feat: refine ISAC design and prepare production deployment

docs/DESIGN_SYSTEM.md

@@ -202,6 +202,9 @@ The canonical tokens live in `src/app.css` under `:root`.
 | Main text | `--shd-text` | `#ecebe5` |
 | Muted text | `--shd-text-muted` | `#858b8d` |
 | SHD action orange | `--shd-orange` | `#f6a821` |
+| Telemetry text floor | `--shd-type-telemetry` | `12px` |
+| Supporting copy floor | `--shd-type-supporting` | `14px` |
+| Ordinary body floor | `--shd-type-body` | `16px` |
 | Adaptive display scale | `--shd-display-scale` | `1` by default; stepped on high-resolution desktops |
 
 ### High-resolution display scaling
@@ -228,11 +231,31 @@ Use the spacing tokens for new components. Prefer `8px`, `12px`, and `20px` gaps
 
 ## Typography
 
-- The current UI stack is `Arial, Helvetica, sans-serif`.
+SHD.build self-hosts two intentional type voices through Fontsource packages:
+
+- **Barlow** is the operational family for display headings, navigation,
+  controls, data, labels, metadata, and general interface copy. Use the shared
+  `--shd-font-sans` token instead of declaring local sans-serif stacks.
+- **Source Serif 4** is the editorial family for explanations, introductions,
+  guide-like prose, and longer descriptive passages. Use
+  `--shd-font-editorial`; do not apply it to controls, tables, metrics, or
+  telemetry labels.
+
+Only the used Barlow weights (400, 600, 700, 800, and 900) and Source Serif 4
+weights (400 and 600) are loaded. Both families are self-hosted, preserve
+fallback stacks, and render immediately without a third-party font request.
+The two-voice rule remains semantic: Barlow operates the system; Source Serif 4
+explains it.
+
 - Page and module headings are uppercase, heavy, and tightly spaced.
-- Eyebrows and table labels use 7–10px text with 1–2px letter spacing.
-- Body and form text should normally remain between 9–12px in dashboards.
-- Public/editorial copy may use Georgia for a restrained field-manual character.
+- Short operational labels, metadata, statuses, and compact actions use the
+  shared 12px telemetry floor. Their tracking must not exceed `0.1em`.
+- Supporting descriptions use at least 14px with normal tracking. Ordinary
+  body and form copy uses the 16px body floor.
+- High-resolution workspace scaling never justifies smaller source sizes:
+  density comes from spacing, connected borders, tone, and weight.
+- Public/editorial copy uses Source Serif 4 for its restrained field-manual
+  character and stays within a 45–75 character reading measure.
 - Never use low-contrast tiny text for information required to complete a task.
 
 ## Layout patterns
@@ -390,6 +413,11 @@ squeezed beside long module headings on mobile.
 - The administrative system is named ISAC. Separate navigation into explicit
   operational domains such as User Operations and Data Management; visibility
   must reflect server-provided capabilities.
+- ISAC module navigation uses complete, game-facing names such as `Weapons`,
+  `Talents`, and `OS Protocols`. Do not expose internal abbreviations such as
+  `WPN`, `TLNT`, or `OSPR`. Canonical game icons may supplement visible labels
+  inside module content and editor controls, but the navigation rail must not
+  invent iconography merely to replace clear language.
 - User Operations shows every supported authentication method as operational
   metadata: local credentials, verified email, passkeys, Discord, and planned
   providers. Identity-removal controls require `users.identities`, create audit
@@ -1472,3 +1500,42 @@ selection changes, and background refreshes. Toasts automatically dismiss
 according to severity, remain keyboard dismissible, use `status` or `alert`
 semantics, and disable entrance motion with reduced motion. On mobile they span
 the safe viewport width below the header without obscuring navigation.
+
+### ISAC progressive disclosure
+
+The ISAC rail shows every module the current operator is authorized to access,
+but groups modules behind collapsible operational categories. The category
+containing the current route opens on first use; subsequent open and closed
+choices are remembered locally for that browser. Searching the rail temporarily
+reveals matching modules across all authorized categories without changing the
+remembered category state.
+
+Use the compact command-status strip for persistent system, access, environment,
+and data-mode context. These values remain textual and must not rely on color
+alone. Registry search remains available for a single page of results, while
+page navigation and row-count controls appear only when the result set spans
+multiple pages. This keeps expert lookup fast without presenting inactive
+controls to contributors and first-time Oversight operators.
+
+Sidebar category headers are real buttons with `aria-expanded` and controlled
+navigation regions. Search fields have visible or accessible labels, keyboard
+focus uses Signal Orange, and collapsed state must remain understandable
+without motion.
+
+### ISAC mutation consequence
+
+Every writable game-data module states what Save will do before the operator
+opens an editor, and the statement remains visible while the editor is open.
+The message is derived from effective permissions rather than copied into each
+module:
+
+- `OVERSIGHT REVIEW` means saving creates a proposal and does not change live
+  data until Oversight approves it.
+- `DIRECT PUBLISH` means the change becomes live immediately and creates an
+  append-only audit event.
+
+Pair the short state label with a complete consequence sentence. Contributors
+must not have to infer this behavior from their role name, data-mode color, or a
+success message shown after saving. Read-only operators do not see a mutation
+statement because their mutation controls are absent. At narrow widths the
+message becomes its own compact row above the module toolbar.