diff --git a/ROADMAP.md b/ROADMAP.md
index af5e156..24e98db 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -58,11 +58,11 @@ Acceptance: an analyst can open an incident, see an ordered multi-stream timelin
 
 Goal: reduce repeat noise without hiding genuinely new behavior.
 
-- [ ] Show active feedback rules, expiry, scope, author, and matching findings in the UI.
-- [ ] Support feedback scope choices: exact value, entity and field, entire entity, or stream-wide rule.
-- [ ] Require an expiry for broad suppressions and warn before a broad rule is saved.
-- [ ] Track detector precision using confirmed versus false-positive feedback.
-- [ ] Include feedback-derived precision and suppression counts in metrics and diagnostics.
+- [x] Show active feedback rules, expiry, scope, author, and matching findings in the UI.
+- [x] Support feedback scope choices: exact value, entity and field, entire entity, or stream-wide rule.
+- [x] Require an expiry for broad suppressions and warn before a broad rule is saved.
+- [x] Track detector precision using confirmed versus false-positive feedback.
+- [x] Include feedback-derived precision and suppression counts in metrics and diagnostics.
 
 Acceptance: a false-positive decision suppresses only the intended pattern and all suppressions are auditable and reversible.
 
diff --git a/src/fgai/anomaly.py b/src/fgai/anomaly.py
index 42a3765..b755b0c 100644
--- a/src/fgai/anomaly.py
+++ b/src/fgai/anomaly.py
@@ -5,6 +5,7 @@ from collections import Counter, defaultdict
 from datetime import datetime
 from statistics import mean, pstdev
 
+from .feedback import SUPPRESSING_STATUSES
 from .logs import THREAT_ACTIONS, event_score, is_utm_event
 from .models import AnomalyFinding, LogEvent
 
@@ -220,7 +221,8 @@ def detect_source_anomalies(
 
         for deviation in field_deviations.get(src_ip, []):
             score += int(deviation.get("score", 0))
-            reasons.append(str(deviation.get("reason", "stream field baseline deviation")))
+            if deviation.get("feedback") not in SUPPRESSING_STATUSES:
+                reasons.append(str(deviation.get("reason", "stream field baseline deviation")))
 
