@@ -0,0 +1,20 @@
+---
+'@objectstack/spec': patch
+'@objectstack/plugin-security': patch
+'@objectstack/runtime': patch
+'@objectstack/rest': patch
+'@objectstack/client': patch
+---
+
+feat(security): a dismissed or revoked suggested audience binding can be re-opened, back to pending
+
+Clause-②: yes (widening)
+Metadata-protocol: none
+
+Once an admin dismissed a pending audience-binding suggestion, or revoked an accepted one, the row stayed `dismissed` and nothing in the product could take that "no" back: `confirm` accepts only pending rows, and the reconciliation never moves a dismissed row. A new door re-opens it:
+
+- **`POST /api/v1/security/suggested-bindings/:id/reopen`** moves a `dismissed` row back to `pending`, exactly as if it had never been answered (`deployment_decision` false, `resolved_by` / `resolved_at` cleared). It is served by both mounts of the family: the REST route and the dispatcher's `/security` domain.
+- **Re-opening grants nothing.** A pending row is not an acceptance, so a revoked set stays out of the `everyone` anchor's definition until `POST …/:id/confirm` accepts it again, and that accept runs the ADR-0090 D7 high-risk gate like any other.
+- **Refusals.** The same authority as the other doors (`manage_metadata`; under a walled posture, the platform operator; `403` otherwise), the same walled-host refusal naming `acceptedDefaultPermissionSets` (`409`), `404` for an unknown id, and `409 SUGGESTION_STATE` for a row that is not `dismissed` (the message names its status) or whose set its package no longer suggests. The last keeps the decision on record: a re-opened row with no declaration would be pruned by the next reconciliation.
+- **Contract.** `ISecurityService` gains the OPTIONAL member `reopenAudienceBindingSuggestion(callerContext, id)`. A security service without it still satisfies the contract; both routes answer `501 NOT_IMPLEMENTED` naming the door, and every dismissal stands. plugin-security serves it and exports `reopenAudienceBindingSuggestion`.
+- **SDK.** `client.security.suggestedBindings.reopen(id)`.
@@ -281,14 +281,22 @@ package produces one:
 GET  /api/v1/security/suggested-bindings?status=pending   # list (reconciles first)
 POST /api/v1/security/suggested-bindings/:id/confirm      # accept: everyone carries the set
 POST /api/v1/security/suggested-bindings/:id/dismiss      # decline, or revoke an acceptance
+POST /api/v1/security/suggested-bindings/:id/reopen       # take a dismissal back: pending again
 ```
 
 `status` accepts `pending`, `confirmed` or `dismissed`, and may be omitted to
 list every suggestion. Any other value is rejected with a `400` naming the
 accepted set — it previously reached the query as a filter nothing matched, so
 a mistyped status returned an empty list that read as "no suggestions".
 
-All three require the `manage_metadata` capability, and under a walled
+Re-opening is how an admin changes their mind about a dismissal or a revoke:
+the row returns to `pending`, exactly as if it had never been answered. It
+grants nothing by itself. A revoked set stays out of `everyone` until `confirm`
+accepts it again, and that accept runs the high-risk gate as any other does.
+Only a `dismissed` row can be re-opened (`409` otherwise), and only while its
+package still suggests the set.
+
+All four require the `manage_metadata` capability, and under a walled
 tenancy posture the platform operator: the decision reaches every member of
 every organization, so a tenant administrator cannot make it. An acceptance
 takes effect at once. What `everyone` grants is the `permissionSets` its
 
@@ -93,7 +93,7 @@ what moved this page's population from 225 to 227; nothing about the two sites
 changed, only whether this instrument could see them.
 
 **The expensive failure direction is a keyword.** Sites whose receiver the author
-typed `any` have no type to read, and there are 55 of them — just over a fifth
+typed `any` have no type to read, and there are 56 of them — just over a fifth
 of the population, concentrated in exactly the seed and bootstrap paths this
 control exists for. Scoring an unreadable receiver as "not an engine" would have
 dropped every one of them silently, with a clean exit and a smaller number that
@@ -132,7 +132,7 @@ are reported as `undecidable` rather than assumed either way.
