diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 1bf74cf3..2ab2cd7b 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -1,263 +1,66 @@
-name: StarshipOS Build
+# The check on every push and pull request: each board's image builds, and the v4 tests pass.
+# Nothing is published here. The nightlies own the rest: nightly.yml (the QEMU acceptance boots,
+# the 32-bit build, the Isabelle/HOL proofs, the images to Nexus) and nightly-docs.yml (the
+# documents to Nexus).
+name: Build
 
 on:
   push:
-    branches: [master]
+    branches: [master, StarForth-v4.0.0]
   pull_request:
     branches: [master]
-  schedule:
-    - cron: '0 2 * * *'   # 02:00 UTC nightly snapshot
   workflow_dispatch:
 
-env:
-  NEXUS:      https://nexus.starshipos-f18.org/repository/starshipos-releases
-  NEXUS_SNAP: https://nexus.starshipos-f18.org/repository/starshipos-snapshots
-
 jobs:
-  build:
-    name: ${{ matrix.board }}
+  image:
+    name: Image ${{ matrix.board }}
     runs-on: ubuntu-latest
-
+    container:
+      image: gitea/runner-images:ubuntu-24.04-v26.11.03   # the runner's own ubuntu-latest is Debian 11 (node:20-bullseye)
+    timeout-minutes: 45
     strategy:
       fail-fast: false
       matrix:
-        board: [qemu, pc, pi4, pi5, milkv]
-        include:
-          - board: qemu
-            karch: amd64
-            vm_arch: amd64
-            img_type: iso
-            efi_name: BOOTX64.EFI
-          - board: pc
-            karch: amd64
-            vm_arch: amd64
-            img_type: iso
-            efi_name: BOOTX64.EFI
-          - board: pi4
-            karch: aarch64
-            vm_arch: arm64
-            img_type: iso
-            efi_name: BOOTAA64.EFI
-          - board: pi5
-            karch: aarch64
-            vm_arch: arm64
-            img_type: iso
-            efi_name: BOOTAA64.EFI
-          - board: milkv
-            karch: riscv64
-            vm_arch: riscv64
-            img_type: img
-            efi_name: BOOTRISCV64.EFI
-
+        include:                  # boards/<dir>/board.mk; Pi 4 has no port yet (#26)
+          - { board: PC,    arch: amd64,   dir: pc,    image: lithos-pc.img }
+          - { board: RASPI, arch: aarch64, dir: raspi, image: lithos-raspi.img }
+          - { board: MILKV, arch: riscv64, dir: milkv, image: lithos-milkv.img }
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0          # the SBOM's version is git describe
+          lfs: false              # only the logs and DoE CSVs are in LFS; the build needs neither
 
-      - name: Install toolchains
-        run: |
-          apt-get update -qq
-          apt-get install -y --no-install-recommends \
-            build-essential make curl ca-certificates \
-            gcc-aarch64-linux-gnu binutils-aarch64-linux-gnu \
-            gcc-riscv64-linux-gnu binutils-riscv64-linux-gnu \
-            mtools xorriso dosfstools gdisk
+      - name: Install the build's dependencies
+        run: make ARCH=${{ matrix.arch }} init INIT_DOCS=0
 
-      - name: Install clang-18 (aarch64 loader)
-        if: matrix.karch == 'aarch64'
-        run: |
-          curl -fsSL https://apt.llvm.org/llvm.sh | bash -s -- 18
+      - name: Boot image
+        run: make boot_image TARGET=${{ matrix.board }}
 
