diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9b8b0c8..5e3b7aa 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,6 @@
-## Unreleased — the orphan thin check runs only after a failed backup (R-1012 follow-up) (2026-10-17)
+## v0.159.2 — the orphan thin check runs only after a failed backup (R-1012 follow-up) (2026-10-18)
 
-**Not released, not vouched; the next vouched agent release carries it.** v0.159.0/v0.159.1 ran the R-1012 orphan check
+**Released 2026-10-18 (committed 2026-10-17): sha256 `4d98868e922d6c10665a6c0da9323e8627ea9c589094e81d27d741e625d9d8f9`, bundle `477704ea2980948433ffc34bb59f008cc11410fd9683d386bfd3e2f085d55bc9`; the vouch is the operator's.** No `configs/` change since v0.159.1. The independent review of 2026-10-18 found nothing in it. v0.159.0/v0.159.1 ran the R-1012 orphan check
 before EVERY snapshot-mode whole-guest backup, and that check takes a short metadata snapshot of the live thin pool.
 Now `BackupRunner` runs it only when the snapshot step has failed (the vzdump start or its task) — the moment the
 answer is needed. The finding is still appended in plain words to the failed backup's error, exactly as before; a