diff --git a/standards/workflows/agent-ingress.yml b/standards/workflows/agent-ingress.yml
index e519c16d7..5da4ef0f9 100644
--- a/standards/workflows/agent-ingress.yml
+++ b/standards/workflows/agent-ingress.yml
@@ -122,13 +122,17 @@ jobs:
           && contains(fromJSON('["submitted","dismissed"]'), github.event.action))
       || github.event_name == 'check_suite'
       || github.event_name == 'workflow_run'
-    # Job-level concurrency (the source stub's workflow-level group), bounded per ADR-0010. PR events
-    # keep their per-PR slot; check_suite / workflow_run share one slot per head SHA (no run_id).
+    # Workflow-level concurrency in the source stub → job-level here, bounded per
+    # ADR-0010: literal role prefix, payload parts only (no run_id), literal bool.
+    # PR events keep their per-PR slot; check_suite / workflow_run use their own
+    # event ids so runs on a shared commit never cancel another PR's review (§4b).
     concurrency:
       group: >-
-        pr-auto-review-ready-check-${{
-          (github.event.pull_request.number && format('pr-{0}', github.event.pull_request.number))
-          || format('sha-{0}', github.event.check_suite.head_sha || github.event.workflow_run.head_sha)
+        pr-auto-review-${{
+        github.event.pull_request.number
+        || github.event.check_suite.id
+        || github.event.workflow_run.id
+        || 'none'
         }}
       cancel-in-progress: true
     permissions:
@@ -141,8 +145,8 @@ jobs:
 
   # ── pr-review ─────────────────────────────────────────────────────────────────
   pr-review:
-    # Subscription filter AND the check_suite-with-no-PR skip, both pure event predicates over the
-    # delivered payload.
+    # Subscription filter AND the source stub's check_suite-with-no-PR skip, both
+    # pure event predicates over the delivered payload.
     if: >-
       (
         (github.event_name == 'pull_request'
@@ -154,9 +158,9 @@ jobs:
         || (github.event_name == 'repository_dispatch' && github.event.action == 'pr-review-mention')
       )
       && (github.event_name != 'check_suite' || github.event.check_suite.pull_requests[0] != null)
-    # Job-level concurrency, bounded per ADR-0010: payload parts only (no inputs.*, no run_id). A sweep
-    # with no PR shares the 'enumerate' slot. The fallback is NOT 'batch', because the pinned reusable
-    # declares pr-review-batch.
+    # Job-level concurrency, bounded per ADR-0010: payload parts only (no inputs.*,
+    # no run_id). A sweep with no PR shares the 'enumerate' slot. The fallback is
+    # NOT 'batch', because the pinned reusable declares pr-review-batch (§4b).
     concurrency:
       group: >-
         pr-review-${{
@@ -198,7 +202,7 @@ jobs:
     if: >-
       github.event_name == 'check_run'
       && github.event.check_run.conclusion == 'failure'
-      && !startsWith(github.event.check_run.name, 'CI Failure Analyst')
+      && !startsWith(github.event.check_run.name, 'ci-failure-analyst')
     concurrency:
       group: "ci-failure-analyst-${{ github.event.check_run.head_sha }}"
       cancel-in-progress: false