The downloader is forced to eth0 with HMN_REQUEST_IFACE=direct and HMN_DIRECT_IFACE=eth0. The worker accepts durable requests and owns retry/backoff. The controller never runs provider acquisition synchronously. The existing full refresh remains the later service-owned heavy operation after first recovery.