fallow 2.94.0 → 2.96.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fallow",
-  "version": "2.94.0",
+  "version": "2.96.0",
   "description": "Deterministic codebase intelligence for TypeScript and JavaScript. Quality, risk, architecture, dependencies, duplication, and safe cleanup evidence for humans, CI, and agents. Optional runtime intelligence layer (Fallow Runtime) adds production execution evidence. Rust-native, sub-second, zero-config framework support.",
   "license": "MIT",
   "repository": {
@@ -83,13 +83,13 @@
     "@tanstack/intent": "0.0.41"
   },
   "optionalDependencies": {
-    "@fallow-cli/darwin-arm64": "2.94.0",
-    "@fallow-cli/darwin-x64": "2.94.0",
-    "@fallow-cli/linux-x64-gnu": "2.94.0",
-    "@fallow-cli/linux-arm64-gnu": "2.94.0",
-    "@fallow-cli/linux-x64-musl": "2.94.0",
-    "@fallow-cli/linux-arm64-musl": "2.94.0",
-    "@fallow-cli/win32-arm64-msvc": "2.94.0",
-    "@fallow-cli/win32-x64-msvc": "2.94.0"
+    "@fallow-cli/darwin-arm64": "2.96.0",
+    "@fallow-cli/darwin-x64": "2.96.0",
+    "@fallow-cli/linux-x64-gnu": "2.96.0",
+    "@fallow-cli/linux-arm64-gnu": "2.96.0",
+    "@fallow-cli/linux-x64-musl": "2.96.0",
+    "@fallow-cli/linux-arm64-musl": "2.96.0",
+    "@fallow-cli/win32-arm64-msvc": "2.96.0",
+    "@fallow-cli/win32-x64-msvc": "2.96.0"
   }
 }

package/schema.json

@@ -112,7 +112,7 @@
         "ignoreDefaults": true,
         "skipLocal": false,
         "crossLanguage": false,
-        "ignoreImports": false,
+        "ignoreImports": true,
         "normalization": {},
         "minCorpusSizeForShingleFilter": 1024,
         "minCorpusSizeForTokenCache": 5000
@@ -697,9 +697,9 @@
           "default": false
         },
         "ignoreImports": {
-          "description": "Exclude ES `import` declarations from clone detection.\n\nWhen enabled, all `import` statements (value imports, type imports, and\nside-effect imports) are stripped from the token stream before clone\ndetection. This reduces noise from sorted import blocks that naturally\nlook similar across files. Only affects ES `import` declarations;\nCommonJS `require()` calls are not filtered.",
+          "description": "Exclude ES `import` declarations from clone detection.\n\nDefaults to `true`: token-identical sorted import blocks are a structural\nproperty of well-formatted code, not copy-paste, so they should not\nsurface as clone groups. Set to `false` to count import blocks again.\nWhen enabled, all `import` statements (value imports, type imports, and\nside-effect imports) are stripped from the token stream before clone\ndetection. Only affects ES `import` declarations; CommonJS `require()`\ncalls and `export ... from` re-export blocks are still counted.",
           "type": "boolean",
-          "default": false
+          "default": true
         },
         "normalization": {
           "description": "Fine-grained normalization overrides on top of the detection mode.",
@@ -832,6 +832,13 @@
           },
           "default": []
         },
+        "thresholdOverrides": {
+          "description": "Per-file or per-function threshold overrides. These keep exceptional\nfunctions visible as configured numeric ceilings instead of hiding them\nbehind binary suppressions.",
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/HealthThresholdOverride"
+          }
+        },
         "ownership": {
           "description": "Ownership analysis configuration. Controls bot filtering and email\nprivacy mode for `--ownership` output.",
           "$ref": "#/$defs/OwnershipConfig",
@@ -852,7 +859,67 @@
           "type": "boolean",
           "default": true
         }
-      }
+      },
+      "additionalProperties": false
+    },
+    "HealthThresholdOverride": {
+      "description": "Per-file or per-function health threshold override.",
+      "type": "object",
+      "properties": {
+        "files": {
+          "description": "Project-root-relative file globs this override applies to.",
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "functions": {
+          "description": "Exact emitted function names this override applies to. Empty means every\nfunction in matching files.",
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "maxCyclomatic": {
