Slot Clock

The µs-class half of Time Synchronization — read the two-domain split there first. This page elaborates the scheduled-MAC side of the Link Contract's R8 into a design: what slot alignment a TDMA-class medium actually needs, where it comes from with no fixed infrastructure, and how it maps onto Florete's decision-authority layers. Companion to Radio MACs; terms: Glossary. The ms-class sibling is the Network Clock.

What slot sync actually requires

Neighborhood-relative, not global. A TDMA collision happens when two transmissions meet at a common receiver — so what must agree is the slot phase of nodes within an interference neighborhood (two hops, at most), not across the network diameter. Skew between nodes that share no receiver is irrelevant. This is the insight the gradient-sync literature¹ formalizes (optimize neighbor skew, not offset to a global reference), and it makes the accuracy story tractable: per-hop sync error does not need to be divided by network diameter, only bounded within each neighborhood.

Insight from the gradient literature, mechanism from the tree literature. Worth being explicit, because it looks like a contradiction: we take GTSP's argument without taking GTSP's design. Gradient protocols¹ make the neighbor-skew point and then answer it leaderlessly — every node averages clocks with all its neighbors, no root, converging on a shared global virtual time — and argue this beats a tree, because in a tree two physical neighbors reached via different branches can be far apart in tree distance and so in skew. We keep the point and still answer it with a ranked tree (the FTSP/TSCH shape), for reasons that are about our regime, not about precision:

• We do not want a global time value. We want frame phase agreement plus a shared frame counter — strictly less than a synchronized timescale, and the counter is maintained by counting, not by continuous multi-hop time transfer. GTSP synchronizes a real-valued clock everywhere; we never do, so its main deliverable is one we would pay for and discard.
• We have a movable authority. The Coordinator can provision, optimize, and re-root a tree; leaderless averaging gives it nothing to hold. Monotonic ranks make the tree loop-free by construction and locally checkable, where mutual averaging must be trusted to converge.
• The tree needs no per-link sync protocol — tracking rides ordinary traffic to one parent — whereas GTSP adds a clock exchange on every neighbor edge, which is exactly the peer-to-peer sync machinery Hearing vs. exchanging refuses to introduce.
• The tree gives a natural origin for the counter and a deterministic winner at merge.

The gradient property GTSP maximizes — small skew between physical neighbors — the tree still delivers well enough, because our time source is itself a physical link neighbor and the neighborhood a synced burst must survive is only two hops deep: per-hop error accumulates over a handful of hops, never the network diameter. Leaderless averaging is not wrong; it is the fallback shape — what the authority-less corners of a partitioned mesh converge with — not the baseline, which is exactly where the Known approaches table files it.

The guard budget. For transmitters meeting at a receiver, the guard interval must absorb:

1. Pairwise slot-phase error within the 2-hop neighborhood (the sync design's output);
2. Drift since last resync — oscillator quality × resync interval (ppm-class TCXOs diverge pairwise at up to a few µs per second; resync every ~100 ms–1 s keeps this µs-class);
3. Propagation delay, and its residual spread — 3.3 µs/km. Absent compensation this is the largest term: a transmitter emitting at its slot boundary is heard a full one-way propagation delay later, so the guard would have to cover the neighborhood's whole range (a 30 km interference radius is already ~100 µs). Ranging (timing advance) collapses that term toward one receiver — the transmitter emits early so its burst lands on the boundary there — but a burst heard by several receivers is aligned for at most one; the residual differential spread survives at the others. So the range term is small on ranged unicast slots and large on broadcast/newcomer slots, which is why it is sized per slot role, not once for the frame (below);
4. TX/RX turnaround and ramp jitter (hardware-specific).

The budget arithmetic is the contract between the sync design and the frame design: tighter sync buys shorter guards buys more usable airtime. Numbers land with a concrete radio (oscillator spec, turnaround, burst overhead), not with B2.

