diff --git a/scripts/deploy-standard-workflows.sh b/scripts/deploy-standard-workflows.sh
index 3daf65b6e..2a6ce6a21 100755
--- a/scripts/deploy-standard-workflows.sh
+++ b/scripts/deploy-standard-workflows.sh
@@ -433,6 +433,12 @@ template_requires_s7635_marker() {
   grep -qE '^[[:space:]]*secrets:[[:space:]]+inherit([[:space:]]|$)' "$1"
 }
 
+# stub_has_inherited_secrets — 0 if the stub content on stdin carries a real
+# `secrets: inherit` YAML line.
+stub_has_inherited_secrets() {
+  grep -qE '^[[:space:]]*secrets:[[:space:]]+inherit([[:space:]]|$)'
+}
+
 # stub_has_s7635_marker — 0 if the stub content on stdin carries the
 # `# NOSONAR(githubactions:S7635)` marker on a real `secrets: inherit` line.
 stub_has_s7635_marker() {
@@ -601,6 +607,70 @@ merge_guarded_surfaces() {
   return 0
 }
 
+# stub_has_stale_stable_header <existing_content> <template> <repo> -> 0 if the stub carries a
+# comment naming its agent's stable channel (`<base>/stable`, `<base>/v<M>-stable`,
+# `<base> stable channel`) that the template no longer carries (#1297). Such a header
+# contradicts a ring pin; the pin alone is compliant, so without this check the sweep
+# would never ship the comment-only header fix to existing ring repos. In ring repos,
+# even a currently stable-pinned stub must migrate its header because the in-place
+# repin will change the pin to ring, leaving the header contradictory.
+stub_has_stale_stable_header() {
+  local existing="$1" template="$2" repo="$3" base re tier
+  base="$(reusable_base_of "$template")"
+  [[ -n "$base" ]] || return 1
+  re="^[[:space:]]*#.*(${base}/(v[0-9]+-)?stable|${base} stable channel)"
+  grep -qE "$re" <<< "$existing" || return 1
+  # A stable-pinned stub's header agrees with its pin, BUT only when the repo is
+  # stable-tier. In ring-managed repos, a stable-pinned stub is itself an anomaly
+  # that the repin will fix; the header must migrate too, so don't exempt in ring.
+  if ring_is_ring_reusable "$base" && [[ -n "$repo" ]]; then
+    tier="$(ring_tier_for_repo "$base" "$repo" 2>/dev/null)" || tier=""
+    # Ring-managed repo with a tier: the stub should be ring-pinned, so the header
+    # is stale regardless of the current pin.
+    if [[ -n "$tier" ]] && [[ "$tier" != "stable" ]]; then
+      # The template may still carry the stable wording; ring renders (ring_repin_uses)
+      # and the header cleanup neutralize it, so the template never exempts a ring repo.
+      return 0  # Flag as stale
+    fi
+  fi
+  ! grep -qE "$re" "$template" || return 1
+  # Non-ring reusable or stable-tier repo: apply the exemption (don't flag if
+  # the stub is stable-pinned, since the header agrees with the pin).
+  ! grep -qE "^[[:space:]]*uses:.*@${base}/(v[0-9]+-)?stable([[:space:]]|\$)" <<< "$existing"
+}
+
+# strip_stale_stable_header <base> [<template>] -> stdin minus the stale stable-channel
+# header. With <template>, the stub's whole leading comment block (everything above the
+# first top-level YAML key) is replaced by the template's canonical, tier-neutral header,
+# so a multiline legacy bullet is never left half-deleted. The body is kept verbatim, so
+# per-repo edits (e.g. workflow_run.workflows) survive and the next sweep sees no stale
+# header (#1297). Without <template>, only the lines naming the stable channel are dropped.
+strip_stale_stable_header() {
+  local base="$1" template="${2:-}"
+  if [[ -n "$template" && -r "$template" ]]; then
+    # Body comment blocks (consecutive comment lines) that name the stable channel are
+    # dropped whole too, so a legacy `# Pinned to the moving ... stable channel` block under
+    # `jobs:` does not survive and keep the detector true forever.
+    awk -v tpl="$template" -v base="$base" -v re="^[[:space:]]*#.*(${base}/(v[0-9]+-)?stable|${base} stable channel)" '
+      BEGIN {
+        while ((getline l < tpl) > 0) { if (l ~ /^[^#[:space:]]/) break; hdr = hdr l "\n" }
+        # The template header may still name the stable channel; render it tier-neutral
+        # (same wording as ring_repin_uses) so cleanup never reinstalls it.
+        gsub(base "/(v[0-9]+-)?stable", base "/<tier>", hdr)
+        gsub(base " stable channel", base "/<tier> channel", hdr)
+      }
+      function flush() { if (!stale) printf "%s", blk; blk = ""; stale = 0 }
+      !body && /^[^#[:space:]]/ { body = 1; printf "%s", hdr }
+      body && /^[[:space:]]*#/ { blk = blk $0 "\n"; if ($0 ~ re) stale = 1; next }
+      body { flush(); print; next }
+      END { if (body) flush() }
+    '
+    return 0
+  fi
+  grep -vE "^[[:space:]]*#.*(${base}/(v[0-9]+-)?stable|${base} stable channel)" || true
+}
+
+
 # is_already_compliant <existing_content> <template> <repo> -> 0 if the deployed
 # stub needs no re-deploy. A stub is compliant only when it is BOTH pin-compliant
 # (is_pin_compliant, below) AND — when its template carries a real `secrets: inherit`
@@ -615,7 +685,8 @@ merge_guarded_surfaces() {
 # rendered at the repo's tier channel (stub_body_matches_template): its callers
 # predate the template and carry per-repo edits, which are drift. So must every stub
 # in a FULL_BODY_COMPARE_REPOS repo (repo-template, #1285) other than a
-# BODY_PRESERVING_WORKFLOWS one, whose per-repo body is never re-synced.
