Actual identity read, with the intended controller identifier returned. I have that saved output. The notes omit which network adapter and route were selected during it.

Have the network owner compare both laptops on the documented target and permitted service. Keep the script, imported SDK and launcher details with each result. A route difference is possible, but the service policy could differ too.

Can you preserve the failing laptop's configuration before anyone starts experimenting?

Configuration captured, Toby. Both use the same supported SDK and unchanged script. Network owner is checking the actual service path; we have not treated the presence of two adapters as a diagnosis.

Does the failing read reach the intended controller-side service at all, according to the network evidence? That would narrow the question more than another ping screenshot.

The network owner found the diagnostic service blocked by the laptop's assigned policy, while the permitted ping traffic passed. The working laptop had the approved service rule. They are correcting that managed configuration, not disabling the firewall.

Good specific finding. After the approved change, repeat through the ordinary launcher and after reopening the laptop. Keep the returned controller identity, not just a connection succeeded note, in the maintenance record.

Those checks pass now. Normal launcher and reopened session return the intended FR5 identity with the managed service rule in place. The intermittent ping history did not identify this service restriction; the policy log did.

Give the rebuild owner that policy reference too. The next laptop should inherit the actual fix.