diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml
index 6061887..028b62b 100644
--- a/.gitea/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@@ -14,12 +14,15 @@ jobs:
       CI_COMMIT: ${{ gitea.sha }}
       CI_REF: ${{ gitea.ref }}
       CI_RUN_ID: ${{ gitea.run_id }}
-      CI_RUN_ATTEMPT: ${{ gitea.run_attempt }}
     steps:
       - name: Check out pushed commit
         uses: https://github.com/actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
           persist-credentials: false
+      - name: Identify workflow attempt
+        # Gitea 1.25 does not populate gitea.run_attempt. Use a unique value for
+        # container names and diagnostic artifacts, including reruns of one SHA.
+        run: printf 'CI_RUN_ATTEMPT=%s\n' "$(date -u +%Y%m%d%H%M%S%N)" >> "$GITHUB_ENV"
       - name: Build and test both images
         run: timeout --signal=TERM --kill-after=60s 75m bash ci/verify.sh
       - name: Publish verified main images
@@ -35,7 +38,7 @@ jobs:
         if: always()
         uses: https://github.com/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5
         with:
-          name: diagnostics-${{ gitea.run_id }}-${{ gitea.run_attempt }}
+          name: diagnostics-${{ gitea.run_id }}-${{ env.CI_RUN_ATTEMPT }}
           path: ci/artifacts/
           if-no-files-found: error
           retention-days: 14
diff --git a/docs/gitea-ci.md b/docs/gitea-ci.md
index 9f9bc23..3eb58c3 100644
--- a/docs/gitea-ci.md
+++ b/docs/gitea-ci.md
@@ -184,10 +184,11 @@ die instelling. De twee bewegende tags zijn geen atomisch paar.
 ## Diagnostiek en herstellen
 
 Iedere workflowpoging bewaart beschikbare diagnostiek als
-`diagnostics-<run-id>-<attempt>` gedurende veertien dagen: Maven-rapporten, JUnit-
+`diagnostics-<run-id>-<unique-attempt-id>` gedurende veertien dagen: Maven-rapporten, JUnit-
 rapporten van frontend/Playwright, het Playwright HTML-rapport, traces/screenshots
 en containerlogs. Open de artifactdownload op de Gitea Actions-runpagina.
-Build- en publicatielogs staan er eveneens in. Geen environmentdump of Docker
+Build- en publicatielogs staan er eveneens in. Gitea 1.25 vult `gitea.run_attempt`
+niet in; de workflow maakt daarom zelf een unieke identificatie per poging. Geen environmentdump of Docker
 inspect met mogelijke credentials wordt opgenomen.
 
 Bij mislukking blijven de oorspronkelijke exitstatus en rapporten behouden.
diff --git a/docs/s4-validation.md b/docs/s4-validation.md
index 0fdac28..fe83334 100644
--- a/docs/s4-validation.md
+++ b/docs/s4-validation.md
@@ -57,14 +57,20 @@ Local image IDs (not registry digests):
 - [x] Activate and verify the Docker Desktop HTTP-registry setting.
 - [x] Repository `REGISTRY_USER`/`REGISTRY_TOKEN` secrets configured using the
       supplied token files. Registry access is verified by actual publication below.
-- [ ] Obtain a repository runner registration token and register/start the
-      installed mini-PC runner; verify it is online in Gitea.
+- [x] Runner ID 1 (`agiledancers-mini-pc`) registered, service started and
+      online in Gitea. Real feature/failure jobs ran on this runner.
 - [ ] Confirm server settings permit every branchpush (including messages with
       skip strings) and retain uploaded diagnostic artifacts for fourteen days.
-- [ ] Real feature-branch run: record URL/run ID, successful container-E2E and
-      absence of publication.
-- [ ] Real intentionally failing test/build run: record URL/run ID, blocked
-      publication and downloadable failure artifacts.
+- [x] [Feature run #1](http://192.168.2.28:3000/wanjakrah/agiledancers/actions/runs/1),
+      API run ID 2, commit `74a5aa12377d4a62cdebe1dcd6e8a8e1443b33fb`: succeeded,
+      two container E2E tests passed, publication skipped. Diagnostic ZIP was
+      downloaded and verified (23 files).
+- [x] [Failure probe #2](http://192.168.2.28:3000/wanjakrah/agiledancers/actions/runs/2),
+      API run ID 3, temporary branch `feature/s4-ci-failure`, commit
+      `6d94c68756a90c5e87590e6fd137de8aa5cd9395`: failed at the deliberate
+      backend test; imagebuild/publication did not run. Diagnostic ZIP was
+      downloaded and verified (15 files). The probe is absent from the real
+      featurebranch.
 - [ ] Real main run: record URL/run ID, both full-SHA images, successful pullback,
       registry digests and the two `main` aliases.
 - [ ] Real rerun/partial-publication recovery and stale-main evidence: record
@@ -73,3 +79,10 @@ Local image IDs (not registry digests):
 The isolated publication tests provide automated control-flow coverage; they do
 not substitute for real authenticated registry/Gitea acceptance runs. No application
 images have been published and no application has been deployed by this work.
+
+
+Gitea 1.25 does not populate `gitea.run_attempt`; the workflow generates a unique
+attempt identifier for containers and diagnostic artifact names. The Gitea v3
+artifact-list API returns an empty list despite successful uploads; artifacts
+were verified by downloading the run-page archive URLs. This is separate from
+artifact availability and does not require a server upgrade.