For block-height ties, prefer the block whose locally-observed arrival time is closest to its internal timestamp.
Really like this idea.
Creates big incentives to screw with the subsecond accuracy of the network times.
Not sure I follow, could you give us an example of an attack?
Has the anti-convergence property where if a first block is announced with a bad time you can keep trying instead of moving forward and you'll be sure to replace it unless you end up with a race with a child of it.
You could. But this would just be a new (and less potent) variation of selfish mining, which is only applicable "if a block is announced with a bad time" (which would happen a lot less often since nodes will be incentivised to keep their clocks accurate. More importantly it would not be a profitable strategy (compared to following the protocol).
I know that there has traditionally been reluctance to assume accurate clocks (since NTP is seen as a central point of failure), but this appears to me to be a very weak dependency. Even if you had the magical capability to change the clocks on all network nodes when you want (not when they choose to sync) to whatever time you want (typically the time that is in the header of your selfishly mined block) you only end up with a selfish mining attack which we are vulnerable to today anyway. So as far as I can see no worse attacks become possible and the one we knew about becomes immensely harder. But this could just be a failure of imagination on my part.