[phoebus-84]

Atomic metadata patch, optional content CAS and transactional administrative audit

Refs #74 (non-closing workstream backlink).

Draft / dependencies: stacked on Zenflows #73 (feat/authz-processes), including #71/#72. SDK interfacerproject/interfacer-client#3 (on #2) and GUI interfacerproject/interfacer-gui#915 (on #914 → #913 → #912) are dependent. Normal released-SDK dependency update remains a gate; no merge/deployment authorized.

• Add patchEconomicResourceMetadata and read-only economicResource.metadataHash, retaining existing replacement/economic-event semantics.
• Authorize with existing resource.update under resource/control/membership locks, then merge current metadata. Accountable/contributor is not a grant; organization policy is unchanged.
• Optional SHA-256 content CAS, not a revision counter/control epoch. Object order irrelevant; ABA is not detected. Without CAS overlapping fields are last-committer-wins.
• Shallow field replacement; arrays/nested objects replace, null stores a value. No fabrication of physical process/events/quantity/custody/control.
• Extend the existing append-only zf_permission_log for the explicit administrative action resource.metadata.patch: actor/service/request from ExecutionContext, changed keys and before/after fingerprints, no raw metadata. Edit/audit in one transaction; invalid audit rolls back. Not reconstructible full content history or encryption.
• Harden existing JSON scalar rejection of unsupported primitive JSON roots (formerly CaseClauseError).

Validation / limitations

Application RED against the naïve compatibility read/replace implementation: 19 tests, 11 failures (including one fixture cleanup failure, subsequently corrected). Actual independent Postgres connections reproduced erased fields and ignored CAS; rollback/audit regressions failed. GREEN: 20 new tests, broader 296 authz tests passed. Production release Docker build passed.

Whole suite on reset synthetic TEST database only, seed 734057: 872 tests, 1 failure, 24 skipped. Baseline on equivalently reset test DB/same seed: 852 tests, the same classifications/1 nil failure, 24 skipped. Earlier dirty test DB runs had page/count failures from failed RED cleanup; cleanup fixed, reset performed; not omitted from logs. No sandbox demo DB reset. Prior intermittent page cursor failure is not declared fixed.

Compiled new SDK + real Zenroom WASM + signed sandbox API: Bob accountable/contributor denied; one mutation per patch; two same-token writers give one winner/one CONFLICT; independent fields both persist; actual GUI helper sends query + one patch, no process pipeline. Qty/custody/accountable/control/previous-event trace unchanged.

Two bounded Chromium desktop/mobile passes: first Alice driver locator incorrectly expected an anchor on a non-link ProjectDisplay; Bob readonly passed, no runtime errors. Corrected confirmation green for all four actor/viewport cases, real signed same-field race, localized conflict draft retention/no automatic retry, explicit retry/save/reload and no overflow. Remote requests blocked. This evidence is for the new relations metadata path, not a claim of all GUI E2E being green.

GUI currently reads the token immediately before saving: closes read/write race, does not reconcile an old draft with newer same-field edits. Content CAS is optional in the API; legacy replacement writers and existing SDK accept/modify partial-commit behavior remain unchanged. No automatic retry/fallback. No read-privacy/capabilities/organization redesign.

Details: docs/atomic-resource-metadata.md.