diff --git a/docs/release-control/v6/internal/subsystems/ai-runtime.md b/docs/release-control/v6/internal/subsystems/ai-runtime.md
index fea40693e1..271e66327f 100644
--- a/docs/release-control/v6/internal/subsystems/ai-runtime.md
+++ b/docs/release-control/v6/internal/subsystems/ai-runtime.md
@@ -25,6 +25,18 @@ that same result. Successful reads retain their content and execution provenance
 
 ## Purpose
 
+### Permanent suppression rules remain reversible — issue #2528
+
+The existing manual suppression API/store semantics remain unchanged. Patrol
+Activity now exposes scoped list/confirm/remove/readback for explicitly manual
+rules. Deleting a rule permits future matches but does not reopen historical
+dismissals, erase findings, broaden creation scope or modify other rules.
+Finding-specific Reopen and remembered decisions remain distinct. Frontend
+API/component controls plus authenticated handler/store controls verify these
+boundaries; source/browser proof does not establish installed or reporter
+acceptance.
+
+
 ### Fully cached Patrol usage — issues #2118 / #2350
 
 Zero ordinary input tokens do not mean a run was free or skipped. Any positive
diff --git a/docs/release-control/v6/internal/subsystems/api-contracts.md b/docs/release-control/v6/internal/subsystems/api-contracts.md
index e459897ac5..29acf094e6 100644
--- a/docs/release-control/v6/internal/subsystems/api-contracts.md
+++ b/docs/release-control/v6/internal/subsystems/api-contracts.md
@@ -20,6 +20,20 @@
 
 ## Purpose
 
+### Confirmed Patrol rule operations preserve tenant context — issue #2528
+
+The frontend consumes the existing GET/DELETE suppression endpoints without a
+wire or permission change. The optional client expectedOrgID pins the request
+header and checks context before and after CSRF preparation; retry:false
+disables auth, invalid-organisation, CSRF and rate-limit retries for this flow.
+Other callers retain their defaults. Current auth, scope and CSRF checks remain
+authoritative; an abort or mismatched context stops dispatch. The suppression
+client rejects malformed or duplicate rows, accepts the existing empty nil
+slice, and only deletes a rule_ identity with explicit manual origin and no
+finding/dismissal attribution. Transport success alone is not removal: the UI
+must read the same collection back and establish exact-ID absence.
+
+
 ### Organisation deletion retains data after incomplete monitoring shutdown
 
 Authenticated organisation-owner deletion waits for tenant-loop exit and sealed
diff --git a/docs/release-control/v6/internal/subsystems/cloud-paid.md b/docs/release-control/v6/internal/subsystems/cloud-paid.md
index 34c5094087..e9bb4f5ae0 100644
--- a/docs/release-control/v6/internal/subsystems/cloud-paid.md
+++ b/docs/release-control/v6/internal/subsystems/cloud-paid.md
@@ -15,6 +15,18 @@
 
 ## Purpose
 
+### Opt-in confirmed-operation transport keeps paid contexts unchanged
+
+The shared frontend client adds expectedOrgID and retry:false for the existing
+Patrol manual-rule reversal flow. It binds confirmed reads/deletion to the
+selected organisation and stops automatic auth, invalid-org, CSRF and
+rate-limit replay only when requested. Paid APIs retain their existing default
+request behaviour, tenant enforcement and entitlement boundaries. The strict
+consumer rechecks context after CSRF preparation and discards stale responses;
+this adds no paid endpoint, cross-tenant fallback or scope expansion. Shared
+client tests cover unchanged defaults and explicit one-attempt context binding.
+
+
 Own cloud plan/version semantics, entitlement limits, hosted billing/runtime
 agreement, the Pulse Cloud control plane, provider-hosted MSP account
 bootstrap/licensing, hosted tenant lifecycle, and cloud-specific enforcement
diff --git a/docs/release-control/v6/internal/subsystems/frontend-primitives.md b/docs/release-control/v6/internal/subsystems/frontend-primitives.md
index 1c380ea961..13d0941b34 100644
--- a/docs/release-control/v6/internal/subsystems/frontend-primitives.md
+++ b/docs/release-control/v6/internal/subsystems/frontend-primitives.md
@@ -20,6 +20,15 @@
 
 ## Purpose
 
+### Confirmed operations opt out of silent transport fallback
+
+The shared API client accepts expectedOrgID and retry:false for confirmed
+Patrol manual-rule removal. It pins and rechecks the selected organisation at
+dispatch, respects cancellation after asynchronous CSRF preparation and makes
+no automatic auth/tenant/CSRF/rate-limit replay. Existing caller defaults are
+unchanged. Tests exercise these safeguards with real request options.
+
+
 All drawer History fallbacks must distinguish current observations from retained, unavailable or freshness-unknown guest readings, using original memory evidence and filesystem read reasons.
 
 ### Canonical drawer History preserves guest read provenance
diff --git a/docs/release-control/v6/internal/subsystems/patrol-intelligence.md b/docs/release-control/v6/internal/subsystems/patrol-intelligence.md
index dfbf50ed95..4753a5c328 100644
--- a/docs/release-control/v6/internal/subsystems/patrol-intelligence.md
+++ b/docs/release-control/v6/internal/subsystems/patrol-intelligence.md
@@ -15,6 +15,27 @@
 
 ## Purpose
 
+### Manual suppression reversal — issue #2528
+
+Patrol Activity exposes the existing suppression collection independently of
+active findings. It lists only explicitly manual rules with resource and
+category scope, exact ID and reason; wildcard scopes are labelled both in the
+list and confirmation. Create-rule controls link to this existing Activity
+section. Finding dismissals, automatic/legacy rules and history are not removed
+or reopened by manual deletion. Reopen finding remains a separate action.
+
+A confirmation is bound to its organisation, invalidates on organisation or
+membership change/disposal, verifies the unchanged manual row with a fresh
+authorised read, sends one exact-ID DELETE and requires readback absence before
+claiming removal. Any failed or uncertain step hides stale controls and requires
+explicit reload, not an automatic mutation retry. Other rules can still cover
+the same scope. Component/API tests cover cancellation, stale scope/origin,
+authorisation loss, malformed data, concurrent removal, late results and
+readback failure. Browser evidence must cover creation through removal and the
+actual existing links on desktop and narrow viewports. Synthetic proof is not
+publication or the reporter's own removal.
+
+
 ### Canonical Patrol and Assistant continuation, 2026-09-07
 
