@@ -18,11 +18,13 @@ All notable changes to CallShield will be documented in this file.
   footer alone. "Reply STOP to opt out" scored 40 against aggressive mode's
   bar of 25, so a clinic's appointment reminder or a pharmacy's refill notice
   was blocked on its last line. Answer and opt-out wording now counts only
-  next to a real spam pattern, or in a text that doesn't say who sent it. The
-  carrier rules make a business open with its name ("Lakeside Family Clinic:
-  ..." or "this is Dana from Maple Street Dental"), while scams paste the
-  footer onto a chatty opener that never says. Recall on the IMC 2025
-  smishing sample stays at its floors.
+  next to another spam signal (a lure, a suspicious link, shouting or a
+  callback number), or in a text that doesn't say who sent it. The carrier
+  rules make a business open with its name ("Lakeside Family Clinic: ...",
+  "[Corner Market] ..." or "this is Dana from Maple Street Dental"), while
+  scams paste the footer onto a chatty opener that never says. A time like
+  3:30, a link, a greeting or a word like Alert in front of the colon isn't
+  a name. Recall on the IMC 2025 smishing sample went up slightly.
 - A number the maintainer approved can now be taken back. Its entry in
   `spam_numbers_approved.json` gets `"revoked": true` and a date, and the next
   merge strips the review from the row. A row the review alone was holding up
 
@@ -12,7 +12,7 @@
 <p align="center">
   <a href="https://github.com/SysAdminDoc/CallShield/releases/latest"><img src="https://img.shields.io/github/v/release/SysAdminDoc/CallShield?style=flat-square&color=a6e3a1" alt="Release"></a>
   <img src="https://img.shields.io/badge/Spam%20Numbers-51%2C363-f38ba8?style=flat-square" alt="51,363 Numbers">
-  <img src="https://img.shields.io/badge/JVM%20unit%20tests-1827-94e2d5?style=flat-square" alt="1827 JVM unit tests">
+  <img src="https://img.shields.io/badge/JVM%20unit%20tests-1831-94e2d5?style=flat-square" alt="1831 JVM unit tests">
   <img src="https://img.shields.io/badge/Android-10%2B-89b4fa?style=flat-square" alt="Android 10+">
   <img src="https://img.shields.io/badge/License-MIT-cba6f7?style=flat-square" alt="MIT License">
   <img src="https://img.shields.io/badge/API%20Keys-None-fab387?style=flat-square" alt="No required API keys">
@@ -519,12 +519,12 @@ RELEASE_KEY_PASSWORD=...
 ## Testing
 
 ```bash
-./gradlew testDebugUnitTest   # 1827 tests
+./gradlew testDebugUnitTest   # 1831 tests
 ./gradlew connectedDebugAndroidTest -Pandroid.testInstrumentationRunnerArguments.class=com.sysadmindoc.callshield.platform.TargetSdkBehaviorSmokeTest
 ./gradlew verifyPipelineTests # Cloudflare Worker (node) + data-pipeline and translation checks (python)
 ```
 
-The suite is **1827 total JVM unit tests**, run with Robolectric wherever a screen, a service or the database is involved.
+The suite is **1831 total JVM unit tests**, run with Robolectric wherever a screen, a service or the database is involved.
 
 Two GitHub workflows run without building the app. **Validation** runs the Worker and
 pipeline suites on every push except report-only ones (`run-pipeline-tests.ps1 -CorrectnessOnly`),
@@ -561,7 +561,7 @@ language in [issue #7](https://github.com/SysAdminDoc/CallShield/issues/7).
 | Community API | Cloudflare Workers |
 | URL Safety | Local spam-domain data, with optional PhishTank and OpenPhish |
 | Verification | Local Gradle, lint, and release-artifact checks |
-| Tests | 1827 JVM unit tests (JUnit) |
+| Tests | 1831 JVM unit tests (JUnit) |
 | Strings | 1738 string resources and 37 plural groups (translation-ready) |
 | Accessibility | 100+ content descriptions, 48dp touch targets |
 | Min SDK | 29 (Android 10) |
 
