@@ -189,7 +189,7 @@ reproduce them. Where it disagrees, it disagrees on the page:
 | :--- | :--- | ---: |
 | 175 write call sites | quoted in the merged changeset | **231** |
 | 24 carrying no tenant context | quoted in the merged changeset | **2** provable and tenancy-enabled; **31** more whose options argument is unreadable |
-| 127 of 175 statically decidable, 48 runtime-parameter-name sites | restated on the `isSystem`-scoping card | **160 of 231** decidable, **71** undecidable |
+| 127 of 175 statically decidable, 48 runtime-parameter-name sites | restated on the `isSystem`-scoping card | **157 of 231** decidable, **74** undecidable |
 | 135 (77%) silenced by the `isSystem` guard before the posture gate | the lost issue body — **no surviving corroboration** | **not reproduced**: 128 decidably elevated, 0 decidably not, 95 undecidable |
 | 141 and 132, two independent re-derivations | the card that filed this work | — |
 
@@ -201,7 +201,7 @@ at any commit.
 
 Two structural facts do plausibly widen this reading against any hand or regex
 one, and both are counted in the generated tables below: the 40 sites reached
-through an erased (`any`) receiver, and the 52 that name their object through a
+through an erased (`any`) receiver, and the 51 that name their object through a
 `const` rather than inline. An instrument that read either the way a person does
 would report a smaller number and would not say so.
 
@@ -224,9 +224,9 @@ cannot read, and they are neither in nor out.
 | what | count |
 | :--- | ---: |
 | write call sites on the application surface | **231** |
-| …whose object name is statically decidable | 160 |
-| …whose object name is chosen at run time | 71 |
-| …against an object with tenancy ENABLED | 159 |
+| …whose object name is statically decidable | 157 |
+| …whose object name is chosen at run time | 74 |
+| …against an object with tenancy ENABLED | 156 |
 | …against an object that declares tenancy off | 1 |
 | threading a tenant context | 171 |
 | PROVABLY carrying none (options read, no context key) | **8** |
@@ -244,10 +244,10 @@ cannot read, and they are neither in nor out.
 | receiver erased, placed by an `object: string` PARAMETER | 5 |
 | receiver erased, placed by an `UNTYPED_RECEIVERS` row | 5 |
 
-| object name spelled inline | 108 |
-| object name spelled through a `const` | 52 |
+| object name spelled inline | 106 |
+| object name spelled through a `const` | 51 |
 | object name is an `object: string` parameter | 7 |
-| object name is some other run-time expression | 64 |
+| object name is some other run-time expression | 67 |
 
 ### Subtractions the census could NOT defend — enforced
 
@@ -297,13 +297,13 @@ holds still. They are required to be HERE and to say WHEN they were true;
 their values are not compared. The reasoning, and the measurement behind it,
 are in `scripts/check-tenant-audit-census.mjs`.
 
-Measured on 2026-10-19 at `2623d6d6c`.
+Measured on 2026-10-19 at `ebe85c6d3`.
 
 | corpus scale (not enforced) | count |
 | :--- | ---: |
-| tracked non-test sources scanned | 670 |
+| tracked non-test sources scanned | 672 |
 | engine-shaped types recognised | 79 |
-| declared objects in the registry | 116 |
+| declared objects in the registry | 117 |
 | same-named calls subtracted as non-engine | 166 |
 
 {/* END GENERATED: tenant-audit-census */}
@@ -34,9 +34,9 @@ silent, and `node scripts/tenant-audit-census.mjs --write` is the resolution.
 | Measure | Value |
 |---|---:|
 | Write call sites | 231 |
-| Object name statically decidable | 160 |
-| Object name chosen at run time | 71 |
-| Against a tenancy-enabled object | 159 |
+| Object name statically decidable | 157 |
+| Object name chosen at run time | 74 |
+| Against a tenancy-enabled object | 156 |
 | Against an object declaring tenancy off | 1 |
 | Threading a tenant context | 171 |
 | Provably carrying none | 8 |
@@ -90,13 +90,13 @@ holds still. They are required to be HERE and to say WHEN they were true;
 their values are not compared. The reasoning, and the measurement behind it,
 are in `scripts/check-tenant-audit-census.mjs`.
 