 Canonical action state and legacy approval state remain distinct in Assistant
diff --git a/docs/release-control/v6/internal/subsystems/registry.json b/docs/release-control/v6/internal/subsystems/registry.json
index d79af8c40e..1530edb78d 100644
--- a/docs/release-control/v6/internal/subsystems/registry.json
+++ b/docs/release-control/v6/internal/subsystems/registry.json
@@ -6947,7 +6947,8 @@
         "frontend-modern/src/utils/patrolRuntimeActions.ts",
         "frontend-modern/src/utils/patrolRuntimePresentation.ts",
         "frontend-modern/src/utils/patrolSummaryPresentation.ts",
-        "frontend-modern/src/utils/remediationPresentation.ts"
+        "frontend-modern/src/utils/remediationPresentation.ts",
+        "frontend-modern/src/features/patrol/PatrolSuppressionRules.tsx"
       ],
       "verification": {
         "allow_same_subsystem_tests": false,
@@ -7098,6 +7099,19 @@
               "frontend-modern/src/utils/__tests__/patrolRunPresentation.test.ts",
               "frontend-modern/src/utils/__tests__/patrolSummaryPresentation.test.ts"
             ]
+          },
+          {
+            "id": "patrol-manual-rule-reversal",
+            "label": "Patrol manual-rule reversal proof",
+            "match_prefixes": [],
+            "match_files": [
+              "frontend-modern/src/features/patrol/PatrolSuppressionRules.tsx"
+            ],
+            "allow_same_subsystem_tests": false,
+            "test_prefixes": [],
+            "exact_files": [
+              "frontend-modern/src/features/patrol/__tests__/PatrolSuppressionRules.test.tsx"
+            ]
           }
         ],
         "match_files": null
diff --git a/frontend-modern/browser-tests/patrol-rule-removal.cjs b/frontend-modern/browser-tests/patrol-rule-removal.cjs
new file mode 100644
index 0000000000..bc3569bf3a
--- /dev/null
+++ b/frontend-modern/browser-tests/patrol-rule-removal.cjs
@@ -0,0 +1,439 @@
+// Full production Patrol surface. Only local API responses are synthetic.
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const { chromium, webkit } = require('playwright');
+const hash = (file) => crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+const files = [
+  'src/api/patrol.ts',
+  'src/utils/apiClient.ts',
+  'src/components/AI/FindingsPanel.tsx',
+  'src/features/patrol/PatrolIntelligenceSurface.tsx',
+  'src/features/patrol/PatrolAttentionWorkbench.tsx',
+  'src/features/patrol/PatrolSuppressionRules.tsx',
+];
+const output = '/workspace/tmp/patrol-rule-proof/browser';
+const report = {
+  playwright: require('playwright/package.json').version,
+  content_sha256: {},
+  cases: [],
+  captures: [],
+  cleanup: {},
+};
+fs.mkdirSync(output, { recursive: true });
+for (const file of files)
+  report.content_sha256[`frontend-modern/${file}`] = hash(`/workspace/frontend-modern/${file}`);
+assert.equal(
+  report.playwright,
+  JSON.parse(fs.readFileSync('/workspace/tests/integration/package-lock.json')).packages[
+    'node_modules/@playwright/test'
+  ].version,
+);
+
+async function journey(root, engine, width, parent = false) {
+  process.chdir(root);
+  const { createServer } = await import(path.join(root, 'node_modules/vite/dist/node/index.js'));
+  const server = await createServer({
+    root,
+    configFile: path.join(root, 'vite.config.ts'),
+    cacheDir: path.join(output, `vite-${parent ? 'parent' : engine}-${width}`),
+    server: { host: '127.0.0.1', port: 5297, strictPort: true, watch: null },
+  });
+  let browser;
+  const result = {
+    parent,
+    engine,
+    width,
+    checks: [],
+    requests: [],
+    errors: [],
+    offOrigin: [],
+    cleanup: {},
+  };
+  report.cases.push(result);
+  const now = '2026-10-05T12:00:00Z';
+  const broad = {
+    id: 'rule_any_any_2',
+    resource_id: '',
+    category: '',
+    description: 'Intentional maintenance',
+    created_from: 'manual',
+    created_at: now,
+  };
+  const other = {
+    id: 'rule_keep_capacity_3',
+    resource_id: 'fixture-keep',
+    resource_name: 'Keep VM',
+    category: 'capacity',
+    description: 'Keep this unrelated rule',
+    created_from: 'manual',
+    created_at: now,
+  };
+  const historical = {
+    id: 'finding_history',
+    finding_id: 'history',
+    resource_id: 'fixture-db',
+    resource_name: 'Database VM',
+    category: 'backup',
+    description: 'Retain this dismissal and note',
+    created_from: 'dismissed',
+    created_at: now,
+  };
+  const legacy = { ...other, id: 'rule_legacy', created_from: 'suppress' };
+  const rules = [broad, other, historical, legacy];
+  const initialUntouched = JSON.stringify(rules);
+  const item = {
+    id: 'record-1',
+    operationalRecordId: 'record-1',
+    subjectResourceId: 'fixture-db',
+    subjectResourceName: 'Database VM',
+    subjectResourceType: 'vm',
+    kind: 'backup',
+    title: 'Backup age on Database VM',
+    plainLanguageSummary: 'The off-site backup is older than expected.',
+    severity: 'warning',
+    state: 'open',
+    firstObservedAt: now,
+    lastObservedAt: now,
+    evidenceFreshness: 'fresh',
+    evidenceCompleteness: 'complete',
+    impact: 'Check the backup schedule.',
+    relatedResources: [],
+    recommendedNextStep: 'Review the off-site backup.',
+    availableActions: [],
+    verificationState: 'not_available',
+  };
+  const finding = {
+    id: 'fixture-finding',
+    resource_id: 'fixture-db',
+    resource_name: 'Database VM',
+    resource_type: 'vm',
+    category: 'backup',
+    severity: 'warning',
+    title: 'Off-site backup age',
+    description: 'The off-site backup is older than expected.',
+    detected_at: now,
+    last_seen_at: now,
+    times_raised: 1,
+    suppressed: false,
+    auto_resolved: false,
+    mirrors_alert_id: 'fixture-db::backup',
+    mirrors_alert_type: 'backup',
+  };
+  const summary = {
+    activeCount: 1,
+    openCount: 1,
+    acknowledgedCount: 0,
+    suppressedCount: 0,
+    uncertainCount: 0,
+    resolvedCount: 0,
+    calm: false,
+    coverageState: 'current',
+    evaluatedAt: now,
+  };
+  let loseResponse = false;
+  let denied = false;
+  let created;
+  try {
+    await server.listen();
+    browser =
+      engine === 'webkit'
+        ? await webkit.launch({ headless: true })
+        : await chromium.launch({ headless: true, channel: 'chromium', args: ['--no-sandbox'] });
+    result.browser = browser.version();
+    const page = await browser.newPage({
+      viewport: { width, height: 900 },
+      colorScheme: width === 320 ? 'dark' : 'light',
+      isMobile: width === 320,
+      hasTouch: width === 320,
+    });
+    page.setDefaultTimeout(12000);
+    page.on('pageerror', (error) => result.errors.push(error.message));
+    const origin = 'http://127.0.0.1:5297';
+    await page.context().addCookies([
+      { name: 'pulse_csrf', value: 'synthetic-csrf', url: origin },
+      { name: 'pulse_session', value: 'synthetic-session', url: origin },
+    ]);
+    await page.addInitScript(() => {
+      if (matchMedia('(prefers-color-scheme: dark)').matches)
+        document.documentElement.classList.add('dark');
+    });
+    await page.routeWebSocket('**/ws*', () => {});
+    await page.route('**/*', async (route) => {
+      const request = route.request(),
+        url = new URL(request.url()),
+        method = request.method(),
+        p = url.pathname;
+      if (url.origin !== origin) {
+        result.offOrigin.push(url.origin);
+        return route.abort();
+      }
+      if (!p.startsWith('/api/')) return route.continue();
+      const org = request.headers()['x-pulse-org-id'];
+      result.requests.push({ path: p, method, org });
+      if (p === '/api/ai/patrol/suppressions') {
+        assert.equal(org, 'fixture-tenant-a');
+        if (method === 'GET') {
+          if (denied)
+            return route.fulfill({
+              status: 403,
+              json: { error: 'access_revoked' },
+              headers: { 'X-CSRF-Token': 'synthetic-replacement' },
+            });
+          return route.fulfill({ json: rules });
+        }
+        assert.equal(method, 'POST');
+        assert.equal(request.headers()['x-csrf-token'], 'synthetic-csrf');
+        const input = request.postDataJSON();
+        assert.equal(input.resource_id, 'fixture-db');
+        assert.equal(input.category, 'backup');
+        assert.equal(input.allow_broad_scope, undefined);
+        created = {
+          ...input,
+          id: 'rule_fixture-db_backup_1',
+          created_from: 'manual',
+          created_at: now,
+        };
+        rules.push(created);
+        return route.fulfill({ json: { success: true, rule: created } });
+      }
+      if (p.startsWith('/api/ai/patrol/suppressions/')) {
+        assert.equal(method, 'DELETE');
+        assert.equal(org, 'fixture-tenant-a');
+        assert.equal(request.headers()['x-csrf-token'], 'synthetic-csrf');
+        const id = decodeURIComponent(p.slice('/api/ai/patrol/suppressions/'.length));
+        const index = rules.findIndex((r) => r.id === id);
+        assert(index >= 0);
+        assert.equal(rules[index].created_from, 'manual');
+        rules.splice(index, 1);
+        if (loseResponse) {
+          loseResponse = false;
+          return route.abort('failed');
+        }
+        return route.fulfill({ json: { success: true } });
+      }
+      assert.equal(method, 'GET', `unexpected mutation ${p}`);
+      let json = {};
+      if (p === '/api/settings/ai')
+        json = {
+          patrol_enabled: true,
+          patrol_autonomy_level: 'monitor',
+          patrol_readiness: { status: 'ready', ready: true, cause: 'none' },
+        };
+      else if (p === '/api/ai/patrol/status')
+        json = {
+          enabled: true,
+          runtime_state: 'idle',
+          running: false,
+          readiness: { status: 'ready', ready: true, cause: 'none' },
+          summary: { active: 1, critical: 0, warning: 1, info: 0 },
+        };
+      else if (p === '/api/ai/patrol/attention')
+        json = { data: [item], summary, meta: { page: 1, limit: 50, total: 1, totalPages: 1 } };
+      else if (p === '/api/ai/patrol/attention/summary') json = summary;
+      else if (p === '/api/ai/patrol/attention/record-1')
+        json = {
+          item,
+          operationalRecord: {
+            id: item.id,
+            kind: item.kind,
+            state: item.state,
+            severity: item.severity,
+            title: item.title,
+            subjectResourceId: item.subjectResourceId,
+            subjectResourceName: item.subjectResourceName,
+            createdAt: now,
+            updatedAt: now,
+          },
+          timeline: [],
+          evidence: [],
+        };
+      else if (p === '/api/ai/patrol/autonomy')
+        json = { autonomy_level: 'monitor', full_mode_unlocked: false };
+      else if (p === '/api/ai/patrol/findings') json = [finding];
+      else if (p === '/api/ai/patrol/runs') json = [];
+      else if (p === '/api/ai/unified/findings') json = { findings: [] };
+      else if (p === '/api/ai/approvals') json = { approvals: [] };
