Notes publish their disclosure labels to RAG — the note.rag.upsert payload carries the note's label (scope, scopeRefs, allowedMembers = participants and NAMED members, sensitivity and its level, confidential, teamMembersOnly, inherits, about, labelVersion 1) from NoteLabelResolver, and the new note.rag.label {action, noteId, orgId, label} carries a new one without the text; both leave only after the writer's transaction commits and read the label in a new read-only transaction, gated by RagPhiGa...