+          "description": "Local cyclomatic complexity ceiling.",
+          "type": [
+            "integer",
+            "null"
+          ],
+          "format": "uint16",
+          "minimum": 0,
+          "maximum": 65535
+        },
+        "maxCognitive": {
+          "description": "Local cognitive complexity ceiling.",
+          "type": [
+            "integer",
+            "null"
+          ],
+          "format": "uint16",
+          "minimum": 0,
+          "maximum": 65535
+        },
+        "maxCrap": {
+          "description": "Local CRAP ceiling.",
+          "type": [
+            "number",
+            "null"
+          ],
+          "format": "double"
+        },
+        "reason": {
+          "description": "Human-readable rationale for the exception.",
+          "type": [
+            "string",
+            "null"
+          ]
+        }
+      },
+      "additionalProperties": false,
+      "required": [
+        "files"
+      ]
     },
     "OwnershipConfig": {
       "description": "Configuration for ownership analysis (`fallow health --hotspots --ownership`).",

package/skills/fallow/SKILL.md

@@ -106,7 +106,7 @@ Route by intent before reaching for the big analysis commands. Same matrix as `f
 | `config` | Show the loaded config path and resolved config (verifies which `.fallowrc.json` is in effect) | `--path` |
 | `list` | Inspect project structure | `--files`, `--entry-points`, `--plugins`, `--boundaries`, `--workspaces` |
 | `workspaces` | Inspect monorepo workspaces + discovery diagnostics (shorthand for `list --workspaces`) | (no flags) |
-| `dupes` | Code duplication detection | `--mode`, `--threshold`, `--top`, `--changed-since`, `--workspace`, `--changed-workspaces`, `--skip-local`, `--cross-language`, `--ignore-imports`, `--explain-skipped`, `--fail-on-regression`, `--tolerance`, `--regression-baseline`, `--save-regression-baseline` |
+| `dupes` | Code duplication detection | `--mode`, `--threshold`, `--top`, `--changed-since`, `--workspace`, `--changed-workspaces`, `--skip-local`, `--cross-language`, `--ignore-imports`, `--no-ignore-imports`, `--explain-skipped`, `--fail-on-regression`, `--tolerance`, `--regression-baseline`, `--save-regression-baseline` |
 | `health` | Function complexity analysis (also covers Angular templates as synthetic `<template>` findings: external `.html` files via `templateUrl` AND inline `@Component({ template: \`...\` })` literals; suppress external with `<!-- fallow-ignore-file complexity -->` at the top of the `.html` file, suppress inline with `// fallow-ignore-next-line complexity` directly above the `@Component` decorator) | `--complexity`, `--max-cyclomatic`, `--max-cognitive`, `--max-crap`, `--top`, `--sort`, `--file-scores`, `--hotspots`, `--ownership`, `--ownership-emails`, `--targets`, `--effort`, `--score`, `--min-score`, `--since`, `--min-commits`, `--save-snapshot`, `--trend`, `--coverage-gaps`, `--coverage`, `--coverage-root`, `--runtime-coverage`, `--min-invocations-hot`, `--min-observation-volume`, `--low-traffic-threshold`, `--workspace`, `--changed-workspaces`, `--baseline`, `--save-baseline` |
 | `flags` | Detect feature flag patterns (env vars, SDK calls, config objects) | `--top` |
 | `explain` | Explain one issue type without running analysis | `<issue-type>`, `--format json` |
@@ -149,7 +149,7 @@ Run `fallow <command> --help` for the full flag list per command (see also refer
 | `boundary-violation` | `--boundary-violations` | - | `// fallow-ignore-next-line boundary-violation` | Imports crossing architecture zone boundaries. Presets: `layered`, `hexagonal`, `feature-sliced`, `bulletproof`; `autoDiscover` can create one zone per feature directory; per-rule `allowTypeOnly: [zones]` admits `import type` / `export type` crossings while still blocking value imports. Optional sections: `boundaries.coverage.requireAllFiles` reports unzoned source files (`allowUnmatched` globs exempt intentional ones), and `boundaries.calls.forbidden` bans callee patterns per zone (segment-aware and import-resolved, so `child_process.*` covers `node:child_process` named/namespace/default imports; direct callees only, zoned files only). The whole family shares the `boundary-violation` rule and suppression token (`boundary-call-violation` and `boundary-call-violations` accepted as aliases); start the rule at `warn` for a staged rollout |
