diff --git a/CHANGELOG.md b/CHANGELOG.md
index 558e4fd..8f158d6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,43 @@
 
 All notable changes to Armature are documented here.
 
+## v0.7.4 — Documentation + Deferred Surface Work
+
+**Docs Category Grouping**
+- Backend `Category` field on `docEntry` struct in `server/handlers/docs.go`
+- Frontend sidebar groups docs by category with `.docs-category-heading` CSS
+- Four categories: Getting Started, Platform, Extension Development, Operations
+- 14 docs in ordered list (was 7 ordered + 3 auto-discovered)
+
+**New Documentation (4 guides)**
+- `PERMISSIONS-AND-GROUPS.md` — RBAC model, 7 permission slugs, system/custom groups, settings cascade, extension permissions
+- `WORKFLOWS.md` — Entry modes, stage modes/types/audiences, signoff gates, SLA enforcement, branch rules, Starlark hooks
+- `STARLARK-REFERENCE.md` — Sandbox constraints, 10 modules with function signatures and permission gates, example hook script
+- `FRONTEND-JS-GUIDE.md` — Preact+htm runtime, 16 SDK modules with API reference, shell topbar patterns, CSS contract
+
+**Extension Guide Updates**
+- `config_section` manifest field documented: schema, backend discovery (`configSectionsForSurface()`), frontend `__CONFIG_SECTIONS__` contract, example component
+- Starlark Sandbox API section replaced with pointer to new Starlark Reference
+
+**Docs Content Refresh**
+- GETTING-STARTED: `sb_data` → `armature_data` volume name
+- ARCHITECTURE: `sb.register()`/`sb.ns()` → `sw` SDK references, shell topbar mention
+- DEPLOYMENT: `sb_storage` → `armature_storage`, added `TLS_MODE` env var
+- TUTORIAL-FIRST-EXTENSION: `--bg-2` → `--bg-secondary` CSS variable
+- EXTENSION-CSS: self-hosted font notes on `--font` and `--mono`
+- `docs.go`: added `AUDIT-` and `USABILITY-` prefix filters for auto-discovery
+
+**Team Admin Workflows Split**
+- `workflows.js` (722 lines) split into 3 ES modules:
+  - `workflows.js` (~160 lines) — `WorkflowsSection` + `WorkflowsTab` + imports
+  - `workflow-editor.js` (~240 lines) — `WorkflowEditor` + `StageForm`
+  - `workflow-monitor.js` (~210 lines) — `AssignmentsTab` + `MonitorTab` + `SignoffPanel`
+- External import contract unchanged (default export stays in `workflows.js`)
+
+**Bug Fixes**
+- Docs outline `scrollToHeading` now scrolls `.docs-content` container instead of `scrollIntoView`, preventing topbar from being pushed off-screen
+- `--bg-2` (undefined CSS variable) replaced with `--bg-secondary` in `sw-shell.css` and `sw-primitives.css`
+
 ## v0.7.3 — Extension Shell Migration
 
 **Shell Topbar Migration**
@@ -23,6 +60,26 @@ All notable changes to Armature are documented here.
 **Roadmap**
 - Headless E2E automation moved to v0.7.5 (independent from shell migration)
 
+## v0.7.2 — Package Runners + CI Gate
+
+**Package Runners (5)**
+- Notes runner: `requires: ["notes"]`. 3 suites (crud, folders, tags-search), 12 tests
+- Chat runner: `requires: ["chat", "chat-core"]`. 2 suites (conversations, messaging), 9 tests
+- Schedules runner: `requires: ["schedules"]`. 1 suite (crud), 5 tests
+- Workflow runner: `requires: ["content-approval"]`. 1 suite (lifecycle), 5 tests
+- Renderer runner: `requires: ["mermaid-renderer"]`. 1 suite (contract), 4 tests
+
+**Runner Result API**
+- `POST /api/v1/admin/test-runners/results` — store structured run results
+- `GET /api/v1/admin/test-runners/results` — retrieve latest results per runner
+- In-memory store with 4 Go handler tests
+
+**CI Integration**
+- `test-runners` stage in Gitea CI pipeline
+- Playwright driver launches headless browser, navigates to `/s/test-runners`, triggers run-all
+- `wait-for-healthy.sh` polls `/healthz/ready` before test execution
+- DinD networking fix: resolve container IP via `docker inspect` (port mapping not exposed to runner localhost)
+
 ## v0.7.1 — Surface Runner Framework
 
 **`sw.testing` SDK Module**