fix(origin-gate): stop over-blocking the two reachable /32s in 192.0.0.0/24

192.0.0.0/24 carries "Globally Reachable: False" as a block, but the IANA IPv4
Special-Purpose registry re-delegates two /32s inside it that are marked True:

  192.0.0.9/32   Port Control Protocol Anycast   (RFC 7723)
  192.0.0.10/32  TURN Anycast                    (RFC 8155)

Refusing the /24 wholesale over-blocks both.

The uncomfortable part: this file's IPv6 side already carves out the very same
two services (2001:1::1 PCP and 2001:1::2 TURN) inside 2001::/23, with a comment
warning that the registry -- not the intuition that a prefix "looks internal" --
is the authority. The same reasoning was applied on one side and skipped on the
other.

Why it was missed: the bidirectional difference check that produced the IPv6
carve-outs was run over the IPv6 registry ONLY. The claim it was used to support
("registry-exact in both directions") was stated for the gate as a whole. A
completeness claim was therefore made from a check covering half its subject --
the same class the surrounding commits were written to close.

Found by an independent audit, not by me.

Now verified over BOTH registries, both directions, all four difference sets
empty:
  IPv4  A-B (registry-False, not refused)  -> empty
  IPv4  B-A (registry-True,  refused)      -> empty
  IPv6  A-B                                -> empty
  IPv6  B-A                                -> empty

Test pins the carve-out at exactly two addresses wide: 192.0.0.9 and .10 stay
accepted, 192.0.0.8/.11/.1 stay refused. Discrimination proved -- removing the
carve-out turns the suite red (194/1); restored, 195/195.

Author: marcohost33-maker

src/security/header-values.js

@@ -388,7 +388,20 @@ function parseCanonicalIpv4(hostname) {
 }
 
 function isNonPublicIpv4(octets) {
-  const [a, b, c] = octets;
+  const [a, b, c, d] = octets;
+
+  // 192.0.0.0/24 is registry-False as a block, but the registry re-delegates two
+  // /32s inside it that ARE globally reachable: 192.0.0.9 (Port Control Protocol
+  // Anycast, RFC 7723) and 192.0.0.10 (TURN Anycast, RFC 8155). Refusing the /24
+  // wholesale over-blocks them.
+  //
+  // The IPv6 side of this file already carves out the very same two services
+  // (2001:1::1 and 2001:1::2) inside 2001::/23 — this is that carve-out's
+  // missing IPv4 twin. Found by an independent audit, not by the bidirectional
+  // registry check that produced the IPv6 carve-outs: that check was run over
+  // the IPv6 registry only, so the IPv4 half of the same claim went untested.
+  if (a === 192 && b === 0 && c === 0 && (d === 9 || d === 10)) return false;
+
   return (
     a === 0 ||
     a === 10 ||

tests/security/production-boundary.test.js

@@ -372,3 +372,30 @@ test('Integrity-Policy-Report-Only cannot be smuggled onto the served response',
     'expected the report-only twin to be refused at the response boundary',
   );
 });
+
+test('the two globally reachable /32s inside 192.0.0.0/24 stay accepted', () => {
+  // 192.0.0.0/24 is registry-False as a block, but the registry re-delegates two
+  // /32s inside it that carry "Globally Reachable: True". Refusing the /24
+  // wholesale over-blocks them. This is the IPv4 twin of the 2001:1::1/2/3
+  // carve-out below — it was missing because the bidirectional registry check
+  // that produced the IPv6 carve-outs was only ever run over the IPv6 registry.
+  for (const origin of [
+    'https://192.0.0.9', // Port Control Protocol Anycast (RFC 7723)
+    'https://192.0.0.10', // TURN Anycast (RFC 8155)
+  ]) {
+    assert.deepEqual(
+      validateApprovedEndpointOrigins([origin]),
+      [],
+      `expected ${origin} to remain accepted (registry: Globally Reachable = True)`,
+    );
+  }
+
+  // The surrounding /24 must still be refused — the carve-out is exactly two
+  // addresses wide, not a hole in the block.
+  for (const origin of ['https://192.0.0.8', 'https://192.0.0.11', 'https://192.0.0.1']) {
+    assert.ok(
+      validateApprovedEndpointOrigins([origin]).some((e) => /non-public\/reserved/.test(e)),
+      `expected ${origin} to stay refused`,
+    );
+  }
+});