+# BODY_PRESERVING_WORKFLOWS or PRESENT_ONLY_WORKFLOWS one, whose per-repo body is
+# re-pinned in place and never re-synced from the template.
 #
 # A pin-correct stub whose guarded `on:` / `permissions:` / `concurrency:` surface
 # differs from the template is ALSO drift (#1236): the audit flags it
@@ -634,6 +705,7 @@ is_already_compliant() {
      && ! stub_has_s7635_marker <<< "$existing_content"; then
     return 1
   fi
+  stub_has_stale_stable_header "$existing_content" "$template" "$repo" && return 1
   if is_replace_if_present_workflow "$workflow" \
      || { is_full_body_compare_repo "$repo" && ! is_body_preserving_workflow "$workflow"; }; then
     stub_body_matches_template "$existing_content" "$template" "$repo" || return 1
@@ -928,6 +1000,31 @@ deploy_repo() {
       fi
     fi
 
+    # Stale stable-channel header (#1297): migrate by editing the stub's OWN body, never
+    # by redeploying the template (that would reset per-repo edits such as
+    # pr-auto-review's workflow_run.workflows). Full-body-compared stubs are exempt —
+    # their drift is already resolved by a template redeploy.
+    if [[ "$DRY_RUN" != "true" && -n "$existing_sha" ]] \
+       && stub_has_stale_stable_header "$existing_content" "$template" "$repo"; then
+      base="$(reusable_base_of "$template")"
+      if [[ "$repin_source" == "$template" ]] && ! is_replace_if_present_workflow "$workflow" \
+         && ! { is_full_body_compare_repo "$repo" && ! is_body_preserving_workflow "$workflow"; } \
+         && is_pin_compliant "$existing_content" "$template" "$repo" \
+         && ! stub_any_surface_drift "$workflow" "$(< "$template")" "$existing_content" \
+         && { ! template_requires_s7635_marker "$template" || stub_has_inherited_secrets < <(printf '%s\n' "$existing_content"); }; then
+        # Keep the existing body only when its guarded surfaces are compliant and it
+        # still forwards `secrets: inherit` where the template does (the marker
+        # injection below cannot add a missing line); a stub with trigger/permission/
+        # secrets drift falls back to the canonical template.
+        repin_source="$(mktemp)"; _TMPFILES+=("$repin_source")
+        printf '%s\n' "$existing_content" > "$repin_source"
+      fi
+      if [[ "$repin_source" != "$template" ]]; then
+        strip_stale_stable_header "$base" "$template" < "$repin_source" > "$repin_source.stripped"
+        mv "$repin_source.stripped" "$repin_source"
+      fi
+    fi
+
     # When repin_source is a copy of existing_content (meta-repo consumer or body-
     # preserving repin-in-place) and the template requires the S7635 marker but the
     # copy lacks it, inject the marker now. Without this, the deployed stub would
diff --git a/scripts/lib/ring-pins.sh b/scripts/lib/ring-pins.sh
index d4f087ce7..93d2e215b 100644
--- a/scripts/lib/ring-pins.sh
+++ b/scripts/lib/ring-pins.sh
@@ -455,11 +455,22 @@ ring_tag_exists() {
 # is re-pinned alongside `uses:` here. This only re-pins the VALUE of an input the
 # stub already forwards (never adds/forwards a new one), so it never introduces the
 # undeclared-input channel-skew defect (#1052).
+# When <newref> is not a stable channel, comment lines naming this agent's stable
+# channel (`<base>/v<M>-stable`, `<base> stable channel`) are rendered tier-neutral
+# (`<base>/<tier>`), so a header never contradicts the ring pin even while the
+# template still carries the stable wording (#1297).
 ring_repin_uses() {
-  local base="$1" newref="$2" file
+  local base="$1" newref="$2" file neutral=()
   file="$(ring_reusable_file "$base")"
   file="${file//./\\.}"
+  if [[ ! "$newref" =~ stable$ ]]; then
+    neutral=(
+      -e "/^[[:space:]]*#/s#${base}/(v[0-9]+-)?stable#${base}/<tier>#g"
+      -e "/^[[:space:]]*#/s#${base} stable channel#${base}/<tier> channel#g"
+    )
+  fi
   sed -E \
+    ${neutral[@]+"${neutral[@]}"} \
     -e "s#^([[:space:]]*uses:[[:space:]]*combsmith/[^@[:space:]]*/${file})@[^[:space:]]+#\1@${newref}#" \
     -e "s#^([[:space:]]*agent_ref:[[:space:]]*[\"']?)${base}/[^\"'[:space:]]+#\1${newref}#" \
     -e "s#^([[:space:]]*checkout_ref:[[:space:]]*[\"']?)${base}/[^\"'[:space:]]+#\1${newref}#"
diff --git a/standards/workflows/add-to-project.yml b/standards/workflows/add-to-project.yml