+      else if (p === '/api/ai/models') json = { models: [] };
+      else if (p === '/api/license/runtime-capabilities')
+        json = {
+          capabilities: ['ai_patrol'],
+          limits: [],
+          hosted_mode: false,
+          max_history_days: 7,
+          runtime: { build: 'community', label: 'Pulse Community runtime' },
+          blocked_capabilities: [],
+        };
+      return route.fulfill({ json });
+    });
+    const capture = async (name) => {
+      const file = path.join(output, `${parent ? 'parent' : engine}-${width}-${name}.png`);
+      await page.screenshot({ path: file, fullPage: true });
+      report.captures.push({ path: file.replace('/workspace/', ''), sha256: hash(file) });
+      const dimensions = await page.evaluate(() => ({
+        inner: innerWidth,
+        scroll: document.documentElement.scrollWidth,
+      }));
+      assert(dimensions.scroll <= dimensions.inner + 1, JSON.stringify(dimensions));
+    };
+    await page.goto(`${origin}/browser-tests/patrol-rule-removal.html`, {
+      waitUntil: 'domcontentloaded',
+      timeout: 60000,
+    });
+    await page.getByRole('button', { name: 'Open Database VM · Backup age' }).click();
+    await page
+      .getByRole('list', { name: 'Lasting decisions' })
+      .getByRole('button', { name: 'Create rule', exact: true })
+      .click();
+    const form = page.getByRole('form', { name: 'Confirm Create rule' });
+    assert(await form.getByRole('button', { name: 'Confirm: Create rule' }).isDisabled());
+    await form.getByLabel(/Why this rule/).fill('Backups are deliberately held off-site');
+    await form.getByRole('button', { name: 'Confirm: Create rule' }).click();
+    await page.getByRole('status').filter({ hasText: 'Rule created.' }).waitFor();
+    assert(created);
+    result.checks.push(
+      'Production Inbox Create rule sends one narrow scoped POST with a written reason.',
+    );
+    if (parent) {
+      assert.equal(await page.getByRole('link', { name: 'Manage suppression rules' }).count(), 0);
+      await page.getByRole('tab', { name: 'Activity' }).click();
+      assert.equal(await page.locator('#patrol-suppression-rules').count(), 0);
+      assert.equal(result.requests.filter((r) => r.method === 'DELETE').length, 0);
+      await capture('no-reversal');
+      result.checks.push(
+        'Exact assigned parent creates a permanent rule but has no manual-rule reversal control.',
+      );
+      return;
+    }
+    await page.getByRole('link', { name: 'Manage suppression rules' }).click();
+    await page.getByRole('button', { name: 'Remove rule for Database VM, backup' }).waitFor();
+    assert.equal(await page.locator('#patrol-suppression-rules').getAttribute('open'), '');
+    await capture('manual-list');
+    const select = () => page.getByRole('button', { name: 'Remove rule for Database VM, backup' });
+    await select().click();
+    let dialog = page.getByRole('dialog', { name: 'Remove suppression rule?' });
+    await dialog.getByText(created.id, { exact: true }).waitFor();
+    assert(
+      await dialog
+        .getByRole('button', { name: 'Cancel' })
+        .evaluate((e) => e === document.activeElement),
+    );
+    await capture('exact-confirmation');
+    await page.keyboard.press('Escape');
+    await dialog.waitFor({ state: 'detached' });
+    assert.equal(result.requests.filter((r) => r.method === 'DELETE').length, 0);
+    await select().click();
+    await page.getByRole('dialog').getByRole('button', { name: 'Remove this rule' }).click();
+    await page.getByRole('status').filter({ hasText: 'Rule removed.' }).waitFor();
+    assert.equal(JSON.stringify(rules), initialUntouched);
+    assert.equal(result.requests.filter((r) => r.method === 'DELETE').length, 1);
+    assert.equal(await select().count(), 0);
+    await capture('removed-readback');
+    result.checks.push(
+      'Cancellation is non-mutating; exact manual deletion requires pre-read and post-read and preserves unrelated rules and finding-backed history.',
+    );
+
+    // The second existing creation control points at the same reversal flow.
+    await page.getByRole('button', { name: 'Finding options and history' }).click();
+    await page.getByRole('button', { name: 'Finding options for Off-site backup age' }).click();
+    await page.getByRole('button', { name: 'Create rule from this' }).click();
+    await page.getByRole('textbox', { name: 'Reason for suppression rule' }).waitFor();
+    assert.equal(
+      await page.getByRole('link', { name: 'Manage suppression rules' }).getAttribute('href'),
+      '/patrol/activity#patrol-suppression-rules',
+    );
+    await page.getByText(/Reopen finding only undoes an individual dismissal/).waitFor();
+    await capture('finding-create-link');
+    await page.getByRole('button', { name: 'Cancel', exact: true }).click();
+    result.checks.push(
+      'Production Finding options create control has an accessible reason field and the same Activity reversal link; no second POST.',
+    );
+
+    await page
+      .getByRole('button', { name: 'Remove rule for All resources, All categories' })
+      .click();
+    dialog = page.getByRole('dialog');
+    await dialog.getByText('This broad rule covers all resources in all categories.').waitFor();
+    await capture('wildcard-confirmation');
+    loseResponse = true;
+    await dialog.getByRole('button', { name: 'Remove this rule' }).click();
+    await page.getByRole('alert').filter({ hasText: 'Removal could not be confirmed.' }).waitFor();
+    assert.equal(result.requests.filter((r) => r.method === 'DELETE').length, 2);
+    await capture('uncertain-not-success');
+    await page.getByRole('button', { name: 'Reload rules' }).click();
+    await page.getByRole('button', { name: 'Remove rule for Keep VM, capacity' }).waitFor();
+    assert.equal(
+      await page
+        .getByRole('button', { name: 'Remove rule for All resources, All categories' })
+        .count(),
+      0,
+    );
+    assert.equal(result.requests.filter((r) => r.method === 'DELETE').length, 2);
+    result.checks.push(
+      'A lost DELETE response never retries or claims removal; explicit reload reconciles absence and keeps other decisions.',
+    );
+
+    await page.getByRole('button', { name: 'Remove rule for Keep VM, capacity' }).click();
+    denied = true;
+    await page.getByRole('dialog').getByRole('button', { name: 'Remove this rule' }).click();
+    await page.getByRole('alert').filter({ hasText: 'Removal could not be confirmed.' }).waitFor();
+    assert.equal(result.requests.filter((r) => r.method === 'DELETE').length, 2);
+    denied = false;
+    await page.getByRole('button', { name: 'Reload rules' }).click();
+    await page.getByRole('button', { name: 'Remove rule for Keep VM, capacity' }).click();
+    await page.evaluate(() => window.__patrolRuleRemoval.switchOrg());
+    await page.getByRole('alert').filter({ hasText: 'Organisation or access changed.' }).waitFor();
+    assert.equal(await page.getByRole('dialog').count(), 0);
+    assert.equal(await page.getByRole('button', { name: /^Remove rule for/ }).count(), 0);
+    assert.equal(result.requests.filter((r) => r.method === 'DELETE').length, 2);
+    await capture('scope-invalidated');
+    result.checks.push(
+      'Revoked access blocks before DELETE, then organisation switch discards pending confirmation and old rule data. No cross-tenant action or automatic retry.',
+    );
+    assert.deepEqual(result.errors, []);
+    assert.deepEqual(result.offOrigin, []);
+  } catch (error) {
+    result.failure = error.message;
+    throw error;
+  } finally {
+    if (browser) await browser.close();
+    await server.close();
+    result.cleanup = { browser_closed: Boolean(browser), server_closed: true };
+  }
+}
+(async () => {
+  try {
+    await journey(
+      '/workspace/tmp/patrol-rule-proof/parent/frontend-modern',
+      'chromium',
+      1365,
+      true,
+    );
+    await journey('/workspace/frontend-modern', 'chromium', 1365);
+    await journey('/workspace/frontend-modern', 'webkit', 320);
+    report.result = 'passed';
+  } catch (error) {
+    report.result = 'failed';
+    report.failure = error.message;
+    throw error;
+  } finally {
+    report.cleanup = {
+      all_cases_closed: report.cases.every(
+        (c) => c.cleanup.browser_closed && c.cleanup.server_closed,
+      ),
+    };
+    fs.writeFileSync(path.join(output, 'result.json'), JSON.stringify(report, null, 2));
+  }
+  console.log(
+    JSON.stringify({
+      result: report.result,
+      cases: report.cases.length,
+      captures: report.captures.length,
+      cleanup: report.cleanup,
+    }),
+  );
+})().catch((error) => {
+  console.error(error.stack);
+  process.exitCode = 1;
+});
diff --git a/frontend-modern/browser-tests/patrol-rule-removal.html b/frontend-modern/browser-tests/patrol-rule-removal.html
new file mode 100644
index 0000000000..f7a590a483
--- /dev/null
+++ b/frontend-modern/browser-tests/patrol-rule-removal.html
@@ -0,0 +1,11 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/browser-tests/patrol-rule-removal.tsx"></script>
+  </body>
+</html>
diff --git a/frontend-modern/browser-tests/patrol-rule-removal.tsx b/frontend-modern/browser-tests/patrol-rule-removal.tsx
new file mode 100644
index 0000000000..d0f80b9ef4
--- /dev/null
+++ b/frontend-modern/browser-tests/patrol-rule-removal.tsx
@@ -0,0 +1,33 @@
+// Mount the production Patrol surface under a local Router; the browser script
+// supplies bounded API responses for the manual-rule creation and reversal states.
+import { Route, Router } from '@solidjs/router';
+import { render } from 'solid-js/web';
+import { PatrolIntelligenceSurface } from '../src/features/patrol/PatrolIntelligenceSurface';
+import { eventBus } from '../src/stores/events';
+import { setOrgID } from '../src/utils/apiClient';
+import '../src/index.css';
+
+setOrgID('fixture-tenant-a');
+(window as any).__patrolRuleRemoval = {
+  switchOrg: () => {
+    setOrgID('fixture-tenant-b');
+    eventBus.emit('org_switched', 'fixture-tenant-b');
+  },
+  revoke: () => eventBus.emit('organizations_changed'),
+};
+
+render(
+  () => (
+    <Router>
+      <Route
+        path="*"
+        component={() => (
+          <main class="mx-auto max-w-6xl p-4">
+            <PatrolIntelligenceSurface />
+          </main>
+        )}
+      />
+    </Router>
+  ),
+  document.getElementById('root')!,
+);
diff --git a/frontend-modern/src/api/__tests__/patrol.test.ts b/frontend-modern/src/api/__tests__/patrol.test.ts
index 741418d603..4cd780eb17 100644
--- a/frontend-modern/src/api/__tests__/patrol.test.ts
+++ b/frontend-modern/src/api/__tests__/patrol.test.ts
@@ -13,6 +13,8 @@ import {
   getPatrolRunHistoryWithToolCalls,
   getPatrolRunWithToolCalls,
   createSuppressionRuleFromFinding,
+  getSuppressionRules,
+  deleteManualSuppressionRule,
   reopenFinding,
   resolveFinding,
   triggerPatrolRun,
@@ -35,6 +37,59 @@ describe('patrol api', () => {
     apiFetchJSONMock.mockResolvedValue([] as any);
   });
 
