feat(isac): add oversight proposal corrections

docs/DESIGN_SYSTEM.md

@@ -224,9 +224,9 @@ Use the spacing tokens for new components. Prefer `8px`, `12px`, and `20px` gaps
   be textual and use the danger color; inactivity remains a separate activity
   classification rather than a punishment state.
 - Role names describe durable organizational responsibility. `Admin` is the
-  unrestricted administrative role; `Moderator` is reserved for community
-  content moderation and does not imply ISAC access. Operational ISAC access is
-  delegated separately through scoped roles and permissions.
+  unrestricted administrative role; `Community Oversight` is reserved for
+  community content moderation and does not imply ISAC access. Operational
+  ISAC access is delegated separately through scoped roles and permissions.
 - Roles & Permissions is a separate User Operations registry. Role definitions
   compose discrete capabilities through a dense permission catalogue with an
   explicit selected count and textual `GRANTED` / `NOT GRANTED` states. The
@@ -547,13 +547,28 @@ and other non-mutating inspection controls remain visible and interactive.
 
 The ISAC command-status cluster includes an explicit `DATA MODE` cell alongside
 system, access, and environment. It reports the highest effective data authority
-in this order: `ADMIN`, `DATA MANAGER`, `APPROVER`, `CONTRIBUTOR`, then
+in this order: `ADMIN`, `OVERSIGHT`, `DATA MANAGER`, `CONTRIBUTOR`, then
 `READ-ONLY`. Use a neutral treatment for read-only, orange for contributor,
-blue for approval authority, and green for direct-management authority. The
+blue for Oversight authority, and green for direct-management authority. The
 label and value are mandatory because color is supplemental. At medium widths
 the four cells become a two-column grid; on narrow screens the cluster spans
 the command header width.
 
+### Oversight proposal corrections
+
+User-facing references to moderators and data approvers use the SHD term
+`Oversight`. Distinguish `Community Oversight` from `Data Oversight` when a role
+name must identify its operational domain.
+
+Pending proposal review uses three equal decision controls: approve, correct,
+and reject. `CORRECT` is limited to small text or numeric fixes. Present the
+stored form fields in a compact two-column correction grid and identify their
+original field names; long descriptions and structured JSON values use
+textareas. Uploaded file evidence is visible but immutable. Every correction
+must be separately saved and audit logged before approval, and material changes
+should be rejected for contributor revision. Collapse the decision controls and
+correction fields to one column on narrow screens.
+
 Data-navigation links with pending proposals use a dedicated four-column layout:
 module code, flexible label, square orange count cell, then navigation arrow.
 Never insert a count into the ordinary three-column link without changing its

docs/architecture.md

@@ -113,7 +113,7 @@ mutation rather than deletion or modification of the original event:
 ISAC data access is split into `data.view`, `data.propose`, `data.manage`, and
 `data.approve`. Data Viewers can inspect registries. Data Contributors can submit
 the same editor forms, but the request is serialized into `data_change_proposals`
-instead of mutating canonical tables. Data Approvers review the queue and must
+instead of mutating canonical tables. Data Oversight reviews the queue and must
 explicitly confirm approval or rejection.
 
 Approval replays the stored form through its original SvelteKit server action.
@@ -124,8 +124,8 @@ proposal as failed without changing live data. Pending counts appear alongside
 each data registry in ISAC so collaborators can see concurrent suggestions.
 
 The protected seeded roles are Data Viewer, Data Contributor, Data Editor, and
-Data Approver. Data Editor retains direct-write access for trusted operators;
-Data Approver combines direct-write access with queue review. New ISAC data
+Data Oversight. Data Editor retains direct-write access for trusted operators;
+Data Oversight combines direct-write access with queue review. New ISAC data
 modules must use the shared moderation interception path and audit both the final
 mutation and proposal lifecycle.