Before successful core postcheck, restore the three VM100 managed files and the exact backed-up topology/Direct runtime state, then verify paid CIDR membership in the existing VPN PBR nft set. After successful core postcheck, a late source/report publication failure is STOP without automatic rollback of verified source changes.