Per-Agent Learned Drift Models

Mechanism

The drift model is a per-peer estimator that maps observable conditioning variables — die temperature, supply voltage, time since power-on, mission-mode load profile, recent vibration spectrum — onto a predicted instantaneous frequency offset of the local oscillator from its nominal rate. The mapping is parameterized; in the simplest embodiment it is a polynomial in temperature with a separable aging term, in richer embodiments it is a Gaussian-process regressor or a small neural function approximator. The structural commitment is that the model is per-peer, learned, and credentialed; the specific functional form is a deployment choice.

Training proceeds online during normal mesh operation. Every consensus update produces, for each contributing peer, a residual between the peer's drift-corrected predicted clock and the consensus-resolved frame. The residual is annotated with the conditioning variables that prevailed at the observation epoch. Residual-and-condition tuples accumulate in a per-peer training buffer, and the model parameters are refit periodically against the buffer to minimize residual variance under the current conditioning distribution. Older tuples are retired on a declared schedule so that the model tracks slowly-time-varying drift behavior without unbounded memory.

Inference at consensus time inverts the trained model: each peer reports its raw oscillator reading together with the model's predicted drift correction at the current conditioning state, and the solver consumes the corrected reading rather than the raw reading. The peer also reports the model's declared uncertainty at the current conditioning state — typically the residual variance of the fit, optionally widened in regions of conditioning space sparsely covered by training data. The consensus solver weights each peer's corrected reading by the inverse of its declared uncertainty so that mature, well-conditioned models dominate the consensus and immature or out-of-distribution models contribute proportionally less.

The structural separation between raw reading, declared correction, and declared uncertainty is load-bearing. A peer that reports only a corrected reading hides the model's internal state from the solver and forecloses the solver's ability to discount immature contributions; a peer that reports only a raw reading wastes the per-unit calibration that the model already encodes. The disclosed protocol requires both, accompanied by the model-state credential under which the correction was generated, so that the consensus is reproducible from the per-peer report record and so that any subsequent audit can recompute the correction the peer applied at any past epoch from its credentialed model history alone.

Operating Parameters

Training-buffer depth, refit cadence, and tuple-retirement schedule are configurable. Buffers in the thousands-of-tuples range with refit cadences of minutes-to-hours and retirement horizons of days-to-weeks balance responsiveness to environmental change against stability of the fitted model. Deployments with rapid environmental transients select shorter horizons; deployments with stable thermal environments and slow aging select longer horizons.

Each model carries a credentialed maturity record. The record encodes the volume of training tuples, the conditioning-space coverage of the training set, the residual-variance history, and the model-form declaration. The maturity record is signed by the peer's credentialing authority and is verifiable by every other peer in the mesh before that peer's contributions are admitted to the consensus. A peer presenting a model trained outside its declared mission-profile envelope is admitted with reduced weight or rejected entirely according to the deployment admissibility rule.

Outlier handling is structural. A residual that exceeds a declared multiple of the model's predicted uncertainty is flagged as a credentialed diagnostic event rather than absorbed into the training buffer; persistent outliers downgrade the peer's contribution weight and surface as a fleet-management notification. The mechanism distinguishes transient excursions (admitted as conditioning-state outliers, used to expand the model's uncertainty in that region) from systematic failures (which downgrade the peer's credential).

The declared-uncertainty surface admits structural minimum and maximum bounds: a model is not permitted to declare an uncertainty smaller than a deployment-credentialed floor (which encodes irreducible per-unit oscillator noise that no model can predict away), and a model whose declared uncertainty saturates the deployment-credentialed ceiling for sustained windows is escalated as a candidate for retraining or replacement. These bounds prevent both overconfident inference at well-trained operating points and silent degradation at operating points the model has stopped tracking. The bounds are themselves credentialed parameters, audit-visible to every peer in the mesh, so that an admissibility decision against a contributing peer is reconstructible from the public credential record alone.

Alternative Embodiments

The model form is open. Polynomial-in-temperature models with separable aging suffice for inexpensive temperature-compensated crystal oscillators in benign environments. Gaussian-process regressors capture non-stationary drift behavior in oscillators subjected to broadband mechanical or thermal load. Small neural networks trained against richer conditioning vectors capture interactions among temperature, supply, and load that lower-capacity models cannot express. The choice of model form is a credentialed deployment parameter.

The conditioning vector is also open. Embodiments include a temperature-only conditioning vector for cost-constrained deployments, a temperature-plus-supply-plus-aging vector for general-purpose deployments, and richer vectors including vibration-spectrum features, magnetic-field exposure, and mission-mode encoding for high-stability deployments. The structural commitment is that the conditioning vector is declared and credentialed; specific feature selection is a deployment choice.

