Looking at the masto status and account update services, and the account move service, it's not entirely clear to me why it should be forbidden to update the uri and username fields - that seems like it's implicitly allowed by the ActivityStreams Move action, and AS requires that all objects have an absolute URI as an id but doesn't specify that they can never change. Neither does ActivityPub. ActivityPub actually specifies that an Update should completely replace the old object and so it should be possible to replace the URI/id.