What this system does not know

TMS, SMMS, TDMS, COA and BDMS are internal Indian Railways systems. They have no external access, no public API and no published extract. The maintenance backlog here is generated, not observed. That is a hard constraint on any entrant, not a shortcut we took.

The structure of the result is defensible: clubbing reduces block count because three departments genuinely cannot see each other’s registers, and that is a property of the problem rather than of our data. The magnitudes are only as good as the generator, whose seed and distributions are published.

All three are validated with real methodology on generated data. That bounds what the validation is worth.

What we do not claim. A concordance of 0.690 on generated survival data does not establish that the model would rank real assets that well. The conformal guarantee holds under exchangeability on this data and would need re-establishing on field data.

Two numbers, because they answer different questions.

Placement

5.61%

Holding the scheduled work fixed: is it placed well? The question a planner asks.

Including what to defer

34.65%

The full objective is ~99% deferral penalty, so this measures how many deferrals are provably necessary.

Both are root-LP bounds. They do not improve with more solve time — only the primal does; we verified that at two work budgets and the floor was identical. So we report the floor rather than headline a percentage: no plan of this work costs less than 3,00,93,381 detention-minute equivalents. That is a proof. Of the 28 competing repositories, one computes a bound and none displays it.

5 criticality-A tasks cannot be placed within the corridor this horizon offers. Every one of them is behind the same constraint — Machine and gang availability (C8) — tower wagon — the classic divisional bottleneck, which the model found without being told to look for it. Verified at a 300-second solve as a real capacity limit rather than a solver artefact.

• TRD-006 ρ 93
• TRD-010 ρ 150
• TRD-011 ρ 88
• TRD-078 ρ 143
• TRD-079 ρ 106

We could have tuned it away. We would rather ship the artefact a DRM actually needs — evidence for requesting more corridor — than a suspiciously perfect result.

Named here rather than implied by omission.

• Reading the Train Signal Register
  The Station Master at each end of a section already records block taken and block returned, by rule, on paper. Those two timestamps are the actual duration of every block ever granted — reading them back would make the duration model the one model grounded in field data instead of generated durations. Not a new field app: a post that already writes the number we need.
• Historical replay harness
  Stage 1 of the rollout, where data-quality problems surface.
• BDMS write-back
  The planner proposes; BDMS grants. We never write to the block register.
• ST-GNN detention surface
  A graph is justified — blocking one section backs traffic into its neighbours — but an unjustified GNN is worse than a justified GBM.
• Continuous replanning
  The replanner is built and works one disruption at a time: /replan re-solves a mid-week USFD flaw with the past frozen, statutory work kept first and the fewest approved jobs changed, and names the resource that would have avoided the cost. It runs offline: 8 scenarios are precomputed and offered as a choice. What is not built is the loop around it - watching a defect feed and re-solving on its own. That needs feeds this project does not have.
• Un-approving a plan
  No railway un-approves a programme; it supersedes it. Supersession itself is built - re-solving marks the division's earlier plans superseded and keeps them as the record of what was granted. What has no real counterpart is reset_plan, which returns the same plan to draft: this instance is shared, so without it the approval chain could be exercised exactly once. The button says so, and the reset is written to the audit log.
• Serving the plan only from the database
  Sign-in and scoping are applied inside Postgres, so a Northern Railway post gets nothing rather than this division's numbers. But plan.json is still served publicly at /data/plan.json so the application runs for anyone who clones it without a database, and requesting that URL directly still yields the artefact. The scoping is enforced; the file is not.

Every plan carries a fingerprint: a SHA-256 of the blocks and tasks it grants, printed on the document and written into the append-only audit log at submission and at decision.

• Integrity, not correctness
  A matching fingerprint says this is the plan that was approved. It says nothing about whether the plan is good.
• A hash, not a signature
  Who approved comes from the audit row. In this demonstration every post shares one password, printed on the sign-in page, so “approved by the DRM” means approved by someone signed in as the DRM.
• Checked by the database, partly on trust
  Submit and Approve re-run 9 of the pre-approval rules in SQL over the rows the database holds, three of them in part. For what the rows do not carry - machine counts, due dates, booked durations, blackout days - the database requires the engine's passing record of this exact build: there it trusts the engine rather than checking it.
• A block record typed in, not read
  The Sr.DOM records each block as granted, returned or not availed, standing in for the Station Masters and controller who really do. Nothing is read from the Train Signal Register, and nothing reads the record back: work not availed does not roll into next week's backlog.
• Against users, not the database owner
  Row-level security stops every client from editing the audit log. The project owner and the service-role key bypass it entirely and could rewrite the plan, its hash and the log together. The printed copy is the one outside our control, which is why the fingerprint is printed.

It cannot see roads or minutes, so it is held to 1.2 work-hours per block-hour — what the weekly solver achieves on a full week, measured. Then it is checked: week 1’s 66 jobs go to the weekly solver unchanged, which fits 60. The 6 it cannot place roll into the later weeks; 5 of them are statutory and are overdue by then. So the month’s 139 of 139 statutory placed is the monthly plan’s figure, not a promise at minute resolution.

The reference instance is 4 sections, 90 tasks and 432 candidate windows over a 7-day horizon at 15-minute slots, solving in about 90 seconds. We have not demonstrated a full division at this resolution. The levers exist, but decomposing across a shared resource produces a plan nobody can execute, and the single tower wagon usually couples the sections.

This is a planning system, not a safety system. It does not touch signalling or interlocking, it does not grant blocks, and no output is safety-critical in the interlocking sense. It produces the proposal that the divisional block meeting reviews and amends.