The training-source signal admits embodiments beyond consensus residuals. A peer with intermittent access to a high-quality external reference (a periodic GNSS fix, a chamber-test reference) can use that reference as a training signal during access windows; a peer co-located with another peer of declared higher quality can use that peer's corrected reading as a training signal under a credentialed pair-wise rule. Mixed-source training is admissible as long as each source's contribution is weighted by its declared quality.

The model-update cadence admits a continuous embodiment, in which parameters are updated incrementally on each new residual through a recursive estimator (Kalman-style or stochastic-gradient), and a batched embodiment, in which parameters are held constant between scheduled refit windows and updated atomically at each window. The continuous embodiment minimizes lag between drift behavior and corrective response; the batched embodiment simplifies the credentialing record by producing discrete model-state credentials that can be signed, distributed, and audited as static artifacts. A federated embodiment shares structural model-form parameters across a fleet of peers of the same hardware family while keeping per-peer parameters private, allowing the family-level prior to accelerate convergence at newly commissioned peers without disclosing per-unit calibration data.

Composition

The drift model composes directly with anchorless bootstrap. During the relative-frame phase before any external binding observation has been admitted, the consensus over drift-corrected per-agent times is more accurate than the consensus over raw readings would be, and the residual-norm convergence metric tightens correspondingly faster. During absolute-bound operation, the drift model continues to suppress per-peer excursions between binding observations, so that absolute-frame coherence is preserved across binding-observation gaps.

The model also composes with the ranging-piggyback channel: range residuals depend on per-peer time accuracy, so improved drift correction tightens range solutions, and tightened range solutions in turn improve the time-and-position cross-validation that surfaces oscillator anomalies. The composition is reciprocal rather than one-way.

A further composition arises with fleet-management and mission-planning subsystems. The credentialed maturity record is itself a fleet-observable property; mission planners select per-task contributors whose drift-model maturity meets the task's declared time-quality requirement, and fleet operators schedule conditioning-coverage missions that drive immature peers through underrepresented regions of their conditioning space to accelerate model maturation. The drift model is therefore not merely a per-peer numerical correction but a fleet-level operational asset whose state is visible, auditable, and subject to deliberate management against mission objectives.

Prior-Art Boundary

Factory-calibrated temperature-compensated oscillators apply a fixed per-unit correction curve burned in at manufacture; the correction is static and degrades as the oscillator ages. Oven-controlled oscillators reduce drift by stabilizing the oscillator's thermal environment but cannot compensate for non-thermal contributions and remain individually calibrated. Recent learned-drift literature in the timekeeping community proposes adaptive compensation against external references, but treats the trained model as a private, uncredentialed property of the local clock client and does not surface model maturity to a consensus solver.

The disclosed architecture exposes the per-peer drift model as a first-class credentialed mesh property: every peer's model form, conditioning vector, training history, and declared uncertainty are observable to every other peer through the credential chain, and the consensus solver weights contributions accordingly. Mesh-time consensus is consensus over drift-corrected per-agent times under credentialed admissibility, not consensus over uncorrected readings followed by post-hoc filtering.

Disclosure Scope

This article describes the per-agent learned drift model mechanism disclosed in Provisional Application 64/049,409. Defense-grade timekeeping under contested conditions gains improving fleet-wide time quality as a function of operating experience rather than a function of external-reference availability. Civilian fleet operations gain the same property and additionally gain a structural mechanism for mixing oscillator grades — high-stability units and low-cost units coexist in the same mesh, each contributing at its declared weight, with the consensus reflecting the actual quality distribution rather than the lowest common denominator. Long-endurance and resident-asset deployments gain compounding benefit, since each operating hour contributes to model maturity and the mesh's effective time quality improves over the asset's service life rather than degrading toward end-of-calibration.

The scope of the disclosure encompasses the per-peer model architecture, the online training procedure against consensus residuals, the credentialed maturity record signed by each peer's credentialing authority, the conditioning-vector declaration as a credentialed deployment parameter, the uncertainty-weighted consensus admission rule, the outlier-handling mechanism that distinguishes transient excursions from systematic failures, the tuple-retirement schedule that bounds memory while tracking slow drift evolution, and the composition with anchorless bootstrap and ranging-piggyback consensus. The disclosure further encompasses mixed-source training embodiments in which intermittent external references and credentialed peer-pair observations supplement consensus residuals as training signals.

Embodied properties of the disclosed architecture include the elevation of the per-peer drift model from a private oscillator-client property to a first-class credentialed mesh property, the structural symmetry between model maturity at the contributing peer and admission weight at the consuming consensus, the auditability of every per-peer contribution against the credential chain, and the explicit accommodation of heterogeneous oscillator grades within a single mesh under a single admissibility profile. These properties are presented as part of the architectural disclosure rather than as performance claims of any particular oscillator or model form.