   • This file is a THIN CALLER STUB. All branch-update logic lives in the
 #     reusable workflow above.
-#   • You MUST NOT change: the `uses:` ref — it is pinned to this repo's ring
-#     channel for `auto-rebase`, set by the standards sweep (a moving tag
-#     advanced centrally). Never
+#   • You MUST NOT change: the `uses:` ref — it is pinned to the
+#     `auto-rebase/v2-stable` channel, a moving tag advanced centrally. Never
 #     repoint it to `@main`, a SHA, or a frozen `@vX` (see ci-standards.md →
 #     Reusable workflow versioning). Also do not change the trigger event,
 #     the concurrency group name,
diff --git a/standards/workflows/dependabot-rebase.yml b/standards/workflows/dependabot-rebase.yml
index 2210bc7f3..53a1f1f2f 100644
--- a/standards/workflows/dependabot-rebase.yml
+++ b/standards/workflows/dependabot-rebase.yml
@@ -6,9 +6,8 @@
 # AGENTS — READ BEFORE EDITING:
 #   • This file is a THIN CALLER STUB. All rebase/merge serialization logic
 #     lives in the reusable workflow above.
-#   • You MUST NOT change: the `uses:` ref — it is pinned to this repo's ring
-#     channel for `dependabot-rebase`, set by the standards sweep (a moving
-#     tag advanced centrally).
+#   • You MUST NOT change: the `uses:` ref — it is pinned to the
+#     `dependabot-rebase/v2-stable` channel, a moving tag advanced centrally.
 #     Never repoint it to `@main`, a SHA, or a frozen `@vX` (see
 #     ci-standards.md → Reusable workflow versioning). Also do not change the
 #     concurrency group name, the explicit secrets
diff --git a/standards/workflows/dev-lead.yml b/standards/workflows/dev-lead.yml
index f95f783c9..1cd459bdb 100644
--- a/standards/workflows/dev-lead.yml
+++ b/standards/workflows/dev-lead.yml
@@ -56,8 +56,7 @@ permissions: {}
 
