diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6819cef..1a64f7c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- **The tenant registry** (`src/domains/tenants/`, core-api T-8 / workspace
+  D-73) - `tenants` and `tenant_consumers` (migration 007), and
+  `TenantsService.require_tenant`, the one enforcement point Book's and
+  Scribe's own `_require_tenant` now delegate to instead of checking only
+  presence: a tenant that is not in the table is 403 `tenant_unknown`, one
+  marked `suspended` is 403 `tenant_suspended`, and an Office caller whose
+  consumer holds no grant in that tenant is 403 `consumer_not_granted` -
+  closing the gap where a typo'd `tatlock_user` claim opened a fresh, empty
+  namespace rather than being refused. Every existing `owner_tenant` column
+  (`book_records`, `book_tenant_counters`, `scribe_addresses`,
+  `scribe_messages`, `scribe_mailbox_entries`) now carries a foreign key to
+  `tenants.id` (`ON DELETE RESTRICT`). Migration 007 seeds the two tenants
+  in use today - `jpmschweitzer` (household) and `llm_tester` (test) - both
+  granted to `office-claude`, the only Office consumer configured in
+  Authentik. Read-only this round: `GET /tenants/me` answers the caller's
+  own tenant and its granted consumers (the cheap "am I allowed here"
+  probe); `GET /tenants` answers every tenant for a `tatlock`/`scheduler`
+  caller or a list of one for a tenant-bearing caller, never revealing
+  another tenant's existence. No write routes - provisioning a tenant is
+  later (workspace T-195).
 - **The Scribe** (`src/domains/scribe/`) - the household's message bus
   (dossier core-api T-5 / workspace D-66, D-68, D-73): `register`/`list`
   addresses, `send`, `mailbox`, `history`, `find`, `mark`, `tag`/`untag`, all