Start with read/edit only.
Allow network explicitly for installs.
Restate the allowlist after compacting.
Do not approve unexpected fetch prompts.
Smoke-test one edit after changing policy.
Change one variable at a time and confirm what actually helped.
If a company policy is involved, rule that out before chasing client settings.
Write the working steps into a short checklist for next time.
Export or screenshot a good setup so reinstalls are faster.
If it still flakes, retest on a clean network such as phone hotspot.