Aircraft Stand Pre-Assignment Under a Calibrated Occupancy Risk Model

Abstract

We formalise aircraft stand pre-assignment as a constrained Markov decision process whose hard operational predicates (stand validity, size compatibility, buffered temporal non-overlap and adjacency exclusion) define a feasible action mask; we prove that any scoring policy composed with this mask assigns only feasible stands, and we derive in closed form the expected conflict minutes (ECM) accumulated by a schedule when occupancy durations follow calibrated piecewise-linear predictive distributions. In a preregistered one-shot replay of all 516 test days at San Francisco International Airport, a greedy policy that consumes this risk model cuts model-based expected conflict under the calibrated occupancy-risk model from 1175.5 to 615.9 min per 100 reservations relative to the strongest rule baseline: a 48% reduction (Holm-corrected $p=3.0\times {10}^{-13}$), with zero constraint violations and no deferrals. Three further preregistered hypotheses are reported not confirmed: graph-embedding and blended rankers reverse significantly, and masked discrete conservative Q-learning beats behaviour cloning but not the rule.

1. Introduction

An aircraft arriving at a large airport must be given a parking stand before it lands, and the assignment must be held for as long as it actually stays. Two properties make this hard. The constraints are not soft: a stand holds one aircraft at a time, small stands cannot take wide-body aircraft, and a pad cannot be used simultaneously as a whole and through its lettered sub-positions. Violating any of these is an operational failure rather than a cost, so a policy that merely pays a penalty for infeasible choices is unusable. And the quantity that drives conflict, how long an aircraft will occupy the stand, is unknown at decision time: planners work with reserved durations that are systematically wrong, and the cost is paid later by the aircraft assigned to the same stand.

These properties pull in different directions. Guaranteeing feasibility invites a hard-constraint formulation solved by mixed-integer programming; consuming uncertainty invites a probabilistic forecaster and a policy that scores candidates by risk. Published work on gate and stand assignment has largely followed one route or the other. Exact and heuristic optimisation delivers feasibility and strong objective values on a fixed instance [1,2,3]. A growing body of learning-based literature applies reinforcement and imitation learning to the allocation decision itself [4,5], a strand documented by a recent systematic review [6]. Robust and predictive-prescriptive formulations bring uncertainty into the plan, through a robustness-optimising multi-commodity flow model [7] or predictive-prescriptive planning under uncertainty [8]. Rare is the method that does all four at once: guarantee hard feasibility by construction rather than by penalty; let a calibrated predictive distribution enter the decision rule that the policy optimises at decision time; define that risk as an analytical functional rather than a sampled surrogate; and report its evaluation under a protocol frozen before the test data were read. Table 1 places this paper against the closest work on those axes.

Table 1. Positioning against representative learning-based and optimisation-based stand/gate assignment work, selected for proximity on the four axes below rather than by systematic search. Classifications reflect our reading of what each paper reports and are offered as a positioning aid, not as a survey finding. Among these representative studies we are not aware of one that satisfies all four axes simultaneously.

Study	Hard	Uncertainty in	Analytical	Prereg.	Open Multi-
	Feasibility	Decision Rule	Risk Funct.	Evaluation	Year Data
Li et al. (2021), Transp. Res. C — column generation with submodularity [1] a	✓	✗	✗	✗	✗
Wang et al. (2022), Transp. Res. C — robust multi-commodity flow [7] a	✓	∘	∘	✗	✗
Zhang et al. (2025), Transp. Res. E — predictive + prescriptive planning [8] a	∘	✓	✗	✗	∘
Li et al. (2025), Oper. Res. Perspect. — deep reinforcement learning [4] a	∘	∘	✗	✗	✗
Ding et al. (2023), Entropy — imitation learning + genetic algorithm [5] a	∘	✗	✗	✗	✗
Typical survey coverage (Daş et al. 2020 [2]; Ali et al. 2026 SLR [6]) a	∘	∘	✗	✗	∘
This work	✓	✓	✓	✓	✓

^a Bibliographic metadata is DOI-verified for every cited row. The classification cells are inferred from the method family each work reports and should be read as a positioning summary, not a reproduction of those papers’ own claims; only the “This work” row is backed by the evidence released with this paper. ✓ = provided; ∘ = partial or instance-dependent; ✗ = not provided. Columns are the four axes named in Section 1 plus open multi-year data with time-extrapolating splits. Prereg., preregistered; Funct., functional; SLR, systematic literature review.

We take the composition route. A masking operator turns the four hard predicates into a state-dependent feasible action set, and any scoring function composed with it inherits feasibility (Proposition 1); the scorer is then free to be whatever consumes uncertainty best, in our case a greedy rule penalising each candidate stand by the predicted overlap it would create. Measuring what such a policy buys needs a risk quantity well defined on a schedule of predicted occupancies, and our main mathematical result supplies one: under piecewise-linear predictive duration distributions, the expected buffered overlap of two same-stand occupancies has an exact closed form, obtained by integrating a piecewise-quadratic integrand segment by segment (Theorem 1). We call the daily aggregate the expected conflict minutes per 100 reservations, ECM. It is not a convenience: on the public San Francisco International Airport (SFO) parking log the recorded end of a reservation equals its requested end, so reservation-based overlap is identically zero for every policy respecting the mask, and a degenerate label channel cannot rank policies. Every claim we derive from ECM is stated as an expected conflict under the calibrated occupancy-risk model, never as realised minutes saved.

1.1. Contributions

• Closed-form expected-conflict functional (Theorem 1): for piecewise-linear predictive duration CDFs with bounded linear tails, the expected buffered overlap of a same-stand pair integrates exactly, with no quadrature error. Two corollaries connect it to the decision problem: it is monotone in the effective separation of a pair and under stochastic-order shifts of either duration (Corollary 1), and it collapses to the deterministic buffered overlap, hence to zero on any mask-feasible schedule, when the predictive distributions degenerate to point masses (Corollary 2). A Monte-Carlo gate confirms the implementation on 30 of 30 validation days, at an aggregate relative difference of 0.00159.
• Feasibility by construction (Proposition 1): the masked policy class assigns only stands satisfying all four predicates, for any scorer; across 516 one-shot test days and every policy evaluated, the measured violation count is 0.
• Preregistered headline result: a greedy policy ${\pi }_{\mathrm{unc}}$ consuming a $q_{0.9}$ overlap-risk term attains 615.9 ECM against 1175.5 for the strongest rule baseline B1, a 48% reduction (day-paired $\Delta =-559.6$, 95% CI $[-674.0,-451.2]$, Holm-corrected $p=3.0\times {10}^{-13}$), at a defer rate of 0 and with churn below B1’s. B1 never sees the occupancy model, so this is a like-for-like decision-quality contrast; a second, larger contrast against an uncertainty-blind twin ($\Delta =-6526.7$, Holm $p=1.9\times {10}^{-85}$) is a mechanism ablation isolating the information channel.
• Calibrated occupancy-duration model: a LightGBM quantile model with conformal interval calibration reaches test pinball loss 205.08 min against 243.79 for a point-$L_1$ model and 209.50 for the historical expanding-quantile baseline, at 80% interval coverage 0.782 (day-paired $\Delta$ against the historical baseline $-4.18$ min/day, Holm $p=0.0094$).
• Masked discrete conservative Q-learning, motivated and measured: we adapt the CQL support-restriction argument to the masked simplex, obtaining a conservative lower bound for the policy-evaluation operator evaluated at its own softmax (Proposition 2); this motivates the conservatism mechanism of a deployed control-CQL learner, which is not itself the object of the proposition. The learner beats the behaviour-cloning ensemble on the composite reward by $+34.11$ per day (Holm $p=8.1\times {10}^{-83}$) and does not reach the rule baseline ($-25.50$), so under the preregistered conjunction rule that hypothesis is not confirmed and we report it as such.
• Measured boundary conditions, and an optimality reference: gradient boosting beats every attempted upgrade (deep, graph-attention, graph-hybrid and blended rankers) on 516 replayed days with paired statistics, two of them preregistered to help and significantly reversed on test; a per-day mixed-integer program solved to proven optimality on 20 sampled test days puts the historical plan’s headroom at 66.4 objective units per day (62.2%).
• Reproducible, preregistered pipeline: hypotheses, endpoints, comparator sets, decision rule and the ECM definition were frozen before any development iteration; the frozen test split was read for the preregistered evaluation exactly once, and every other test-set contact, before and after that read, is enumerated in Section 4.7.

1.2. Scope of the Claims

Three of the four preregistered hypotheses are reported as not confirmed, with numbers, in Section 5: the graph-embedding hybrid ranker (H-A), the score blend (H-B) and the offline-RL comparison against the rule (H-D). Only the uncertainty-aware allocation hypothesis (H-C) is confirmed. That confirmed claim is model-based by construction: it says that consuming calibrated occupancy uncertainty reduces expected conflict under the calibrated occupancy-risk model of Theorem 1, on one airport’s log, under the pairwise conventions of Section 2. It does not say that realised conflict minutes fall, because on this data snapshot realised conflict cannot be measured at all. We lead with a comparison against a rule that never consumes the occupancy model, which makes the result more than a policy scoring well on its own surrogate. The sign of the advantage is established beyond this single calibrated model: Section 5.8 re-runs the comparison under a second, independently conformalised duration model, both as the policy’s input and as the yardstick that judges it, and under correlated durations induced by a day-level common shock. The ranking holds throughout, and the margin widens under the alternative model.

Section 2 is the mathematical core; Section 3 audits the data, Section 4 specifies the models and the preregistered protocol, Section 5 reports the one-shot evaluation, and Section 6 and Section 7 interpret, qualify and conclude.

2. Mathematical Formulation

2.1. Decision Problem

We model one operating day as an episode of a constrained Markov decision process $\mathcal{M}=(\mathcal{S},\mathcal{A},F,P,r,\gamma )$, in which F is a state-dependent admissible-action map rather than a family of expected-cost constraints (Figure 1). Let $\mathcal{G}$ be the stand inventory and $\mathcal{A}=\mathcal{G}\cup \{\varnothing \}$. Requests are processed in order of reserved start, ties broken by event identifier; the data carry no booking timestamps, so this is the decision order. A state $s_t=(i_t,H_t,w_t)$ pairs the request $i_t$ under decision with the committed schedule $H_t=\left\{(j,g_j,a_j,D_j,c_j)\right\}$, $g_j\in \mathcal{G}$, and exogenous context $w_t$ (weather, load, calendar); a request carries a deterministic reserved start $a_i$, a reserved duration, an aircraft model, an operating company and a reservation-chain label $c_i$, the pair (source type, source identifier) grouping the recurring blocks of one standing reservation. The schedule holds both the boundary occupancies inherited from the previous day and the decisions already taken. Transitions are deterministic: $a_t=g$ yields $H_{t+1}=H_t\cup \left\{(i_t,g,a_{i_t},D_{i_t},c_{i_t})\right\}$, and ∅ leaves $H_{t+1}=H_t$. The reward is a weighted sum of four costs,

$$r(s_t,a_t)=-\left(w_c{\mathrm{conflict}}_t+w_p{\mathrm{pref}}_t+w_h{\mathrm{churn}}_t+w_s{\mathrm{mismatch}}_t\right),$$

(1)

with weights $(w_c,w_p,w_h,w_s)=(1.0,0.2,0.3,0.1)$ locked in the project configuration. The composite endpoint of Section 5 takes $w_c,w_p,w_h$ and excludes the tie-break-tier size-mismatch term, an exclusion fixed in the preregistration; that term is reported descriptively. Where the classical constrained MDP of Altman [9] restricts policies through expected-cost inequalities, our constraints admit no expectation: a double-booking is a failure on the realised path, not on average. Enforcing them pathwise through F is strictly stronger and is what makes Proposition 1 exact rather than a bound; action masking of this kind is standard in policy-gradient practice [10], but here it also carries the feasibility guarantee.

Figure 1. Framework. Predicates C1–C4 define the feasible action mask; a calibrated quantile model of occupancy duration feeds the closed-form ECM functional (Theorem 1); three policies are replayed over 516 preregistered one-shot test days; the blind twin is dashed because it bypasses the uncertainty channel. Day-mean model-based expected conflict under the calibrated occupancy-risk model per 100 reservations: ${\pi }_{\mathrm{unc}}$ 615.9, B1 1175.5, blind twin 7142.6. Prop., Proposition; Thm, Theorem; BC, behaviour cloning; P10/P50/P90, 0.1/0.5/0.9 quantile forecasts; q90, 0.9 quantile.

2.2. Hard-Constraint Predicates

Write $[a_i,e_i)$ for the reserved interval of i and $\beta =15$ min for the buffer.

