Ping works but every application fails after a backup WAN path is added

On Thursday night the team added a backup path for branches: an IPsec tunnel over the internet from BR1 to a new headend router R3, behind a second firewall FW2. The primary path is a metro Ethernet circuit from BR1 to R1, behind FW1. FW1 and FW2 are separate Cisco ASAs, not a failover pair, so they do not share connection state. Both permit ICMP echo, echo-reply, time-exceeded and unreachable for troubleshooting.

Since Friday morning, BR1 users (10.40.0.0/24) cannot open any HQ application. "But ping works." Other branches are fine. All branch LANs live inside 10.40.0.0/16. SRV1 is 10.60.0.15, gateway 10.60.0.1 on CORE1.