diff --git a/CHANGELOG.md b/CHANGELOG.md
index 46c2c692ba..f96410bcc4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -160,6 +160,40 @@ sync with the newest highlights.
   successfully with all Phase J commits. The patch system
   works end-to-end.
 
+## 2026-07-01 — Build system: explicit patch verification
+
+The user requested "build system must report complete when
+upstream have our patches applied". This session adds the
+explicit verification tools:
+
+- **`local/scripts/check-cargo-patches.sh`** (Improvement C):
+  For each local source's `Cargo.toml`, scans for
+  `[patch.crates-io]` and `[patch."<URL>"]` sections,
+  resolves the patch via `cargo metadata`, and verifies
+  that the resolved source URL (or manifest_path for
+  path-deps) matches the expected local fork path. Returns
+  non-zero on any unresolved patch. Wraps `cargo metadata`
+  in a 30s timeout to handle large workspaces (relibc,
+  base). Explicitly skips relibc (its `[patch]` is only the
+  cc-rs git branch override, no `path` patches).
+- **`make verify-patches`**: runs the above script. The
+  current kernel Phase J patch
+  ([patch."<URL>"] redox_syscall) is verified
+  end-to-end.
+- **`make verify-file-patches`**: runs
+  `local/scripts/check-unwired-patches.sh --strict` which
+  verifies all file-level .patch files in `local/patches/`
+  are referenced by at least one recipe.toml `patches = [...]`
+  entry.
+- **`make verify-all`**: runs both. The comprehensive
+  Phase J end-to-end verification. Returns non-zero on any
+  failure (CI-friendly).
+
+The cookbook itself already logs `[SUMMARY] All N patches
+validated successfully` for file-level patches. These new
+Makefile targets make the verification part of the standard
+build workflow.
+
 ## 2026-07-01 — cpufreqd oscillation fixed (kernel MSR scheme + VM detection)
 
 ### Kernel fix: `sys` scheme path-strip ENOENT bug (kernel fork commit `c231262`)