One address is one user within an instance, not globally, so an account's people can be projected into every instance they are granted. The replacement index is created before email_1 is dropped, so a failure at any point leaves a working constraint. The drop is idempotent and tolerates two services racing it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>