v1.56.1 - inmobi 1.1.1: the usnat section comes back out

A correction to v1.56.0. inmobi-reject 1.1.0 wrote a GPP usnat section for tenants configured with MSPA. Measured against their own reject, from a New Zealand address, on the very tenant that prompted it - mspaJurisdiction: "STATE_AND_NATIONAL" - their IABGPP_HDR_GppString came back DBABMA: section 2 alone. 1.1.0 wrote DBACMMA with a US national section for that visitor.

The premise was wrong. coreConfig.mspaJurisdiction says which jurisdictions the tenant runs MSPA in, not where the visitor is. Their cmp2.js decides that from ||cmp.inmobi.com/geoip, which these filters noop, so a replaced CMP cannot learn it. The note 1.1.0 removed - that the US sections need a jurisdiction the page cannot tell us - was correct, and what replaced it read a tenant setting as a visitor fact. A usnat section written for a visitor outside those jurisdictions is a claim about a jurisdiction they are not in, which is worse than the silence it replaced.

The section is gone and the string is DBABMA~<tc string> again, as in 1.0.1.

The reason it went is now in the source, and so is the encoding: it was read off their own encodeUSString and checked byte for byte against @iabgpp/cmpapi, so anyone who finds a way to establish the visitor's jurisdiction does not have to derive it a second time - section 7, header DBACMMA alongside section 2, Version 2, six notice fields, three opt-out fields, 16 sensitive-data entries and 3 child ones, the 0/2/1 field convention, MspaCoveredTransaction from isCoveredTransaction, MspaOptOutOptionMode from mspaSignalMode, a flat 2 for MspaServiceProviderMode, a GPC segment with no bit of its own for being included, and a bit string padded to a whole byte before it is taken six bits at a time.

What v1.56.0 did that stands: the vendor list version still comes out of a returning visitor's own euconsent-v2 rather than a pin, with the pin behind it at 180. And transcend-reject 1.5.0 is unaffected - it still writes a refusal where their object is absent, which is every $redirect= install.

1036 tests.