 
 The same holds twice over for the context. An options argument spelled as a
 literal can be read; one spelled `options`, `{ ...opts }`, or handed through a
-forwarding shim cannot, and **51 of the 244 sites are spelled that way**. A
+forwarding shim cannot, and **51 of the 245 sites are spelled that way**. A
 context resolved from an inline literal or a local `const` can be tested for
 `isSystem`; one arriving from a helper call cannot.
 
@@ -197,10 +197,10 @@ reproduce them. Where it disagrees, it disagrees on the page:
 
 | carried figure | where it survives | this census |
 | :--- | :--- | ---: |
-| 175 write call sites | quoted in the merged changeset | **244** |
+| 175 write call sites | quoted in the merged changeset | **245** |
 | 24 carrying no tenant context | quoted in the merged changeset | **2** provable and tenancy-enabled; **29** more whose options argument is unreadable |
-| 127 of 175 statically decidable, 48 runtime-parameter-name sites | restated on the `isSystem`-scoping card | **166 of 244** decidable, **78** undecidable |
-| 135 (77%) silenced by the `isSystem` guard before the posture gate | the lost issue body — **no surviving corroboration** | **not reproduced**: 141 decidably elevated, 0 decidably not, 95 undecidable |
+| 127 of 175 statically decidable, 48 runtime-parameter-name sites | restated on the `isSystem`-scoping card | **167 of 245** decidable, **78** undecidable |
+| 135 (77%) silenced by the `isSystem` guard before the posture gate | the lost issue body — **no surviving corroboration** | **not reproduced**: 141 decidably elevated, 0 decidably not, 96 undecidable |
 | 141 and 132, two independent re-derivations | the card that filed this work | — |
 
 **The differences are not reconciled, and deliberately so.** The old census's
@@ -210,18 +210,18 @@ be stated is what this instrument counts, which is written above and re-runnable
 at any commit.
 
 Two structural facts do plausibly widen this reading against any hand or regex
-one, and both are counted in the generated tables below: the 55 sites reached
-through an erased (`any`) receiver, and the 51 that name their object through a
+one, and both are counted in the generated tables below: the 56 sites reached
+through an erased (`any`) receiver, and the 52 that name their object through a
 `const` rather than inline. An instrument that read either the way a person does
 would report a smaller number and would not say so.
 
 The fourth row is the one worth flagging to anyone citing it. **The 135 / 77%
 figure has no surviving corroboration anywhere in the tree.** This census reads
-141 of 244 (58%) as decidably elevated, with 95 more whose elevation is a
+141 of 245 (58%) as decidably elevated, with 96 more whose elevation is a
 run-time fact — so the claim is neither confirmed nor refuted, and the honest
 answer is that a static reading cannot settle it.
 
-⇒ **Cite `2 / 244`, and say what it is**: the sites whose options argument was
+⇒ **Cite `2 / 245`, and say what it is**: the sites whose options argument was
 READ and holds no tenant context, against a decidably tenancy-enabled object.
 That is the control's provable yield surface. ⛔ Do not cite it as "the sites
 without tenant context" — **29 further sites** have an options argument this
@@ -233,29 +233,29 @@ cannot read, and they are neither in nor out.
 
 | what | count |
 | :--- | ---: |
-| write call sites on the application surface | **244** |
-| …whose object name is statically decidable | 166 |
+| write call sites on the application surface | **245** |
+| …whose object name is statically decidable | 167 |
 | …whose object name is chosen at run time | 78 |
-| …against an object with tenancy ENABLED | 165 |
+| …against an object with tenancy ENABLED | 166 |
 | …against an object that declares tenancy off | 1 |
-| threading a tenant context | 185 |
+| threading a tenant context | 186 |
 | PROVABLY carrying none (options read, no context key) | **8** |
 | …of those, against a decidably tenancy-enabled object | **2** |
 | options argument UNREADABLE — may or may not carry one | 51 |
 | …of those, against a decidably tenancy-enabled object | 29 |
 | threading a decidably ELEVATED (`isSystem`) context | 141 |
 | threading a context that is decidably NOT elevated | 0 |
-| threading a context whose elevation is a run-time fact | 95 |
+| threading a context whose elevation is a run-time fact | 96 |
 
 | how the instrument reached the site | count |
 | :--- | ---: |
 | receiver carried a readable engine type | 189 |
-| receiver erased, placed by the object NAME | 45 |
+| receiver erased, placed by the object NAME | 46 |
 | receiver erased, placed by an `object: string` PARAMETER | 5 |
 | receiver erased, placed by an `UNTYPED_RECEIVERS` row | 5 |
 
 | object name spelled inline | 115 |
-| object name spelled through a `const` | 51 |
+| object name spelled through a `const` | 52 |
 | object name is an `object: string` parameter | 7 |
 | object name is some other run-time expression | 71 |
 
@@ -307,13 +307,13 @@ holds still. They are required to be HERE and to say WHEN they were true;
 their values are not compared. The reasoning, and the measurement behind it,
 are in `scripts/check-tenant-audit-census.mjs`.
