fix: don't double-report a failed SEC run, and correct the rollback doc

Three follow-ups from review of the A6 commits.

The cache-summary re-finalize raised a second durable system event on a failed
run: _runtime_finish emits for `error`/`rate_limited`, and the dedup key
includes the message, so "SEC unavailable" and "SEC unavailable · cache 511 · 2
score inputs changed" landed as two unacknowledged Admin events. Adds
`emit_event` so a re-finalize that only rewords an outcome stays silent, with a
regression test asserting exactly one event.

The rollback section still claimed disabling the SEC job freezes the cache — the
opposite of what the same page says two lines earlier, and of what the code now
does. Rewritten: there is no Admin cache-off switch, restoring `fundamental_data`
alone is temporary because the next run rebuilds it from the same snapshots and
code, and a real freeze means stopping the service.

Remaining "shadow" wording: the two import jobs have never been shadow since
activation, so `_run_shadow_import` -> `_run_source_import`, its section heading,
the deployment doc's job label, and the plan doc's "production switch remains"
handoff paragraph are all brought up to date.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/scheduler.py

@@ -254,7 +254,14 @@ def _runtime_finish(
     processed: int,
     total: int | None,
     message: str | None = None,
+    emit_event: bool = True,
 ) -> None:
+    """Finalize a job's runtime row, optionally raising a durable event.
+
+    ``emit_event=False`` is for a *re-finalize* that only rewords an outcome an
+    earlier call already reported. The dedup key includes the message, so a
+    reworded error would otherwise land in Admin → System Events twice.
+    """
     runtime = _job_runtime.get(job_name, {})
     runtime.update({
         "running": False,
@@ -268,7 +275,7 @@ def _runtime_finish(
     })
     _job_runtime[job_name] = runtime
     # Durable event for error / rate-limit finishes (badge + Admin → Jobs panel).
-    if status in ("error", "rate_limited"):
+    if emit_event and status in ("error", "rate_limited"):
         severity = "error" if status == "error" else "warning"
         try:
             loop = asyncio.get_running_loop()
@@ -792,11 +799,11 @@ async def collect_sentiment() -> None:
 
 
 # ---------------------------------------------------------------------------
-# Jobs: shadow fundamentals sources
+# Jobs: bulk fundamentals source imports
 # ---------------------------------------------------------------------------
 
 
-async def _run_shadow_import(job_name: str, importer: SourceImporter) -> bool:
+async def _run_source_import(job_name: str, importer: SourceImporter) -> bool:
     """Run an importer and return whether its scheduled job was enabled.
 
     The SEC wrapper uses the return value only to word its runtime message: its
@@ -859,7 +866,7 @@ async def _run_shadow_import(job_name: str, importer: SourceImporter) -> bool:
 
 async def run_dolt_earnings_import() -> None:
     """Pull and import the Dolt earnings calendar/results feed."""
-    await _run_shadow_import("dolt_earnings_import", DoltEarningsImporter())
+    await _run_source_import("dolt_earnings_import", DoltEarningsImporter())
 
 
 async def run_sec_fundamentals_import() -> None:
@@ -873,7 +880,7 @@ async def run_sec_fundamentals_import() -> None:
     no filing does, and `fundamental_data` feeds scoring.
     """
     job_name = "sec_fundamentals_import"
-    import_ran = await _run_shadow_import(job_name, SecFundamentalsImporter())
+    import_ran = await _run_source_import(job_name, SecFundamentalsImporter())
 
     try:
         async with async_session_factory() as db:
@@ -908,6 +915,10 @@ async def run_sec_fundamentals_import() -> None:
     # Every outcome carries the cache summary — including deferred, failed and
     # source-locked ones. The import status is what varies; the refresh always
     # happened, and Admin → Jobs is the only place an operator sees that.
+    #
+    # This only rewords what _run_source_import already finalized, so it must not
+    # emit a second durable event: the dedup key includes the message, and a
+    # failure would otherwise show up twice in Admin → System Events.
     runtime = get_job_runtime_snapshot(job_name)
     if import_ran:
         status = str(runtime.get("status") or "completed")
@@ -921,6 +932,7 @@ async def run_sec_fundamentals_import() -> None:
         processed=processed,
         total=1,
         message=f"{import_message} · {cache_message}",
+        emit_event=False,
     )