diff --git a/docs/PORT_IDENTITY_CORPUS_AUDIT_2026-08-24.md b/docs/PORT_IDENTITY_CORPUS_AUDIT_2026-08-24.md
new file mode 100644
index 0000000..3c2c1b1
--- /dev/null
+++ b/docs/PORT_IDENTITY_CORPUS_AUDIT_2026-08-24.md
@@ -0,0 +1,365 @@
+# Port Identity Corpus Audit — 2026-08-24
+
+**Branch audited**: `develop`
+**HEAD**: `868325a` (*Merge pull request #55 from FHoffarth/feature/public-deck-geometry-review-workspace-v1*)
+**Scope**: `knowledge/ports/` and every consumer that reads it
+**Method**: corpus-wide distinct-value analysis, followed by generator-source confirmation
+**Status**: findings confirmed against generator source; remediation proposed in ADR-0006
+
+---
+
+## 0. Why this audit replaced the planned sprint
+
+The commissioned work was a port-by-port reconciliation sprint: audit a sample
+of ports, downgrade unsupported precision, reconcile external research.
+
+That plan could not have found the defect described here. Every
+`identity.json` file in the repository is individually well-formed and
+individually plausible. Barcelona reads like researched data. So does Hamburg.
+So does Singapore. The defect is invisible at file scope and only appears in
+the **distribution across the corpus** — which is why a sampling audit of eight
+ports would have returned a clean bill of health for a corpus in which every
+trust-bearing field is a constant.
+
+**Generalisable lesson:** a machine-readable corpus should be audited by
+scanning it, not by reading a sample of it. Sampling answers "is this file
+plausible?" Scanning answers "is this corpus data?" Only the second question
+detects generator output.
+
+---
+
+## 1. Corpus inventory
+
+| Measure | Value |
+|---|---|
+| Port directories under `knowledge/ports/` | 119 |
+| `identity.json` files | 119 |
+| Total JSON files in tree | 161 |
+| Directories with `identity.json` only | 113 |
+| Directories with the 8-file rich layout | 6 |
+| Distinct file layouts | 2 |
+
+The six rich-layout ports are **Barcelona, Genoa, Marseille, Messina, Naples,
+Valletta**, each carrying `emergency.json`, `identity.json`, `medical.json`,
+`port.json`, `sustainability.json`, `terminals.json`, `transport.json`,
+`weather.json`.
+
+---
+
+## 2. Principal finding — the identity layer is template output
+
+Across all 119 ports, every trust-bearing field resolves to a single constant
+or to a two-valued split:
+
+| Field | Distinct values across 119 ports |
+|---|---|
+| `timezone` | `"UTC"` — 119/119 |
+| `sources[].field` | `"all"` — 119/119 |
+| `sources[].source_id` | `"src:official-port-authority"` — 119/119 |
+| `sources[].trust_level` | `"OFFICIAL"` — 119/119 |
+| `sources[].retrieved_at` | `2026-08-16T12:00:00Z` — 119/119 |
+| `terminals[].walking_time_min` | `10` — 119/119 |
+| `terminals[].step_free_access` | `true` — 119/119 |
+| `logistics.card_acceptance_pct` | `98` — 119/119 |
+| terminals per port | `1` — 119/119 |
+| `terminals[].distance_to_city_center_m` | `500` (101) / `800` (18) |
+| `terminals[].gangway_deck_default` | `5` (108) / `2` (11) |
+| `terminals[].berths` | 2 synthetic entries (101) / 1 (18) |
+| `negative_intelligence` | two templates, 101/18 split |
+
+There is no third value anywhere in the corpus for any of these fields.
+
+### 2.1 The 101/18 split explained
+
+The split is not a data property. It is **two generators**, each with its own
+hardcoded template:
+
+| Generator | Ports | Fingerprint |
+|---|---|---|
+| `tools/mass_populate_knowledge.py` (~L170–205) | 101 | `distance_to_city_center_m: 500`; `berths: ["{Slug} Berth 1", "{Slug} Berth 2"]`; `gangway_deck_default: 5 if "River" not in region else 2`; `negative_intelligence[0] = f"Check terminal berth assignment upon morning arrival in {name}."` |
+| `tools/populate_classes_and_ports.py` (~L52–86) | 18 | `distance_to_city_center_m: 800`; `berths: ["{Slug} Pier 1"]`; `gangway_deck_default: 5`; `negative_intelligence[0] = f"Verify pier location in {name}."` |
+
+The `gangway_deck_default` 108/11 split is a nested conditional inside
+generator A: eleven river ports carry `2`, everything else `5`.
