Heatmap requires canonical universe-return matrix (DB-GAP: no batch selector on public.security_analytics_snapshots yet).