-      - name: Extract versions
-        id: ver
-        run: |
-          LITHOS=$(grep 'LITHOS_VERSION\s*?=' Makefile.starkernel | head -1 | sed 's/.*= *//')
-          SF=$(grep '^VERSION\s*?=' Makefile | head -1 | sed 's/.*= *//')
-          SHA=$(git rev-parse --short HEAD)
-          if [ "${{ github.event_name }}" = "schedule" ]; then
-            SUFFIX="-SNAPSHOT"
-          else
-            SUFFIX="-${SHA}"
-          fi
-          echo "lithos=${LITHOS}${SUFFIX}" >> $GITHUB_OUTPUT
-          echo "sf=${SF}${SUFFIX}"         >> $GITHUB_OUTPUT
-          echo "sha=${SHA}"                >> $GITHUB_OUTPUT
-          echo "is_snapshot=${{ github.event_name == 'schedule' }}" >> $GITHUB_OUTPUT
+      - name: Compress           # the PC image is a 2 GiB stick, nearly all empty
+        run: xz -T0 -6 build/boards/${{ matrix.dir }}/${{ matrix.image }}
 
-      - name: Build StarForth VM
-        run: make T=${{ matrix.board }}
-
-      - name: Build kernel
-        run: |
-          export PATH=/usr/lib/llvm-18/bin:$PATH
-          make -f Makefile.starkernel T=${{ matrix.board }}
-
-      - name: Pack ISO (amd64 / aarch64)
-        if: matrix.img_type == 'iso'
-        env:
-          BUILD_DIR: build/${{ matrix.karch }}/kernel
-          EFI: ${{ matrix.efi_name }}
-          BOARD: ${{ matrix.board }}
-          VER: ${{ steps.ver.outputs.lithos }}
-        run: |
-          set -e
-          mkdir -p "$BUILD_DIR/iso/EFI/BOOT"
-          cp "$BUILD_DIR/starkernel_loader.efi" "$BUILD_DIR/iso/EFI/BOOT/$EFI"
-          printf 'FS0:\\EFI\\BOOT\\%s\r\n' "$EFI" > "$BUILD_DIR/iso/startup.nsh"
-          dd if=/dev/zero of="$BUILD_DIR/iso/efi.img" bs=512 count=8192
-          mformat -i "$BUILD_DIR/iso/efi.img" ::
-          mmd     -i "$BUILD_DIR/iso/efi.img" ::/EFI/BOOT
-          mcopy   -i "$BUILD_DIR/iso/efi.img" "$BUILD_DIR/starkernel_loader.efi" "::/EFI/BOOT/$EFI"
-          xorriso -as mkisofs -r -J -e efi.img -no-emul-boot \
-            -o "$BUILD_DIR/kernel-${VER}-${BOARD}.iso" "$BUILD_DIR/iso"
-
-      - name: Pack GPT image (riscv64)
-        if: matrix.img_type == 'img'
-        env:
-          BUILD_DIR: build/riscv64/kernel
-          BOARD: ${{ matrix.board }}
-          VER: ${{ steps.ver.outputs.lithos }}
-        run: |
-          set -e
-          DISK="$BUILD_DIR/kernel-${VER}-${BOARD}.img"
-          dd if=/dev/zero of="$DISK" bs=1M count=64
-          sgdisk -n 1:2048:131038 -t 1:ef00 -c 1:"EFI System" "$DISK"
-          dd if=/dev/zero of="$BUILD_DIR/esp.img" bs=512 count=128991
-          mkfs.fat -F 32 -n "ESP" "$BUILD_DIR/esp.img"
-          mmd   -i "$BUILD_DIR/esp.img" ::/EFI/BOOT
-          mcopy -i "$BUILD_DIR/esp.img" "$BUILD_DIR/starkernel_loader.efi" ::/EFI/BOOT/BOOTRISCV64.EFI
-          mcopy -i "$BUILD_DIR/esp.img" "$BUILD_DIR/starkernel_kernel.elf" ::/kernel.elf
-          printf 'FS0:\\EFI\\BOOT\\BOOTRISCV64.EFI\r\n' > "$BUILD_DIR/startup.nsh"
-          mcopy -i "$BUILD_DIR/esp.img" "$BUILD_DIR/startup.nsh" ::/startup.nsh
-          dd if="$BUILD_DIR/esp.img" of="$DISK" bs=512 seek=2048 conv=notrunc
-
-      - name: Upload artifacts (Gitea)
+      - name: Keep the image and its SBOM
         uses: actions/upload-artifact@v3
         with:
-          name: starshipos-${{ matrix.board }}-${{ steps.ver.outputs.sha }}
+          name: image-${{ matrix.dir }}-${{ github.run_number }}
           path: |
-            build/${{ matrix.karch }}/kernel/starkernel_loader.efi
-            build/${{ matrix.karch }}/kernel/starkernel_kernel.elf
-            build/${{ matrix.karch }}/kernel/kernel-${{ steps.ver.outputs.lithos }}-${{ matrix.board }}.*
-            build/${{ matrix.vm_arch }}/fastest/starforth
+            build/boards/${{ matrix.dir }}/${{ matrix.image }}.xz
+            build/boards/${{ matrix.dir }}/*.spdx*
 
