P24 R11 is Class C because it changes the live VM121 database schema.
Before any live mutation, the target script creates a root-only encrypted PostgreSQL custom-format dump using the existing /root/.config/wg-access/db-backup.pass boundary, validates decrypt + pg_restore --list, restores it into a temporary database, and proves the candidate migration against that restored database.
Before CORE_SOURCE_CHANGE_COMPLETE=true, any failure invokes guarded rollback: restore the five previous source files, remove the new migration, replace the live database from the encrypted dump, recreate backend, and verify recovery.
After CORE_SOURCE_CHANGE_COMPLETE=true, late source-publication/report/postcheck failures MUST NOT automatically restore the database or source. They are STOP/continuation cases because the core migration/source/backend state is already committed.
The VM121 agent remains inactive/disabled. No VM100/VM101 runtime mutation and no public onboarding occur in this STEP.

R11 preserves the pre-core marker guarantees and additionally permits only a non-running systemd failed state for wg-access-agent.service to be normalized with systemctl reset-failed before backup. An actually active/activating service remains a pre-core STOP.