Definition 1

(Constraint predicates). For a request i, a stand $g\in \mathcal{G}$ and a committed schedule H:

$$\begin{array}{cc}\hfill \mathrm{C}1(i,g):& \mathit{the}\mathit{date}\text{-}\mathit{effective}\mathit{validity}\mathit{window}\mathit{of}g\mathit{covers}[a_i,e_i);\hfill \end{array}$$

(2)

$$\begin{array}{cc}\hfill \mathrm{C}2(i,g):& \mathit{the}\mathit{aircraft}\mathit{model}\mathit{of}i\mathit{is}\mathit{compatible}\mathit{with}\mathit{the}\mathit{size}\mathit{category}\mathit{of}g;\hfill \end{array}$$

(3)

$$\begin{array}{cc}\hfill \mathrm{C}3(i,g,H):& \forall (j,g_j,·,·,c_j)\in H\mathit{with}{g}_j=g\mathit{and}{c}_j\ne c_i:\hfill \\ \hfill & a_j\ge e_i+\beta \mathit{or}{e}_j\le a_i-\beta ;\hfill \end{array}$$

(4)

$$\begin{array}{cc}\hfill \mathrm{C}4(i,g,H):& \mathit{the}\mathit{same}\mathit{separation}\mathit{holds}\mathit{between}\mathit{g}\mathit{and}\mathit{every}\mathit{committed}\hfill \\ \hfill & \mathit{occupancy}\mathit{of}a\mathit{stand}\mathit{that}\mathit{shares}\mathit{physical}\mathit{extent}\mathit{with}g.\hfill \end{array}$$

(5)

The feasible action set in state $s=(i,H,w)$ is

$$F\left(s\right)=\left\{g\in \mathcal{G}:\mathrm{C}1\wedge \mathrm{C}2\wedge \mathrm{C}3\wedge \mathrm{C}4\right\}\cup \{\varnothing \}.$$

(6)

Each predicate carries a measured design decision. C1 reads the validity window, not present status, because 34,195 historical events sit on stands inactive today (only 48 predate a stand’s valid_from and 12 postdate its valid_to). C2 is an expanding, leakage-safe count of model-by-category co-occurrence with a flagged global fallback. C3 exempts same-chain occupancies, since standing reservations expand into back-to-back blocks meeting at midnight and counting those continuations as conflicts would make 6.59% of historical choices self-conflicting instead of 2.91%. C4 excludes a base pad against its own lettered sub-positions but not sub-positions against each other, since excluding all dependent pairs would render 7.20% of historical choices infeasible against 1.26%. Two consequences are used repeatedly: C1 and C2 are unary and C3 and C4 pairwise, so none couples three or more occupancies; and C3 and C4 are monotone in H, since enlarging the schedule can only remove stands from $F\left(s\right)$.

2.3. Masked Policy Class

Definition 2

(Masked policy class). Let ${\pi }_f:\mathcal{S}\times \mathcal{G}\to \mathbb{R}$ be any measurable scoring function. The masking operator m produces the policy

$$(m\circ {\pi }_f)\left(s\right)=\left\{\begin{array}{cc}{\displaystyle \underset{g\in F\left(s\right)\setminus \{\varnothing \}}{\mathrm{arg\; max}}{\pi }_f(s,g),}\hfill & F\left(s\right)\ne \{\varnothing \},\hfill \\ \varnothing ,\hfill & \mathit{otherwise},\hfill \end{array}\right.$$

(7)

with ties broken by a fixed deterministic rule. The masked policy class is ${\Pi }_{\mathrm{M}}=\{m\circ {\pi }_f:{\pi }_f\mathit{measurable}\}$.

Every policy compared here lies in ${\Pi }_{\mathrm{M}}$, differing only in ${\pi }_f$; for the value-based agents of Section 4.5 the mask assigns $-\infty$ logits to infeasible actions, reproducing (7) exactly.

2.4. Feasibility by Construction

Call H admissible if every decision-created pair in it satisfies C3 and C4 and every such occupancy satisfies C1 and C2 for its own request.

Proposition 1

(Feasibility by construction). Let $\pi \in {\Pi }_{\mathrm{M}}$ and let $H_1$ be the inherited boundary schedule of an episode. Then for every epoch t the assignment produced by π satisfies C1–C4 with respect to $H_t$, and the terminal schedule $H_{T+1}$ is admissible. In particular, π creates no violation of C1–C4 that was not already present in $H_1$; and by (7) a policy of ${\Pi }_{\mathrm{M}}$ returns ∅ only when $F\left(s_t\right)=\{\varnothing \}$.

Proof. 

Induct on t. For $t=1$ the claim on decisions is vacuous, no decision having been taken, and $H_1$ is inherited. Assume every decision up to epoch $t-1$ satisfies C1–C4 against the schedule prevailing when it was taken. At epoch t, if $F\left(s_t\right)=\{\varnothing \}$ then $\pi \left(s_t\right)=\varnothing$ by (7) and $H_{t+1}=H_t$, so the hypothesis carries over; otherwise $\pi \left(s_t\right)=g^{\star }\in F\left(s_t\right)\setminus \{\varnothing \}$ satisfies C1–C4 with respect to $H_t$ by (6), for any ${\pi }_f$, because the maximisation in (7) ranges over $F\left(s_t\right)$ and nothing else. A pair certified at epoch t also stays certified: requests are decided in order of reserved start, so when $(i_t,g^{\star })$ is added every occupancy it can conflict with is already in $H_t$ and was checked, and each later pair is checked at the epoch of its later-starting member against the full committed schedule. Because C3 and C4 are pairwise, a pair’s certification never depends on occupancies added afterwards, and because C1 and C2 are unary they cannot be invalidated by later decisions. Hence every decision pair in $H_{T+1}$ is certified, which is admissibility.    □

Remark 1.

The guarantee is relative to the four modelled predicates and the current inventory snapshot. It is exercised rather than assumed: the argument above is what the replay engine asserts at run time, and across 516 test days and every masked policy, including both offline-RL agents, the measured violation count is 0 (Section 5.4).

2.5. Conservative Value Bound Under Masking

The offline-RL instantiation of Section 4.5 learns ${\pi }_f$ by conservative Q-learning [11] restricted to $F\left(s\right)$. The restriction is not cosmetic: CQL’s log-sum-exp regulariser ranges over the action set, so shrinking it changes the penalty.

Proposition 2

(Conservatism under masking). Let ${\pi }_{\beta }$ be the behaviour policy generating the logged dataset $\mathcal{D}$ and suppose ${\pi }_{\beta }(a\mid s)>0$ for every $a\in F\left(s\right)\setminus \{\varnothing \}$ and every s in the support of $\mathcal{D}$. Consider the masked CQL(H) fixed-point iteration in which the regularising maximisation is restricted to the masked simplex $\Delta \left(F\left(s\right)\right)$; let $\widehat{Q}$ denote its fixed point and let $\mu (·\mid s)\propto \exp \widehat{Q}(s,·)$ be the softmax over $F\left(s\right)$ induced by $\widehat{Q}$. This μ is both the entropy-regularised maximiser and the policy the bound certifies, and $\widehat{Q}$ satisfies the masked policy-evaluation fixed-point equation for it. Then, evaluated under μ itself,

$${\mathbb{E}}_{a\sim \mu (·\mid s)}\left[\widehat{Q}(s,a)\right]\le V^{\mu }\left(s\right)\mathit{for}\mathit{all}s\in \mathcal{D},$$

(8)

provided α exceeds the (policy-dependent) threshold of [11], Theorem 3.2, instantiated at μ on $F\left(s\right)$; in the exact-Bellman case any $\alpha >0$ suffices. The two policies in play are kept distinct: ${\pi }_{\beta }$ is the data-generating behaviour and μ the induced softmax the bound certifies.

Proof sketch. 

The support-restriction argument of [11] is pointwise in the action set, so replacing $\mathcal{A}$ by $F\left(s\right)$ leaves the per-iteration update in the form ${\widehat{Q}}^k={\mathcal{B}}^{\mu }{\widehat{Q}}^{k-1}-\alpha [\mu (a\mid s)/{\pi }_{\beta }(a\mid s)-1]$ on $F\left(s\right)$, with $\mu$ the entropy-regularised softmax over $\Delta \left(F\left(s\right)\right)$. The strengthened support assumption keeps ${\pi }_{\beta }>0$ for every feasible action, so the correction is finite wherever $\mu$ places mass; under $\mu$ it is nonnegative, ${\sum }_a\mu [\mu /{\pi }_{\beta }-1]={\sum }_a{\mu }^2/{\pi }_{\beta }-1\ge 0$ by Cauchy–Schwarz, whereas the same sum under an arbitrary $\pi \ne \mu$ can be negative, which is why the bound is stated at $\mu$ only. Appendix A.3 gives the full argument.    □

Remark 2

(Scope: the deployed learner is not the object of Proposition 2). Two scope restrictions travel with Proposition 2. First, it concerns the policy-evaluation CQL(H) fixed point under an exact Bellman operator, whereas the learner of Section 4.5 is a control variant: Bellman-optimality target ${\max }_{a^{\prime }\in F\left(s^{\prime }\right)}{Q}_{\mathrm{target}}$, exponential-moving-average target network, Huber temporal-difference loss, finite-epoch stochastic optimisation, and a behaviour-cloning-distilled warm start. Second, the strengthened support assumption is demanding and the logged policy does not meet it: the recorded behaviour is a near-point-mass, placing one action among roughly 109 feasible stands. The warm start smooths the initial Q-estimate, not the data-generating distribution entering the penalty ratio $\mu /{\pi }_{\beta }$, so it does not make the full-support assumption hold on the logged data and we make no such claim. Proposition 2 is therefore about an idealised masked policy-evaluation operator whose reference behaviour has full support on $F\left(s\right)$: it isolates and formalises the conservatism mechanism, that restricting the log-sum-exp penalty to $F\left(s\right)$ preserves the lower-bound structure the deployed control learner inherits informally. It motivates that mechanism rather than certifying the agent, whose behaviour is reported, as a non-confirmed hypothesis, in Section 5.5. Training uses only reachable events, those whose logged action lies inside the mask, which is 95.53% of test events.

2.6. The Expected-Conflict Functional

Because the recorded end of a reservation equals its requested end here (Section 3.1), a schedule satisfying C3 has exactly zero reservation-based overlap minutes, so that channel cannot separate masked policies. We replace it with expected conflict under the calibrated predictive model of Section 4.1.

Definition 3

(Predictive duration distribution). For event i let $q_{0.1}\le q_{0.5}\le q_{0.9}$ be its calibrated predicted duration quantiles, clipped below at one minute and sorted if the raw predictions invert, and put $L_i=\max (0,q_{0.1}-(q_{0.5}-q_{0.1}))$, $U_i=q_{0.9}+(q_{0.9}-q_{0.5})$. The duration $D_i$ has the CDF $F_i$ that is piecewise linear through the knots

$$(L_i,0),(q_{0.1},0.1),(q_{0.5},0.5),(q_{0.9},0.9),(U_i,1),$$

(9)

equal to 0 below $L_i$ and to 1 above $U_i$. Coinciding knots merge, retaining the largest CDF value, so $F_i$ is right-continuous and may carry atoms. Write ${\overline{F}}_i=1-F_i$ for the survival function and $E_i=a_i+D_i$ for the random end time.

The support is bounded by construction, and the linear tails, fixed in the preregistration, let non-meeting pairs be pruned exactly.

Assumption 1.

Throughout Section 2.6 and Section 5:

(A1) 

Independence: $D_i$ and $D_j$ are independent for $i\ne j$.

(A2) 

Deterministic starts: each reserved start $a_i$ is known and not random.

(A3) 

Pairwise accounting: the risk of a schedule is the sum of its same-stand pair terms; k-fold simultaneous occupancy is counted $\left({\displaystyle \genfrac{}{}{0pt}{}{k}{2}}\right)$ times.

(A4) 

One-sided buffer: the earlier occupancy’s end is inflated by β and the later occupancy’s start is not, so a pair contributes the expected overlap of $[a_i,E_i+\beta )$ with $[a_j,E_j)$.

Assumption 1 (A1) is the strongest: durations at one airport on one day share shocks (weather, an inbound delay wave), and positive dependence would raise joint tail risk, so the functional understates it, while (A3) inflates the absolute level on busy stands. Because these conventions are identical for every policy compared, a paired difference in ECM is a fair comparison within the calibrated occupancy-risk model that defines the functional. It is not model-free, and neither the absolute level nor, strictly, the sign is guaranteed to survive a materially different duration model or a strong positive-dependence correction (the sensitivity analysis is reported in Section 5.8).

Theorem 1

(Expected pairwise conflict in closed form). Let i and j be committed to the same stand and ordered so that i precedes j in the total order $(a,\mathit{event}\mathit{id})$ (so $a_i\le a_j$, with the event identifier breaking equal-start ties), and let $D_i,D_j$ follow Definition 3 under Assumption 1. Then the expected buffered overlap

$${\kappa }_{ij}=\mathbb{E}\left[{(\min (E_i+\beta ,E_j)-a_j)}^{+}\right]$$

(10)

satisfies

$${\kappa }_{ij}={\int }_{a_j}^{T_{ij}}{\overline{F}}_i\left(t-\beta -a_i\right){\overline{F}}_j\left(t-a_j\right)\mathrm{d}t,T_{ij}=\min \left(a_i+\beta +U_i,a_j+U_j\right),$$

(11)

and the integral evaluates exactly. Let $a_j=t_0<t_1<\cdots <t_K=T_{ij}$ be the ordered union of $\{a_j,T_{ij}\}$ with the knots of ${\overline{F}}_i(·-\beta -a_i)$ and of ${\overline{F}}_j(·-a_j)$ that fall in $[a_j,T_{ij}]$. On each segment write $h_k=t_k-t_{k-1}$, $m_k=\frac{1}{2}(t_{k-1}+t_k)$, and let $c_{1k},c_{2k}$ and $s_{1k},s_{2k}$ be the values and slopes of the two survival factors at $m_k$. Then

$${\kappa }_{ij}={\displaystyle \sum _{k=1}^K}\left(h_k{c}_{1k}{c}_{2k}+{\displaystyle \frac{h_k^3}{12}}{s}_{1k}{s}_{2k}\right).$$

(12)

If either $T_{ij}\le a_j$ or the buffered supports do not meet, then ${\kappa }_{ij}=0$.