index e913e82d6..9ab2e5d0e 100644
--- a/standards/workflows/add-to-project.yml
+++ b/standards/workflows/add-to-project.yml
@@ -7,7 +7,7 @@
 #   • This file is a THIN CALLER STUB. All noise-gate / reconcile logic lives
 #     in the reusable workflow above.
 #   • You MAY change: nothing in normal use. The `uses:` ref and `agent_ref`
-#     are pinned to the `add-to-project/v1-stable` channel and move with it — do
+#     are pinned to the `add-to-project/<tier>` channel and move with it — do
 #     not change them to `@main` or a SHA (see ci-standards.md → Reusable
 #     workflow versioning).
 #   • You MUST NOT change: trigger events, the concurrency group, or the
diff --git a/standards/workflows/idea-enhancer.yml b/standards/workflows/idea-enhancer.yml
index ea5088d7b..d703d495f 100644
--- a/standards/workflows/idea-enhancer.yml
+++ b/standards/workflows/idea-enhancer.yml
@@ -7,7 +7,7 @@
 #   • This file is a THIN CALLER STUB. All enhancement-dispatch logic (including
 #     the Ideas-category / non-bot guard) lives in the reusable above.
 #   • You MUST NOT change: the `uses:` ref — it is pinned to the
-#     `idea-enhancer/v1-stable` channel, a moving tag advanced centrally. Never
+#     `idea-enhancer/<tier>` channel, a moving tag advanced centrally. Never
 #     repoint it to `@main`, a SHA, or a frozen `@vX`. Do not change the trigger
 #     events or the `secrets:` block.
 #   • You MAY change: the cron schedule if the weekly cadence doesn't suit.
diff --git a/standards/workflows/idea-triage.yml b/standards/workflows/idea-triage.yml
index 40c593fd2..ce1414f0e 100644
--- a/standards/workflows/idea-triage.yml
+++ b/standards/workflows/idea-triage.yml
@@ -7,7 +7,7 @@
 #   • This file is a THIN CALLER STUB. All triage-dispatch logic lives in the
 #     reusable above.
 #   • You MUST NOT change: the `uses:` ref — it is pinned to the
-#     `idea-triage/v1-stable` channel, a moving tag advanced centrally. Never
+#     `idea-triage/<tier>` channel, a moving tag advanced centrally. Never
 #     repoint it to `@main`, a SHA, or a frozen `@vX`. Do not change the
 #     `secrets:` block.
 #   • You MAY change: the cron schedule if the weekly cadence doesn't suit.
diff --git a/standards/workflows/initiative-planner.yml b/standards/workflows/initiative-planner.yml
index 277dd8834..f12512add 100644
--- a/standards/workflows/initiative-planner.yml
+++ b/standards/workflows/initiative-planner.yml
@@ -8,7 +8,7 @@
 #     `idea:approved` gate, the trusted-actor check, and the cross-repo dispatch
 #     to the central BMAD Scrum Master planner) lives in the reusable above.
 #   • You MUST NOT change: the `uses:` ref — it is pinned to the
-#     `initiative-planner/v1-stable` channel, a moving tag advanced centrally.
+#     `initiative-planner/<tier>` channel, a moving tag advanced centrally.
 #     Never repoint it to `@main`, a SHA, or a frozen `@vX` (see
 #     ci-standards.md → Reusable workflow versioning). Also do not change the
 #     trigger events or the `secrets:` block.
diff --git a/standards/workflows/persona-mention.yml b/standards/workflows/persona-mention.yml
index bd88a0402..d82903c4a 100644
--- a/standards/workflows/persona-mention.yml
+++ b/standards/workflows/persona-mention.yml
@@ -8,7 +8,7 @@
 #     workflow above, and every per-persona decision lives in that persona's
 #     manifest — not here and not in the reusable.
 #   • You MUST NOT change: the `uses:` ref — it is pinned to the
-#     `persona-mention/v1-stable` channel, a moving tag advanced centrally.
+#     `persona-mention/<tier>` channel, a moving tag advanced centrally.
 #     Never repoint it to `@main`, a SHA, or a frozen `@vX.Y.Z` (see
 #     ci-standards.md → Reusable workflow versioning). Also do not change the
 #     trigger events or the job-level `permissions:` block — reusable workflows
diff --git a/standards/workflows/pr-auto-review.yml b/standards/workflows/pr-auto-review.yml
index 50b707f9b..f03ccecd9 100644
--- a/standards/workflows/pr-auto-review.yml
+++ b/standards/workflows/pr-auto-review.yml
@@ -8,7 +8,7 @@
 #     reusable workflow above.
 #   • You MAY change: the workflow name(s) in `workflow_run.workflows` to match
 #     your repository's CI workflow name(s).
-#   • You MUST NOT change: the `@pr-auto-review/v1-stable` channel in the `uses:`
+#   • You MUST NOT change: the `@pr-auto-review/<tier>` channel in the `uses:`
 #     line — this reusable is on the org-wide moving-channel model (rollout and
 #     rollback are a single central tag move; a frozen `@vN`/`@<sha>` pin is
 #     rejected by the compliance audit). Nor the trigger event types or the
diff --git a/standards/workflows/pr-review.yml b/standards/workflows/pr-review.yml
