@@ -544,6 +544,12 @@ export const ORGANIZATION_OWNERSHIP_INVENTORY: readonly InventoryEntry[] = [
   { object: 'sys_comment', census: P1, fate: 'attribution', citation: `${D3_ORG_ROWS}; a reply's parent comment carries the organization`, anchors: [parent('parent_id', 'sys_comment')] },
   { object: 'sys_comment_reaction', census: PMAIN, fate: 'attribution', citation: `${CENSUS_MAIN} (in reach); the reaction's comment carries the organization`, anchors: [parent('comment_id', 'sys_comment')] },
   { object: 'sys_email', census: P1, fate: 'attribution', citation: `${D7}: sys_email is stamped at its producers; the related record carries the organization`, anchors: [subject('related_object', 'related_id')] },
+  {
+    object: 'sys_identity_email',
+    census: PMAIN,
+    fate: 'column-drop',
+    citation: `${CENSUS_MAIN}: systemFields.tenant: false; ${D7}: sys_email's sibling for mail about a person (ruling record 6257510973, Q2 A)`,
+  },
   { object: 'sys_http_delivery', census: P1, fate: 'attribution', citation: `${D7}: a delivery is stamped from its webhook's organization`, anchors: [parent('ref_id', 'sys_webhook')] },
   {
     object: 'sys_webhook',
 
@@ -12,6 +12,7 @@
 export { SysNotification } from './sys-notification.object.js';
 export { SysAttachment } from './sys-attachment.object.js';
 export { SysEmail } from './sys-email.object.js';
+export { SysIdentityEmail } from './sys-identity-email.object.js';
 export { SysEmailTemplate } from './sys-email-template.object.js';
 // sys_saved_report / sys_report_schedule retired with the saved-report stack (#20102).
 // sys_approval_request / sys_approval_action moved to @objectstack/plugin-approvals (ADR-0029 K2.b).
 