 jobs:
   dev-lead:
-    # Pinned to this repo's moving dev-lead ring channel tag (set by the
-    # standards sweep), not @main, so a broken
+    # Pinned to the moving dev-lead stable channel tag, not @main, so a broken
     # change to dev-lead can no longer gate its own fix (the self-host circular
     # dependency). Promotion is done by moving that channel tag centrally; this
     # caller is never edited on release. agent_ref threads the same channel into
diff --git a/standards/workflows/idea-enhancer.yml b/standards/workflows/idea-enhancer.yml
index 6db803b8b..3ea45bc8a 100644
--- a/standards/workflows/idea-enhancer.yml
+++ b/standards/workflows/idea-enhancer.yml
@@ -6,9 +6,8 @@
 # AGENTS — READ BEFORE EDITING:
 #   • This file is a THIN CALLER STUB. All enhancement-dispatch logic (including
 #     the Ideas-category / non-bot guard) lives in the reusable above.
-#   • You MUST NOT change: the `uses:` ref — it is pinned to this repo's ring
-#     channel for `idea-enhancer`, set by the standards sweep (a moving tag
-#     advanced centrally). Never
+#   • You MUST NOT change: the `uses:` ref — it is pinned to the
+#     `idea-enhancer/v1-stable` channel, a moving tag advanced centrally. Never
 #     repoint it to `@main`, a SHA, or a frozen `@vX`. Do not change the trigger
 #     events or the `secrets:` block.
 #   • You MAY change: the cron schedule if the weekly cadence doesn't suit.
diff --git a/standards/workflows/idea-triage.yml b/standards/workflows/idea-triage.yml
index 81b8af283..7169e171a 100644
--- a/standards/workflows/idea-triage.yml
+++ b/standards/workflows/idea-triage.yml
@@ -6,9 +6,8 @@
 # AGENTS — READ BEFORE EDITING:
 #   • This file is a THIN CALLER STUB. All triage-dispatch logic lives in the
 #     reusable above.
-#   • You MUST NOT change: the `uses:` ref — it is pinned to this repo's ring
-#     channel for `idea-triage`, set by the standards sweep (a moving tag
-#     advanced centrally). Never
+#   • You MUST NOT change: the `uses:` ref — it is pinned to the
+#     `idea-triage/v1-stable` channel, a moving tag advanced centrally. Never
 #     repoint it to `@main`, a SHA, or a frozen `@vX`. Do not change the
 #     `secrets:` block.
 #   • You MAY change: the cron schedule if the weekly cadence doesn't suit.
diff --git a/standards/workflows/initiative-planner.yml b/standards/workflows/initiative-planner.yml
index c6f028301..d4af6cd80 100644
--- a/standards/workflows/initiative-planner.yml
+++ b/standards/workflows/initiative-planner.yml
@@ -7,9 +7,8 @@
 #   • This file is a THIN CALLER STUB. All idea→initiative dispatch logic (the
 #     `idea:approved` gate, the trusted-actor check, and the cross-repo dispatch
 #     to the central BMAD Scrum Master planner) lives in the reusable above.
-#   • You MUST NOT change: the `uses:` ref — it is pinned to this repo's ring
-#     channel for `initiative-planner`, set by the standards sweep (a moving
-#     tag advanced centrally).
+#   • You MUST NOT change: the `uses:` ref — it is pinned to the
+#     `initiative-planner/v1-stable` channel, a moving tag advanced centrally.
 #     Never repoint it to `@main`, a SHA, or a frozen `@vX` (see
 #     ci-standards.md → Reusable workflow versioning). Also do not change the
 #     trigger events or the `secrets:` block.
diff --git a/standards/workflows/persona-mention.yml b/standards/workflows/persona-mention.yml
index cc37ae75d..cd7778729 100644
--- a/standards/workflows/persona-mention.yml
+++ b/standards/workflows/persona-mention.yml
@@ -7,9 +7,8 @@
 #   • This file is a THIN CALLER STUB. All routing logic lives in the reusable
 #     workflow above, and every per-persona decision lives in that persona's
 #     manifest — not here and not in the reusable.
-#   • You MUST NOT change: the `uses:` ref — it is pinned to this repo's ring
