@@ -3,6 +3,7 @@ import { getErrorMessage } from '@sim/utils/errors'
 import { type NextRequest, NextResponse } from 'next/server'
 import { verifyCronAuth } from '@/lib/auth/internal'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { purgeExpiredDeletedAccountIdentities } from '@/lib/users/deleted-identity'
 import { runCleanupOAuthTokens } from '@/background/cleanup-oauth-tokens'
 
 export const dynamic = 'force-dynamic'
@@ -14,14 +15,22 @@ const logger = createLogger('CleanupOAuthTokensAPI')
  * Retention sweep for lapsed OAuth token rows. Issuance state does not gate
  * retention: a deployment that disables the provider must still drain rows
  * created while it was enabled.
+ *
+ * The same hourly run drains expired deleted-account identity digests first,
+ * within its own short budget, so they never outlive their retention window. A
+ * failed purge is logged and never holds up the token sweep.
  */
 export const GET = withRouteHandler(async (request: NextRequest) => {
   const authError = verifyCronAuth(request, 'OAuth token cleanup')
   if (authError) return authError
 
   try {
+    const deletedAccountIdentities = await purgeExpiredDeletedAccountIdentities().catch((error) => {
+      logger.error('Failed to purge expired deleted-account identities', { error })
+      return null
+    })
     const result = await runCleanupOAuthTokens()
-    return NextResponse.json({ success: true, ...result })
+    return NextResponse.json({ success: true, ...result, deletedAccountIdentities })
   } catch (error) {
     logger.error('Failed to sweep expired OAuth tokens', { error })
     return NextResponse.json(
 
@@ -211,7 +211,7 @@ describe('provisionScimUser', () => {
     expect(error.message).toContain('no available seats')
     expect(mocks.insertScimUser).not.toHaveBeenCalled()
     expect(mocks.reconcile).not.toHaveBeenCalled()
-    expect(mocks.deleteAccount).toHaveBeenCalledWith('u-new')
+    expect(mocks.deleteAccount).toHaveBeenCalledWith('u-new', { recordIdentity: false })
     expect(mocks.recordAudit).not.toHaveBeenCalled()
     expect(mocks.reconcileSeats).not.toHaveBeenCalled()
   })
@@ -221,7 +221,7 @@ describe('provisionScimUser', () => {
     mocks.insertScimUser.mockRejectedValue(new Error('lock timeout'))
     const error = await run(attributes()).catch((caught) => caught)
     expect(error.message).toBe('lock timeout')
-    expect(mocks.deleteAccount).toHaveBeenCalledWith('u-new')
+    expect(mocks.deleteAccount).toHaveBeenCalledWith('u-new', { recordIdentity: false })
   })
 
   it('never deletes a pre-existing account when linking fails', async () => {
 
@@ -242,7 +242,7 @@ export const provisionScimUser = defineAuthorizedScimUseCase({
        * directory's retry starts from a clean slate instead of a half-state.
        */
       if (createdAccount) {
-        await deleteUserAccount(userId).catch((cleanupError) =>
+        await deleteUserAccount(userId, { recordIdentity: false }).catch((cleanupError) =>
           logger.error('Failed to remove an account after provisioning was refused', {
             userId,
             cleanupError,
 
@@ -21,6 +21,7 @@ const hoistedMocks = vi.hoisted(() => ({
   billingSubscriptions: [] as unknown[],
   idempotencyCalls: [] as { namespace: string; requestFingerprint: string }[],
   moveWorkspace: vi.fn(),
+  userHasDeletedAccountIdentity: vi.fn(async () => false),
 }))
 
 vi.mock('@sim/audit', () => auditMock)
@@ -53,6 +54,9 @@ vi.mock('@/lib/billing/enterprise-outbox', () => ({
   resolveEnterpriseMetadataIntent: vi.fn(),
 }))
 vi.mock('@/lib/core/outbox/service', () => outboxServiceMock)
+vi.mock('@/lib/users/deleted-identity', () => ({
+  userHasDeletedAccountIdentity: hoistedMocks.userHasDeletedAccountIdentity,
+}))
 
 import { grantDashboardOrganizationBalance, grantDashboardUserBalance } from '@/lib/admin/dashboard'
 
@@ -150,6 +154,30 @@ describe('grantDashboardUserBalance', () => {
     )
   })
 
+  it('creates a missing stats row without the free allowance for a returning deleted identity', async () => {
+    mocks.userHasDeletedAccountIdentity.mockResolvedValueOnce(true)
+    queueTableRows(user, [{ id: 'user-1' }])
+    queueTableRows(userStats, [
+      { creditBalance: '0', currentUsageLimit: '0', freeTierEligible: false },
+    ])
+    mocks.billingSubscriptions = [null, null]
+    dbChainMockFns.returning.mockResolvedValueOnce([
+      { creditBalance: '0.005', currentUsageLimit: '0.005' },
+    ])
+
+    await grantDashboardUserBalance(
+      'user-1',
+      0.005,
+      undefined,
+      '4f0f5c4e-3a43-4f39-9d55-6b1b2f6f2a10',
+      { id: 'admin-1', name: 'Admin', email: 'admin@sim.ai' }
+    )
+
+    expect(dbChainMockFns.values).toHaveBeenCalledWith(
+      expect.objectContaining({ userId: 'user-1', freeTierEligible: false, currentUsageLimit: '0' })
+    )
+  })
+
   it('adds above a higher custom limit for an entitled personal subscription', async () => {
     const personalSubscription = {
       referenceId: 'user-1',
 