         if not reasons:
             continue
diff --git a/src/fgai/dashboard.py b/src/fgai/dashboard.py
index 42ebb54..9e96fa7 100644
--- a/src/fgai/dashboard.py
+++ b/src/fgai/dashboard.py
@@ -185,7 +185,7 @@ HTML = """<!doctype html>
     </section>
     <nav class="tabs" aria-label="Dashboard views"><button class="tab active" data-tab="overview">Overview</button><button class="tab" data-tab="findings">Findings</button><button class="tab" data-tab="diagnostics">Diagnostics</button><button class="tab" data-tab="settings">Settings</button><button class="tab" data-tab="howto">How To</button></nav>
     <div data-view="overview" class="active"><section class="split"><div class="panel"><h2>Events and Anomalies</h2><canvas id="trendChart" class="chart"></canvas></div><div class="panel"><h2>Baseline and Stream Health</h2><div id="health"></div></div></section><section class="panel"><h2>Operator Guidance</h2><div id="actionPlan" class="muted">Waiting for monitor data.</div></section><section class="panel"><h2>Correlation Map</h2><div class="correlation-layout"><div><canvas id="correlationGraph" class="graph"></canvas><div id="correlationGraphInfo" class="muted"></div></div><div id="correlationExplorer" class="muted">Waiting for correlated entities.</div></div></section><section class="panel"><h2>Investigation Incidents</h2><div class="toolbar"><label><input id="showResolvedIncidents" type="checkbox"> show resolved</label><button type="button" id="clearResolvedIncidents">Clear resolved</button><button type="button" id="clearAllIncidents">Clear all</button><span id="incidentSummary"></span></div><div id="incidentNotice" class="muted" role="status"></div><div id="incidents"></div></section><section class="split"><div class="panel"><h2>Anomalies</h2><div id="anomalies"></div></div><div class="panel"><h2>Recommendations</h2><div id="recommendations"></div></div></section><section class="panel"><h2>AI Assessment</h2><div id="llmAssessment" class="muted">LLM assessment disabled.</div></section></div>
-    <div data-view="findings"><section class="panel"><h2>Triage Queue</h2><div id="triageQueue"></div></section><section class="panel"><h2>Field Baseline Deviations</h2><div class="toolbar"><label><input id="showReviewedFindings" type="checkbox"> show reviewed</label><label><input id="showLowFindings" type="checkbox"> show low score</label><span id="findingSummary"></span></div><div id="feedbackNotice" class="muted" role="status"></div><div id="fieldDeviations"></div></section><section class="panel"><h2>Related Activity Across Sources</h2><div id="relatedActivity"></div></section><section class="split"><div class="panel"><h2>Block Candidates</h2><div id="blocks"></div></div><div class="panel"><h2>Threat Intelligence</h2><div id="reputation"></div></div></section><section class="panel"><h2>Policy Findings</h2><div id="policies"></div></section></div>
+    <div data-view="findings"><section class="panel"><h2>Triage Queue</h2><div id="triageQueue"></div></section><section class="panel"><h2>Field Baseline Deviations</h2><div class="toolbar"><label><input id="showReviewedFindings" type="checkbox"> show reviewed</label><label><input id="showLowFindings" type="checkbox"> show low score</label><span id="findingSummary"></span></div><div id="feedbackNotice" class="muted" role="status"></div><div id="fieldDeviations"></div><div id="reviewForm" hidden><div class="toolbar"><label>Scope<br><select id="reviewScope"><option value="value">Exact value</option><option value="field">This field</option><option value="entity">Entire entity</option><option value="stream">Whole stream</option></select></label><label>Note<br><input id="reviewNote" type="text"></label><label>Expiry (days, 0 = never)<br><input id="reviewExpiryDays" type="number" min="0" step="1" value="0"></label><label>Author<br><input id="reviewAuthor" type="text"></label></div><div id="reviewScopeWarning" class="muted" role="status" hidden>Broad-scope rules must expire. Choose how many days this suppression should last.</div><p><button type="button" id="reviewSubmit">Save review</button> <button type="button" id="reviewCancel">Cancel</button></p></div></section><section class="panel"><h2>Active Feedback Rules</h2><div class="toolbar"><span id="feedbackRuleSummary"></span></div><div id="feedbackRules"></div></section><section class="panel"><h2>Related Activity Across Sources</h2><div id="relatedActivity"></div></section><section class="split"><div class="panel"><h2>Block Candidates</h2><div id="blocks"></div></div><div class="panel"><h2>Threat Intelligence</h2><div id="reputation"></div></div></section><section class="panel"><h2>Policy Findings</h2><div id="policies"></div></section></div>
     <div data-view="diagnostics"><section class="panel"><h2>Diagnostics</h2><div id="diagnostics"></div></section></div>
     <div data-view="settings"><section class="panel"><h2>Recommended Stream Profiles</h2><div class="toolbar"><label><input id="showExistingProfiles" type="checkbox"> show existing profiles</label><span id="profileSuggestionSummary"></span></div><div id="profileApplyResult" class="muted" role="status"></div><div id="profileSuggestions" class="muted">Waiting for observed stream data.</div></section><section class="panel"><h2>Installed Ollama Models</h2><div id="ollamaModels" class="muted">Loading local Ollama models.</div></section><section class="panel"><h2>Runtime Configuration</h2><form id="settingsForm"><div class="grid"><label>Log source<br><select name="log_source"><option value="local_syslog">Local syslog</option><option value="graylog_mcp">Graylog MCP</option></select></label><label>Graylog MCP URL<br><input name="graylog_mcp_url" type="url" placeholder="https://graylog.example/api/mcp"></label><label>Enabled streams<br><button type="button" id="loadStreams">Load streams</button><div id="streamPicker" class="muted">Load streams after URL and token are saved.</div></label><label>Profile editor<br><button type="button" id="loadFields">Edit first checked stream profile</button><div id="profileEditorStatus" class="muted">No profile selected for editing.</div><div id="fieldPicker" class="muted">Click Edit profile on one stream.</div></label><label>Profile name<br><input name="profile_name" placeholder="Example: Windows login behavior"></label><label>Detector thresholds (JSON)<br><textarea name="profile_detectors" placeholder='{"auth_failure":{"enabled":true,"minimum":5,"z_threshold":3}}'></textarea></label><label>Field weights (JSON)<br><textarea name="profile_field_weights" placeholder='{"url":1.5,"auth_failure_burst":2,"query_domain":{"rare_value":1.8}}'></textarea></label><label>Behavior relationships (JSON)<br><textarea name="profile_relationship_fields" placeholder='[{"left":"username","right":"srcip","name":"user source IP"}]'></textarea></label><label>Graylog query<br><input name="graylog_query" placeholder="*"></label><label>Graylog fetch mode<br><select name="graylog_fetch_mode"><option value="auto">Auto aggregate</option><option value="aggregate">Aggregate + sample</option><option value="raw">Raw only</option></select></label><label>Graylog MCP poll window seconds<br><input name="graylog_range_seconds" type="number" min="60" step="60" placeholder="300"></label><label>Graylog max events per stream<br><input name="graylog_max_events_per_stream" type="number" min="1" step="1000" placeholder="5000"></label><label>Raw sample events per stream<br><input name="graylog_raw_sample_events" type="number" min="1" step="1000" placeholder="5000"></label><label>MCP call timeout seconds<br><input name="graylog_mcp_call_timeout_seconds" type="number" min="1" step="1" placeholder="8"></label><label>MCP poll budget seconds<br><input name="graylog_mcp_poll_timeout_seconds" type="number" min="60" step="30" placeholder="240"></label><label>Baseline training days<br><input name="baseline_training_days" type="number" min="1" step="1" placeholder="7"></label><label>Baseline bucket retention days<br><input name="baseline_retention_days" type="number" min="1" step="1" placeholder="7"></label><label>Baseline value retention days<br><input name="baseline_value_retention_days" type="number" min="1" step="1" placeholder="3"></label><label>Max values per entity field<br><input name="baseline_max_values_per_field" type="number" min="1" step="100" placeholder="500"></label><label>Threat intel provider<br><select name="threat_intel_provider"><option value="auto">Auto</option><option value="abuseipdb">AbuseIPDB</option><option value="virustotal">VirusTotal</option></select></label><label>AbuseIPDB API key<br><input name="abuseipdb_api_key" type="password" placeholder="Leave blank to keep current key"></label><label>VirusTotal API key<br><input name="virustotal_api_key" type="password" placeholder="Leave blank to keep current key"></label><label>Threat intel daily limit<br><input name="threat_intel_daily_limit" type="number" min="1" step="1" placeholder="100"></label><label>Threat intel cache TTL seconds<br><input name="threat_intel_ttl_seconds" type="number" min="60" step="60" placeholder="604800"></label><label>Threat