-#     channel for `persona-mention`, set by the standards sweep (a moving tag
-#     advanced centrally).
+#   • You MUST NOT change: the `uses:` ref — it is pinned to the
+#     `persona-mention/v1-stable` channel, a moving tag advanced centrally.
 #     Never repoint it to `@main`, a SHA, or a frozen `@vX.Y.Z` (see
 #     ci-standards.md → Reusable workflow versioning). Also do not change the
 #     trigger events or the job-level `permissions:` block — reusable workflows
diff --git a/standards/workflows/pr-auto-review.yml b/standards/workflows/pr-auto-review.yml
index 18ff27067..73df2cea4 100644
--- a/standards/workflows/pr-auto-review.yml
+++ b/standards/workflows/pr-auto-review.yml
@@ -8,9 +8,8 @@
 #     reusable workflow above.
 #   • You MAY change: the workflow name(s) in `workflow_run.workflows` to match
 #     your repository's CI workflow name(s).
-#   • You MUST NOT change: the `uses:` ref — it is pinned to this repo's ring
-#     channel for `pr-auto-review`, set by the standards sweep. This reusable
-#     is on the org-wide moving-channel model (rollout and
+#   • You MUST NOT change: the `@pr-auto-review/v1-stable` channel in the `uses:`
+#     line — this reusable is on the org-wide moving-channel model (rollout and
 #     rollback are a single central tag move; a frozen `@vN`/`@<sha>` pin is
 #     rejected by the compliance audit). Nor the trigger event types or the
 #     job-level `permissions:` block — reusable workflows can be granted no more
diff --git a/standards/workflows/pr-review-mention.yml b/standards/workflows/pr-review-mention.yml
index 91607a85c..cab045617 100644
--- a/standards/workflows/pr-review-mention.yml
+++ b/standards/workflows/pr-review-mention.yml
@@ -6,9 +6,8 @@
 # AGENTS — READ BEFORE EDITING:
 #   • This file is a THIN CALLER STUB. All review-dispatch logic lives in the
 #     reusable workflow above.
-#   • You MUST NOT change: the `uses:` ref — it is pinned to this repo's ring
-#     channel for `pr-review-mention`, set by the standards sweep (a moving
-#     tag advanced centrally).
+#   • You MUST NOT change: the `uses:` ref — it is pinned to the
+#     `pr-review-mention/v2-stable` channel, a moving tag advanced centrally.
 #     Never repoint it to `@main`, a SHA, or a frozen `@vX` (see
 #     ci-standards.md → Reusable workflow versioning). Also do not change the
 #     trigger events or the job-level `permissions:` block — reusable workflows
diff --git a/standards/workflows/pr-review.yml b/standards/workflows/pr-review.yml
index fa61f51f2..d40a359af 100644
--- a/standards/workflows/pr-review.yml
+++ b/standards/workflows/pr-review.yml
@@ -9,9 +9,9 @@
 #     above, including concurrency (per PR + head SHA, never cancelling an
 #     in-flight review), the check_suite-without-a-PR skip, and reading
 #     `client_payload.pr_url` from repository_dispatch.
-#   • You MUST NOT change: the `pr-review` channel in the `uses:` line or the
-#     matching `agent_ref` — both are pinned in lockstep to this repo's ring
-#     channel for `pr-review`, set by the standards sweep. Nor the workflow `name:`,
+#   • You MUST NOT change: the `@pr-review/v1-stable` channel in the `uses:`
+#     line or the matching `agent_ref` — both are re-pinned in lockstep to this
+#     repo's canary-ring tier by the standards sweep. Nor the workflow `name:`,
 #     the job id `review` (check names depend on both), the trigger event types,
 #     the Dependabot skip guard, or the job-level `permissions:` block. Do not
 #     add a stub-level `concurrency:` block.