@@ -0,0 +1,67 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+import { ObjectSchema } from '@objectstack/spec/data';
+import { SysEmail } from './sys-email.object.js';
+
+/**
+ * sys_identity_email — Outbound Identity Mail Log
+ *
+ * The deployment-level sibling of `sys_email` (ADR-0131 D7, ruling of record
+ * 6257510973, letter Q2 A). Identity mail is mail about a PERSON rather than
+ * an organization — verification, password reset, magic link, email-change
+ * notice, an account invitation to someone who belongs to no organization
+ * yet — so it has no organization to stamp. It lives here, with no
+ * organization column, instead of as an organization-less row in the tenant
+ * mail log: ⛔ neither a nullable column nor unpersisted mail.
+ *
+ * Same row shape as `sys_email` — the fields ARE `sys_email`'s, so the two
+ * cannot drift — and the same pipeline: `IEmailService.send` with
+ * `identityMail: true` writes the row, and the queue worker, the outbox drain
+ * hook, the boot outbox sweep and attachment reclamation read it by id and
+ * status exactly as they read `sys_email`.
+ *
+ * Expand-first: rows an 18.0 install wrote to `sys_email` for this mail stay
+ * there; the mail pipeline keeps reading them, and moving them is the 18.x
+ * upgrade ceremony's.
+ *
+ * `systemFields: { tenant: false }` removes the injected organization column.
+ * With no column there is no tenant wall, so who may read is object
+ * permission (D7): these rows carry password-reset and sign-in links, so the
+ * platform-only capability, as on `sys_job` — under a wall an organization's
+ * administrator must not read every person's links.
+ *
+ * Typical writers: `IEmailService.send()` / `sendTemplate()` with `identityMail: true`
+ * (plugin-auth's identity mails).
+ * Typical readers: the mail delivery pipeline, the platform administrator.
+ *
+ * @namespace sys
+ */
+export const SysIdentityEmail = ObjectSchema.create({
+  name: 'sys_identity_email',
+  label: 'Identity Email',
+  pluralLabel: 'Identity Emails',
+  icon: 'mail',
+  isSystem: true,
+  managedBy: 'append-only',
+  systemFields: { tenant: false },
+  requiredPermissions: ['manage_platform_settings'],
+  description: 'Outbound identity mail log — verification, password reset and sign-in mail about a person, not an organization',
+  displayNameField: 'subject',
+  nameField: 'subject', // [ADR-0079] canonical primary-title pointer (mirrors deprecated displayNameField)
+  titleFormat: '{subject}',
+  highlightFields: ['subject', 'to_addresses', 'status', 'sent_at'],
+
+  fields: SysEmail.fields,
+
+  indexes: [
+    { fields: ['status', 'created_at'] },
+    { fields: ['related_object', 'related_id'] },
+    { fields: ['sent_by'] },
+  ],
+
+  enable: {
+    // [ADR-0103] Engine-owned append-only mail log, as `sys_email`: written
+    // only by the mail service (SYSTEM_CTX). Reads behind the permission above.
+    apiMethods: ['get', 'list'],
+  },
+});
@@ -2008,7 +2008,9 @@ export class AuthManager {
           // the user's mail carries only the deployment default. Best-effort;
           // `undefined` leaves the #14319 ladder exactly as it was.
           const storedLocale = await this.storedRecipientLocale({ id: user.id });
-          const mailOrganization = await this.authMailOrganizationArg();
+          // [ADR-0131 D7, ruling of record 6257510973, Q2 A] Both mails are
+          // about a person, not an organization: identity mail, recorded in
+          // the deployment-level `sys_identity_email`, with no organization.
           const result = await email.sendTemplate(invitation
             ? {
               // Exactly the variables `auth.account_invitation` declares —
@@ -2028,7 +2030,7 @@ export class AuthManager {
               },
               relatedObject: 'sys_user',
               relatedId: user.id,
-              ...mailOrganization,
+              identityMail: true,
             }
             : {
               template: 'auth.password_reset',
@@ -2043,7 +2045,7 @@ export class AuthManager {
               },
               relatedObject: 'sys_user',
               relatedId: user.id,
-              ...mailOrganization,
+              identityMail: true,
             });
           if (result?.status === 'failed') {
             throw new Error(
@@ -2106,9 +2108,9 @@ export class AuthManager {
               },
               relatedObject: 'sys_user',
               relatedId: user.id,
-              // [ADR-0131 D9] The mail is about a user, who belongs to no
-              // organization yet: the derivable owner, as for the grant.
-              ...(await this.authMailOrganizationArg()),
+              // [ADR-0131 D7, Q2 A] The mail is about a person, who may belong
+              // to no organization yet: identity mail, in `sys_identity_email`.
+              identityMail: true,
             });
             if (result?.status === 'failed') {
               throw new Error(
@@ -3881,8 +3883,8 @@ export class AuthManager {
               relatedObject: 'sys_invitation',
               relatedId: invitation.id,
               // commit b706af987 — the invitation HOLDS its organization; thread it so
-              // the sys_email row is stamped. Org-less auth mail (reset /
-              // verification / magic link) deliberately threads nothing.
+              // the sys_email row is stamped: tenant mail. Mail about a person
+              // (reset / verification / magic link) is identity mail instead.
               ...(invitation.organizationId
                 ? { organizationId: String(invitation.organizationId) }
                 : {}),
@@ -4125,7 +4127,8 @@ export class AuthManager {
                 expiresInMinutes: 10,
                 appName: this.getAppName(),
               },
-              ...(await this.authMailOrganizationArg()),
+              // [ADR-0131 D7, Q2 A] A sign-in link for a person: identity mail.
+              identityMail: true,
             });
           } catch (err: any) {
             console.error(`[AuthManager] sendMagicLink failed: ${err?.message ?? err}`);
@@ -5630,31 +5633,6 @@ export class AuthManager {
     }
   }
 
-  /**
-   * [ADR-0131 D9] The organization a write this manager makes on a
-   * tenant-column object carries when nothing on the write names one: the
-   * Default Organization under `single` — the only organization there is —
-   * and none under a wall, where `tenancy.defaultOrgId()` answers `null`. One
-   * reading for every such producer here (the auth mails that are about a user
-   * rather than an organization), so they cannot disagree about it. `undefined` when no tenancy service is wired or
-   * it cannot answer: the producer then names nothing, as before.
-   */
-  private async derivableWriteOrganizationId(): Promise<string | undefined> {
-    try {
-      const tenancy = this.config.getTenancy?.();
-      const organizationId = tenancy ? await tenancy.defaultOrgId() : null;
-      return organizationId ?? undefined;
-    } catch {
-      return undefined;
-    }
-  }
-
-  /** The `organizationId` argument of an auth mail that is about a user, not an organization. */
-  private async authMailOrganizationArg(): Promise<{ organizationId?: string }> {
-    const organizationId = await this.derivableWriteOrganizationId();
-    return organizationId ? { organizationId } : {};
-  }
-
   /**
    * [ADR-0131 D3/D9 — the self-registration grant settles on the first
    * membership] The `user.create.after` half of an admitted self-registration.
@@ -5995,7 +5973,8 @@ export class AuthManager {
         },
         relatedObject: 'sys_user',
         ...(from.id ? { relatedId: from.id } : {}),
-        ...(await this.authMailOrganizationArg()),
+        // [ADR-0131 D7, Q2 A] A notice to the account holder: identity mail.
+        identityMail: true,
       });
     } catch (err) {
       // Best-effort by design — see the ⛔ above. Logged so an operator can see
 