+  const manual = {
+    id: 'rule_vm/101_backup_1',
+    created_from: 'manual',
+    resource_id: 'vm/101',
+    category: 'backup',
+    description: 'Off-site copies',
+    created_at: '2026-10-05T12:00:00Z',
+  };
+  it('reads the exact organisation without fallback or retry, including a nil empty store', async () => {
+    const signal = new AbortController().signal;
+    apiFetchJSONMock.mockResolvedValueOnce([manual]);
+    await expect(getSuppressionRules('tenant-a', signal)).resolves.toEqual([manual]);
+    expect(apiFetchJSONMock).toHaveBeenLastCalledWith('/api/ai/patrol/suppressions', {
+      expectedOrgID: 'tenant-a',
+      retry: false,
+      signal,
+    });
+    apiFetchJSONMock.mockResolvedValueOnce(null);
+    await expect(getSuppressionRules('default')).resolves.toEqual([]);
+  });
+  it.each([{}, [null], [{ ...manual, id: '' }], [manual, manual], [{ ...manual, category: 7 }]])(
+    'rejects an invalid collection instead of presenting false absence: %j',
+    async (value) => {
+      apiFetchJSONMock.mockResolvedValueOnce(value as any);
+      await expect(getSuppressionRules('tenant-a')).rejects.toThrow('invalid rule list');
+    },
+  );
+  it('removes exactly one encoded manual identity, never a finding-backed or unknown-origin row', async () => {
+    const signal = new AbortController().signal;
+    apiFetchJSONMock.mockResolvedValueOnce({ success: true });
+    await deleteManualSuppressionRule(manual, 'tenant-a', signal);
+    expect(apiFetchJSONMock).toHaveBeenLastCalledWith(
+      '/api/ai/patrol/suppressions/rule_vm%2F101_backup_1',
+      {
+        method: 'DELETE',
+        expectedOrgID: 'tenant-a',
+        retry: false,
+        signal,
+      },
+    );
+    for (const row of [
+      { ...manual, id: 'finding_123' },
+      { ...manual, created_from: 'suppress' },
+      { ...manual, finding_id: '123' },
+    ])
+      await expect(deleteManualSuppressionRule(row, 'tenant-a')).rejects.toThrow('Only manually');
+    expect(apiFetchJSONMock).toHaveBeenCalledTimes(1);
+  });
+  it('requires an explicit successful deletion response', async () => {
+    apiFetchJSONMock.mockResolvedValueOnce({ success: false });
+    await expect(deleteManualSuppressionRule(manual, 'tenant-a')).rejects.toThrow('not confirmed');
+  });
+
   it('uses the retained-objective contract with encoded identities and revisions', async () => {
     apiFetchJSONMock.mockResolvedValueOnce({ objectives: [] } as any);
     await expect(getPatrolObjectives()).resolves.toEqual([]);
diff --git a/frontend-modern/src/api/patrol.ts b/frontend-modern/src/api/patrol.ts
index 1703d8eab5..b74686d107 100644
--- a/frontend-modern/src/api/patrol.ts
+++ b/frontend-modern/src/api/patrol.ts
@@ -523,6 +523,85 @@ export async function reopenFinding(
   });
 }
 