From d6d2d697bb2201b1f7d37389a2bbf20cbc676e15 Mon Sep 17 00:00:00 2001
From: don-petry <36422719+don-petry@users.noreply.github.com>
Date: Mon, 12 Oct 2026 06:15:46 +0000
Subject: [PATCH 11/14] fix(reviews): render ring headers tier-neutral from
 stable-wording templates

Test-Change-Justification: template headers still name the stable channel (templates are read-only synced stubs, f47c49c); the expected header in test 11 must be the tier-neutral rendering, per CodeRabbit review on #1298 (thread PRRT_kwDORyesfc6rWIKK).
---
 scripts/deploy-standard-workflows.sh              | 14 +++++++++++---
 scripts/lib/ring-pins.sh                          | 13 ++++++++++++-
 .../stub-header-tier-neutral.bats                 | 15 ++++++++++++++-
 3 files changed, 37 insertions(+), 5 deletions(-)

diff --git a/scripts/deploy-standard-workflows.sh b/scripts/deploy-standard-workflows.sh
index b3d1033d5..fe84c5973 100755
--- a/scripts/deploy-standard-workflows.sh
+++ b/scripts/deploy-standard-workflows.sh
@@ -596,7 +596,6 @@ stub_has_stale_stable_header() {
   [[ -n "$base" ]] || return 1
   re="^[[:space:]]*#.*(${base}/(v[0-9]+-)?stable|${base} stable channel)"
   grep -qE "$re" <<< "$existing" || return 1
-  ! grep -qE "$re" "$template" || return 1
   # A stable-pinned stub's header agrees with its pin, BUT only when the repo is
   # stable-tier. In ring-managed repos, a stable-pinned stub is itself an anomaly
   # that the repin will fix; the header must migrate too, so don't exempt in ring.
@@ -605,9 +604,12 @@ stub_has_stale_stable_header() {
     # Ring-managed repo with a tier: the stub should be ring-pinned, so the header
     # is stale regardless of the current pin.
     if [[ -n "$tier" ]] && [[ "$tier" != "stable" ]]; then
+      # The template may still carry the stable wording; ring renders (ring_repin_uses)
+      # and the header cleanup neutralize it, so the template never exempts a ring repo.
       return 0  # Flag as stale
     fi
   fi
+  ! grep -qE "$re" "$template" || return 1
   # Non-ring reusable or stable-tier repo: apply the exemption (don't flag if
   # the stub is stable-pinned, since the header agrees with the pin).
   ! grep -qE "^[[:space:]]*uses:.*@${base}/(v[0-9]+-)?stable([[:space:]]|\$)" <<< "$existing"
@@ -625,8 +627,14 @@ strip_stale_stable_header() {
     # Body comment blocks (consecutive comment lines) that name the stable channel are
     # dropped whole too, so a legacy `# Pinned to the moving ... stable channel` block under
     # `jobs:` does not survive and keep the detector true forever.
-    awk -v tpl="$template" -v re="^[[:space:]]*#.*(${base}/(v[0-9]+-)?stable|${base} stable channel)" '
-      BEGIN { while ((getline l < tpl) > 0) { if (l ~ /^[^#[:space:]]/) break; hdr = hdr l "\n" } }
+    awk -v tpl="$template" -v base="$base" -v re="^[[:space:]]*#.*(${base}/(v[0-9]+-)?stable|${base} stable channel)" '
+      BEGIN {
+        while ((getline l < tpl) > 0) { if (l ~ /^[^#[:space:]]/) break; hdr = hdr l "\n" }
+        # The template header may still name the stable channel; render it tier-neutral
+        # (same wording as ring_repin_uses) so cleanup never reinstalls it.
+        gsub(base "/(v[0-9]+-)?stable", base "/<tier>", hdr)
+        gsub(base " stable channel", base "/<tier> channel", hdr)
+      }
       function flush() { if (!stale) printf "%s", blk; blk = ""; stale = 0 }
       !body && /^[^#[:space:]]/ { body = 1; printf "%s", hdr }
       body && /^[[:space:]]*#/ { blk = blk $0 "\n"; if ($0 ~ re) stale = 1; next }
diff --git a/scripts/lib/ring-pins.sh b/scripts/lib/ring-pins.sh
index 8169bae34..498d8a361 100644
--- a/scripts/lib/ring-pins.sh
+++ b/scripts/lib/ring-pins.sh
@@ -455,11 +455,22 @@ ring_tag_exists() {
 # is re-pinned alongside `uses:` here. This only re-pins the VALUE of an input the
 # stub already forwards (never adds/forwards a new one), so it never introduces the
 # undeclared-input channel-skew defect (#1052).
+# When <newref> is not a stable channel, comment lines naming this agent's stable
+# channel (`<base>/v<M>-stable`, `<base> stable channel`) are rendered tier-neutral
+# (`<base>/<tier>`), so a header never contradicts the ring pin even while the
+# template still carries the stable wording (#1297).
 ring_repin_uses() {
-  local base="$1" newref="$2" file
+  local base="$1" newref="$2" file neutral=()
   file="$(ring_reusable_file "$base")"
   file="${file//./\\.}"
+  if [[ ! "$newref" =~ stable$ ]]; then
+    neutral=(
+      -e "/^[[:space:]]*#/s#${base}/(v[0-9]+-)?stable#${base}/<tier>#g"
+      -e "/^[[:space:]]*#/s#${base} stable channel#${base}/<tier> channel#g"
+    )
+  fi
   sed -E \
+    "${neutral[@]+"${neutral[@]}"}" \
     -e "s#^([[:space:]]*uses:[[:space:]]*petry-projects/[^@[:space:]]*/${file})@[^[:space:]]+#\1@${newref}#" \
     -e "s#^([[:space:]]*agent_ref:[[:space:]]*[\"']?)${base}/[^\"'[:space:]]+#\1${newref}#" \
     -e "s#^([[:space:]]*checkout_ref:[[:space:]]*[\"']?)${base}/[^\"'[:space:]]+#\1${newref}#"
diff --git a/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats b/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats
index 9abed9037..d1fec22b8 100644
--- a/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats
+++ b/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats
@@ -177,7 +177,8 @@ ring_rendered_templates() {
   local t="${REPO_ROOT}/standards/workflows/persona-mention.yml" old out
   old="$(printf '# legacy header\n#   • You MUST NOT change: the `uses:` ref — it is pinned to the\n#     `persona-mention/v1-stable` channel, a moving tag.\n#     Never repoint it.\n%s\n' "$(sed -n '/^[^#[:space:]]/,$p' "$t")")"
   out="$(bash -c 'source "$1"; strip_stale_stable_header persona-mention "$3" <<< "$2"' _ "$SCRIPT" "$old" "$t")"
-  [ "$(sed -n '/^[^#[:space:]]/q;p' <<< "$out")" = "$(sed -n '/^[^#[:space:]]/q;p' "$t")" ]
+  # The template header, rendered tier-neutral (it may still name the stable channel).
+  [ "$(sed -n '/^[^#[:space:]]/q;p' <<< "$out")" = "$(sed -n '/^[^#[:space:]]/q;p' "$t" | bash -c 'source "$1"; ring_repin_uses persona-mention persona-mention/v1-ring1' _ "$SCRIPT")" ]
   [[ "$out" != *legacy* ]]
 }
 