index 3ebcf5b61..d88f57295 100644
--- a/standards/workflows/pr-review.yml
+++ b/standards/workflows/pr-review.yml
@@ -9,7 +9,7 @@
 #     above, including concurrency (per PR + head SHA, never cancelling an
 #     in-flight review), the check_suite-without-a-PR skip, and reading
 #     `client_payload.pr_url` from repository_dispatch.
-#   • You MUST NOT change: the `@pr-review/v1-stable` channel in the `uses:`
+#   • You MUST NOT change: the `@pr-review/<tier>` channel in the `uses:`
 #     line or the matching `agent_ref` — both are re-pinned in lockstep to this
 #     repo's canary-ring tier by the standards sweep. Nor the workflow `name:`,
 #     the job id `review` (check names depend on both), the trigger event types,
diff --git a/test/scripts/deploy-standard-workflows/dry-run.bats b/test/scripts/deploy-standard-workflows/dry-run.bats
index f5b226854..fd98722f9 100644
--- a/test/scripts/deploy-standard-workflows/dry-run.bats
+++ b/test/scripts/deploy-standard-workflows/dry-run.bats
@@ -75,7 +75,8 @@ stub_pinning() {  # <ref> → base64 of the auto-rebase template re-pinned to <r
   # and the surface-drift check (#1236) stays clean.
   local body
   body="$(sed -E "s|(auto-rebase-reusable\.yml)@[^[:space:]]+|\1@$1|" \
-    "${REPO_ROOT}/standards/workflows/auto-rebase.yml")"
+    "${REPO_ROOT}/standards/workflows/auto-rebase.yml" \
+    | bash -c 'source "$1"; ring_repin_uses "$2" "$3"' _ "$SCRIPT" auto-rebase "${1%% *}")"
   base64 -w 0 <<<"$body" 2>/dev/null || base64 -b 0 <<<"$body"
 }
 
diff --git a/test/scripts/deploy-standard-workflows/emit-vform.bats b/test/scripts/deploy-standard-workflows/emit-vform.bats
index 191bc29f4..9555bf187 100644
--- a/test/scripts/deploy-standard-workflows/emit-vform.bats
+++ b/test/scripts/deploy-standard-workflows/emit-vform.bats
@@ -84,7 +84,8 @@ stub_pinning() {  # <ref> → base64 of the auto-rebase template re-pinned to <r
   # concurrency: surfaces match and the surface-drift check (#1236) stays clean.
   local body
   body="$(sed -E "s|(auto-rebase-reusable\.yml)@[^[:space:]]+|\1@$1|" \
-    "${REPO_ROOT}/standards/workflows/auto-rebase.yml")"
+    "${REPO_ROOT}/standards/workflows/auto-rebase.yml" \
+    | bash -c 'source "$1"; ring_repin_uses "$2" "$3"' _ "$SCRIPT" auto-rebase "$1")"
   base64 -w 0 <<<"$body" 2>/dev/null || base64 -b 0 <<<"$body"
 }
 
@@ -112,7 +113,8 @@ devlead_stub_pinning_with_marker() {  # <ref> → base64 of the dev-lead templat
   local body
   body="$(sed -E -e "s|(dev-lead-reusable\.yml)@[^[:space:]]+|\1@$1|" \
     -e "s|^([[:space:]]*agent_ref:[[:space:]]*).*|\1$1|" \
-    "${REPO_ROOT}/standards/workflows/dev-lead.yml")"
+    "${REPO_ROOT}/standards/workflows/dev-lead.yml" \
+    | bash -c 'source "$1"; ring_repin_uses "$2" "$3"' _ "$SCRIPT" dev-lead "$1")"
   base64 -w 0 <<<"$body" 2>/dev/null || base64 -b 0 <<<"$body"
 }
 
diff --git a/test/scripts/deploy-standard-workflows/pr-review-replace-if-present.bats b/test/scripts/deploy-standard-workflows/pr-review-replace-if-present.bats
index f01d8034b..a77810d73 100644
--- a/test/scripts/deploy-standard-workflows/pr-review-replace-if-present.bats
+++ b/test/scripts/deploy-standard-workflows/pr-review-replace-if-present.bats
@@ -63,7 +63,8 @@ STUB
 # The template rendered at <channel> — what a correctly deployed caller looks like:
 # only the two pin lines move; the header prose keeps the template's channel.
 rendered_at() {  # <channel>
-  sed -E "/^[[:space:]]*(uses|agent_ref):/s#pr-review/v1-stable#$1#" "$TEMPLATE"
+  sed -E "/^[[:space:]]*(uses|agent_ref):/s#pr-review/v1-stable#$1#" "$TEMPLATE" \
+    | bash -c 'source "$1"; ring_repin_uses pr-review "$2"' _ "$SCRIPT" "$1"
 }
 
 # The legacy fleet caller shape (TalkTerm-like): bare pr-review/stable pin, an
diff --git a/test/scripts/deploy-standard-workflows/repo-template-full-body.bats b/test/scripts/deploy-standard-workflows/repo-template-full-body.bats
index bafe2e195..e9905b6ba 100644
--- a/test/scripts/deploy-standard-workflows/repo-template-full-body.bats
+++ b/test/scripts/deploy-standard-workflows/repo-template-full-body.bats
@@ -67,7 +67,8 @@ STUB
 
 # The template rendered at <channel> — only the reusable pin moves.
 rendered_at() {  # <channel>
-  sed -E "/^[[:space:]]*uses:/s#dependabot-rebase/v2-stable#$1#" "$TEMPLATE"
+  sed -E "/^[[:space:]]*uses:/s#dependabot-rebase/v2-stable#$1#" "$TEMPLATE" \
+    | bash -c 'source "$1"; ring_repin_uses dependabot-rebase "$2"' _ "$SCRIPT" "$1"
 }
 
 # The template at <channel> with a stale header comment — the #1075 shape: the
diff --git a/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats b/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats
new file mode 100644
index 000000000..f16f06df5
--- /dev/null
+++ b/test/scripts/deploy-standard-workflows/stub-header-tier-neutral.bats
@@ -0,0 +1,314 @@
+#!/usr/bin/env bats
+# Issue #1297 — a synced stub's header never contradicts its own `uses:` pin.
