The standard fix for an unsafe release is a short chain of flops in the destination clock domain, usually two. While the incoming reset is asserted, every flop in the chain is held low through its asynchronous clear. When the source releases, a deasserted level travels down the chain one stage per clock edge, so the domain's reset comes out aligned to its own clock.
The first flop may still go metastable if the release lands in its window, exactly as the previous lesson describes. The second flop samples it a full clock period later, which gives it time to settle, the same reasoning as a two-flop data synchroniser. Designs on very fast clocks or with strict reliability targets sometimes use three stages.
The circuit is taught in full, with a runnable testbench, in Reset Architecture. This course does not repeat that construction; it covers what signoff checks about it.
One synchroniser per destination clock domain, clocked by that domain's clock. A synchroniser shared between two clocks protects neither.
Nothing but the synchroniser's own flops between the asynchronous source and the domain reset net; in particular, no combinational logic on the path.
No load driven directly by the raw source anywhere in the domain: every flop's reset comes from the synchronised output.
The synchroniser flops themselves carry asynchronous clears from the same source, so assertion stays immediate.
The release aligns to only one clock. Each domain needs its own synchroniser on its own clock; the single shared one leaves two domains with an asynchronous release.
So that assertion stays immediate and works without a running clock, for example at power-up. Only the release travels through the chain; the assert path bypasses it.