surface-grant-client-metadata

The Standing dashboard answers "who can read parts of me?" and "what has been read?" by summarizing ref/grants and ref/traces. Those summaries can carry only clientid, so live rows can render as raw cli... identifiers even when the reference server has registered client metadata. That is honest but below the owner-comprehension bar.

/ref/grants and /ref/traces are operator-console summaries over disclosure-spine correlations. They are reference-only, but they are the substrate for the dashboard's relationship and recent-read views. The owner needs a human-recognizable client label when the server has one, and the raw client_id must remain visible because client names are client-authored metadata, not independent proof of identity.

Debugging, replay, trace, and operator-control surfaces that are useful for the reference implementation but are not part of core PDPP SHALL be explicitly marked as reference-only.