-Measured on 2026-10-19 at `2623d6d6c`.
+Measured on 2026-10-19 at `ebe85c6d3`.
 
 | corpus scale (not enforced) | count |
 | :--- | ---: |
-| tracked non-test sources scanned | 670 |
+| tracked non-test sources scanned | 672 |
 | engine-shaped types recognised | 79 |
-| declared objects in the registry | 116 |
+| declared objects in the registry | 117 |
 | same-named calls subtracted as non-engine | 166 |
 
 ## Every site
@@ -157,9 +157,9 @@ Measured on 2026-10-19 at `2623d6d6c`.
 | `packages/plugins/plugin-auth/src/scim-connection-service.ts` | `insert` | `sys_scim_connection_credential` | enabled | PROVABLY NONE | 1 |
 | `packages/plugins/plugin-auth/src/session-tombstone.ts` | `update` | `objectName` | undecidable | options unreadable | 1 |
 | `packages/plugins/plugin-auth/src/sso-client-secret.ts` | `update` | `sys_sso_provider` | disabled | elevated | 1 |
-| `packages/plugins/plugin-email/src/attachment-reclaim.ts` | `update` | `sys_email` | enabled | elevated | 1 |
-| `packages/plugins/plugin-email/src/email-plugin.ts` | `insert` | `sys_email` | enabled | elevated | 1 |
-| `packages/plugins/plugin-email/src/email-plugin.ts` | `update` | `sys_email` | enabled | elevated | 1 |
+| `packages/plugins/plugin-email/src/attachment-reclaim.ts` | `update` | `object` | undecidable | elevated | 1 |
+| `packages/plugins/plugin-email/src/email-plugin.ts` | `insert` | `object` | undecidable | elevated | 1 |
+| `packages/plugins/plugin-email/src/email-plugin.ts` | `update` | `object` | undecidable | elevated | 1 |
 | `packages/plugins/plugin-pinyin-search/src/companion-projection.ts` | `update` | `schema.name` | undecidable | elevated | 1 |
 | `packages/plugins/plugin-security/src/auto-org-admin-grant.ts` | `delete` | `object` | undecidable | elevated | 1 |
 | `packages/plugins/plugin-security/src/auto-org-admin-grant.ts` | `insert` | `object` | undecidable | elevated | 1 |
 
@@ -0,0 +1,34 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [ADR-0131 D7, ruling of record 6257510973, Q2 A] `sys_identity_email` is
+ * `sys_email`'s deployment-level sibling: the same row shape, so one mail
+ * pipeline serves both, and no organization column.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { SysEmail } from './sys-email.object.js';
+import { SysIdentityEmail } from './sys-identity-email.object.js';
+
+describe('sys_identity_email — the identity-mail sibling of sys_email', () => {
+  it('declares exactly sys_email\'s fields — the row shape the pipeline reads and writes', () => {
+    expect(Object.keys(SysIdentityEmail.fields)).toEqual(Object.keys(SysEmail.fields));
+    expect(SysIdentityEmail.fields).toEqual(SysEmail.fields);
+  });
+
+  it('keys the same indexes, so the by-status and by-id reads cost the same', () => {
+    expect(SysIdentityEmail.indexes).toEqual(SysEmail.indexes);
+  });
+
+  it('opts out of the injected organization column; sys_email keeps it', () => {
+    expect(SysIdentityEmail.systemFields).toEqual({ tenant: false });
+    expect(SysEmail.systemFields?.tenant).not.toBe(false);
+    expect(Object.keys(SysIdentityEmail.fields)).not.toContain('organization_id');
+  });
+
+  it('is append-only, readable by get/list, and behind the platform-only capability', () => {
+    expect(SysIdentityEmail.managedBy).toBe('append-only');
+    expect(SysIdentityEmail.enable?.apiMethods).toEqual(['get', 'list']);
+    expect(SysIdentityEmail.requiredPermissions).toEqual(['manage_platform_settings']);
+  });
+});
@@ -1,7 +1,6 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
 
-import { ObjectSchema } from '@objectstack/spec/data';
-import { SysEmail } from './sys-email.object.js';
+import { ObjectSchema, Field } from '@objectstack/spec/data';
 
 /**
  * sys_identity_email — Outbound Identity Mail Log
@@ -14,8 +13,8 @@ import { SysEmail } from './sys-email.object.js';
  * organization column, instead of as an organization-less row in the tenant
  * mail log: ⛔ neither a nullable column nor unpersisted mail.
  *
- * Same row shape as `sys_email` — the fields ARE `sys_email`'s, so the two
- * cannot drift — and the same pipeline: `IEmailService.send` with
+ * Same row shape as `sys_email` — its fields, held equal by a test — and the
+ * same pipeline: `IEmailService.send` with
  * `identityMail: true` writes the row, and the queue worker, the outbox drain
  * hook, the boot outbox sweep and attachment reclamation read it by id and
  * status exactly as they read `sys_email`.
@@ -51,7 +50,183 @@ export const SysIdentityEmail = ObjectSchema.create({
   titleFormat: '{subject}',
   highlightFields: ['subject', 'to_addresses', 'status', 'sent_at'],
 