 
-Measured on 2026-10-26 at `700904cd5`.
+Measured on 2026-10-28 at `7b081efc9`.
 
 | corpus scale (not enforced) | count |
 | :--- | ---: |
-| tracked non-test sources scanned | 779 |
-| engine-shaped types recognised | 89 |
-| declared objects in the registry | 117 |
-| same-named calls subtracted as non-engine | 177 |
+| tracked non-test sources scanned | 799 |
+| engine-shaped types recognised | 93 |
+| declared objects in the registry | 120 |
+| same-named calls subtracted as non-engine | 181 |
 
 {/* END GENERATED: tenant-audit-census */}
@@ -33,19 +33,19 @@ silent, and `node scripts/tenant-audit-census.mjs --write` is the resolution.
 
 | Measure | Value |
 |---|---:|
-| Write call sites | 244 |
-| Object name statically decidable | 166 |
+| Write call sites | 245 |
+| Object name statically decidable | 167 |
 | Object name chosen at run time | 78 |
-| Against a tenancy-enabled object | 165 |
+| Against a tenancy-enabled object | 166 |
 | Against an object declaring tenancy off | 1 |
-| Threading a tenant context | 185 |
+| Threading a tenant context | 186 |
 | Provably carrying none | 8 |
 | …and decidably tenancy-enabled | 2 |
 | Options argument unreadable | 51 |
 | …and decidably tenancy-enabled | 29 |
 | Threading a decidably elevated context | 141 |
 | Threading a decidably non-elevated context | 0 |
-| Threading a context of undecidable elevation | 95 |
+| Threading a context of undecidable elevation | 96 |
 
 ## Subtractions the census could NOT defend — enforced
 
@@ -90,14 +90,14 @@ holds still. They are required to be HERE and to say WHEN they were true;
 their values are not compared. The reasoning, and the measurement behind it,
 are in `scripts/check-tenant-audit-census.mjs`.
 
-Measured on 2026-10-26 at `700904cd5`.
+Measured on 2026-10-28 at `7b081efc9`.
 
 | corpus scale (not enforced) | count |
 | :--- | ---: |
-| tracked non-test sources scanned | 779 |
-| engine-shaped types recognised | 89 |
-| declared objects in the registry | 117 |
-| same-named calls subtracted as non-engine | 177 |
+| tracked non-test sources scanned | 799 |
+| engine-shaped types recognised | 93 |
+| declared objects in the registry | 120 |
+| same-named calls subtracted as non-engine | 181 |
 
 ## Every site
 
@@ -183,7 +183,7 @@ Measured on 2026-10-26 at `700904cd5`.
