fix(hrv): refuse SDNN when the R-R stream is banked, not only when it…

[pipiche38]

What this fixes

#1085 taught the app to refuse SDNN on an over-counted capture. The drain the night after it merged
showed that gate is necessary but not sufficient: the 2026-08-06 Oura night measured
coverage 1.03, rrIntegrity=plausible — no duplication at all, its records tiling the timeline at
a fill ratio of 0.990 — and still printed SDNN 174 ms against a 40-100 ms physiological range.

Over-counting was never what made that number wrong.

A banked stream stamps a whole record of intervals on one coarse timestamp, so the stored values
are a decomposition of a record period rather than beat-to-beat measurements. The per-record SUM is
right to ~1% — which is why meanNN and resting HR stay correct and WHOOP-validated — while the
individual intervals are not. Coverage cannot see that fault by construction: it compares beat-time
against wall-clock, and a banked night can be textbook.

Evidence

Measured on that night, after the shipped Malik ectopic filter:

	measured	physiological
whole-night SDNN	174 ms	40-100
within-5-minute SDNN (median, n=106)	123 ms	30-80
of which genuine trend (SD of 5-min medians)	94 ms	— HR really moves 47-86 bpm

And the fault is not reachable by artifact rejection — each interval sits within 20% of its own
local median, so no per-beat rule sees it:

ectopic window radius	2 (shipped)	5	12	20
within-5-min SDNN	124 ms	115	105	99
beats kept	91.0%	90.8%	89.9%	89.3%

The change

• beatAccurateFraction(tsSec:rrMs:) — fraction of consecutive beats whose wall-clock gap matches
  their own R-R value. Beat-accurate streams step one interval per beat and measure ~1.0; a banked
  stream's gaps are 0 s against ~1 s values and it collapses toward 0.
• beatValuesAreTrustworthy(beatAccurateFraction:) — SDNN withheld below the boundary. Independent
  of beatSpreadIsTrustworthy: neither implies the other, and both now gate.
• hrv diag gains beatAccurate=, so the distribution can be gathered from traces that already
  exist — the same way coverage= was logged before anything acted on it.

The boundary is not tuned. The two populations do not overlap near it: a beat-accurate stream
measures ~100%, every banked Oura overnight measured to date sits at 2.6-6.6% (five nights,
2026-07-29 → 08-06). A mid-range boundary is the honest expression of "anything in between is a
stream we have never seen".

Scope held deliberately narrow

• RMSSD / pNN50 stay ungated, for the same reason they are ungated by the coverage verdict.
• Live spot readings untouched — too-short or mismatched input returns 1.0 and stays trusted, so
  an honest live capture is never suppressed. That is pinned by a test.
• The constants duplicate the ones the respiration gate uses for the same judgement (Oura respiration reads low because banked IBI isn't beat-accurate (RSA can't work). Full evidence + fix. #882/fix(oura): gate RSA respiration to nil when the R‑R stream isn't beat-accurate #883)
  rather than sharing them, because that gate lives in SleepStager on a branch that is not
  upstream. If it lands, the two should collapse onto this definition — the boundary is worth drawing
  once, in one place, for both.

Verification

• swift test StrandAnalytics 1,248 tests, incl. 6 new. The decisive one pins a perfectly
  covered banked night (coverage 1.0, verdict plausible) passing the over-count gate and being
  refused by the new one — the exact case that motivated this.
• Kotlin twins of each in HrvRrCoverageTest. ./gradlew testFullDebugUnitTest 3,516 tests with
  the same 3 pre-existing locale failures as clean main — verified by running those same tests
  on a clean upstream/main worktree, not assumed.
• Strand (macOS) built locally: IntelligenceEngine.swift is app-target Swift that no default CI
  job compiles.

Not claimed

This does not make Oura SDNN correct — it makes the app stop reporting it. Recovering a real HRV
number from this ring needs the ring's own 0x5D tag (P6d), which is separate work.