TCA2: A Minimum-Assurance Time–Control Framework for GNSS-Challenged Indoor Regions under Degraded Hybrid Links Integrity-Driven Arbitration, Graceful Degradation, and Hybrid LF/Packet Dissemination

GNSS-challenged indoor and infrastructure-poor deployments often require not only defensible timekeeping but also a minimum auditable degree of low-rate coordination under degraded links. We present TCA 2 , a contract-first framework that makes both time acceptance and minimal control acceptance decidable from operational evidence. Time is accepted when scheduled endpoint observations remain within tolerance θ with availability A(θ) meeting the declared Service Assurance Level (SAL) target; minimal control is accepted when deadline-bounded commands attain R(Δ) within a Minimal Control Assurance Set (MCAS). TCA 2 couples (i) integrity-driven arbitration across GNSS/NTP/LF with explicit holdover and logged transitions, (ii) a timecode-agnostic adapter for national LF profiles, and (iii) hybrid dissemination over one-way LF paths plus an optional bidirectional packet path. In this architecture, LF paths preserve resilient time continuity for legacy or weakest-observability endpoints, whereas deadline-audited control attainment is evaluated only for packet-connected Path C endpoints with ACK/CONFIRM evidence. The evaluation is layered rather than monolithic: DS-1 establishes adapter portability; DS-2 evaluates the time-service contract on 30 legacy display-only clocks in a four-week single-building trial; DS-3 grounds the evidence workflow at field scale through an anonymized footprint of ≈7.85k terminals; and DS-4 demonstrates packet-plane minimal-control evidence in a controlled testbed. In DS-2, audited synchronization improves from ∼0.70 under tower-only LF to 0.93–1.00 with local LF augmentation, reaching 1.00 after stabilization; in DS-4, at Δ ( ACK ) = Δ ( M ) = 30 s, R ( ACK ) = 0.997 and R ( M ) = 0.965 over 593 issued MCAS commands. The contribution lies not in any single underlying carrier or protocol primitive, but in a unified assurance contract that combines multi-source time arbitration, minimum-control preservation, auditable degradation, and offline-recomputable evidence. • TCA 2 frames GNSS-challenged indoor timing and low-rate coordination as a minimum-assurance time–control contract, rather than a best-effort synchronization problem. • Time acceptance A(θ) and packet-plane minimal-control attainment R(Δ) are recomputable from minimal evidence logs; missing evidence is treated conservatively as unavailable or not attained. • SAL/MCAS provide auditable graceful degradation: TIME_STATE and MCAS traffic are preserved under integrity or capacity stress, while non-MCAS traffic may be deferred. • The evaluation is explicitly layered: DS-1 validates adapter portability, DS-2 tests weakest-observability legacy endpoints, DS-3 grounds field-scale evidence workflow, and DS-4 demonstrates packet-plane minimal-control evidence. • In DS-2, local LF augmentation raises audited synchronization from ∼0.70 to 0.93–1.00, reaching 1.00 after stabilization; in DS-4, Δ = 30 s yields R ( ACK ) = 0.997 and R ( M ) = 0.965 over 593 MCAS commands.