Tell "the host didn't answer" apart from "we refuse that address"

[jeremy]

"The host didn't answer" and "we refuse that address" arrived as the same nil, empty list, or false. That reads fine until a caller treats a refusal as permanent — a webhook that deactivates a customer's endpoint when the guard refuses it would retire that endpoint on one bad DNS minute, because a lookup returning nothing was indistinguishable from a lookup returning the metadata address.

A refusal is a statement about the address. An empty lookup is a statement about the moment. So a host that resolves to nothing now raises Unresolvable, deliberately not a subclass of Violation — callers that don't care can rescue both, and the ones that do can finally choose.

	resolves to something public	resolves, all blocked	resolves to nothing	malformed URL
resolve_public_ips (takes a host)	the public addresses	[]	raises Unresolvable	—
resolve_public_ip	first public address	nil	raises Unresolvable	nil
enforce_public_ip	returns	raises Violation	raises Unresolvable	raises Violation
resolvable_public_ip?	true	false	false	false

resolvable_public_ip? still answers false either way — a predicate answers the question it was asked and doesn't raise.

This is also where a guard built on Resolv.getaddress used to raise Resolv::ResolvError, so callers migrating from one keep a distinction they already had rather than silently losing it.

Two bugs the tests turned up

The resolver's ResolvError rescue was dead code. Resolv.getaddresses sat inside the rescue IPAddr::InvalidAddressError clause that detects an IP literal, and sibling rescue clauses don't catch each other — so the rescue Resolv::ResolvError, Resolv::ResolvTimeout below it could never fire. Only reachable through a resolver configured to raise timeout errors, so nothing was breaking today, but it read as protection it wasn't providing. The literal check moves into its own method and the DNS call moves back into the body where the rescue reaches it.

A blank host resolved to nothing instead of being refused. URI#host is "" for "http://", not nil, so it slipped past host_of and came back as a failed lookup. There was never a name to look up — that's malformed, and it now says so.

Compatibility

Breaking for anyone relying on resolve_public_ip/resolve_public_ips returning nil/[] for an unresolvable host, or on enforce_public_ip raising Violation for one. Rescuing Unresolvable alongside Violation restores the old behavior exactly.

63 tests green on the existing suite plus the new cases.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.