diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 6d8b0a2..e8548d4 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -16,20 +16,22 @@ jobs:
       - uses: dorny/paths-filter@v4
         id: filter
         with:
+          # 'every' + negation-only globs. dorny combines a filter's patterns with
+          # Array.some by default, and picomatch compiles '!.gitea/**' as "matches any
+          # path NOT under .gitea" — so under 'some' that single line matched EVERY
+          # non-.gitea file (incl. .planning/** and *.md), flipping code=true for
+          # doc-only PRs and silently running the heavy api/harness jobs (regression
+          # introduced by quick task 260613-dmw; the old positive allowlist also never
+          # actually excluded .gitea because '**/*.yml' already matched workflow files).
+          # With predicate-quantifier 'every' a changed file counts as "code" ONLY if it
+          # matches ALL patterns — i.e. it is outside .gitea/, outside .planning/, and is
+          # not Markdown. Verified against representative file sets in quick task 260613-fp9.
+          predicate-quantifier: 'every'
           filters: |
             code:
-              - '**/*.ts'
-              - '**/*.tsx'
-              - '**/*.js'
-              - '**/*.json'
-              - '**/*.yaml'
-              - '**/*.yml'
-              - 'apps/**'
-              - 'packages/**'
-              - 'pnpm-lock.yaml'
-              - 'Dockerfile'
-              - 'docker-compose*.yml'
               - '!.gitea/**'
+              - '!.planning/**'
+              - '!**/*.md'
 
   fast-checks:
     runs-on: ubuntu-latest