Job flow 8 · task:final-deactivation Diagram

Queued at the same moments as grace-warning. Job ID grace-final-<sub>, delay = grace length (monthly 7, quarterly 15, yearly 30 days; trial: until trialEnd + 7 days). attempts 3 with backoff.
Still in grace: status must still be ENDED, CANCELLED, PAST_DUE or PENDING_REAUTH. Paying or renewing inside grace removes the job; if it runs anyway it does nothing.
Delete agents: every assets row of the subscription gets an asset_logs entry (action REMOVED, reason 'Trial Expiry' or 'Cancellation/Payment Failure') and is deleted. Admins get 'Action Required: Remove Agents from the SIEM Server: <company> (<reason>)' with the agent list. The SIEM/Wazuh server is not changed.
If any agent could not be deleted the job throws before the status changes; BullMQ retries it and the retry deletes the rest.
Move to EXPIRED. Customer: 'Service Deactivation: Data Permanently Removed'. Admins: 'Subscription Expired: <company>'. EXPIRED gives profile and subscription (buy new) only.
Switch workspace: ensureUserHasDefaultSubscription moves the owner's currentSubscriptionId to another owned non-EXPIRED subscription, else to an ACTIVE/TRIALING team membership, else null.