Solid write-up — the on delete set null detail is the one most implementations miss, and the two-session race test on the unique index is the right way to prove the design.

One hard-won edge worth calling out: the claim key is permanent, and dot-collapsing makes a typo burn the real mailbox. If I fat-finger my own signup as jan.edoe@gmail.com, janedoe@gmail.com is taken forever — and when the actual owner of janedoe@gmail.com signs up, they land at zero with no trial and no self-serve path back. The cost of a false match here isn't just "one account without credits," it can silently deny the mailbox's real owner. Worth surfacing which key blocked the grant, or adding a support-side action to release a claim row, because this becomes a support ticket in the first week.

Sharp question: the key only collapses dots for gmail.com, but Google Workspace domains ignore dots too — and you can't enumerate Workspace domains statically. jane.doe@company.com and janedoe@company.com are different keys in this design while Google delivers both to the same inbox. Did you consider that hole, or is MX-checking at insert time too much dependency on the hot path?