@@ -157,8 +157,8 @@ class SmsContentAnalyzer
         // confirm"), and alone they blocked a clinic's appointment reminder in
         // aggressive mode. Scams copy the footer onto a chatty opener too
         // ("Hey Sam, are you free for coffee? Reply STOP to unsubscribe"), so
-        // they still count after a pattern above, or when the text doesn't say
-        // who sent it (see [namedSender]).
+        // they still count next to any other signal, or when the text doesn't
+        // say who sent it (see [namesItsSender]).
         private val responseCues =
             listOf(
                 Regex("(?i)(unsubscribe|opt.?out|stop to (end|cancel|quit|unsubscribe))"),
@@ -167,13 +167,47 @@ class SmsContentAnalyzer
             )
 
         // The carrier rules also make a business say who it is first:
-        // "Lakeside Family Clinic: your visit is..." or "this is Dana from
-        // Maple Street Dental". A greeting or a link before the colon isn't a name.
-        private val namedSender =
-            Regex(
-                "^[^\\p{L}\\p{N}]*(?!(?i:hi|hey|hello|dear|good|https?)(?![\\p{L}\\p{N}]))\\p{L}[\\p{L}\\p{N}&'’. -]{0,38}:" +
-                    "|(?i:this is)$SPACE+[\\p{L}'’. ]{1,30}$SPACE+(?i:from|at|with)$SPACE+\\p{Lu}",
-            )
+        // "Lakeside Family Clinic: your visit is...", "[Corner Market] your
+        // order..." or "this is Dana from Maple Street Dental". The colon has to
+        // be followed by a space, so "3:30", "https://" and "tel:" aren't names.
+        private val senderPrefix =
+            Regex("^[^\\p{L}\\p{N}\\[]*(?:\\[([^\\]\\n]{1,40})]|([\\p{L}\\p{N}][\\p{L}\\p{N}&'’.\\- ]{0,39}):(?:$SPACE|\$))")
+
+        // Each name word is its own run of letters, never spaces, so a long run
+        // of spaces after "this is" can't make the engine try every split.
+        private val senderIntroduction =
+            Regex("(?i:\\bthis is)$SPACE+(?:\\p{L}[\\p{L}'’.-]*$SPACE+){1,3}?(?i:from|at|with)$SPACE+\\p{Lu}")
+
+        private val nameWordSeparator = Regex("$SPACE+")
+
+        // Openers that start a notice or a greeting, not a business's name:
+        // "Alert:", "Valued customer:", "Hi Sam:", "Quick question:".
+        private val notANameOpener =
+            (
+                "hi hey hello hiya howdy yo greetings dear good valued customer member user client friend sir madam " +
+                    "alert notice warning urgent important attention final reminder update info notification action " +
+                    "security account message msg re fwd fw your our my the a congrats congratulations quick question " +
+                    "note ps http https www tel sms"
+            ).split(' ').toSet()
+
+        // Lowercase words a business name can carry: "Bank of America", "Smith & Sons".
+        private val nameConnectors = "of the and for at on de del la le du des da do y & + -".split(' ').toSet()
+
+        // A sender's name is a few capitalized words or digits ("Rosa's Kitchen",
+        // "Bank of America", "7-Eleven", "24 Hour Fitness") that doesn't open
+        // with a greeting or a notice word.
+        private fun looksLikeName(name: String): Boolean {
+            val words = name.split(nameWordSeparator).filter { it.isNotEmpty() }
+            if (words.isEmpty() || words.size > 5 || name.none { it.isLetter() }) return false
+            if (words.first().lowercase().trim { !it.isLetterOrDigit() } in notANameOpener) return false
+            return words.all { word -> word.lowercase() in nameConnectors || word.any { it.isUpperCase() || it.isDigit() } }
+        }
+
+        private fun namesItsSender(text: String): Boolean {
+            val prefix = senderPrefix.find(text)
+            val name = prefix?.let { it.groupValues[1].ifEmpty { it.groupValues[2] } }
+            return (name != null && looksLikeName(name)) || senderIntroduction.containsMatchIn(text)
+        }
 