intel error TTL seconds<br><input name="threat_intel_error_ttl_seconds" type="number" min="60" step="60" placeholder="3600"></label><label>AbuseIPDB max age days<br><input name="abuseipdb_max_age_days" type="number" min="1" step="1" placeholder="90"></label><label>Graylog field mapping (JSON)<br><textarea name="graylog_field_mapping" placeholder='{"srcip":"client_ip","dstip":"server_ip","action":"event_action"}'></textarea></label><label>Graylog MCP token<br><input name="graylog_mcp_token" type="password" placeholder="Leave blank to keep current token"></label><label><input name="graylog_tls_verify" type="checkbox"> Verify Graylog TLS certificate</label><label>Ollama model<br><input name="llm_model" placeholder="llama3.1"></label><label>Ollama assessment timeout seconds<br><input name="llm_timeout" type="number" min="1" step="1" placeholder="180"></label><label>Profile advisor model<br><input name="profile_advisor_model" placeholder="qwen3:8b"></label><label>Profile advisor timeout seconds<br><input name="profile_advisor_timeout" type="number" min="1" step="1" placeholder="240"></label><label><input name="llm_enabled" type="checkbox"> Enable Ollama analysis</label><label><input name="profile_advisor_enabled" type="checkbox"> Enable Ollama profile advisor</label><label><input name="threat_intel_enabled" type="checkbox"> Enable threat intelligence</label></div><p><button type="submit">Save configuration</button> <span id="settingsResult" class="muted"></span></p></form></section></div>
     <div data-view="howto"><section class="panel"><h2>How To Use SignalScope</h2><div class="howto-grid"><div class="howto-card"><h3>1. Normal workflow</h3><ol><li>Settings: connect Graylog MCP and enable streams.</li><li>Settings: apply recommended profiles for missing streams.</li><li>Diagnostics: confirm raw samples, aggregate counts, and profile readiness.</li><li>Overview: use Operator Guidance, incidents, trends, and correlation map.</li><li>Findings: review only high-signal deviations first, then mark decisions.</li></ol></div><div class="howto-card"><h3>2. Stream health</h3><ul><li><b>ready</b>: profile exists, events are arriving, and baseline fields are ready.</li><li><b>learning</b>: profile exists and events arrive, but baseline age or buckets are still too low.</li><li><b>missing_profile</b>: stream is enabled but no profile exists. Apply or edit one.</li><li><b>no_events</b>: stream is enabled but the current poll has no raw sample events.</li><li><b>partial_fetch</b>: Graylog returned only part of the requested raw sample.</li></ul></div><div class="howto-card"><h3>3. Ready fields</h3><p><code>0/8</code> means 8 profile fields are tracked but none are mature enough yet. A field needs at least 12 baseline buckets and the configured Baseline training days before it is ready.</p><p>During learning, treat findings as signals to tune profiles, not as final alerts.</p></div><div class="howto-card"><h3>4. Profiles</h3><ul><li><b>Entity fields</b> define who or what behavior is tracked, such as user, host, source IP, or application actor.</li><li><b>Baseline fields</b> define the changing behavior to learn, such as action, event ID, service, URL, status, or counters.</li><li><b>Relationships</b> learn pairs such as username to srcip or host to process.</li><li><b>Detectors</b> add burst checks for auth failures, DNS queries, and deny actions.</li></ul></div><div class="howto-card"><h3>5. Findings</h3><ul><li>Start with Triage Queue and incidents, not raw long tables.</li><li>Open evidence details before confirming a finding.</li><li>Use Expected for known behavior, False positive for bad signal, Confirmed for real investigation items.</li><li>Use expiry when a behavior is expected only temporarily.</li></ul></div><div class="howto-card"><h3>6. High EPS / MCP</h3><ul><li>Use aggregate or auto fetch mode for high EPS streams.</li><li>Keep raw samples small enough for context; aggregate counts represent the full window.</li><li>Sample capped is normal in aggregate mode. Truncated raw mode means you may miss context.</li><li>If MCP is stale, the UI shows cached status so you can still inspect previous findings.</li></ul></div><div class="howto-card"><h3>7. Ollama</h3><ul><li>Dashboard assessment summarizes current evidence.</li><li>Profile advisor maps unknown/custom fields and suggests relationships.</li><li>Ollama advice is constrained to fields discovered from Graylog; unknown fields are rejected.</li></ul></div><div class="howto-card"><h3>8. Baseline DB size</h3><ul><li>Baseline DB size is the local SQLite behavior baseline.</li><li>Retention deletes old rows, but SQLite only returns disk space after manual VACUUM.</li><li>If the DB grows fast, lower bucket retention, value retention, or max values per entity field in Settings.</li><li>Stop the service before running <code>signalscope baseline-maintenance --vacuum</code>.</li></ul></div><div class="howto-card"><h3>9. What to fix first</h3><ol><li>No streams enabled.</li><li>Enabled streams with missing profiles.</li><li>Enabled streams with zero raw events.</li><li>Profiles stuck at 0 ready fields after the training window.</li><li>Too many repeated findings without review feedback.</li><li>Baseline DB growing without maintenance.</li></ol></div></div></section></div>
@@ -216,6 +216,8 @@ function graylogEvidenceLink(query, configuration, label='Open in Graylog') {
 }
 const tableSort = {};
 const uiCache = {correlations: [], fieldRows: [], correlationHitboxes: [], selectedCorrelationKey: '', entityLabels: {}};
+let pendingReview = null;
+let lastReviewAuthor = '';
 window.availableStreams = [];
 window.streamSelection = {};
 window.configuredStreams = [];
@@ -793,11 +795,76 @@ async function refresh() {
   document.getElementById('fieldDeviations').innerHTML = `${fieldRowsCached ? '<p class="muted">No current field deviations in this poll; showing cached findings from the last non-empty poll.</p>' : ''}` + table(fieldRows, [
     {label:'Entity', key:'entity', render:r => entityCell(r)}, {label:'Stream', key:'stream_title'}, {label:'Detector', key:'detector'}, {label:'Field', key:'field'}, {label:'Score', key:'score'}, {label:'Baseline', render:r => esc(`${r.confidence || '-'}; ${r.baseline_age_days ?? 0}d; ${r.baseline_samples || 0} samples`)}, {label:'Review', render:r => esc(r.feedback || 'unreviewed')}, {label:'Evidence', render:r => { const weighted = r.weight && r.weight !== 1 ? `; weighted ${r.base_score ?? r.score} x ${r.weight}` : ''; const summary=esc(`${r.reason}; current ${r.current ?? '-'} vs baseline ${r.baseline ?? '-'}; scope ${r.baseline_scope ?? '-'}${weighted}; values: ${(r.sample_values || []).join(', ') || '-'}`); const events=(r.sample_events || []).map(item => `${esc(`${item.timestamp} | ${item.source} -> ${item.destination} | ${item.action} ${item.service} | ${item.value} | ${item.message}`)}${item.graylog_query ? `<br><code>${esc(item.graylog_query)}</code>${graylogEvidenceLink(item.graylog_query, configuration)}` : ''}`).join('<br>'); const id=`deviation:${r.entity}:${r.stream_id}:${r.field}:${r.value || ''}`; return events ? `<details data-detail-id="${esc(id)}"><summary>${summary}</summary><p>${events}</p></details>` : summary; }}, {label:'Review action', render:r => `<div class="review-actions"><button class="feedback" data-status="expected" data-entity="${esc(r.entity)}" data-stream="${esc(r.stream_id)}" data-field="${esc(r.field)}" data-value="${esc(r.value || '')}">Expected</button><button class="feedback" data-status="false_positive" data-entity="${esc(r.entity)}" data-stream="${esc(r.stream_id)}" data-field="${esc(r.field)}" data-value="${esc(r.value || '')}">False positive</button><button class="feedback" data-status="confirmed" data-entity="${esc(r.entity)}" data-stream="${esc(r.stream_id)}" data-field="${esc(r.field)}" data-value="${esc(r.value || '')}">Confirm</button></div>`}
   ], 'field-deviations');
-  document.querySelectorAll('.feedback').forEach(button => button.addEventListener('click', async () => {
-    const note = prompt('Review note (optional):') || '';
-    const days = prompt('Expiry in days (0 = no expiry):', '0') || '0';
-    const response = await fetch('/api/feedback', {method:'POST', headers:{'Content-Type':'application/json'}, body:JSON.stringify({status:button.dataset.status, entity:button.dataset.entity, stream_id:button.dataset.stream, field:button.dataset.field, value:button.dataset.value, note, expires_at: Number(days) > 0 ? Math.floor(Date.now()/1000) + Number(days) * 86400 : 0})});
-    document.getElementById('feedbackNotice').textContent = response.ok ? 'Review saved. The matching pattern will be labeled on the next refresh.' : 'Could not save review.';
+  const reviewForm = document.getElementById('reviewForm');
+  const reviewScopeSelect = document.getElementById('reviewScope');
+  const reviewScopeWarning = document.getElementById('reviewScopeWarning');
+  const updateReviewScopeWarning = () => {
+    const broad = ['entity', 'stream'].includes(reviewScopeSelect.value);