+export interface PatrolSuppressionRule {
+  id: string;
+  resource_id?: string;
+  resource_name?: string;
+  category?: string;
+  description: string;
+  created_at: string;
+  created_from?: string;
+  finding_id?: string;
+  dismissed_reason?: string;
+}
+
+export function isManualSuppressionRule(rule: PatrolSuppressionRule): boolean {
+  return (
+    rule.created_from === 'manual' &&
+    rule.id.startsWith('rule_') &&
+    !rule.finding_id &&
+    !rule.dismissed_reason
+  );
+}
+
+/** Read the existing collection without silently falling back to another tenant. */
+export async function getSuppressionRules(
+  orgID: string,
+  signal?: AbortSignal,
+): Promise<PatrolSuppressionRule[]> {
+  const data = await apiFetchJSON<unknown>('/api/ai/patrol/suppressions', {
+    expectedOrgID: orgID,
+    retry: false,
+    signal,
+  });
+  // The existing Go store serialises an empty nil slice as null.
+  if (data === null) return [];
+  const ids = new Set<string>();
+  if (
+    !Array.isArray(data) ||
+    data.some((row) => {
+      if (!row || typeof row !== 'object') return true;
+      if (
+        typeof row.id !== 'string' ||
+        !row.id.trim() ||
+        ids.has(row.id) ||
+        typeof row.description !== 'string' ||
+        typeof row.created_at !== 'string' ||
+        [
+          'resource_id',
+          'resource_name',
+          'category',
+          'created_from',
+          'finding_id',
+          'dismissed_reason',
+        ].some((key) => row[key] !== undefined && typeof row[key] !== 'string')
+      )
+        return true;
+      ids.add(row.id);
+      return false;
+    })
+  ) {
+    throw new Error('Patrol returned an invalid rule list. Reload before making changes.');
+  }
+  return data as PatrolSuppressionRule[];
+}
+
+/** Removing a manual rule never calls the finding-specific Reopen path. */
+export async function deleteManualSuppressionRule(
+  rule: PatrolSuppressionRule,
+  orgID: string,
+  signal?: AbortSignal,
+): Promise<void> {
+  if (!isManualSuppressionRule(rule)) {
+    throw new Error('Only manually created rules can be removed here.');
+  }
+  const result = await apiFetchJSON<{ success: boolean }>(
+    `/api/ai/patrol/suppressions/${encodeURIComponent(rule.id)}`,
+    { method: 'DELETE', expectedOrgID: orgID, retry: false, signal },
+  );
+  if (result?.success !== true) throw new Error('Rule removal was not confirmed.');
+}
+
 /**
  * Create a permanent suppression rule from a finding.
  *
diff --git a/frontend-modern/src/components/AI/FindingsPanel.tsx b/frontend-modern/src/components/AI/FindingsPanel.tsx
index c5aaaaeae8..50eb876e8f 100644
--- a/frontend-modern/src/components/AI/FindingsPanel.tsx
+++ b/frontend-modern/src/components/AI/FindingsPanel.tsx
@@ -13,6 +13,8 @@
 import { Component, createSignal, createEffect, Show, For, createMemo } from 'solid-js';
 import { useLocation } from '@solidjs/router';
 import { Card } from '@/components/shared/Card';
+import { ButtonLink } from '@/components/shared/Button';
+import { PATROL_SUPPRESSION_RULES_PATH } from '@/features/patrol/PatrolSuppressionRules';
 import { FormSelect } from '@/components/shared/FormSelect';
 import { LoadingSpinner } from '@/components/shared/LoadingSpinner';
 import { MetadataBadge } from '@/components/shared/MetadataBadge';
@@ -1943,12 +1945,21 @@ export const FindingsPanel: Component<FindingsPanelProps> = (props) => {
             </div>
             <p class="text-[11px] text-muted mb-1.5">
               Future findings matching this resource and category will be auto-dismissed by Patrol
-              without surfacing as new findings. You can list or remove rules later from the
-              suppressions management surface.
+              without surfacing as new findings. Remove this permanent rule under Activity →
+              Suppression rules; Reopen finding only undoes an individual dismissal.
             </p>
+            <ButtonLink
+              href={PATROL_SUPPRESSION_RULES_PATH}
+              variant="ghost"
+              size="sm"
+              class="min-h-11"
+            >
+              Manage suppression rules
+            </ButtonLink>
             <textarea
               class="w-full text-xs px-2 py-1.5 rounded-sm border border-border bg-surface text-base-content resize-none focus:outline-hidden focus:ring-1 focus:ring-blue-400"
               rows={2}
+              aria-label="Reason for suppression rule"
               value={createRuleDescription()}
               onInput={(e) => setCreateRuleDescription(e.currentTarget.value)}
               placeholder="Why this rule? (required — e.g. 'delly backups are intentionally off-site, ignore failures')"
diff --git a/frontend-modern/src/components/AI/__tests__/FindingsPanel.links.test.tsx b/frontend-modern/src/components/AI/__tests__/FindingsPanel.links.test.tsx
index f97849bbb8..08e50ab8fc 100644
--- a/frontend-modern/src/components/AI/__tests__/FindingsPanel.links.test.tsx
+++ b/frontend-modern/src/components/AI/__tests__/FindingsPanel.links.test.tsx
@@ -618,6 +618,19 @@ describe('FindingsPanel resource links', () => {
     expect(screen.getByRole('button', { name: 'Dismiss: Later' })).toBeInTheDocument();
     expect(screen.getByRole('button', { name: 'Create rule from this' })).toBeInTheDocument();
 
+    fireEvent.click(screen.getByRole('button', { name: 'Create rule from this' }));
+    expect(
+      screen.getByRole('textbox', { name: 'Reason for suppression rule' }),
+    ).toBeInTheDocument();
+    expect(screen.getByRole('link', { name: 'Manage suppression rules' })).toHaveAttribute(
+      'href',
+      '/patrol/activity#patrol-suppression-rules',
+    );
+    expect(
+      screen.getByText(/Reopen finding only undoes an individual dismissal/),
+    ).toBeInTheDocument();
+    fireEvent.click(screen.getByRole('button', { name: /^Cancel$/ }));
+
     fireEvent.click(options);
     expect(options).toHaveAttribute('aria-expanded', 'false');
     expect(
diff --git a/frontend-modern/src/features/patrol/PatrolAttentionWorkbench.tsx b/frontend-modern/src/features/patrol/PatrolAttentionWorkbench.tsx
index 76bbcbe03d..cf86a215a6 100644
--- a/frontend-modern/src/features/patrol/PatrolAttentionWorkbench.tsx
+++ b/frontend-modern/src/features/patrol/PatrolAttentionWorkbench.tsx
@@ -37,6 +37,7 @@ import {
   unsuppressPatrolAttention,
 } from '@/api/patrolAttention';
 import { createSuppressionRuleFromFinding } from '@/api/patrol';
+import { PATROL_SUPPRESSION_RULES_PATH } from './PatrolSuppressionRules';
 import { ResourceActionsAPI } from '@/api/resourceActions';
 import { Button, ButtonLink, CopyValueButton } from '@/components/shared/Button';
 import { FormSelect } from '@/components/shared/FormSelect';
@@ -1660,6 +1661,14 @@ function AttentionLastingDecisions(props: {
             {error()}
           </p>
         </Show>
+        <ButtonLink
+          href={PATROL_SUPPRESSION_RULES_PATH}
+          variant="ghost"
+          size="sm"
+          class="mt-3 min-h-11"
+        >
+          Manage suppression rules
+        </ButtonLink>
       </div>
     </DetailSection>
   );
diff --git a/frontend-modern/src/features/patrol/PatrolIntelligenceSurface.tsx b/frontend-modern/src/features/patrol/PatrolIntelligenceSurface.tsx
index 234795d4fa..90ca3c1306 100644
--- a/frontend-modern/src/features/patrol/PatrolIntelligenceSurface.tsx
+++ b/frontend-modern/src/features/patrol/PatrolIntelligenceSurface.tsx
@@ -21,6 +21,7 @@ import { PatrolAttentionWorkbench } from './PatrolAttentionWorkbench';
 import { PatrolObjectivesPanel } from './PatrolObjectivesPanel';
 import { PatrolRecentWorkPanel } from './PatrolRecentWorkPanel';
 import { PatrolWeeklyDigestCard } from './PatrolWeeklyDigestCard';
+import { PatrolSuppressionRules } from './PatrolSuppressionRules';
 import type { AttentionItem } from '@/api/patrolAttention';
 
 interface FindingResourceScope {
@@ -242,6 +243,8 @@ export function PatrolIntelligenceSurface() {
             </div>
           </section>
 
