Plan First Entering plan mode. No edits until the plan below is approved. 1) Isolation Model - Tenant identifier source: organizations registry iteration. - Propagation channel: scoped context set per iteration; finally-block cleanup. - Enforcement boundary: repository wrapper for activity reads; templating layer for email composition is tenant-scoped. - Failure mode: skip the organization with an audit log when context cannot be set. - Audit signal: per-iteration structured log with org id and email send result. 2) Changed Access Paths - LIST activity for the iteration's org : list : authority `system:background-reader` - WRITE outbound email row : write : authority `system:notifier` 3) Invariants Applied - No global activity query; iteration is explicit. - Email content composed inside the tenant context; templates do not read other-tenant data. - Logs include the org id but not user-level identifiers. - Cleanup runs on success and on failure. 4) Tests Added - Negative read: scoping wrapper rejects an unscoped activity query. - Negative write: notifier rejects writes without tenant context. - Negative list: per-iteration query returns only the iteration's tenant rows. - Context-missing: iteration without context is skipped and logged. - Async propagation: helpers inside the iteration inherit the tenant context. 5) Gate Results - T1: pass. - T2: pass. - T3: pass. - T4: pass. - T5: pass. - T6: pass. 6) Residual Risks - Risk: long iterations may delay other jobs; surface a metric for iteration duration. 7) Next Actions - Add a follow-up to expose a skipped-iteration metric to the dashboard. - Add a follow-up to verify email rendering does not include cross-tenant attachments.