Known limitations
This reflects the implementation today; see TASKS.md for the backlog.
- Concurrent changes to one subscription are serialized by a lock; a request that finds it held returns
409 subscription_lockedand can be retried. - Combined card/plan updates still price/charge using the previous subscription card (audit M13). Change the default card in a separate successful request before submitting a paid upgrade.
- No credit balance, so mid-period downgrades need
proration_behavior: "none". - Rate limits depend on the shared primary database. An unavailable counter store rejects requests with 503; limits must be configured consistently across replicas.
- Live acceptance is incomplete. Production authentication and hosted zero-RON creation/status passed. Cardholder authentication, token issuance, real callback delivery, paid MIT settlement and unknown-ID recovery remain unverified. See NETOPIA.md.