-      - name: Publish to Nexus
-        if: github.ref == 'refs/heads/master' || github.event_name == 'schedule'
-        env:
-          NEXUS_PASS: ${{ secrets.NEXUS_CI_PASSWORD }}
-          BOARD: ${{ matrix.board }}
-          KARCH: ${{ matrix.karch }}
-          VM_ARCH: ${{ matrix.vm_arch }}
-          KVER: ${{ steps.ver.outputs.lithos }}
-          SFVER: ${{ steps.ver.outputs.sf }}
-          IMG_TYPE: ${{ matrix.img_type }}
-          IS_SNAPSHOT: ${{ steps.ver.outputs.is_snapshot }}
-        run: |
-          set -e
-          REPO="${IS_SNAPSHOT:+$NEXUS_SNAP}"
-          REPO="${REPO:-$NEXUS}"
-          push() {
-            local coord="$1" file="$2"
-            echo "→ org.f18:${coord}"
-            curl -fsS --retry 3 \
-              -u "ci-publisher:${NEXUS_PASS}" \
-              -H "Content-Type: application/octet-stream" \
-              -X PUT "${REPO}/org/f18/${coord}" \
-              --upload-file "$file"
-          }
-
-          # kernel/<version>/kernel-<version>-<board>-loader.efi
-          push "kernel/${KVER}/kernel-${KVER}-${BOARD}-loader.efi" \
-            "build/${KARCH}/kernel/starkernel_loader.efi"
-
-          # kernel/<version>/kernel-<version>-<board>-kernel.elf
-          push "kernel/${KVER}/kernel-${KVER}-${BOARD}-kernel.elf" \
-            "build/${KARCH}/kernel/starkernel_kernel.elf"
-
-          # kernel/<version>/kernel-<version>-<board>.<iso|img>
-          push "kernel/${KVER}/kernel-${KVER}-${BOARD}.${IMG_TYPE}" \
-            "build/${KARCH}/kernel/kernel-${KVER}-${BOARD}.${IMG_TYPE}"
-
-          # starforth/<version>/starforth-<version>-<board>
-          push "starforth/${SFVER}/starforth-${SFVER}-${BOARD}" \
-            "build/${VM_ARCH}/fastest/starforth"
-
-  verify-isabelle:
-    name: Isabelle/HOL Proofs
+  v4-tests:
+    name: v4 tests (32- and 64-bit cells)
     runs-on: ubuntu-latest
-
+    container:
+      image: gitea/runner-images:ubuntu-24.04-v26.11.03   # the runner's own ubuntu-latest is Debian 11 (node:20-bullseye)
+    timeout-minutes: 60
     steps:
       - uses: actions/checkout@v4
-
-      - name: Cache Isabelle installation
-        uses: actions/cache@v3
-        id: isabelle-install-cache
         with:
-          path: /opt/Isabelle2024
-          key: isabelle-2024-linux
+          lfs: false
 