+
+Both generators emit the identical blanket source record:
+
+```python
+"sources": [
+ {"field": "all", "source_id": "src:official-port-authority",
+ "trust_level": "OFFICIAL", "retrieved_at": "2026-08-16T12:00:00Z"}
+]
+```
+
+**These values are synthetic/template-derived and carry no field-level
+evidence.** This is not inferred from the distribution — the generator source
+is in the repository and is quoted above. The distribution raised the
+question; the generator source answered it.
+
+---
+
+## 3. Provenance laundering
+
+The blanket source record is the mechanism by which unsourced generator output
+acquired an authoritative appearance. Three independent defects compound:
+
+1. **`field: "all"`** — a source covering every field attests no field in
+ particular. It cannot establish provenance for `card_acceptance_pct` or for
+ anything else.
+2. **`source_id: "src:official-port-authority"`** — this names a *category of
+ authority*, not a retrievable document. No artifact, no URL, no content
+ address. There is nothing behind it to fetch or verify.
+3. **`trust_level: "OFFICIAL"`** — the corpus's highest trust label, applied
+ uniformly by a generator to values the generator itself invented.
+
+`retrieved_at` is identical to the second across all 119 ports, which is not a
+possible outcome of 119 retrievals.
+
+This is the P0-A/P0-B anti-pattern in its purest observed form: unsourced
+values inheriting an authoritative provenance stamp. It is more severe than
+the earlier instances, because here the values never had a source at any point
+— the stamp was applied by a generator to content it fabricated in the same
+statement.
+
+---
+
+## 4. Passenger-facing risk
+
+Ranked by consequence to a traveller.
+
+### 4.1 `timezone: "UTC"` on all 119 ports — SEVERE
+
+All-aboard time is computed from this field. The corpus spans Reykjavík to
+Sydney; not one port is correctly UTC in practice for local operations
+(Barcelona is `Europe/Madrid`). A passenger acting on a UTC-derived all-aboard
+time in Barcelona in summer is wrong by two hours in the direction that misses
+the ship.
+
+### 4.2 `logistics.emergency_phone` — SEVERE
+
+Not in the original quarantine scope; discovered during consumer analysis and
+added. The generators derive this from a country allow-list with an
+else-branch fallback:
+
+```python
+"emergency_phone": "112" if p["country"] not in ["United States", "Puerto Rico"] else "911"
+```
+
+Distribution: `112` (91 ports), `911` (23), `999` (5). The else-branch
+misroutes every country outside the allow-list. Confirmed incorrect values
+include:
+
+| Port | Country | Stored | Actual |
+|---|---|---|---|
+| `costa-maya`, `cozumel` | Mexico | `112` | `911` |
+| `bridgetown` | Barbados | `112` | `511` / `911` |
+| `grand-cayman` | Cayman Islands | `112` | `911` |
+| `haifa` | Israel | `112` | `100` / `101` / `102` |
+
+A wrong emergency number published under `trust_level: OFFICIAL` is the most
+directly harmful fact in the corpus. Phase 2F (fail-closed on passenger-facing
+claims) applies without qualification.
+
+### 4.3 `logistics.currency` — MODERATE
+
+31 of 119 ports carry the literal string `"Local"`, the generator's
+else-branch. This is a non-value occupying a field a passenger would read.
+
+### 4.4 Synthetic precision — MODERATE
+
+`walking_time_min: 10`, `distance_to_city_center_m: 500/800`,
+`card_acceptance_pct: 98`, `step_free_access: true`. Each is actionable and
+each is invented. `step_free_access: true` corpus-wide is an accessibility
+claim asserted for 119 ports without a single observation, and is the one most
+likely to strand a wheelchair user.
+
+---
+
+## 5. Duplicate UN/LOCODE entity pairs
+
+Two LOCODEs appear twice, indicating either duplicate directories for one port
+or a genuine entity-identity question:
+
+| LOCODE | Directories |
+|---|---|
+| `USPEF` | `fort-lauderdale`, `port-everglades` |
+| `ITTRS` | `trieste`, `venice-trieste` |
+
+Both pairs are plausibly the same physical port under two slugs — the same
+class of question as New York vs. Bayonne, but already live in the repository.
