1. Verify exact Machine Git commit/tree/count and clean tracked work tree.
2. Verify VM100 topology NORMAL and one peer per selector.
3. Verify VM101 recovery/fallback NORMAL, five healthy slots, no pending topology and Direct disabled.
4. Analyze exact source branches for DIRECT_REQUIRED, provider acquisition and bootstrap declarations.
5. Do not modify services, routes, selectors, VPN configs or recovery state.