Guard sizing and the range term

Nothing forces one guard for the whole frame, and the range term above — the widest, most role-dependent component — sizes down along two independent levers, neither of which is "add 3.3 µs/km × the radio's maximum range":

• Ranging on unicast slots (fast-path). A slot dedicated to a known TX→RX pair carries that pair's measured timing advance, so its guard drops to the residual budget (pairwise sync error + drift + differential spread to any co-hearers) and the freed time becomes airtime. Two limits keep the gain modest and vendor-dependent: the radio must actually support a per-slot guard (many firmwares fix it frame-wide — then this lever is simply absent), and reclaimed airtime is usable only if a larger burst fits it under the current MCS — the win is quantized to whole packets at the active rate, not continuous. This is µs-timescale execution, vendor-side below R10.
• RRA sizing from geometry (slow-path). The baseline guard is not the radio's maximum link range (a 100 km-capable radio does not owe 330 µs of guard everywhere) but the neighborhood's operational geometry — which the Coordinator's RRA sees, from ranging results and mobility telemetry (positions, range-rates). It sizes each neighborhood's guard — and, as an evolution, each slot role's guard — to the actual spread, widening only the broadcast/newcomer slots that carry the uncompensated term. A group whose members sit within a few km needs a few-µs range guard; its inter-group links, spanning tens of km, get their own wider slots. Because the slot map is per link, this is per-role sizing, not one rete-wide number — no group is forced to the worst-case guard of a link it never uses, which is what makes the "one group must talk to another" worry dissolve: the inter-group hop is just another slot with its own guard.

Variable slot length — reshaping the frame so tighter-guarded slots carry proportionally more payload, rather than merely varying the guard inside a fixed slot — is the general form and a research topic, not baseline. The baseline is a fixed frame with per-role guards sized by RRA, capturing most of the benefit with none of the reframing complexity.

Frame numbering, not just phase

Phase agreement puts slot boundaries in the same places; it does not give frames shared names. Slot maps need the names, for two reasons:

• Grants are epoch-structured. A grant is generally not "slot 3 of every frame" but "slot 3 of every frame ≡ 2 (mod 8)" — the superframe/epoch structure that lets a neighborhood host more nodes than one frame has slots. Without agreed frame indices, "which frame of the epoch is this?" has no common answer, and the grant is meaningless.
• Schedule changes must be atomic. When the RRA revises a neighborhood's slot map, every member must switch at the same frame boundary — a node transmitting on the old map while a neighbor receives on the new one is a collision generator. The clean mechanism is an activation tag: "map v8 takes effect at frame N." That turns a schedule change from a flag-day (drain, pause, reconfigure, resume) into one atomic boundary crossing — and it works only if N names the same instant for everyone.

So the sync domain agrees on a monotonic frame counter. It is learned once, at join (below), and thereafter maintained by counting, not by protocol: the counter advances once per frame (ms scale) while sync holds boundary error at µs scale — a node would have to be wrong by three orders of magnitude, deep past the point where holdover has already declared its schedule untrustworthy, before it could miscount a frame. This is TSCH's absolute-slot-number discipline exactly². (A few counter bits in each burst's MAC header are a cheap consistency check a vendor may offer; the design must not require it.)

Consequences: the vendor-agnostic ctrl vocabulary gains activation epochs (see the Design Sketch's open questions), and the counter's width and wrap behavior become an R10 question.

The movable reference

The mesh has no base station — but the R9 constraint is precise, and it is not "no master": nothing may pin fast-timescale authority to fixed infrastructure. A time reference is legitimate as a movable role — elected or Coordinator-designated, re-electable when lost, with holdover in between — exactly the shape the Coordinator itself has (logically centralized, relocatable, partition-tolerant). A single-rank network can have a rank-0 clock; it just cannot require a particular box to hold it. A wired-backbone or GNSS-fed node may well be chosen as reference because it is stationary and well-sourced — that is an optimization decision within bounds, never an architectural role.

The time-source graph

Sync structure follows the R9 split — provisioned options, local selection:

