feat(isac): add oversight proposal corrections

docs/DESIGN_SYSTEM.md

@@ -224,9 +224,9 @@ Use the spacing tokens for new components. Prefer `8px`, `12px`, and `20px` gaps
   be textual and use the danger color; inactivity remains a separate activity
   classification rather than a punishment state.
 - Role names describe durable organizational responsibility. `Admin` is the
-  unrestricted administrative role; `Moderator` is reserved for community
-  content moderation and does not imply ISAC access. Operational ISAC access is
-  delegated separately through scoped roles and permissions.
+  unrestricted administrative role; `Community Oversight` is reserved for
+  community content moderation and does not imply ISAC access. Operational
+  ISAC access is delegated separately through scoped roles and permissions.
 - Roles & Permissions is a separate User Operations registry. Role definitions
   compose discrete capabilities through a dense permission catalogue with an
   explicit selected count and textual `GRANTED` / `NOT GRANTED` states. The
@@ -547,13 +547,28 @@ and other non-mutating inspection controls remain visible and interactive.
 
 The ISAC command-status cluster includes an explicit `DATA MODE` cell alongside
 system, access, and environment. It reports the highest effective data authority
-in this order: `ADMIN`, `DATA MANAGER`, `APPROVER`, `CONTRIBUTOR`, then
+in this order: `ADMIN`, `OVERSIGHT`, `DATA MANAGER`, `CONTRIBUTOR`, then
 `READ-ONLY`. Use a neutral treatment for read-only, orange for contributor,
-blue for approval authority, and green for direct-management authority. The
+blue for Oversight authority, and green for direct-management authority. The
 label and value are mandatory because color is supplemental. At medium widths
 the four cells become a two-column grid; on narrow screens the cluster spans
 the command header width.
 
+### Oversight proposal corrections
+
+User-facing references to moderators and data approvers use the SHD term
+`Oversight`. Distinguish `Community Oversight` from `Data Oversight` when a role
+name must identify its operational domain.
+
+Pending proposal review uses three equal decision controls: approve, correct,
+and reject. `CORRECT` is limited to small text or numeric fixes. Present the
+stored form fields in a compact two-column correction grid and identify their
+original field names; long descriptions and structured JSON values use
+textareas. Uploaded file evidence is visible but immutable. Every correction
+must be separately saved and audit logged before approval, and material changes
+should be rejected for contributor revision. Collapse the decision controls and
+correction fields to one column on narrow screens.
+
 Data-navigation links with pending proposals use a dedicated four-column layout:
 module code, flexible label, square orange count cell, then navigation arrow.
 Never insert a count into the ordinary three-column link without changing its