feat(notifications): alert oversight review queues

docs/DESIGN_SYSTEM.md

@@ -114,6 +114,21 @@ are always rendered as circular portraits with the restrained orange SHD ring
 used by the Agent Profile; the source image remains square and uses
 `object-fit: cover` so authenticated surfaces crop it consistently.
 
+When unread notifications exist on mobile, repeat the compact orange count on
+both the menu trigger and the Notifications destination. The trigger badge sits
+outside the upper-right control edge without changing the hamburger geometry.
+Its accessible name includes the full unread count; the visible badge is hidden
+from assistive technology to avoid announcing the count twice.
+
+Oversight reviewers receive a permission-aware cadence console inside
+Notification Preferences. Each available review queue is shown independently
+and uses the shared segmented radio pattern for Immediate, 15-minute, one-hour,
+or daily delivery. Do not expose categories the agent cannot review.
+Consolidated delivery groups queue items rather than issuing repeated messages;
+daily delivery targets 10:00 AM in `America/New_York` so the Eastern wall-clock
+time remains stable across daylight-saving transitions. On mobile, cadence
+segments wrap to two columns and each review category becomes its own row.
+
 Contact notifications use the mandatory ISAC visual identity because they are
 operational inbound messages. The notification carries a concise preview and a
 specific action to an authorization-checked full record. Full messages never

docs/architecture.md

@@ -321,3 +321,24 @@ time by the static `/missing-item-icon.svg` asset through the shared
 `ItemIcon` component; the placeholder is never inserted into
 `game_data_icons`. A later edit or proposal can attach the real icon without
 recreating or replacing the canonical item.
+# Oversight notification dispatch
+
+New Data Change and Avatar Oversight review items are routed only to agents who
+currently hold `data.approve` or `avatars.review` respectively. Each reviewer
+chooses Immediate, 15-minute, one-hour, or daily delivery independently for
+each authorized queue. Immediate alerts are created during submission;
+consolidated alerts are persisted in `oversight_notification_queue`.
+
+Production must run the idempotent dispatcher once per minute from exactly one
+scheduler instance:
+
+```text
+* * * * * cd /path/to/shd.build && npm run notifications:oversight:production
+```
+
+The dispatcher groups due rows by reviewer, queue, cadence, and delivery
+window. Daily rows are assigned to the next 10:00 AM wall-clock boundary in
+`America/New_York`, including daylight-saving transitions. Successfully
+dispatched rows retain `delivered_at` evidence and are never selected again.
+The existing ISAC notification delivery preferences still determine optional
+browser and email fan-out after the consolidated inbox message is created.