 | `boundary-coverage` | - | - | `// fallow-ignore-file boundary-violation` | Source file matches no configured architecture boundary zone; Requires boundaries.coverage.requireAllFiles |
 | `boundary-call-violation` | - | - | `// fallow-ignore-next-line boundary-call-violation` | Zoned file calls a callee its zone forbids; Requires boundaries.calls.forbidden patterns |
-| `policy-violation` | `--policy-violations` | - | `// fallow-ignore-next-line policy-violation` | Calls or imports banned by a declarative rule pack (`rulePacks` config key lists standalone JSON/JSONC files of `banned-call` / `banned-import` rules; pure data, no project code executes). Findings identified as `<pack>/<rule-id>`. Default `warn` master; per-rule `severity` overrides per finding and the exit gate reads the effective severity. Invalid or missing packs fail config load with exit 2. `fallow rule-pack-schema` prints the pack JSON Schema. Suppress with `// fallow-ignore-next-line policy-violation` (one token covers every pack rule on the line). |
+| `policy-violation` | `--policy-violations` | - | `// fallow-ignore-next-line policy-violation` | Calls or imports banned by a declarative rule pack (`rulePacks` config key lists standalone JSON/JSONC files of `banned-call` / `banned-import` rules; pure data, no project code executes). Findings identified as `<pack>/<rule-id>`. Default `warn` master; per-rule `severity` overrides per finding and the exit gate reads the effective severity. Invalid or missing packs fail config load with exit 2. `fallow rule-pack-schema` prints the pack JSON Schema. Use the scoped token to suppress one rule; bare `policy-violation` still covers every pack rule on the line or file. |
 | `stale-suppression` | `--stale-suppressions` | - | - | `fallow-ignore` comments or `@expected-unused` JSDoc tags that no longer match any issue |
 | `unused-catalog-entry` | `--unused-catalog-entries` | yes | - | `pnpm-workspace.yaml` entries no workspace package.json references via `catalog:` (default `warn`) |
 | `empty-catalog-group` | `--empty-catalog-groups` | - | - | Named `catalogs.<name>:` groups in `pnpm-workspace.yaml` with no entries. Top-level `catalog:` placeholders are ignored. Default `warn`. |
@@ -198,7 +198,7 @@ When using fallow via MCP (`fallow-mcp`), the following tools are available:
 | `project_info` | introspection | free | `entry_points`, `files`, `plugins`, `boundaries` | Project metadata. Set `entry_points`, `files`, `plugins`, or `boundaries` to `true` to request specific sections |
 | `list_boundaries` | introspection | free | - | Architecture boundary zones, access rules, and pre-expansion `autoDiscover` `logical_groups[]` (user-authored parent name, verbatim paths, discovered children, `status` enum, summed `file_count`). Returns `{"configured": false}` if no boundaries configured |
 | `feature_flags` | analysis | free | `workspace`, `production` | Detect feature flag patterns (env vars, SDK calls, config objects). Set `top` to limit results |
-| `impact` | introspection | free | `root` | Read the local, opt-in Fallow Impact value report (`fallow impact --format json`). Runs no analysis: current surfacing counts, trend since the last recorded run, pre-commit gate containment, and (on impact v1.5+) resolved/suppressed attribution. Read-only and `root`-only; the mutating `enable` / `disable` lifecycle is not exposed. A never-enabled project returns a populated `{"enabled": false, ...}` report (never `{}`); branch on `enabled` then `record_count` and recommend the user run `fallow impact enable` rather than toggling it. Local-developer signal: empty in ephemeral CI runners, so not a CI metric |
+| `impact` | introspection | free | `root` | Read the local, opt-in Fallow Impact value report (`fallow impact --format json`). Runs no analysis: current surfacing counts, trend since the last recorded run, pre-commit gate containment, and (on impact v1.5+) resolved/suppressed attribution. History is read from a per-project file in the user's private config dir (never inside the repo). Read-only and `root`-only; the mutating `enable` / `disable` / `default` lifecycle is not exposed. A never-enabled project returns a populated `{"enabled": false, ...}` report (never `{}`); branch on `enabled` and `enabled_source` (`project` / `user` / `default`) then `record_count`, recommending `fallow impact enable` only when `explicit_decision` is `false` (never asked) and staying silent when `true` (deliberately disabled here). Local-developer signal: fallow never records in CI, so empty there and not a CI metric |