-      - name: Install Isabelle
-        if: steps.isabelle-install-cache.outputs.cache-hit != 'true'
-        run: |
-          apt-get update -qq
-          apt-get install -y --no-install-recommends curl ca-certificates
-          curl -fsSL \
-            "https://isabelle.in.tum.de/dist/Isabelle2024_linux.tar.gz" \
-            -o /tmp/isabelle.tar.gz
-          tar -xzf /tmp/isabelle.tar.gz -C /opt
-          rm /tmp/isabelle.tar.gz
+      - name: Install the build's dependencies
+        run: make ARCH=amd64 init INIT_DOCS=0
 
-      - name: Cache Isabelle heaps
-        uses: actions/cache@v3
-        with:
-          path: ~/.isabelle/Isabelle2024
-          key: isabelle-heaps-${{ hashFiles('proof/**/*.thy', 'proof/ROOT') }}
-          restore-keys: isabelle-heaps-
-
-      - name: Verify StarForth proofs
-        run: |
-          export PATH=/opt/Isabelle2024/bin:$PATH
-          isabelle build -v -d proof StarForth 2>&1 | tee /tmp/isabelle-build.log
-          # Exit code reflects proof success/failure
-          grep -q "Finished StarForth" /tmp/isabelle-build.log
-
-      - name: Upload proof log
-        if: always()
-        uses: actions/upload-artifact@v3
-        with:
-          name: isabelle-proof-log-${{ github.sha }}
-          path: /tmp/isabelle-build.log
-
-  build-docs:
-    name: Documentation
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install doc toolchain
-        run: |
-          apt-get update -qq
-          apt-get install -y --no-install-recommends \
-            doxygen python3 \
-            ruby ruby-dev build-essential \
-            texlive-latex-base texlive-latex-extra \
-            texlive-science texlive-fonts-recommended
-          gem install asciidoctor asciidoctor-latex --no-document
-
-      - name: API docs (Doxygen → AsciiDoc)
-        run: make api-docs
-
-      - name: LaTeX docs (AsciiDoc → LaTeX)
-        run: make docs-latex
-
-      - name: Math companion PDF (LaTeX → PDF)
-        run: make math-companion
-
-      - name: Upload documentation
-        if: always()
-        uses: actions/upload-artifact@v3
-        with:
-          name: docs-${{ github.sha }}
-          path: |
-            docs/src/appendix/
-            docs/latex/
-            docs/SSRN_companion/Math_Companion_SSRN.pdf
+      - name: make -C v4 test
+        run: make -C v4 test
diff --git a/.gitea/workflows/nightly-docs.yml b/.gitea/workflows/nightly-docs.yml
index fda07f49..00d38c46 100644
--- a/.gitea/workflows/nightly-docs.yml
+++ b/.gitea/workflows/nightly-docs.yml
@@ -18,6 +18,8 @@ jobs:
   docs:
     name: Book, volumes, API reference
     runs-on: ubuntu-latest
+    container:
+      image: gitea/runner-images:ubuntu-24.04-v26.11.03   # the runner's own ubuntu-latest is Debian 11 (node:20-bullseye)
     timeout-minutes: 90
     steps:
       - uses: actions/checkout@v4
diff --git a/.gitea/workflows/nightly.yml b/.gitea/workflows/nightly.yml
index f6029b20..01b676cd 100644
--- a/.gitea/workflows/nightly.yml
+++ b/.gitea/workflows/nightly.yml
@@ -20,6 +20,8 @@ jobs:
   nightly:
     name: Acceptance, proofs, images
     runs-on: ubuntu-latest
+    container:
+      image: gitea/runner-images:ubuntu-24.04-v26.11.03   # the runner's own ubuntu-latest is Debian 11 (node:20-bullseye)
     timeout-minutes: 150
     steps:
       - uses: actions/checkout@v4
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index f195f0e9..39d9efa3 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -17,6 +17,8 @@ jobs:
   release:
     name: Release ${{ github.ref_name }}
     runs-on: ubuntu-latest
+    container:
+      image: gitea/runner-images:ubuntu-24.04-v26.11.03   # the runner's own ubuntu-latest is Debian 11 (node:20-bullseye)
     timeout-minutes: 240
     steps:
       - uses: actions/checkout@v4