Data contract: elected moderation team declaration with frozen election parameters and interim mode (moderation teams B1)

[QuantumExplorer]

Part of #4865 (decentralized moderation teams). Item B1 of the PR split. Wave 1: no dependency, can start now.

Summary

A data contract can declare that its moderators are an elected team: a third ContractModerators variant carrying the frozen election parameters, the moderated document types, the charter envelope, the interim mode and the owner protection flag. Until a team is seated the contract is moderated by its interim moderators. No election exists yet in this PR.

Decisions implemented: D3, D5, D6, D7, D8, D17, D18, D20, D25, D47, D62, D64 in #4865. D63 was dropped in round 9 (2026-09-22): no charter fee maximums.

Current behaviour

ContractModerators in packages/rs-dpp/src/data_contract/config/moderation/mod.rs has ContractOwner and AppointedModerators(BTreeSet<Identifier>). team() returns the claimants of the moderators pot. #4830 already refuses enabling moderation on a contract update.

Scope

• ContractModerators::Elected (or an equivalent name), declarable only at contract creation (D7), never removable by update. Fields:
  • join window and vote window, seconds as u32, 1 day to 4 weeks, default 1 week (D8);
  • challenge cool-down x, 2 weeks to 3 years (D4, D8);
  • the moderated set of document type names (D25); a type in the set need not be flagged canBeDeletedByModerators, deletes reach only the flagged ones (D47);
  • the abilities a charter may claim on each moderated type, non-empty per type (D62, refined 2026-09-21);
  • no fee maximums (D63 dropped 2026-09-22): a type's own actionFees.moderators amount is the most a team may charge on its actions and a charter charges a share of it; owner pot amounts stay in the action fee schedule and stay immutable (D64);
  • the interim mode: owner moderates, an appointed set moderates, or the moderated types are not yet usable, or noModeration (added 2026-09-22: nobody moderates and nobody claims the pot until a team is seated, the moderated types stay usable) (D6, D17);
  • whether the owner is protected from moderation in elected mode, default not protected (D20).
• Bounds in SystemLimits, platform version last in parameter lists, meta-schema and JSON wire shape in the style of the existing variants, docs in the book's moderation chapter.
• Interim behaviour in the batch gate: in elected mode with no seated team, the interim moderators are team(), and "not yet usable" refuses document transitions of the moderated set (D18). Interim moderators claim the pot as today (D19).
• Contract update validation: every field of the declaration is frozen (D8).

Out of scope

• The seated team and its gate (H1), the election (H2), charter-priced amounts (F2).

Tests

• Create accepted at every bound and refused one outside each bound.
• Update refused for each field change and for switching in or out of elected mode.
• Interim: owner-only, appointed set, and not-yet-usable, the last refusing a create of a moderated type and accepting one of an unmoderated type.
• The moderated set may name a type that is not deletable; a declaration naming an unknown type is refused.

Coordination

The warn PR (D) and H1 also touch the moderation config module. Keep the variant additive.

[QuantumExplorer]

Implemented in #4886. Three design changes came out of its review (recorded as round 9 in #4865):

• abilities are declared per moderated document type, non-empty per type (D62 refined);
• no charter fee maximums in the declaration: a type's actionFees.moderators amount is the ceiling and a charter charges a share of it (D63 dropped, D64 kept);
• a fourth interim kind, noModeration: nobody moderates and nobody claims the pot until a team is seated, but the moderated types stay usable (D6/D17/D18 extended).

The scope bullets above are updated to match.