-  fields: SysEmail.fields,
+  // `sys_email`'s fields, written out: the source scans that judge an
+  // object's columns (`check:keyed-text-bounds`) read a literal, never a
+  // reference. `sys-identity-email.object.test.ts` holds the two equal, so
+  // the row shape cannot drift; the reasoning behind each field lives on
+  // `sys_email`.
+  fields: {
+    id: Field.text({
+      label: 'Email ID',
+      required: true,
+      readonly: true,
+      group: 'System',
+    }),
+
+    message_id: Field.text({
+      label: 'Message-ID',
+      required: false,
+      maxLength: 255,
+      description: 'RFC-5322 Message-ID assigned by the transport',
+      group: 'Envelope',
+    }),
+
+    from_address: Field.text({
+      label: 'From',
+      required: true,
+      maxLength: 320,
+      searchable: true,
+      group: 'Envelope',
+    }),
+
+    to_addresses: Field.text({
+      label: 'To',
+      required: true,
+      maxLength: 4000,
+      searchable: true,
+      description: 'Comma-separated recipient addresses',
+      group: 'Envelope',
+    }),
+
+    cc_addresses: Field.text({
+      label: 'Cc',
+      required: false,
+      maxLength: 4000,
+      group: 'Envelope',
+    }),
+
+    bcc_addresses: Field.text({
+      label: 'Bcc',
+      required: false,
+      maxLength: 4000,
+      group: 'Envelope',
+    }),
+
+    reply_to: Field.text({
+      label: 'Reply-To',
+      required: false,
+      maxLength: 320,
+      group: 'Envelope',
+    }),
+
+    subject: Field.text({
+      label: 'Subject',
+      required: true,
+      maxLength: 998,
+      searchable: true,
+      group: 'Content',
+    }),
+
+    body_text: Field.textarea({
+      label: 'Body (text)',
+      required: false,
+      searchable: true,
+      group: 'Content',
+    }),
+
+    body_html: Field.textarea({
+      label: 'Body (HTML)',
+      required: false,
+      group: 'Content',
+    }),
+
+    headers_json: Field.textarea({
+      label: 'Headers (JSON)',
+      required: false,
+      internal: true,
+      description:
+        'Custom headers supplied with the message when it was sent, as a JSON object of name → value. '
+        + 'Written in both delivery modes (it is audit evidence as much as delivery input). '
+        + 'Absent on rows written before this column existed, which read back as "no custom headers". '
+        + 'Never returned on the generic data path — headers are the ordinary place a '
+        + 'credential goes; the delivery paths recover it through the engine\'s privileged accessor.',
+      group: 'Content',
+    }),
+
+    attachments_json: Field.textarea({
+      label: 'Attachments (JSON)',
+      required: false,
+      description:
+        'Attachments as a JSON array of { filename, contentType?, size, hash, cid?, contentForm, '
+        + 'inline?, storageKey?, contentReclaimedAt? }. Content up to the plugin-email budget '
+        + '(SYS_EMAIL_ATTACHMENT_LIMIT_BYTES, 256 KiB combined raw — ~350 KB of base64 at worst) is base64 in '
+        + '`inline`; larger content goes to the file-storage capability and the element carries `storageKey` '
+        + 'instead, so the row stays bounded either way. filename/contentType/size/hash are PERMANENT audit '
+        + 'evidence; out-of-row content is a delivery artifact and is deleted a grace window after the row '
+        + 'reaches a terminal state, at which point `storageKey` is replaced by `contentReclaimedAt`.',
+      group: 'Content',
+    }),
+
+    status: Field.select(
+      ['queued', 'sent', 'failed'],
+      {
+        label: 'Status',
+        required: true,
+        defaultValue: 'queued',
+        description: 'Lifecycle state — queued when the message is submitted for sending, before the first delivery attempt',
+        group: 'State',
+      },
+    ),
+
+    error: Field.textarea({
+      label: 'Error',
+      required: false,
+      description:
+        'Why the message failed — a transport error, or the validation that rejected it before delivery.',
+      group: 'State',
+    }),
+
+    attempt_count: Field.number({
+      label: 'Attempts',
+      required: false,
+      defaultValue: 0,
+      description: 'Number of delivery attempts performed by the service',
+      group: 'State',
+    }),
+
+    sent_at: Field.datetime({
+      label: 'Sent At',
+      required: false,
+      description: 'Set when status transitions to "sent"',
+      group: 'State',
+    }),
+
+    related_object: Field.text({
+      label: 'Related Object',
+      required: false,
+      maxLength: 100,
+      description: 'Object name of the related record (e.g. lead, opportunity)',
+      group: 'Source',
+    }),
+
+    related_id: Field.text({
+      label: 'Related Record',
+      required: false,
+      maxLength: 100,
+      description: 'Record id within related_object',
+      group: 'Source',
+    }),
+
+    sent_by: Field.lookup('sys_user', {
+      label: 'Sent By',
+      required: false,
+      group: 'Source',
+    }),
+
+    created_at: Field.datetime({
+      label: 'Created At',
+      required: true,
+      defaultValue: 'NOW()',
+      readonly: true,
+      group: 'System',
+    }),
+
+    updated_at: Field.datetime({
+      label: 'Updated At',
+      required: false,
+      group: 'System',
+    }),
+  },
 
   indexes: [
     { fields: ['status', 'created_at'] },