• Each node carries a time rank: the reference is rank 0; a node's rank derives from its selected source's rank plus a quality-weighted increment (accumulated sync error grows with depth and with link quality — pure hop count is too crude a metric).
• The Coordinator provisions, per node, a set of allowed time sources (primary + backups, with their ranks — the node's own rank included; ranks are ctrl state like the sources themselves) — a semi-persistent decision alongside the slot map. The node selects locally among them: lowest rank audible, with hysteresis so equal-rank candidates don't cause parent-flapping. The instantaneous syncs-to relation is a tree rooted at the reference; the provisioned structure is the DAG of allowed edges. Sync thus propagates hop by hop outward from rank 0 along this tree, carried by ordinary traffic — each node tracking its parent's transmissions (below) — a distribution tree with no distribution signal of its own.
• The invariant that keeps the graph sound is rank monotonicity: never sync to a source of rank ≥ your own. Sync loops — two nodes tracking each other and drifting away together — are the classic field failure of time-source trees³, and monotonic ranks make loop-freedom locally verifiable: the check is a comparison of a provisioned source's rank against the node's own, needing no global view to reject a cyclic provision. Where that check runs is the same question as any radio-ctrl check (below) — not in flor agent, which is vocabulary-blind and verifies only envelopes and signatures, but in the radio-facing component that understands time-source vocabulary, exactly as checking forwarding rows against bounds and failing over paths is the mesh-vertex's job, never the agent's.
• Coordinator-less fallback: with no provision available (churn, partition, bootstrap), the pure local rule — lowest audible rank (learned from beacons, which the fallback broadens), monotonicity preserved, deterministic tie-breaks — keeps the domain synchronized. The Coordinator optimizes the tree; it is never needed to have one. Same sentence as the scheduler: the fast path never depends on a remote controller.

Where the time story lives

Source selection, the monotonicity check, and holdover bookkeeping form one time-source handler, and it belongs on the same shelf as the rest of the radio's ctrl story — which is not flor agent. The agent is the node supervisor, deliberately vocabulary-blind: it verifies signatures and hands the payload down, understanding neither forwarding tables nor time sources. Nor is it the mesh-vertex, which owns paths and label forwarding, not radio timing. The one Florete-side component that already speaks the vendor-agnostic radio vocabulary and translates it across R10 is the link-vertex, in its medium adapter — so the handler sits there. It holds the provisioned sources and ranks, runs the selection (lowest audible rank, hysteresis, monotonicity) against the raw per-source offsets the radio reports, and commands the radio which neighbor to track and range; the µs execution stays below R10. This mirrors the node-fast-path split exactly: path failover is a mesh-vertex decision over provisioned paths, source failover is a medium-adapter decision over provisioned sources — each in the component that owns its vocabulary, neither in the agent. (How much of the selection the radio driver caches below R10 is the usual finer adapter-vs-driver boundary Radio MACs leaves radio-specific.)

The source-priority ladder

Who gets to be rank 0, in descending priority:

1. GNSS-disciplined node — where GNSS exists, it is the best possible reference (absolute, drift-free, and it makes multiple rank-0 nodes mutually consistent for free). It is an accelerator, never a requirement: the design must close without it (GNSS-denied is a stated Edge Mesh condition, and radios need not carry receivers).
2. Coordinator-designated reference — chosen for stability, centrality, source quality; delivered as ctrl state.
3. Local election — deterministic (source-quality class, then stable tie-break, e.g. lowest node identifier), for bootstrap and coordinator-less operation.

The ladder is policy, not a wire field. In coordinated operation the Coordinator applies it: which nodes are GNSS-fed or otherwise well-sourced is a node fact it already sees, and the root it picks arrives as ctrl state like everything else. What survives on the wire is the single rank number, with the ladder folded into its ordering: the root's source class forms the rank's high-order component, depth/quality the low-order — so "lowest audible rank" and the merge comparison implement the ladder with no extra field. A depth-five member of a GNSS-rooted domain outranks the root of a free-running one, which is exactly what a merge should conclude. This is sidelink's shape distilled — priority class first, hop distance second⁴ — and it is what makes the domain converge on the best available root and re-converge when a better one appears.

Hearing vs. exchanging

Steady-state sync needs no dedicated signal. Every correctly received burst carries a preamble whose arrival time, compared against the expected slot boundary, is a sync observation — and attribution comes with it, since R1's per-neighbor addressing labels every burst's sender. Ordinary traffic therefore keeps a joined node synchronized for free, and there are no quiet links to fall through: R7's BFD-class liveness probes run on every link regardless, so the liveness stream doubles as the sync keep-alive (the TSCH pattern²). The provisioning rule that follows: time sources are chosen among a node's link neighbors, so tracking rides on traffic that already flows — which also disposes of half-duplex concerns for members (a link's bidirectional traffic guarantees RX opportunities on the source) and, because the link is bidirectional, keeps the two-way ranging exchange available on the very link a node syncs to (what one-way listening can and cannot give is the subject of Ranging). Drift estimation improves markedly with a short observation history per source (offset and rate — FTSP's regression trick⁵). Rank needs no peer exchange either — deliberately: mesh-vertices keep exchanging exactly what they exchange today (liveness probes and workload traffic), and no peer-to-peer sync protocol is added between vertices. In coordinated operation a node's rank and sources arrive through the signed ctrl chain; rank appears on the air only inside announce beacons, for those the ctrl chain cannot reach — newcomers, rejoiners, and the coordinator-less fallback.