+    reviewScopeWarning.hidden = !broad;
+  };
+  document.querySelectorAll('.feedback').forEach(button => button.addEventListener('click', () => {
+    pendingReview = {status: button.dataset.status, entity: button.dataset.entity, stream_id: button.dataset.stream, field: button.dataset.field, value: button.dataset.value};
+    reviewScopeSelect.value = pendingReview.value ? 'value' : 'field';
+    document.getElementById('reviewNote').value = '';
+    document.getElementById('reviewExpiryDays').value = '0';
+    document.getElementById('reviewAuthor').value = lastReviewAuthor;
+    updateReviewScopeWarning();
+    reviewForm.hidden = false;
+    reviewForm.scrollIntoView({block: 'nearest'});
+  }));
+  reviewScopeSelect.onchange = updateReviewScopeWarning;
+  document.getElementById('reviewCancel').onclick = () => {
+    pendingReview = null;
+    reviewForm.hidden = true;
+  };
+  document.getElementById('reviewSubmit').onclick = async () => {
+    if (!pendingReview) return;
+    const scope = reviewScopeSelect.value;
+    const note = document.getElementById('reviewNote').value || '';
+    const author = document.getElementById('reviewAuthor').value || '';
+    const days = Number(document.getElementById('reviewExpiryDays').value || '0');
+    const broad = scope === 'entity' || scope === 'stream';
+    if (broad && days <= 0) {
+      reviewScopeWarning.hidden = false;
+      return;
+    }
+    if (broad) {
+      const target = scope === 'entity' ? `entity "${pendingReview.entity}"` : `stream "${pendingReview.stream_id}"`;
+      if (!confirm(`This will suppress ALL findings for ${target} across every field until it expires. Continue?`)) return;
+    }
+    lastReviewAuthor = author;
+    const payload = {status: pendingReview.status, scope, entity: pendingReview.entity, stream_id: pendingReview.stream_id, field: pendingReview.field, value: pendingReview.value, note, author, expires_at: days > 0 ? Math.floor(Date.now()/1000) + days * 86400 : 0};
+    const response = await fetch('/api/feedback', {method:'POST', headers:{'Content-Type':'application/json'}, body:JSON.stringify(payload)});
+    if (response.ok) {
+      document.getElementById('feedbackNotice').textContent = 'Review saved. The matching pattern will be labeled on the next refresh.';
+      pendingReview = null;
+      reviewForm.hidden = true;
+      refresh();
+    } else {
+      const error = await response.json().catch(() => ({}));
+      document.getElementById('feedbackNotice').textContent = `Could not save review: ${error.error || 'invalid request'}.`;
+    }
+  };
+  const feedbackRules = (data.feedback || []).slice().sort((left, right) => Number(right.created_at || 0) - Number(left.created_at || 0));
+  document.getElementById('feedbackRuleSummary').textContent = `${feedbackRules.length} active rule(s).`;
+  document.getElementById('feedbackRules').innerHTML = table(feedbackRules, [
+    {label:'Scope', key:'scope'},
+    {label:'Entity', render:r => esc(r.entity || '-')},
+    {label:'Stream', render:r => esc(r.stream_id || '-')},
+    {label:'Field', render:r => esc(r.field || '-')},
+    {label:'Value', render:r => esc(r.value || '-')},
+    {label:'Status', key:'status'},
+    {label:'Author', render:r => esc(r.author || '-')},
+    {label:'Note', render:r => esc(r.note || '-')},
+    {label:'Expiry', render:r => r.expires_at ? esc(new Date(Number(r.expires_at) * 1000).toLocaleString()) : 'never'},
+    {label:'Created', render:r => esc(new Date(Number(r.created_at || 0) * 1000).toLocaleString())},
+    {label:'Matching findings', render:r => String(rawFieldRows.filter(item => item.feedback_rule_id === r.id).length)},
+    {label:'Action', render:r => `<button type="button" class="revoke-feedback-rule" data-id="${esc(r.id)}">Revoke</button>`}
+  ], 'feedback-rules');
+  document.querySelectorAll('.revoke-feedback-rule').forEach(button => button.addEventListener('click', async () => {
+    if (!confirm('Revoke this feedback rule? Matching findings will reappear on the next refresh.')) return;
+    const response = await fetch('/api/feedback/revoke', {method:'POST', headers:{'Content-Type':'application/json'}, body:JSON.stringify({id: button.dataset.id})});
+    document.getElementById('feedbackNotice').textContent = response.ok ? 'Rule revoked.' : 'Could not revoke rule.';
     refresh();
   }));
   const relatedGroups = compactRelatedActivity(relatedRows);
@@ -836,6 +903,20 @@ async function refresh() {
     '<h3>Entities</h3>' + table(context.source_profiles || [], [{label:'Entity', key:'entity', render:r => entityCell(r)}, {label:'Events', key:'events'}, {label:'UTM', key:'utm_events'}, {label:'Deny', key:'deny_or_threat_actions'}, {label:'Destinations', key:'distinct_destinations'}, {label:'Actions', render:r => esc((r.top_actions || []).join(', '))}], 'entities') +
     '<h3>Profile Baseline Readiness</h3>' + table(profileReadiness, [{label:'Profile', key:'profile_name'}, {label:'Stream', key:'stream_title'}, {label:'Field', key:'field'}, {label:'Buckets', key:'buckets'}, {label:'Age days', key:'age_days'}, {label:'Training days', key:'training_days'}, {label:'Ready', key:'ready', render:r => r.ready ? 'ready' : 'learning'}, {label:'Action', render:r => r.stream_id ? `<button type="button" class="delete-stream-profile small-action danger-action" title="Delete profile" data-stream-id="${esc(r.stream_id)}" data-stream-name="${esc(r.stream_title || r.profile_name || r.stream_id)}">Remove</button>` : '-'}], 'profile-readiness') +
     '<h3>Data Quality</h3>' + table([quality], [{label:'Events', key:'events'}, {label:'Timestamp coverage', render:r => `${r.timestamp_coverage || 0}%`}, {label:'Source coverage', render:r => `${r.source_coverage || 0}%`}, {label:'Truncated streams', render:r => esc((r.truncated_streams || []).join(', ') || 'none')}]) +
+    '<h3>Feedback Rules</h3>' + table(
+      ['value', 'field', 'entity', 'stream'].map(scope => ({scope, count: feedbackRules.filter(item => (item.scope || 'value') === scope).length})),
+      [{label:'Scope', key:'scope'}, {label:'Active rules', key:'count'}]
+    ) + `<p class="muted">${rawFieldRows.filter(item => ['expected', 'false_positive'].includes(item.feedback || '')).length} finding(s) suppressed by feedback this poll.</p>` +
+    '<h3>Detector Precision</h3>' + table(
+      Object.entries(rawFieldRows.reduce((acc, item) => {
+        if (!['confirmed', 'false_positive'].includes(item.feedback || '')) return acc;
+        const key = item.detector || 'unknown';
+        acc[key] = acc[key] || {confirmed: 0, false_positive: 0};
+        acc[key][item.feedback] += 1;
+        return acc;
+      }, {})).map(([detector, counts]) => ({detector, confirmed: counts.confirmed, false_positive: counts.false_positive, precision: (counts.confirmed + counts.false_positive) ? `${(counts.confirmed / (counts.confirmed + counts.false_positive) * 100).toFixed(1)}%` : '-'})),
+      [{label:'Detector', key:'detector'}, {label:'Confirmed', key:'confirmed'}, {label:'False positive', key:'false_positive'}, {label:'Precision', key:'precision'}]
+    ) +
     '<h3>Security Event Samples</h3>' + table(context.security_event_samples || [], [{label:'Entity', key:'entity', render:r => entityCell(r)}, {label:'Type', key:'type'}, {label:'Action', key:'action'}, {label:'Severity', key:'severity'}, {label:'Destination', key:'dst'}, {label:'Service', key:'service'}]) +
     '<h3>Top Sources</h3>' + table(d.top_source_ips || [], [{label:'Value', key:'value', render:r => entityCell({entity:r.value})}, {label:'Count', key:'count'}]) +
     '<h3>Top Destinations</h3>' + table(d.top_destination_ips || [], [{label:'Value', key:'value'}, {label:'Count', key:'count'}]) +
@@ -1283,6 +1364,13 @@ def serve_dashboard(host: str, port: int, status_file: str, *, image_dir: str |
                 except (ValueError, json.JSONDecodeError) as exc:
                     self._send(400, "application/json", json.dumps({"error": str(exc)}).encode("utf-8"))
                 return
+            if self.path == "/api/feedback/revoke" and self._is_loopback_client():
+                try:
+                    payload = json.loads(self.rfile.read(min(int(self.headers.get("Content-Length", "0")), 16_384)).decode("utf-8"))
+                    self._send(200, "application/json", json.dumps(FeedbackStore().revoke(str(payload.get("id", "")))).encode("utf-8"))
+                except (ValueError, json.JSONDecodeError) as exc:
+                    self._send(400, "application/json", json.dumps({"error": str(exc)}).encode("utf-8"))
+                return
             if self.path == "/api/feedback/clear" and self._is_loopback_client():
                 try:
                     payload = json.loads(self.rfile.read(min(int(self.headers.get("Content-Length", "0")), 16_384)).decode("utf-8"))
diff --git a/src/fgai/feedback.py b/src/fgai/feedback.py
index b8dd901..738e201 100644
--- a/src/fgai/feedback.py
+++ b/src/fgai/feedback.py
@@ -1,9 +1,77 @@
 from __future__ import annotations
 
