DC-EPOCH-16

Rolling Praos chain-dep nonce evolution on the live follow path. Each validated followed header drives ONE indivisible BLUE nonce transition over {slot, prev_block_hash, vrf_nonce_output, next_epoch_freeze_boundary}: evolving' = evolving (X) nonceValue(vrf_nonce_output); lab' = prevHashToNonce(prev_block_hash); candidate' = evolving' WHILE slot < freeze_boundary ELSE candidate (frozen), with freeze_boundary = firstSlotNextEpoch - RSW and RSW = ceil(4*k / f). The epoch tick computes epoch_nonce' = candidate (X) last_epoch_block_nonce, previous_epoch_nonce' = epoch_nonce, last_epoch_block_nonce' = lab, with evolving AND candidate carried UNCHANGED across the boundary (NO reset). (a) (X) = Nonce(blake2b256(a || b)), NeutralNonce identity; the Praos boundary combine carries NO extraEntropy operand (unlike TPraos TICKN). (b) EXPLICIT OPERAND PRESENCE: last_epoch_block_nonce is an explicit optional; the boundary combine FAILS CLOSED (MissingLastEpochBlockNonce) on an absent operand unless supplied by a valid bootstrap bridge (ECA-5) or a freshly-seeded B1 chain-dep -- a nonce is NEVER fabricated. (c) BACKWARD-COMPATIBLE DURABLE FORMAT: the chain-dep snapshot encoder ALWAYS writes the array(10) form (10th field null|bytes(32) = last_epoch_block_nonce); decode accepts EXACTLY arity 10 (full B1 state) OR the legacy arity 9 (last_epoch_block_nonce = explicit None, preserving the store's already-promised within-epoch operation and barred from the rolling cross-boundary combine). (d) BRIDGE EQUIVALENCE (hermetic, mandatory): the B1 epoch tick over the seeded seed-epoch snapshot nonces reproduces the live-proven ECA-5 bridge eta0(seed+1) byte-identically. (e) LIVE GROUND TRUTH: Ade's self-evolved eta0(seed+2) equals the live Cardano node's epochNonce(seed+2). CandidateFreeze as a separable transition is retired -- the per-header transition is indivisible.