The integrity half is the one I keep underestimating. I used to think hiding the price list was the whole problem, then realized a tampered total on submit is worse if the server just trusts it. Sending the config and letting the server recompute on confirm is the version I would actually ship. The bit about a price change being a data change, not a deploy, would have saved me a few Friday releases.