The beacon exists for those who cannot exchange yet. A cold newcomer sits below every layer Florete has, in a circle: fetching anything through the ctrl chain needs a link; a link needs mTLS; mTLS needs transmit opportunities; and a transmit opportunity in a scheduled medium requires knowing the frame. The announce beacon is the minimum that breaks the circle — a broadcast, connectionless, self-identifying transmission carrying exactly the state that can arrive no other way:

• the slot phase — implicit in the beacon's own timing;
• the frame counter — fast-path state, fresh at ms timescale; no Coordinator can deliver it, because reaching the Coordinator presupposes it;
• the frame-structure pointer — where the newcomer/contention slot sits (the frame layout is a ctrl decision, not a compiled-in constant);
• the sync-domain identity and the sender's rank — so a scanner joins the right domain and picks the best-rooted beacon it hears (root quality is encoded in the rank's ordering — see the ladder);
• the slot-map version — the number, never the map (below).

The slot map itself is deliberately absent: it is ordinary ctrl state. The join sequence, end to end:

1. Scan — passive, so half-duplex costs the newcomer nothing — until a beacon yields phase, counter, structure pointer, domain, version.
2. Range in the newcomer slot (below).
3. mTLS in the contention slot — and note it is two handshakes, not one: the newcomer's mesh-vertex brings up a link to the beaconer/Introductor it heard, and separately its agent must reach the Coordinator. Both span several frames at contention-slot rates; join latency is seconds, and that is fine.
4. Ordinary ctrl chain — the agent syncs through the new link, the Coordinator grants slots, and the neighborhood's updated map arrives down the Coordinator → agent → link-vertex path with an activation frame attached. This step hides an assumption worth stating plainly: the newcomer's agent↔Coordinator connection is itself carried over the new neighbor, which must forward it into the mesh — so joining the radio and reaching the control plane are not one act but two, chained. In C0/C1 that chain is trivial (stable rete, and the enrollment bundle already encodes how to reach the Coordinator); under B2 mobility a newcomer may have no prior path to the Coordinator at all, which turns "reach the Coordinator" into an open admission problem (below).
5. Leave the contention slot for the granted slots at the activation boundary.

The version field serves the returning node: one that kept state through a partition or deep holdover compares the beacon's map version and counter against its own — a mismatch means its grants are void, and it re-enters through the newcomer procedure rather than transmitting on a schedule that no longer exists.

Who beacons: designated relays, not everyone — and not a base station. Beaconing spends airtime, so participation is a controlled quantity — and Florete already has the mechanism: the Link Contract's discovery-participation rule (mgmt bounds declare which link-vertices may beacon, ctrl decisions activate them). The announce beacon is R6's discovery beacon carrying sync state — one mechanism, not two, with the Introductor as its future, admission-owning generalization. The Coordinator selects beaconers the way it computes everything else: as a coverage problem (wherever a newcomer may appear, at least one beacon should be audible). Multiple beaconers coexist trivially because their beacon slots are scheduled apart in time — a scanner hears several across an epoch and picks by rank; nothing requires same-slot beaconing, so no concurrent-transmission signal coding is needed (deliberate same-slot identical transmission is a real technique — barrage relay is built on it⁶ — but an exotic vendor capability, not a design requirement). Nor does a beaconer need a dedicated listening slot: it hears other beaconers in their slots, like everyone else. And beaconers are relays, not masters: a beacon carries its sender's rank, and the sender tracks the domain like any node. In coordinated operation beacons sync only those outside — members never consume them, since their sources and ranks are ctrl-provisioned; sync reaches members along the time-source tree, over ordinary traffic. Only in the coordinator-less fallback do beacons become the rank carrier for members too — there the picture does become sidelink's hop-by-hop SLSS relaying⁴, with the rank ordering deciding whom a listener believes. That fallback beaconing — low-rank nodes beacon by deterministic local rule — is also the cold-start answer: the elected rank-0 root beacons first.