 | `trace_export` | trace | free | `file`, `export_name` | Trace why an export is used or unused (`fallow dead-code --trace FILE:EXPORT_NAME --format json`). Required `file` and `export_name`. Returns file reachability, entry-point status, direct references, re-export chains, and a reason string. Use before deleting a supposedly-unused export |
 | `trace_file` | trace | free | `file` | Trace all graph edges for a file (`fallow dead-code --trace-file PATH --format json`). Required `file`. Returns reachability, exports, imports-from, imported-by, and re-exports. Use to decide whether a file is isolated, barrel-only, or imported by live entry points |
 | `trace_dependency` | trace | free | `package_name` | Trace where a dependency is imported (`fallow dead-code --trace-dependency PACKAGE --format json`). Required `package_name`. Returns importing files, type-only importers, total import count, `used_in_scripts` (true when invoked from package.json scripts or CI configs), and `is_used` (combined import + script signal; mirrors the unused-deps detector so build tools like `microbundle` or `vitest` are not falsely flagged as unused). Use before removing a dependency or moving between `dependencies` and `devDependencies` |
@@ -218,14 +218,14 @@ Most tools accept `root`, `config`, `no_cache`, and `threads` params. Exceptions
 
 All JSON responses include structured `actions` arrays on every finding (dead code, health, duplication), enabling programmatic fix application or suppression.
 
+`health.thresholdOverrides[]` lets projects keep known legacy functions visible as configured local ceilings instead of hiding them with suppressions. Each entry has `files` globs, optional exact `functions`, one or more of `maxCyclomatic`, `maxCognitive`, or `maxCrap`, and optional `reason`. Health JSON may include top-level `threshold_overrides[]` entries with `active`, `stale`, or `no_match` status, and complexity findings that use an override carry `effective_thresholds` plus `threshold_source: "override"`.
+
 `dead-code`, `health`, `dupes`, bare `fallow`, and `audit` JSON output also carry a top-level `next_steps` array of read-only follow-up commands computed from the run's findings: each entry is `{ id, command, reason }`. The `command` is runnable as-is (never a placeholder, never `fix` or any other mutating command); the stable kebab-case `id` (`setup`, `impact-report`, `trace-unused-export`, `trace-clone`, `complexity-breakdown`, `scope-workspaces`, `audit-changed`) maps to a verification step you should run BEFORE acting, for example tracing an export before deleting it. A leading `setup` step (command: `fallow schema`) appears only on unconfigured, non-CI projects with findings and doubles as the onboarding trigger below; it disappears after setup or `fallow init --decline`. An at-most-weekly `impact-report` step (command: `fallow impact`) carries the local value digest when impact tracking has non-zero results; it may ride a clean run. When running via MCP, dispatch on the `id` to the matching tool / `code_execute` host call (`trace_export`, `trace_clone`, `check_health` with `complexity_breakdown: true`, `audit`) rather than shelling out the CLI string. The array is deduplicated, capped at three, and omitted when empty; set `FALLOW_SUGGESTIONS=off` to suppress it.
 
 ## Node.js Bindings
-
 Embedding fallow in a Node.js process (editor extensions, servers, custom tooling)? Use the `@fallow-cli/fallow-node` NAPI bindings instead of spawning the CLI: six async functions (`detectDeadCode`, `detectCircularDependencies`, `detectBoundaryViolations`, `detectDuplication`, `computeComplexity`, `computeHealth`) returning the same JSON envelopes as `--format json`. Read-only analysis only; use the CLI for write-path commands. Details: [Node Bindings](references/node-bindings.md).
