@@ -702,6 +702,36 @@ async function forfeitFreeTierAllowance(userId: string): Promise<void> {
   logger.info('Withheld the free allowance from a returning deleted-account identity', { userId })
 }
 
+/**
+ * Withholds the free allowance from a `user_stats` row the caller just created
+ * in `tx`, when the user's email belongs to an account deleted within the
+ * retention window: the email-only check {@link ensureUserStatsExists} makes for
+ * its fallback row, on the caller's transaction so the row never commits
+ * holding an allowance it should not. Call it only when the insert created the
+ * row, so an existing row costs nothing. Runs in a savepoint and fails open: a
+ * failure leaves the row eligible and the caller's transaction intact.
+ */
+export async function withholdFreeAllowanceFromCreatedStatsRow(
+  tx: DbOrTx,
+  userId: string
+): Promise<void> {
+  if (!(await userHasDeletedAccountIdentity(userId, { includeSignIns: false }, tx))) return
+  try {
+    await tx.transaction(async (savepoint) => {
+      await savepoint
+        .update(userStats)
+        .set({ freeTierEligible: false })
+        .where(eq(userStats.userId, userId))
+      await syncUsageLimitsFromSubscription(userId, savepoint)
+    })
+    logger.info('Withheld the free allowance from a returning deleted-account identity', {
+      userId,
+    })
+  } catch (error) {
+    logger.error('Failed to withhold the free allowance from a new stats row', { userId, error })
+  }
+}
+
 /**
  * Syncs the user's personal billing pool from their exact personal subscription.
  * Organization subscriptions have a separate pool and never clear personal limits.
 
@@ -29,7 +29,10 @@ import {
   invalidateSecurityPolicyVersionCache,
 } from '@/lib/auth/security-policy'
 import { applySessionPolicyToNewMember } from '@/lib/auth/session-policy'
-import { syncUsageLimitsFromSubscription } from '@/lib/billing/core/usage'
+import {
+  syncUsageLimitsFromSubscription,
+  withholdFreeAllowanceFromCreatedStatsRow,
+} from '@/lib/billing/core/usage'
 import {
   assertNoUnresolvedEnterpriseIssuance,
   resolveEnterpriseMetadataIntent,
@@ -1935,14 +1938,18 @@ export async function transferOrganizationOwnership(
         .limit(1)
 
       if (oldStats) {
-        await tx
+        const createdStats = await tx
           .insert(userStats)
           .values({
             id: generateId(),
             userId: newOwnerUserId,
             usageLimitUpdatedAt: new Date(),
           })
           .onConflictDoNothing({ target: userStats.userId })
+          .returning({ id: userStats.id })
+        if (createdStats.length > 0) {
+          await withholdFreeAllowanceFromCreatedStatsRow(tx, newOwnerUserId)
+        }
 
         const overage = oldStats.billedOverageThisPeriod || '0'
         const overageNum = toNumber(toDecimal(overage))
 
@@ -24,6 +24,7 @@ import { isRecordLike } from '@sim/utils/object'
 import { and, asc, eq, inArray, sql } from 'drizzle-orm'
 import { maybeNotifyLimit } from '@/lib/billing/core/limit-notifications'
 import type { HighestPrioritySubscription } from '@/lib/billing/core/plan'
+import { withholdFreeAllowanceFromCreatedStatsRow } from '@/lib/billing/core/usage'
 import type { BillingEntity } from '@/lib/billing/core/usage-log'
 import type {
   ProjectStorageBillingContext,
@@ -771,7 +772,8 @@ export async function incrementAdmittedStorageUsageForBillingContextInTx(
  * matches 0 rows, and therefore reads as "quota exceeded", if that row
  * doesn't exist yet. `ensureUserStatsExists` itself isn't reused here since
  * it writes through the standalone `db` client, which would open a second
- * pooled connection while this transaction's is held.
+ * pooled connection while this transaction's is held; a row created here gets
+ * its deleted-identity check on `tx` instead.
  */
 export async function checkAndIncrementStorageUsageInTx(
   tx: DbOrTx,
@@ -792,7 +794,7 @@ export async function checkAndIncrementStorageUsageInTx(
   const orgScoped = isOrgScopedSubscription(sub, userId) && sub
 
   if (!orgScoped) {
-    await tx
+    const created = await tx
       .insert(userStats)
       .values({
         id: generateId(),
@@ -801,6 +803,8 @@ export async function checkAndIncrementStorageUsageInTx(
         usageLimitUpdatedAt: new Date(),
       })
       .onConflictDoNothing({ target: userStats.userId })
+      .returning({ id: userStats.id })
+    if (created.length > 0) await withholdFreeAllowanceFromCreatedStatsRow(tx, userId)
   }
 
   const [updated] = orgScoped
 
@@ -17,6 +17,7 @@ import {
   handleNewUser,
   syncUsageLimitsFromSubscription,
 } from '@/lib/billing/core/usage'
+import { checkAndIncrementStorageUsageInTx } from '@/lib/billing/storage/tracking'
 import { getFreeTierLimit } from '@/lib/billing/subscriptions/utils'
 import { deleteUserAccount } from '@/lib/users/account-deletion'
 import { purgeExpiredDeletedAccountIdentities } from '@/lib/users/deleted-identity'
@@ -250,6 +251,28 @@ describe('deleted account identities and the free allowance', () => {
     expect(await statsOf(stranger)).toEqual({ freeTierEligible: true, limit: getFreeTierLimit() })
   })
 
