A single-bit level crossing needs exactly one structure: two flip-flops in series, both clocked by the destination clock, with the source feeding the first flop directly. Everything in this topic is a consequence of that circuit.
The first flop is the sacrificial one: it takes the timing hit, and if the source changes inside its window it has one full destination period to resolve. The second flop samples a settled value. The design uses only the second flop's output, so downstream logic never sees a hovering signal.
Source is a registered output in its own domain. The crossing starts at a flop, so the signal travels glitch-free to the synchroniser.
No logic between the flops, and none between the source flop and the first flop. Any gate in the path can glitch or stretch the wire and eat the resolution time.
Both flops on one destination clock. The full period of settling time exists only if the same clock samples twice.
Flops placed together so the wire between them is short; a long route steals resolution time.
Never read the first flop. No branch, no debug tap, no fanout of it into destination logic.
Latency is two to three destination cycles from source change to visible output. That delay is the price of the settling time and must appear in every protocol budget.
Structural analysis looks for exactly this shape: a single-bit crossing whose destination side is two or more back-to-back flops on one clock, fed directly by a source flop, with the synchroniser identified to the flow so optimisation and retiming leave it alone. Missing identification, logic in the path, or a tap on the first flop are reported as violations.
The registered-source rule. The decoder output can glitch as its inputs settle, and the first flop may capture a glitch as if it were data. Register the signal in the source domain first.
The settling budget is the time between the two sampling edges. With two different clocks that spacing is uncontrolled, so the resolution time the MTBF argument relies on no longer exists.