 | `packages/plugins/plugin-security/src/invitation-placement.ts` | `insert` | `sys_user_position` | enabled | elevated | 1 |
 | `packages/plugins/plugin-security/src/suggested-audience-bindings.ts` | `delete` | `sys_audience_binding_suggestion` | enabled | context, elevation undecidable | 1 |
 | `packages/plugins/plugin-security/src/suggested-audience-bindings.ts` | `insert` | `sys_audience_binding_suggestion` | enabled | context, elevation undecidable | 1 |
-| `packages/plugins/plugin-security/src/suggested-audience-bindings.ts` | `update` | `sys_audience_binding_suggestion` | enabled | context, elevation undecidable | 3 |
+| `packages/plugins/plugin-security/src/suggested-audience-bindings.ts` | `update` | `sys_audience_binding_suggestion` | enabled | context, elevation undecidable | 4 |
 | `packages/plugins/plugin-sharing/src/backfill-sys-record-share-organizations.ts` | `update` | `sys_record_share` | enabled | elevated | 1 |
 | `packages/plugins/plugin-sharing/src/primary-bu-projection.ts` | `update` | `sys_user` | enabled | elevated | 2 |
 | `packages/plugins/plugin-sharing/src/record-orphan-cleanup.ts` | `delete` | `table` | undecidable | options unreadable | 2 |
 
@@ -116,4 +116,14 @@ describe('client.security.suggestedBindings', () => {
             'http://localhost:3000/api/v1/security/suggested-bindings/sug_2/dismiss',
         );
     });
+
+    it('reopen POSTs to the id-scoped subroute, encoding the id', async () => {
+        const { client, fetchMock } = createMockClient({ success: true, data: { suggestion: { id: 'sug/3', status: 'pending' } } });
+        const result = await client.security.suggestedBindings.reopen('sug/3');
+        expect(String(fetchMock.mock.calls[0][0])).toBe(
+            'http://localhost:3000/api/v1/security/suggested-bindings/sug%2F3/reopen',
+        );
+        expect(fetchMock.mock.calls[0][1].method).toBe('POST');
+        expect(result).toEqual({ suggestion: { id: 'sug/3', status: 'pending' } });
+    });
 });
@@ -6228,6 +6228,15 @@ export class ObjectStackClient {
               );
               return this.unwrapResponse(res);
           },
+
+          /** Re-open a dismissed or revoked suggestion: pending again, nothing granted until `confirm` accepts it. */
+          reopen: async (id: string): Promise<{ suggestion: AudienceBindingSuggestion }> => {
+              const res = await this.fetch(
+                  `${this.baseUrl}/api/v1/security/suggested-bindings/${encodeURIComponent(id)}/reopen`,
+                  { method: 'POST' },
+              );
+              return this.unwrapResponse(res);
+          },
       },
   };
 
 
@@ -94,6 +94,7 @@ export {
   listAudienceBindingSuggestions,
   confirmAudienceBindingSuggestion,
   dismissAudienceBindingSuggestion,
+  reopenAudienceBindingSuggestion,
   SuggestionNotFoundError,
   SuggestionStateError,
 } from './suggested-audience-bindings.js';
 
@@ -79,6 +79,7 @@ const DECLARED_MEMBERS = {
   listAudienceBindingSuggestions: 'required',
   confirmAudienceBindingSuggestion: 'required',
   dismissAudienceBindingSuggestion: 'required',
+  reopenAudienceBindingSuggestion: 'optional',
   contributeOwnershipFloorAlternates: 'optional',
 } as const satisfies DeclaredOptionality;
 
 
@@ -76,6 +76,7 @@ import {
   listAudienceBindingSuggestions,
   confirmAudienceBindingSuggestion,
   dismissAudienceBindingSuggestion,
+  reopenAudienceBindingSuggestion,
   type SuggestionDeps,
   type SuggestionListFilter,
 } from './suggested-audience-bindings.js';
@@ -370,13 +371,16 @@ export function registerSecurityService(
       },
       // [ADR-0090 D5/D9] Install-time suggestion surface: packages suggest a
       // set for `everyone`; a `manage_metadata` holder accepts it once for
-      // the deployment (the `everyone` definition is re-derived) or dismisses.
+      // the deployment (the `everyone` definition is re-derived) or dismisses,
+      // and may re-open a dismissal (back to pending — nothing granted).
       listAudienceBindingSuggestions: (callerContext?: any, filter?: SuggestionListFilter) =>
         listAudienceBindingSuggestions(suggestionDeps, callerContext, filter),
       confirmAudienceBindingSuggestion: (callerContext: any, id: string) =>
         confirmAudienceBindingSuggestion(suggestionDeps, callerContext, id),
       dismissAudienceBindingSuggestion: (callerContext: any, id: string) =>
         dismissAudienceBindingSuggestion(suggestionDeps, callerContext, id),
+      reopenAudienceBindingSuggestion: (callerContext: any, id: string) =>
+        reopenAudienceBindingSuggestion(suggestionDeps, callerContext, id),
     };
     // [ADR-0106 D7] The metadata-plane readable-field query, registered as an
     // EXTENSION of the published contract rather than inside the typed