+All 119 LOCODEs are syntactically well-formed (5 chars, uppercase
+alphanumeric); none has been validated against the UNECE list.
+
+**Not resolved in this audit.** Entity identity is an ontology decision
+requiring its own ADR, not a cleanup edit.
+
+---
+
+## 6. The six rich-layout ports
+
+These carry a **second, incompatible provenance model**:
+
+```json
+"provenance": { "source_artifact": "CRUISE_PORT_INTELLIGENCE_PROFILE_WEST_MED_2026" }
+```
+
+plus per-item `"source"` (a prose authority name) and `"provenance"` (an opaque
+string such as `"BCN-PA-TERM-A"`). Neither resolves to a content-addressed
+artifact. `CRUISE_PORT_INTELLIGENCE_PROFILE_WEST_MED_2026` is a name, not an
+address.
+
+**However**: this content does not exhibit template fingerprints. Values vary
+per port, are specific and checkable (named hospitals with addresses and phone
+numbers, named metro lines, named terminal operators), and read as
+hand-researched. Its provenance model is inadequate; its *content* is not
+demonstrated to be synthetic and **must not be assumed invalid merely because
+`identity.json` in the same directory is**.
+
+### 6.1 `identity.json` vs `port.json` contradictions
+
+| Port | terminals in `identity.json` | in `port.json` | in `terminals.json` | `un_locode` | `unlocode` |
+|---|---|---|---|---|---|
+| barcelona | 1 | 8 | 8 | `ESBCN` | `ES-BCN` |
+| genoa | 1 | 3 | 3 | `ITGOA` | `IT-GOA` |
+| marseille | 1 | 2 | 2 | `FRMRS` | `FR-MRS` |
+| messina | 1 | 1 | 1 | `ITMSN` | `IT-MSN` |
+| naples | 1 | 3 | 3 | `ITNAP` | `IT-NAP` |
+| valletta | 1 | 2 | 2 | `MTMLA` | `MT-MLA` |
+
+Two divergences: the single-terminal count is generator output contradicting
+researched data, and the LOCODE is stored under two field names in two formats
+in the same directory.
+
+---
+
+## 7. Unexpected findings
+
+### U-1 — The frontend bridge is an independent second source of synthetic values
+
+`tools/generate_frontend_bridge.py` (~L130–170) does **not** read these values
+from the knowledge layer. It hardcodes them inline at generation time:
+
+```python
+"berths": ["Berth 1", "Berth 2"],
+"gangwayDeckDefault": 5,
+"distanceToCenterM": 500,
+"walkingTimeMin": 10,
+"cardAcceptancePct": 98,
+"officialSource": {
+ "authority": f"{name} Port Authority",
+ "url": "https://www.timonelo.com",
+ "trustLevel": "OFFICIAL",
+},
+```
+
+Three consequences:
+
+1. **Quarantining `identity.json` does not stop the frontend publishing these
+ values.** `frontend/src/generated/ports.ts` will continue to carry
+ `walkingTimeMin: 10` for all 119 ports regardless of the knowledge layer.
+2. `officialSource.url` is **Timonelo's own domain**, presented as the port
+ authority's official source under `trustLevel: "OFFICIAL"`. The authority
+ name is manufactured by string interpolation.
+3. `locode = p.get("un_locode", "ITGOA")` — any port missing a LOCODE
+ **silently becomes Genoa**. Same pattern for `country` → `"Italy"` and
+ `region` → `"Mediterranean"`.
+
+This is the `fleet.ts` failure mode again: a generated frontend artifact
+carrying values the knowledge layer does not support. It is arguably the more
+serious of the two, because it bypasses the knowledge layer entirely and
+therefore cannot be fixed by any amount of knowledge-layer governance.
+
+**Not fixed in this patch.** The `PortData` TypeScript interface declares these
+fields non-optional, so removing them is a frontend contract change requiring
+a design decision about how the UI renders UNKNOWN. That is not a mechanical
+edit.
+
+### U-2 — Committed generated artifacts are already stale on `develop`
+
+`data/cruise_intelligence_db.json` and `data/cruise_knowledge_graph.json` do
+not match what `develop`'s own knowledge layer compiles to. Verified on a
+pristine `HEAD` checkout with no modifications: regeneration produces a
+~20,000-line diff, concentrated in `ship:msc-bellissima` and
+`ship:msc-meraviglia` cabin attributes.