@@ -196,3 +197,15 @@ ring_rendered_templates() {
   run bash -c 'source "$1"; for w in idea-enhancer.yml idea-triage.yml initiative-planner.yml; do is_engine_host_target "$w" .github-private || exit 1; ! is_engine_host_target "$w" TalkTerm || exit 2; done' _ "$SCRIPT"
   [ "$status" -eq 0 ]
 }
+
+@test "ring repin renders a template's stable-channel comments tier-neutral; cleanup never reinstalls them" {
+  install_gh_stub
+  local t="${REPO_ROOT}/standards/workflows/persona-mention.yml" old out
+  old="$(printf '# legacy persona-mention/v1-stable\n%s\n' "$(sed -n '/^[^#[:space:]]/,$p' "$t")")"
+  out="$(bash -c 'source "$1"; strip_stale_stable_header persona-mention "$3" <<< "$2"' _ "$SCRIPT" "$old" "$t")"
+  run grep -E '^[[:space:]]*#.*(persona-mention/(v[0-9]+-)?stable|persona-mention stable channel)' <<< "$out"
+  [ "$status" -eq 1 ]
+  # Stable repin keeps the stable wording.
+  run bash -c 'source "$1"; ring_repin_uses persona-mention persona-mention/v1-stable < "$2"' _ "$SCRIPT" "$t"
+  grep -qF 'persona-mention/v1-stable' <<< "$output"
+}

From 666b6d9fec9b3ed456a20f9f886279e120b689d4 Mon Sep 17 00:00:00 2001
From: don-petry <36422719+don-petry@users.noreply.github.com>
Date: Mon, 12 Oct 2026 06:17:15 +0000
Subject: [PATCH 12/14] test(reviews): render ring fixtures via ring_repin_uses
 so headers are tier-neutral

