Tehran's Revenge File Stays Open — and So Does the Question of What Opens It

On 1 July 2026, at 09:59 UTC, an open-source intelligence channel relayed a statement from the secretary of Iran's Supreme National Security Council (SNSC) addressed directly to "President Trump and Prime Minister Netanyahu," declaring that "the file of revenge for the pure blood of Khamenei and the innocent martyrs" of the Islamic Republic remains open, and that "those who gave the orders and carried out" the killing "will not escape punishment." The same language was published by the SNSC media account via Tasnim News Agency, the state-aligned outlet that has become the default distribution rail for the Council's messaging, at 08:18 UTC, with the added framing from the secretary — identified in Tasnim's coverage as Ali Larijani-era interlocutor and SNSC figure Ali Akbar Ahmadian — that "the clenched fist of the martyred leader is a symbol of our national security doctrine." A parallel translation was carried by the Tehran-based English-language account English Abuali at 09:00 UTC. Three outlets, same morning, same threat, same target list: the U.S. president and the Israeli prime minister.

Read narrowly, this is rhetorical maintenance — the kind of statement Tehran puts out when it wants the world to know it has not forgotten, without committing to a clock. Read more carefully, it is something more interesting: a public, dated, attributable refusal to close the deterrence ledger at exactly the moment Western capitals are trying to read the post-Khamenei regime as either chastened or distracted. The Council does not speak for the foreign ministry, does not speak for the IRGC, does not speak for the president's office. It speaks for the body that, on paper, coordinates Iran's whole-security response.

What the statement actually says

Strip the Quranic phrasing and three claims survive. First, that the killing of Khamenei is treated as an act attributable to specific decision-makers in Washington and Jerusalem, not to a generic adversary. The naming of Trump and Netanyahu is deliberate — it puts a clock on two individuals rather than on states, which is the language of vendetta more than of state deterrence. Second, that the file is "open" rather than "pending," which in Iranian security vocabulary implies active operational planning rather than diplomatic arbitration. Third, that the Council positions itself, not the foreign ministry, as the authoritative voice on the question — a small but real signal of whose institutional hand is on the wheel.

None of this is new in form. Tehran has kept a public "revenge file" on the killing of Qasem Soleimani since January 2020 and has periodically re-opened it in statements from the same Council, particularly during escalations. What is notable in 2026 is the timing — published within hours of multilateral track-II contacts in the Gulf aimed at de-escalation, and framed in language that explicitly refuses to accept closure.

Why the SNSC, and why now

Iran's Supreme National Security Council is the formal convening body for decisions of war and peace; its secretary is, in practice, the regime's most consequential security bureaucrat. Ahmadian, who has held the post across multiple governments, is one of the few figures who briefs both the Supreme Leader's office and the regular military chain of command. When the Council speaks in this register, it is signalling to internal factions — the IRGC, the Basij, the bonyads — that the political system is not ready to declare the matter closed, regardless of what diplomats may say in backchannels.

That matters because the dominant Western reading of the past month has been that Iran's leadership is consumed with succession management and cannot afford a kinetic escalation. The 1 July statement is best understood as a counter-reading from inside the system: succession is precisely the moment when the security services re-assert themselves, and a public vendetta file against named individuals is one of the cheaper moves available to them.

The structural frame

This sits inside a wider pattern in which revisionist or sanctioned states use the public attribution of retaliation to named individuals as a substitute for actual retaliation they cannot yet execute. The mechanism is older than the Iranian case — it is how weaker parties preserve deterrent credibility when they cannot match the adversary's escalation ladder. The risk is miscalibration: statements calibrated for a domestic security audience can be read as operational signals abroad, and vice versa. Both Washington and Jerusalem now have to assume, until told otherwise, that the SNSC is speaking on behalf of someone with both the motive and the means to act.

What the open file does not tell us is whether Tehran has actually rebuilt the proxy and missile capabilities degraded in last year's exchanges, whether the Revolutionary Guards have been authorised to operationalise the threat, or whether the Council's public posture is a negotiating asset to be traded away in the next round. The Council, by design, leaves those questions open.

The stakes

If the threat is purely declaratory, the cost is reputational: another escalation the system did not follow through on, and a further discount on Tehran's public warnings. If it is more than declaratory, the targets are not abstractions — Trump and Netanyahu are specific individuals whose security architecture will now have to plan against an attribution the Iranian state has made on the record, in three channels, on the same day.

For European and Gulf mediators currently floating de-escalation tracks, the message is awkward but legible: do not assume that the file has been folded away because the principals are not currently in the room. For Western policymakers, the question is no longer whether Iran has an open revenge file — it has said so, three times, in the last twenty-four hours — but what would count, in Tehran's eyes, as closing it.

This publication reads the SNSC statement not as a forecast of imminent action but as an institutional refusal to concede closure. The threats are public and on the record. The operational picture behind them is not.

Wire provenance

This editorial synthesis draws on the following public wire/social posts:

• https://t.me/osintlive
• https://t.me/englishabuali
• https://t.me/JahanTasnim