Add investment parsing support for 14 BDC tickers - #990

* docs(changelog): the BDC entry documents the next release, not a published one

#990 branched from 2df53a2 on 2026-08-07, when the entries now dated 5.46.0
were still under [Unreleased]. It added its own entry to that block, and eight
days later the squash merge applied the hunk by context — into a section that
had since been released.

So 5.46.0's published changelog claimed a feature it does not contain, and the
BDC work would have shipped in the next release undocumented. Moved to
[Unreleased] under a `### Changed` heading, with the two label-shape fixes and
the ticker count added, since those are what a reader upgrading actually needs.
5.46.0 keeps its other 22 entries unchanged.

Worth knowing for any long-lived branch: a CHANGELOG hunk written against
[Unreleased] does not follow that heading when a release is cut underneath it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* chore(release): 5.49.0

Seven entries, one Changed and six Fixed. The headline is section extraction:
a 10-K written with colon-separated item headers went from one section to
fifteen, and Item 1C (Cybersecurity, mandatory since December 2023) and
Item 16 now resolve on filings whose table of contents omits them — which was
most modern 10-Ks. Across the parity corpus the new parser moved from level
with the deprecated one to ahead of it on 10-K, +0.1% to +3.4%.

Also folds in the BDC changelog entry that #990 landed under the already
published 5.46.0 section: its branch predated that release, so the squash
merge placed the hunk by context into a section that had since been dated.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

…9.0 section

The branch was written when its bullet sat under [Unreleased]. 5.49.0 shipped in
the meantime, which put a version heading above those bullets, so merging main
placed this entry at the tail of an already-published section — cleanly, with no
conflict to notice. Moved under a fresh [Unreleased] / Fixed.

This is the second time this trap has fired (it put dgunning#990's entry inside 5.46.0),
and both times git merged without complaint: the surrounding bullets are stable
context, so only the heading above them moved.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

… host (#989)

* fix(cache): cache rules never matched data.sec.gov (+ add companyfacts)

`_get_cache_rules()` builds its single top-level key from `SEC_BASE_URL`
(`www.sec.gov`), but httpxthrottlecache matches the request HOST against that
key before it ever looks at the path. `/submissions` and `/api/xbrl/companyfacts`
are served from `SEC_DATA_URL` (`data.sec.gov`), so:

    re.match(r'.*www\.sec\.gov', 'data.sec.gov')  ->  None

No rule under that key has ever applied to a data.sec.gov request. Verified live:
a fresh process logs `No patterns matched data.sec.gov` and goes to the network
every time.

This means the `/submissions` TTL has never taken effect -- including the
deliberate 600s -> 30s reduction in 655f5d3 for Issue #471. It also means
`get_facts()` (companyfacts) re-downloads on every call in every process.

Fix: build one key per host actually used by `edgar.urls` and file each rule
under the host that really serves it. A custom mirror that points
EDGAR_BASE_URL and EDGAR_DATA_URL at the same host merges into a single key,
so mirror support is preserved.

Also adds the missing `/api/xbrl/companyfacts/.*` rule under the data host,
with the same 30s budget as `/submissions`: both are invalidated by the same
event (a new filing lands), so a longer companyfacts-specific TTL would
reintroduce exactly the staleness Issue #471 removed.

Tests: `tests/issues/regression/test_data_sec_gov_cache_domain.py`, 5 cases.
3 of them fail against the pre-fix code (they pin the regression itself, not
just the fixed behaviour); the other 2 are negative guards for www.sec.gov and
an unrelated host, unaffected either way.

CHANGELOG.md: entry under [Unreleased] / Fixed, per CONTRIBUTING.md.

* fix(cache): key cache rules by exact host, built by the matcher's own parser

The previous commit fixed data.sec.gov by adding a second key, but kept the
hand-built `.*<domain>` pattern. Two holes survived, both raised by @paultiq
pointing at GH #490 as the origin:

Unanchored keys leak across hosts. `.*mirror.example.org` also matches
`data.mirror.example.org`, and `controller.get_rules` returns the FIRST key
that matches, so a mirror configured as base=mirror.example.org /
data=data.mirror.example.org resolved its submissions and companyfacts
requests to the base rule set — which has no rule for them. That is this
same bug, moved from sec.gov to mirrors.

Hand-parsing disagrees with the matcher. The key is compared against
`request.url.host`; `https?://([^/]+)` keeps the case, port, `user@` and
percent-encoding that httpx normalises away, so a capitalised host, a port
or credentials in EDGAR_DATA_URL produced a key no real request can match.

`_host_key` now takes the host from `httpx.URL(...).host` — the same parser
that produces it at match time — and matches it exactly, so the two sides
cannot disagree and a rule written for one host cannot answer for another.
A URL with no host is logged and matches nothing: a misconfigured mirror
goes uncached rather than borrowing another host's rules.

Also pins httpxthrottlecache>=0.6.1, whose clamp for the clock-skew crash
(paultiq/httpxthrottlecache#43) is what caching data.sec.gov now reaches.

Tests: 7 of the 12 fail on the previous commit — the three cross-host cases
(including a lookalike host that inherited the cache-forever Archives rule)
and the four parser-mismatch cases. Two of them only fail after fixing the
test helper itself: it fell through to later keys when the real matcher
stops at the first, which made every cross-host assertion unable to fail.

* test(cache): pin the replica against the real matcher, split multi-rule asserts

The file checks _get_cache_rules through _rule_for, a replica of
httpxthrottlecache's matcher. A replica can be wrong in the same direction as
the code it checks, and this one already was once — so it is now pinned against
controller.get_rule_for_request itself, over deliberately overlapping keys,
which is the only shape where a fall-through replica and the library disagree.
Agreement on the live (non-overlapping) rules is free and could not fail alone.

Also: one case per rule instead of four asserts in one test, so a break names
the rule it broke; /Archives cache-forever asserted by identity, apart from
the TTL cases; and the percent-encoded mirror host from the PR table now has
the test the other three URL forms already had.

Verified: 23 pass, 8 fail against the previous commit's httpclient.py, all 23
pass in isolation and in reverse order.

* test(cache): name the PR the regression test guards

`scripts/check_regression_provenance.py` refuses a regression test whose module
docstring does not link the issue, PR or bead it guards, and the fast job runs it
before the tests — so the whole job failed in 65s without running a single test.

The docstring already explained the bug at length; what the gate wants is the one
canonical link, which here is the PR itself.

* docs(changelog): move the #989 entry out of the published 5.49.0 section

The branch was written when its bullet sat under [Unreleased]. 5.49.0 shipped in
the meantime, which put a version heading above those bullets, so merging main
placed this entry at the tail of an already-published section — cleanly, with no
conflict to notice. Moved under a fresh [Unreleased] / Fixed.

This is the second time this trap has fired (it put #990's entry inside 5.46.0),
and both times git merged without complaint: the surrounding bullets are stable
context, so only the heading above them moved.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Dwight Gunning <dgunning@gmail.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>