How opening status is determined

1. Public status contract

2. Calculation order

1. An active, expiring operator override wins.
2. A same-day official live update may produce OPEN NOW, LIMITED, or CLOSED.
3. A confirmed official schedule is evaluated in Europe/Bucharest, including seasonal ranges, weekday rules, split hours, dated exceptions, and validity dates.
4. Admission cutoffs—not building closing times—end an open claim where the source publishes both.
5. If a live recheck is late, a still-valid conditional timetable degrades to LIMITED. A stable timetable remains explicitly SCHEDULED OPEN.
6. If the timetable does not cover the date, the engine returns CHECK OFFICIAL instead of guessing.

3. Verified source registry

Every attraction has a dedicated adapter entry and an HTTPS host allowlist. Parsers require attraction-specific names, dates, times, or operational phrases; a generic page-load success is not enough.

4. Accuracy corrections in this revision

• Bran Castle uses the current official last-entry times: 18:00 or 19:00 by season. Revision 9 removed the superseded 19:30 August cutoff.
• Black Church open claims now stop 20 minutes before building close, matching its published last-entrance rule.
• Peleș and Pelișor stop open claims at 16:00 and 16:15 respectively, while still displaying the 17:00 building closure.
• Salina Turda stops admission claims at 17:00; ASTRA uses the 19:45 last-ticket cutoff.
• Libearty displays the actual 09:45 and 11:15 guided departures, includes the booking requirement, and stops availability after the final public departure.
• Biertan now includes the 19:00 June–August close, daily lunch break, and winter Tuesday–Sunday schedule.
• Sighișoara now distinguishes winter weekday 09:00 opening from weekend 10:00 opening.
• Viscri’s current tower/restoration restrictions and Râșnov’s garden-only access produce LIMITED.
• The Poiana parser reads only operator status fields; it cannot mistake a site-footer timestamp for current lift data.
• Sinaia accepts the official named-date daily heading without requiring a numeric year and extracts today’s section times.
• Successful live-board checks now clear any older same-day-hours snapshot when the source does not publish replacement hours.
• Transfăgărășan and Transalpina use CNAIR Dispecerat’s current road inventory and published 2026 daytime windows as conditional schedules, not as perpetual live-road claims.

5. Refresh paths and frequency

Cloudflare scheduled events are the primary path. An eligible HTML request also starts every due group after the page response has had priority; a per-worker cooldown prevents visitor traffic from repeatedly starting the fallback. Each group claims its own D1 lease before fetching, so simultaneous requests cannot duplicate a run. Starting all due cadences removes the starvation bug where a frequently-due live group could prevent normal and daily checks from ever starting on a low-traffic deployment. A new configuration revision clears prior run summaries once, making every cadence immediately due after deployment. Every scheduled event also catches up any other due cadence, so this validation does not depend on visitor traffic. The admin can run any group immediately as well.

6. Durable state

D1 stores places, source configuration, same-day extracted hours, last attempt, last successful confirmation, parser health, repeated-failure count, status history, dated exceptions, admin login throttles, and refresh leases/run summaries. Configuration is revisioned: a new deployment upgrades existing rows in place while preserving manual overrides.

Production database errors are surfaced. The application no longer silently swaps in seed records after a D1 query failure.

7. Failure behavior

Each source attempt has a seven-second timeout, responses are capped at two megabytes, redirects are limited to four allowlisted HTTPS hops, and transient HTTP/network failures receive one bounded retry. Blocked hosts, unsafe redirects, bot challenges, missing exact fields, and unsupported wording record a failed attempt and its reason. They never advance last_confirmed_at. The display then uses a still-valid official schedule with the appropriate status, or asks the visitor to check the linked source when no schedule can support the date.

8. Operator controls

The protected console can run all source adapters on demand, inspect parser health and consecutive errors, set an expiring override, and edit the official URL, freshness policy, or validated schedule JSON. Automatic checks continue underneath a manual override.

9. Automated release gates

10. Audit snapshot · 21 August 2026

“Accurate” here is a testable contract: every attraction is mapped to its named official source; every parser must recognize attraction-specific evidence; schedule calculations stop at admission cutoffs; failures cannot create an open claim; and uncovered future dates return CHECK OFFICIAL. No crawler can guarantee that an external operator page is always online or that an operator has published a last-minute on-site decision, so the system surfaces those limits instead of manufacturing certainty.

11. Honest MVP boundaries

• Road results remain conditional: CNAIR Dispecerat supplies the current HTML inventory, while weather and on-site safety decisions can still change access without notice.
• Weather-dependent cable cars and canyon access remain LIMITED when only a timetable is available.
• Official pages protected by anti-bot challenges may force the schedule fallback even when visitors can open the page in a browser.
• Future schedules with a known publication horizon—such as Corvin after September 2026 and Transalpina after August 2026—must be reviewed when the operator publishes them.
• On-site staff and the linked source remain authoritative for same-day safety decisions.