Proof. 

We prove (11) here and (12) in Appendix A.1. Because $D_j\ge 0$ we have $E_j\ge a_j$, so

$${(\min (E_i+\beta ,E_j)-a_j)}^{+}={\int }_{a_j}^{\infty }\mathbf{1}\left\{E_i+\beta >t\right\}\mathbf{1}\left\{E_j>t\right\}\mathrm{d}t,$$

(13)

the integrand being the indicator of $[a_j,\min (E_i+\beta ,E_j))$, which is empty exactly when the positive part vanishes. Both factors are nonnegative and measurable, so Tonelli’s theorem allows exchanging expectation and integral, and (A1) factorises the expectation of the product,

$${\kappa }_{ij}={\int }_{a_j}^{\infty }\mathbb{P}(E_i+\beta >t)\mathbb{P}(E_j>t)\mathrm{d}t={\int }_{a_j}^{\infty }{\overline{F}}_i(t-\beta -a_i){\overline{F}}_j(t-a_j)\mathrm{d}t,$$

(14)

the second equality using (A2) to treat $a_i,a_j$ as constants. By Definition 3, the supports are bounded, so ${\overline{F}}_i(t-\beta -a_i)=0$ for $t\ge a_i+\beta +U_i$ and ${\overline{F}}_j(t-a_j)=0$ for $t\ge a_j+U_j$; truncating the upper limit at $T_{ij}$ therefore changes nothing, which is (11).    □

Equation (12) is exact, not a quadrature rule, and the implementation evaluates it verbatim; Appendix A.1 carries the segment algebra.

Remark 3

(Ordering at equal starts). Under the one-sided buffer (A4) ${\kappa }_{ij}$ depends on which member is treated as earlier when $a_i=a_j$, since only the earlier end is inflated. The total order $(a,\mathit{event}\mathit{id})$ fixes this tie deterministically, matching the code (risk.py sorts by (start_min, event_id) before pairing), and the same order fixes the later-starting member used for day attribution below. This specifies the convention the implementation already uses; no reported number changes.

Definition 4

(Daily risk functional). Let ${\mathcal{P}}_d$ be the counted pairs of day d: same stand, distinct reservation chains, later-starting member a decision of day d. With $N_d$ the number of requests the policy scored on day d,

$${\mathrm{ECM}}_d={\displaystyle \frac{100}{N_d}}\sum _{(i,j)\in {\mathcal{P}}_d}{\kappa }_{ij}.$$

(15)

We report the mean of ${\mathrm{ECM}}_d$ over evaluation days and call it expected conflict minutes per 100 reservations, ECM.

These conventions mirror the mask and are applied identically to all policies: C3’s same-chain exemption carries over, and day attribution keeps inherited boundary-versus-boundary pairs out of every policy’s account.

Corollary 1

(Monotonicity). Write $\delta =a_j-a_i-\beta$ for the effective separation of the pair. Then

$${\kappa }_{ij}\left(\delta \right)={\int }_0^{\infty }{\overline{F}}_i(\delta +u){\overline{F}}_j\left(u\right)\mathrm{d}u$$

(16)

is nonincreasing in δ; hence ${\kappa }_{ij}$ is nonincreasing in the start separation $a_j-a_i$ and nondecreasing in the buffer β. If in addition $D_i^{\prime }{⪯}_{\mathrm{st}}{D}_i$ in the usual stochastic order, then replacing $D_i$ by $D_i^{\prime }$ does not increase ${\kappa }_{ij}$, and symmetrically for j.

Proof. 

Substituting $t=a_j+u$ in (11) gives the displayed form; survival functions are nonincreasing, so $\delta \mapsto {\overline{F}}_i(\delta +u)$ is nonincreasing for every u and the integral inherits it. For the stochastic-order claim, $D_i^{\prime }⪯\mathrm{st}{D}_i$ means ${\overline{F}}_i^{\prime }\le {\overline{F}}_i$ pointwise, and the integrand is monotone in each nonnegative factor.    □

Note the direction: $\beta$ is a fixed convention of the metric, not a lever a policy pulls, and what lowers ECM is separating a pair in time.

Corollary 2

(Degeneracy and consistency with the mask). Suppose $D_i$ and $D_j$ are point masses at $d_i$ and $d_j$. Then

$${\kappa }_{ij}={(\min (a_i+d_i+\beta ,a_j+d_j)-a_j)}^{+},$$

(17)

the deterministic one-sided buffered overlap. In particular, for a distinct-chain pair ($c_i\ne c_j$) that satisfies C3 with reserved durations, ${\kappa }_{ij}=0$; consequently every mask-feasible schedule has ${\mathrm{ECM}}_d=0$ when evaluated with reserved durations in place of the predictive distributions.

Proof. 

Point masses make ${\overline{F}}_i\left(u\right)=\mathbf{1}\left\{u<d_i\right\}$, so the integrand in (11) is the indicator of $[a_j,\min (a_i+d_i+\beta ,a_j+d_j))$ and its integral is the length of that interval, or zero if empty. For the second claim, restrict to a distinct-chain pair, over which C3’s quantifier ranges (Definition 1); then $a_i\le a_j$ makes $e_j\le a_i-\beta$ unattainable, so C3 reduces to $a_j\ge a_i+d_i+\beta$, under which $\min (a_i+d_i+\beta ,a_j+d_j)-a_j\le 0$. The distinct-chain restriction is exactly the counted pair set of ${\mathrm{ECM}}_d$ (Definition 4), so the schedule-level conclusion is unaffected: a same-chain pair may carry positive ${\kappa }_{ij}$ but is never counted.    □

So ECM is a strict refinement of the mask, and the corollary also forces the identically zero risk term of the uncertainty-blind twin of Section 4.4, registered in advance and verified on test. Because (12) is exact only if implemented correctly, we validated it against Monte-Carlo simulation before any policy was tuned: on 30 validation days with 2000 inverse-CDF draws each, all 30 fell inside the preregistered tolerance, aggregate relative difference 0.00159 (Appendix A.2).

2.7. Reference Mixed-Integer Program

To quantify how much room the historical plan leaves, we also solve each sampled day jointly. Binary variables $x_{ig}$ over stands passing C1 and C2 carry C3 and C4 as in-model clique constraints, the objective being the cost form of (1) at the same locked weights; pairs whose buffered overlap is below 60 min keep a purchasable hard constraint priced at the reward’s conflict charge, heavier pairs get pure clique constraints, and boundary occupancies are fixed at their historical stands. It is a hindsight bound, not a method: it sees the whole day at once and knows every reserved duration in advance (Section 5.6).

3. Data

3.1. The Central Caveat, Stated First

The main event log records one interval per reservation, whose recorded end is its requested end; no separate realised end exists. Four duration quantities recur below and are kept distinct throughout. The requested duration is the interval length on the reservation record, fixed at booking and available at the decision epoch. The recorded duration is the interval length as stored in the operator log; on this snapshot it is identical to the requested duration by construction. The realised duration is the time the aircraft actually occupied the stand; it is not observable in this source and is never used. The predictive occupancy duration is the distribution produced by the calibrated quantile model of Section 4.1 from operational context that excludes the requested duration, and it is the object the risk functional integrates. Every downstream consequence in this paper follows from that single fact. Reservation-based overlap minutes are structurally zero for any schedule satisfying predicate C3 (Corollary 2), so that channel cannot rank masked policies. The airport also publishes a table of realised gate events, but its rolling two-week window (17 June 2026 to 30 June 2026) does not intersect the parking log, which ends 31 May 2026: zero rows join, and the planned-versus-actual check is not merely noisy but impossible on the current snapshots. This is why the conflict channel of Section 5 is the model-based functional of Theorem 1, and why every conflict claim in this paper is phrased as expected conflict under the calibrated occupancy-risk model.

3.2. Sources

Six public tables enter the pipeline, all open data. The main event log is the SFO parking-activity table (5rkh-waic), 194,503 rows over 213 consecutive calendar months, split into 157,273 call-in visits and 37,230 standing blocks, the latter with recurring daily expansions of one long-lived reservation, which is why predicate C3 needs its same-chain exemption; median occupancy is 8.25 h, first and 99th percentiles 1.25 and 98 h. The stand inventory (2ymc-znns) lists 287 stands with date-effective validity windows, a size category and a configuration flag: 220 hardstands and 67 gates, of which 182 are active today and 105 are not, and 186 are configured independent against 101 dependent, multi-large or multi-dependent. Because 34,195 historical events sit on stands inactive today, C1 reads the validity window and ignores the present status, and 53 historical stands are absent from the snapshot altogether. A tail-to-model reference (u7dr-xm3v, 8999 rows), the realised gate-event table (chfu-j7tc, 14,718 rows), NOAA Local Climatological Data v2 for station USW00023234 (261,352 hourly records) and the Bureau of Transportation Statistics On-Time Reporting Carrier database restricted to SFO (1,926,950 rows) complete the set. Licences and sources are given in the Data Availability Statement.

Linkage was measured at audit time: tail numbers resolve to an aircraft model for 98.23% of the rows carrying a tail, though 27.81% carry none at all, and on matched rows the recorded model agrees exactly for 96.96%; stand names resolve to the current inventory for 97.69% of rows and weather joins within three hours for 99.92% of feature rows. The BTS join is the weakest link by design, covering US domestic reporting carriers from 2019 onward, so only 56.09% of activity rows find a same-day flight record (60.98% within one day).

Quality checks are unremarkable in scale but were acted on: 1008 exactly duplicated business rows and 7 rows whose end precedes their start are dropped. A further 1596 rows (0.82%) start before the running maximum end on the same stand; these are genuine historical double-use, kept as recorded, and the dominant reason the mask does not reach 100% recall (Section 4.2).

3.3. Splits

Splits are rolling-origin and time-extrapolating; nothing is shuffled. After de-duplication, the windows hold 5776 warm-up events (1 September 2008 to 31 December 2009, excluded from training by convention), 138,132 training events (1 January 2010 to 31 December 2022), 28,153 validation events (1 January 2023 to 31 December 2024) and 21,434 test events over the 516 days from 1 January 2025 to 31 May 2026. Every calendar month in train, validation and test contains data. Volume in 2020 falls to 51% of 2019 but never breaks; we keep the period in training and expose it through a period indicator rather than excising it. The inventory a split sees shifts materially across windows, 132 distinct stands appearing in test against 248 in train, which is one source of the time-extrapolation decay reported in Section 5.2.

The test window was read for the preregistered evaluation exactly once, after every configuration had been locked on validation. This is a claim about the preregistered round, not about the split’s whole history: Section 4.7 states the protocol and tabulates every test-set contact across all rounds.

4. Methods

4.1. Calibrated Occupancy-Duration Model

The predictive distributions of Definition 3 come from a LightGBM [12] quantile model of occupancy duration, trained at $\tau \in \{0.1,0.5,0.9\}$ under the pinball loss [13] against the recorded duration in minutes. The following is what the predictive distribution represents. Because the recorded end of a reservation equals its requested end on this snapshot (Section 3.1), the label is the requested duration, and that value is on the record at the decision epoch. The model is therefore not forecasting a quantity that is unknown when the stand is chosen. What it estimates is the conditional distribution of occupancy duration across comparable movements, given aircraft category, operating company, calendar and time-of-day position, weather and leakage-safe expanding history, with the requested duration itself withheld from the feature set. The spread it reports is between-movement variability for operations of this kind; it is not the deviation of an individual aircraft’s actual occupancy from its own request, which this data source cannot observe. The risk term consumes that spread as a planning hedge: a candidate stand is scored by the overlap expected if this movement behaves like comparable movements, rather than by treating the single requested value as exact. Whether between-movement spread is a good proxy for within-movement uncertainty about actual occupancy is not testable here, and Section 6.5 records that as a scope condition rather than a demonstrated property.

Feature construction is leakage-safe by exclusion: the requested end and duration are dropped because they equal the label here, the assigned stand, its area prefix and the area load at start because they are outcomes of the decision the model informs, and the raw tail number for cardinality. What remains is aircraft model, operating company, calendar and time-of-day structure, weather, BTS flight context, and stacked expanding company-by-model duration quantiles computed strictly from events completed before the decision date, which is the leakage rule the rule baseline also obeys. Twelve configurations were compared on validation pinball loss, crossing an absolute against a residual parameterisation, raw against $\log (1+x)$ target scaling and two capacity settings; the winner fits $\log (1+x)$ residuals around the expanding pair-quantile anchor supplied as an initial score, with 127 leaves and a minimum of 100 samples per leaf, five seeds combined by the per-level median and rearranged to restore monotonicity, needed for 7772 events across all splits. Intervals are calibrated by split-conformal conformalized quantile regression [14] on validation only ($\alpha =0.2$, fitted correction $\widehat{q}=0.0077$ on the $\log (1+x)$ scale), so validation coverage is partly by construction and test coverage the honest generalisation check; we report both, with the pinball loss, a strictly consistent scoring function for the quantile functional [15].

