diff --git a/.github/workflows/evaluation.yml b/.github/workflows/evaluation.yml
index 35f6fb50..3e205151 100644
--- a/.github/workflows/evaluation.yml
+++ b/.github/workflows/evaluation.yml
@@ -387,7 +387,12 @@ jobs:
             issue_comment)
               # Require an explicit SHA: "/evaluate <7-40 hex>". The issue_comment
               # payload carries no commit id, so a bare /evaluate cannot be bound.
-              REQUESTED="$(printf '%s' "$COMMENT_BODY" | sed -n '1{s/[[:cntrl:]]//g;s#^[[:space:]]*/evaluate[[:space:]]\{1,\}\([0-9a-fA-F]\{7,40\}\)\b.*#\1#p}')"
+              # Parse with a bash regex (portable; avoids sed word-boundary quirks).
+              FIRST_LINE="${COMMENT_BODY%%$'\n'*}"      # first line only
+              FIRST_LINE="${FIRST_LINE//$'\r'/}"        # strip trailing CR
+              if [[ "$FIRST_LINE" =~ ^[[:space:]]*/evaluate[[:space:]]+([0-9a-fA-F]{7,40})([^0-9a-fA-F]|$) ]]; then
+                REQUESTED="${BASH_REMATCH[1]}"
+              fi
               ;;
           esac
 
diff --git a/docs/design/pr-triage-workflows.md b/docs/design/pr-triage-workflows.md
index 76b601da..1e7d7bc3 100644
--- a/docs/design/pr-triage-workflows.md
+++ b/docs/design/pr-triage-workflows.md
@@ -53,11 +53,13 @@ runs the exact commit the maintainer approved:
    worker runs as `github-actions[bot]`, and label events emitted by
    `GITHUB_TOKEN` do **not** start workflows (GitHub's recursion guard), so the
    bot cannot use entry point 3. `workflow_dispatch` is exempt from that guard,
-   so the worker dispatches `evaluation.yml` directly. A dispatched run's
-   `head_sha` is the default branch (not the PR head), so the worker matches the
-   run by `evaluation.yml`'s run name (`Evaluate PR #<n> @ <sha7>`) for
-   idempotency. The gate resolves the worker's short `head_sha` input to that
-   exact commit (it does not re-read the live PR head).
+   so the worker dispatches `evaluation.yml` directly. A dispatched run checks
+   out the default branch by default (`github.sha` is `main`'s tip, **not** the
+   PR head) and its metadata doesn't record the target PR, so the worker matches
+   the run by `evaluation.yml`'s run name (`Evaluate PR #<n> @ <sha7>`) for
+   idempotency. The PR's head travels in the `head_sha` **input**, and the gate
+   resolves that short SHA to the exact commit (it does not re-read the live PR
+   head).
 
 ## State machine (worker)