Brief: P7 edge-door plan, review round 4

Rounds 1–3 are CODEX-FINDINGS-P7-EDGE-DOOR.md, -R2.md and -R3.md beside the plan. The plan is now revision 4. After your round 3, Paul ruled that the door believes no caller-supplied visitor address. That ruling is recorded in the design record's §0 on docs-instance-moves-design and in the plan's rewritten Security model, and it is fixed.

1. Disposition table for round 3's four findings: closed / partly / not closed.
2. Try again to falsify the plan's claim that the door now grants no privilege over the public door. Check what the app, the gate, analytics, the cache and the far edge of a backhaul see for a door request, with RemoteAddr set to door/<account>/<app> and the forwarded headers as Task 5's setForwarded branch sets them. Look for any code that parses RemoteAddr and misbehaves on a value with no port.
3. Then only new findings, ranked P1/P2/P3.

Check every path:line you cite. End with one line saying whether the plan is ready to build. Keep it under about 1,000 words.