diff --git a/.gitea/workflows/CI.yaml b/.gitea/workflows/CI.yaml
index a74bfb5..fa332bc 100644
--- a/.gitea/workflows/CI.yaml
+++ b/.gitea/workflows/CI.yaml
@@ -25,10 +25,38 @@ jobs:
       - name: build CI container
         run: ops/devcontainer/build.sh
 
+  # Debug job: doesn't depend on the flaky failure()/success() resolution at all, only on
+  # `build-docker` (which reliably completes).  Dumps exactly what Gitea computed for
+  # `needs.build-docker.result`, so we can see what build-docker-bootstrap's `if:` should be
+  # seeing, even if build-docker-bootstrap itself stays stuck in "Blocked".
+  debug-context:
+    needs: build-docker
+    if: always()
+    container:
+      image: alpine:3.22
+    steps:
+      - name: dump needs/github context
+        env:
+          NEEDS_JSON: ${{ toJson(needs) }}
+          GITHUB_JSON: ${{ toJson(github) }}
+        run: |
+          echo "=== needs.build-docker.result ==="
+          echo "${{ needs.build-docker.result }}"
+          echo "=== full needs context ==="
+          echo "$NEEDS_JSON"
+          echo "=== event_name / ref ==="
+          echo "${{ github.event_name }} / ${{ github.ref }}"
+          echo "=== full github context ==="
+          echo "$GITHUB_JSON"
+
   # Fallback: full bootstrap build.  This one is quite slow.
   build-docker-bootstrap:
     needs: build-docker
-    if: failure()
+    # NOTE: was `if: failure()`.  That bare status-check function appears to never resolve
+    # (job gets stuck in "Blocked" forever) when its `needs` job has `continue-on-error: true`.
+    # Using the explicit needs.<job>.result comparison instead, to sidestep whatever's broken
+    # in the bare success()/failure() evaluation path.
+    if: needs.build-docker.result == 'failure'
 
     container:
       image: alpine:3.22
@@ -38,6 +66,14 @@ jobs:
         GOPATH: /go-cache-volume
         GOCACHE: /go-cache-volume/build-cache
     steps:
+      - name: debug context
+        env:
+          NEEDS_JSON: ${{ toJson(needs) }}
+        run: |
+          echo "=== running build-docker-bootstrap ==="
+          echo "needs.build-docker.result: ${{ needs.build-docker.result }}"
+          echo "$NEEDS_JSON"
+
       - name: checkout
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -55,7 +91,11 @@ jobs:
 
   release-test:
     needs: build-docker-bootstrap
-    if: "!failure()"
+    # NOTE: was `if: "!failure()"`.  Same rationale as build-docker-bootstrap above: use an
+    # explicit needs.<job>.result comparison instead of the bare failure() status-check function.
+    # This should be true both when build-docker-bootstrap succeeded AND when it was skipped
+    # (i.e. everything except an actual failure), matching the original !failure() intent.
+    if: needs.build-docker-bootstrap.result != 'failure'
     container:
       image: gas
       volumes:
@@ -65,6 +105,14 @@ jobs:
         GOCACHE: /go-cache-volume/build-cache
         GOLANGCI_LINT_CACHE: /go-cache-volume/golangci-lint
     steps:
+      - name: debug context
+        env:
+          NEEDS_JSON: ${{ toJson(needs) }}
+        run: |
+          echo "=== running release-test ==="
+          echo "needs.build-docker-bootstrap.result: ${{ needs.build-docker-bootstrap.result }}"
+          echo "$NEEDS_JSON"
+
       - name: checkout
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}