fix: Phase 2-3 DB isolation + Gate 3 data layer real connection (AGENTS.md v16.0)

**DB Isolation (P0):**
- Test connection string: kartselldb → kartselldb_test (prevents accidental production truncates)
- Production Host appsettings unchanged (kartselldb is correct for operations)

**Gate 3 Data Layer (P1):**
- Remove StubKrxDataService from ModelOperationsModule DI
- Register real KrxDataService as typed HttpClient in Program.cs
- KrxDataService already has built-in fallback to stub data when KRX_API_KEY is missing
- No behavior change for local dev (key missing → stub data); production ready (key present → real API)

**Tech Debt Registration (AGENTS.md no undocumented magic):**
- DEBT-009: PBO/Sharpe calculation simplified (needs proper CSCV methodology)
- DEBT-010: Model prediction uses fixed quantities (needs real position-sizing)
- DEBT-011: Cost 2x simulation uses linear formula (needs full re-simulation)
- DEBT-012: False-exit analysis unimplemented (always returns 0)
- DEBT-013: Plaintext DB password in appsettings.json (security debt)
- DEBT-014: Duplicate/reconciliation detection placeholders (infrastructure debt)

Gate 3 marked "rehearsal ready" (real KRX data, simplified analytics).
See TECH_DEBT_REGISTER.md for full impact/effort estimates.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

TECH_DEBT_REGISTER.md

@@ -8,7 +8,7 @@
 
 | Status | Count | Total Impact |
 |--------|-------|--------------|
-| Backlog | 0 | 0 pts |
+| Backlog | 6 | 12 pts |
 | In Progress | 0 | 0 pts |
 | Completed | 1 | 1 pt |
 | No Action | 1 | 1 pt |
@@ -30,6 +30,17 @@
 | DEBT-005 | CA1861 (array overhead) | Low (1) | Low (1) | Deferred | Static readonly array allocations. Negligible perf; accept trade-off for readability. Revisit if conditions change. | @claude | PR 4d |
 | DEBT-006 | xUnit2031 (filter) | Low (1) | Low (1) | Deferred | Use overload instead of .Where() for Assert.Single. Analyzer nit; defer. Revisit if conditions change. | @claude | PR 4d |
 
+### Gate 3 Simplified Analytics (Deferred per v16.0)
+
+| ID | Category | Impact | Effort | Status | Notes | Owner | ADR |
+|----|----------|--------|--------|--------|-------|-------|-----|
+| DEBT-009 | PBO/Sharpe calculation | High (3) | High (3) | Backlog | MetricsCalculator.cs:148,170 use simplified percentile formulas. Need proper CSCV-based PBO and DSR methodology. Required for production Sharpe baseline. Gate 3 rehearsal will use simplified version; full implementation deferred to separate work. | @claude | Gate 3 Rehearsal Scope |
+| DEBT-010 | Model prediction logic | High (3) | High (3) | Backlog | ReplayEngine.cs:90,163 predict fixed quantities (100 units). Need actual position-sizing algorithm. Required for realistic cost simulation. Gate 3 uses fixed quantities; full implementation deferred. | @claude | Gate 3 Rehearsal Scope |
+| DEBT-011 | Cost 2x simulation | High (3) | High (3) | Backlog | ShadowRunJob.cs:132 uses linear approximation (TotalReturn * 0.5m). Need full re-simulation with actual fee/slippage impact. Required for realistic scenario analysis. Gate 3 uses linear model; full implementation deferred. | @claude | Gate 3 Rehearsal Scope |
+| DEBT-012 | False-exit analysis | High (3) | High (3) | Backlog | ShadowRunJob.cs:136-139, FalseExitAnalyzer.cs always returns 0. Unimplemented feature. Required for accurate sell-reason attribution. Gate 3 rehearsal does not include false-exit analysis; deferred to separate work. | @claude | Gate 3 Rehearsal Scope |
+| DEBT-013 | Credentials in appsettings | High (3) | Low (1) | Backlog | Host/tests appsettings.json contains plaintext DB password (kartsell4321@!). Must migrate to Gitea Actions Secrets and environment variables. Security compliance required. | @claude | Security / Ops |
+| DEBT-014 | Duplicate & reconciliation tracking | Medium (2) | Medium (2) | Backlog | MetricsSql.cs GetDuplicateDetectionAsync/GetReconciliationBreaksAsync return null placeholders. Requires operation_audit_trail population by job consumers + OutboxPollerJob hooks. Non-blocking; dashboard degrades gracefully. | @claude | Observability Enhancement |
+
 ### Deferred Refactoring
 