         // Phone number in SMS body (common in callback scams)
         private val phoneInBody =
@@ -418,6 +452,19 @@ class SmsContentAnalyzer
                 reasons.add("disguised_text")
             }
 
+            // The signals scored below, worked out first so the footer decision
+            // can see every one of them.
+            val alphaChars = ruleText.filter { it.isLetter() }
+            val shouting = alphaChars.length > 10 && alphaChars.count { it.isUpperCase() }.toFloat() / alphaChars.length > 0.5f
+            val callback = phoneInBody.containsMatchIn(ruleText)
+            val specialRatio =
+                ruleText.count { !it.isLetterOrDigit() && !it.isWhitespace() }.toFloat() /
+                    ruleText.length.coerceAtLeast(1)
+            val specialHeavy = specialRatio > 0.15f && ruleText.length > 20
+            val shortWithUrl = visibleText.length < 50 && urls.isNotEmpty()
+            val replyBait = firstContact && SmsReplyBait.matches(ruleText, urls, visibleText.length)
+            val otherSignal = score > 0 || shouting || callback || specialHeavy || shortWithUrl || replyBait
+
             // Check spam keyword patterns
             var patternHits = 0
             val countPatternHit = {
@@ -433,44 +480,40 @@ class SmsContentAnalyzer
                 if (patternHits >= 3) break // Cap pattern contribution
                 if (pattern.containsMatchIn(ruleText)) countPatternHit()
             }
-            if (patternHits > 0 || !namedSender.containsMatchIn(ruleText)) {
+            if (patternHits > 0 || otherSignal || !namesItsSender(ruleText)) {
                 for (cue in responseCues) {
                     if (patternHits >= 3) break
                     if (cue.containsMatchIn(ruleText)) countPatternHit()
                 }
             }
 
             // All caps text (>50% of message) — shouting is a spam signal
-            val alphaChars = ruleText.filter { it.isLetter() }
-            if (alphaChars.length > 10 && alphaChars.count { it.isUpperCase() }.toFloat() / alphaChars.length > 0.5f) {
+            if (shouting) {
                 score += 15
                 reasons.add("excessive_caps")
             }
 
             // Contains phone number in body (callback scam) — regex is
             // case-insensitive so we match the original body instead of lowercasing.
-            if (phoneInBody.containsMatchIn(ruleText)) {
+            if (callback) {
                 score += 10
                 reasons.add("callback_number")
             }
 
             // Excessive special characters / emoji (common in spam)
-            val specialRatio =
-                ruleText.count { !it.isLetterOrDigit() && !it.isWhitespace() }.toFloat() /
-                    ruleText.length.coerceAtLeast(1)
-            if (specialRatio > 0.15f && ruleText.length > 20) {
+            if (specialHeavy) {
                 score += 10
                 reasons.add("special_chars")
             }
 
             // Very short message with URL (likely phishing). Counted without
             // invisible characters, which would otherwise pad it past the limit.
-            if (visibleText.length < 50 && urls.isNotEmpty()) {
+            if (shortWithUrl) {
                 score += 20
                 reasons.add("short_msg_with_url")
             }
 
-            if (firstContact && SmsReplyBait.matches(ruleText, urls, visibleText.length)) {
+            if (replyBait) {
                 score += REPLY_BAIT_SCORE
                 reasons.add("reply_bait")
             }
 
@@ -785,6 +785,77 @@ class SmsContentAnalyzerTest {
         assertEquals(listOf("spam_keywords"), footed.reasons)
     }
 
