Add confirmed audit reversals

docs/DESIGN_SYSTEM.md

@@ -222,6 +222,14 @@ Use the spacing tokens for new components. Prefer `8px`, `12px`, and `20px` gaps
   JSON snapshots. Search and category/action filters run before pagination.
   The Auditor role grants read-only `audit.view` access plus entry to ISAC;
   audit visibility never implies mutation, user-management, or game-data access.
+- Supported audit events may expose a permissioned compensating-action control.
+  Reversion uses a danger-styled `ATTEMPT REVERT` entry action followed by a
+  modal that explains the original action, operator, target, and conflict
+  checks. The orange Confirm action is the only submission path. ISAC compares
+  current state with the original event’s after-snapshot before restoring the
+  before-snapshot; newer work blocks the operation. Successful reversions append
+  a new `audit.reverted` event and never alter the original history. `audit.view`
+  remains read-only; `audit.revert` is independently assigned.
 - Account deletion uses a collapsed danger zone, explicit identity confirmation,
   and plain-language retention guidance. Soft-deleted accounts retain authored
   content under a deleted-agent identity while releasing credentials, usernames,