An override `{"PII": {"rules": []}}` passes `Validate` (internal/core/rules/rules.go) and injects a heading-only `## PII` block — suppression wearing the domain's name, which the agent reads as a domain that says nothing; a custom domain declared with recall but no rules does the same. Reproduced at v0.7.0 (a 43-byte block, exit 0). The documented way to silence a domain is `{"state": "dormant"}`; a domain whose merged rules are empty should not render at all, and the loader should say which domain it dropped and name the dormant remedy, in line with the empty-rule-body refusal (iss-2608261550497978). Sibling of GHSA-22f8-qf5r-gjgq.

An override {"PII": {"rules": []}} passes Validate (internal/core/rules/rules.go) and injects a heading-only ## PII block — suppression wearing the domain's name, which the agent reads as a domain that says nothing; a custom domain declared with recall but no rules does the same. Reproduced at v0.7.0 (a 43-byte block, exit 0). The documented way to silence a domain is {"state": "dormant"}; a domain whose merged rules are empty should not render at all, and the loader should say which domain it dropped and name the dormant remedy, in line with the empty-rule-body refusal (iss-2608261550497978). Sibling of GHSA-22f8-qf5r-gjgq.

Grounds

• pursued: the heading-only block must not render, and the drop must be loud — a domain that silently stops existing is the same suppression-nobody-sees the fix is about
• declined: refusing the whole file, the shape the empty-rule-body refusal (iss-2608261550497978) set. That refusal is on a rule BODY inside an otherwise loadable domain; this one would take every other domain down with it, on an upgrade, for a config that worked yesterday. Validate keeps the refusal where it guards abcd's own bundled defaults