 
 ## References
-
 - [CLI Reference](references/cli-reference.md): complete command and flag specifications, plus configuration field details
 - [Gotchas](references/gotchas.md): common pitfalls, edge cases, and correct usage patterns
 - [Patterns](references/patterns.md): workflow recipes for CI, monorepos, migration, and incremental adoption
@@ -400,7 +400,7 @@ fallow impact enable
 fallow impact --format json --quiet
 ```
 
-`fallow impact enable` is a one-time, user-owned local action; the agent-facing line is the read step. The store lives at `.fallow/impact.json` (gitignored), the report is read-only, and it is empty in ephemeral CI runners.
+`fallow impact enable` is a one-time, user-owned local action; the agent-facing line is the read step. History is stored per-project in the user's private config dir (never inside the repo, so no `.fallow/` or `.gitignore` changes); `fallow impact default on` enables it for every project at once. The report is read-only and is empty in CI (fallow never records there).
 
 ### Debug why something is flagged
 

package/skills/fallow/references/cli-reference.md

@@ -147,6 +147,7 @@ By default, `fallow dupes` skips generated framework output matching `**/.next/*
 | `--skip-local` | `bool` | `false` | Only report cross-directory duplicates |
 | `--cross-language` | `bool` | `false` | Strip type annotations for TS↔JS matching |
 | `--ignore-imports` | `bool` | `false` | Exclude import declarations from clone detection |
+| `--no-ignore-imports` | `bool` | `false` | Count import declarations as clone candidates (opt out of the default import exclusion) |
 | `--top` | `string` | - | Show only the N most-duplicated clone groups (sorted by instance count desc, tiebreak: line count desc, then path/line). Summary stats reflect the full project. |
 | `--trace` | `string` | - | Deep-dive clones. `FILE:LINE` traces all clones at a location; `dup:<id>` traces a clone group by the stable fingerprint shown in the listing and on `clone_groups[].fingerprint` in JSON. Fingerprints are usually `dup:<8hex>` and widen only on rare report collisions. Trace output adds an extract-function suggestion, estimated savings, and a best-effort proposed name per group |
 
@@ -492,7 +493,7 @@ fallow health --format json --quiet --trend
 {
   "kind": "health",
   "schema_version": 7,
-  "version": "2.94.0",
+  "version": "2.96.0",
   "elapsed_ms": 32,
   "summary": {
     "files_analyzed": 482,
@@ -516,6 +517,8 @@ fallow health --format json --quiet --trend
 }
 ```
 
+`health.thresholdOverrides[]` config entries can raise local cyclomatic, cognitive, or CRAP ceilings for matching files and optional exact function names. When an override affects output, health JSON includes top-level `threshold_overrides[]` state entries (`active`, `stale`, or `no_match`). Complexity findings evaluated with local ceilings include `effective_thresholds` and `threshold_source: "override"` so agents can see which thresholds drove the finding and avoid treating configured exceptions as hidden suppressions.
+
 When the unit size very-high-risk percentage is >= 3%, the JSON output includes a `large_functions` array listing functions exceeding 60 lines of code:
 
 ```json
@@ -877,7 +880,7 @@ fallow audit \
 {
   "kind": "audit",
   "schema_version": 7,
-  "version": "2.94.0",
+  "version": "2.96.0",
   "command": "audit",
   "verdict": "fail",
   "changed_files_count": 12,
@@ -952,7 +955,7 @@ fallow flags --format json --quiet --workspace my-package
 ```json
 {
   "schema_version": 7,
-  "version": "2.94.0",
+  "version": "2.96.0",
   "elapsed_ms": 116,
   "feature_flags": [],
   "total_flags": 0
@@ -1052,7 +1055,7 @@ fallow security --gate newly-reachable --changed-since origin/main
 {
   "kind": "security",
   "schema_version": "4",
-  "version": "2.94.0",
+  "version": "2.96.0",
   "elapsed_ms": 42,
   "config": {
     "rules": {
@@ -1081,7 +1084,7 @@ fallow security --gate newly-reachable --changed-since origin/main
 {
   "kind": "security",
   "schema_version": "4",