4.2. Mask Construction and Candidate Sets

Predicates C1–C4 are materialised once into a candidate table of 21,161,217 request-by-stand rows with per-predicate flags and decision-time features. Feasible sets are large (mean 109.3 stands overall, 131.4 on test, 10th and 90th percentiles 85 and 134), so the mask constrains without starving the scorer, and C2 falls back to its flagged global compatibility window on 4.844% of feasible rows. Empty feasible sets occur for 363 events (0.19%), all inside the excluded warm-up window, and no train, validation or test request ever has one, which is why the deferral rate is zero for every policy in Section 5. Mask recall, the share of requests whose historical stand lies inside the feasible set, is 93.53% overall, 96.94% on validation and 95.53% on test; the dominant residual cause is C3, history having placed different reservation chains on one stand less than a buffer apart 5548 times. Those are precisely the conflicts the policy is asked to avoid, so counting them infeasible is intended behaviour rather than mask error, at the price of an upper bound below one on any agreement-with-history metric.

4.3. Imitation Rankers

Four scoring functions imitate the historical planner, each trained on the feasible candidate sets with the historical choice as the positive. B1 is a rule rather than a learner, preferring the area of the reservation’s recorded stand and, within it, the feasible stand with the largest temporal buffer; B2 is an XGBoost [16] ranker trained with the LambdaMART objective [17,18] on 40 sampled negatives per request; B3 a listwise multilayer perceptron over the same features; B4 a relational graph attention network [19,20] over a heterogeneous request-stand graph with same-area, pad-variant and request-stand relations. Every learned ranker uses five seeds combined into a mean-score ensemble, with a frequency rule over company-by-stand counts as a floor. The preregistered round added two attempts to improve on B2: the hybrid ranker concatenates the seed-matched 64-dimensional penultimate representation of the frozen GAT to the B2 feature stack, stored as $\log (1+x)$ in half precision, and the blend normalises each model’s ensemble score to a per-request ordinal rank and takes a convex combination, weights chosen on validation from a simplex grid of step 0.05 (0.70 on XGBoost, 0.30 on the GAT, zero on the MLP).

4.4. Uncertainty-Aware Policy and Its Blind Twin

The uncertainty-aware policy ${\pi }_{\mathrm{unc}}$ is a masked greedy policy in the sense of Definition 2, whose scorer subtracts a risk term from the frozen imitation score:

$$\begin{array}{cc}\hfill {\pi }_f(i,g)& =\mathrm{base}(i,g)-\lambda R_{90}(i,g),\hfill \\ \hfill R_{90}(i,g)& =\sum _{j\in H\left(g\right),c_j\ne c_i}\left|[a_i,a_i+q_{0.9}^i+\beta )\cap [a_j,a_j+q_{0.9}^j)\right|.\hfill \end{array}$$

(18)

Here, $\mathrm{base}$ is the frozen five-seed B2 ensemble score (no ranker is retrained) and $q_{0.9}$ the calibrated 0.9 knot of Definition 3, so the risk term is a point summary of the predictive distribution evaluated against the occupancies already committed to the candidate stand, including the inherited boundary. The weight $\lambda$ was selected on validation from the preregistered grid $\{0.25,0.5,1,2,4,8,16\}$, the whole grid counting as one development iteration; the argument minimum was ${\lambda }^{\star }=16$, at the grid edge, though the curve is flat above $0.5$ and the improvement from 8 to 16 is 0.04 ECM.

The blind twin ${\pi }_{\mathrm{blind}}$ is the same functional form with reserved durations substituted for the predicted $q_{0.9}$ quantiles. Corollary 2 predicts what happens: C3 already forbids reserved-time overlap on the feasible set, so the reserved-duration risk term is identically zero and ${\pi }_{\mathrm{blind}}$ collapses to plain greedy scoring on $\mathrm{base}$, which is exactly the B2 policy. Registered as a structural observation before the evaluation, this was verified decision by decision: 0 mismatches out of 28,153 validation and 0 out of 21,434 test decisions. The twin is therefore not an independent baseline but a mechanism ablation, holding ranker, mask, replay and tie-breaks fixed and removing only the information channel; the like-for-like decision-quality comparison is against B1, which never sees the occupancy model at all.

4.5. Masked Offline Reinforcement Learning

The offline agent is a discrete conservative Q-learner [11] over the masked candidate set. Infeasible actions receive $-\infty$ logits, so both the greedy policy and the CQL log-sum-exp regulariser range over $F\left(s\right)$ only, the algorithmic mirror of Proposition 1, unit-tested against perturbed masks. Training and evaluation use the identical objective, the three-term composite reward ($w_c$ expected conflict, $w_p$ preference, $w_h$ churn) with the size-mismatch term of (1) excluded from both per the preregistration and reported only descriptively, so there is no train/evaluation mismatch. The conflict term is the marginal expected-conflict contribution of a decision, the sum of ${\kappa }_{ij}$ over pairs it creates; attribution is exact, since summing contributions over a day reproduces the schedule-level total, an identity we verify directly. Training uses 91,164 logged transitions from reachable training events from 2015 onward. One asymmetry is structural, shared by every method’s training data: on logged transitions the behaviour policy is the history, so the churn term is identically zero there and acts only at evaluation time on counterfactual trajectories, leaving the agent to learn from an expected-conflict and preference signal alone. That is a property of the data, not a difference in objective, and it shapes the result in Section 5.5.

The network is warm-started for two epochs by distilling the frozen B2 ensemble score, then trained for six CQL epochs with learning rate ${10}^{-3}$, batches of 256 requests, target-network exponential moving average 0.005 and a Huber loss. Only two knobs were tuned, over three validation iterations: the conservatism weight $\alpha$ and the discount $\gamma$, ending at ${\alpha }^{\star }=0.01$, $\gamma =0.8$. Three seeds are combined by averaging Q-values and the policy is the masked greedy argument maximum of that mean. An implicit Q-learning agent [21] with expectile parameter 0.7 and every shared hyperparameter copied from the locked CQL configuration serves as a non-confirmatory ablation; nothing was selected on it.

4.6. Replay Protocol and Metrics

Evaluation replays each historical day as one episode: requests arrive in reserved-start order, the episode is initialised with the boundary occupancies inherited from previous days at their historical stands, and the committed schedule updates after every decision, so a policy sees the consequences of its own earlier choices. All policies replay the same days from the same initial condition, making the day the natural resampling unit for the paired statistics below. Recorded per day are the model-based ECM of Definition 4; reservation-based overlap per 100 requests, retained for continuity with the historical plan though Corollary 2 makes it zero for every masked policy; agreement, the share of requests placed on the historical stand, and churn its complement, both imitation-fidelity diagnostics; defer rate; and mask violations, which Proposition 1 predicts to be zero.

4.7. Statistics and Preregistration

All comparisons are day-paired: we form the per-day endpoint difference and estimate its mean with a percentile bootstrap over 10,000 resamples [22], resampling whole days so that within-day dependence is preserved. Days are not independent of one another, however: the per-day difference series is serially correlated (Section 5.4), so the primary interval is reported alongside a moving-block bootstrap [23] across block lengths of 1 to 28 days, and we treat the block-length sweep rather than any single length as the interval statement. We test each difference with a two-sided Wilcoxon signed-rank test [24], reporting the number of non-zero days, and quantify effect size with Cliff’s $\delta$ [25], computed over the cross product of the two per-day samples and therefore measuring unpaired stochastic dominance. Because the design is day-paired we also report the matched-pairs rank-biserial correlation, formed from the signed ranks of the per-day differences; the two answer different questions and we give both. The preregistration labels the whole-day procedure the “day-block bootstrap”, after the block resampling of [23]. Every interval quoted in the results is the whole-day percentile interval; where the block-length sweep is relevant it is reported explicitly alongside it (Section 5.4). Multiplicity is controlled by Holm’s step-down procedure [26] within the preregistered family.

Five things were frozen before any iteration ran: hypotheses H-A to H-D, their endpoints and comparator sets, the decision rule, the $\lambda$ and weight grids, and the ECM definition of Section 2.6. The decision rule requires Holm-corrected $p<0.05$ and a 95% confidence interval excluding zero and a point estimate in the registered direction, over a family of $m=6$ comparisons. The protocol was fixed before the first iteration; development used train and validation only, and each track had a budget of at most three validation iterations. For this preregistered round, the frozen test split of 516 days was read exactly once, with every endpoint produced from that single reading, and no configuration reported here was selected on it. Three deviations, all definitional clarifications, were recorded before that evaluation.

That “exactly once” is specific to the preregistered round and does not imply the split had never been touched: Table 2 enumerates every contact across all rounds. Of the contacts that occurred before and after it, none selected a reported configuration, and only this round was preregistered.

Table 2. Every contact with the frozen test split across the project’s history. No contact selected a configuration reported here; all selection decisions were made on validation, and only this round was preregistered. Reads are enumerated, not summarised.

Round/Stage	Reads	What Was Inspected	What Was Selected on It
Occupancy-duration forecaster (v1 development)	3	test pinball and coverage of two earlier model iterations plus the final model	nothing; grid winner, conformal scale and seed-combine all chosen on validation
Earlier full-pipeline evaluation	1	the full replay battery of that round	nothing preregistered; reported as the baseline record
Preregistered one-shot	1	all six family-F3 endpoints simultaneously	nothing; every track was locked on validation before the read
Revision round, referee-requested	1	four post-hoc robustness analyses run as one batch: a second calibrated duration model, a positive-dependence stress test, k-way overlap accounting, and an uncertainty-consuming comparator outside the proposed scoring rule	nothing; no preregistered endpoint was recomputed, no locked configuration altered, and none of the four enters the family-F3 correction

All computations were run in Python 3.13.9 (Python Software Foundation, Beaverton, OR, USA) with LightGBM 4.6.0 (Microsoft Corporation, Redmond, WA, USA) for the occupancy-duration model; XGBoost 3.2.0 (https://xgboost.ai), PyTorch 2.12.0 (https://pytorch.org) and PyTorch Geometric 2.8.0 (https://pytorch-geometric.readthedocs.io) for the rankers and offline-RL agents; PuLP 3.3.0 with the COIN-OR CBC solver (https://github.com/coin-or/pulp) for the reference program; and SciPy 1.16.0 (https://scipy.org) for the statistical tests.

5. Results

Every number here is transcribed from the recorded results: the preregistered quantities from the single one-shot reading of the 516-day test split, and the comparison quantities from the earlier full-pipeline evaluation on the same split. Section 5.4 collects all six preregistered comparisons, with verdicts and paired statistics, in one table.

5.1. The Occupancy-Duration Model Is Calibrated and Beats Its Baselines

The forecaster passes its preregistered gate on both splits: on test its mean pinball loss is 205.08 min against 243.79 for a point-$L_1$ model emitting the same value at all three levels and 209.50 for the historical company-by-model expanding-quantile baseline (Table 3). Day-paired over the 516 test days the improvement over the historical baseline is $-4.18$ min/day, 95% CI $[-7.74,-1.48]$, Holm-corrected $p=0.0094$, $\delta =-0.017$; over the point model, $-37.96$ min/day $[-42.23,-34.29]$, Holm $p=6.2\times {10}^{-86}$, $\delta =-0.488$. The margin over the historical baseline is small and we say so: 2.1% of the loss, comparable to the across-seed standard deviation, and at the 0.9 level the ensemble and the historical baseline are essentially tied on test (310.03 vs. 310.74).

Table 3. Occupancy-duration forecaster comparison on validation and test. Test is never used for selection.

Forecaster	MAE (P50)	Pinball	Pinball	Pinball	Pinball	80%	Calib.
	(min)	P10	P50	P90	Mean	Coverage	Error
Validation
LGBM quantile + CQR (ours)	553.82	69.69	276.91	321.58	222.73	0.800	0.052
LGBM quantile, uncalibrated	553.82	69.76	276.91	321.79	222.82	0.789	0.052
LGBM point $L_1$ (all three levels)	554.10	125.48	277.05	428.62	277.05	0.000	—
Historical company × model quantiles	593.22	75.39	296.61	386.54	252.85	0.800	0.113
Test
LGBM quantile + CQR (ours)	486.90	61.75	243.45	310.03	205.08	0.782	0.065
LGBM quantile, uncalibrated	486.90	61.84	243.45	309.70	205.00	0.774	0.067
LGBM point $L_1$ (all three levels)	487.58	130.56	243.79	357.02	243.79	0.000	—
Historical company × model quantiles	508.17	63.66	254.09	310.74	209.50	0.797	0.098

All losses in original minutes; lower is better except coverage, whose target is 0.80. The point-$L_1$ row emits the same value at all three levels, hence zero interval coverage. The preregistered forecaster gate (G1) passes on validation and test against both meaningful baselines. The reserved-duration “baseline” is excluded: it has zero error by construction here (reserved end = recorded end), so it is not a forecast. Validation coverage is partly by construction, the split-conformal (CQR) correction being calibrated on validation only ($\widehat{q}=0.0077$, $\alpha =0.2$, $n=\mathrm{28,153}$); test coverage is the honest check. MAE, mean absolute error; P10/P50/P90, 0.1/0.5/0.9 quantiles; Calib., calibration; LGBM, LightGBM; CQR, conformalized quantile regression.

Coverage of the nominal 80% central interval is 0.800 on validation and 0.782 on test (Figure 2, left), the validation figure partly by construction and the test figure the honest check, inside the preregistered tolerance band. A controlled ablation holding configuration, seeds and calibration fixed shows what the BTS flight context is worth here: $-3.04$ min/day of pinball loss $[-3.47,-2.58]$, $p=1.1\times {10}^{-59}$. The same features are worth nothing measurable to the imitation layer (Section 5.7), a clean separation of where an external signal helps.

