Rounds 1–4 are the `CODEX-FINDINGS-P7-EDGE-DOOR*.md` files beside the plan.
4
The plan is now revision 5 and folds in round 4.
5
6
1. **Disposition table** for round 4's four findings: closed / partly / not closed.
7
2. **Check the new representation** only: `X-Forwarded-For: 192.0.0.8` (RFC 7600), the alternate-header strip list, the cache bypass, and the stated degraded mode. Does any common framework's client-address resolution (Rails, Django, Express `trust proxy`, Laravel TrustProxies, Go's `realip`-style middleware) resolve a door request to loopback, a private address, or a caller-chosen value? Is the strip list missing a header one of them consults?
8
3. **New findings only** where they are P1 or P2. This round is to confirm the plan can be built, so leave P3 polish out.
9
10
Check every `path:line` you cite. End with one line saying whether the plan is ready to build. Keep it under about 800 words.
amadan