Job flow 1a · task:billing-cycle — checks before charging Diagram

Queued by: admin activation (cycle 1, delayed to the first period end); settlement follow-up after each paid renewal (next cycle at the new period end); Stripe TOKEN_SAVED (delay 0: the cycle-0 first charge, or a PAST_DUE recovery charge); an upgrade that changes the interval (job replaced at the new period end); task:billing-cycle-reconciliation (lost job). Job ID billing-cycle-<sub>-<cycle>, attempts 1.
Status + cycle check: cycle 0 runs only for UNPAID or PAYMENT_FAILED; cycle ≥ 1 only for ACTIVE or PAST_DUE. The job's cycle must equal subscriptions.billingCycleNumber, otherwise it is a stale job and does nothing.
Period check: an ACTIVE subscription (cycle ≥ 1) whose currentPeriodEnd is still ahead is moved back to delayed until that time. PAST_DUE and cycle 0 run at once.
Cancel flag: beginCancellationGracePeriod → status CANCELLED, expiryDate = now + grace (7 / 15 / 30 days by interval), grace-warn-3d, grace-warn-1d and grace-final queued, email 'Your Paid Access Has Ended'. No charge. The job ends here.
Scheduled downgrade: planId, assetsReqCount, interval, intervalDays and lockedPriceAmount switch to the downgrade; discountAmountPerCycle recomputed (percentage follows the new price, fixed stays); pushed price cleared; downgrade fields cleared; agents marked pendingRemoval are deleted (asset_logs) and admins get 'Action Required: Remove Agents from the SIEM Server (Downgrade)'. Then the charge step runs with the new price.