| robust per-segment TCS (supported min-Z seeding + clamp to the per-record surface) | tcs_ground.per_segment | keep code, ship off | Every pass-4 catastrophe is fixed, but 2 of 7 canaries still miss and the metrics now move in the third decimal for +9–22 % runtime. |
ground clamp max(seg_z, rec_z − 0.05) | always on inside per-segment mode | it is the whole fix | The naive union is still as broken as in r3 (066 segment-only kept fraction 0.383); the clamp pulls final back to within 0.0143 of per-record. |
| stripper pole-promotion guard | returns_stripper.reject_promoted_poles = true | keep | 1 of 318 stripped clusters affected corpus-wide — the target FP; det_diff REMOVED 1 / ADDED 0 / MOVED 0. |
| hard-blob share cap 0.6 | unchanged (no survivor test yet) | fragile | 060 cid93 sits at 0.5815; a few-cm DEM change drops it to 0.5075 and one cell out of the blob → +13 800 points stay painted on the billboard. |
| histogram seeding internals | review fixes (C) | 2 majors fixed | uint16 counter wrap could lift a seed above truth; the cache sidecar ignored the tablecloth profile, so a profile change did not invalidate the cache. |
| seed support coverage | 1 m window, cumulative support | open | 34 % of real cells fall back to plain min-Z (too sparse, or the floor lies outside the 1 m window) — those cells get no robustness at all. |
| histogram memory | grid sized by bounding box | open | 650 MB on 018 where a populated-cells-only (sparse) grid would be ~16 MB. |
canopy extension (tree-path only, ae988ba) | 0.20 / 0.02 | unexercised | Byte-identical r3pr → r4pr on all four segments — a no-op on this corpus, so untested rather than validated. |