diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8abb2382..bfa99c3d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,6 +14,11 @@
 
 name: CI
 
+# Action versions are the Node 24 native releases (checkout@v5, setup-node@v5,
+# setup-python@v6). The v4/v5 generation targets Node 20, which the runners now
+# force onto Node 24 with a deprecation warning on every job - working today,
+# a hard failure whenever GitHub drops the shim.
+#
 # Jobs run on the org's self-hosted "arc-runner-set" (enterprise
 # ge-aerospace-runner-group, Linux). GitHub-hosted runners are blocked by the
 # org IP allow list (hosted Azure runner IPs are not allow-listed -> checkout
@@ -34,8 +39,8 @@ jobs:
   backend:
     runs-on: arc-runner-set
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: '3.14'
           cache: pip
@@ -45,7 +50,7 @@ jobs:
   naming:
     runs-on: arc-runner-set
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - run: bash scripts/check-naming-and-style.sh
 
   gates:
@@ -58,8 +63,8 @@ jobs:
     # it again.
     runs-on: arc-runner-set
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: '3.14'
           cache: pip
@@ -72,8 +77,8 @@ jobs:
       run:
         working-directory: frontend
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
         with:
           node-version: '20'
           cache: npm
@@ -88,8 +93,8 @@ jobs:
     # code is absent from the bundle - the delete-a-plugin guarantee in CI.
     runs-on: arc-runner-set
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
         with:
           node-version: '20'
           cache: npm
diff --git a/CHANGELOG.md b/CHANGELOG.md
index b41042f8..061d8a2e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -128,6 +128,25 @@ ADR-007 and ADR-002.
 
 ### Fixed
 
+- **The published site's API documentation page had no spec to show.**
+  `shopdb/core/api/docs.py` reads `docs/openapi.json` at runtime to serve
+  `/api/docs`, and publication excluded the whole of `docs/` because the prose
+  becomes the wiki. So every site installed from the published repo shipped the
+  ReDoc page, loaded it, and answered `{"error":"openapi.json not generated"}`.
+  The spec now publishes: it is a product file that happens to live under
+  `docs/`, not documentation. The prose still goes to the wiki and nowhere else.
+
+- **Three gates were reporting green by not running.**
+  `test_api_inventory_parity`, `test_openapi_spec` and `test_docs_publishable`
+  all skip themselves when the file they read is absent - correct in a
+  published checkout, and silently wrong on GitHub, which runs against exactly
+  that checkout. An outside branch added nine routes documented nowhere and
+  passed CI. `scripts/check-gates-ran.sh` now asserts each gate actually ran,
+  splitting the ones that must run everywhere from the ones that need files
+  publication deliberately leaves behind, and a new `gates` job runs it in CI.
+  Verified in both directions: it passes here, and it fails when the file a
+  gate reads is taken away.
+
 - **Secure Send now hands you a message, not a bare URL.** A link on its own
   invites being pasted onto text already sitting in the chat box, and a chat
   client turns the selection into the link's caption - so the secret travels as