feat: expand mailbox evidence scanner

README.md

@@ -19,16 +19,25 @@ The example config uses `tests/fixtures/mailbox` as a mailbox source. Runtime
 state is written to `.email-connect/state.sqlite`; generated CSV reports are
 written to `reports/`.
 
+For a live mailbox, set `mailbox.protocol: imap`, configure host, port, folder,
+and credential environment variable names, then export the credentials before
+running `scan-mailbox`. IMAP scans select the configured folder read-only and
+fetch message bodies with `BODY.PEEK[]`; mailbox write-back actions such as
+marking messages seen are intentionally unsupported in this MVP.
+
 ## Current Scope
 
 - Coordination-engine spec review and references.
 - Initial adapter descriptor, capability profile, evidence ceiling, and
   limitations.
+- Fixture and read-only IMAP mailbox sources.
 - Conservative mailbox message parser and evidence mapper.
-- SQLite state store with message and evidence deduplication.
-- CSV report generation.
-- Golden fixture tests for hard bounce, soft bounce, out-of-office, and human
+- SQLite state store with scan cursor, message/evidence deduplication, and
+  endpoint quality hints.
+- CSV report generation, including `--report-only-new`.
+- Golden fixture tests for hard bounce, soft bounce, delayed delivery, final
+  failure, complaint, unsubscribe, unknown return, out-of-office, and human
   reply signals.
 
-IMAP access, provider webhooks, outbound sending, suppression workflows, and a
-UI are planned work, not complete in this first slice.
+Provider webhooks, outbound sending, suppression workflows, OAuth mailbox login,
+and a UI remain outside this first mailbox-scanner slice.