Test-Change-Justification: fixtures re-pinned only uses: and left the template's stable-channel header above a ring pin, the exact contradiction #1297 / CodeRabbit review on #1298 (thread PRRT_kwDORyesfc6rWIKK) says the sweep must not treat as compliant; fixtures now use the production renderer.
---
 test/scripts/deploy-standard-workflows/dry-run.bats         | 3 ++-
 test/scripts/deploy-standard-workflows/emit-vform.bats      | 6 ++++--
 .../pr-review-replace-if-present.bats                       | 3 ++-
 .../deploy-standard-workflows/repo-template-full-body.bats  | 3 ++-
 4 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/test/scripts/deploy-standard-workflows/dry-run.bats b/test/scripts/deploy-standard-workflows/dry-run.bats
index f5b226854..f9d499e6d 100644
--- a/test/scripts/deploy-standard-workflows/dry-run.bats
+++ b/test/scripts/deploy-standard-workflows/dry-run.bats
@@ -75,7 +75,8 @@ stub_pinning() {  # <ref> → base64 of the auto-rebase template re-pinned to <r
   # and the surface-drift check (#1236) stays clean.
   local body
   body="$(sed -E "s|(auto-rebase-reusable\.yml)@[^[:space:]]+|\1@$1|" \
-    "${REPO_ROOT}/standards/workflows/auto-rebase.yml")"
+    "${REPO_ROOT}/standards/workflows/auto-rebase.yml" \
+    | bash -c 'source "$1"; ring_repin_uses "$2" "$3"' _ "$SCRIPT" auto-rebase "$1")"
   base64 -w 0 <<<"$body" 2>/dev/null || base64 -b 0 <<<"$body"
 }
 
diff --git a/test/scripts/deploy-standard-workflows/emit-vform.bats b/test/scripts/deploy-standard-workflows/emit-vform.bats
index c40ef7148..d8e291f2e 100644
--- a/test/scripts/deploy-standard-workflows/emit-vform.bats
+++ b/test/scripts/deploy-standard-workflows/emit-vform.bats
@@ -84,7 +84,8 @@ stub_pinning() {  # <ref> → base64 of the auto-rebase template re-pinned to <r
   # concurrency: surfaces match and the surface-drift check (#1236) stays clean.
   local body
   body="$(sed -E "s|(auto-rebase-reusable\.yml)@[^[:space:]]+|\1@$1|" \
-    "${REPO_ROOT}/standards/workflows/auto-rebase.yml")"
+    "${REPO_ROOT}/standards/workflows/auto-rebase.yml" \
+    | bash -c 'source "$1"; ring_repin_uses "$2" "$3"' _ "$SCRIPT" auto-rebase "$1")"
   base64 -w 0 <<<"$body" 2>/dev/null || base64 -b 0 <<<"$body"
 }
 
@@ -112,7 +113,8 @@ devlead_stub_pinning_with_marker() {  # <ref> → base64 of the dev-lead templat
   local body
   body="$(sed -E -e "s|(dev-lead-reusable\.yml)@[^[:space:]]+|\1@$1|" \
     -e "s|^([[:space:]]*agent_ref:[[:space:]]*).*|\1$1|" \
-    "${REPO_ROOT}/standards/workflows/dev-lead.yml")"
+    "${REPO_ROOT}/standards/workflows/dev-lead.yml" \
+    | bash -c 'source "$1"; ring_repin_uses "$2" "$3"' _ "$SCRIPT" dev-lead "$1")"
   base64 -w 0 <<<"$body" 2>/dev/null || base64 -b 0 <<<"$body"
 }
 
diff --git a/test/scripts/deploy-standard-workflows/pr-review-replace-if-present.bats b/test/scripts/deploy-standard-workflows/pr-review-replace-if-present.bats
index 27f12bb86..c69a23fd6 100644
--- a/test/scripts/deploy-standard-workflows/pr-review-replace-if-present.bats
+++ b/test/scripts/deploy-standard-workflows/pr-review-replace-if-present.bats
@@ -63,7 +63,8 @@ STUB
 # The template rendered at <channel> — what a correctly deployed caller looks like:
 # only the two pin lines move; the header prose keeps the template's channel.
 rendered_at() {  # <channel>
-  sed -E "/^[[:space:]]*(uses|agent_ref):/s#pr-review/v1-stable#$1#" "$TEMPLATE"
+  sed -E "/^[[:space:]]*(uses|agent_ref):/s#pr-review/v1-stable#$1#" "$TEMPLATE" \
+    | bash -c 'source "$1"; ring_repin_uses pr-review "$2"' _ "$SCRIPT" "$1"
 }
 
