Verified server identity, persistent member/customer mapping, database authorization, authenticated billing sessions, verified payment events with replay/retry handling, and provider sandbox acceptance tests. Clerk, Supabase, Stripe, email and analytics are not connected in this sample. The paid/grace access policy would be agreed with the product owner.