diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e528cd54..85abca91 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -349,7 +349,7 @@ jobs:
       # minutes (review PR #149, glm-5.2 F2).
       - name: red-first - proof against merge base
         id: rf_run
-        if: ${{ !cancelled() && steps.setup.outcome == 'success' && steps.rf_plan.outcome == 'success' && steps.rf_plan.outputs.count != '0' && steps.rf_plan.outputs.count != '' }}
+        if: ${{ !cancelled() && github.event_name == 'pull_request' && steps.setup.outcome == 'success' && steps.rf_plan.outcome == 'success' && steps.rf_plan.outputs.count != '0' && steps.rf_plan.outputs.count != '' }}
         continue-on-error: true
         timeout-minutes: 25
         env:
diff --git a/docs/diagrams/export-svg.mjs b/docs/diagrams/export-svg.mjs
index c027f1a0..26f81e38 100644
--- a/docs/diagrams/export-svg.mjs
+++ b/docs/diagrams/export-svg.mjs
@@ -14,6 +14,7 @@ import { createRequire } from 'node:module';
 import { readFileSync, writeFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
+import { stripComments } from './strip-comments.mjs';
 
 const { chromium } = createRequire(import.meta.url)('playwright-core');
 const [, , mode, ...args] = process.argv;
@@ -121,7 +122,7 @@ ${Object.keys(T.t).map((k) => `svg [data-node-id] > rect:not(.c-mask).c-${k}{fil
     await browser.close();
   }
   // Drop indentation between tags, but whitespace touching a tspan is text: one space.
-  const out = svg.replace(/<!--[\s\S]*?-->/g, '').replace(/>\s+<(?!\/?tspan\b)/g, '><').replace(/>\s+</g, '> <');
+  const out = stripComments(svg).replace(/>\s+<(?!\/?tspan\b)/g, '><').replace(/>\s+</g, '> <');
   writeFileSync(outSvg, out);
   console.log(`${outSvg}: ${Buffer.byteLength(out)} bytes, <script>: ${(out.match(/<script/g) || []).length}`);
 }
diff --git a/docs/diagrams/export-svg.test.mjs b/docs/diagrams/export-svg.test.mjs
index 349af2f7..2fdd77ba 100644
--- a/docs/diagrams/export-svg.test.mjs
+++ b/docs/diagrams/export-svg.test.mjs
@@ -9,6 +9,7 @@ import { createRequire } from 'node:module';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { stripComments } from './strip-comments.mjs';
 
 const script = fileURLToPath(new URL('./export-svg.mjs', import.meta.url));
 
@@ -103,3 +104,10 @@ test('export opens an HTML file whose path needs URL escaping', { skip }, () =>
     assert.match(readFileSync(out, 'utf8'), /<text[^>]*>Probe<\/text>/);
   });
 });
+
+test('stripComments leaves no comment opener behind', () => {
+  assert.equal(stripComments('<a/><!-- x --><b/>'), '<a/><b/>');
+  for (const s of ['<!<!---->-->', '<!<!---->--', '<!--<!-- a -->', '<<!---->!-- x -->', 'a<!-- never closed']) {
+    assert.ok(!stripComments(s).includes('<!--'), `${s} -> ${stripComments(s)}`);
+  }
+});
diff --git a/docs/diagrams/strip-comments.mjs b/docs/diagrams/strip-comments.mjs
new file mode 100644
index 00000000..544abd6a
--- /dev/null
+++ b/docs/diagrams/strip-comments.mjs
@@ -0,0 +1,9 @@
+// Separate from export-svg.mjs so tests can import it without Chromium or argv.
+// The optional group also removes an unterminated `<!--`; repeating until the
+// string is stable catches openers that a removed comment re-assembled
+// (`<!<!---->-->`), so none survives (CodeQL js/incomplete-multi-character-sanitization).
+export function stripComments(s) {
+  let prev;
+  do { prev = s; s = s.replace(/<!--(?:[\s\S]*?-->)?/g, ''); } while (s !== prev);
+  return s;
+}
diff --git a/scripts/ci/ci-shape.sh b/scripts/ci/ci-shape.sh
index d937057d..cc5b10df 100755
--- a/scripts/ci/ci-shape.sh
+++ b/scripts/ci/ci-shape.sh
@@ -175,6 +175,9 @@ for rf_step in "red-first - plan" "red-first - proof against merge base"; do
     err "job linux: step '$rf_step' lacks RF_BASE_BRANCH: \${{ github.event.pull_request.base.ref }}"
   has "$rf_body" 'refs/heads/$RF_BASE_BRANCH' ||
     err "job linux: step '$rf_step' missing red-first base branch fetch (refs/heads/\$RF_BASE_BRANCH)"
+  # CodeQL actions/cache-poisoning: the static condition must name the event.
+  has "$(grep -E '^        if:' <<< "$rf_body")" "github.event_name == 'pull_request'" ||
+    err "job linux: step '$rf_step' 'if' lacks github.event_name == 'pull_request' (it checks out pull_request.head.sha)"
 done
 # V161-FU-3 / R953-A1: plan step HEAD_SHA fetch stays fatal; BASE_SHA fetch
 # stays non-fatal (|| ) so a stale payload base.sha cannot abort the plan.
diff --git a/scripts/test-ci-shape.sh b/scripts/test-ci-shape.sh
index ad271cb2..073bb0e3 100755
--- a/scripts/test-ci-shape.sh
+++ b/scripts/test-ci-shape.sh
@@ -185,6 +185,9 @@ case_m "ci-shape fails when the red-first base branch fetch is missing" ci \
 case_m "ci-shape fails when only the proof step lacks the base branch fetch" ci \
   '/^      - name: red-first - proof against merge base$/,/^  [a-z]/ { /refs\/heads\/\$RF_BASE_BRANCH/d }' \
   "proof against merge base.*base branch fetch"
+case_m "ci-shape fails when the proof step 'if' drops the pull_request event check" ci \
+  '/^      - name: red-first - proof against merge base$/,/^  [a-z]/ s/github.event_name == .pull_request. && //' \
+  "proof against merge base' 'if' lacks github.event_name"
 case_m "ci-shape fails when only the plan step lacks RF_BASE_BRANCH" ci \
   '/^      - name: red-first - plan$/,/^      - / { /RF_BASE_BRANCH:/d }' \
   "red-first - plan' lacks RF_BASE_BRANCH"