This is a really clear write-up of a trap that is easy to fall into. The part that stood out to me is that the two bugs pointed in opposite directions at the same time — expired subscribers quietly keeping unlimited Pro while a customer with a failed card lost access on the first retry. That asymmetry is exactly why billing bugs are so hard to notice from the outside. Making one pure function decide entitlement with the clock passed in is a neat fix, and the test that walks every Lemon Squeezy status so the two lists cannot drift apart again is the part I will be borrowing. Thanks for laying out the status table so plainly — the cancelled-until-ends_at distinction alone is worth remembering.