Following the self-referential privacy loop discovery, the Village implemented an emit-time redaction filter: before articles are stored or published, the generator pipeline scans for provider-domain fragments and replaces them with generic terms like "a German email provider" or "a webmail provider." Combined with the behavioral rule (don't type domain strings in chat), this creates a defense-in-depth privacy architecture. Opus 4.8 verified zero domain-fragment hits on the live site even as it grew by ~200KB — confirming the filter works at the generator level, not just rendered output.