+  it('withholds the allowance from a stats row a storage write creates', async () => {
+    const email = `storage.${generateId()}@deleted-identity.test`
+    await deleteOwnAccount(await signUp(email))
+    const returning = await insertUser(email)
+    const stranger = await insertUser(`storage-stranger.${generateId()}@deleted-identity.test`)
+    const store = (userId: string) =>
+      db.transaction((tx) => checkAndIncrementStorageUsageInTx(tx, null, userId, 1024))
+
+    const first = await store(returning)
+    const second = await store(returning)
+    await store(stranger)
+
+    expect([first.allowed, second.allowed]).toEqual([true, true])
+    expect(await statsOf(returning)).toEqual({ freeTierEligible: false, limit: 0 })
+    expect(await statsOf(stranger)).toEqual({ freeTierEligible: true, limit: getFreeTierLimit() })
+    const [stored] = await db
+      .select({ bytes: userStats.storageUsedBytes })
+      .from(userStats)
+      .where(eq(userStats.userId, returning))
+    expect(stored.bytes).toBe(2048)
+  })
+
   it('never withholds from a stats-less user’s fallback row for a sign-in linked in a later request', async () => {
     const microsoft = { providerId: 'microsoft', accountId: `ms-${generateId()}` }
     await deleteOwnAccount(await signUp(`ms-gone.${generateId()}@deleted-identity.test`, microsoft))
 
@@ -214,27 +214,45 @@ export async function recordDeletedAccountIdentities(tx: DbOrTx, userId: string)
   }
 }
 
+async function findDeletedIdentityMatch(
+  executor: DbOrTx,
+  identity: SignInIdentity
+): Promise<boolean> {
+  const hashes = identityHashes(identity)
+  if (hashes.length === 0) return false
+  const [match] = await executor
+    .select({ identityHash: deletedAccountIdentity.identityHash })
+    .from(deletedAccountIdentity)
+    .where(
+      and(
+        inArray(deletedAccountIdentity.identityHash, hashes),
+        gt(deletedAccountIdentity.expiresAt, sql`now()`)
+      )
+    )
+    .limit(1)
+  return Boolean(match)
+}
+
+/**
+ * Runs a lookup on `executor`. Inside a caller's transaction it runs in a savepoint, so a failed
+ * lookup rolls back only itself instead of aborting the caller's transaction.
+ */
+function readIdentity<T>(executor: DbOrTx, read: (reader: DbOrTx) => Promise<T>): Promise<T> {
+  return executor === db ? read(db) : executor.transaction(read)
+}
+
 /**
  * Whether any of these identities belonged to an account deleted within the
  * retention window. Fails open: a lookup error returns `false` and is logged,
  * because refusing a legitimate person's allowance is worse than one missed match.
  */
-export async function isDeletedAccountIdentity(identity: SignInIdentity): Promise<boolean> {
+export async function isDeletedAccountIdentity(
+  identity: SignInIdentity,
+  executor: DbOrTx = db
+): Promise<boolean> {
   if (!isBillingEnabled) return false
   try {
-    const hashes = identityHashes(identity)
-    if (hashes.length === 0) return false
-    const [match] = await db
-      .select({ identityHash: deletedAccountIdentity.identityHash })
-      .from(deletedAccountIdentity)
-      .where(
-        and(
-          inArray(deletedAccountIdentity.identityHash, hashes),
-          gt(deletedAccountIdentity.expiresAt, sql`now()`)
-        )
-      )
-      .limit(1)
-    return Boolean(match)
+    return await readIdentity(executor, (reader) => findDeletedIdentityMatch(reader, identity))
   } catch (error) {
     logger.error('Deleted-identity lookup failed; granting the free allowance', { error })
     return false
@@ -246,16 +264,20 @@ export async function isDeletedAccountIdentity(identity: SignInIdentity): Promis
  * the retention window: always its email, and its linked social sign-ins only
  * when `includeSignIns` is set, which callers do only for a user created in the
  * current signup request (a sign-in linked later never withholds anything).
- * Fails open like {@link isDeletedAccountIdentity}.
+ * Pass the caller's transaction as `executor` to read on it. Fails open like
+ * {@link isDeletedAccountIdentity}.
  */
 export async function userHasDeletedAccountIdentity(
   userId: string,
-  { includeSignIns }: { includeSignIns: boolean }
+  { includeSignIns }: { includeSignIns: boolean },
+  executor: DbOrTx = db
 ): Promise<boolean> {
   if (!isBillingEnabled) return false
   try {
-    const identity = await loadSignInIdentity(db, userId)
-    return await isDeletedAccountIdentity(includeSignIns ? identity : { email: identity.email })
+    return await readIdentity(executor, async (reader) => {
+      const identity = await loadSignInIdentity(reader, userId)
+      return findDeletedIdentityMatch(reader, includeSignIns ? identity : { email: identity.email })
+    })
   } catch (error) {
     logger.error('Deleted-identity lookup failed; granting the free allowance', { userId, error })
     return false