Exact Dice Degradation Envelopes for Label-Free Segmentation Update Selection

Test-time segmentation updates can improve an unlabeled input while damaging another. Confidence and transformation consistency can rank candidates, but do not in themselves bound the loss caused by returning a changed mask. We derive the exact largest decrease in binary Dice between a baseline and a candidate, maximized over every possible unknown reference mask on the same pixels. A maximizing reference always lies inside baseline foreground: three observable mask counts reduce the problem to at most four reference-cardinality checks. Accepting an output only when its envelope is below a budget gives a deterministic, per-case Dice degradation limit relative to the baseline. A finite grid of logit interpolations permits partial candidate outputs without extra network forwards. Exhaustive and randomized validation checks 5,026,592 reference masks with no discrepancy. We evaluate six independently trained MK-UNet sources, three seeds per task, on ClinicDB, Massachusetts Buildings and the external Kvasir-SEG cohort, including appearance corruptions. Across 17,808 case-condition-seed evaluations, 0 certificate violations occur in the checked candidate comparisons. At a one-point Dice budget, exact versus loose interpolation changes the returned mask in the following fractions of episodes: ClinicDB, 51.0% versus 38.7%; Buildings, 62.1% versus 53.1%; Kvasir-SEG, 52.3% versus 34.9%. Mean Dice effects and useful-update rejection are reported separately from admissibility. An exploratory oracle-presence-bit ablation examines how weak supervision relaxes the empty-baseline restriction. The envelope quantifies relative mask-change risk; it does not certify anatomical correctness, preserve other metrics, or guarantee adaptation benefit.