The provenance display gate — a reader who is not a note's owner sees its LEARNED_FROM and DERIVED_FROM links only for sources they are cleared for (participant or owner, existing access, the management chain), every other one of a relation collapses into one restricted placeholder, and an unresolvable or unavailable source is restricted, never an error; labels from the six owners through KBService's DisclosureLabelClient, cached 60 s per (org, ref); applied after the service returns on every no...