VM101 has a service-owned provider-direct worker and an asynchronous request handoff from the existing zero-healthy cached-bootstrap controller. The worker downloads only a fresh working candidate pool over WAN eth0. It does not test, rank, activate, or build the full five-slot pool.