+import hashlib
 import json
 import time
 from pathlib import Path
 
+VALID_STATUSES = {"false_positive", "expected", "confirmed"}
+VALID_SCOPES = {"value", "field", "entity", "stream"}
+SCOPE_PRIORITY = {"value": 0, "field": 1, "entity": 2, "stream": 3}
+SUPPRESSING_STATUSES = {"false_positive", "expected"}
+
+_SCOPE_ID_FIELDS = {
+    "value": ("stream_id", "entity", "field", "value"),
+    "field": ("stream_id", "entity", "field"),
+    "entity": ("entity",),
+    "stream": ("stream_id",),
+}
+
+
+def _resolve_scope(item: dict[str, object]) -> str:
+    scope = str(item.get("scope") or "").lower()
+    if scope:
+        return scope
+    return "value" if str(item.get("value", "")) else "field"
+
+
+def _entry_id(scope: str, entry: dict[str, object]) -> str:
+    fields = _SCOPE_ID_FIELDS[scope]
+    payload = {"scope": scope, **{key: entry.get(key, "") for key in fields}}
+    return hashlib.sha256(json.dumps(payload, sort_keys=True).encode("utf-8")).hexdigest()[:16]
+
+
+def _normalize(item: dict[str, object]) -> dict[str, object]:
+    scope = _resolve_scope(item)
+    if scope not in VALID_SCOPES:
+        raise ValueError("invalid feedback scope")
+    status = str(item.get("status", "")).lower()
+    if status not in VALID_STATUSES:
+        raise ValueError("invalid feedback status")
+    stream_id = str(item.get("stream_id", ""))
+    entity = str(item.get("entity", ""))
+    field = str(item.get("field", ""))
+    value = str(item.get("value", ""))
+    if scope == "stream" and not stream_id:
+        raise ValueError("stream-scoped feedback requires a stream_id")
+    if scope == "entity" and not entity:
+        raise ValueError("entity-scoped feedback requires an entity")
+    if scope in {"value", "field"} and not (entity and stream_id and field):
+        raise ValueError("field-scoped feedback requires entity, stream_id, and field")
+    expires_at = int(item.get("expires_at", 0) or 0)
+    if scope in {"entity", "stream"} and expires_at <= 0:
+        raise ValueError("broad-scope feedback rules require an expiry")
+    if scope == "stream":
+        entity = field = value = ""
+    elif scope == "entity":
+        stream_id = field = value = ""
+    elif scope == "field":
+        value = ""
+    entry = {
+        "stream_id": stream_id,
+        "entity": entity,
+        "field": field,
+        "value": value,
+        "scope": scope,
+        "status": status,
+        "note": str(item.get("note", "")),
+        "author": str(item.get("author", "")),
+        "created_at": int(time.time()),
+        "expires_at": expires_at,
+    }
+    entry["id"] = _entry_id(scope, entry)
+    return entry
+
 
 class FeedbackStore:
     def __init__(self, path: str = "state/signalscope-feedback.json") -> None:
@@ -15,17 +83,37 @@ class FeedbackStore:
         except (FileNotFoundError, json.JSONDecodeError):
             items = []
         now = int(time.time())
-        return [item for item in items if not item.get("expires_at") or int(item["expires_at"]) > now]
+        result = []
+        for item in items:
+            if not isinstance(item, dict):
+                continue
+            if item.get("expires_at") and int(item["expires_at"]) <= now:
+                continue
+            scope = _resolve_scope(item)
+            item = dict(item)
+            item["scope"] = scope
+            item.setdefault("author", "")
+            item.setdefault("id", _entry_id(scope, item))
+            result.append(item)
+        return result
 
     def add(self, item: dict[str, object]) -> dict[str, object]:
-        status = str(item.get("status", "")).lower()
-        if status not in {"false_positive", "expected", "confirmed"}:
-            raise ValueError("invalid feedback status")
-        entry = {"stream_id": str(item.get("stream_id", "")), "entity": str(item.get("entity", "")), "field": str(item.get("field", "")), "value": str(item.get("value", "")), "status": status, "note": str(item.get("note", "")), "created_at": int(time.time()), "expires_at": int(item.get("expires_at", 0) or 0)}
-        entries = [value for value in self.entries() if (value.get("stream_id"), value.get("entity"), value.get("field"), value.get("value", "")) != (entry["stream_id"], entry["entity"], entry["field"], entry["value"])]
-        entries.append(entry); self.path.parent.mkdir(parents=True, exist_ok=True); self.path.write_text(json.dumps(entries, indent=2), encoding="utf-8")
+        entry = _normalize(item)
+        entries = [value for value in self.entries() if value.get("id") != entry["id"]]
+        entries.append(entry)
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        self.path.write_text(json.dumps(entries, indent=2), encoding="utf-8")
         return entry
 
