Algorithm 3: Outer-Loop Shadow-Schedule Activation

Input: Active schedule S, protected critical flows Fc, current topology and link estimates, reservation state R, minimum lead time delta_min Output: Activated shadow schedule S′ or fallback to break-then-make reallocation Phase A (background, before any trigger): A1: For each f in Fc, maintain node-disjoint candidate backup routes and reserve standby cells in dedicated mode [Equation (18)] A2: Refresh the reservations whenever topology or link estimates change by more than the warning threshold Phase B (on trigger): 1: For each f in Fc, identify the invalid primary/backup segment and residual deadline 2: If the reserved standby path of f is still valid, adopt it; otherwise run CASA (Algorithm 1) on the invalid segment to compute node-disjoint protected routes and standby cells (compute-on-trigger) 3: Construct S′ and UpdateSet = diff(S, S′) 4: Validate: half-duplex, conflict-free allocation, route disjointness, deadline, and reliability constraints [Equations (8)–(12)] 5: Select ASN_act >= ASN_now + delta_min, with delta_min >= ceil((T_opt + T_dis)/T_slot); disseminate UpdateSet and ASN_act to all affected nodes 6: Confirm installation before ASN_act; if any required installation fails, postpone ASN_act by one slotframe and retry once, otherwise invoke the break-then-make fallback (full CASA reallocation of the affected flows) 7: At ASN_act, atomically activate S′ 8: Measure packet-level recovery, schedule-installation latency, and any packet loss during the transition 9: return S′