+#
+# The sweep re-pins a ring-managed stub's `uses:` / `agent_ref:` / `checkout_ref:`
+# lines to the repo's ring channel (ring_repin_uses) but deploys the comments
+# verbatim. A template header naming `<agent>/v<N>-stable` therefore sits above a
+# `@<agent>/v<N>-ring1` pin in every ring repo, review bots flag the mismatch, and
+# agent passes "fix" it in the consumer — drifting the stub from the template.
+# The headers are tier-neutral instead, so:
+#   - no ring-managed template, rendered at a ring channel, still names the
+#     agent's stable channel anywhere;
+#   - a correctly swept ring-1 stub is still compliant (stub_body_matches_template).
+
+setup() {
+  TT_TMP="$(mktemp -d "$BATS_TEST_TMPDIR/hdr.XXXXXX")"
+  REPO_ROOT="$(cd -- "${BATS_TEST_DIRNAME}/../../.." && pwd)"
+  SCRIPT="${REPO_ROOT}/scripts/deploy-standard-workflows.sh"
+}
+
+teardown() { rm -rf "$TT_TMP"; }
+
+# Fake gh: serves v1 channel tags for every agent (matching-refs); nothing else.
+install_gh_stub() {
+  local bin="${TT_TMP}/bin"
+  mkdir -p "$bin"
+  cat > "$bin/gh" <<'STUB'
+#!/usr/bin/env bash
+if [ "${1:-}" = "api" ]; then
+  case "$2" in
+    *matching-refs/tags/*)
+      agent="${2##*matching-refs/tags/}"; agent="${agent%%/*}"
+      for c in stable next ring0 ring1; do echo "refs/tags/${agent}/v1-${c}"; done
+      exit 0 ;;
+  esac
+fi
+exit 0
+STUB
+  chmod +x "$bin/gh"
+  PATH="${bin}:${PATH}"; export PATH
+}
+
+# ring_rendered_templates — for every ring-managed channel-pinned template, print
+# "<template>\t<base>\t<ring1-ref>": the ring1 ref keeps the template's own major.
+ring_rendered_templates() {
+  bash -c '
+    source "$1"
+    for t in "$2"/standards/workflows/*.yml; do
+      base="$(reusable_base_of "$t")"
+      [ -n "$base" ] && ring_is_ring_reusable "$base" || continue
+      ref="$(reusable_uses_of "$t")"; ref="${ref##*@}"
+      [[ "$ref" =~ ^${base}/v([0-9]+)-stable$ ]] || continue
+      printf "%s\t%s\t%s\n" "$t" "$base" "${base}/v${BASH_REMATCH[1]}-ring1"
+    done
+  ' _ "$SCRIPT" "$REPO_ROOT"
+}
+
+@test "fixture: the channel-pinned templates are enumerated" {
+  run ring_rendered_templates
+  [ "$status" -eq 0 ]
+  local n
+  n="$(grep -c . <<< "$output")"
+  [ "$n" -ge 10 ]
+  grep -qF 'persona-mention.yml' <<< "$output"
+  grep -qF 'pr-review.yml' <<< "$output"
+}
+
+@test "every ring-managed template, rendered at ring1, names no stable channel for its agent" {
+  local rows t base ref rendered bad=""
+  rows="$(ring_rendered_templates)"
+  while IFS=$'\t' read -r t base ref; do
+    rendered="$(bash -c 'source "$1"; ring_repin_uses "$2" "$3" < "$4"' _ "$SCRIPT" "$base" "$ref" "$t")"
+    # The pin itself moved…
+    grep -qF "@${ref}" <<< "$rendered" || bad+="${t##*/}: pin not re-pinned"$'\n'
+    # …and nothing else in the stub still names the agent's stable channel.
+    if grep -nE "${base}/(v[0-9]+-)?stable|${base} stable channel" <<< "$rendered" >"$TT_TMP/hits"; then
+      bad+="${t##*/}: $(tr '\n' ' ' < "$TT_TMP/hits")"$'\n'
+    fi
+  done <<< "$rows"
+  if [ -n "$bad" ]; then printf '%s' "$bad"; return 1; fi
+}
+
+@test "sweep: every ring-managed template's existing stubs with stale headers are flagged as non-compliant (not skipped)" {
+  install_gh_stub
+  local rows t base ref rendered old bad=""
+  rows="$(ring_rendered_templates)"
+  while IFS=$'\t' read -r t base ref; do
+    rendered="$(bash -c 'source "$1"; ring_repin_uses "$2" "$3" < "$4"' _ "$SCRIPT" "$base" "$ref" "$t")"
+    # Simulate an existing ring-1 stub that still carries the old stable-channel header
+    old="$(printf '# pinned to the \`%s/v1-stable\` channel\n%s\n' "$base" "$rendered")"
+    # Verify it is NOT compliant (would be processed, not skipped, by the sweep)
+    run bash -c 'source "$1"; is_already_compliant "$2" "$3" combsmith/test-repo' _ "$SCRIPT" "$old" "$t"
+    [ "$status" -eq 1 ] || bad+="${t##*/}: stale header not flagged as non-compliant"$'\n'
+  done <<< "$rows"
+  if [ -n "$bad" ]; then printf '%s' "$bad"; return 1; fi
+}
+
+@test "ring-1 repo: a correctly swept persona-mention stub is compliant and its header agrees with its pin" {
+  install_gh_stub
+  local t="${REPO_ROOT}/standards/workflows/persona-mention.yml" swept
+  swept="$(bash -c 'source "$1"; ring_repin_uses persona-mention persona-mention/v1-ring1 < "$2"' _ "$SCRIPT" "$t")"
+  grep -qE '^ +uses:.*persona-mention-reusable\.yml@persona-mention/v1-ring1' <<< "$swept"
+  run grep -E 'persona-mention/(v[0-9]+-)?stable' <<< "$swept"
+  [ "$status" -eq 1 ]
+  run bash -c 'source "$1"; stub_body_matches_template "$2" "$3" combsmith/TalkTerm' _ "$SCRIPT" "$swept" "$t"
+  [ "$status" -eq 0 ]
+  # Still drift: the same stub left on the stable pin in a ring-1 repo.