Figure 2. (Left) Calibration of the occupancy-duration forecaster: quantile reliability on (a) validation ($n=\mathrm{28,153}$) and (b) test ($n=\mathrm{21,434}$) for the calibrated LightGBM model against the historical expanding-quantile baseline, and (c) coverage of the nominal 80% interval; numbers in Table 3. (Right) Preregistered negative result H-A: frozen graph-attention embeddings do not help the XGBoost ranker. The day-paired difference in reachable hit@1 is $\Delta =-1.19$ pp $[-1.76,-0.63]$, Holm $p=4.9\times {10}^{-5}$ over $n=516$ days, significant opposite to the registered direction, so H-A is not confirmed. Event-pooled hit@1 by year puts the deficit in 2025 (plain 0.4456 vs. hybrid 0.4278) and is roughly flat in 2026, where the hybrid is marginally higher (0.3036 vs. 0.3063). LGBM, LightGBM; CQR, conformalized quantile regression; hist., historical baseline; val, validation; XGB, XGBoost; GAT, graph attention network; pp, percentage points.

5.2. Imitation Boundary Conditions

Four attempts to beat gradient boosting at imitating the historical planner all fail, two under preregistration.

5.2.1. Architecture

On test the XGBoost ensemble reaches hit@1 0.3971 against 0.3583 for the graph attention network, 0.3575 for the listwise perceptron and 0.2715 for the frequency rule (Table 4); day-paired, the graph model loses to gradient boosting by $-4.20 \mathrm{pp}$ $[-4.80,-3.60]$, Holm $p=7.6\times {10}^{-33}$, $\delta =-0.236$, but ties the perceptron at an equal five-seed budget, $+0.05 \mathrm{pp}$ $[-0.44,+0.54]$, Holm $p=0.86$. The architecture-decisive statement is therefore narrow: graph attention does not beat gradient boosting on these tabular features, and we claim nothing about it against the perceptron.

Table 4. The imitation channel on the 516 test days. Left columns: top-k feasible hit rates over the reachable denominator. Right columns: the replay summary of the earlier full-pipeline evaluation, as day means.

Ranker/Policy	Test Hit Rate			Replay Over 516 Days
	@1	@3	@5	Agreem.	Churn	Confl.	Mask
				Rate	Rate	min/100	viol.
B0 historical plan (unmasked)	—	—	—	1.0000	0.0000	373.25	959
B1 same-area rule	—	—	—	0.1295	0.8705	0.00	0
Frequency rule (company × stand)	0.2715	0.5073	0.6124	0.2099	0.7901	0.00	0
B2 XGBoost LambdaMART	0.3971	0.6647	0.7706	0.3272	0.6728	0.00	0
B3 listwise MLP	0.3575	0.6008	0.6997	0.2940	0.7060	0.00	0
B4 relational GAT	0.3583	0.6111	0.7146	0.2874	0.7126	0.00	0
Hybrid XGB + GAT embeddings	0.3863	0.6385	0.7378	—	—	—	—
Rank-normalised blend (0.7 XGB + 0.3 GAT)	0.3937	0.6508	0.7476	—	—	—	—

Learned rankers are five-seed ensembles; the reachable denominator is the 95.53% of test events whose historical choice lies inside the feasible set. Deferral rate is 0.0 for every policy. Reservation-based overlap is structurally zero for every masked policy; only the unmasked historical plan accrues it, through 959 choices the mask would have rejected. Zero mask violations is the empirical counterpart of Proposition 1. XGB, XGBoost; MLP, multilayer perceptron; GAT, graph attention network; Agreem., agreement; Confl., conflict; viol., violations.

5.2.2. Graph Structure as a Feature Extractor (H-A, Not Confirmed)

Concatenating the frozen graph model’s penultimate representation to the boosted ranker was preregistered to raise hit@1; it lowers it, by $-1.19 \mathrm{pp}$ $[-1.76,-0.63]$, Holm $p=4.9\times {10}^{-5}$, $\delta =-0.064$ over 516 days, significant opposite to the registered direction. The deficit sits in 2025 (event-pooled hit@1 0.4456 plain against 0.4278 hybrid) and essentially vanishes in 2026 (0.3036 against 0.3063; Figure 2, right). The mechanism is visible in development: the embeddings are in-sample on training rows, so the booster over-trusts them and early stopping truncates before the ordinary features are learned, two seeds stopping at a single tree. All three variants tried on validation (raw 64-dimensional, scalar score, 16 principal components) were negative, so none survived even the development split.

5.2.3. Score Blending (H-B, Not Confirmed)

A rank-normalised convex blend, weights chosen on validation, was preregistered to beat the best single ranker. On validation it gained $+0.13\mathrm{pp}$, not significant ($p=0.23$); on test it loses $-0.32 \mathrm{pp}$ $[-0.54,-0.10]$, Holm $p=0.0104$, so the validation-selected gain reversed and the reversal is itself significant. A gain of that size, selected over a 231-point grid, is indistinguishable from selection noise until a frozen split says otherwise.

5.3. Replay Agreement

Under replay the same ordering holds on agreement with the historical plan: 0.327 for the boosted ranker, 0.294 for the perceptron, 0.287 for the graph model, 0.210 for the frequency rule and 0.129 for the same-area rule (Table 4), the boosted ranker beating the rule by $+19.77 \mathrm{pp}$ $[+18.98,+20.54]$, Holm $p=2.3\times {10}^{-85}$, $\delta =0.888$. Agreement decays from 0.364 in 2025 to 0.238 in 2026, the expected cost of extrapolating across a changing inventory, and is capped below one by the 95.53% mask recall. Reservation-based overlap is 0.00 per 100 requests for every masked policy and 373.25 for the unmasked historical plan, which is exactly what Corollary 2 predicts.

5.4. Uncertainty-Aware Allocation: The Headline Result

The uncertainty-aware policy attains a day-mean ECM of 615.9 against 1175.5 for the B1 same-area rule: a 48% reduction in model-based expected conflict under the calibrated occupancy-risk model, day-paired $\Delta =-559.6$, 95% CI $[-674.0,-451.2]$, Wilcoxon $p=1.0\times {10}^{-13}$, Holm-corrected $p=3.0\times {10}^{-13}$, Cliff’s $\delta =-0.136$, all 516 days contributing a non-zero difference (Table 5). The per-day difference series is serially dependent (lag-1 autocorrelation $+0.546$; Ljung–Box on 14 lags $p=1.7\times {10}^{-208}$), so we also report the interval under a moving-block bootstrap: it excludes zero at every block length from 1 to 28 days, widening from $[-674.0,-451.2]$ at one day to $[-938.1,-185.0]$ at 28. The matched-pairs rank-biserial effect size is $-0.378$. We lead with this comparison because B1 never sees the occupancy model. The ratio-of-sums view agrees, $-6.67$ $[-7.87,-5.54]$ ECM per unit of exposure, as do the medians, 558.7 against 788.7; dispersion also collapses, the day-level standard deviation being 311.1 for ${\pi }_{\mathrm{unc}}$ against 1255.7 for B1.

Table 5. The six preregistered comparisons of family F3, evaluated in a single one-shot reading of the test split.

Hyp.	Comparison (Daily Endpoint)	A	B	$\Delta$ [95% CI]	Holm p	$\mathit{\delta }$	Dir.	Pass
H-A	hybrid − plain XGB, hit@1 (pp)	39.98	41.18	−1.19 [−1.76, −0.63]	$4.9\times {10}^{-5}$	−0.064	+	✗
H-B	blend − XGB ens., hit@1 (pp)	40.86	41.18	−0.32 [−0.54, −0.10]	0.01036	−0.014	+	✗
H-C	${\pi }_{\mathrm{unc}}$− blind twin, ECM/100	615.9	7142.6	−6526.7 [−6774.8, −6283.7]	$1.9\times {10}^{-85}$	−1.000	−	✓
H-C	${\pi }_{\mathrm{unc}}$− B1 rule, ECM/100	615.9	1175.5	−559.6 [−674.0, −451.2]	$3.0\times {10}^{-13}$	−0.136	−	✓
H-D	CQL − B2 ens., reward	−37.63	−71.74	+34.11 [+32.27, +35.94]	$8.1\times {10}^{-83}$	+0.744	+	✓
H-D	CQL − B1 rule, reward	−37.63	−12.14	−25.50 [−27.74, −23.36]	$1.8\times {10}^{-76}$	−0.771	+	✗

Verdicts. H-A: NOT CONFIRMED, H-B: NOT CONFIRMED, H-C: CONFIRMED, H-D: NOT CONFIRMED. Decision rule frozen before the split was read (Section 4.7); family size $m=6$; no re-runs, post hoc subsets or metric swaps. $n=516$ paired test days per comparison; CIs are percentile intervals resampling whole days (10,000 resamples), the block-length sensitivity of the headline interval being reported in Section 5.4; $\delta$ is Cliff’s delta; “Dir.” is the preregistered sign. ECM is model-based: expected conflict under the calibrated occupancy-risk model of Theorem 1, not reservation-based overlap (which is structurally zero on this snapshot). Hyp., hypothesis; XGB, XGBoost; ens., ensemble; CQL, conservative Q-learning; CI, confidence interval; pp, percentage points.

Against its uncertainty-blind twin the gap is an order of magnitude larger, $\Delta =-6526.7$ $[-6774.8,-6283.7]$, Holm $p=1.9\times {10}^{-85}$, $\delta =-1.000$, with ${\pi }_{\mathrm{unc}}$ lower on all 516 of 516 days. That contrast is a mechanism ablation, not a co-equal baseline: as Section 4.4 predicted from Corollary 2, the blind twin’s risk term is identically zero and it coincides with the B2 imitation policy, verified with 0 mismatches over 21,434 test decisions. Removing only the information channel therefore isolates what consuming the uncertainty estimates is worth: nearly all of the gap between imitating history and managing risk (Figure 3).

Figure 3. Expected conflict by policy over the 516 preregistered one-shot test days. Every quantity is model-based expected conflict under the calibrated occupancy-risk model of Theorem 1, not reservation-based overlap, which is structurally zero for every masked policy on this snapshot. The headline is ${\pi }_{\mathrm{unc}}$ 615.9 against B1 1175.5, a 48% reduction, because B1 never sees the occupancy model; the uncertainty-blind twin (7142.6) is a mechanism ablation, not a co-equal baseline, since it provably coincides with the B2 policy (0/21,434 mismatches) and so isolates the information channel rather than the ranker. CQL (3728.9) and the IQL ablation (7599.5) are shown for reference. Bars are day means with percentile bootstrap 95% intervals resampling whole days (10,000 resamples), logarithmic ordinate; statistics in Table 5 and Table 6. CQL, conservative Q-learning; IQL, implicit Q-learning; RL, reinforcement learning; XGB-BC, XGBoost behaviour cloning.

Figure 3. Expected conflict by policy over the 516 preregistered one-shot test days. Every quantity is model-based expected conflict under the calibrated occupancy-risk model of Theorem 1, not reservation-based overlap, which is structurally zero for every masked policy on this snapshot. The headline is ${\pi }_{\mathrm{unc}}$ 615.9 against B1 1175.5, a 48% reduction, because B1 never sees the occupancy model; the uncertainty-blind twin (7142.6) is a mechanism ablation, not a co-equal baseline, since it provably coincides with the B2 policy (0/21,434 mismatches) and so isolates the information channel rather than the ranker. CQL (3728.9) and the IQL ablation (7599.5) are shown for reference. Bars are day means with percentile bootstrap 95% intervals resampling whole days (10,000 resamples), logarithmic ordinate; statistics in Table 5 and Table 6. CQL, conservative Q-learning; IQL, implicit Q-learning; RL, reinforcement learning; XGB-BC, XGBoost behaviour cloning.

Table 6. One-shot test policy summary: model-based expected conflict, composite reward, and behavioural diagnostics.

Policy	ECM/100 Requests		Composite Reward	Agreement Rate	Churn Rate	Defer Rate	Mask Violations
	Mean	Median
${\pi }_{\mathrm{unc}}$ (uncertainty-aware)	615.9	558.7	−6.50	0.2707	0.7293	0.0	0
B1 same-area rule	1175.5	788.7	−12.14	0.1295	0.8705	0.0	0
Blind twin (≡B2 XGB-BC) a	7142.6	6692.8	−71.74	0.3272	0.6728	0.0	0
Masked discrete CQL (ensemble)	3728.9	3181.6	−37.63	0.2348	0.7652	0.0	0
IQL ablation (ensemble) b	7599.5	7020.1	−76.48	0.0107	0.9893	0.0	0

^a The blind twin provably coincides with the B2 greedy policy (0/21,434 test mismatches), so it is a mechanism ablation isolating the information channel, not a co-equal baseline. ^b IQL is a non-confirmatory descriptive ablation, not part of the preregistered family. Day means (and medians) over the 516 one-shot test days; composite reward per request uses the locked weights, higher is better. Defer rate 0.0 and mask violations 0 for every policy: no request reached an empty feasible set, and Proposition 1 is verified on test for every policy, the offline-RL ones included. ECM is model-based expected conflict under the calibrated occupancy-risk model (Theorem 1), not reservation-based overlap. ECM, expected conflict minutes; XGB-BC, XGBoost behaviour cloning; CQL, conservative Q-learning; IQL, implicit Q-learning.

