Phishing feed overhaul — signature_count is now excluded from the drift hash (node-local counter), preventing permanent cluster mismatches after feed updates. A dedicated Lua module (nmg_phishing_feeds.lua) replaces the built-in phishing handler to avoid namespace conflicts with rspamd internals. URL hits from phishing feeds now produce a sandbox symbol entry for traceability.
Cluster repair: ghost-delete fix — RepairDrift full-sync mode can now remove orphan rows from a peer node that were silently deleted on the local node without a replication event (ghost-delete). The full-sync mode is gated behind an explicit ?mode=full_sync query parameter to prevent accidental data loss.