DC-EPOCH-14

Atomic epoch-authority transition + recovery. The node holds exactly ONE owned ActiveEpochAuthority -- the SOLE leadership + header-validation view source -- and crosses an epoch boundary as ONE authoritative state transition. (a) ONE HOLDER: header validation AND leadership/forge resolve the SAME holder, FRESH per authoritative decision (authority.ledger_view() / .pool_distr_view()), never a separately-built view nor a reference stored across the swap. (b) ATOMIC SWAP: at the boundary the holder is promoted IN PLACE (Seed -> Promoted) by the SAME path that derives the bound candidate, verifies the activation predicate, and writes the durable activation WAL record BEFORE the promotion is visible; a failure after the predicate is a terminal halt, never a seed fallback. (c) EPOCH-MATCH GUARD (slot-aware, mode-aware): at a forge decision the resolved authority's epoch MUST relate to the slot's protocol epoch (the SAME EraSchedule::locate the decision uses) per the CANONICAL EpochAuthorityMode -- recovered identically from durable state, NEVER an ambient runtime flag: authority_epoch > slot => terminal PrematurePromotion (both modes); == => proceed; < + ContinuityRequired => terminal MissingPromotion; < + SeedOnly => a graceful no-forge (ForgeNotLeader; the follow loop stays alive). Header validation rejects a wrong-epoch block through the SAME epoch-gated holder (a seed view answers None for an N+1 query -> reject before acceptance). (d) PROMOTION LINEARITY: <= 1 promoted authority per target epoch -- an identical re-promotion is idempotent, a different binding terminal. (e) CROSS-CONSUMER IDENTITY: at a slot, validation + forge resolve the SAME authority epoch AND the SAME active-view canonical hash (epoch alone is insufficient; two N+1 candidates with different bindings both report N+1). (f) RECOVERY EXACTNESS: warm-start reconstructs the promoted authority by RE-DERIVING the candidate from the durable tuple (activation-WAL record + v4 seed sidecar + bootstrap checkpoint + canonical selected-chain window) and promoting ONLY if the re-derived candidate reproduces the record's ENTIRE identity -- a record that merely parses but cannot be RECOMPUTED IDENTICALLY is a terminal halt; no record => the seed stays; never a fall back to the epoch-wrong seed view. Every replay of the same durable inputs makes the same decision and recovers the same authority. This is a hermetic guarantee: it does not prove unattended public Preview continuity (ECA-5).