Table 6. One-shot test policy summary: model-based expected conflict, composite reward, and behavioural diagnostics.

Policy	ECM/100 Requests		Composite Reward	Agreement Rate	Churn Rate	Defer Rate	Mask Violations
	Mean	Median
${\pi }_{\mathrm{unc}}$ (uncertainty-aware)	615.9	558.7	−6.50	0.2707	0.7293	0.0	0
B1 same-area rule	1175.5	788.7	−12.14	0.1295	0.8705	0.0	0
Blind twin (≡B2 XGB-BC) a	7142.6	6692.8	−71.74	0.3272	0.6728	0.0	0
Masked discrete CQL (ensemble)	3728.9	3181.6	−37.63	0.2348	0.7652	0.0	0
IQL ablation (ensemble) b	7599.5	7020.1	−76.48	0.0107	0.9893	0.0	0

^a The blind twin provably coincides with the B2 greedy policy (0/21,434 test mismatches), so it is a mechanism ablation isolating the information channel, not a co-equal baseline. ^b IQL is a non-confirmatory descriptive ablation, not part of the preregistered family. Day means (and medians) over the 516 one-shot test days; composite reward per request uses the locked weights, higher is better. Defer rate 0.0 and mask violations 0 for every policy: no request reached an empty feasible set, and Proposition 1 is verified on test for every policy, the offline-RL ones included. ECM is model-based expected conflict under the calibrated occupancy-risk model (Theorem 1), not reservation-based overlap. ECM, expected conflict minutes; XGB-BC, XGBoost behaviour cloning; CQL, conservative Q-learning; IQL, implicit Q-learning.

5.4.1. The Gain Is Not Bought by Refusing to Decide

A risk-penalising policy could trivially lower expected conflict by deferring hard requests or scattering aircraft across the field; neither happens. The deferral rate is exactly 0.0 for every policy, no request ever reaching an empty feasible set (Section 4.2), and ${\pi }_{\mathrm{unc}}$ assigns a stand to all 21,434 test requests. Its churn rate, 0.729, sits below B1’s 0.871 and above the blind twin’s 0.673: the risk term trades some imitation fidelity (agreement 0.271 against 0.327) for a large reduction in expected conflict while departing from the historical plan less often than the rule it beats. Counted conflict pairs per day fall to 13.7 for ${\pi }_{\mathrm{unc}}$ from 33.7 for the blind twin, with B1 at 8.3: B1 achieves few pairs by spreading aircraft at a heavy agreement cost, while ${\pi }_{\mathrm{unc}}$ reaches lower expected conflict with more pairs, because the pairs it creates are well separated (Table 6).

5.4.2. What Validation Said First

On validation, the same policy reached 634.7 ECM against 955.6 for B1 (the level implied by the paired mean difference $\Delta =-320.9$ $[-421.1,-226.2]$; B1’s tabulated day-mean is 955.5), but the day-level effect size was slightly positive ($\delta =+0.061$): the mean favoured ${\pi }_{\mathrm{unc}}$ while the median validation day favoured B1. On test both agree ($\delta =-0.136$). We report both rather than the more flattering one.

5.5. Safe Offline Reinforcement Learning: A Partial Result

Masked discrete conservative Q-learning was preregistered to beat both the imitation ensemble and the rule on the composite reward; it beats one. Per day the ordering is ${\pi }_{\mathrm{unc}}$ $-6.50$, the rule $-12.14$, CQL $-37.63$, the imitation ensemble $-71.74$. Against the ensemble CQL gains $+34.11$ $[+32.27,+35.94]$, Holm $p=8.1\times {10}^{-83}$, $\delta =+0.744$, satisfying every criterion; against the rule it loses $-25.50$ $[-27.74,-23.36]$, Holm $p=1.8\times {10}^{-76}$, in the wrong direction. The preregistered rule required both, so H-D is not confirmed and no claim of reinforcement-learning superiority appears anywhere in this paper.

On the conflict channel CQL lands between the two at 3728.9 ECM, $-3413.8$ $[-3596.6,-3229.7]$ below the imitation ensemble and $+2553.4$ $[+2340.2,+2778.2]$ above the rule. The offline agent does learn to avoid expected conflict relative to the behaviour it was distilled from, but stops well short of a rule that simply maximises temporal buffer, and much further short of ${\pi }_{\mathrm{unc}}$, which reaches 615.9 using the very same base scores (Section 6 argues why). Feasibility held throughout: zero mask violations for the ensemble and for each of the three seeds.

The conservatism parameter behaves as the mechanism formalised by Proposition 2 would suggest, though that proposition concerns the policy-evaluation fixed point, not this control learner (Remark 2). Lowering $\alpha$ from 1.0 to 0.1 to 0.01 on validation released the policy from the behaviour prior monotonically (agreement $0.368\to 0.336\to 0.271$, ECM $5243\to 3377\to 2681$), improving the reward at every step and never producing a violation. The sweep is qualitatively consistent with the conservatism interpretation; it is three points, not a proof.

The implicit Q-learning ablation, run once with every shared hyperparameter copied from the locked CQL configuration and nothing selected on it, collapses: reward $-76.48$ per day, ECM 7599.5, agreement 0.011, churn 0.989, and 52% of its assignments sent to gates against 1.4% for the imitation ensemble. Learning Q only on logged actions, without the conservative term ranging over the whole feasible set, discards the behavioural anchoring the warm start provided; that the anchoring term is load-bearing is a useful negative for anyone instantiating offline RL under a mask.

5.6. Optimality Reference

On 20 test days sampled across the volume range, the day-joint mixed-integer program of Section 2.7 solved to proven optimality in 20 of 20 cases. Mean objective headroom over the historical plan is 66.41 units per day, 62.2% of the historical objective or 157.9 per 100 requests; the median is 22.16, 6 of the 20 days have no headroom at all, and the optimal plans buy it cheaply, moving 1.45 requests per day off their historical stand. This is a hindsight bound, not a method we propose: the program decides the whole day at once with every reserved duration known, where the planner decided sequentially under uncertainty. Its use is as a scale, showing that the sequential policies operate in a problem with a large objective gap in principle, so the differences between them are not squeezed against a ceiling.

5.7. Extreme Days and Feature Ablations

A subset of 52 test days (top decile by reservation volume crossed with weather severity, defined before this round and outside the preregistered family) preserves every sign of the headline. There, ${\pi }_{\mathrm{unc}}$ reaches 609.8 ECM against 1640.1 for the rule, $\Delta =-1030.2$ $[-1468.4,-634.8]$, and against the blind twin $-6466.8$ $[-7217.2,-5753.1]$; the rule’s risk rises by 46% on extreme days (1640.1 against 1123.4 on ordinary days) while ${\pi }_{\mathrm{unc}}$ barely moves (609.8 against 616.6). The unmasked historical plan accrues 545.9 reservation-based overlap minutes per 100 requests on extreme days against 353.9 on the rest, and agreement falls from 0.331 to 0.291. These are descriptive, without Holm correction.

Three feature ablations round out the picture. Replacing the quantile occupancy features by point predictions costs $0.41 \mathrm{pp}$ of replay agreement (Holm $p=0.036$); removing weather moves hit@1 by $-0.46 \mathrm{pp}$ with a raw $p=0.018$ that does not reach significance after correction ($p=0.054$), so we make no claim for the weather signal; and removing the BTS features changes nothing measurable for the imitator ($+0.09 \mathrm{pp}$, $p=0.52$), in sharp contrast to their clear value to the forecaster (Section 5.1).

5.8. Robustness of the Conflict Ranking

The headline compares two policies inside one calibrated occupancy model, under an independence convention, through a pairwise accounting of overlap. Each of those three choices could, in principle, carry the result. None of them does, and we establish this directly rather than by argument. The analyses in this subsection sit outside the preregistered family, were run as a single batch on the frozen split, and are recorded as such in Table 2; no locked configuration was altered and no preregistered endpoint was recomputed. Table 7 collects them, and Table 8 adds, on validation, the sensitivity of the ranking to the risk weight $\lambda$ over the whole preregistered grid.

Table 7. Robustness of the ${\pi }_{\mathrm{unc}}$–B1 expected-conflict ranking on the 516 frozen test days. Every row is a day-paired comparison of the same two policies under a different stress applied to the evaluation; ECM is in expected conflict minutes per 100 reservations. The first row is the preregistered one-shot, reproduced exactly.

Stress Applied to the Evaluation	B1	${\mathit{\pi }}_{\mathbf{unc}}$	Reduction	p
None (preregistered one-shot)	1175.5	615.9	47.6%	$3.0\times {10}^{-13}$
Second calibrated duration model, driving both the policy and the metric	1498.4	637.9	57.4%	$8.6\times {10}^{-27}$
Second calibrated duration model as the metric only, scoring a policy that never consumed it	1498.4	1155.7	22.9%	$4.0\times {10}^{-3}$
Positive dependence, $\rho =0.4$	1476.4	782.8	47.0%	$1.7\times {10}^{-13}$
Positive dependence, $\rho =0.8$	1778.2	905.3	49.1%	$1.4\times {10}^{-14}$

Dependence rows use a one-factor Gaussian copula with a day-level common shock and unchanged marginals, evaluated by Monte Carlo at $k=2000$ draws per day with common random numbers across policies; at $\rho =0$ the sampler reproduces the closed form to a relative difference of $7.9\times {10}^{-4}$ (B1) and $4.7\times {10}^{-4}$ (${\pi }_{\mathrm{unc}}$). p-values are two-sided Wilcoxon signed-rank on the per-day difference.

Table 8. Validation sensitivity of the risk weight over the whole preregistered grid (731 validation days, day-mean ECM per 100 reservations). The rule baseline B1 attains 955.5 on the same days. The argument minimum lies at the grid edge, but the curve is flat above $\lambda =0.5$, the gain from 8 to 16 is 0.04, and the ranking against B1 is preserved at every grid point, so the reported configuration reflects a broad plateau rather than a tuned optimum.

$\mathit{\lambda }$	0.25	0.5	1	2	4	8	16
ECM per 100	641.19	635.86	636.02	635.41	634.90	634.72	634.68
Replay agreement	0.3583	0.3579	0.3575	0.3575	0.3574	0.3575	0.3575

The selected configuration is ${\lambda }^{\star }=16$. ECM, expected conflict minutes.

5.8.1. The Ranking Does Not Depend on One Calibrated Model

Re-running the comparison on a second, independently conformalised duration model (trained without the flight-context features, so it is a genuinely different forecaster rather than a perturbation) preserves the sign and widens the margin, from 47.6% to 57.4% ($\delta =-0.268$). The harder variant is the third row, where the locked ${\pi }_{\mathrm{unc}}$ is graded by a model it never consumed: this severs the shared-model channel entirely, and the advantage survives at 22.9% ($p=4.0\times {10}^{-3}$). Whether the second model informs the policy or only judges it, ${\pi }_{\mathrm{unc}}$ is ahead.

5.8.2. Positive Dependence Strengthens the Case Rather than Weakening It

Assumption (A1) is what lets the joint tail factor, and same-day durations plausibly share shocks, so we couple them through a day-level common factor and sweep the copula correlation. Absolute expected conflict rises for both policies (by roughly half at $\rho =0.8$, confirming that the independent functional understates joint tail mass) but the paired advantage is preserved at every level and grows at the top of the range, with Cliff’s $\delta$ strengthening monotonically from $-0.134$ to $-0.153$. The mechanism is visible in the pair counts: B1 concentrates its exposure in fewer but far larger overlaps, and it is precisely those that a common shock inflates.

5.8.3. What the Functional Counts, Measured

Because ECM sums pairwise overlaps, a k-fold simultaneous occupancy enters through $\left({\displaystyle \genfrac{}{}{0pt}{}{k}{2}}\right)$ terms, and the magnitude should be read with that convention in mind. Resolving the counted pair set into connected clusters of simultaneously conflicting occupancies puts a number on it: under ${\pi }_{\mathrm{unc}}$, 95.3% of expected conflict minutes arise in isolated two-occupancy overlaps and only 4.7% in clusters of three or more, so ECM and a simultaneity-based reading of the same schedule almost coincide. Under B1 the figure is 35.5%. ECM is a policy-ranking functional over predicted occupancy risk; it is not a forecast of realised delay minutes, and the convention that inflates it inflates the rule baseline roughly seven times more than the proposed policy.

5.8.4. Where the Advantage Comes from

A comparator that consumes the same predictive quantiles through a different decision rule separates the two candidate explanations. B1-pred keeps B1’s mechanism exactly (same-area preference, then the largest buffer behind the arriving reservation) and changes only the information, taking that buffer from the predicted $q_{0.9}$ end rather than the reserved end. It reaches 824.3 ECM against B1’s 1175.5 ($p=8.2\times {10}^{-59}$), and ${\pi }_{\mathrm{unc}}$ reaches 615.9. Predictive uncertainty is therefore valuable through more than one decision rule, which is the stronger claim for the information channel; and the composed policy converts it further, at 2.3 times B1-pred’s replay agreement (0.271 against 0.117), so the scoring rule buys operational continuity that the heuristic does not.