+    def revoke(self, entry_id: str) -> dict[str, object]:
+        entries = self.entries()
+        before = len(entries)
+        entries = [item for item in entries if item.get("id") != entry_id]
+        removed = before - len(entries)
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        self.path.write_text(json.dumps(entries, indent=2), encoding="utf-8")
+        return {"removed": removed, "remaining": len(entries), "id": entry_id}
+
     def clear(self, *, status: str | None = None) -> dict[str, object]:
         entries = self.entries()
         if status is None:
@@ -33,7 +121,7 @@ class FeedbackStore:
             entries = []
         else:
             status = status.lower()
-            if status not in {"false_positive", "expected", "confirmed"}:
+            if status not in VALID_STATUSES:
                 raise ValueError("invalid feedback status")
             before = len(entries)
             entries = [item for item in entries if str(item.get("status", "")).lower() != status]
@@ -41,3 +129,27 @@ class FeedbackStore:
         self.path.parent.mkdir(parents=True, exist_ok=True)
         self.path.write_text(json.dumps(entries, indent=2), encoding="utf-8")
         return {"removed": removed, "remaining": len(entries), "status": status or "all"}
+
+
+def feedback_matches(entry: dict[str, object], *, entity: str, stream_id: str, field: str, value: str) -> bool:
+    scope = str(entry.get("scope") or _resolve_scope(entry))
+    if scope == "stream":
+        return str(entry.get("stream_id", "")) == stream_id
+    if scope == "entity":
+        return str(entry.get("entity", "")) == entity
+    if scope == "field":
+        return (
+            str(entry.get("entity", "")) == entity
+            and str(entry.get("stream_id", "")) == stream_id
+            and str(entry.get("field", "")) == field
+        )
+    return (
+        str(entry.get("entity", "")) == entity
+        and str(entry.get("stream_id", "")) == stream_id
+        and str(entry.get("field", "")) == field
+        and str(entry.get("value", "")) == value
+    )
+
+
+def select_match(candidates: list[dict[str, object]]) -> dict[str, object]:
+    return min(candidates, key=lambda item: SCOPE_PRIORITY.get(str(item.get("scope") or _resolve_scope(item)), 1))
diff --git a/src/fgai/incidents.py b/src/fgai/incidents.py
index bfb2679..97996fe 100644
--- a/src/fgai/incidents.py
+++ b/src/fgai/incidents.py
@@ -7,6 +7,7 @@ from collections import defaultdict
 from pathlib import Path
 
 from .entities import entity_type
+from .feedback import SUPPRESSING_STATUSES
 from .models import AnomalyFinding
 
 
@@ -29,7 +30,7 @@ def build_incidents(anomalies: list[AnomalyFinding], field_deviations: dict[str,
     for entity, deviations in field_deviations.items():
         group = groups[entity]
         group["fields"].extend(deviations)
-        active = [item for item in deviations if item.get("feedback") not in {"expected", "false_positive"}]
+        active = [item for item in deviations if item.get("feedback") not in SUPPRESSING_STATUSES]
         group["score"] = min(100, int(group["score"]) + min(30, sum(int(item.get("score", 0)) for item in active)))
         group["evidence"].extend(str(item.get("reason", "")) for item in active)
         for item in active:
diff --git a/src/fgai/metrics.py b/src/fgai/metrics.py
index 9d33ece..82addd6 100644
--- a/src/fgai/metrics.py
+++ b/src/fgai/metrics.py
@@ -1,5 +1,7 @@
 from __future__ import annotations
 
