DC-EPOCH-17

Replay-derived per-boundary leadership authority on the live follow path. The activation seam (prepare_authority_for_candidate_slot) ADVANCES the promoted epoch authority at EVERY boundary it crosses, not once: for a candidate slot in epoch C with the currently-promoted authority for epoch P, it promotes the C authority IFF C == P+1 (C > P+1 is terminal CandidateSlotSkipsBoundary; the candidate parent must bind the durable selected tip). The authority SOURCE is chosen deterministically by boundary index: C == seed_epoch+1 uses the ECA-5 MARK bridge (DC-EPOCH-15); C >= seed_epoch+2 uses the WINDOW-REPLAY over the durable C-2 epoch window (try_activate_at_boundary over the reduced checkpoint + canonical C-2 window blocks + v4 sidecar geometry), reflecting the MARK/SET/GO leadership snapshot lag = 2 (authority(E) = replay(E-2)). (a) the bound view's epoch_nonce is the EVOLVED chain-dep epoch_nonce at the boundary (DC-EPOCH-16, live-proven), never a recomputed/bridge nonce. (b) DURABLE-BEFORE-VISIBLE: the WAL activation record is written before the active view is advanced. (c) REPLAY-DETERMINISTIC: the promoted authority is a pure function of the durable window (blocks + reduced checkpoint + sidecar) -- same durable state => byte-identical bound view + WAL record. (d) FAIL-CLOSED: a missing/short C-2 window, a boundary-skipping candidate, or a parent not binding the durable tip is TERMINAL -- no silent bridge fallback past seed+1, no Origin fallback. AUTOMATIC + DETERMINISTIC: the sole gate is the candidate-slot/tip predicate over canonical durable state (no arming flag). LIVE GROUND TRUTH: Ade validates + admits seed+2 blocks against the replay-derived seed+2 authority + eta0(seed+2), crossing N+1->N+2 in the relay loop with no OutsideForecastRange / VrfCert / fail-close.