Every loader runs, every beacon is refused: csp_blocks_tracker_scripts per tag (Clarity and UET included, which the old hard-coded map missed), and csp_policy_blocks_tag_requirements for Meta (its documented CSP stops at the script host).