R-1008: in flight = the worker process lives (Proxmox's pid+pstart rule), not a wall-clock start vs btime (security review: a clock step could make a live backup look dead)

REPORT.md

@@ -1,4 +1,4 @@
-# REPORT — v0.156.0: after a power cut the box clears up (R-1006, R-1008) — released, not vouched (2026-10-14)
+# REPORT — v0.156.1: after a power cut the box clears up (R-1006, R-1008) (2026-10-14)
 
 Evidence: felhom.eu `documentation/audits/power-cut-fixes-2026-10-14/` — the spike (C1 the night's leftover, C2 a killed
 worker, C3 a real power cut, C4 a full disk), the 17 red-proofs.
@@ -14,6 +14,14 @@ worker, C3 a real power cut, C4 a full disk), the 17 red-proofs.
 - On „No space left" vzdump removes its own partial (both paths): the preflight's sizing stays. But a full host root breaks
   LVM's own metadata writes (a half-removed snapshot; the janitor cannot clear it — new row).
 
+## 0.156.0 is superseded — do not vouch it
+
+A background security review of the pushed 0.156.0 flagged „fail-open state drift": its in-flight rule compared a task's
+wall-clock start with the kernel's `btime`, which moves when the clock is corrected after the boot (an NTP step after a
+power cut) — a live backup could then look „from before the boot" and its lock be cleared. 0.156.1 uses Proxmox's own
+liveness rule instead (the UPID's pid + pstart against `/proc/<pid>/stat` start tick and state; no clock), and fails safe
+when this agent cannot see root's processes (PID 1 not visible).
+
 ## What changed
 
 See `CHANGELOG.md` v0.156.0: `vzdumpInFlight` behind the one `BackupRunning`; `internal/vzpartial` at start-up and before