diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 77a95c5..e13bf60 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -20,35 +20,32 @@ jobs:
   test:
     runs-on: ubuntu-latest
     timeout-minutes: 20
+    outputs:
+      ci_test_ok: ${{ steps.mark_test.outputs.ok }}
     steps:
       - uses: actions/checkout@v4
 
+      # Без cache: npm — act_runner v1.0.8 отменяет шаг на распаковке ~546MB (exit -1).
       - uses: actions/setup-node@v4
         with:
           node-version: '20'
-          cache: 'npm'
 
       - run: npm ci
       - run: npm run lint
       - run: npm run build
 
       - name: Mark test complete
+        id: mark_test
         if: success()
-        run: mkdir -p "${RUNNER_TEMP}/ci-gate" && touch "${RUNNER_TEMP}/ci-gate/test"
-
-      - name: Test completion gate
-        if: always()
-        run: |
-          if [ ! -f "${RUNNER_TEMP}/ci-gate/test" ]; then
-            echo "::error::Test job incomplete (step cancelled — act_runner bug?). Re-run CI."
-            exit 1
-          fi
+        run: echo "ok=1" >> "$GITHUB_OUTPUT"
 
   push-image:
     needs: test
-    if: github.event_name == 'push'
+    if: github.event_name == 'push' && needs.test.outputs.ci_test_ok == '1'
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    outputs:
+      ci_push_ok: ${{ steps.mark_push.outputs.ok }}
     steps:
       - uses: actions/checkout@v4
 
@@ -97,13 +94,34 @@ jobs:
         run: bash scripts/run-registry-prune.sh
 
       - name: Mark push complete
+        id: mark_push
         if: success()
-        run: mkdir -p "${RUNNER_TEMP}/ci-gate" && touch "${RUNNER_TEMP}/ci-gate/push"
+        run: echo "ok=1" >> "$GITHUB_OUTPUT"
 
-      - name: Push completion gate
-        if: always()
+  # act_runner v1.0.8: cancelled steps не валят job; gate-шаги if:always() не выполняются.
+  # Отдельный job проверяет outputs/result — workflow = failure, deploy-ift не стартует.
+  ci-done:
+    needs: [test, push-image]
+    if: always()
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Enforce CI completion
         run: |
-          if [ ! -f "${RUNNER_TEMP}/ci-gate/push" ]; then
-            echo "::error::Push job incomplete (step cancelled — act_runner bug?). Re-run CI."
+          set -euo pipefail
+          TEST_OK="${{ needs.test.outputs.ci_test_ok }}"
+          if [ "${TEST_OK}" != "1" ]; then
+            echo "::error::test job incomplete (runner reported success without output)"
             exit 1
           fi
+          if [ "${{ github.event_name }}" = "push" ]; then
+            if [ "${{ needs.push-image.result }}" != "success" ]; then
+              echo "::error::push-image must succeed, got: ${{ needs.push-image.result }}"
+              exit 1
+            fi
+            if [ "${{ needs.push-image.outputs.ci_push_ok }}" != "1" ]; then
+              echo "::error::push-image incomplete (output missing)"
+              exit 1
+            fi
+          fi
+          echo "CI gate OK"