docs(kbn): file the -02a span audit of every held-until claim

Commissioned with -02a on the board ruling. Four findings: the -02
local-start hold is carried by eight files not five (AGENTS.md and
README.md among them, so -02a's completion surface is wider than its
record); a candidate defect of the same shape at -05, whose scope row
contains neither 'process-exec' nor 'LoadCredential' though three guides
condition deployment on that interface; a negative result confirming the
-00/-03/-05 activation hold spans correctly; and the structural hole that
makes all of them unverifiable, whose inverse form is the -05 rows naming
apps/gateway/Dockerfile, a path that does not exist.

Additive to section 10 only. No other item's rows altered; the Dockerfile
discrepancy is reported, not corrected — that row is -05's.

docs/native-kanban-sot/KBN-101-DB-ROLE-SPLIT.md

@@ -467,3 +467,62 @@ at GREEN, not carried forward as evidence.
 
 `-02a` neither breaks production-like entrypoints nor authorizes their local use. They resolve
 exactly as they do today when no local channel is active, and they remain held.
+
+### Span audit of every "held until \<item\>" claim
+
+Commissioned with `-02a` because the item exists to close one instance of this defect, and one
+instance is not evidence about the rest. A claim is defective when a guide conditions a hold on an
+item whose scope row and acceptance criteria do not contain the named capability — the item can
+land complete and the hold's stated condition still not be met.
+
+**Finding 1 — the `-02` local-start hold has a wider site surface than recorded.** The item record
+names five doc sites. The claim is actually carried by **eight files**, two of them repo-root and
+operator-facing:
+
+| File                                        | Lines         |
+| ------------------------------------------- | ------------- |
+| `AGENTS.md`                                 | 89            |
+| `README.md`                                 | 237, 255      |
+| `docs/guides/dev-guide.md`                  | 116, 136, 301 |
+| `docs/guides/deployment.md`                 | 21            |
+| `docs/PRD.md`                               | 1207          |
+| `docs/native-kanban-sot/SHARED-CONTRACT.md` | 34            |
+| `docs/federation/SETUP.md`                  | 34            |
+| `docs/guides/migrate-tier.md`               | 4, 61         |
+
+Consequence for `-02a`'s own completion: updating only the five recorded sites leaves at least
+three stale, including `AGENTS.md` and `README.md` — the two files an operator or a fresh agent
+seat reads first. A stale site does not merely lag; it re-asserts the hold `-02a` lifted and points
+at the wrong item.
+
+**Finding 2 — candidate defect of the same shape, at `-05`.** `SHARED-CONTRACT.md` §35, `PRD.md`
+§1209 and `dev-guide.md` §301 hold production deployment until "the KBN-101-05 renderer-backed
+process-exec or `LoadCredential` interface exists". In this contract, `process-exec` and
+`LoadCredential` occur four times — in `-02`'s row, `-07`'s docs row, and the documentation
+disposition rows, always as a _consumer boundary_ or an explicitly _non-executable schematic_.
+**`-05`'s own scope row contains neither term.** Its deliverables are the renderer plus the
+Compose/stack/image files, stated entirely in render-and-mount terms. Exec-time credential passing
+and rendering files into mounts are different mechanisms, not two descriptions of one. So `-05` can
+satisfy every criterion it has while that interface does not exist.
+
+Confidence is lower than for `-02`: `-05` genuinely owns the credential-delivery seam, so this may
+be an under-specified scope row rather than an absent owner. It is not provable from the criteria
+as written, and the disposition belongs to the integration gate, not to `-02a`.
+
+**Finding 3 — negative result, recorded because a one-sided audit is not an audit.** The
+PostgreSQL/federated activation hold spans correctly. External bootstrap resolves to `-00`'s
+exclusive `infra/pg-bootstrap/**` ownership; runner `--run`/`--verify` resolves to `-03`'s exact
+`mosaic-db-migrator --help|--run|--verify` contract; Gateway/Compose readiness resolves to `-05`'s
+Compose/stack ownership. Every named capability lands in a scope row that contains it.
+
+**Finding 4 — structural.** None of these claims is machine-checkable. Nothing links "capability
+named in a guide" to "capability present in an item's criteria", which is why the `-02` gap
+survived review at eight sites. The inverse form of the same hole is live in this document: the
+`-05` rows name `apps/gateway/Dockerfile`, which does not exist — the image source is
+`docker/gateway.Dockerfile`. An ownership row pointing at no file and a hold pointing at no
+criterion are one defect class, and both are green against every check currently run.
+
+Suggested control, for every lane rather than this one: a link check that resolves each
+`held until <ITEM>` claim to a scope row or AC containing the named capability, and each ownership
+row to a path that exists, failing CI on an unresolved claim. `-02a` does not implement it; the
+finding is filed for the integration gate.