 | ID | Category | Impact | Effort | Status | Notes | Owner | ADR |

src/KArtSell.Host/Features/Observability/MetricsSql.cs

@@ -71,24 +71,27 @@ public class MetricsSql
 
     public async Task<(int Detected, int Resolved, DateTime LastCheck)?> GetDuplicateDetectionAsync(CancellationToken cancellationToken = default)
     {
-        // Placeholder: outbox duplicate detection (table not yet in migrations)
-        // Returns null until outbox-duplicate-detection feature is implemented
+        // Placeholder: building_blocks.outbox_message table exists (0000_building_blocks.sql).
+        // Duplicate detection logging (via operation_audit_trail or dedicated table) not yet implemented.
+        // Returns null until OutboxPollerJob hooks duplicate tracking (see DEBT-014).
         await Task.CompletedTask;  // Async compliance
         return null;
     }
 
     public async Task<(int Detected, int Resolved, List<string> Pending)?> GetReconciliationBreaksAsync(CancellationToken cancellationToken = default)
     {
-        // Placeholder: Reconciliation break detection requires outbox/inbox log correlation
-        // Returns null until full audit trail correlation is implemented
+        // Placeholder: Reconciliation break detection requires outbox/inbox log correlation.
+        // Requires audit trail showing Evidence version mismatches. Not yet implemented.
+        // Returns null until operation_audit_trail is populated by job consumers (see DEBT-014).
         await Task.CompletedTask;  // Async compliance
         return null;
     }
 
     public async Task<(decimal Baseline, decimal Current)?> GetModelDriftAsync(CancellationToken cancellationToken = default)
     {
-        // Placeholder: Model drift calculation requires baseline comparison from shadow_run metrics
-        // Returns null until full OOS metrics are integrated from model_operations.shadow_run
+        // Placeholder: Model drift calculation requires baseline/current sharpe comparison from shadow_run results.
+        // Returns null until Gate 3 rehearsal populates model_operations.shadow_run with real metrics.
+        // Once shadow_run results exist, baseline/current sharpe can be calculated and compared (see DEBT-009).
         await Task.CompletedTask;  // Async compliance
         return null;
     }

src/KArtSell.Host/Program.cs

@@ -117,6 +117,11 @@ builder.Services.AddSingleton<RateLimiterService>();
 builder.Services.AddSingleton<CircuitBreakerPolicyFactory>();
 builder.Services.AddHttpClient<ResilientHttpClient>();
 
+// KRX Data Service (real API, with KRX_API_KEY; fallback to stub data if key missing)
+builder.Services.AddHttpClient<KArtSell.Modules.ModelOperations.ShadowRun.Services.KrxDataService>();
+builder.Services.AddScoped<KArtSell.Modules.ModelOperations.ShadowRun.IKrxDataService>(sp =>
+    sp.GetRequiredService<KArtSell.Modules.ModelOperations.ShadowRun.Services.KrxDataService>());
+
 // Observability Metrics
 builder.Services.AddScoped<MetricsPolicy>();
 builder.Services.AddScoped<MetricsSql>();

src/KArtSell.Modules.ModelOperations/ModelOperationsModule.cs

@@ -17,7 +17,7 @@ public static class ModelOperationsModule
         services.AddScoped<IModelOperationRequestRepository, DapperModelOperationRequestRepository>();
         services.AddScoped<IModelOperationRequestService, ModelOperationRequestService>();
         services.AddSingleton<IMarketCalendarService, MarketCalendarService>();
-        services.AddScoped<IKrxDataService, StubKrxDataService>();
+        // KrxDataService registered in Host.Program.cs as typed HttpClient
         services.AddScoped<IObservabilityService, StubObservabilityService>();
         return services;
     }

tests/KArtSell.Integration.Tests/appsettings.Development.json

@@ -1,5 +1,5 @@
 {
   "ConnectionStrings": {
-    "Postgres": "Host=127.0.0.1;Port=5432;Database=kartselldb;Username=kartsell;Password=kartsell4321@!"
+    "Postgres": "Host=127.0.0.1;Port=5432;Database=kartselldb_test;Username=kartsell;Password=kartsell4321@!"
   }
 }