+    @Test
+    fun `any other signal brings a named sender's footer back`() {
+        // A brand name up front doesn't make a link or a callback lure safe.
+        listOf(
+            "USPS: your parcel is on hold. Reschedule at https://usps-parcel.top/r" to 70,
+            "Lakeside Clinic: confirm your visit at https://bit.ly/3xYz" to 75,
+            "CVS: YOUR PRESCRIPTION IS READY FOR PICKUP TODAY" to 55,
+            "Lakeside Clinic: call 800-555-0100 about your visit." to 50,
+        ).forEach { (lure, expected) ->
+            val footed = SmsContentAnalyzer.analyze("$lure Reply STOP to opt out.")
+            assertEquals(lure, expected, footed.score)
+            assertTrue(lure, "spam_keywords" in footed.reasons)
+        }
+    }
+
+    @Test
+    fun `a time, a link or a notice word before a colon doesn't name a sender`() {
+        listOf(
+            "Are you free Saturday at 3:30? Reply STOP to unsubscribe.",
+            // Capitalized and short, but the colon sits inside a time.
+            "Saturday 3:30 works for me? Reply STOP to unsubscribe.",
+            "Meet me at 5:30 by the fountain. Reply STOP to unsubscribe.",
+            "Look at these pics https://photos.example.com/abc Reply STOP to unsubscribe.",
+            "tel:8005551234 is our new line. Reply STOP to opt out.",
+            "Valued customer: we miss you. Reply STOP to unsubscribe.",
+            "Valued Customer: we miss you. Reply STOP to unsubscribe.",
+            "Hiya: long time no see! Reply STOP to unsubscribe.",
+            "Greetings: we have news for you. Reply STOP to unsubscribe.",
+            "Quick question: are you free this week? Reply STOP to unsubscribe.",
+            "Hi Sam: are you free this week? Reply STOP to unsubscribe.",
+            "[1/2] Hey, are you free? Reply STOP to unsubscribe.",
+            // A sentence isn't a name: lowercase words, or more than five.
+            "are you around tonight: text me back. Reply STOP to unsubscribe.",
+            "We Want You Back At The Gym: Reply STOP to unsubscribe.",
+        ).forEach { body ->
+            assertEquals(body, 40, SmsContentAnalyzer.analyze(body).score)
+        }
+        assertEquals(25, SmsContentAnalyzer.analyze("Alert: your parcel is waiting. Reply Y to confirm.").score)
+        assertEquals(25, SmsContentAnalyzer.analyze("Notice: your package is at the depot. Reply 1 for help.").score)
+    }
+
+    @Test
+    fun `a business named with digits, connectors or brackets is a sender`() {
+        listOf(
+            "7-Eleven: your order is ready for pickup. Reply STOP to opt out.",
+            "24 Hour Fitness: your class starts at 6 PM. Reply STOP to opt out.",
+            "Smith & Sons Plumbing: we're on our way. Reply STOP to opt out.",
+            "[Lakeside Clinic] Your visit is tomorrow at 9:00. Reply Y to confirm.",
+        ).forEach { body ->
+            assertEquals(body, 0, SmsContentAnalyzer.analyze(body).score)
+        }
+    }
+
+    @Test
+    fun `a long run of spaces can't stall the sender check`() {
+        // The first version of the "this is Dana from" rule let spaces sit
+        // inside and around the name, and 16,000 of them took over a minute.
+        listOf(
+            "this is" + " ".repeat(16_000) + "x",
+            "this is Dana" + " ".repeat(16_000) + "from",
+            "this is " + "a ".repeat(8_000),
+            "[" + " ".repeat(16_000),
+            "Lakeside" + " ".repeat(16_000) + ":",
+        ).forEach { body ->
+            val started = System.nanoTime()
+            SmsContentAnalyzer.analyze(body)
+            val millis = (System.nanoTime() - started) / 1_000_000
+            assertTrue("${body.take(12).trim()}... took $millis ms", millis < 2_000)
+        }
+    }
+
     @Test
     fun `interview and payslip texts stay clean`() {
         listOf(