@@ -80,12 +80,17 @@ import {
   type EmailAttachmentStore,
 } from './attachment-storage.js';
 import { withContentReclaimed } from './sys-email-payload.js';
+import { EMAIL_LOG_OBJECTS, TENANT_EMAIL_OBJECT, emailLogObjectOfJob } from './email-log-objects.js';
 
 /** System context — reclamation is platform bookkeeping, not a user query. */
 const SYSTEM_CTX = { isSystem: true, positions: [], permissions: [] } as const;
 
-/** Backing object; a constant so the query and the log lines agree. */
-export const RECLAIM_OBJECT = 'sys_email';
+/**
+ * Backing object of a job that names none — every job an 18.0 process
+ * published, and every `sys_email` job since. A `sys_identity_email` job
+ * names its log in the payload (`email-log-objects.ts`).
+ */
+export const RECLAIM_OBJECT = TENANT_EMAIL_OBJECT;
 
 /**
  * `sys_email.status` values after which content is never needed again.
@@ -188,18 +193,31 @@ export async function reclaimAttachmentContent(
 
   if (keys.length === 0) return { kind: 'noop', rowId };
 
+  // The log the row lives in. A payload naming something else is refused,
+  // not guessed: reading the wrong log finds no row, and "no row" is the
+  // branch below that DELETES the content.
+  const object = emailLogObjectOfJob(payload?.object);
+  if (!object) {
+    // Stalled, never re-armed: no later run can read a log the job does not name.
+    return rearmOrStall(
+      { ...opts, rearm: undefined }, rowId, 'mail', graceMs,
+      `the job names '${String(payload?.object)}', which is not a mail log (${EMAIL_LOG_OBJECTS.join(', ')}), `
+      + 'so the row its content belongs to cannot be read',
+    );
+  }
+
   if (!opts.store) {
     // The capability that HOLDS the bytes is not mounted on this process.
     // Deleting is impossible; re-arm so a process that has it can finish the
     // job, and say so if nothing can.
     return rearmOrStall(
-      opts, rowId, graceMs,
+      opts, rowId, object, graceMs,
       'the storage capability is not mounted on the process running the reclaim job, so the content '
       + 'cannot be deleted here',
     );
   }
 
-  const found = await opts.engine.find(RECLAIM_OBJECT, {
+  const found = await opts.engine.find(object, {
     where: { id: rowId },
     limit: 1,
     context: SYSTEM_CTX,
@@ -211,9 +229,9 @@ export async function reclaimAttachmentContent(
   // them from the payload's own key list is what makes row deletion incapable
   // of orphaning content — see the module header.
   if (!row) {
-    await deleteOrThrow(opts.store, keys, rowId, 'the sys_email row no longer exists');
+    await deleteOrThrow(opts.store, keys, rowId, object, `the ${object} row no longer exists`);
     opts.logger?.info?.(
-      `EmailServicePlugin: reclaimed ${keys.length} out-of-row attachment object(s) for sys_email row `
+      `EmailServicePlugin: reclaimed ${keys.length} out-of-row attachment object(s) for ${object} row `
       + `'${rowId}', which no longer exists — the content had no remaining reference.`,
     );
     return { kind: 'orphan-reclaimed', rowId, keys };
@@ -223,8 +241,8 @@ export async function reclaimAttachmentContent(
   const status = String(row.status ?? '');
   if (!TERMINAL_EMAIL_STATUSES.includes(status)) {
     return rearmOrStall(
-      opts, rowId, graceMs,
-      `the sys_email row is still at '${status || '(unset)'}', so its content may still be needed for delivery`,
+      opts, rowId, object, graceMs,
+      `the ${object} row is still at '${status || '(unset)'}', so its content may still be needed for delivery`,
     );
   }
 
