`user.email` is unique byte-for-byte only, so `Alice@corp.com` and
`alice@corp.com` can both exist as separate accounts. Every identity binding in
the product compares the case-folded address, so those two rows are one identity
to it: a credential-group enrollment for either matches both, and each account
receives the `s:` subject token of a managed credential belonging to the other.
That is live on the members-mode path today, and it is the same fold the `u:`
document token depends on.

`user_email_lower_unique` is the constraint that makes the state unreachable —
the standard Postgres form of a case-insensitive unique email, on
`lower(btrim(email))`. Access resolution probes that exact expression, so a
predicate written any other way would silently become a sequential scan of
`user` on every read; verified as an index scan against a real database.

The migration pre-checks for duplicates inside the runner's batch transaction,
so a database that already holds one fails the deploy with a sentence naming the
problem and rolls back having changed nothing. Without that check the concurrent
build would fail on the first duplicate and leave an INVALID index that
`IF NOT EXISTS` skips on every later run — the constraint would appear to exist
while enforcing nothing, which is the one outcome worth engineering against.
Both paths were verified against a real database in rolled-back transactions:
the index builds on current data, and a deliberately inserted case-variant
duplicate raises and rolls back.

Access resolution keeps its own ambiguity check rather than trusting the
constraint to still be there. An index can be dropped during an incident, and a
restore can bring back a database built before it existed; neither should
silently hand one person another's documents. An ambiguous address binds to
nothing, so both accounts keep the tokens every workspace member holds and lose
only what their identity would have granted.

The enrollment join also stops reading `normalized_email`. That column is
declared unique but written by nothing, so the `COALESCE` over it always fell
through to the folded address — and would have silently started matching a
broader set of people the day anything backfilled it.