feat(isac): add moderated data contributions

docs/DESIGN_SYSTEM.md

@@ -503,3 +503,13 @@ All image uploads use the shared SHD drop-zone treatment and expose three equiva
 selection paths: a file picker, drag and drop, and clipboard paste. The control shows
 the selected filename and a local preview, but server-side format, size, transparency,
 and normalization checks remain authoritative.
+
+### Moderated data states
+
+ISAC must clearly distinguish direct editing, contributor proposals, and read-only
+access. Use a compact access banner above the module rather than changing the
+registry layout. Pending proposal counts appear as orange numeric indicators in
+data-navigation items. Proposal lifecycle states use text as well as color:
+pending is orange/actionable, approved is green/configured, and rejected or
+failed is red/archived. Review decisions always use the standard ISAC confirmation
+surface and must never apply a proposal from a table-row click alone.

docs/architecture.md

@@ -107,6 +107,27 @@ mutation rather than deletion or modification of the original event:
    administrative access.
 6. The server restores the previous state and appends an `audit.reverted` event
    whose target is the original audit-event ID.
+
+# Moderated game-data contributions
+
+ISAC data access is split into `data.view`, `data.propose`, `data.manage`, and
+`data.approve`. Data Viewers can inspect registries. Data Contributors can submit
+the same editor forms, but the request is serialized into `data_change_proposals`
+instead of mutating canonical tables. Data Approvers review the queue and must
+explicitly confirm approval or rejection.
+
+Approval replays the stored form through its original SvelteKit server action.
+This preserves canonical validation, relational updates, icon processing, and the
+normal game-data audit event. Proposal creation and review decisions also produce
+separate `data_moderation` audit events. Failed canonical validation marks a
+proposal as failed without changing live data. Pending counts appear alongside
+each data registry in ISAC so collaborators can see concurrent suggestions.
+
+The protected seeded roles are Data Viewer, Data Contributor, Data Editor, and
+Data Approver. Data Editor retains direct-write access for trusted operators;
+Data Approver combines direct-write access with queue review. New ISAC data
+modules must use the shared moderation interception path and audit both the final
+mutation and proposal lifecycle.
 7. A successfully reverted event cannot be reverted again.
 
 Unsupported destructive identity operations, account deletion, incomplete