Finding the beacon. A scanner must recognize a beacon without knowing the frame layout, so the beacon needs a medium-level self-identifying preamble or marker — a vendor capability question at R10. The scan window is bounded by the beacon cadence, which sets the join-latency floor and costs airtime — the same participation trade R6's E6 measures on the CSMA side.

Ranging

What one-way reception gives — and what it cannot. A received preamble's arrival, compared to the expected boundary, measures clock_offset + propagation_delay; a single observation cannot separate the two. For a stationary geometry that is harmless — the propagation term is a constant, absorbed into the offset estimate — and the node stays phase-synced well enough to receive and to keep its clock. For a moving geometry the propagation term drifts at radial_velocity / c, and FTSP-style regression simply tracks it as an apparent rate, folded into the offset-and-drift estimate alongside oscillator drift. So passive listening is genuine sync — for the receive side and for clock maintenance — one-way, no exchange needed: this is what "every received burst is a sync observation" above actually means.

Ranging is the one two-way step — and it is what the transmit side needs. What one-way listening cannot recover is the propagation delay by itself, so it cannot tell a node how far to advance its own transmission to land aligned at a chosen receiver. That separation requires a two-way MAC-level exchange (timing advance) — a radio primitive below R10, scheduled in the newcomer procedure and re-run as geometry changes, still not a Florete link. Cellular solves the identical problem at random access (RACH timing advance)⁷. The topological consequence: good transmit alignment lives on bidirectional links only — which is already where members sync, since sources are chosen among link neighbors (above), so the two-way exchange is always available on the link a node tracks. A one-way-only listener — a newcomer on a beacon, or a node merely overhearing a non-source — is phase-synced enough to receive, but until it can range it must lean on a guard wide enough to swallow the uncompensated range term (the newcomer slot, above).

Mobility ages the correction. Both the apparent drift above and the timing-advance value go stale at a rate set by relative radial speed, v/c. Airborne relative speeds — a few thousand km/h — are ≪ c, so per second the term is µs-class, comparable to a decent oscillator; but it accumulates between exchanges, so across sparse-communication epochs it is a real budget line, not a rounding error. It sets two things: a mobility component of the drift budget, and the re-ranging cadence (faster for faster-closing geometries — an open question). At bench and short range the correction is sub-µs and the guard can simply absorb it.

Spoofing

Sync is spoofable, and that is DoS-class. The newcomer-facing beacon is unauthenticated by construction — and so is every field it carries: phase, counter, structure, rank, version. A forged beacon (a fake rank 0, a skewed counter) can disrupt a neighborhood's schedule or lure a rejoining node onto a dead frame — the same class as PoA-label collision: never identity forgery (mTLS stays the only trust source, and everything the beacon bootstraps still ends at an mTLS gate), but a real denial-of-service surface. Among members the exposure is narrower still: in coordinated operation a member's sources and ranks arrive through the signed ctrl chain and beacons are simply not consumed — a forged beacon cannot re-parent a synced member at all. What remains attackable is exactly the beacon's audience: join, rejoin, and the coordinator-less fallback. Members do still hear rogue beacons, and can report them as telemetry — Arbiter-shaped evidence (a non-local violation caught by cross-node observation) — so detection is tractable. The naked surface is the beacon itself, and closing it means medium-level beacon authentication — mTLS cannot protect what must be parsed below the layer it lives on. That is precisely the shape of the R3 radio-security extension: keys derived from the rete's X.509/SPIFFE trust (a group beacon key distributed to enrolled members, or signed beacons), never a parallel credential system — with replay/freshness as the hard sub-problem, since an old but genuine beacon is still a weapon. Explicitly evolution, not MVP: on a closed bench the risk is accepted, detection stays post-hoc, and the design task is parked with R3's extension contract.

