Use scan ID as written in the GUI as identifier for the report

README.md

@@ -21,6 +21,21 @@ pointing at a module that was never put on the path.
 report_generator --scan_id <uuid> [--path <file-or-directory>] --config config.json
 ```
 
+`--scan_id` takes either id a run is known by. A run is recorded under two: the **pipeline id**,
+which the GUI shows, cipherverifier names its working directories after, and archon's `core_scan`
+row is keyed by; and the **stored scan id**, minted when the artifacts are uploaded, which `scans`,
+`artifacts` and the S3 keys are keyed by. `core_scanresult` is where they meet — its own id is the
+stored scan, its `scan_id` the pipeline — and it is translated in both directions:
+
+- Reading always uses the stored scan id, because that is what the store is keyed by.
+- The report always *identifies* itself by the pipeline id — the file name, the `Scan Identifier`
+  field and the page footers — because that is the id the GUI shows and so the only one a reader
+  can match against anything else.
+
+So both ids produce the same report, filed under the pipeline id. A run with no pipeline row falls
+back to being reported under its stored id, which is then the only name it has. Passing a pipeline
+id used to fail with a bare `No row was found when one was required`.
+
 Without `--path` the report is written into `reports/`. The S3 secret comes from the environment:
 `PERSISTENT_STORAGE_STORAGE_CONFIG_S3_SECRET_ACCESS_KEY` (and the database password from
 `PERSISTENT_STORAGE_STORAGE_CONFIG_DATABASE_PASSWORD`). The name is not this tool's to choose: it is