diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0d54c18a..0c9fcd39 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,13 +4,45 @@ All notable changes to ScadaBridge are documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+Detailed per-change history lives in `git log`,
+`archreview/plans/00-MASTER-TRACKER.md`, and `docs/plans/` — this file records
+operator-facing and breaking changes only.
+
 ## [Unreleased]
 
+### Changed — Architecture-review hardening initiative (PLAN-01…PLAN-08, 2026-07-08 → 2026-07-10)
+
+Eight architecture reviews produced eight fix plans; 191 of 192 tasks landed. The
+initiative added eager startup options-validation across 12+ components, ClusterClient
+message-contract lock tests, secured-write pending-TTL, a login throttle, transport
+import single-flight, store-and-forward sweep bounding, and a deploy-readiness
+handshake; it excised the vestigial site-notification delivery surface and established
+a canonical deferred-work register. Authoritative record:
+`archreview/plans/00-MASTER-TRACKER.md` plus the per-plan docs.
+
+### Added — M8 Transport
+
+Encrypted bundle export/import extended from central-only config to site/instance-scoped
+config (`Site`s, site `DataConnection`s, `Instance`s + `Area` by name), reconciled across
+environments by the `BundleNameMap` name-mapping subsystem, with a per-line Myers diff and
+the script trust gate enforced at import review. Post-initiative additions (both 2026-07-10):
+an aggregated live alarm stream feeding the Alarm Summary page, and hourly KPI rollups
+unblocking 30d/90d trend windows.
+
+### Added — M7 Native alarms + operational UX
+
+Read-only native-alarm mirroring (OPC UA Alarms & Conditions + MxAccess Gateway) onto a
+unified condition model; an operator Alarm Summary page; OPC UA node browse/search/type-info
+and site-local certificate trust; **two-person secured writes, introducing the `Operator`
+and `Verifier` roles**; and an SMS (Twilio) notification delivery adapter.
+
 ### Changed — BREAKING: canonical role names + audit separation-of-duties collapse (Task 1.7)
 
 Role string VALUES are standardized onto the canonical vocabulary
-(`Administrator`/`Designer`/`Deployer`/`Viewer`; `Operator`/`Engineer` are unused
-by ScadaBridge). The legacy ScadaBridge role names were renamed and two were
+(`Administrator`/`Designer`/`Deployer`/`Viewer`; `Engineer` remains unused by
+ScadaBridge; `Operator` has since been adopted by the M7 two-person secured-write
+flow, together with the new `Verifier` role — see the M7 entry above). The legacy
+ScadaBridge role names were renamed and two were
 **collapsed**:
 
 | Legacy role     | Canonical role  | Notes |