+  run bash -c 'source "$1"; stub_body_matches_template "$(cat "$2")" "$2" combsmith/TalkTerm' _ "$SCRIPT" "$t"
+  [ "$status" -eq 1 ]
+}
+
+@test "ring-1 repo: a correctly swept pr-review stub is compliant and its header agrees with its pin" {
+  install_gh_stub
+  local t="${REPO_ROOT}/standards/workflows/pr-review.yml" swept
+  swept="$(bash -c 'source "$1"; ring_repin_uses pr-review pr-review/v1-ring1 < "$2"' _ "$SCRIPT" "$t")"
+  grep -qE '^ +uses:.*@pr-review/v1-ring1' <<< "$swept"
+  grep -qE '^ +agent_ref: *pr-review/v1-ring1' <<< "$swept"
+  run grep -E 'pr-review/(v[0-9]+-)?stable' <<< "$swept"
+  [ "$status" -eq 1 ]
+  run bash -c 'source "$1"; stub_body_matches_template "$2" "$3" combsmith/bmad-bgreat-suite' _ "$SCRIPT" "$swept" "$t"
+  [ "$status" -eq 0 ]
+}
+
+@test "ring-1 repo: a correctly pinned stub still carrying the old stable-channel header is NOT compliant (is_already_compliant)" {
+  install_gh_stub
+  local t="${REPO_ROOT}/standards/workflows/persona-mention.yml" swept old
+  swept="$(bash -c 'source "$1"; ring_repin_uses persona-mention persona-mention/v1-ring1 < "$2"' _ "$SCRIPT" "$t")"
+  old="$(printf '# pinned to the `persona-mention/v1-stable` channel\n%s\n' "$swept")"
+  run bash -c 'source "$1"; is_already_compliant "$2" "$3" combsmith/TalkTerm' _ "$SCRIPT" "$old" "$t"
+  [ "$status" -eq 1 ]
+  run bash -c 'source "$1"; is_already_compliant "$2" "$3" combsmith/TalkTerm' _ "$SCRIPT" "$swept" "$t"
+  [ "$status" -eq 0 ]
+}
+
+@test "stable-pinned stub with a stable-channel header is NOT drift (tier-restricted)" {
+  install_gh_stub
+  local t="${REPO_ROOT}/standards/workflows/persona-mention.yml" stable old
+  stable="$(cat "$t")"
+  old="$(printf '# pinned to the `persona-mention/v1-stable` channel\n%s\n' "$stable")"
+  # Pass a stable-tier repo so the exemption applies
+  run bash -c 'source "$1"; stub_has_stale_stable_header "$2" "$3" combsmith/stable-repo' _ "$SCRIPT" "$old" "$t"
+  [ "$status" -eq 1 ]
+}
+
+@test "strip_stale_stable_header drops only the stale comment lines and keeps per-repo edits" {
+  install_gh_stub
+  local body
+  body="$(printf '# pinned to the `pr-auto-review/v1-stable` channel\non:\n  workflow_run:\n    workflows: ["Build"]\n')"
+  run bash -c 'source "$1"; strip_stale_stable_header pr-auto-review <<< "$2"' _ "$SCRIPT" "$body"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *'workflows: ["Build"]'* ]]
+  [[ "$output" != *stable* ]]
+}
+
+@test "sweep: ring-pinned stub with stale header is flagged as drift and header is stripped" {
+  install_gh_stub
+  local t="${REPO_ROOT}/standards/workflows/persona-mention.yml" swept old
+  swept="$(bash -c 'source "$1"; ring_repin_uses persona-mention persona-mention/v1-ring1 < "$2"' _ "$SCRIPT" "$t")"
+  old="$(printf '# pinned to the \`persona-mention/v1-stable\` channel\n%s\n' "$swept")"
+  # Verify the stub with stale header is NOT compliant
+  run bash -c 'source "$1"; is_already_compliant "$2" "$3" combsmith/TalkTerm' _ "$SCRIPT" "$old" "$t"
+  [ "$status" -eq 1 ]
+  # Verify that stripping the header makes it compliant
+  local stripped
+  stripped="$(bash -c 'source "$1"; strip_stale_stable_header persona-mention <<< "$2"' _ "$SCRIPT" "$old")"
+  run bash -c 'source "$1"; is_already_compliant "$2" "$3" combsmith/TalkTerm' _ "$SCRIPT" "$stripped" "$t"
+  [ "$status" -eq 0 ]
+}
+
+@test "strip_stale_stable_header with a template replaces the whole legacy header block" {
+  install_gh_stub
+  local t="${REPO_ROOT}/standards/workflows/persona-mention.yml" old out
+  old="$(printf '# legacy header\n#   • You MUST NOT change: the `uses:` ref — it is pinned to the\n#     `persona-mention/v1-stable` channel, a moving tag.\n#     Never repoint it.\n%s\n' "$(sed -n '/^[^#[:space:]]/,$p' "$t")")"
+  out="$(bash -c 'source "$1"; strip_stale_stable_header persona-mention "$3" <<< "$2"' _ "$SCRIPT" "$old" "$t")"
+  # The template header, rendered tier-neutral (it may still name the stable channel).
