Free 0.12.9 HTTP input boundaries — existing foundation and additive routes

Mutations save/finish/audit require POST, capability and an action-specific 10-character string nonce. Missing/array/invalid nonces fail 403 before WordPress nonce helpers. Read-only authorized preview/order/account/diagnostic downloads remain available via GET. Permission denials are 403; malformed payload/ID is 400; mutating GET/HEAD is 405.

Order IDs: original decimal string or internal integer, 1..PHP_INT_MAX, no leading zero, whitespace, sign, fraction, suffix, percent corruption or array. Duplicate critical query keys are rejected (400), not resolved by last-value-wins. Ownership/editor capability and per-order/action nonce remain independent checks. Public Woo order number is still displayed, not used for authorization.

Wizard root: nonempty array, at most64 top-level keys, at least one known field in the selected step. Unknown keys/subtrees are ignored without traversing or unslashing. Known field arrays are rejected except a flat indexed language list of at most4 supported codes. No object/nested input is accepted. Invalid UTF-8 and NUL are rejected. All validation completes before option/Terms writes. Existing server-stored identical oversized values may round-trip unchanged; no migration or silent truncation occurs.

New scalar UTF-8 BYTE limits (not character counts):
2: admin_language, default_document_language
4: establishment
32: postcode, returns_postcode, supplier_relationship, contract_formation_mode
64: registration_number, tax_id, vat_number, phone, complaints_phone, returns_phone, contract_formation_status
128: customer_email_id, basic_pdf_email_id, contract_formation_provider
254: email, complaints_email, returns_email, separate_supplier_email
256: city, returns_city, returns_country
512: legal_name, registered_name, registration_authority, returns_recipient, separate_supplier_name
2048: site, address, returns_address, returns_street
8192: legacy complaints_contact, returns_contact
Address/street fields retain legitimate newlines through sanitize_textarea_field. Existing approved legal/catalog texts and historical documents are not subjected to these new form limits.

Checkbox false: false,0,"0","off","false","no","" or absent.
Checkbox true: true,1,"1","on","true","yes". Other types/values rejected.
Enums: existing language/establishment/supplier/formation allowlists and eligible email/status/provider validation remain authoritative; no new legal rules.

Read-only navigation/notice flags are escaped display hints, not authorization. Notice/asset isolation uses actual WordPress screen hook identity. Fixed SQL table identifiers remain an internal allowlist, with prepared values/WP/Woo APIs. Private temporary PDFs remain random-path/0600 and cleanup-bounded. The scalar/Wizard limits above are carried forward, not new legal-content restrictions.

Additive 0.12.9 routes: existing-original read/print actions use per-order
authorization and action nonces; confirmed original sending is POST-only,
capability/eligibility checked and governed by the durable submission ledger.
Operational PDF save/preview and the search/diagnose AJAX actions are Core
interoperability for authorized separate Pro, not standalone Free features.
They additionally require Pro access, settings/order capabilities, bounded
typed inputs and exact action nonces. Guests fail closed. The Core SDK is
not a REST/ERP service and introduces no arbitrary remote file download.
See docs/PDF-EXTENSION-DEVELOPER-API.md for the exact field/privacy budgets.

The optional operator QA-checkout action is disabled without the explicit
LMCC_QA_DOCUMENT_RECIPIENTS configuration allowlist. It requires an admin,
POST and its action nonce, marks only an explicitly prepared synthetic
checkout and rejects unapproved recipients. It is not a general permission
to send customer data to another address. Never use real customer data.

Original confirmation files are separate from temporary PDFs: local,
authenticated-encrypted, immutable objects with integrity-checked DB index.
They are not replaced by the current printout and are not exposed as public
file URLs. Back up the database, private files and their encryption key
together. No historical original is reconstructed by an account download.
