docs(ruling-4b): round-4 review fixes — rollback state predicate, join flow deferred

- §6.4 rollback witness now requires no state effect on rollback (create
  leaves no row; rename/transfer/visibility change leave prior values;
  delete/revoke leave the row present) alongside no event and no outbox
  record — all three REQ-AUD-001 legs; §6.9 cross-ref mirrors it.
- §2.8 no longer authorizes a join-request runtime surface: the
  see-and-ask-to-join flow (Ruling 4b decision 5) is deferred in its
  entirety to its follow-up contract, with §2.8's invariants pre-binding
  it; A2 §9.2 gains the matching express exclusion (that contract must
  amend A2's enumeration before any join-request surface exists).

docs/requirements/native-kanban-sot.md

@@ -497,13 +497,20 @@ itself permits, so that contract does not stretch A1 by interpretation.
 1. Content access stays grant-only under the RBAC grant model contract:
    directory listing discloses existence, never content, membership, or any
    authority (Ruling 3 unchanged; hierarchy schema §2.8).
-2. Visibility changes are hierarchy mutations on the existing §8.2.3 audited
+2. **No join-request surface is authorized.** Ruling 4b decision 5's
+   see-and-ask-to-join flow is a follow-up contract in its entirety —
+   including the ability to submit a request. A2 admits exactly the
+   read-only listing of §9.1.2 and nothing more; hierarchy schema §2.8
+   states the invariants that pre-bind the future flow contract, and that
+   contract must itself amend this enumeration before any join-request
+   runtime surface exists.
+3. Visibility changes are hierarchy mutations on the existing §8.2.3 audited
    mutation path — audited maintenance of the class's own structure in
    §8.1.3's sense, not a further runtime function. Authorization for them is
    defined in hierarchy schema §5.5 (platform admins plus the future
    company-CRUD capability; owner-as-such cannot publish).
-3. Company creation is unchanged and always yields `visibility = 'private'`
+4. Company creation is unchanged and always yields `visibility = 'private'`
    (onboarding wizard §5.2); this amendment adds no creation path and no
    default-open disclosure.
-4. Every other constraint of A1 — §8.1.2's remaining bullets, §8.2 in full,
+5. Every other constraint of A1 — §8.1.2's remaining bullets, §8.2 in full,
    and §8.3's other acceptance criteria — is untouched.