You've CBSubs controlling usergroups, but you want it to remove the previous usergroup? CBSubs won't do that unless the previous usegroup is also being controlled by a plan that has become inactive. The alternative is to act on the CBSubs subscription states using CB Auto Actions and let CB Auto Actions handle the usergroups. You can do this by using the following.

Plan Active
Triggers: onCPayUserStateChange
User: Automatic
Access: Everybody
Conditional 1: [var3] Equal To PLAN_ID_HERE
Conditional 2: [var2] Equal To A

Plan Expired
Triggers: onCPayUserStateChange
User: Automatic
Access: Everybody
Conditional 1: [var3] Equal To PLAN_ID_HERE
Conditional 2: [var2] Equal To X

Now you can use the Usergroup action and replace, add, or remove usergroups as needed.

CBSubs is already configured to move expired memberships to register; is the second auto-action necessary?

I wouldn't combine the 2 usages. User CB Auto Actions or CBSubs to control usergroups. I don't recommend trying to use both at the same time.

And, the [var3] is hardcoded to refer to plan ID, correct? Likewise [var2] is intended to show active or inactive by A and X respectively?

Yes.

Finally, once this is done, I can just run the auto action to clean everything up--is that right?

No, those triggers are fired when their subscription state changes. It'd all be automated when someone subscribes or expires.

If you're using free lifetime plans then ensure you've configured free lifetime plans to create subscriptions within CBSubs > Settings > Global otherwise that trigger won't fire for them as they won't have a subscription state to act on. You also need to change PLAN_ID_HERE to the actual plan id, which is the number under the ID column in CBSubs > Plans and not the number under #. So for example if you had a plan with an ID of 4 you'd have exactly the below.

Plan Active
Triggers: onCPayUserStateChange
User: Automatic
Access: Everybody
Conditional 1: [var3] Equal To 4
Conditional 2: [var2] Equal To A

Plan Expired
Triggers: onCPayUserStateChange
User: Automatic
Access: Everybody
Conditional 1: [var3] Equal To 4
Conditional 2: [var2] Equal To X

The above trigger is in the dropdown as "User State Change". Just start typing it and it should filter the dropdown to it.