# Brief: P7 edge-door plan, review round 4

Rounds 1–3 are `CODEX-FINDINGS-P7-EDGE-DOOR.md`, `-R2.md` and `-R3.md` beside
the plan. The plan is now revision 4. After your round 3, Paul ruled that the
door believes no caller-supplied visitor address. That ruling is recorded in
the design record's §0 on `docs-instance-moves-design` and in the plan's
rewritten **Security model**, and it is fixed.

1. **Disposition table** for round 3's four findings: closed / partly / not closed.
2. **Try again to falsify the plan's claim that the door now grants no privilege over the public door.** Check what the app, the gate, analytics, the cache and the far edge of a backhaul see for a door request, with `RemoteAddr` set to `door/<account>/<app>` and the forwarded headers as Task 5's `setForwarded` branch sets them. Look for any code that parses `RemoteAddr` and misbehaves on a value with no port.
3. **Then only new findings,** ranked P1/P2/P3.

Check every `path:line` you cite. End with one line saying whether the plan is ready to build. Keep it under about 1,000 words.