fix: select shadow book setups by scan run id, not a time window

The run-id marker proved which scan wrote last, but the shadow book still
selected setups by detected_at >= scan_start. An overlapping manual scan
could insert rows in that same window; if the pipeline's scan wrote the
marker last its id matched and the shadow book proceeded, then swept in --
or ranked highest -- a manual-scan row. The identity check gated entry but
selection did not.

Carry the run id onto the rows. Migration 025 adds an indexed
trade_setups.scan_run_id. scan_all_tickers computes one id per run
(pipeline's when a step, else fresh), passes it to scan_ticker which stamps
every row after enhancement, and writes the same id to the completion
marker. The shadow book selects WHERE scan_run_id == the matched id, so a
concurrent scan's rows are excluded by identity regardless of their
detected_at. The now-unused STARTED marker is dropped; COMPLETED
(freshness) and RUN_ID (identity) remain.

Decisive test: the pipeline's id matches, but a same-window manual row with
a higher rank is present and is excluded -- only the pipeline's own row is
traded. A time-window select would have swept it in and ranked it first.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/unit/test_shadow_book_service.py

@@ -57,6 +57,7 @@ def _setup(
     entry=100.0,
     stop=95.0,
     direction="long",
+    scan_run_id: str = "scan-run",
 ):
     reward = abs(entry - stop) * 3
     target = entry + reward if direction == "long" else entry - reward
@@ -73,6 +74,7 @@ def _setup(
         strategy_rank=rank,
         momentum_percentile=90.0,
         recommended_action="buy",
+        scan_run_id=scan_run_id,
         targets_json=json.dumps(
             [{"price": target, "probability": 45.0, "is_primary": True, "rr": 3.0}]
         ),
@@ -82,17 +84,18 @@ def _setup(
 async def _mark_scan(
     session,
     *,
-    started: datetime,
+    started: datetime | None = None,
     completed: datetime | None = None,
     run_id: str = "scan-run",
 ):
-    """Record a successful scan run so the shadow book has something to act on."""
+    """Record a successful scan run so the shadow book has something to act on.
+
+    ``started`` is accepted for readability at call sites but only ``completed``
+    (freshness) and ``run_id`` (identity) are persisted.
+    """
     from app.services import rr_scanner_service as rr
 
-    completed = completed or started
-    await shadow_book_service.settings_store.upsert_setting(
-        session, rr.KEY_LAST_SCAN_STARTED, started.isoformat()
-    )
+    completed = completed or started or datetime.now(timezone.utc)
     await shadow_book_service.settings_store.upsert_setting(
         session, rr.KEY_LAST_SCAN_COMPLETED, completed.isoformat()
     )
@@ -242,20 +245,20 @@ class TestScanFreshness:
         assert summary["opened"] == 0
 
     @pytest.mark.asyncio
-    async def test_setups_before_this_run_are_excluded(self, session):
-        """A qualified row from a previous run (before the current scan start)
-        must not be traded even though the current scan completed."""
+    async def test_setups_from_another_run_are_excluded_by_identity(self, session):
+        """A row from a different scan run must not be traded even if its
+        detected_at falls in the same window — selection is by scan_run_id."""
         ids = await _seed(session, ["AAA", "BBB"])
         now = datetime.now(timezone.utc)
-        scan_start = now - timedelta(minutes=5)
         session.add_all(
             [
-                _setup(ids["AAA"], rank=0.9, detected=now),  # this run
-                _setup(ids["BBB"], rank=0.8, detected=now - timedelta(hours=20)),  # prior run
+                _setup(ids["AAA"], rank=0.9, detected=now, scan_run_id="scan-run"),
+                # Same time window, different run — e.g. an overlapping manual scan.
+                _setup(ids["BBB"], rank=0.8, detected=now, scan_run_id="other-run"),
             ]
         )
         await session.commit()
-        await _mark_scan(session, started=scan_start, completed=now)
+        await _mark_scan(session, completed=now, run_id="scan-run")
 
         summary = await shadow_book_service.open_shadow_positions(
             session, activation_config=_CONFIG
@@ -269,21 +272,22 @@ class TestScanFreshness:
         ticker must beat an earlier qualified row, not the other way round."""
         ids = await _seed(session, ["AAA"])
         now = datetime.now(timezone.utc)
-        scan_start = now - timedelta(minutes=10)
         # Earlier row qualifies; later row fails the R:R floor (rr 1.0 < 2.0).
+        # Both belong to the same scan run.
         older = _setup(ids["AAA"], rank=0.9, detected=now - timedelta(minutes=8))
         newer = TradeSetup(
             ticker_id=ids["AAA"], direction="long", entry_price=100.0,
             stop_loss=95.0, target=105.0, rr_ratio=1.0, composite_score=70.0,
             confidence_score=70.0, detected_at=now, strategy_rank=0.9,
             momentum_percentile=90.0, recommended_action="buy",
+            scan_run_id="scan-run",
             targets_json=json.dumps(
                 [{"price": 105.0, "probability": 45.0, "is_primary": True, "rr": 1.0}]
             ),
         )
         session.add_all([older, newer])
         await session.commit()
-        await _mark_scan(session, started=scan_start, completed=now)
+        await _mark_scan(session, completed=now, run_id="scan-run")
 
