docs: point at the author's idea note, and log its first item

The author keeps ideas in an Obsidian note outside this repository. Nothing
in the repo pointed at it, so a fresh session would never find it and the
backlog would look complete while ideas sat unread. AGENTS.md now names the
path and the rule: the note is the inbox, the backlog is the tracked list,
and they are reconciled in both directions.

Item 3 is that note's one open idea, an API letting qtmaildir tag incoming
mail by resemblance to a kept case. It is recorded unsized and explicitly
marked as having no verified cause, because unlike items 1 and 2 there is
nothing built to verify. The entry records the real tension rather than just
the request: this tool has been deliberately mechanical, reporting what a
message declared and refusing rather than guessing, and a resemblance score
would be its first opinion. It also notes that source.eml is unredacted, so
matching must not become a route by which a stored recipient identifier
reaches a comparison.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Wrfqr2xqQfhtXCscU7zrdz

1 files changed, 42 insertions, 0 deletions

diff --git a/docs/BACKLOG.md b/docs/BACKLOG.md
index 79c0ab1..60405c0 100644
--- a/docs/BACKLOG.md
+++ b/docs/BACKLOG.md
@@ -7,6 +7,7 @@ number and gains a status rather than being renumbered.
 |---|------|------|--------|
 | 1 | Skip boilerplate namespace URLs | XS | open |
 | 2 | An IDN indicator resolves to no contact | S | open |
+| 3 | Expose kept cases so qtmaildir can tag spam | ? | open, unsized |
 
 ## 1. Skip boilerplate namespace URLs
 
@@ -67,3 +68,44 @@ where the attacker wants the tool to normalise on their behalf, and a
 consultant chasing one indicator by hand is a smaller cost than a query made
 about a name the user never saw. Wait for a real IDN indicator in a sweep before
 building it.
+
+## 3. Expose kept cases so qtmaildir can tag spam
+
+**Source.** The author's idea note, not a defect found in the code. Unlike
+items 1 and 2 the cause here has NOT been verified against the code, because
+there is nothing built yet to verify: this is a feature request, and it is
+recorded unsized on purpose.
+
+**Observed.** Case directories are permanent by design, so over time they
+become a local corpus of messages the user has already judged to be phishing.
+Nothing reads them back. The idea is that qtmaildir could ask this tool
+whether an incoming message resembles one, and tag it as spam when it does.
+
+**Approach.** Undecided, and the shape matters more than the code. The
+umbrella design already fixes the coupling between the two repositories: the
+manifest format and a command name in qtmaildir's config, with no submodule.
+A read-only subcommand answering a question about one message fits that
+contract; a daemon, a socket or a shared database does not, and the umbrella
+design rules out a database of this tool's own.
+
+**Constraints, and the real tension.** Deciding a message is spam by
+resemblance is a classifier, and this tool has so far been deliberately
+mechanical: it reports what a message declared, and refuses rather than
+guesses when the trust boundary is unset. A resemblance score is the first
+thing here that would be an opinion rather than an observation, and a wrong
+one either hides real mail or teaches the user to distrust the tag.
+
+There is also a quieter question about what a match is allowed to be based on.
+The obvious signals are the ones already in a manifest, a sending IP, a
+domain, a URL shape, an attachment hash. Those are safe. Matching on the
+message body would mean holding attacker-supplied text against new mail, and
+`source.eml` is unredacted, so anything built here must not become a route by
+which a stored recipient identifier reaches a comparison that is later
+reported or logged. Property 1 governs what may be published, and a tag is not
+a report, but the path from one to the other is short.
+
+**Before building.** Ask the author what "fits certain requisites" means to
+him concretely, since that phrase is doing all the work in the note, and
+whether he wants a judgement or only the facts, for instance a subcommand that
+answers "this IP appears in three kept cases" and leaves the tagging decision
+to qtmaildir. The second is much more in keeping with the rest of the tool.