# Stage 09: Account-Scoped Repository Boundaries

Date: 2026-07-29

## Result

- Added narrow repository ports for alerts, the trade journal, and strategy tracking.
- Added SQLite adapters that expose only the persistence operations each service requires.
- Required a positive account owner on every private read, write, update, and delete path.
- Kept the shared automatic screener-run lookup explicit as the sole zero-owner read in the
  strategy tracking adapter.
- Routed the application container through a repository bundle.
- Removed direct alert and trade deletion/update calls from the HTTP-facing dashboard service.
- Preserved structural compatibility for isolated tests and gradual extraction from the legacy
  database facade.

## Boundary

Application services depend on repository protocols. The SQLite implementation may later be
replaced without changing those services. Repository adapters do not call market providers,
and provider adapters do not access user tables.

## Residual Migration

The legacy `ReviewDatabase` still contains the SQL behind these adapters and remains the
compatibility facade for features not yet extracted. Subsequent feature stages can move SQL
behind the same ports one feature at a time after account-isolation tests pass.