 # The legacy fleet caller shape (TalkTerm-like): bare pr-review/stable pin, an
diff --git a/test/scripts/deploy-standard-workflows/repo-template-full-body.bats b/test/scripts/deploy-standard-workflows/repo-template-full-body.bats
index 26cef0a5b..df339fb42 100644
--- a/test/scripts/deploy-standard-workflows/repo-template-full-body.bats
+++ b/test/scripts/deploy-standard-workflows/repo-template-full-body.bats
@@ -67,7 +67,8 @@ STUB
 
 # The template rendered at <channel> — only the reusable pin moves.
 rendered_at() {  # <channel>
-  sed -E "/^[[:space:]]*uses:/s#dependabot-rebase/v2-stable#$1#" "$TEMPLATE"
+  sed -E "/^[[:space:]]*uses:/s#dependabot-rebase/v2-stable#$1#" "$TEMPLATE" \
+    | bash -c 'source "$1"; ring_repin_uses dependabot-rebase "$2"' _ "$SCRIPT" "$1"
 }
 
 # The template at <channel> with a stale header comment — the #1075 shape: the

From 01f46028ab753c8dc7931b57094c8a2d5f95ba8e Mon Sep 17 00:00:00 2001
From: don-petry <36422719+don-petry@users.noreply.github.com>
Date: Wed, 14 Oct 2026 20:23:14 +0000
Subject: [PATCH 13/14] fix: remove outer quotes from neutral array expansion
 in ring_repin_uses

The outer quotes around ${neutral[@]+""} prevented proper
argument splitting when sed receives multiple -e options, potentially causing
incorrect sed behavior in ring-channel deployments.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
---
 scripts/lib/ring-pins.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/lib/ring-pins.sh b/scripts/lib/ring-pins.sh
index cb9c7d378..93d2e215b 100644
--- a/scripts/lib/ring-pins.sh
+++ b/scripts/lib/ring-pins.sh
@@ -470,7 +470,7 @@ ring_repin_uses() {
     )
   fi
   sed -E \
-    "${neutral[@]+"${neutral[@]}"}" \
+    ${neutral[@]+"${neutral[@]}"} \
     -e "s#^([[:space:]]*uses:[[:space:]]*combsmith/[^@[:space:]]*/${file})@[^[:space:]]+#\1@${newref}#" \
     -e "s#^([[:space:]]*agent_ref:[[:space:]]*[\"']?)${base}/[^\"'[:space:]]+#\1${newref}#" \
     -e "s#^([[:space:]]*checkout_ref:[[:space:]]*[\"']?)${base}/[^\"'[:space:]]+#\1${newref}#"

From 63444b577ad05dd6a47b473f9ac58bb8a390dc00 Mon Sep 17 00:00:00 2001
From: don-petry <36422719+don-petry@users.noreply.github.com>
Date: Wed, 14 Oct 2026 20:41:37 +0000
Subject: [PATCH 14/14] fix(reviews): pass only the ref token to
 ring_repin_uses in dry-run stub_pinning

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 test/scripts/deploy-standard-workflows/dry-run.bats | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/scripts/deploy-standard-workflows/dry-run.bats b/test/scripts/deploy-standard-workflows/dry-run.bats
index f9d499e6d..fd98722f9 100644
--- a/test/scripts/deploy-standard-workflows/dry-run.bats
+++ b/test/scripts/deploy-standard-workflows/dry-run.bats
@@ -76,7 +76,7 @@ stub_pinning() {  # <ref> → base64 of the auto-rebase template re-pinned to <r
   local body
   body="$(sed -E "s|(auto-rebase-reusable\.yml)@[^[:space:]]+|\1@$1|" \
     "${REPO_ROOT}/standards/workflows/auto-rebase.yml" \
-    | bash -c 'source "$1"; ring_repin_uses "$2" "$3"' _ "$SCRIPT" auto-rebase "$1")"
+    | bash -c 'source "$1"; ring_repin_uses "$2" "$3"' _ "$SCRIPT" auto-rebase "${1%% *}")"
   base64 -w 0 <<<"$body" 2>/dev/null || base64 -b 0 <<<"$body"
 }