+
+Regeneration is **deterministic** (byte-identical across repeated runs), so
+this is genuine drift, not nondeterminism.
+
+**Consequence for this patch:** `data/` is deliberately excluded. Regenerating
+would mix ~20k lines of pre-existing unrelated drift into a port quarantine
+diff, making both unreviewable. Regeneration must be a separate, deliberate
+change once the drift is understood.
+
+---
+
+## 8. Remediation applied
+
+See ADR-0006. Summary: `knowledge/ports/*/identity.json` × 119, synthetic
+fields nulled or emptied, blanket source records removed. Entity identity
+fields (`slug`, `name`, `un_locode`, `country`, `region`, `coordinates`,
+`terminals[].name`) preserved unchanged and **not promoted** to trusted facts.
+
+Enforcement: `tests/test_port_identity_quarantine.py`, 13 corpus-wide
+invariants. These are distribution-based rather than per-file, because a
+per-file assertion cannot distinguish researched data from template output.
+
+---
+
+## 9. Explicit UNKNOWNs and unresolved items
+
+| # | Item | Status |
+|---|---|---|
+| K1 | Correct IANA timezone for all 119 ports | UNKNOWN — nulled, needs sourced per-port value |
+| K2 | Correct emergency number for all 119 ports | UNKNOWN — nulled; **passenger-safety priority** |
+| K3 | Walking time / centre distance / step-free access | UNKNOWN — no evidence exists for any port |
+| K4 | Card acceptance rate | UNKNOWN — questionable as a knowledge-layer field at all |
+| K5 | Real terminal and berth inventories | UNKNOWN for 113 ports; 6 rich ports have candidate data |
+| K6 | Validity of all 119 UN/LOCODEs | UNVALIDATED — syntactically well-formed, never checked against UNECE |
+| K7 | `USPEF` and `ITTRS` duplicate pairs | UNRESOLVED — ontology decision, needs its own ADR |
+| K8 | Provenance model for the 6 rich ports | UNRESOLVED — separate audit required |
+| K9 | Frontend bridge hardcoded values (U-1) | UNRESOLVED — frontend contract decision required |
+| K10 | `data/` drift (U-2) | UNRESOLVED — cause not investigated |
+| K11 | Generators still present and will re-emit templates if run | MITIGATED by tests, not removed |
+
+---
+
+## Appendix A — Machine-readable finding summary
+
+```json
+{
+ "audit_date": "2026-08-24",
+ "branch": "develop",
+ "head_sha": "868325a",
+ "corpus": {
+ "port_directories": 119,
+ "identity_files": 119,
+ "rich_layout_ports": ["barcelona", "genoa", "marseille", "messina", "naples", "valletta"]
+ },
+ "template_constants": {
+ "timezone": {"UTC": 119},
+ "walking_time_min": {"10": 119},
+ "card_acceptance_pct": {"98": 119},
+ "step_free_access": {"true": 119},
+ "terminals_per_port": {"1": 119},
+ "distance_to_city_center_m": {"500": 101, "800": 18},
+ "gangway_deck_default": {"5": 108, "2": 11},
+ "sources_field": {"all": 119},
+ "sources_source_id": {"src:official-port-authority": 119},
+ "sources_trust_level": {"OFFICIAL": 119},
+ "sources_retrieved_at": {"2026-08-16T12:00:00Z": 119}
+ },
+ "generators": [
+ {"path": "tools/mass_populate_knowledge.py", "ports": 101, "distance_m": 500},
+ {"path": "tools/populate_classes_and_ports.py", "ports": 18, "distance_m": 800}
+ ],
+ "duplicate_locodes": {
+ "USPEF": ["fort-lauderdale", "port-everglades"],
+ "ITTRS": ["trieste", "venice-trieste"]
+ },
+ "emergency_phone_distribution": {"112": 91, "911": 23, "999": 5},
+ "currency_distribution": {
+ "EUR": 55, "Local": 31, "USD": 17, "NOK": 8, "MXN": 4, "GBP": 2, "SGD": 1, "AUD": 1
+ },
+ "unexpected_findings": ["U-1 frontend bridge hardcodes values", "U-2 data/ drift on develop"]
+}
+```
diff --git a/docs/adr/ADR-0006.md b/docs/adr/ADR-0006.md
new file mode 100644
index 0000000..77c6e6b
--- /dev/null
+++ b/docs/adr/ADR-0006.md
@@ -0,0 +1,227 @@
+# ADR-0006: Quarantine Synthetic Port Identity Intelligence
+
+**Date**: 2026-08-24
+**Status**: `PROPOSED`
+**Governs**: `knowledge/ports/*/identity.json` and its consumers
+**Evidence**: `docs/PORT_IDENTITY_CORPUS_AUDIT_2026-08-24.md`
+
+---
+
+## Context
+
+Every `identity.json` under `knowledge/ports/` was written by one of two bulk
+generators, `tools/mass_populate_knowledge.py` (101 ports) and