-  "version": "2.94.0",
+  "version": "2.96.0",
   "elapsed_ms": 42,
   "config": {
     "rules": {
@@ -1543,6 +1546,7 @@ Available on all commands:
 | `--dupes-skip-local` | `bool` | `false` | Only report cross-directory duplicates in combined mode |
 | `--dupes-cross-language` | `bool` | `false` | Enable cross-language duplicate detection in combined mode |
 | `--dupes-ignore-imports` | `bool` | `false` | Exclude import declarations from duplicate detection in combined mode |
+| `--dupes-no-ignore-imports` | `bool` | `false` | Count import declarations as clone candidates in combined mode (opt out of the default import exclusion) |
 | `--score` | `bool` | `false` | Compute health score (0-100 with letter grade) in combined mode. Enables the health delta header in PR comments. JSON includes `health_score` object with `score`, `grade`, and `penalties` breakdown |
 | `--trend` | `bool` | `false` | Compare current health metrics against saved snapshot. Implies `--score`. Shows per-metric deltas with directional indicators. Requires at least one saved snapshot in `.fallow/snapshots/` |
 | `--save-snapshot` | `string` | - | Save vital signs snapshot for trend tracking. Default path: `.fallow/snapshots/<timestamp>.json`. Forces file-scores + hotspot computation |
@@ -1697,7 +1701,7 @@ The HTTP layer mirrors the bash `gh_api_retry` / `curl_retry` helpers: `FALLOW_A
 {
   "kind": "dead-code",
   "schema_version": 7,
-  "version": "2.94.0",
+  "version": "2.96.0",
   "elapsed_ms": 45,
   "total_issues": 12,
   "entry_points": {
@@ -1857,7 +1861,7 @@ When `--baseline` is used in combined output, the JSON includes a `baseline_delt
 {
   "kind": "dupes",
   "schema_version": 7,
-  "version": "2.94.0",
+  "version": "2.96.0",
   "elapsed_ms": 82,
   "total_clones": 15,
   "total_lines_duplicated": 230,
@@ -1901,11 +1905,11 @@ When running `fallow` with no subcommand (all analyses), the JSON output combine
 {
   "kind": "combined",
   "schema_version": 7,
-  "version": "2.94.0",
+  "version": "2.96.0",
   "elapsed_ms": 159,
   "check": {
     "schema_version": 7,
-    "version": "2.94.0",
+    "version": "2.96.0",
     "elapsed_ms": 45,
     "total_issues": 12,
     "unused_files": [],

package/types/output-contract.d.ts

@@ -390,6 +390,10 @@ export type ComplexityMetric = ("cyclomatic" | "cognitive")
  * to cyclomatic complexity and so produces no contribution.
  */
 export type ComplexityContributionKind = ("if" | "else" | "else-if" | "ternary" | "logical-and" | "logical-or" | "nullish-coalescing" | "logical-assignment" | "optional-chain" | "for" | "for-in" | "for-of" | "while" | "do-while" | "switch" | "case" | "catch" | "labeled-break" | "labeled-continue")
+/**
+ * Source for a finding's effective thresholds.
+ */
+export type ThresholdSource = "override"
 /**
  * Discriminant for [`HealthFindingAction::kind`]. Mirrors the action types
  * emitted by `build_health_finding_actions`. A single finding's `actions`
@@ -407,6 +411,10 @@ export type CoverageModel = ("static_binary" | "static_estimated" | "istanbul")
  * Whether CRAP findings in the report used one coverage-source kind or a mix.
  */
 export type CoverageSourceConsistency = ("uniform" | "mixed")
+/**
+ * Lifecycle state for a configured threshold override.
+ */
+export type ThresholdOverrideStatus = ("active" | "stale" | "no_match")
 /**
  * Discriminant for [`UntestedFileAction::kind`]. Mirrors the action types
  * emitted by `build_untested_file_actions`.
@@ -615,6 +623,12 @@ export type GroupByMode = ("owner" | "directory" | "package" | "section")
  * `CoverageAnalyzeSchemaVersion`).
  */
 export type ImpactReportSchemaVersion = "1"
+/**
+ * Why Impact tracking is (or is not) active for a project. `Project` = an
+ * explicit per-repo `enable`; `User` = the user-global default with no per-repo
+ * decision; `Default` = off (no per-repo decision and no global default).
+ */
+export type EnabledSource = ("project" | "user" | "default")
 /**
  * Direction of a count trend between two recorded runs.