+  [ "$(sed -n '/^[^#[:space:]]/q;p' <<< "$out")" = "$(sed -n '/^[^#[:space:]]/q;p' "$t" | bash -c 'source "$1"; ring_repin_uses persona-mention persona-mention/v1-ring1' _ "$SCRIPT")" ]
+  [[ "$out" != *legacy* ]]
+}
+
+@test "strip_stale_stable_header with a template also drops a stale comment block under jobs" {
+  install_gh_stub
+  local t="${REPO_ROOT}/standards/workflows/dev-lead.yml" old out
+  old="$(printf '# legacy header dev-lead/v1-stable\nname: x\njobs:\n  dev-lead:\n    # Pinned to the moving dev-lead stable channel tag, not @main,\n    # so a broken change cannot gate its own fix.\n    uses: foo\n    # keep me\n    with: 1\n')"
+  out="$(bash -c 'source "$1"; strip_stale_stable_header dev-lead "$3" <<< "$2"' _ "$SCRIPT" "$old" "$t")"
+  [[ "$out" != *"stable channel"* ]]
+  [[ "$out" != *"cannot gate"* ]]
+  [[ "$out" == *"# keep me"* ]]
+}
+
+@test "ring repin renders a template's stable-channel comments tier-neutral; cleanup never reinstalls them" {
+  install_gh_stub
+  local t="${REPO_ROOT}/standards/workflows/persona-mention.yml" old out
+  old="$(printf '# legacy persona-mention/v1-stable\n%s\n' "$(sed -n '/^[^#[:space:]]/,$p' "$t")")"
+  out="$(bash -c 'source "$1"; strip_stale_stable_header persona-mention "$3" <<< "$2"' _ "$SCRIPT" "$old" "$t")"
+  run grep -E '^[[:space:]]*#.*(persona-mention/(v[0-9]+-)?stable|persona-mention stable channel)' <<< "$out"
+  [ "$status" -eq 1 ]
+  # Stable repin keeps the stable wording.
+  run bash -c 'source "$1"; ring_repin_uses persona-mention persona-mention/v1-stable < "$2"' _ "$SCRIPT" "$t"
+  grep -qF 'persona-mention/v1-stable' <<< "$output"
+}
+
+@test "deploy_repo: stale header + missing S7635 marker + surface drift redeploys the template, not the drifted body" {
+  local t="${REPO_ROOT}/standards/workflows/persona-mention.yml" swept old
+  swept="$(bash -c 'source "$1"; ring_repin_uses persona-mention persona-mention/v1-ring1 < "$2"' _ "$SCRIPT" "$t")"
+  # stale header, marker stripped, one guarded trigger dropped
+  old="$(printf '# pinned to the `persona-mention/v1-stable` channel\n%s\n' "$swept" \
+    | sed -E 's/[[:space:]]+# NOSONAR\(githubactions:S7635\).*$//' | sed '/^  discussion_comment:$/,+1d')"
+  bash -c 'source "$1"; set +e; stub_any_surface_drift persona-mention.yml "$(< "$2")" "$3"' _ "$SCRIPT" "$t" "$old" \
+    || skip "fixture does not produce surface drift for this template"
+  local bin="${TT_TMP}/bin"; mkdir -p "$bin"
+  cat > "$bin/gh" <<'STUB'
+#!/usr/bin/env bash
+if [ "${1:-}" = "api" ]; then
+  case "$2" in
+    *matching-refs/tags/*)
+      agent="${2##*matching-refs/tags/}"; agent="${agent%%/*}"
+      for c in stable next ring0 ring1; do echo "refs/tags/${agent}/v1-${c}"; done
+      exit 0 ;;
+    *contents/.github/workflows/agent-ingress.yml) echo "gh: Not Found (HTTP 404)" >&2; exit 1 ;;
+    *contents*) printf '{"sha":"abc123","content":"%s"}' "$GH_CONTENT_B64"; exit 0 ;;
+  esac
+fi
+exit 0
+STUB
+  chmod +x "$bin/gh"; PATH="${bin}:${PATH}"; export PATH
+  GH_CONTENT_B64="$(printf '%s\n' "$old" | base64 -w 0)"; export GH_CONTENT_B64
+  export OUT="${TT_TMP}/out"
+  run env GH_TOKEN=x bash -c '
+    source "$1"; set +e
+    ORG=combsmith; DRY_RUN=false; FORCE=false; _OVERALL_FAILED=0
+    WORKFLOWS=(persona-mention.yml)
+    sd_deploy_files_via_pr() { shift 5; mkdir -p "$OUT"; while [ "$#" -ge 2 ]; do cp "$2" "$OUT/${1##*/}"; shift 2; done; echo "OPENED #1"; }
+    deploy_repo TalkTerm
+    [ -f "$OUT/persona-mention.yml" ] || exit 3
+    bash -c "source \"\$1\"; ! stub_any_surface_drift persona-mention.yml \"\$(< \"\$2\")\" \"\$(< \"\$3\")\"" _ "$1" "$2" "$OUT/persona-mention.yml"
+  ' _ "$SCRIPT" "$t"
+  [ "$status" -eq 0 ]
+}
+
