DC-NODE-45

ONE bootstrap-bound wall-clock -> absolute-slot authority on the authoritative --mode node producer path. (a) SOLE AUTHORITY: the forge derives its slot ONLY through BootstrapBoundTimingAuthority::slot_at, which projects a DerivedTimingAnchor over the venue's COMPLETE timing calendar from system start. The prior single-anchor conversion (anchor_millis, start_slot, slot_length_ms -> checked_millis_to_slot) is REMOVED from the codebase, not deprecated: two reachable slot authorities are the defect class, so an unpreferred second path does not close it. (b) STORE-SELECTED, NEVER OPERATOR-SELECTED: the venue calendar is resolved by the DURABLE seed-epoch sidecar's genesis_hash; --network and the operator shelley-genesis are fail-closed CROSS-CHECKS only (a --network naming a different venue is terminal; an absent one is simply no cross-check). (c) DURABLE BINDING: establishment refuses unless the reconstructed calendar is self-consistent (each segment transition epoch-aligned with the previous segment's own epoch length), reproduces the store's recorded epoch_start_slot AND epoch_length_slots, contains seed_point_slot inside that epoch, and yields an anchor whose lineage verifies against the calendar (schedule_timing_commitment). (d) RECONSTRUCTED, NOT PERSISTED: the anchor domain is the bootstrap anchor SLOT (never the clock, a peer tip, or an operator timestamp), so same bootstrap lineage + same calendar => byte-identical authority; nothing is persisted, so no store artifact is versioned and recovery behaviour is unchanged (STORE_SEMANTICS_VERSION stays v3). (e) TIMING-ONLY SCOPE: the calendar carries no era identity; slot_at reads system_start, per-segment start_slot and slot_length_ms and nothing else (CE-L2c-12), so historical eras enter as calendar geometry and never as ledger semantics. (f) CONSTITUTIONAL REFUSAL PRESERVED: a snapshot-local schedule still yields ScheduleDoesNotCoverSystemStart on BOTH conversion directions (slot_at and slot_start_time_ms); the compact anchor satisfies that guard by derivation rather than relaxing it. (g) A forge-ON start without a seed-epoch sidecar FAILS CLOSED -- with no bootstrap fact to bind the calendar to, a forge whose slot cannot be justified must not start.