P24 R16 is Class C because it changes the live VM121 database schema.
Before any live mutation, the target script creates a root-only encrypted PostgreSQL custom-format dump using the existing /root/.config/wg-access/db-backup.pass boundary, validates decrypt + pg_restore --list, restores it into a temporary database, and proves the candidate migration against that restored database.
Before CORE_SOURCE_CHANGE_COMPLETE=true, any failure invokes guarded rollback: restore the five previous source files with canonical modes (wg_access_agent.py 0755; other modified Python files 0644), remove the new migration, replace the live database from the encrypted dump, recreate backend, and verify recovery.
After CORE_SOURCE_CHANGE_COMPLETE=true, late source-publication/report/postcheck failures MUST NOT automatically restore the database or source. They are STOP/continuation cases because the core migration/source/backend state is already committed.
The VM121 agent remains inactive/disabled. No VM100/VM101 runtime mutation and no public onboarding occur in this STEP.

R16 retains R13/R14 diagnostic and rollback hardening, the failed-unit normalization rule, and the corrected Alembic revision 0004_profile_provisioning. R16 additionally pins EXPECTED_MIGRATION_SHA to the actual corrected migration candidate and hardens mandatory fixtures against candidate/deployer SHA drift and stale report revision/publication labels.