1.0.0-beta4 Access-control, hardening and compatibility release (roadmap Phase 1, #3616939): - CRITICAL: role revocation now works from a granted_roles snapshot recorded at grant time, never a live plan lookup, so a deleted or renamed plan can no longer leave users with paid access indefinitely (#3616929; update 10014 installs and backfills the field; change record: https://www.drupal.org/node/3620566). - Admin collections, settings forms and Field UI now use the defined administer subscriptions / administer subscription plans permissions instead of four never-defined strings that locked them to user 1 (#3616930). - Fresh installs no longer fatal on the subscribe paths when default_connector is unset: a single installed connector is inferred as the default, pages redirect with a friendly message, and the subscribe-url/portal-url APIs return a documented 503 error shape (#3616932). The settings form's connector select is required and config/install ships every schema key. - Drupal 12 compatibility: hooks converted to a #[Hook] attribute class with injected services; connector plugins are discovered by PHP attribute with the annotation still supported; core_version_requirement fixed to ^10 || ^11 (#3603421). The || ^12 flip follows once tested against Drupal 12 betas. - Kernel test suite grown from 27 to 42 tests.