6. Discussion

6.1. Feasibility and Risk Are Separable, and They Compose

The architecture is a composition: a mask that owns feasibility and a scorer that owns everything else. Proposition 1 makes the split rigorous, since the guarantee holds for any measurable scorer, and the record confirms it is no artefact of well-behaved scorers: two offline-RL agents, whose scorers share no structure with the rule or the ranker, still produce zero violations across 516 days. The split frees the scorer entirely, be it a boosted ranker, a rule, a Q-network or a hand-written penalty, and the two halves compose in a specific direction. The mask alone does not manage risk: the B2 imitation policy is fully feasible yet carries 7142.6 ECM, six times the same-area rule’s. Nor does the forecaster alone: it is well calibrated (Section 5.1), yet the blind twin, identical ranker and no access to the forecast, is exactly the high-risk policy. Uncertainty must be consumed by the decision rule to matter, and ${\pi }_{\mathrm{unc}}$ demonstrates it: same mask, same ranker, same replay, one extra term, 615.9 against 7142.6. The B1 comparison shows the effect is not merely relative to a weak imitator, ${\pi }_{\mathrm{unc}}$ also beating the strongest rule baseline at lower churn and with no deferrals.

6.2. Why Online Model-Based Risk Beat Offline Value Learning Here

The most instructive contrast is between two policies sharing a base ranker: ${\pi }_{\mathrm{unc}}$ reaches 615.9 ECM while masked CQL, trained on a reward whose dominant term is the same expected-conflict quantity, reaches 3728.9. The offline agent optimises the right objective and still lands six times higher, for informational rather than algorithmic reasons. ${\pi }_{\mathrm{unc}}$’s risk term is evaluated online against the episode’s own committed schedule: at the moment of decision it reads which occupancies already sit on each candidate stand and integrates their predicted overlap with the request in hand. The Q-network has no such access; it sees a static feature vector summarising the logged state, and whatever conflict structure that vector fails to encode is invisible to it however much conservative training it receives. This is consistent with the offline-RL literature’s emphasis on distributional shift and representation error under function approximation [27]. Two structural facts push the same way: the training reward carries no churn signal, because on logged transitions the behaviour is the history; and the mask was a filter applied on top, not a learning target.

The reading we take is not that offline RL is unsuited to stand assignment, but that when a calibrated model of the uncertain quantity exists and can be queried at decision time, a policy that queries it directly is a strong baseline value learning must earn its way past.

6.3. The Imitation Channel Has a Ceiling, and It Is Not the Architecture

It would be easy to read the four failures of Section 5.2 as a verdict on graph learning, but the data do not support that: the graph model was trained under a disclosed budget, so only the head-to-head loss against gradient boosting on identical features is architecture-decisive, and even that is a statement about these tabular features.

A more likely ceiling is the target itself. Agreement with a historical planner is bounded above by 95.53% mask recall, and the residual disagreement is dominated by real historical double-use of stands, exactly the behaviour a conflict-avoiding policy should not imitate; a ranker that imitates perfectly would inherit the historical packing, which is what the ECM channel shows the imitation ensemble doing. Better imitation is therefore not obviously the direction of travel, and the H-A result, which traces to in-sample embeddings, is a symptom of pushing harder on a target with little left to give. What would change the picture is a different label: realised occupancy times.

6.4. A Measured Case for Preregistration

Hypothesis H-B is the paper’s most transferable methodological finding. Had the blend’s grid search and the test evaluation happened in the same loop, the natural narrative would have been an ensemble improvement, wrong in sign. Three of four preregistered hypotheses did not confirm and two reversed significantly; absent the frozen protocol and the single test reading, at least one would plausibly have been reported as positive. That is what the protocol bought on this data, and it is why we report preregistration as a methodological safeguard that underwrites the evidence rather than as a scientific finding in its own right: it converts the negative results from an absence of evidence into measured evidence about what does not work here.

6.5. Assumptions and Scope Conditions

The guarantees and the measured advantage each hold under stated conditions, and it is worth setting out that envelope precisely, both because it delimits what the evidence supports and because several of its edges are now measured rather than assumed.

6.5.1. What the Conflict Channel Is a Claim About

This operator log records reservations: the recorded end of an interval is its requested end, and the published realised-gate feed does not intersect the parking log on this snapshot. Every conflict quantity here is therefore a statement about expected overlap between reservations under the calibrated occupancy-risk model of Theorem 1, expected conflict computed from predictive duration distributions, not observed blockage at the stand. The 48% headline says that consuming calibrated occupancy uncertainty lowers model-based expected conflict against a rule that never sees the model, and Section 5.8 establishes that this survives a second calibrated forecaster and correlated durations. It is not a measurement of realised delay minutes, and we do not read it as one.

6.5.2. The Functional’s Conventions and Their Measured Effect

Assumption 1 (A1)–(A4) fix independent durations, deterministic starts, pairwise accounting and a one-sided buffer. All four apply identically to every policy compared, which is what makes the paired differences fair, and the two that could plausibly carry the ranking are now quantified rather than argued: relaxing independence through a day-level common shock preserves and slightly widens the advantage (Table 7), and resolving the pairwise sum into simultaneity clusters shows 95.3% of ${\pi }_{\mathrm{unc}}$’s expected conflict minutes sitting in isolated two-occupancy overlaps. Deterministic starts remain a modelling choice; relaxing them changes the mathematics rather than only the numbers, since a random $a_i$ turns the outer integral into a convolution that no longer factorises segment by segment, and that is the natural next extension of the functional.

6.5.3. What “Feasibility-Guaranteed” Guarantees

Proposition 1 certifies feasibility with respect to predicates C1–C4 and the stand inventory as published, for any scorer, pathwise; and the certificate is exercised, at zero violations across 516 test days and every policy evaluated, including two offline-RL agents whose scorers share no structure with the rule or the ranker. Two of the predicates are operational reconstructions: C4 infers physical sharing from stand naming, a base pad against its lettered sub-positions, and C1 reads the published validity windows of a current inventory snapshot. Requirements outside these four (ground-handling resourcing or contractual stand rights, for instance) enter as additional predicates supplied by the deploying operator rather than through F as specified here. Because the guarantee is a property of the policy class and holds for any measurable scorer, it composes with such predicates without re-derivation, which is precisely the property that makes the construction portable.

6.5.4. The Envelope This Evidence Covers

The results come from one airport’s operator log over 213 consecutive months, evaluated on 516 held-out days under time-extrapolating splits. That design tests generalisation forward in time, which is the axis a deployed allocator actually faces, and the year-by-year view shows where re-fitting earns its keep: as the stand inventory drifts, the imitation components lose ground while the risk channel does not, so a deployment would recalibrate the ranker on a roughly annual cycle and the occupancy model whenever the published inventory changes materially. Transfer to a second airport requires the same four predicates to be instantiated against that airport’s layout and inventory, and we make no claim beyond this operator’s log.

6.5.5. What the Behavioural Metrics Report

Replay agreement and churn are behavioural diagnostics, not quality measures: a policy raises agreement by reproducing historical packing, which the conflict channel shows to be the higher-risk choice. Agreement is additionally bounded by construction, since the historical stand lies inside the feasible set for 95.53% of test requests, the residual being genuine historical double-use by distinct reservation chains. We therefore read agreement as a measure of operational continuity, that is, of how much of the existing plan a policy leaves undisturbed, and report it alongside the conflict endpoint rather than as a substitute for it.

7. Conclusions

Stand pre-assignment needs two guarantees usually traded against each other: constraints that hold on every realised path, and a decision rule that takes occupancy uncertainty seriously. This paper obtains both by composition. A masking operator built from four hard predicates makes feasibility a property of the policy class rather than of the learned scorer (Proposition 1), with zero violations across 516 one-shot test days and every policy evaluated, including two offline-RL agents. Onto that class we graft a risk term from the main mathematical result: under piecewise-linear predictive duration distributions with bounded linear tails the expected buffered overlap of a same-stand pair has an exact closed form (Theorem 1), degenerating precisely to the constraint it generalises when those distributions collapse to point masses (Corollary 2).

Empirically, in a preregistered one-shot replay of all 516 test days at SFO, a greedy policy consuming this risk model reduces model-based expected conflict under the calibrated occupancy-risk model from 1175.5 to 615.9 min per 100 reservations against the strongest rule baseline, a 48% reduction (Holm-corrected $p=3.0\times {10}^{-13}$), while deferring no request and churning less than that rule. A mechanism ablation against an uncertainty-blind twin of the same policy, which provably coincides with plain imitation greedy, isolates the information channel and accounts for the bulk of the effect. The result is model-based by construction, because the public snapshot cannot measure realised conflict at all, and we state it that way throughout.

We report the negatives with the same precision. Graph-attention embeddings hurt the imitation ranker, a validation-selected score blend reversed significantly on test, and masked discrete conservative Q-learning beat behaviour cloning but not the rule, so its hypothesis is not confirmed; for that agent we prove the conservative value bound survives masking for the policy-evaluation operator (Proposition 2), a result that motivates rather than certifies the deployed control learner. Three of four preregistered hypotheses did not confirm, under a protocol frozen before the preregistered evaluation and read exactly once in that round with every other test-set contact enumerated (Table 2). Reporting them under a protocol fixed in advance is what allows the confirmed result to be read as evidence rather than as selection.

Future Work

The most valuable next step is data, not method: weekly snapshots of the realised gate-event feed plus a re-download of the parking log once the windows overlap would supply realised occupancy times and convert every model-based conflict claim here into a realised-conflict claim, giving the forecaster a genuine target and making ECM checkable against outcomes rather than only against Monte-Carlo simulation of its own model. The multi-model and dependence sensitivity analyses are already reported in Section 5.8: the H-C ranking is preserved under a second calibrated duration model and under a day-level common shock, so the headline’s sign is not an artefact of the single model that defines the functional. Four method extensions follow from the limitations. First, start-time jitter remains open: Assumption 1 (A2) is the one convention whose relaxation changes the mathematics rather than only the numbers, since a random $a_i$ turns the outer integral into a convolution that no longer factorises segment by segment. Second, alternative tail families for the predictive distribution are a natural companion to it. Third, cross-fitted, out-of-fold graph embeddings would test whether the H-A negative is about graph structure or in-sample leakage. Fourth, the exploratory four-component blend, which reached $+0.20 \mathrm{pp}$ on validation with $p=0.0046$ but lay outside the registered functional form, can now be tested under its own preregistration.

Appendix A.1. The Expected-Conflict Functional in Closed Form

Notation follows Definition 3 and Assumption 1. Step 1. The proof in Section 2.6 establishes, by the layer-cake identity, Tonelli’s theorem and (A1) and (A2),

$${\kappa }_{ij}={\int }_{a_j}^{\infty }\mathbb{P}\left(D_i>t-\beta -a_i\right)\mathbb{P}\left(D_j>t-a_j\right)\mathrm{d}t={\int }_{a_j}^{\infty }{\overline{F}}_i(t-\beta -a_i){\overline{F}}_j(t-a_j)\mathrm{d}t,$$

(A1)

for a pair $i,j$ on the same stand with $a_i\le a_j$. Definition 3 gives ${\overline{F}}_i\left(u\right)=0$ for $u\ge U_i$ and ${\overline{F}}_j\left(u\right)=0$ for $u\ge U_j$, so the integrand vanishes for $t\ge T_{ij}=\min (a_i+\beta +U_i,a_j+U_j)$ and the upper limit may be truncated there; if $T_{ij}\le a_j$ the integral is empty and ${\kappa }_{ij}=0$. That is the exact pruning rule used by the implementation, exact because the tails of Definition 3 are bounded rather than asymptotic.

Step 2: both factors are affine between consecutive breakpoints. Let $x_0^{\left(i\right)}<\cdots <x_{n_i}^{\left(i\right)}$ be the knot abscissae of $F_i$ after merging coinciding knots (Definition 3), and similarly for j. On each open interval $(x_{r-1}^{\left(i\right)},x_r^{\left(i\right)})$ the CDF is affine, hence so is ${\overline{F}}_i$; outside $[x_0^{\left(i\right)},x_{n_i}^{\left(i\right)}]$ it is constant, one below and zero above, and merged knots carry atoms at which ${\overline{F}}_i$ jumps, the knot value being post-jump since $F_i$ is right-continuous. The affine shifts of (A1) move those breakpoints to $t=a_i+\beta +x_r^{\left(i\right)}$ and $t=a_j+x_r^{\left(j\right)}$. Let

$$\{t_0<t_1<\cdots <t_K\}=\left(\{a_j,T_{ij}\}\cup {\{a_i+\beta +x_r^{\left(i\right)}\}}_r\cup {\{a_j+x_r^{\left(j\right)}\}}_r\right)\cap [a_j,T_{ij}],$$

(A2)

so that $t_0=a_j$ and $t_K=T_{ij}$. On each open segment $(t_{k-1},t_k)$ both factors are affine, and every jump point of either is an endpoint of a segment, never an interior point; in particular the midpoint $m_k=\frac{1}{2}(t_{k-1}+t_k)$ is always a point of affinity of both, which makes the expansion below legitimate even in the presence of atoms.