@@ -78,6 +78,7 @@ import { executeTransactionallyIdempotent } from '@/lib/core/idempotency/transac
 import { enqueueOutboxEvent } from '@/lib/core/outbox/service'
 import type { DbOrTx } from '@/lib/db/types'
 import { deliverRunStops } from '@/lib/mothership/request/application/stop-delivery'
+import { userHasDeletedAccountIdentity } from '@/lib/users/deleted-identity'
 import { ownedAttachableWorkspacesWhere } from '@/lib/workspaces/organization-workspaces'
 
 interface PaginationInput {
@@ -1497,6 +1498,14 @@ export async function grantDashboardUserBalance(
   actor: AdminMutationActor
 ) {
   const normalizedReason = reason?.trim() || null
+  /**
+   * Decides the eligibility of a stats row this grant may have to create, with
+   * the same email check as every other row creation. Looked up before the
+   * transaction so it never holds a second pooled connection inside it.
+   */
+  const freeTierEligibleIfCreated = !(await userHasDeletedAccountIdentity(userId, {
+    includeSignIns: false,
+  }))
   const outcome = await db.transaction(async (tx) => {
     await acquireUserBillingIdentityLock(tx, userId)
     const [account] = await tx
@@ -1518,13 +1527,14 @@ export async function grantDashboardUserBalance(
     const initialUsageLimit =
       initialMembership || isOrgScopedSubscription(initialSubscription, userId)
         ? null
-        : getPerUserMinimumLimit(initialSubscription).toString()
+        : getPerUserMinimumLimit(initialSubscription, freeTierEligibleIfCreated).toString()
     await tx
       .insert(userStats)
       .values({
         id: generateId(),
         userId,
         currentUsageLimit: initialUsageLimit,
+        freeTierEligible: freeTierEligibleIfCreated,
         usageLimitUpdatedAt: new Date(),
       })
       .onConflictDoNothing({ target: userStats.userId })
@@ -1533,6 +1543,7 @@ export async function grantDashboardUserBalance(
       .select({
         creditBalance: userStats.creditBalance,
         currentUsageLimit: userStats.currentUsageLimit,
+        freeTierEligible: userStats.freeTierEligible,
       })
       .from(userStats)
       .where(eq(userStats.userId, userId))
@@ -1566,7 +1577,9 @@ export async function grantDashboardUserBalance(
         }
 
         const grantDollarDelta = toDecimal(amountDollars).toString()
-        const usageLimitFallback = toDecimal(getPerUserMinimumLimit(billingSubscription))
+        const usageLimitFallback = toDecimal(
+          getPerUserMinimumLimit(billingSubscription, stats.freeTierEligible)
+        )
           .plus(toDecimal(stats.creditBalance))
           .toString()
         const nextUsageLimit =
 
@@ -93,7 +93,7 @@ import {
   syncSubscriptionPlan,
   writeBillingInterval,
 } from '@/lib/billing/core/subscription'
-import { handleNewUser } from '@/lib/billing/core/usage'
+import { handleNewSignInAccount, handleNewUser } from '@/lib/billing/core/usage'
 import {
   ensureOrganizationForTeamSubscription,
   syncSubscriptionUsageLimits,
@@ -405,7 +405,7 @@ export const auth = betterAuth({
           }
 
           try {
-            await handleNewUser(user.id)
+            await handleNewUser(user.id, context)
           } catch (error) {
             logger.error('[databaseHooks.user.create.after] Failed to initialize user stats', {
               userId: user.id,
@@ -651,7 +651,7 @@ export const auth = betterAuth({
 
           try {
             const { ensureUserStatsExists } = await import('@/lib/billing/core/usage')
-            await ensureUserStatsExists(account.userId)
+            await ensureUserStatsExists(account.userId, context)
           } catch (error) {
             logger.error('[databaseHooks.account.create.after] Failed to ensure user stats', {
               userId: account.userId,
@@ -660,6 +660,15 @@ export const auth = betterAuth({
             })
           }
 
+          try {
+            await handleNewSignInAccount(account, context)
+          } catch (error) {
+            logger.error('[databaseHooks.account.create.after] Deleted-identity check failed', {
+              userId: account.userId,
+              error,
+            })
+          }
+
           try {
             const [{ value: accountCount }] = await db
               .select({ value: count() })
 
@@ -22,6 +22,7 @@ import {
 } from '@/lib/billing/plan-helpers'
 import {
   ENTITLED_SUBSCRIPTION_STATUSES,
+  getFreeTierAllowance,
   getFreeTierLimit,
   getPlanPricing,
   hasPaidSubscriptionStatus,
@@ -276,6 +277,7 @@ export async function getPersonalBillingSummary(userId: string, executor: DbClie
           creditBalance: userStats.creditBalance,
           billingBlocked: userStats.billingBlocked,
           billingBlockedReason: userStats.billingBlockedReason,
+          freeTierEligible: userStats.freeTierEligible,
         })
         .from(userStats)
         .where(eq(userStats.userId, userId))
@@ -326,7 +328,7 @@ export async function getPersonalBillingSummary(userId: string, executor: DbClie
     const effectiveCurrentUsage = Math.max(0, toNumber(currentUsage) - refreshDeduction)
     const usageLimit = stats.currentUsageLimit
       ? toNumber(toDecimal(stats.currentUsageLimit))
-      : getFreeTierLimit()
+      : getFreeTierAllowance(stats.freeTierEligible)
     const percentUsed = usageLimit > 0 ? (effectiveCurrentUsage / usageLimit) * 100 : 0
     const isExceeded = effectiveCurrentUsage >= usageLimit
     const isWarning = !isExceeded && percentUsed >= 80