diff --git a/CHANGELOG.md b/CHANGELOG.md
index 18e420dd..860b32ce 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,10 +5,49 @@ follow semantic versioning; release dates are ISO 8601.
 
 ## v1.6.7 — Planned
 
-**Dependency cleanup cycle.** Scope being assembled — entries are
-filled in as work lands on `develop`. No breaking changes are
-planned; the next minor with new canonical DSL primitives is
-**v1.7.0** (see [ROADMAP.md](ROADMAP.md)).
+**Transitive dependency cleanup.** v1.6.7 narrows the runtime
+classpath GraphCompose imposes on consumers. The Kotlin standard
+library is gone (the codebase is Java-first; no production
+`.kt` sources exist), the `flexmark-all` aggregator is replaced
+with the three modules `MarkDownParser` actually references,
+`jackson-dataformat-yaml` is marked `<optional>true</optional>`
+(mirroring the existing `poi-ooxml` pattern — only consumers that
+load YAML configs through `ConfigLoader` need to pull it in),
+`jackson-module-jsonSchema` and the explicit `snakeyaml`
+declaration are dropped as unused, and `jcl-over-slf4j` is added
+explicitly so PDFBox's `commons-logging` call sites keep routing
+through SLF4J after the flexmark narrowing (the bridge was
+previously provided transitively via `flexmark-all`). The cycle
+also fixes a latent layout-cache staleness bug on
+`DocumentSession.registry().register(...)` (Track I3): the
+registry returned by `registry()` is now a session-owned wrapper
+that invalidates the layout cache on every mutation, matching the
+semantics of `DocumentSession.registerNodeDefinition(...)`.
+
+**Zero breaking public API changes.** The `japicmp` gate against
+the v1.6.6 baseline reports `semver PATCH, compatible bug fix` —
+the one surface delta is `NodeRegistry` becoming non-`final` so
+`DocumentSession` can install the auto-invalidating subclass
+described above. All existing call sites compile and run
+unchanged. The transitive cleanup is a runtime-classpath change,
+not a compile-surface change.
+
+**Migration from v1.6.6.** Consumers that relied on dependencies
+flowing transitively through GraphCompose must now declare them
+explicitly:
+
+| If you transitively depended on… | Add to your build |
+|---|---|
+| Kotlin stdlib via GraphCompose | `org.jetbrains.kotlin:kotlin-stdlib-jdk8` |
+| Flexmark extensions (tables, footnotes, gfm-strikethrough, …) | the relevant `com.vladsch.flexmark:flexmark-ext-*` modules |
+| YAML config loading through `ConfigLoader` | `com.fasterxml.jackson.dataformat:jackson-dataformat-yaml` |
+| `jackson-module-jsonSchema` | `com.fasterxml.jackson.module:jackson-module-jsonSchema` |
+| The `commons-logging` API beyond SLF4J routing | declare `commons-logging:commons-logging` explicitly (GraphCompose intentionally excludes it from PDFBox and bridges via `jcl-over-slf4j`) |
+
+No code changes are required for typical usage — pure-PDF
+consumers and JSON-only `ConfigLoader` callers carry on as before.
+The next minor with new canonical DSL primitives is **v1.7.0**
+(see [ROADMAP.md](ROADMAP.md)).
 
 ### Build