         summary = await shadow_book_service.open_shadow_positions(
             session, activation_config=_CONFIG
@@ -298,10 +302,9 @@ class TestPipelineScanBinding:
         """The scan that stamped this pipeline's run id is the one to act on."""
         ids = await _seed(session, ["AAA"])
         now = datetime.now(timezone.utc)
-        session.add(_setup(ids["AAA"], rank=0.9, detected=now))
+        session.add(_setup(ids["AAA"], rank=0.9, detected=now, scan_run_id="pipeline-A"))
         await session.commit()
-        await _mark_scan(session, started=now - timedelta(minutes=1),
-                         completed=now, run_id="pipeline-A")
+        await _mark_scan(session, completed=now, run_id="pipeline-A")
 
         summary = await shadow_book_service.open_shadow_positions(
             session, activation_config=_CONFIG, expected_run_id="pipeline-A"
@@ -309,19 +312,41 @@ class TestPipelineScanBinding:
 
         assert summary["opened"] == 1
 
+    @pytest.mark.asyncio
+    async def test_concurrent_manual_row_excluded_even_when_pipeline_matches(self, session):
+        """The reported P2: the pipeline's scan matches (it wrote the marker
+        last), but an overlapping manual scan inserted a row in the same time
+        window. Identity selection must exclude that manual row — a detected_at
+        window would have swept it in."""
+        ids = await _seed(session, ["AAA", "BBB"])
+        now = datetime.now(timezone.utc)
+        session.add_all(
+            [
+                _setup(ids["AAA"], rank=0.9, detected=now, scan_run_id="pipeline-A"),
+                # Overlapping manual scan, same window, higher rank — must NOT win.
+                _setup(ids["BBB"], rank=0.99, detected=now, scan_run_id="manual-X"),
+            ]
+        )
+        await session.commit()
+        await _mark_scan(session, completed=now, run_id="pipeline-A")
+
+        summary = await shadow_book_service.open_shadow_positions(
+            session, activation_config=_CONFIG, expected_run_id="pipeline-A"
+        )
+
+        assert summary["symbols"] == [ids["AAA"]]
+
     @pytest.mark.asyncio
     async def test_concurrent_manual_scan_finishing_last_is_refused(self, session):
-        """The reported race: a manual rr_scanner overlaps the near-close
-        pipeline and writes the markers last. Its completion timestamp is later
-        than the pipeline start, but its run id is not the pipeline's — so the
-        shadow book must refuse, even though a timestamp check would accept."""
+        """A manual rr_scanner overlaps the pipeline and writes the markers last.
+        Its completion timestamp is later than the pipeline start, but its run id
+        is not the pipeline's — refuse, though a timestamp check would accept."""
         ids = await _seed(session, ["AAA"])
         now = datetime.now(timezone.utc)
-        session.add(_setup(ids["AAA"], rank=0.9, detected=now))
+        session.add(_setup(ids["AAA"], rank=0.9, detected=now, scan_run_id="manual-999"))
         await session.commit()
         # Pipeline expects "pipeline-A"; the manual scan's id won the last write.
-        await _mark_scan(session, started=now - timedelta(minutes=1),
-                         completed=now, run_id="manual-999")
+        await _mark_scan(session, completed=now, run_id="manual-999")
 
         summary = await shadow_book_service.open_shadow_positions(
             session, activation_config=_CONFIG, expected_run_id="pipeline-A"
@@ -334,10 +359,9 @@ class TestPipelineScanBinding:
         """If the pipeline's own scan failed, the stored id is a prior run's."""
         ids = await _seed(session, ["AAA"])
         now = datetime.now(timezone.utc)
-        session.add(_setup(ids["AAA"], rank=0.9, detected=now))
+        session.add(_setup(ids["AAA"], rank=0.9, detected=now, scan_run_id="yesterday"))
         await session.commit()
-        await _mark_scan(session, started=now - timedelta(minutes=1),
-                         completed=now, run_id="yesterday")
+        await _mark_scan(session, completed=now, run_id="yesterday")
 
         summary = await shadow_book_service.open_shadow_positions(
             session, activation_config=_CONFIG, expected_run_id="pipeline-today"