[PM-39431] feat: Implement SendInvoicePriceMigrationJob

[cyprain-okeke]

🎟️ Tracking

PM-39431

📔 Objective

send_invoice organizations never emit Stripe's invoice.upcoming event (PM-38728), so UpcomingInvoiceHandler never schedules their business-plan price migration and they would renew at the old price without notice. This adds SendInvoicePriceMigrationJob — a daily (08:00 UTC), cloud-only Quartz sweep that:

1. Early-returns (with one trace log) when the new PM38728_SendInvoicePriceMigration flag is off.
2. Selects candidates via GetSendInvoiceCandidatesInWindowAsync(7, 15) (PM-39236's repository method — active cohort, not migrated, not yet complete, gateway IDs present, ExpirationDate in window).
3. Re-verifies each candidate against the live subscription — collection_method == send_invoice and GetCurrentPeriodEnd() still in the 7–15 day window, using TestClock.FrozenTime when present so test-clock subscriptions evaluate correctly (Organization.ExpirationDate is Admin-Portal-editable and can drift).
4. Delegates the schedule → notify → stamp flow to IBusinessPlanMigrationCoordinator ([PM-39430] Extract shared business-plan migration coordinator #8050), so the webhook and sweep paths cannot drift. The job maps the five BusinessPlanMigrationResult states to deliberate log severities (CompletedWithoutNotification → Error with a last-retry-day escalation, since re-selection ends when the org exits the window).
5. Processes up to 10 organizations concurrently with per-item error continuation (StripeException logged with StripeError.Code); shutdown cancellation logs partial counters at Warning instead of a spurious error.

Stacked PR: based on #8050's branch; only the four files above are new — no files owned by #8050 are touched. Coupling surface is ExecuteAsync(Organization, Subscription) + the result enum.

Deviations from the ticket's technical breakdown (contract drift, both discussed on the ticket): IBusinessPlanMigrationProcessor.ProcessAsync shipped as IBusinessPlanMigrationCoordinator.ExecuteAsync in #8050; IFeatureService.IsEnabledAsync doesn't exist (synchronous IsEnabled). The skeleton's defensive GatewayCustomerId re-check is deliberately omitted — nothing downstream reads it (the scheduler works off subscription.CustomerId).

Testing: 24 unit tests (selection args, all re-check skips incl. exact 7/15-day boundaries via frozen clock, coordinator delegation, expansion pinning, concurrency bounds, per-item continuation, summary counters, log-severity pins). Also verified end-to-end locally against a real Stripe test clock: happy path (2-phase schedule, both stamps, renewal email with plan-derived total), email-retry (re-send without re-scheduling), collection-method flip skip, selection variants against the real sproc, and flag-off no-op.

Pre-merge checklist:

• LaunchDarkly flag pm-38728-send-invoice-price-migration created, default off in all environments
• Rollout note: the flow also requires PM35215_BusinessPlanPriceMigration on — with only PM38728 enabled, every candidate logs a daily NotScheduled warning and burns a Stripe call
• QA environment has migration 2026-07-23_02_AddRenewalNotificationSentDate… applied (sweep depends on PM-39236's column + sproc)
• [PM-39430] Extract shared business-plan migration coordinator #8050 merged → rebase onto main, re-run dotnet test test/Billing.Test, undraft

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Re-reviewed at ddf37c4, whose only delta since the previous approving pass is using var semaphore in ExecuteJobAsync — the fix for the github-code-quality "Missing Dispose call" thread. The disposal is safe: semaphore.WaitAsync(context.CancellationToken) sits outside the try, so a cancelled waiter never reaches finally { semaphore.Release(); }, and Task.WhenAll does not complete until every started task has finished, so no Release can land after Dispose. The rest of the job is unchanged from the reviewed state — churn-only cohort guard, non-renewing subscription guard, per-item error boundaries, shutdown cancellation handled off the error channel, discounts.coupon / customer.discount / test_clock expansions, and identifier-only logging all still hold; no security, correctness, or breaking-change findings at ≥75 confidence.

Code Review Details

No findings. Notes carried forward, informational only:

• The remaining open github-code-quality thread on the generic catch (Exception) at src/Billing/Jobs/SendInvoicePriceMigrationJob.cs:106-113 is the deliberate per-item error boundary the comment above it describes — one organization's failure must not abandon the sweep, and both the counter and the log capture it. No change recommended.
• The trigger "0 0 8 * * ?" has no InTimeZone, so it fires at 08:00 in the scheduler's local time rather than strictly 08:00 UTC as the description states. This matches existing fixed-hour triggers in the repo (src/Api/Jobs/JobsHostedService.cs, src/Admin/Jobs/JobsHostedService.cs) and is immaterial against a 7–15 day window.
• Pre-merge checklist from the PR description: the #8050 rebase item is satisfied (base is main, coordinator present). The LaunchDarkly flag pm-38728-send-invoice-price-migration (default off), the PM35215_BusinessPlanPriceMigration dependency, and the RenewalNotificationSentDate migration in QA remain unchecked.

[codecov]

Codecov Report

❌ Patch coverage is 88.71795% with 22 lines in your changes missing coverage. Please review.
✅ Project coverage is 62.88%. Comparing base (8589031) to head (ddf37c4).

Files with missing lines	Patch %	Lines
src/Billing/Jobs/SendInvoicePriceMigrationJob.cs	92.02%	10 Missing and 5 partials ⚠️
src/Billing/Jobs/JobsHostedService.cs	0.00%	7 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8086      +/-   ##
==========================================
+ Coverage   62.83%   62.88%   +0.04%     
==========================================
  Files        2299     2300       +1     
  Lines      100138   100332     +194     
  Branches     9012     9030      +18     
==========================================
+ Hits        62923    63089     +166     
- Misses      35030    35051      +21     
- Partials     2185     2192       +7     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[amorask-bitwarden]

⛏️ In the unlikely scenario the schedule gets created, but we get a transient DB error following that, we'll be in a weird state that will hit this case. Might be worth using LogError here to make sure we're seeing it.

[cyprain-okeke]

addressed by commit 0a0a02a

[amorask-bitwarden]

❓ I think we might be missing a guard against churn-only cohorts here? Might be worth adding one:

var cohort = await cohortRepository.GetByIdAsync(assignment.CohortId);
if (cohort?.MigrationPathId is null)
{
    return false;
}

[cyprain-okeke]

addressed by commit 0a0a02a

[amorask-bitwarden]

The changes look good, but I have concerns around how this will be tested. As written, this job will only fire one time per day at 8 AM UTC.

We used to have a JobsController that @kdenney wrote up to test a previous job using an endpoint in lower environments. It was removed here: #7424

I think it would be worth bringing that back in this PR to make sure QA can test this job more than once a day given how complex it is and the due date on the work itself.

All you'd have to do is:

1. Add src/Billing/Controllers/JobsController.cs with [Route("jobs")], [SelfHosted(NotSelfHostedOnly = true)] and [RequireLowerEnvironment], no shared secret — same shape as #6615.
2. Add TriggerJobNowAsync<T>() to BaseJobsHostedService calling _scheduler.TriggerJob(new JobKey(typeof(T).FullName!)), and call that from the controller instead of RunJobAdHocAsync.
3. Add [DisallowConcurrentExecution] to SendInvoicePriceMigrationJob.