On the first live plan change the payment went through, the subscription row was correct, and every screen still answered “not included in your current plan”. The role that carries a plan's permissions was attached from the wrong scope, and the attach reported success, so nothing looked wrong anywhere. Plan roles are attached in the account's own scope now, and a failure is loud.