+          <PatrolSuppressionRules openForLink={location.hash === '#patrol-suppression-rules'} />
+
           <details
             ref={findingsPanel}
             id="patrol-operational-records"
diff --git a/frontend-modern/src/features/patrol/PatrolSuppressionRules.tsx b/frontend-modern/src/features/patrol/PatrolSuppressionRules.tsx
new file mode 100644
index 0000000000..2795c3a914
--- /dev/null
+++ b/frontend-modern/src/features/patrol/PatrolSuppressionRules.tsx
@@ -0,0 +1,347 @@
+import {
+  createEffect,
+  createMemo,
+  createSignal,
+  For,
+  onCleanup,
+  onMount,
+  Show,
+  untrack,
+} from 'solid-js';
+import {
+  deleteManualSuppressionRule,
+  getSuppressionRules,
+  isManualSuppressionRule,
+  type PatrolSuppressionRule,
+} from '@/api/patrol';
+import { Button } from '@/components/shared/Button';
+import { Dialog } from '@/components/shared/Dialog';
+import { eventBus } from '@/stores/events';
+import { getOrgID } from '@/utils/apiClient';
+
+export const PATROL_SUPPRESSION_RULES_PATH = '/patrol/activity#patrol-suppression-rules';
+
+const ruleScope = (rule: PatrolSuppressionRule) => ({
+  resource: rule.resource_id ? rule.resource_name || rule.resource_id : 'All resources',
+  category: rule.category || 'All categories',
+});
+const sameRule = (left: PatrolSuppressionRule, right: PatrolSuppressionRule) =>
+  [
+    'id',
+    'resource_id',
+    'resource_name',
+    'category',
+    'description',
+    'created_at',
+    'created_from',
+    'finding_id',
+  ].every(
+    (key) => left[key as keyof PatrolSuppressionRule] === right[key as keyof PatrolSuppressionRule],
+  );
+
+/** A reversible manual-rule control inside Patrol's existing Activity flow. */
+export function PatrolSuppressionRules(props: { openForLink?: boolean } = {}) {
+  const [open, setOpen] = createSignal(false);
+  const [rules, setRules] = createSignal<PatrolSuppressionRule[]>();
+  const [selected, setSelected] = createSignal<PatrolSuppressionRule>();
+  const [busy, setBusy] = createSignal(false);
+  const [error, setError] = createSignal('');
+  const [notice, setNotice] = createSignal('');
+  const manualRules = createMemo(() => rules()?.filter(isManualSuppressionRule) ?? []);
+  const otherCount = createMemo(() => (rules()?.length ?? 0) - manualRules().length);
+  let loadedOrg = '';
+  let generation = 0;
+  let request: AbortController | undefined;
+  let summary: HTMLElement | undefined;
+  let trigger: HTMLElement | undefined;
+  const currentOrg = () => getOrgID() || 'default';
+  const begin = () => {
+    request?.abort();
+    request = new AbortController();
+    return { generation: ++generation, controller: request, org: currentOrg() };
+  };
+  const isCurrent = (run: ReturnType<typeof begin>) =>
+    run.generation === generation && !run.controller.signal.aborted && run.org === currentOrg();
+  const invalidate = () => {
+    ++generation;
+    request?.abort();
+    setRules(undefined);
+    setSelected(undefined);
+    setBusy(false);
+    setNotice('');
+    setError('Organisation or access changed. Reload rules before making changes.');
+  };
+  const offOrg = eventBus.on('org_switched', invalidate);
+  const offMembership = eventBus.on('organizations_changed', invalidate);
+  onCleanup(() => {
+    ++generation;
+    request?.abort();
+    offOrg();
+    offMembership();
+  });
+
+  const load = async () => {
+    if (busy()) return;
+    const run = begin();
+    setBusy(true);
+    setSelected(undefined);
+    setRules(undefined);
+    setError('');
+    setNotice('');
+    try {
+      const data = await getSuppressionRules(run.org, run.controller.signal);
+      if (!isCurrent(run)) return;
+      loadedOrg = run.org;
+      setRules(data);
+    } catch {
+      if (isCurrent(run))
+        setError('Rules could not be loaded. Check your access and reload rules.');
+    } finally {
+      if (run.generation === generation) {
+        if (run.org !== currentOrg()) invalidate();
+        else setBusy(false);
+      }
+    }
+  };
+  const choose = (rule: PatrolSuppressionRule, button: HTMLElement) => {
+    if (busy() || !rules() || !isManualSuppressionRule(rule)) return;
+    if (loadedOrg !== currentOrg()) return invalidate();
+    trigger = button;
+    setNotice('');
+    setSelected({ ...rule });
+  };
+  const remove = async () => {
+    const rule = selected();
+    if (!rule || busy() || !rules()) return;
+    if (loadedOrg !== currentOrg()) return invalidate();
+    const run = begin();
+    setBusy(true);
+    setError('');
+    try {
+      // A fresh authorised read verifies the exact displayed scope/origin.
+      // Do not act on a stale, edited, missing or cross-tenant confirmation.
+      const before = await getSuppressionRules(run.org, run.controller.signal);
+      if (!isCurrent(run)) return;
+      const current = before.find((entry) => entry.id === rule.id);
+      if (!current || !isManualSuppressionRule(current) || !sameRule(current, rule)) {
+        throw new Error('The confirmed rule is no longer current.');
+      }
+      await deleteManualSuppressionRule(current, run.org, run.controller.signal);
+      if (!isCurrent(run)) return;
+      const after = await getSuppressionRules(run.org, run.controller.signal);
+      if (!isCurrent(run)) return;
+      if (after.some((entry) => entry.id === rule.id)) throw new Error('Rule still present.');
+      // The deleted row is gone; return focus to a stable control, not its
+      // detached button. Cancellation returns to the selected row instead.
+      trigger = summary;
+      setRules(after);
+      setSelected(undefined);
+      setNotice(
+        'Rule removed. Future matching findings can appear. Dismissed findings and history were not reopened or removed; other rules may still cover the same scope.',
+      );
+    } catch {
+      if (!isCurrent(run)) return;
+      trigger = summary;
+      setSelected(undefined);
+      setRules(undefined);
+      setError('Removal could not be confirmed. Reload rules before trying again.');
+    } finally {
+      if (run.generation === generation) {
+        if (run.org !== currentOrg()) invalidate();
+        else setBusy(false);
+      }
+    }
+  };
+  const openFromLink = () => {
+    setOpen(true);
+    if (!rules() && !busy()) void load();
+    queueMicrotask(() => summary?.focus());
+  };
+  const openFromHash = () => {
+    if (window.location.hash === '#patrol-suppression-rules') openFromLink();
+  };
+  onMount(() => {
+    openFromHash();
+    window.addEventListener('hashchange', openFromHash);
+    onCleanup(() => window.removeEventListener('hashchange', openFromHash));
+  });
+  createEffect(() => {
+    // Router state can update before pushState changes window.location. The
+    // confirmed route hash supplied by the owner is already authoritative.
+    if (props.openForLink) untrack(openFromLink);
+  });
+
+  return (
+    <details
+      id="patrol-suppression-rules"
+      class="rounded-lg border border-border bg-surface"
+      open={open()}
+      onToggle={(event) => {
+        const next = event.currentTarget.open;
+        setOpen(next);
+        if (next && !rules() && !busy() && !error()) void load();
+      }}
+    >
+      <summary
+        ref={summary}
+        class="min-h-11 cursor-pointer rounded-lg px-4 py-3 text-sm font-semibold text-base-content focus-visible:outline-2 focus-visible:outline-blue-500 sm:px-5"
+      >
+        Suppression rules
+      </summary>
+      <Show when={open()}>
+        <div class="space-y-3 border-t border-border p-4 sm:p-5">
+          <p class="text-sm leading-5 text-muted">
+            Review permanent rules created with Create rule. Removing one allows future matching
+            Patrol findings; it does not reopen dismissed findings or erase history. Use Reopen
+            finding in Finding options and history to undo an individual dismissal.
+          </p>
+          <Button
+            variant="secondary"
+            size="sm"
+            class="min-h-11"
+            disabled={busy()}
+            onClick={() => void load()}
+          >
+            {busy() ? 'Checking rules…' : 'Reload rules'}
+          </Button>
+          <Show when={error()}>
+            <p role="alert" class="text-sm text-red-700 dark:text-red-300">
+              {error()}
+            </p>
+          </Show>
+          <Show when={notice()}>
+            <p role="status" class="text-sm text-base-content">
+              {notice()}
+            </p>
+          </Show>
+          <Show when={rules()}>
+            <Show
+              when={manualRules().length > 0}
+              fallback={<p class="text-sm text-muted">No manually created suppression rules.</p>}
+            >
+              <ul class="space-y-3" aria-label="Manually created suppression rules">
+                <For each={manualRules()}>
+                  {(rule) => (
+                    <li class="rounded-md border border-border p-3">
+                      <div class="flex flex-col gap-3 sm:flex-row sm:items-start sm:justify-between">
+                        <div class="min-w-0 space-y-1 text-sm text-base-content">
+                          <p class="break-words font-medium">
+                            {ruleScope(rule).resource} · {ruleScope(rule).category}
+                          </p>
+                          <Show when={!rule.resource_id || !rule.category}>
+                            <p class="text-sm font-medium text-amber-800 dark:text-amber-200">
+                              Broad rule: matches{' '}
+                              {!rule.resource_id ? 'all resources' : 'this resource'} in{' '}
+                              {!rule.category ? 'all categories' : rule.category}.
+                            </p>
+                          </Show>
+                          <p class="whitespace-pre-wrap break-words">
+                            {rule.description || 'No reason recorded.'}
+                          </p>
+                          <Show when={rule.resource_id}>
+                            <p class="break-all text-xs text-muted">
+                              Resource ID: {rule.resource_id}
+                            </p>
+                          </Show>
+                          <p class="break-all text-xs text-muted">Rule ID: {rule.id}</p>
+                        </div>
+                        <Button
+                          variant="secondary"
+                          size="sm"
+                          class="min-h-11 shrink-0 self-start"
+                          disabled={busy()}
+                          aria-label={`Remove rule for ${ruleScope(rule).resource}, ${ruleScope(rule).category}`}
+                          onClick={(event) => choose(rule, event.currentTarget)}
+                        >
+                          Remove rule
+                        </Button>
+                      </div>
+                    </li>
+                  )}
+                </For>
+              </ul>
+            </Show>
+            <Show when={otherCount() > 0}>
+              <p class="text-xs leading-5 text-muted">
+                {otherCount()} other remembered{' '}
+                {otherCount() === 1 ? 'decision is' : 'decisions are'} not manual rules and cannot
+                be removed here. Finding dismissals remain in Finding options and history.
+              </p>
+            </Show>
+          </Show>
+        </div>
+      </Show>
+      <Dialog
+        isOpen={Boolean(selected())}
+        ariaLabel="Remove suppression rule?"
+        onClose={() => {
+          if (!busy()) setSelected(undefined);
+        }}
+        returnFocus={() => trigger}
+      >
+        <Show when={selected()}>
+          {(rule) => (
+            <div class="space-y-4 p-5">
+              <h2 class="text-base font-semibold text-base-content">Remove suppression rule?</h2>
+              <p class="text-sm leading-5 text-muted">
+                Only this exact manual rule will be removed. Future matching findings can appear;
+                existing dismissals and history stay unchanged.
+              </p>
+              <dl class="space-y-2 text-sm text-base-content">
+                <div>
+                  <dt class="font-medium">Resource</dt>
+                  <dd class="break-words">{ruleScope(rule()).resource}</dd>
+                </div>
+                <Show when={rule().resource_id}>
+                  <div>
+                    <dt class="font-medium">Resource ID</dt>
+                    <dd class="break-all">{rule().resource_id}</dd>
+                  </div>
+                </Show>
+                <div>
+                  <dt class="font-medium">Category</dt>
+                  <dd>{ruleScope(rule()).category}</dd>
+                </div>
+                <div>
+                  <dt class="font-medium">Reason</dt>
+                  <dd class="whitespace-pre-wrap break-words">
+                    {rule().description || 'No reason recorded.'}
+                  </dd>
+                </div>
+                <div>
+                  <dt class="font-medium">Rule ID</dt>
+                  <dd class="break-all">{rule().id}</dd>
+                </div>
+              </dl>
+              <Show when={!rule().resource_id || !rule().category}>
+                <p class="text-sm font-medium text-amber-800 dark:text-amber-200">
+                  This broad rule covers {!rule().resource_id ? 'all resources' : 'this resource'}{' '}
+                  in {!rule().category ? 'all categories' : rule().category}.
+                </p>
+              </Show>
+              <div class="flex flex-wrap gap-2">
+                <Button
+                  variant="secondary"
+                  class="min-h-11"
+                  autofocus
+                  disabled={busy()}
+                  onClick={() => setSelected(undefined)}
+                >
+                  Cancel
+                </Button>
+                <Button
+                  variant="danger"
+                  class="min-h-11"
+                  disabled={busy()}
+                  onClick={() => void remove()}
+                >
+                  {busy() ? 'Verifying removal…' : 'Remove this rule'}
+                </Button>
+              </div>
+            </div>
+          )}
+        </Show>
+      </Dialog>
+    </details>
+  );
+}
diff --git a/frontend-modern/src/features/patrol/__tests__/PatrolAttentionWorkbench.test.tsx b/frontend-modern/src/features/patrol/__tests__/PatrolAttentionWorkbench.test.tsx
index 3c5ff2b423..55b931eefa 100644
--- a/frontend-modern/src/features/patrol/__tests__/PatrolAttentionWorkbench.test.tsx
+++ b/frontend-modern/src/features/patrol/__tests__/PatrolAttentionWorkbench.test.tsx
@@ -865,6 +865,10 @@ describe('PatrolAttentionWorkbench', () => {
     );
     expect(apiMocks.loadPatrolFindings).toHaveBeenCalled();
     expect(await screen.findByRole('status')).toHaveTextContent(/Rule created/i);
+    expect(screen.getByRole('link', { name: 'Manage suppression rules' })).toHaveAttribute(
+      'href',
+      '/patrol/activity#patrol-suppression-rules',
+    );
   });
 
