What changed
- classify observed SEO outreach and carrier-payment phishing
- harden MIME, encoded-header, HTML-entity, Unicode, URL, and attachment handling
- add false-positive controls and regression coverage
- refresh repository guidance and pantry lockfile
Why
Live spam samples bypassed scoring through authenticated compromised domains, encoded content, folded headers, and narrow scan windows.
Validation
- 44 focused spam-filter tests pass
- full Zig test suite passes with Zig 0.16
- production service health verified after deployment