The spam scoring caught my eye — 45+ heuristic signals is a lot. How do you handle false positives for transactional emails? A password reset or order confirmation might legitimately trigger some of those signals (no unsubscribe, image-heavy, urgent language) even though they're completely clean emails. Does the transactional exemption you mention cover most of those cases or is there still manual tuning needed?