   it('shows the remembered decision and a reopen path instead of re-offering it', async () => {
diff --git a/frontend-modern/src/features/patrol/__tests__/PatrolIntelligenceSurface.test.tsx b/frontend-modern/src/features/patrol/__tests__/PatrolIntelligenceSurface.test.tsx
index 9679ed439e..91b1ff2c1f 100644
--- a/frontend-modern/src/features/patrol/__tests__/PatrolIntelligenceSurface.test.tsx
+++ b/frontend-modern/src/features/patrol/__tests__/PatrolIntelligenceSurface.test.tsx
@@ -143,6 +143,15 @@ describe('PatrolIntelligenceSurface finding handoff', () => {
     await vi.waitFor(() => expect(window.location.pathname).toBe('/patrol'));
   });
 
+  it('keeps manual-rule reversal reachable in Activity even with the findings panel closed', () => {
+    window.history.replaceState(null, '', '/patrol/activity');
+    renderSurface();
+    const rules = document.getElementById('patrol-suppression-rules');
+    expect(rules?.querySelector('summary')).toHaveTextContent('Suppression rules');
+    expect(rules).not.toHaveAttribute('open');
+    expect(document.getElementById('patrol-operational-records')).not.toHaveAttribute('open');
+  });
+
   it('lands the finding handoff on the findings panel without a scroll to the top', async () => {
     const scrollTo = vi.spyOn(window, 'scrollTo').mockImplementation(() => {});
     const scrollIntoView = vi.fn();
diff --git a/frontend-modern/src/features/patrol/__tests__/PatrolSuppressionRules.test.tsx b/frontend-modern/src/features/patrol/__tests__/PatrolSuppressionRules.test.tsx
new file mode 100644
index 0000000000..f3095ca736
--- /dev/null
+++ b/frontend-modern/src/features/patrol/__tests__/PatrolSuppressionRules.test.tsx
@@ -0,0 +1,261 @@
+import { cleanup, fireEvent, render, screen, waitFor, within } from '@solidjs/testing-library';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { eventBus } from '@/stores/events';
+import { PatrolSuppressionRules } from '../PatrolSuppressionRules';
+import {
+  deleteManualSuppressionRule,
+  getSuppressionRules,
+  type PatrolSuppressionRule,
+} from '@/api/patrol';
+
+const context = vi.hoisted(() => ({ org: 'tenant-a' }));
+vi.mock('@/utils/apiClient', () => ({ getOrgID: () => context.org }));
+vi.mock('@/api/patrol', async (original) => ({
+  ...(await original<typeof import('@/api/patrol')>()),
+  getSuppressionRules: vi.fn(),
+  deleteManualSuppressionRule: vi.fn(),
+}));
+const read = vi.mocked(getSuppressionRules);
+const remove = vi.mocked(deleteManualSuppressionRule);
+const manual: PatrolSuppressionRule = {
+  id: 'rule_vm-101_backup_1',
+  resource_id: 'vm-101',
+  resource_name: 'Database VM',
+  category: 'backup',
+  description: 'Backups are held off-site',
+  created_from: 'manual',
+  created_at: '2026-10-05T12:00:00Z',
+};
+const broad: PatrolSuppressionRule = {
+  ...manual,
+  id: 'rule_any_any_2',
+  resource_id: '',
+  resource_name: '',
+  category: '',
+  description: 'Intentional maintenance',
+};
+const dismissed: PatrolSuppressionRule = {
+  ...manual,
+  id: 'finding_important',
+  finding_id: 'important',
+  created_from: 'dismissed',
+};
+const legacy: PatrolSuppressionRule = { ...manual, id: 'rule_legacy', created_from: 'suppress' };
+const initial = [manual, broad, dismissed, legacy];
+
+async function openRules() {
+  const view = render(() => <PatrolSuppressionRules />);
+  const details = document.getElementById('patrol-suppression-rules') as HTMLDetailsElement;
+  details.open = true;
+  fireEvent(details, new Event('toggle'));
+  await screen.findByRole('button', { name: 'Remove rule for Database VM, backup' });
+  return view;
+}
+async function chooseManual() {
+  fireEvent.click(screen.getByRole('button', { name: 'Remove rule for Database VM, backup' }));
+  return screen.findByRole('dialog', { name: 'Remove suppression rule?' });
+}
+function deferred<T>() {
+  let resolve!: (value: T) => void;
+  const promise = new Promise<T>((done) => {
+    resolve = done;
+  });
+  return { promise, resolve };
+}
+
+describe('Patrol manual-rule reversal', () => {
+  beforeEach(() => {
+    context.org = 'tenant-a';
+    window.history.replaceState(null, '', '/patrol/activity');
+    read.mockReset().mockResolvedValue(initial);
+    remove.mockReset().mockResolvedValue(undefined);
+  });
+  afterEach(cleanup);
+
+  it('does not load until requested; shows exact IDs, reasons, wildcard scope and non-manual distinction', async () => {
+    render(() => <PatrolSuppressionRules />);
+    expect(read).not.toHaveBeenCalled();
+    const details = document.getElementById('patrol-suppression-rules') as HTMLDetailsElement;
+    details.open = true;
+    fireEvent(details, new Event('toggle'));
+    await screen.findByText('Rule ID: rule_vm-101_backup_1');
+    expect(screen.getByText('Resource ID: vm-101')).toBeInTheDocument();
+    expect(screen.getByText('Backups are held off-site')).toBeInTheDocument();
+    expect(
+      screen.getByText('Broad rule: matches all resources in all categories.'),
+    ).toBeInTheDocument();
+    expect(screen.getAllByRole('button', { name: /^Remove rule for/ })).toHaveLength(2);
+    expect(screen.getByText(/2 other remembered decisions/)).toBeInTheDocument();
+    expect(screen.queryByText('Rule ID: finding_important')).not.toBeInTheDocument();
+    expect(read).toHaveBeenCalledWith('tenant-a', expect.any(AbortSignal));
+  });
+
+  it('confirms the exact scope with safe initial focus and permits cancellation without a mutation', async () => {
+    await openRules();
+    const trigger = screen.getByRole('button', { name: 'Remove rule for Database VM, backup' });
+    trigger.focus();
+    const dialog = await chooseManual();
+    expect(within(dialog).getByText(manual.id)).toBeInTheDocument();
+    expect(within(dialog).getByText(manual.description)).toBeInTheDocument();
+    await waitFor(() =>
+      expect(within(dialog).getByRole('button', { name: 'Cancel' })).toHaveFocus(),
+    );
+    fireEvent.keyDown(document, { key: 'Escape' });
+    await waitFor(() => expect(screen.queryByRole('dialog')).not.toBeInTheDocument());
+    expect(remove).not.toHaveBeenCalled();
+    expect(read).toHaveBeenCalledTimes(1);
+    await waitFor(() => expect(trigger).toHaveFocus());
+  });
+
+  it('revalidates, deletes one exact manual ID and confirms absence while keeping unrelated decisions', async () => {
+    await openRules();
+    read.mockResolvedValueOnce(initial).mockResolvedValueOnce([broad, dismissed, legacy]);
+    await chooseManual();
+    fireEvent.click(screen.getByRole('button', { name: 'Remove this rule' }));
+    await screen.findByRole('status');
+    expect(remove).toHaveBeenCalledExactlyOnceWith(manual, 'tenant-a', expect.any(AbortSignal));
+    expect(read).toHaveBeenCalledTimes(3);
+    expect(screen.queryByText(`Rule ID: ${manual.id}`)).not.toBeInTheDocument();
+    expect(screen.getByText(`Rule ID: ${broad.id}`)).toBeInTheDocument();
+    expect(screen.getByText(/2 other remembered decisions/)).toBeInTheDocument();
+    expect(screen.getByRole('status')).toHaveTextContent(
+      'Dismissed findings and history were not reopened or removed',
+    );
+    await waitFor(() =>
+      expect(
+        document.getElementById('patrol-suppression-rules')?.querySelector('summary'),
+      ).toHaveFocus(),
+    );
+  });
+
+  it('shows all-resource/all-category scope again at confirmation', async () => {
+    await openRules();
+    fireEvent.click(
+      screen.getByRole('button', { name: 'Remove rule for All resources, All categories' }),
+    );
+    const dialog = await screen.findByRole('dialog');
+    expect(within(dialog).getByText('All resources')).toBeInTheDocument();
+    expect(within(dialog).getByText('All categories')).toBeInTheDocument();
+    expect(
+      within(dialog).getByText('This broad rule covers all resources in all categories.'),
+    ).toBeInTheDocument();
+  });
+
+  it.each([
+    ['scope changed', [{ ...manual, category: 'security' }, broad]],
+    ['manual origin changed', [{ ...manual, created_from: 'finding' }, broad]],
+    ['already removed', [broad]],
+  ])('stops without DELETE when the confirmed rule is %s', async (_, changed) => {
+    await openRules();
+    read.mockResolvedValueOnce(changed);
+    await chooseManual();
+    fireEvent.click(screen.getByRole('button', { name: 'Remove this rule' }));
+    await screen.findByRole('alert');
+    expect(remove).not.toHaveBeenCalled();
+    expect(screen.queryByRole('button', { name: /^Remove rule for/ })).not.toBeInTheDocument();
+    expect(screen.queryByRole('status')).not.toBeInTheDocument();
+  });
+
+  it('invalidates the confirmation and old data on an organisation switch', async () => {
+    await openRules();
+    await chooseManual();
+    context.org = 'tenant-b';
+    eventBus.emit('org_switched', context.org);
+    expect(screen.queryByRole('dialog')).not.toBeInTheDocument();
+    expect(screen.queryByText(`Rule ID: ${manual.id}`)).not.toBeInTheDocument();
+    expect(screen.getByRole('alert')).toHaveTextContent('Organisation or access changed');
+    expect(remove).not.toHaveBeenCalled();
+    read.mockResolvedValueOnce([]);
+    fireEvent.click(screen.getByRole('button', { name: 'Reload rules' }));
+    await screen.findByText('No manually created suppression rules.');
+    expect(read).toHaveBeenLastCalledWith('tenant-b', expect.any(AbortSignal));
+  });
+
+  it('drops a late preflight after access revocation without deleting or reloading automatically', async () => {
+    await openRules();
+    const pending = deferred<PatrolSuppressionRule[]>();
+    read.mockReturnValueOnce(pending.promise);
+    await chooseManual();
+    fireEvent.click(screen.getByRole('button', { name: 'Remove this rule' }));
+    const signal = read.mock.lastCall![1]!;
+    eventBus.emit('organizations_changed');
+    pending.resolve(initial);
+    await waitFor(() => expect(signal.aborted).toBe(true));
+    expect(remove).not.toHaveBeenCalled();
+    expect(read).toHaveBeenCalledTimes(2);
+    expect(screen.queryByRole('status')).not.toBeInTheDocument();
+  });
+
+  it('checks context even when a switch did not emit an event', async () => {
+    await openRules();
+    await chooseManual();
+    context.org = 'tenant-b';
+    fireEvent.click(screen.getByRole('button', { name: 'Remove this rule' }));
+    expect(remove).not.toHaveBeenCalled();
+    expect(read).toHaveBeenCalledTimes(1);
+    expect(screen.getByRole('alert')).toHaveTextContent('Reload rules');
+  });
+
+  it.each(['transport', '403'])(
+    'requires explicit readback after %s uncertainty and never retries DELETE',
+    async () => {
+      await openRules();
+      remove.mockRejectedValueOnce(new Error('Uncertain or refused request'));
+      await chooseManual();
+      fireEvent.click(screen.getByRole('button', { name: 'Remove this rule' }));
+      await screen.findByRole('alert');
+      expect(remove).toHaveBeenCalledTimes(1);
+      expect(read).toHaveBeenCalledTimes(2);
+      expect(screen.getByRole('alert')).toHaveTextContent('Removal could not be confirmed');
+      expect(screen.queryByRole('status')).not.toBeInTheDocument();
+      read.mockResolvedValueOnce([]);
+      fireEvent.click(screen.getByRole('button', { name: 'Reload rules' }));
+      await screen.findByText('No manually created suppression rules.');
+      expect(remove).toHaveBeenCalledTimes(1);
+      expect(screen.queryByRole('status')).not.toBeInTheDocument();
+    },
+  );
+
+  it('does not claim success when readback fails or still contains the deleted ID', async () => {
+    await openRules();
+    await chooseManual();
+    fireEvent.click(screen.getByRole('button', { name: 'Remove this rule' }));
+    await screen.findByRole('alert');
+    expect(remove).toHaveBeenCalledTimes(1);
+    expect(read).toHaveBeenCalledTimes(3);
+    expect(screen.queryByRole('status')).not.toBeInTheDocument();
+  });
+
+  it('prevents duplicate submission and aborts late readback on disposal', async () => {
+    const view = await openRules();
+    const pending = deferred<PatrolSuppressionRule[]>();
+    read.mockResolvedValueOnce(initial).mockReturnValueOnce(pending.promise);
+    await chooseManual();
+    fireEvent.click(screen.getByRole('button', { name: 'Remove this rule' }));
+    await waitFor(() => expect(read).toHaveBeenCalledTimes(3));
+    fireEvent.click(screen.getByRole('button', { name: 'Verifying removal…' }));
+    expect(remove).toHaveBeenCalledTimes(1);
+    const signal = read.mock.lastCall![1]!;
+    view.unmount();
+    expect(signal.aborted).toBe(true);
+    pending.resolve([broad]);
+  });
+
+  it('opens a linked rule section on mount without making a mutation', async () => {
+    window.history.replaceState(null, '', '/patrol/activity#patrol-suppression-rules');
+    render(() => <PatrolSuppressionRules />);
+    await screen.findByText(`Rule ID: ${manual.id}`);
+    expect(document.getElementById('patrol-suppression-rules')).toHaveAttribute('open');
+    expect(remove).not.toHaveBeenCalled();
+  });
+
+  it('honours router hash state before browser history has caught up', async () => {
+    // Solid Router can mount the Activity view before its pushState effect.
+    expect(window.location.hash).toBe('');
+    render(() => <PatrolSuppressionRules openForLink />);
+    await screen.findByText(`Rule ID: ${manual.id}`);
+    expect(document.getElementById('patrol-suppression-rules')).toHaveAttribute('open');
+    expect(read).toHaveBeenCalledTimes(1);
+    expect(remove).not.toHaveBeenCalled();
+  });
+});
diff --git a/frontend-modern/src/utils/__tests__/apiClient.org.test.ts b/frontend-modern/src/utils/__tests__/apiClient.org.test.ts
index 8770e3de6d..6efdcb1f35 100644
--- a/frontend-modern/src/utils/__tests__/apiClient.org.test.ts
+++ b/frontend-modern/src/utils/__tests__/apiClient.org.test.ts
@@ -1,6 +1,7 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import {
   apiFetch,
+  apiClient,
   apiFetchJSON,
   clearApiToken,
   getApiToken,
@@ -42,6 +43,94 @@ describe('apiClient org context', () => {
     expect(window.sessionStorage.getItem('pulse_org_id')).toBe('acme');
   });
 
