The run-id marker proved which scan wrote last, but the shadow book still selected setups by detected_at >= scan_start. An overlapping manual scan could insert rows in that same window; if the pipeline's scan wrote the marker last its id matched and the shadow book proceeded, then swept in -- or ranked highest -- a manual-scan row. The identity check gated entry but selection did not. Carry the run id onto the rows. Migration 025 adds an indexed trade_setups.scan_run_id. scan_all_tickers computes one id per run (pipeline's when a step, else fresh), passes it to scan_ticker which stamps every row after enhancement, and writes the same id to the completion marker. The shadow book selects WHERE scan_run_id == the matched id, so a concurrent scan's rows are excluded by identity regardless of their detected_at. The now-unused STARTED marker is dropped; COMPLETED (freshness) and RUN_ID (identity) remain. Decisive test: the pipeline's id matches, but a same-window manual row with a higher rank is present and is excluded -- only the pipeline's own row is traded. A time-window select would have swept it in and ranked it first. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>