+from .feedback import SUPPRESSING_STATUSES, VALID_SCOPES
+
 
 def prometheus_metrics(status: dict[str, object]) -> str:
     summary = status.get("summary", {}) if isinstance(status.get("summary"), dict) else {}
@@ -8,6 +10,9 @@ def prometheus_metrics(status: dict[str, object]) -> str:
     capabilities = status.get("capabilities", {}) if isinstance(status.get("capabilities"), dict) else {}
     mcp = capabilities.get("graylog_mcp", {}) if isinstance(capabilities.get("graylog_mcp"), dict) else {}
     incidents = status.get("incidents", []) if isinstance(status.get("incidents"), list) else []
+    feedback = status.get("feedback", []) if isinstance(status.get("feedback"), list) else []
+    deviations = status.get("field_deviations", {}) if isinstance(status.get("field_deviations"), dict) else {}
+    all_deviations = [item for items in deviations.values() if isinstance(items, list) for item in items if isinstance(item, dict)]
     lines = ["# HELP fgai_events_total Events in the latest analysis window.", "# TYPE fgai_events_total gauge"]
     for key in ("total", "utm", "threat_actions", "critical_or_high"):
         lines.append(f'fgai_events_total{{kind="{key}"}} {int(summary.get(key, 0) or 0)}')
@@ -20,4 +25,26 @@ def prometheus_metrics(status: dict[str, object]) -> str:
     lines += ["# HELP signalscope_incidents Open incident candidates by severity.", "# TYPE signalscope_incidents gauge"]
     for severity in ("critical", "high", "medium", "low"):
         lines.append(f'signalscope_incidents{{severity="{severity}"}} {sum(1 for item in incidents if isinstance(item, dict) and item.get("severity") == severity)}')
+    lines += ["# HELP fgai_feedback_rules Active feedback rules by scope.", "# TYPE fgai_feedback_rules gauge"]
+    for scope in sorted(VALID_SCOPES):
+        lines.append(f'fgai_feedback_rules{{scope="{scope}"}} {sum(1 for item in feedback if isinstance(item, dict) and item.get("scope", "value") == scope)}')
+    suppressed = sum(1 for item in all_deviations if item.get("feedback") in SUPPRESSING_STATUSES)
+    lines += ["# HELP fgai_feedback_suppressed_findings Findings suppressed by feedback in the latest poll.", "# TYPE fgai_feedback_suppressed_findings gauge", f'fgai_feedback_suppressed_findings {suppressed}']
+    precision: dict[str, dict[str, int]] = {}
+    for item in all_deviations:
+        verdict = item.get("feedback")
+        if verdict not in {"confirmed", "false_positive"}:
+            continue
+        detector = str(item.get("detector", "unknown"))
+        counts = precision.setdefault(detector, {"confirmed": 0, "false_positive": 0})
+        counts[verdict] += 1
+    lines += ["# HELP fgai_detector_feedback_total Confirmed vs false-positive feedback by detector.", "# TYPE fgai_detector_feedback_total gauge"]
+    for detector, counts in sorted(precision.items()):
+        for verdict in ("confirmed", "false_positive"):
+            lines.append(f'fgai_detector_feedback_total{{detector="{detector}",verdict="{verdict}"}} {counts[verdict]}')
+    lines += ["# HELP fgai_detector_precision Confirmed / (confirmed + false_positive) by detector.", "# TYPE fgai_detector_precision gauge"]
+    for detector, counts in sorted(precision.items()):
+        denominator = counts["confirmed"] + counts["false_positive"]
+        if denominator:
+            lines.append(f'fgai_detector_precision{{detector="{detector}"}} {counts["confirmed"] / denominator:.4f}')
     return "\n".join(lines) + "\n"
diff --git a/src/fgai/monitor.py b/src/fgai/monitor.py
index e8abbfd..c58e49b 100644
--- a/src/fgai/monitor.py
+++ b/src/fgai/monitor.py
@@ -12,7 +12,7 @@ from .baseline import BaselineStore
 from .config import ConfigStore
 from .correlation import correlate_source_ips
 from .event_context import build_event_context
-from .feedback import FeedbackStore
+from .feedback import FeedbackStore, SUPPRESSING_STATUSES, feedback_matches, select_match
 from .graylog_aggregate import GraylogAggregateSource
 from .graylog_mcp import GraylogMcpClient
 from .graylog_source import GraylogStreamSource
@@ -383,16 +383,18 @@ def build_status(
     feedback = FeedbackStore().entries()
     for entity, deviations in field_deviations.items():
         for deviation in deviations:
-            match = next((
+            stream_id = str(deviation.get("stream_id", ""))
+            field = str(deviation.get("field", ""))
+            value = str(deviation.get("value", ""))
+            candidates = [
                 item for item in feedback
-                if item.get("entity") == entity
-                and item.get("stream_id") == deviation.get("stream_id")
-                and item.get("field") == deviation.get("field")
-                and (not item.get("value") or item.get("value") == deviation.get("value", ""))
-            ), None)
-            if match:
+                if feedback_matches(item, entity=entity, stream_id=stream_id, field=field, value=value)
+            ]
+            if candidates:
+                match = select_match(candidates)
                 deviation["feedback"] = match["status"]
-                if match["status"] in {"false_positive", "expected"}:
+                deviation["feedback_rule_id"] = match.get("id", "")
+                if match["status"] in SUPPRESSING_STATUSES:
                     deviation["score"] = 0
     anomalies = detect_source_anomalies(events, limit=anomaly_limit, baselines=profiles, field_deviations=field_deviations)
     baseline_events = baseline.ingest(events) if baseline else 0
diff --git a/src/fgai/triage.py b/src/fgai/triage.py
index ed56dd8..2827abf 100644
--- a/src/fgai/triage.py
+++ b/src/fgai/triage.py
@@ -2,6 +2,8 @@ from __future__ import annotations
 
 from collections import Counter, defaultdict
 
+from .feedback import SUPPRESSING_STATUSES
+
 
 def _severity(score: int) -> str:
     return "critical" if score >= 85 else "high" if score >= 60 else "medium" if score >= 35 else "low"
@@ -56,7 +58,7 @@ def build_triage_queue(
             group["deviations"] = int(group["deviations"]) + 1
             group["streams"].add(str(item.get("stream_name") or item.get("stream_title") or item.get("stream_id", "")))
             group["detectors"][str(item.get("detector", "unknown"))] += 1
-            if status in {"expected", "false_positive"}:
+            if status in SUPPRESSING_STATUSES:
                 continue
             score = int(item.get("score", 0) or 0)
             active_scores.append(score)
diff --git a/tests/test_dashboard.py b/tests/test_dashboard.py
index 5beaef7..bf3e119 100644
--- a/tests/test_dashboard.py
+++ b/tests/test_dashboard.py
@@ -76,6 +76,22 @@ class DashboardTests(unittest.TestCase):
         self.assertIn("/api/feedback/clear", source)
         self.assertIn("/api/review-state/clear", source)
 
+    def test_dashboard_exposes_feedback_revoke_endpoint(self):
+        source = inspect.getsource(dashboard)
+        self.assertIn("/api/feedback/revoke", source)
+        self.assertIn(".revoke(", source)
+
+    def test_dashboard_has_active_feedback_rules_panel(self):
+        self.assertIn('id="feedbackRules"', HTML)
+        self.assertIn("revoke-feedback-rule", HTML)
+        self.assertIn('id="feedbackRuleSummary"', HTML)
+
+    def test_dashboard_has_scoped_review_form(self):
+        self.assertIn('id="reviewScope"', HTML)
+        self.assertIn('value="entity"', HTML)
+        self.assertIn('value="stream"', HTML)
+        self.assertIn("Broad-scope rules must expire", HTML)
+
     def test_dashboard_does_not_clear_streams_when_picker_is_unloaded(self):
         self.assertIn("const streamValues = Object.values(window.streamSelection || {})", HTML)
         self.assertIn("if (streamValues.length)", HTML)
diff --git a/tests/test_feedback.py b/tests/test_feedback.py
index 6e7536a..fbeafb8 100644
--- a/tests/test_feedback.py
+++ b/tests/test_feedback.py
@@ -1,8 +1,9 @@
 import tempfile
+import time
 import unittest
 from pathlib import Path
 
-from fgai.feedback import FeedbackStore
+from fgai.feedback import FeedbackStore, feedback_matches, select_match
 
 
 class FeedbackTests(unittest.TestCase):
@@ -20,6 +21,74 @@ class FeedbackTests(unittest.TestCase):
             self.assertEqual(all_items, {"removed": 1, "remaining": 0, "status": "all"})
             self.assertEqual(store.entries(), [])
 
