Matthew,
I got the restrict handling / no XEP 258 label choice handling wrong in my
reply to you. I forgot that we added the ability for catalogs to contain empty
items.
An empty item effective says to the client, when you offer a choice of no XEP
258 label, use this selector.
An item may have no security label. Such an item [explicitly] offers a
choice of sending a stanza without a label.
But when restrict is set, the absence of an empty item means don't offer a
choice of no XEP 258 label. Looks like a small clarification is needed.
Does that make sense?