diff --git a/TECH_DEBT_REGISTER.md b/TECH_DEBT_REGISTER.md
index 7d81d266..913cc43c 100644
--- a/TECH_DEBT_REGISTER.md
+++ b/TECH_DEBT_REGISTER.md
@@ -8,11 +8,11 @@
 
 | Status | Count | Total Impact |
 |--------|-------|--------------|
-| Backlog | 7 | 14 pts |
+| Backlog | 6 | 11 pts |
 | In Progress | 0 | 0 pts |
 | Completed | 1 | 1 pt |
 | No Action | 1 | 1 pt |
-| Deferred | 4 | 4 pts |
+| Deferred | 5 | 7 pts |
 | Accepted | 1 | 2 pts |
 
 ---
@@ -38,7 +38,7 @@
 | DEBT-010 | Model prediction logic | High (3) | High (3) | Backlog | ReplayEngine.cs:90,163 predict fixed quantities (100 units). Need actual position-sizing algorithm. Required for realistic cost simulation. Gate 3 uses fixed quantities; full implementation deferred. | @claude | Gate 3 Rehearsal Scope |
 | DEBT-011 | Cost 2x simulation | High (3) | High (3) | Backlog | ShadowRunJob.cs:132 uses linear approximation (TotalReturn * 0.5m). Need full re-simulation with actual fee/slippage impact. Required for realistic scenario analysis. Gate 3 uses linear model; full implementation deferred. | @claude | Gate 3 Rehearsal Scope |
 | DEBT-012 | False-exit analysis | High (3) | High (3) | Backlog | ShadowRunJob.cs:136-139, FalseExitAnalyzer.cs always returns 0. Unimplemented feature. Required for accurate sell-reason attribution. Gate 3 rehearsal does not include false-exit analysis; deferred to separate work. | @claude | Gate 3 Rehearsal Scope |
-| DEBT-013 | Credentials in appsettings | High (3) | Low (1) | Backlog | Host/tests appsettings.json contains plaintext DB password (kartsell4321@!). Must migrate to Gitea Actions Secrets and environment variables. Security compliance required. | @claude | Security / Ops |
+| DEBT-013 | Credentials in appsettings | High (3) | Low (1) | Deferred | Host/tests appsettings.json contains plaintext DB password. Deferred: not in v16.0 scope. Revisit if security compliance requirements change. | @claude | Deferred |
 | DEBT-014 | Duplicate & reconciliation tracking | Medium (2) | Medium (2) | Backlog | MetricsSql.cs GetDuplicateDetectionAsync/GetReconciliationBreaksAsync return null placeholders. Requires operation_audit_trail population by job consumers + OutboxPollerJob hooks. Non-blocking; dashboard degrades gracefully. | @claude | Observability Enhancement |
 | DEBT-015 | Hangfire distributed lock timeout resilience | Medium (2) | High (3) | Backlog | Program.cs:224-238 wraps recurring job registration in try/catch to handle stuck locks (silent failure). Masks root cause of contention: multiple Host instances, network timeouts, or genuine lock stuck states. Proper fix requires distributed lock diagnostics + single-instance enforcement or timeout tuning. | @claude | Host Reliability |