My understanding is that you cannot use CIDR notation in mod_rewrite because RewriteConds just do simple text-string/character comparisons (Is this correct?).
It depends on what Apache version you're on. I read somewhere-- but now can't find the definitive reference-- that 2.4 adds CIDR functionality to mod_rewrite. Be still my thundering pulse.
Back references refer to "the most recent MATCHED Condition". A group of [OR]-delimited conditions is functionally the same as a single pipe-delimited group. That is, if the first "OR" doesn't match, it simply doesn't count and mod_rewrite continues to the next condition in the set. (If you've got a package that can go either way, the [OR] version runs faster but the pipe version may be easier for a human to read. You can't win.)
For comparison purposes I tried this in my test site. If I request the page /detour.html, I should get redirected. On the surface it looks different from your ruleset, but the underlying structure is the same:
RewriteCond %{REQUEST_URI} !test-three
RewriteCond %{THE_REQUEST} (GET)\ (/[^.\s]+\.html)
RewriteCond %1 HEAD [OR]
RewriteCond %2 detour
RewriteRule .* http://www.example.com/hoosegow/test-three.html [R=301,L]
(I could tell it was working when I got a browser error "infinite redirect loop" and hastily added the first Condition :)) Here it's skipping a non-matched Condition-- the HEAD line-- and continuing to the next Condition.
Deeper question: Are you certain that a RewriteMap is the most efficient way to achieve the result you want? I think most people would use mod_authz-whatsit in "Deny,Allow" order. A rule that potentially requires consulting the same map up to three times on every single request seems like a last-resort approach. At a minimum, you can probably constrain the rule to page requests; very few robots ask for images and stylesheets, and you've probably got hotlink code already. The Rule itself then says
RewriteRule (^|\.html|/)$ - [F]
substituting whatever extension(s) you actually use.