+  it.each([400, 403, 429])('does not replay a confirmed mutation after HTTP %i', async (status) => {
+    setOrgID('tenant-a');
+    document.cookie = 'pulse_csrf=synthetic-csrf; Path=/';
+    mockFetch.mockResolvedValue(
+      new Response(JSON.stringify({ error: 'invalid_org' }), {
+        status,
+        headers: { 'X-CSRF-Token': 'replacement-csrf', 'Retry-After': '1' },
+      }),
+    );
+    const response = await apiFetch('/api/ai/patrol/suppressions/rule_one', {
+      method: 'DELETE',
+      retry: false,
+      expectedOrgID: 'tenant-a',
+    });
+    expect(response.status).toBe(status);
+    expect(mockFetch).toHaveBeenCalledTimes(1);
+    expect(mockFetch.mock.calls[0][1].headers['X-Pulse-Org-ID']).toBe('tenant-a');
+    expect(mockFetch.mock.calls[0][1].headers['X-CSRF-Token']).toBeTruthy();
+    expect(mockFetch.mock.calls[0][1].credentials).toBe('include');
+    expect(getOrgID()).toBe('tenant-a');
+    expect(mockFetch.mock.calls[0][1]).not.toHaveProperty('retry');
+    expect(mockFetch.mock.calls[0][1]).not.toHaveProperty('expectedOrgID');
+  });
+
+  it('binds default explicitly and stops stale confirmations or aborted dispatch', async () => {
+    setOrgID('default');
+    mockFetch.mockResolvedValue(new Response('[]'));
+    await apiFetch('/api/ai/patrol/suppressions', { retry: false, expectedOrgID: 'default' });
+    expect(mockFetch.mock.calls[0][1].headers['X-Pulse-Org-ID']).toBe('default');
+    setOrgID('tenant-b');
+    await expect(
+      apiFetch('/api/ai/patrol/suppressions/rule_one', {
+        method: 'DELETE',
+        expectedOrgID: 'default',
+        retry: false,
+      }),
+    ).rejects.toThrow('Organisation changed');
+    const controller = new AbortController();
+    controller.abort();
+    await expect(
+      apiFetch('/api/ai/patrol/suppressions', {
+        expectedOrgID: 'tenant-b',
+        retry: false,
+        signal: controller.signal,
+      }),
+    ).rejects.toMatchObject({ name: 'AbortError' });
+    expect(mockFetch).toHaveBeenCalledTimes(1);
+  });
+
+  it('does not fall back to another authentication method after a strict-session refusal', async () => {
+    setApiToken('synthetic-token');
+    setOrgID('tenant-a');
+    mockFetch.mockResolvedValue(new Response('{}', { status: 401 }));
+    const result = await apiFetch('/api/state', {
+      preferSessionAuth: true,
+      retry: false,
+      expectedOrgID: 'tenant-a',
+    });
+    expect(result.status).toBe(401);
+    expect(mockFetch).toHaveBeenCalledTimes(1);
+    expect(mockFetch.mock.calls[0][1].headers['X-API-Token']).toBeUndefined();
+  });
+
+  it('checks the confirmed organisation again after asynchronous CSRF preparation', async () => {
+    setOrgID('tenant-a');
+    let finish!: (token: string) => void;
+    const preparation = vi.spyOn(apiClient as any, 'ensureCSRFToken').mockReturnValueOnce(
+      new Promise((resolve) => {
+        finish = resolve;
+      }),
+    );
+    const tokenRead = vi.spyOn(apiClient as any, 'loadCSRFToken').mockReturnValueOnce(null);
+    try {
+      const pending = apiFetch('/api/ai/patrol/suppressions/rule_one', {
+        method: 'DELETE',
+        retry: false,
+        expectedOrgID: 'tenant-a',
+      });
+      setOrgID('tenant-b');
+      finish('synthetic-csrf');
+      await expect(pending).rejects.toThrow('Organisation changed');
+      expect(mockFetch).not.toHaveBeenCalled();
+    } finally {
+      preparation.mockRestore();
+      tokenRead.mockRestore();
+    }
+  });
+
   it('reuses a server-issued org cookie when storage is empty', async () => {
     document.cookie = 'pulse_org_id=tenant-1; Path=/; SameSite=Lax';
     mockFetch.mockResolvedValue(new Response('{}', { status: 200 }));
diff --git a/frontend-modern/src/utils/apiClient.ts b/frontend-modern/src/utils/apiClient.ts
index 05ba90485c..d8b71ce4a6 100644
--- a/frontend-modern/src/utils/apiClient.ts
+++ b/frontend-modern/src/utils/apiClient.ts
@@ -76,6 +76,10 @@ interface FetchOptions extends Omit<RequestInit, 'headers'> {
   preferSessionAuth?: boolean;
   skipAuth?: boolean;
   skipOrgContext?: boolean;
+  // Reviewed destructive operations can opt out of auth/CSRF/rate-limit
+  // retries and bind dispatch to the organisation whose data was confirmed.
+  retry?: boolean;
+  expectedOrgID?: string;
 }
 
 type APIErrorDetails = Record<string, string>;
@@ -593,12 +597,23 @@ class ApiClient {
       preferSessionAuth = false,
       skipAuth = false,
       skipOrgContext = false,
+      retry = true,
+      expectedOrgID,
       headers = {},
       ...fetchOptions
     } = options;
 
     // Build headers object
     const finalHeaders: Record<string, string> = { ...headers };
+    const checkExpectedOrg = () => {
+      if (expectedOrgID !== undefined && (this.getOrgID() || 'default') !== expectedOrgID) {
+        throw new Error('Organisation changed. Reload before making changes.');
+      }
+    };
+    checkExpectedOrg();
+    if (expectedOrgID !== undefined) {
+      finalHeaders[ORG_HEADER_NAME] = expectedOrgID;
+    }
 
     // Always add headers to prevent browser auth popup for API calls
     if (url.startsWith('/api/')) {
@@ -647,6 +662,10 @@ class ApiClient {
       credentials: 'include', // Important for session cookies
     };
 
+    // CSRF preparation may have awaited a request while the operator switched
+    // organisations or left the view. Do not dispatch a stale confirmation.
+    checkExpectedOrg();
+    fetchOptions.signal?.throwIfAborted();
     let response = await fetch(url, finalOptions);
 
     // Session-preferred reads intentionally omit the API token on their first
@@ -655,6 +674,7 @@ class ApiClient {
     // retrying an unauthenticated idempotent response once with their token.
     if (
       response.status === 401 &&
+      retry &&
       preferSessionAuth &&
       !skipAuth &&
       this.apiToken &&
@@ -672,6 +692,8 @@ class ApiClient {
     // Handle stale/invalid org context by clearing it and retrying once against default org.
     if (
       response.status === 400 &&
+      retry &&
+      expectedOrgID === undefined &&
       !skipOrgContext &&
       url.startsWith('/api/') &&
       finalHeaders[ORG_HEADER_NAME] &&
@@ -720,7 +742,7 @@ class ApiClient {
     }
 
     // Handle CSRF token failures - the 403 response should have set a new CSRF cookie
-    if (response.status === 403) {
+    if (response.status === 403 && retry) {
       // First try the response header (backend sends new token in X-CSRF-Token header)
       let refreshedToken = response.headers.get('X-CSRF-Token');
 
@@ -745,7 +767,7 @@ class ApiClient {
     }
 
     // Handle rate limiting with automatic retry for idempotent requests only.
-    if (response.status === 429) {
+    if (response.status === 429 && retry) {
       if (!IDEMPOTENT_METHODS.has(method)) {
         return response;
       }
diff --git a/internal/api/patrol_suppression_management_test.go b/internal/api/patrol_suppression_management_test.go
index 1add39ed89..540289079d 100644
--- a/internal/api/patrol_suppression_management_test.go
+++ b/internal/api/patrol_suppression_management_test.go
@@ -1,6 +1,7 @@
 package api
 
 import (
+	"bytes"
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
@@ -22,6 +23,14 @@ func TestPatrolSuppressionManagementBrowserSession(t *testing.T) {
 		t.Fatal("expected Patrol service")
 	}
 	store := patrol.GetFindings()
+	store.Add(&ai.Finding{ID: "retained-history", ResourceID: "vm-1", ResourceName: "Test VM", Category: ai.FindingCategoryBackup, Title: "Historical backup finding", Severity: ai.FindingSeverityWarning})
+	if !store.Dismiss("retained-history", "expected_behavior", "Keep this operator decision") {
+		t.Fatal("expected an existing dismissed finding")
+	}
+	historyBefore, err := json.Marshal(store.Get("retained-history"))
+	if err != nil {
+		t.Fatal(err)
+	}
 	selected := store.AddSuppressionRule("vm-1", "Test VM", ai.FindingCategoryBackup, "Test reason")
 	other := store.AddSuppressionRule("vm-2", "Other VM", ai.FindingCategoryCapacity, "Keep this rule")
 	router.mux.HandleFunc("/api/ai/patrol/suppressions", RequireAuth(router.config, RequireScope(config.ScopeAIExecute, handler.HandleGetSuppressionRules)))
@@ -57,10 +66,16 @@ func TestPatrolSuppressionManagementBrowserSession(t *testing.T) {
 	if err := json.Unmarshal(list.Body.Bytes(), &rules); err != nil {
 		t.Fatal(err)
 	}
-	if len(rules) != 2 {
-		t.Fatalf("listed %d rules, want 2", len(rules))
+	if len(rules) != 3 {
+		t.Fatalf("listed %d rules, want 2 manual rules and a finding dismissal", len(rules))
 	}
 	for _, rule := range rules {
+		if rule.ID == "finding_retained-history" {
+			if rule.CreatedFrom != "dismissed" || rule.FindingID != "retained-history" {
+				t.Fatal("finding dismissal must stay distinct from manual rules")
+			}
+			continue
+		}
 		if rule.CreatedFrom != "manual" {
 			t.Fatalf("created_from = %q, want manual", rule.CreatedFrom)
 		}
@@ -77,8 +92,8 @@ func TestPatrolSuppressionManagementBrowserSession(t *testing.T) {
 	path := "/api/ai/patrol/suppressions/" + selected.ID
 	for _, token := range []string{"", "invalid-csrf"} {
 		rec := request(http.MethodDelete, path, token, true)
-		if rec.Code != http.StatusForbidden || len(store.GetSuppressionRules()) != 2 {
-			t.Fatalf("invalid-CSRF deletion status = %d; both rules must remain", rec.Code)
+		if rec.Code != http.StatusForbidden || len(store.GetSuppressionRules()) != 3 {
+			t.Fatalf("invalid-CSRF deletion status = %d; both rules and dismissal must remain", rec.Code)
 		}
 	}
 	removed := request(http.MethodDelete, path, csrf, true)
@@ -98,11 +113,20 @@ func TestPatrolSuppressionManagementBrowserSession(t *testing.T) {
 	if err := json.Unmarshal(readback.Body.Bytes(), &rules); err != nil {
 		t.Fatal(err)
 	}
-	if len(rules) != 1 || rules[0].ID != other.ID {
-		t.Fatal("readback must retain only the unselected rule")
+	if len(rules) != 2 {
+		t.Fatal("readback must retain the unselected rule and finding dismissal")
+	}
+	for _, rule := range rules {
+		if rule.ID != other.ID && rule.ID != "finding_retained-history" {
+			t.Fatalf("unexpected remaining row %q", rule.ID)
+		}
+	}
+	historyAfter, err := json.Marshal(store.Get("retained-history"))
+	if err != nil || !bytes.Equal(historyBefore, historyAfter) {
+		t.Fatal("manual deletion must preserve the complete historical finding, note, dismissal and lifecycle")
 	}
 	notFound := request(http.MethodDelete, path, csrf, true)
-	if notFound.Code != http.StatusNotFound || len(store.GetSuppressionRules()) != 1 {
+	if notFound.Code != http.StatusNotFound || len(store.GetSuppressionRules()) != 2 {
 		t.Fatalf("already-removed deletion status = %d; remaining rule must survive", notFound.Code)
 	}
 }