# Second-pass reality check (SPEC §C.1: this filter runs on mail the provider has
# already accepted and delivered).
#
# Every symbol below is a legitimate SMTP-time signal that is meaningless — or
# actively wrong — when scoring a message at rest, days after delivery, fetched
# over IMAP. Measured on a 398-message sample of real delivered mail, they fired
# on 44-71% of it and pushed 11.3% of ordinary mail over the banner threshold.
#
# They are zeroed, not deleted: they still appear in the symbol list, so a verdict
# stays explainable, they just no longer contribute score. When M6 lands, the edge
# scanner (§C.7) sees real SMTP state and these matter again — there, not here.
#
# Measured on 398 real delivered messages, before -> after this file:
#     median   3.09 -> 0.70
#     p95      7.00 -> 3.40
#     >= 6.0   11.3% -> 1.0%      (the banner threshold)
#     max     11.66 -> 9.15       (move threshold is 12.0, so: headroom)
# The thresholds themselves were left at the spec's 12.0/6.0 — they were never
# the problem. Re-measure after the C2 learning loop has a trained Bayes: until
# then genuine scams and legitimate bulk mail overlap in the 5-8 band, and no
# threshold can separate them.
symbols {
  # "This message is older than the scan" — always true for us.
  "DATE_IN_PAST" { score = 0.0; }
  # "Already delivered once" — by definition, for a second-pass filter.
  "PREVIOUSLY_DELIVERED" { score = 0.0; }
  # Properties of the connecting host, which we never saw.
  "HFILTER_HOSTNAME_UNKNOWN" { score = 0.0; }
  "RCVD_NO_TLS_LAST" { score = 0.0; }
  # Absence-of-authentication penalties. We cannot verify SPF/DKIM/DMARC/ARC at
  # rest anyway, so "not available" says nothing about this message.
  "ARC_NA" { score = 0.0; }
  "DMARC_NA" { score = 0.0; }
}