fix(scanner): move updated_at when the upsert takes its conflict branch

[jeffcrouse]

Fixes a real but much narrower gap than ADR-0011 claimed, and corrects the claim in #53.

What ADR-0011 said, and why it was wrong

The draft asserted that a rescan changing a track's tags leaves updated_at untouched, because the
scanner's upsert omits it from an on_conflict_do_update set_ clause that SQLAlchemy emits
verbatim. Both halves of that mechanism are true. The conclusion was not.

That upsert lives in _create_track — the new-track path. Its conflict branch is reached only
when two scans race on the same file_path, which is what the comment above it always said it was
for. The ordinary rescan goes through _update_track, which is plain ORM attribute assignment, so
onupdate=func.now() applies and the timestamp moves.

Caught only by measuring it. The first two attempts reported a false positive: with
expire_on_commit=False, the in-memory attribute can be older than the row it came from, so
"before" was a stale cached value rather than what the database held. Reading the row back on a
separate connection showed the timestamp advancing exactly when the rescan ran, past a deliberate
two-second gap.

What this changes

One line — updated_at added to the set_ clause — so the race path behaves like every other write
to that column. Worth doing because the timestamp is the cursor an incremental client would page
from, and a row whose tags changed but whose updated_at did not is invisible to a delta, in the
silent direction.

The tests are the more useful half

Three, none of which existed, pinning what a delta would rest on:

• a retag moves updated_at
• an unchanged rescan does not — otherwise every delta carries the whole library
• the conflict branch moves it

They read back on their own engine, for the reason above. They guard a design that does not exist
yet, which is exactly when it is cheap to break by "optimising" the rescan into a bulk statement.

23 scanner tests pass, plus test_api_tracks and test_api_library (68 total). #53 is updated to
match — two backend prerequisites now, not three.

🤖 Generated with Claude Code

https://claude.ai/code/session_014P9p2fvFnyiywBxGkv4gfW