The trouble with fuses is that if a receiver is tricked by a bogus or incorrectly received signal into moving into the next (sub)epoch then you can never get it

The trouble with fuses is that if a receiver is tricked by a bogus or incorrectly received signal into moving into the next (sub)epoch then you can never get it to move back, unless there's a manual override, which is an option you didn't mention: not possible in some embedded applications, perhaps, but many consumer GPS devices already force the user to answer several questions whenever the device is rebooted. Another option is trying to guess the epoch from the TAI-UTC offset, which, of course, can't be known in advance and to some extent depends on political decisions so that's more of an "interesting" option than a good or practical one.