35 "summary": "Gate on ROW COUNT, never on plugin presence. This plugin can be installed and active on a store whose invoices are actually issued and numbered by the payment provider or an external accounting system, in which case its own tables and meta keys hold ZERO rows. This plugin's invoice-number key can sit at 0 rows while the provider has issued and numbered the documents. An installed invoicing plugin is not evidence that this plugin issued anything."
36 },
37 {
38 "code": "number-without-a-document",
39 "severity": "warning",
40 "summary": "An invoice NUMBER is not an invoice DOCUMENT. This plugin renders PDFs on demand rather than storing one file per order, so a store can carry numbers with no durable file anywhere. Where only a number exists, carry it as a reference on the imported order and create nothing: re-rendering a historical tax document produces a second body under the same legal identifier."
45 "summary": "Where this plugin DOES keep files, they sit under the site's own uploads directory. Those bytes die with the source site, so they are the one case preserved without asking the merchant. Classify every discovered document URL by host before fetching it -- a discovered URL is untrusted input."
46 }
47 ]
48 }
49 ],
50 "quirks": [
51 {
52 "code": "key-names-vary-by-version-and-fork",
53 "severity": "warning",
54 "summary": "Invoice meta key names differ across versions, forks and the Professional extension, and other issuers use their own entirely (a provider key can differ from another version's only by a trailing capital letter). Discovery therefore matches key FAMILIES -- invoice-number, invoice-document, document-address, invoice-type -- rather than the exact names listed here, and reports families it finds but does not recognize."