Thanks for the recommendation, but I'm not seeing any sort of isolation setting anywhere in the router (/AP) configuration having looked several times. There's definitely a weird routing thing going ...