Step 3: exact integration of each segment. Write $h_k=t_k-t_{k-1}$ and expand each factor about the midpoint,

$${\overline{F}}_i(t-\beta -a_i)=c_{1k}+s_{1k}(t-m_k),{\overline{F}}_j(t-a_j)=c_{2k}+s_{2k}(t-m_k),t\in (t_{k-1},t_k),$$

(A3)

where $c_{1k},c_{2k}$ are the survival values at $m_k$ and $s_{1k},s_{2k}$ the slopes, both nonpositive as negatives of piecewise-linear CDF slopes. Their product is the quadratic

$$c_{1k}{c}_{2k}+\left(c_{1k}{s}_{2k}+c_{2k}{s}_{1k}\right)(t-m_k)+s_{1k}{s}_{2k}{(t-m_k)}^2.$$

(A4)

Integrating over the segment, which is symmetric about $m_k$, and using

$${\int }_{t_{k-1}}^{t_k}\mathrm{d}t=h_k,{\int }_{t_{k-1}}^{t_k}(t-m_k)\mathrm{d}t=0,{\int }_{t_{k-1}}^{t_k}{(t-m_k)}^2\mathrm{d}t={\displaystyle \frac{h_k^3}{12}},$$

(A5)

the cross term vanishes by symmetry and

$${\int }_{t_{k-1}}^{t_k}{\overline{F}}_i(t-\beta -a_i){\overline{F}}_j(t-a_j)\mathrm{d}t=h_k{c}_{1k}{c}_{2k}+{\displaystyle \frac{h_k^3}{12}}{s}_{1k}{s}_{2k}.$$

(A6)

Summing over $k=1,\dots ,K$ gives (12). Every step is an identity, so the result carries no discretisation error: refining the partition beyond (A2) changes nothing, and coarsening it below the breakpoint set is the only way to introduce error.

Remark A1

(Fidelity to the implementation). Four details make the theorem statement and the code describe the same object. Quantile preprocessing: predicted quantiles are clipped below at one minute and sorted ascending when the raw predictions invert, before the knots of (9) are formed, and coinciding knots merge keeping the larger CDF value, turning that knot into an atom; the derivation is unaffected, since merged knots remain elements of (A2). Fallback distributions: an event lacking a finite predicted quantile triple gets a point mass at its reserved duration, contributing the deterministic buffered overlap by Corollary 2; no such event occurs on validation or test. Pair set and attribution: the per-decision marginal used as policy risk term and offline-RL reward drops the day-attribution filter of Definition 4, because every pair a decision forms is caused by it; summing the marginals over a day reproduces the schedule-level total exactly, an identity we verify directly. Two buffer conventions: the reservation-based overlap metric retained from the earlier round inflates both intervals by $\beta /2$, whereas Theorem 1 inflates only the earlier end by β (A4); the two are not comparable and no comparison between them appears here.

Appendix A.2. Monte-Carlo Validation of the Closed Form

The closed form was validated against simulation before any policy iteration was logged, as a correctness gate. Thirty validation days were sampled with a fixed generator from the 731 eligible days (those with at least one candidate pair under the historical schedule), each simulated with $K=2000$ inverse-CDF draws from the distributions of Definition 3. Each draw evaluates the realised one-sided buffered overlap ${(\min (E_i+\beta ,E_j)-a_j)}^{+}$ over exactly the pair set the analytical evaluation integrates, so the sample mean is an unbiased estimator of (A1) and any systematic gap indicates an implementation error, not a modelling one. Writing A for a day’s analytical value and M for its Monte-Carlo mean, the preregistered tolerance required $|A-M|\le \max \left(0.01\max (A,1),3{\mathrm{SE}}_M\right)$ on at least 28 of the 30 days, plus an aggregate relative difference of at most 0.01. The gate passed on its first run: 30 of 30 days inside tolerance, aggregate relative difference 0.00159. Worst of the thirty was 29 January 2023, analytical 11,101.48 against simulated 10,732.67 (Monte-Carlo standard error 161.18), a gap equal to 0.76 of its own tolerance.

What this gate does and does not establish deserves stating plainly. It is a validation of the numerical implementation: it confirms that the closed-form segment sum of Theorem 1 evaluates the same integral that direct inverse-CDF sampling from the distributions of Definition 3 produces, to within the stated tolerance and with no quadrature error. It is not an empirical validation of the model. It says nothing about whether those predictive distributions describe actual stand occupancy, because the sampler draws from the same distributions the closed form integrates; agreement between them is a statement about arithmetic, not about the world. Empirical validation of the predictive family would require a realised-occupancy feed that this data source does not provide, and Section 6.5 records it as such.

Appendix A.3. Conservatism Under Masking: Proof of Proposition 2

We adapt the support-restriction argument of Kumar et al. [11], Theorem 3.2, replacing $\mathcal{A}$ by the state-dependent feasible set $F\left(s\right)$ throughout. The adaptation is not merely notational, since the CQL(H) regulariser is a log-sum-exp over the action set and restricting that set changes the maximiser and hence the penalty; we verify that the lower-bound structure survives and, following the scope of that theorem, that it holds when the resulting $\widehat{Q}$ is evaluated under its own induced softmax $\mu$ rather than under an arbitrary masked policy.

• Masked objective.

Let $\mathcal{D}$ be the logged dataset with empirical behaviour policy ${\pi }_{\beta }$, and assume ${\pi }_{\beta }(a\mid s)>0$ for every $a\in F\left(s\right)\setminus \{\varnothing \}$ and every s appearing in $\mathcal{D}$ (the strengthened support condition of Proposition 2; see Remark 2 for its applicability under the behaviour-cloning-distilled prior). Constrain $Q(s,a)=-\infty$ for $a\notin F\left(s\right)$ and consider the policy-evaluation iteration for the target $\mu$

$$\begin{array}{cc}\hfill {\widehat{Q}}^{k+1}=\underset{Q}{\mathrm{arg\; min}}& \alpha ({\mathbb{E}}_{s\sim \mathcal{D}}[\log \sum _{a\in F\left(s\right)}{e}^{Q(s,a)}]-{\mathbb{E}}_{(s,a)\sim \mathcal{D}}\left[Q(s,a)\right])\hfill \\ \hfill & +\frac{1}{2}{\mathbb{E}}_{(s,a,s^{\prime })\sim \mathcal{D}}\left[{\left(Q(s,a)-{\mathcal{B}}^{\mu }{\widehat{Q}}^k(s,a)\right)}^2\right].\hfill \end{array}$$

(A7)

The first bracket is the entropy-regularised maximisation ${\max }_{\mu \in \Delta \left(F\left(s\right)\right)}{\mathbb{E}}_{a\sim \mu }\left[Q(s,a)\right]+\mathcal{H}\left(\mu \right)$, whose maximiser is the softmax $\mu (a\mid s)$ of $Q(s,·)$ over $F\left(s\right)$; let ${\mathcal{B}}^{\mu }$ be the policy-evaluation Bellman operator for $\mu$. Differentiating (A7) in $Q(s,a)$ for $a\in F\left(s\right)$ and setting the derivative to zero gives, for every state-action pair in the data,

$${\widehat{Q}}^{k+1}(s,a)={\mathcal{B}}^{\mu }{\widehat{Q}}^k(s,a)-\alpha \left[{\displaystyle \frac{\mu (a\mid s)}{{\pi }_{\beta }(a\mid s)}}-1\right],a\in F\left(s\right),$$

(A8)

the update of [11] with $F\left(s\right)$ in place of $\mathcal{A}$. The strengthened assumption makes ${\pi }_{\beta }(a\mid s)>0$ for every feasible a, so $\mu /{\pi }_{\beta }$ is finite throughout $F\left(s\right)$ and the update is well defined; for $a\notin F\left(s\right)$ the constraint forces ${\widehat{Q}}^{k+1}(s,a)=-\infty$.

• The penalty is nonnegative in μ-expectation.

Fix s. Evaluating the bracket of (A8) in expectation under $\mu$ gives

$$\sum _{a\in F\left(s\right)}\mu (a\mid s)\left[{\displaystyle \frac{\mu (a\mid s)}{{\pi }_{\beta }(a\mid s)}}-1\right]=\sum _{a\in F\left(s\right)}{\displaystyle \frac{\mu {(a\mid s)}^2}{{\pi }_{\beta }(a\mid s)}}-1\ge 0,$$

(A9)

because by the Cauchy–Schwarz inequality ${\left({\sum }_a\mu (a\mid s)\right)}^2\le \left({\sum }_a\mu {(a\mid s)}^2/{\pi }_{\beta }(a\mid s)\right)\left({\sum }_a{\pi }_{\beta }(a\mid s)\right)$ and both marginal sums equal one on $F\left(s\right)$ under the support assumption, with equality if and only if $\mu ={\pi }_{\beta }$ there. This nonnegativity is what makes the term conservative: it lowers $\widehat{Q}$ on actions $\mu$ favours relative to ${\pi }_{\beta }$. The step is specific to $\mu$: for a general masked $\pi \ne \mu$ the analogous sum ${\sum }_a\pi (a\mid s)[\mu (a\mid s)/{\pi }_{\beta }(a\mid s)-1]$ can be negative, for instance if $\pi$ concentrates on an action $\mu$ under-weights relative to ${\pi }_{\beta }$, so the bound is claimed at $\mu$ only.

• Fixed point and the bound.

Iterating (A8) and using that ${\mathcal{B}}^{\mu }$ is a $\gamma$-contraction on the masked value functions, the limit satisfies

$$\widehat{Q}(s,a)=Q^{\mu }(s,a)-\alpha {\left(I-\gamma P^{\mu }\right)}^{-1}g(s,a),g(s,a):={\displaystyle \frac{\mu (a\mid s)}{{\pi }_{\beta }(a\mid s)}}-1,$$

(A10)

for $a\in F\left(s\right)$, with $P^{\mu }$ the state-action transition operator induced by $\mu$, restricted to feasible actions. We take the $\mu$-expectation of both sides explicitly, the subtlety being the passage from the per-state (A9) to the value bound. Define the state-level penalty

$$\overline{g}\left(s\right):={\mathbb{E}}_{a\sim \mu (·\mid s)}\left[g(s,a)\right]=\sum _{a\in F\left(s\right)}{\displaystyle \frac{\mu {(a\mid s)}^2}{{\pi }_{\beta }(a\mid s)}}-1\ge 0,$$

(A11)

nonnegativity being (A9). Averaging a state-action function under $\mu$ intertwines $P^{\mu }$ with the state-to-state kernel $P_{\mathrm{st}}^{\mu }(s^{\prime }\mid s)={\sum }_a\mu (a\mid s)P(s^{\prime }\mid s,a)$: for any h,

$${\mathbb{E}}_{a\sim \mu (·\mid s)}\left[\left(P^{\mu }h\right)(s,a)\right]=\sum _a\mu (a\mid s)\sum _{s^{\prime }}P(s^{\prime }\mid s,a){\mathbb{E}}_{a^{\prime }\sim \mu }\left[h(s^{\prime },a^{\prime })\right]=\left(P_{\mathrm{st}}^{\mu }\overline{h}\right)\left(s\right),$$

(A12)

with $\overline{h}\left(s\right)={\mathbb{E}}_{a\sim \mu }\left[h(s,a)\right]$. Applying this to the Neumann series ${(I-\gamma P^{\mu })}^{-1}={\sum }_{t\ge 0}{\gamma }^t{\left(P^{\mu }\right)}^t$ term by term gives ${\mathbb{E}}_{a\sim \mu }\left[{(I-\gamma P^{\mu })}^{-1}g\right]\left(s\right)=\left({(I-\gamma P_{\mathrm{st}}^{\mu })}^{-1}\overline{g}\right)\left(s\right)$. Taking the $\mu$-expectation of (A10) and using ${\mathbb{E}}_{a\sim \mu }\left[Q^{\mu }(s,a)\right]=V^{\mu }\left(s\right)$,

$${\mathbb{E}}_{a\sim \mu (·\mid s)}\left[\widehat{Q}(s,a)\right]=V^{\mu }\left(s\right)-\alpha \left({(I-\gamma P_{\mathrm{st}}^{\mu })}^{-1}\overline{g}\right)\left(s\right)\le V^{\mu }\left(s\right),s\in \mathcal{D},$$

(A13)

which is (8): the inequality holds because ${(I-\gamma P_{\mathrm{st}}^{\mu })}^{-1}={\sum }_{t\ge 0}{\gamma }^t{\left(P_{\mathrm{st}}^{\mu }\right)}^t$ is a nonnegative operator, a discounted sum of stochastic kernels, applied to the pointwise-nonnegative $\overline{g}$, so the subtracted term is $\ge 0$ at every state. Actions outside $F\left(s\right)$ carry $\widehat{Q}=-\infty$ and are excluded because $\mu$ is supported on $F\left(s\right)$; a masked greedy policy never selects them, so the bound is exactly the quantity such a policy acts on. Without sampling error the argument holds for every $\alpha >0$; with finite data $\alpha$ must exceed the policy-dependent threshold of [11], Theorem 3.2, instantiated at $\mu$ with its concentrability coefficient over $F\left(s\right)$ rather than $\mathcal{A}$. It is not a universal constant, and is vacuous at $\mu ={\pi }_{\beta }$, where $\overline{g}\equiv 0$.

• Scope.

Proposition 2 concerns the masked CQL(H) fixed point evaluated at its own induced softmax $\mu$; it is not a theorem about the deployed control learner and not a claim about the empirical policy’s quality (Remark 2). Training uses the reachable subset only, 95.53% of test events having their logged action inside the mask. The full-support condition is an idealisation the empirical data does not satisfy, the logged behaviour being a near-point-mass; the behaviour-cloning warm start smooths the initial Q-estimate, not the data-generating ${\pi }_{\beta }$, so it does not repair the support defect and we do not claim it does. The proposition certifies the idealised operator and formalises the conservatism mechanism; it does not certify the deployed learner, whose achievement, including the comparison it loses, is reported in Section 5.5.