@@ -236,8 +254,8 @@ export async function reclaimAttachmentContent(
   const age = msSinceLastChange(row, now);
   if (age !== undefined && age < graceMs) {
     return rearmOrStall(
-      opts, rowId, graceMs - age,
-      `the sys_email row was last updated ${Math.round(age / 1000)}s ago, inside the `
+      opts, rowId, object, graceMs - age,
+      `the ${object} row was last updated ${Math.round(age / 1000)}s ago, inside the `
       + `${Math.round(graceMs / 1000)}s reclaim grace window`,
     );
   }
@@ -248,19 +266,19 @@ export async function reclaimAttachmentContent(
   // very function that exists to prevent them. This order's failure mode is a
   // row that names a key which 404s, which is loud on read (the decoder
   // verifies) and fixed by the job's next attempt.
-  await deleteOrThrow(opts.store, keys, rowId, `the sys_email row is terminal ('${status}')`);
+  await deleteOrThrow(opts.store, keys, rowId, object, `the ${object} row is terminal ('${status}')`);
 
   const rewritten = withContentReclaimed(row.attachments_json, new Date(now).toISOString());
   if (rewritten !== undefined) {
     await opts.engine.update(
-      RECLAIM_OBJECT,
+      object,
       { id: rowId, attachments_json: rewritten },
       { context: SYSTEM_CTX },
     );
   }
 
   opts.logger?.info?.(
-    `EmailServicePlugin: reclaimed ${keys.length} out-of-row attachment object(s) for sys_email row `
+    `EmailServicePlugin: reclaimed ${keys.length} out-of-row attachment object(s) for ${object} row `
     + `'${rowId}' (status '${status}'). The row keeps filename/contentType/size/hash as audit evidence; only `
     + 'the delivery content was deleted.',
   );
@@ -272,12 +290,13 @@ async function deleteOrThrow(
   store: EmailAttachmentStore,
   keys: string[],
   rowId: string,
+  object: string,
   because: string,
 ): Promise<void> {
   const { failed } = await deleteAttachmentKeys(store, keys);
   if (failed.length === 0) return;
   throw new Error(
-    `reclaiming attachment content for sys_email row '${rowId}' (${because}) could not delete `
+    `reclaiming attachment content for ${object} row '${rowId}' (${because}) could not delete `
     + `${failed.length} of ${keys.length} storage object(s): `
     + failed.map((f) => `'${f.key}' (${f.error})`).join('; ')
     + '. Those bytes are still billed and no longer needed; the reclaim job will retry.',
@@ -288,6 +307,7 @@ async function deleteOrThrow(
 async function rearmOrStall(
   opts: ReclaimAttachmentContentOptions,
   rowId: string,
+  object: string,
   delayMs: number,
   reason: string,
 ): Promise<AttachmentReclaimOutcome> {
@@ -301,7 +321,7 @@ async function rearmOrStall(
   // for. That is the durability/consequence class AGENTS.md pins at `error`,
   // and the line owes both the consequence and the fix.
   opts.logger?.error?.(
-    `EmailServicePlugin: out-of-row attachment content for sys_email row '${rowId}' could NOT be reclaimed and `
+    `EmailServicePlugin: out-of-row attachment content for ${object} row '${rowId}' could NOT be reclaimed and `
     + `could NOT be rescheduled — ${reason}. Those storage objects will now stay in the backend forever unless `
     + 'they are deleted by hand. Fix: keep the durable queue service (@objectstack/service-queue over an '
     + 'ObjectQL engine) and the storage capability (@objectstack/service-storage) mounted on the process '
 
@@ -54,6 +54,7 @@ import {
   collectAttachmentParts,
   type PersistedEmailAttachment,
 } from './sys-email-payload.js';
+import type { EmailLogObject } from './email-log-objects.js';
 
 /**
  * The slice of the `storage` capability (`IStorageService`) that
@@ -152,10 +153,15 @@ export const EMAIL_ATTACHMENT_RECLAIM_GRACE_MS = 24 * 60 * 60_000;
  * content and left it in the bucket forever.
  */
 export interface EmailAttachmentReclaimPayload {
-  /** `sys_email.id` whose content this job reclaims. */
+  /** `sys_email.id` (or `sys_identity_email.id`) whose content this job reclaims. */
   rowId: string;
   /** Every storage key written for that row. Authoritative — see above. */
   keys: string[];
+  /**
+   * The log the row lives in. Written only for `sys_identity_email`; absent
+   * reads as `sys_email`, which is also every job an 18.0 process published.
+   */
+  object?: EmailLogObject;
 }
 
 /** Characters a storage key segment may contain; everything else is folded. */