Brief: P7 edge-door plan, review round 5 (confirming)

Rounds 1–4 are the CODEX-FINDINGS-P7-EDGE-DOOR*.md files beside the plan. The plan is now revision 5 and folds in round 4.

1. Disposition table for round 4's four findings: closed / partly / not closed.
2. Check the new representation only: X-Forwarded-For: 192.0.0.8 (RFC 7600), the alternate-header strip list, the cache bypass, and the stated degraded mode. Does any common framework's client-address resolution (Rails, Django, Express trust proxy, Laravel TrustProxies, Go's realip-style middleware) resolve a door request to loopback, a private address, or a caller-chosen value? Is the strip list missing a header one of them consults?
3. New findings only where they are P1 or P2. This round is to confirm the plan can be built, so leave P3 polish out.

Check every path:line you cite. End with one line saying whether the plan is ready to build. Keep it under about 800 words.