fix(sec): A3 slice-1 review — read-only resolution, error propagation, fair-access

Addresses the slice-1 review:

1. Resolution is now read-only (A1 transaction contract). resolve_ciks /
   fetch_sic_updates compute proposals and mutate nothing; a new
   apply_ticker_updates issues the writes, called only in promote — so a failed
   validation can't leak ticker changes on the framework's failure commit.
2. Only 404 means "missing". Added SecNotFoundError; daily_index /
   latest_index_date catch only that. 403, exhausted 429, 5xx, timeouts, and
   transport/parse errors now propagate instead of looking like "no index".
3. Fair-access enforced when opening a REAL client (transport=None): reject
   blank/placeholder/non-email User-Agent and sub-0.11s spacing. Mock transports
   skip it (tests use 0 spacing).
4. submissions(include_history=False) by default — only the one-time full
   backfill fetches the history shards; SIC/incremental work makes no extra
   requests.

Plus: retry transient 5xx/network errors and honor Retry-After during the 1 GB
backfill; compose_revision rejects a missing index date (no "None:..." revision).

Re-verified live vs real SEC (fair-access validation passes, shard merge intact).
Tests: 18 (added error propagation, read-only resolution, fair-access, recent-only
submissions, reject-None revision).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/unit/test_sec_client.py

@@ -88,9 +88,9 @@ async def test_company_tickers_normalised_and_multiclass():
     assert m["BRK-B"] == 1067983  # dash form
 
 
-async def test_submissions_merges_shards_and_filters_forms():
+async def test_submissions_history_merges_shards_and_filters_forms():
     async with _client() as c:
-        sub = await c.submissions(320193)
+        sub = await c.submissions(320193, include_history=True)
     assert sub["sic"] == "3571" and sub["fiscal_year_end"] == "0926"
     accns = {f["accession"] for f in sub["filings"]}
     # 10-Q + 10-K from recent, 10-Q from the shard; the 8-K is filtered out
@@ -99,6 +99,20 @@ async def test_submissions_merges_shards_and_filters_forms():
     assert older["report_date"] == "1993-12-31" and older["is_xbrl"] is False
 
 
+async def test_submissions_recent_only_skips_shard_requests():
+    seen = []
+
+    def handler(request):
+        seen.append(str(request.url))
+        return _handler(request)
+
+    async with SecClient(transport=httpx.MockTransport(handler), spacing_seconds=0) as c:
+        sub = await c.submissions(320193)  # include_history defaults False
+    assert not any("submissions-001" in u for u in seen)  # no shard fetch
+    accns = {f["accession"] for f in sub["filings"]}
+    assert accns == {"0000320193-26-000013", "0000320193-26-000006"}  # recent only
+
+
 async def test_daily_index_parses_10kq_rows():
     async with _client() as c:
         rows = await c.daily_index(date(2026, 7, 21))
@@ -157,3 +171,53 @@ async def test_429_gives_up_after_max_retries(monkeypatch):
     async with SecClient(transport=httpx.MockTransport(handler), spacing_seconds=0, max_retries=2) as c:
         with pytest.raises(SecError):
             await c.get_json("https://data.sec.gov/z")
+
+
+def _status_client(status):
+    def handler(request):
+        return httpx.Response(status)
+    # max_retries=0 so 5xx/429 raise immediately (no retry sleeps)
+    return SecClient(transport=httpx.MockTransport(handler), spacing_seconds=0, max_retries=0)
+
+
+async def test_index_methods_propagate_403():
+    # A 403 must NOT be mistaken for "no index".
+    async with _status_client(403) as c:
+        with pytest.raises(sc.SecForbiddenError):
+            await c.daily_index(date(2026, 7, 21))
+    async with _status_client(403) as c:
+        with pytest.raises(sc.SecForbiddenError):
+            await c.latest_index_date(today=date(2026, 7, 22))
+
+
+async def test_index_methods_propagate_500():
+    async with _status_client(500) as c:
+        with pytest.raises(SecError):
+            await c.daily_index(date(2026, 7, 21))
+    async with _status_client(500) as c:
+        with pytest.raises(SecError):
+            await c.latest_index_date(today=date(2026, 7, 22))
+
+
+async def test_only_404_is_treated_as_missing():
+    async with _status_client(404) as c:
+        assert await c.daily_index(date(2026, 7, 21)) == []
+        assert await c.latest_index_date(today=date(2026, 7, 22)) is None
+
+
+async def test_fair_access_validation_on_real_client():
+    # Placeholder email rejected.
+    with pytest.raises(SecError):
+        async with SecClient(user_agent="signal-platform (contact: you@example.com)"):
+            pass
+    # Non-email UA rejected.
+    with pytest.raises(SecError):
+        async with SecClient(user_agent="signal-platform"):
+            pass
+    # Valid UA but unsafe production spacing rejected.
+    with pytest.raises(SecError):
+        async with SecClient(user_agent="signal-platform real@person.io", spacing_seconds=0.0):
+            pass
+    # Valid UA + safe spacing opens fine.
+    async with SecClient(user_agent="signal-platform real@person.io", spacing_seconds=0.2):
+        pass