+@test "deploy_repo: stale header + missing 'secrets: inherit' redeploys the template, not the incomplete body" {
+  local t="${REPO_ROOT}/standards/workflows/persona-mention.yml" swept old
+  swept="$(bash -c 'source "$1"; ring_repin_uses persona-mention persona-mention/v1-ring1 < "$2"' _ "$SCRIPT" "$t")"
+  old="$(printf '# pinned to the `persona-mention/v1-stable` channel\n%s\n' "$swept" \
+    | sed -E '/^[[:space:]]*secrets:[[:space:]]+inherit/d')"
+  ! grep -qE '^[[:space:]]*secrets:[[:space:]]+inherit' <<< "$old"
+  local bin="${TT_TMP}/bin"; mkdir -p "$bin"
+  cat > "$bin/gh" <<'STUB'
+#!/usr/bin/env bash
+if [ "${1:-}" = "api" ]; then
+  case "$2" in
+    *matching-refs/tags/*)
+      agent="${2##*matching-refs/tags/}"; agent="${agent%%/*}"
+      for c in stable next ring0 ring1; do echo "refs/tags/${agent}/v1-${c}"; done
+      exit 0 ;;
+    *contents/.github/workflows/agent-ingress.yml) echo "gh: Not Found (HTTP 404)" >&2; exit 1 ;;
+    *contents*) printf '{"sha":"abc123","content":"%s"}' "$GH_CONTENT_B64"; exit 0 ;;
+  esac
+fi
+exit 0
+STUB
+  chmod +x "$bin/gh"; PATH="${bin}:${PATH}"; export PATH
+  GH_CONTENT_B64="$(printf '%s\n' "$old" | base64 -w 0)"; export GH_CONTENT_B64
+  export OUT="${TT_TMP}/out"
+  run env GH_TOKEN=x bash -c '
+    source "$1"; set +e
+    ORG=combsmith; DRY_RUN=false; FORCE=false; _OVERALL_FAILED=0
+    WORKFLOWS=(persona-mention.yml)
+    sd_deploy_files_via_pr() { shift 5; mkdir -p "$OUT"; while [ "$#" -ge 2 ]; do cp "$2" "$OUT/${1##*/}"; shift 2; done; echo "OPENED #1"; }
+    deploy_repo TalkTerm
+    [ -f "$OUT/persona-mention.yml" ] || exit 3
+    grep -qE "^[[:space:]]*secrets:[[:space:]]+inherit" "$OUT/persona-mention.yml"
+  ' _ "$SCRIPT" "$t"
+  [ "$status" -eq 0 ]
+}
+
+@test "deploy_repo: stale header on a compliant stub keeps the repo-specific body and renders a tier-neutral header" {
+  local t="${REPO_ROOT}/standards/workflows/pr-auto-review.yml" swept old
+  swept="$(bash -c 'source "$1"; ring_repin_uses pr-auto-review pr-auto-review/v1-ring1 < "$2"' _ "$SCRIPT" "$t")"
+  # stale stable-channel header + repo-specific workflow_run.workflows edit
+  old="$(printf '# pinned to the `pr-auto-review/v1-stable` channel\n%s\n' "$swept" \
+    | sed 's/workflows: \["CI"\]/workflows: ["Custom CI Marker"]/')"
+  grep -qF 'Custom CI Marker' <<< "$old"
+  local bin="${TT_TMP}/bin"; mkdir -p "$bin"
+  cat > "$bin/gh" <<'STUB'
+#!/usr/bin/env bash
+if [ "${1:-}" = "api" ]; then
+  case "$2" in
+    *matching-refs/tags/*)
+      agent="${2##*matching-refs/tags/}"; agent="${agent%%/*}"
+      for c in stable next ring0 ring1; do echo "refs/tags/${agent}/v1-${c}"; done
+      exit 0 ;;
+    *contents/.github/workflows/agent-ingress.yml) echo "gh: Not Found (HTTP 404)" >&2; exit 1 ;;
+    *contents*) printf '{"sha":"abc123","content":"%s"}' "$GH_CONTENT_B64"; exit 0 ;;
+  esac
+fi
+exit 0
+STUB
+  chmod +x "$bin/gh"; PATH="${bin}:${PATH}"; export PATH
+  GH_CONTENT_B64="$(printf '%s\n' "$old" | base64 -w 0)"; export GH_CONTENT_B64
+  export OUT="${TT_TMP}/out"
+  run env GH_TOKEN=x bash -c '
+    source "$1"; set +e
+    ORG=combsmith; DRY_RUN=false; FORCE=false; _OVERALL_FAILED=0
+    WORKFLOWS=(pr-auto-review.yml)
+    sd_deploy_files_via_pr() { shift 5; mkdir -p "$OUT"; while [ "$#" -ge 2 ]; do cp "$2" "$OUT/${1##*/}"; shift 2; done; echo "OPENED #1"; }
+    deploy_repo TalkTerm
+    [ -f "$OUT/pr-auto-review.yml" ] || exit 3
+  ' _ "$SCRIPT" "$t"
+  [ "$status" -eq 0 ]
+  # The customized body survived (no fallback to the template) ...
+  grep -qF 'Custom CI Marker' "$OUT/pr-auto-review.yml"
+  # ... and the stale stable-channel header is gone.
+  run grep -E '^[[:space:]]*#.*(pr-auto-review/(v[0-9]+-)?stable|pr-auto-review stable channel)' "$OUT/pr-auto-review.yml"
+  [ "$status" -eq 1 ]
+}