Method

We publish a time only when we can show where it came from; 'unknown' is a valid answer and we print it.

Four cutoff states

known — a dated source (official page, signage photo, staff) backs the time; we print it.
none — there is no cutoff (e.g. shrine grounds open at all hours).
unknown — we have not verified it. We do not print a guessed '16:30'; the planner adds an uncertainty buffer instead.
not_applicable — the field does not apply to this place.

Each operational field carries its own source, capture date, confidence and expiry. Priority: official API > official page > signage > staff > field note > secondary > crowd.
When two sources disagree (16:00 vs 16:30) the field is marked disputed and the planner uses the conservative value.
Crowd signals (queue, locker full) can re-rank and warn. They never reopen a closed place or write a new last-entry time.

A — structure: city, 4 clusters, a gateway, 2 sleep areas exist.
B — completeness: every core place has a cutoff status; every sleep area has a reception mode.
C — executable: an airport-to-bed contract exists and the failure ladder ends on a live rung.
D — fixtures: a 21:00 landing locks a path; a 22:10 landing with two 28-inch bags and a 23:00 curfew must NOT lock the train.

Travel times are sampled per mode: walking is triangular, trains are timetable plus a delay distribution, taxis are pickup plus road. Rain is one correlated regime, not a multiplier on everything.
Plans are generated, dominated ones removed, and three representatives shown: low load (α), low time risk (β), low cost (γ).
When nothing fits, we show the smallest set of constraints in conflict and the cheapest one to loosen.
Same data + same seed + same inputs = same plan (replayable).

We model closures, +45 min transit delays, rain, heat, queue spikes, one failed transit edge, one failed place, full lockers and cash shortage. We do not model earthquakes, floods or a dead phone battery.