diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 67a448f..e970f50 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -152,6 +152,44 @@ jobs:
       # Docker daemon and gets one here. That is why the tests run on ubuntu rather than
       # macOS, whose runners have no daemon at all. Expect the Keycloak image pull to
       # dominate a cold run.
+
+      # A failing run says only that tests failed and names a log file on a machine nobody
+      # has a shell on. Every diagnostic thing — exception type, message, stack — is inside
+      # that file, so a red build was a filename and a guess. This prints it.
+      #
+      # head rather than tail, and that is the whole trick: when a suite fails wholesale it
+      # writes one stack per test and they are all the same stack. The first is the one that
+      # explains it, and the last two hundred lines are the same sentence repeated.
+      - name: what actually failed
+        if: failure()
+        run: |
+          set +e
+          echo "=== distro ==="
+          cat /etc/os-release 2>/dev/null | head -3
+          id
+
+          echo "=== what Skia needs, and whether it is here ==="
+          # ldd against the copy the test project carries. Its unresolved rows are the
+          # answer whenever the layout suite dies in HeadlessUnitTestSession, and asking
+          # here beats inferring it from a managed TypeInitializationException.
+          skia="$(find tests -name 'libSkiaSharp.so' 2>/dev/null | head -1)"
+          if [ -n "$skia" ]; then
+            echo "$skia"
+            ldd "$skia" 2>&1 | grep -Ei 'not found|fontconfig|freetype' || echo "  all resolved"
+          else
+            echo "  libSkiaSharp.so was not in the test output at all"
+          fi
+          ldconfig -p 2>/dev/null | grep -ci fontconfig | sed 's/^/fontconfig entries in ldconfig: /'
+
+          echo "=== docker, for the Testcontainers suites ==="
+          docker version --format '{{.Server.Version}}' 2>&1 | head -2
+
+          echo "=== test logs ==="
+          find tests -path '*/TestResults/*.log' 2>/dev/null | while read -r log; do
+            echo "----- $log"
+            head -n 120 "$log"
+          done
+          exit 0
   android:
     name: android head
     runs-on: [linux]