diff --git a/CHANGELOG.md b/CHANGELOG.md
index a49f2be..0c0f313 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -29,3 +29,23 @@ Tag sections feed the release notes — see [`docs/RELEASING.md`](docs/RELEASING
   re-emits it.
 - floret-kit's `core-di` supplies the `@IoDispatcher` the preference store runs
   on, so Clockula no longer declares its own dispatcher qualifier.
+- Clockula's own storage, headless: a Room database with `alarms`, `timers`,
+  `world_clocks` and `stopwatch_laps`, its version-1 schema exported and
+  committed so every future migration is reviewable and testable.
+- Plain-Kotlin alarms, timers, world clocks and stopwatch runs behind four
+  repository interfaces exposing Flows — nothing above the data layer knows Room
+  exists, and a test fails the build if anyone reaches through. A corrupt row
+  degrades on read (a clamped time, an unknown ringtone, a rotted zone id)
+  rather than crashing the list it appears in.
+- Alarm and timer settings are inherited, not copied: a per-alarm ringtone,
+  snooze, vibrate, volume ramp or dismiss challenge is an *override*, so
+  changing an app default later reaches every alarm the user never customised.
+- The clock defaults and the stopwatch's running state now live in DataStore
+  alongside the appearance preferences, clamped on read as well as on write, so
+  a hand-edited or restored file cannot produce a setting the user could never
+  have chosen.
+- The wall-clock / elapsed-realtime split, made explicit: alarm records follow
+  the system clock, while running timers and the stopwatch are anchored to time
+  since boot. Changing the device's time — forwards or backwards — cannot warp
+  either, and a timer that survives a reboot falls back to its wall-clock
+  estimate and says so instead of vanishing.