Table-driven coverage for the CGNAT, IETF-protocol, benchmark, and NAT64 ranges (IPv4, IPv6, and IPv4-mapped forms), an operator-supplied blocked_networks entry enforced by the dialer, and strict parsing that aborts startup naming the key and the offending value. Model: opus-4-8