Free HTTP input boundaries (RC6)

Mutations save/finish/audit require POST, capability and an action-specific 10-character string nonce. Missing/array/invalid nonces fail 403 before WordPress nonce helpers. Read-only authorized preview/order/account/diagnostic downloads remain available via GET. Permission denials are 403; malformed payload/ID is 400; mutating GET/HEAD is 405.

Order IDs: original decimal string or internal integer, 1..PHP_INT_MAX, no leading zero, whitespace, sign, fraction, suffix, percent corruption or array. Duplicate critical query keys are rejected (400), not resolved by last-value-wins. Ownership/editor capability and per-order/action nonce remain independent checks. Public Woo order number is still displayed, not used for authorization.

Wizard root: nonempty array, at most64 top-level keys, at least one known field in the selected step. Unknown keys/subtrees are ignored without traversing or unslashing. Known field arrays are rejected except a flat indexed language list of at most4 supported codes. No object/nested input is accepted. Invalid UTF-8 and NUL are rejected. All validation completes before option/Terms writes. Existing server-stored identical oversized values may round-trip unchanged; no migration or silent truncation occurs.

New scalar UTF-8 BYTE limits (not character counts):
2: admin_language, default_document_language
4: establishment
32: postcode, returns_postcode, supplier_relationship, contract_formation_mode
64: registration_number, tax_id, vat_number, phone, complaints_phone, returns_phone, contract_formation_status
128: customer_email_id, basic_pdf_email_id, contract_formation_provider
254: email, complaints_email, returns_email, separate_supplier_email
256: city, returns_city, returns_country
512: legal_name, registered_name, registration_authority, returns_recipient, separate_supplier_name
2048: site, address, returns_address, returns_street
8192: legacy complaints_contact, returns_contact
Address/street fields retain legitimate newlines through sanitize_textarea_field. Existing approved legal/catalog texts and historical documents are not subjected to these new form limits.

Checkbox false: false,0,"0","off","false","no","" or absent.
Checkbox true: true,1,"1","on","true","yes". Other types/values rejected.
Enums: existing language/establishment/supplier/formation allowlists and eligible email/status/provider validation remain authoritative; no new legal rules.

Read-only navigation/notice flags are escaped display hints, not authorization. Notice/asset isolation uses actual WordPress screen hook identity. Fixed SQL table identifiers remain an internal allowlist, with prepared values/WP/Woo APIs. Private temporary PDFs remain random-path/0600 and cleanup-bounded; no arbitrary URL/file input or new upload/REST/AJAX endpoint is introduced.
