DC-EPOCH-18

Window-end bootstrap reward update for the seed+2 leadership authority. The first post-bootstrap replay-derived authority (seed+2, DC-EPOCH-17) is the per-pool stake snapshot at the seed->seed+1 boundary; that stake = base-UTxO + reward-account balance MUST include the epoch-boundary REWARD UPDATE the chain distributes at that boundary. Cardano applies the reward update AFTER the replayed epoch's withdrawals and THEN snapshots (NewEpochState applyRUpd precedes SNAP), so the delta is applied at the WINDOW-END of the seed-epoch replay -- in drive_window_consensus_inputs after the replay loop, immediately before aggregate_pool_stake -- and EXACTLY ONCE. (a) NO MUTATED PSEUDO-STATE: the seed cert-state is NEVER mutated; the delta is a separate, manifest-bound (anchor_fp), commitment-bound (domain-separated blake2b), version-gated (v1) replay INPUT (BootstrapRewardUpdate = the snapshot's Complete nesRu rs map, aggregated per credential), persisted at bootstrap + recovered at warm-start. (b) PURE BLUE TRANSITION: apply_bootstrap_reward_deltas(&mut DelegationState, &delta) on the window-replay CLONE (the RED driver never mutates core state directly); checked_add fail-closed on overflow. (c) REPLAY-EQUIVALENT: pre-update seed + canonical replay window + the bound delta reproduce the identical post-boundary snapshot on first-run derive AND warm-start recover (they share CandidateProfile). (d) FAIL-CLOSED MECHANICALLY AT THE SINGLE DERIVATION SITE: derive_candidate REQUIRES the bound rupd (target_epoch == seed_epoch) for the seed+2 window (source_epoch == seed_epoch) -- absent or wrong-epoch is TERMINAL -- so EVERY seed+2 derivation path (live first-boundary activate, per-boundary prepare, warm-start recover) fails closed WITHOUT replicating the gate in callers; a mid-pulse (non-Complete) nesRu also fails closed at decode. No native-bootstrap route derives this authority without the reward distribution (a legacy apply-at-bootstrap store, which mutated the seed, fails closed). (e) CLOSED CODEC: decode rejects unknown version, commitment mismatch, non-canonical/duplicate credential keys, unknown credential tag, trailing bytes, non-minimal encoding. LIVE GROUND TRUTH: on preview epoch 1340 the derived pool stake equals the real node's go snapshot to the lovelace; every 1340 block admits on first-run AND warm-start; a no-rupd legacy store fails closed.