Degradation ladder

What a node does as its time sources fall away, in order — the medium must degrade, never stop (R9):

1. Source lost → re-select locally among provisioned backups (no Coordinator involvement — this is the sync analog of path failover being a mesh-vertex decision).
2. No provisioned source fits (every provisioned source gone) → keep syncing by the local rank rule: the lowest-rank audible node below your own, provisioned or not, monotonicity preserved. The line between this and step 3 is exactly whether a usable source still exists on the air — here one does; it just isn't the one the Coordinator named.
3. No usable source audible (nothing below your own rank left to hear) → holdover: free-run on the local oscillator, drift bound growing at oscillator rate. Note this is the losing-the-domain case — a node that is legitimately the lowest-rank root of a fallback domain also free-runs, but as the healthy reference its group tracks it, which is not a degradation (above). What makes holdover subtle is that you may still be heard: higher-rank neighbors that sync to you keep tracking your preamble and drift with you, so your subtree stays internally coherent — nothing to widen there. What grows is your offset from any group you are no longer tracking, and that becomes a collision surface only where your (sub)tree and another synced group meet at a common receiver. It is closed by widening the guard there — the boundary nodes observe your bursts drifting (every received burst already measures it), so the widening is detected, not guessed. Where guards are adjustable this trades airtime for continued operation; where they are fixed (firmware — the common baseline) there is no knob, so the drift eats the fixed guard's spare margin above the steady-state budget, and the time to exhaust it is the holdover budget — then step 4.
4. Drift bound exceeds what guards can absorb → the schedule is no longer trustworthy: fall back to the medium's sync-free mode where one exists (a p2p link re-established pairwise re-bootstraps its own timing), else mute and listen for a domain to rejoin.

Partition merge. Two groups that synchronized independently and then meet have incompatible frame phases and counters. The re-phase rule is deterministic and needs only beacon ranks: with the ladder folded into the rank ordering, the domain whose beacons carry the lower ranks is the better-rooted one — it wins, the other re-phases (with GNSS on both sides, merge is nearly free — both phases already agree). Re-phasing a live group is a scheduled event ("re-phase at epoch N"), and sessions surviving it is a mesh-layer concern — path failover covers a re-phasing radio hop like any other degradation, which is exactly why hybrid paths matter. The Coordinator, when reachable, re-optimizes the merged tree after the fact — never in the loop of the merge itself.

What crosses R10

The interface floor applies to sync unchanged: everything at µs timescale — phase tracking, timestamping, guard enforcement, ranging execution, beacon transmission timing — is vendor-side, below R10. Florete's medium adapter runs no sync loop. What crosses the interface is slow-path only:

Units at the interface. The frame counter is a dimensionless index — a shared name, not a duration — so there is no unit to reconcile across hardware. Everything else the slot clock exposes upward is a physical duration or rate (an RX timestamp's intra-frame offset, per-source offset and drift, the holdover bound, a ranging result), and it crosses R10 in a hardware-agnostic physical unit — nanoseconds — never raw counter ticks. Below R10 the radio measures against whatever native tick its hardware provides (an FPGA sample clock is the precision source) and converts to ns at the boundary from its own known tick rate; that rate stays below the line like the rest of the fast path. This is what lets heterogeneous radios share one sync domain, and lets the host and Coordinator aggregate timestamps across them without knowing any vendor's clock. So a slot-clock timestamp is the pair (frame N, ns offset into frame N) — the counter the coarse, wrap-bounded name; the ns offset the fine phase. (These ns are always relative — an offset from a boundary, a delay, a rate — never absolute time; the slot clock still has none.)

The upward set extends R5's telemetry catalog (feeding the Coordinator's guard-sizing and time-topology decisions); the downward set extends the vendor-agnostic ctrl vocabulary along the same additive path as power caps and slot maps. Note what is deliberately absent from the radio side: the selected source and the node's own rank are not radio telemetry. Selection and rank are Florete-side state, produced by the time-source handler in the medium adapter — the radio reports raw offsets and which preamble it happens to be locked to; the handler decides which source that should be and what rank follows. Both then travel onward to the Coordinator as telemetry, but they originate above R10, not below it.

