[Exim] ACL's, Routers and Transports

Newbie back again for some clarification, I'm just trying to understand the
order that events take place and my exim.conf is full of $%"*.

MUA or MTA knock on door 25 and says EHLO

acl_smtp_connect is run, if ok then MAIL command received
acl_smtp_mail is run, if ok then RCPT command received
acl_smtp_rcpt is run, if ok then DATA command received
acl_smtp_data is run, if ok then mail is received by Exim.

Received mail is processed by the routers, router determines which transport
to use, transport delivers message (either local or remote)

In my .conf I have

acl_smtp_rcpt = check_rcpt
acl_smtp_data = check_data
acl_smtp_etrn = check_etrn

av_scanner = cmdline:/etc/exim/scanner.sh %s:INFECTED:(.+)

does this mean that the scanner.sh is called after acl_smtp_etrn has run ?

At which point in this process does system_filter get run ? The books states
"runs right at the start of delivery, before the recipient addresses are
routed", but which part of this process is classed as "start of delivery"


thank you for your patience,

Graham