+    def test_feedback_scope_defaults_and_ids_are_stable(self):
+        with tempfile.TemporaryDirectory() as directory:
+            store = FeedbackStore(str(Path(directory) / "feedback.json"))
+            no_value = store.add({"status": "expected", "entity": "alice", "stream_id": "windows", "field": "username"})
+            self.assertEqual(no_value["scope"], "field")
+
+            with_value = store.add({"status": "expected", "entity": "alice", "stream_id": "windows", "field": "username", "value": "bob"})
+            self.assertEqual(with_value["scope"], "value")
+            self.assertEqual(len(store.entries()), 2)
+
+            again = store.add({"status": "confirmed", "entity": "alice", "stream_id": "windows", "field": "username"})
+            self.assertEqual(again["id"], no_value["id"])
+            self.assertEqual(len(store.entries()), 2)
+            self.assertEqual(next(item for item in store.entries() if item["id"] == no_value["id"]).get("status"), "confirmed")
+
+    def test_feedback_broad_scope_requires_expiry(self):
+        with tempfile.TemporaryDirectory() as directory:
+            store = FeedbackStore(str(Path(directory) / "feedback.json"))
+            with self.assertRaises(ValueError):
+                store.add({"status": "expected", "scope": "entity", "entity": "alice"})
+            entry = store.add({"status": "expected", "scope": "entity", "entity": "alice", "expires_at": int(time.time()) + 3600})
+            self.assertEqual(entry["scope"], "entity")
+            self.assertEqual(entry["stream_id"], "")
+
+    def test_feedback_stream_scope_requires_stream_id(self):
+        with tempfile.TemporaryDirectory() as directory:
+            store = FeedbackStore(str(Path(directory) / "feedback.json"))
+            with self.assertRaises(ValueError):
+                store.add({"status": "expected", "scope": "stream", "expires_at": int(time.time()) + 3600})
+            entry = store.add({"status": "expected", "scope": "stream", "stream_id": "vpn", "expires_at": int(time.time()) + 3600})
+            self.assertEqual(entry["entity"], "")
+
+    def test_feedback_entity_scope_requires_entity(self):
+        with tempfile.TemporaryDirectory() as directory:
+            store = FeedbackStore(str(Path(directory) / "feedback.json"))
+            with self.assertRaises(ValueError):
+                store.add({"status": "expected", "scope": "entity", "expires_at": int(time.time()) + 3600})
+
+    def test_feedback_revoke_removes_single_rule_by_id(self):
+        with tempfile.TemporaryDirectory() as directory:
+            store = FeedbackStore(str(Path(directory) / "feedback.json"))
+            one = store.add({"status": "expected", "entity": "alice", "stream_id": "windows", "field": "username"})
+            store.add({"status": "confirmed", "entity": "bob", "stream_id": "vpn", "field": "username"})
+
+            result = store.revoke(one["id"])
+            self.assertEqual(result, {"removed": 1, "remaining": 1, "id": one["id"]})
+            self.assertEqual(len(store.entries()), 1)
+
+            missing = store.revoke("does-not-exist")
+            self.assertEqual(missing, {"removed": 0, "remaining": 1, "id": "does-not-exist"})
+
+    def test_feedback_matches_respects_scope_and_precedence(self):
+        value_rule = {"scope": "value", "entity": "alice", "stream_id": "windows", "field": "username", "value": "10.0.0.1", "status": "confirmed"}
+        field_rule = {"scope": "field", "entity": "alice", "stream_id": "windows", "field": "username", "status": "expected"}
+        entity_rule = {"scope": "entity", "entity": "alice", "status": "expected"}
+        stream_rule = {"scope": "stream", "stream_id": "windows", "status": "expected"}
+
+        self.assertTrue(feedback_matches(stream_rule, entity="alice", stream_id="windows", field="username", value="10.0.0.1"))
+        self.assertFalse(feedback_matches(stream_rule, entity="alice", stream_id="vpn", field="username", value="10.0.0.1"))
+        self.assertTrue(feedback_matches(entity_rule, entity="alice", stream_id="vpn", field="hostname", value="x"))
+        self.assertFalse(feedback_matches(field_rule, entity="alice", stream_id="windows", field="hostname", value="x"))
+        self.assertTrue(feedback_matches(value_rule, entity="alice", stream_id="windows", field="username", value="10.0.0.1"))
+        self.assertFalse(feedback_matches(value_rule, entity="alice", stream_id="windows", field="username", value="10.0.0.2"))
+
+        candidates = [stream_rule, entity_rule, field_rule, value_rule]
+        self.assertEqual(select_match(candidates), value_rule)
+        self.assertEqual(select_match([stream_rule, entity_rule]), entity_rule)
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/tests/test_metrics.py b/tests/test_metrics.py
index 2052fbc..9f40e86 100644
--- a/tests/test_metrics.py
+++ b/tests/test_metrics.py
@@ -8,3 +8,45 @@ class MetricsTests(unittest.TestCase):
         output = prometheus_metrics({"summary": {"total": 10}, "anomaly_summary": {"high": 2}, "baseline": {"sources_ready": 3}, "capabilities": {"graylog_mcp": {"status": "connected", "events_fetched": 9}}})
         self.assertIn('fgai_events_total{kind="total"} 10', output)
         self.assertIn("fgai_graylog_mcp_connected 1", output)
+
+    def test_feedback_rules_counted_by_scope(self):
+        status = {
+            "feedback": [
+                {"scope": "entity", "status": "expected"},
+                {"scope": "value", "status": "confirmed"},
+            ],
+            "field_deviations": {},
+        }
+        text = prometheus_metrics(status)
+        self.assertIn('fgai_feedback_rules{scope="entity"} 1', text)
+        self.assertIn('fgai_feedback_rules{scope="value"} 1', text)
+        self.assertIn('fgai_feedback_rules{scope="field"} 0', text)
+        self.assertIn('fgai_feedback_rules{scope="stream"} 0', text)
+
+    def test_suppressed_findings_and_detector_precision(self):
+        status = {
+            "feedback": [],
+            "field_deviations": {
+                "alice": [
+                    {"detector": "rare_value", "feedback": "confirmed"},
+                    {"detector": "rare_value", "feedback": "false_positive"},
+                    {"detector": "rare_value", "feedback": "expected"},
+                    {"detector": "auth_failure_burst", "feedback": "unreviewed"},
+                ]
+            },
+        }
+        text = prometheus_metrics(status)
+        self.assertIn("fgai_feedback_suppressed_findings 2", text)
+        self.assertIn('fgai_detector_feedback_total{detector="rare_value",verdict="confirmed"} 1', text)
+        self.assertIn('fgai_detector_feedback_total{detector="rare_value",verdict="false_positive"} 1', text)
+        self.assertIn('fgai_detector_precision{detector="rare_value"} 0.5000', text)
+        self.assertNotIn('detector="auth_failure_burst"', text)
+
+    def test_metrics_handle_empty_status(self):
+        text = prometheus_metrics({})
+        self.assertIn('fgai_feedback_rules{scope="value"} 0', text)
+        self.assertIn("fgai_feedback_suppressed_findings 0", text)
+
+
+if __name__ == "__main__":
+    unittest.main()