So I got Mail::Audit working. It's pretty nice. My biggest gripe is that there hasn't a release in over a year despite a growing bug list.
In the meantime some alternatives have appeared, like Mail::Procmail. It's documentation explains its differences with Mail::Audit.
I should also mention YAMPLE, which brings the process full circle, by creating a filter syntax based on Mail::Audit...that looks more like Procmail.
I also found, but elected not to try Mail::Query, which extends Mail::Audit with a more SQL like syntax. If my filtering needs became extensive, I might try that.
Simon Cozens, the Mail::Audit author, just sent me this in a reply to a Mail::Audit bug report:
I am not planning to release any more versions of Mail::Audit; it's pretty much done. There are significant bug reports, but not many significant bugs, and when a piece of software is mature, I'd rather not tinker with it too much. M::A does what I need it to do.
But, like cheese, there's "mature" and there's "stale". Further work will concentrate on Email::Filter, which is much better architectured and avoids some of the problems you mention.
[more time passes]
I tried out Email::Filter and it's OK-- a lot like Mail::Audit. I did quickly run into (and patch) a bug which lost e-email.