Good call on not trusting the success page, since "cards get declined three days later" is exactly where tutorials stop. The step I'd add after storing past_due is telling the customer: on invoice.payment_failed, send an email with a link to update the card, then let access follow the status when Stripe finishes retrying.