  */
@@ -2080,8 +2094,8 @@ introduced?: (AuditIntroduced | null)
 }
 /**
  * Wire-shape envelope for a [`PolicyViolation`] finding. Carries actions for
- * replacing the banned call or import, or suppressing it with the
- * `policy-violation` token.
+ * replacing the banned call or import, or suppressing it with a scoped
+ * `policy-violation:<pack>/<rule-id>` token.
  */
 export interface PolicyViolationFinding {
 /**
@@ -2816,6 +2830,11 @@ export interface HealthReport {
  */
 findings: HealthFinding[]
 summary: HealthSummary
+/**
+ * Configured threshold override states. Entries are emitted for active
+ * exceptions, stale exceptions, and full-run no-match cleanup hints.
+ */
+threshold_overrides?: ThresholdOverrideState[]
 /**
  * Project-wide vital signs (always computed from available data).
  */
@@ -2915,6 +2934,15 @@ component_rollup?: (ComponentRollup | null)
  * otherwise so default and CI output stay lean.
  */
 contributions?: ComplexityContribution[]
+/**
+ * Resolved thresholds used for this finding when a config override changed
+ * at least one ceiling. Omitted for findings using global thresholds.
+ */
+effective_thresholds?: (HealthEffectiveThresholds | null)
+/**
+ * Source of the effective thresholds. Omitted when thresholds are global.
+ */
+threshold_source?: (ThresholdSource | null)
 /**
  * Machine-actionable fix and suppress hints.
  */
@@ -2964,6 +2992,14 @@ weight: number
  */
 nesting: number
 }
+/**
+ * Resolved thresholds used to evaluate a health finding.
+ */
+export interface HealthEffectiveThresholds {
+max_cyclomatic: number
+max_cognitive: number
+max_crap: number
+}
 /**
  * Suggested action attached to a [`ComplexityViolation`].
  *
@@ -3046,6 +3082,36 @@ severity_critical_count: number
 severity_high_count: number
 severity_moderate_count: number
 }
+/**
+ * Report entry describing whether a threshold override is active, stale, or
+ * no longer matching any analyzed file or function.
+ */
+export interface ThresholdOverrideState {
+status: ThresholdOverrideStatus
+override_index: number
+path?: (string | null)
+function?: (string | null)
+configured_thresholds: HealthConfiguredThresholds
+effective_thresholds: HealthEffectiveThresholds
+metrics?: (ThresholdOverrideMetrics | null)
+reason?: (string | null)
+}
+/**
+ * Threshold values configured by a single override entry.
+ */
+export interface HealthConfiguredThresholds {
+max_cyclomatic?: (number | null)
+max_cognitive?: (number | null)
+max_crap?: (number | null)
+}
+/**
+ * Current complexity metrics for a matched threshold override entry.
+ */
+export interface ThresholdOverrideMetrics {
+cyclomatic: number
+cognitive: number
+crap?: (number | null)
+}
 /**
  * Project-wide vital signs , a fixed set of metrics for trend tracking.
  *
@@ -4609,6 +4675,11 @@ elapsed_ms: ElapsedMs
  */
 findings: HealthFinding[]
 summary: HealthSummary
+/**
+ * Configured threshold override states. Entries are emitted for active
+ * exceptions, stale exceptions, and full-run no-match cleanup hints.
+ */
+threshold_overrides?: ThresholdOverrideState[]
 /**
  * Project-wide vital signs (always computed from available data).
  */
@@ -5144,6 +5215,7 @@ misconfigured_dependency_overrides?: MisconfiguredDependencyOverrideFinding[]
 export interface ImpactReport {
 schema_version: ImpactReportSchemaVersion
 enabled: boolean
+enabled_source: EnabledSource
 record_count: number
 _meta?: (Meta | null)
 first_recorded?: (string | null)
@@ -5207,7 +5279,8 @@ recent_resolved: ResolutionEvent[]
 attribution_active: boolean
 /**
  * Whether the local agent onboarding prompt has been explicitly declined.
- * Stored under `.fallow/` so agents can avoid cross-session nags.
+ * Stored in the user config dir (per project) so agents avoid cross-session
+ * nags without writing into the repo.
  */
 onboarding_declined: boolean
 /**