Known approaches

The design above is a synthesis; these are its sources, each answering where the reference lives, how sync propagates, what precision it buys:

Open questions

• The rank encoding and metric: the composite ordering (root source class, then depth/quality), the increment function, hysteresis parameters — and what of it is bound (mgmt) vs decision (ctrl) vs local constant.
• Beaconer selection as a Coordinator coverage computation: cadence vs. join-latency budgets, interplay with Introductor placement, and the mgmt/ctrl vocabulary for beacon roles (one question with R6's discovery-participation vocabulary).
• Beacon self-identification at the medium level (a scannable preamble/marker without prior frame knowledge) — an R10 capability question, per MAC.
• Ranging under P2MP: scheduling the two-way exchanges, passive alternatives (listening to others' exchanges), re-ranging cadence under mobility (the v/c staleness term, above).
• Guard sizing across slot roles: per-role guards sized by RRA from ranging/mobility telemetry (baseline), unicast per-slot tightening as a vendor fast-path capability, and variable slot length as the research end of the ladder (Guard sizing and the range term); how much of this is fixed by firmware vs. actually adjustable per vendor.
• Newcomer-to-Coordinator bootstrap under mobility: obtaining grants presupposes a path to the Coordinator that a B2 newcomer may not have, unlike the stable C0/C1 rete. Candidate directions — the beaconer/Introductor delivers a minimal bootstrap state (enough to route toward the Coordinator, or to run degraded), the newcomer joining on that before opening a full Coordinator connection; and, failing even that, a newcomer that cannot reach the Coordinator operates in the contention slot — degraded but alive — until grants arrive. This is broader than the slot clock — an admission concern shared with R6 discovery — and is filed as such in the Design Sketch's open questions; the join sequence is only where it first bites.
• Member-side spoofing response — quarantine, salted re-election, and who decides (local vs ctrl); parallel to the label-collision response.
• Medium-level beacon authentication as an R3-extension instance: group key vs. signed beacons, key lifecycle across membership change (join, revocation), and replay/freshness bounds.
• Re-phase mechanics at partition merge: minimum-disruption schedules, and validating that mesh-layer failover actually carries sessions across a re-phasing hop.
• The epoch/activation vocabulary in ctrl artifacts (with the Design Sketch's ctrl-schema question); frame-counter width and wrap handling at R10.
• One sync domain spanning FDMA channel groups (the working choice — parallel channels share time, keeping the extension ladder sync-free) — revisit if channel-parallel groups ever want independent frames.
• Multi-radio carriers (supernodes): per-module slot clocks on one carrier, the host as a time bridge, carrier-wide guard budgets.

Footnotes

1. P. Sommer, R. Wattenhofer, Gradient Clock Synchronization in Wireless Sensor Networks (IPSN 2009) — optimizes neighbor skew rather than offset to a global reference; the formal footing for "neighborhood-relative is what a MAC needs". Pulse-coupled/firefly sync: Mirollo & Strogatz (1990); the Reachback Firefly Algorithm (Werner-Allen et al., SenSys 2005). ↩ ↩² ↩³

2. RFC 9030 (6TiSCH architecture); keep-alive-based drift bounding and enhanced-beacon join signaling per IEEE 802.15.4 TSCH. TSCH's ASN (absolute slot number) is the frame counter's precedent: announced in Enhanced Beacons at join, maintained by local counting ever after, never carried in ordinary frames. ↩ ↩² ↩³

3. RFC 9030 — An Architecture for 6TiSCH: TSCH nodes keep time against a time-source neighbor; implementations use the routing DAG's rank to keep the time-source graph loop-free, precisely because mutual time-parents drift away together. ↩

4. 3GPP NR sidelink synchronization (TS 38.331): out-of-coverage UEs transmit/relay Sidelink Synchronization Signals, selecting sources by a fixed priority ladder with GNSS-derived timing at the top and hop-limited relaying below — the standardized "priority ladder + seamless fallback" design. ↩ ↩² ↩³

5. M. Maróti et al., The Flooding Time Synchronization Protocol (SenSys 2004) — µs-class in deployment; linear regression over timestamp pairs estimates offset and drift rate; lowest-ID root election with silence-triggered re-election. ↩ ↩²

6. TrellisWare's published barrage-relay work (Halford & Chugg) describes network-wide coarse slot sync maintained without infrastructure, with slot structure sized to tolerate multi-hop propagation spread — see the Radio MACs case studies. ↩ ↩²

7. LTE/NR random-access timing advance: the network measures the uplink preamble's arrival and commands a per-device transmit-time correction — propagation compensation as a MAC primitive at join time, before any higher-layer relationship exists. ↩

8. IEEE 1588 Precision Time Protocol — Best Master Clock election plus two-way delay measurement; White Rabbit extends it to sub-ns over fiber with hardware timestamping and syntonized links. ↩