+`tools/populate_classes_and_ports.py` (18 ports). Each generator hardcodes a
+template. Across the full corpus of 119 ports, `timezone` is `"UTC"` 119 times,
+`walking_time_min` is `10` 119 times, `card_acceptance_pct` is `98` 119 times,
+and every port carries an identical source record:
+
+```json
+{"field": "all", "source_id": "src:official-port-authority",
+ "trust_level": "OFFICIAL", "retrieved_at": "2026-08-16T12:00:00Z"}
+```
+
+The audit establishes this from generator source, not from inference. These are
+**synthetic/template-derived values without field-level evidence**.
+
+### Why the corpus-wide view was necessary
+
+Each file is individually well-formed and individually plausible. Barcelona
+reads like researched data. The defect exists only in the distribution: one
+distinct value across 119 globally distributed ports is not an observation, it
+is a constant. No per-file review — however careful, and however many files it
+covered — could have surfaced this, because the property that reveals the
+defect is not a property of any file.
+
+This is the governing lesson. A machine-readable corpus is audited by scanning
+it, not by sampling it.
+
+### Why port-by-port cleanup would have been epistemically misleading
+
+The originally commissioned work was a reconciliation sprint: triage each
+port's fields, downgrade unsupported precision, reconcile against external
+research. Applied here, that produces a large diff in which each hunk appears
+to record a considered judgement about a specific port's specific claim.
+
+No such judgements would exist. There is one fact — *these are template
+constants* — restated 119 times. A reviewer reading that diff would reasonably
+conclude that 119 independent assessments had been made, and would be wrong.
+The diff would misrepresent the epistemic work behind it, which is a worse
+failure than the data defect it purports to fix: it would launder a mechanical
+deletion as evidence work.
+
+**A single mechanical operation with one recorded rationale is more honest than
+119 apparent judgements.**
+
+---
+
+## Decision
+
+### D1 — The template-derived identity layer is not canonical port knowledge
+
+`knowledge/ports/*/identity.json` does not constitute evidence for any
+passenger-facing fact. Its synthetic fields are quarantined: set to the
+fail-closed state, not deleted, so that the retraction is visible in the data
+and not merely in this document.
+
+### D2 — `field: "all"` cannot establish provenance
+
+A source record claiming to cover every field attests no field in particular.
+Provenance is a claim that a specific document supports a specific assertion;
+a claim covering everything makes no such connection and is therefore
+unverifiable and unfalsifiable.
+
+`field: "all"` is prohibited on the port identity path. If a genuine case ever
+arises — a single authoritative document that really does attest every field
+in a record — it requires an explicit, named schema exception, not a blanket
+allowance.
+
+### D3 — `OFFICIAL` describes evidence authority, never generator output
+
+`trust_level` is a property of the *evidence*: which body published it, in what
+document, retrievable at what address. It is not a property of the code path
+that wrote the field. A generator cannot confer `OFFICIAL` on values it
+invented, and `src:official-port-authority` — a category noun formatted to
+resemble a source identifier, resolving to no artifact — cannot serve as
+evidence for anything.
+
+### D4 — UNKNOWN is publishable; synthetic precision is not
+
+A null `walking_time_min` tells a passenger to check. A synthetic `10` tells
+them something false with the full authority of the system. The second is
+strictly worse, and the difference is not marginal: unknown values invite
+verification, whereas confident wrong values suppress it.
+
+Absence of evidence is a publishable state. Invented precision is not.
+
+### D5 — Passenger-critical facts fail closed
+
+Where a fact could mislead a traveller into a decision with real consequence —
+missing a departure, calling a wrong emergency number, arriving at an
+inaccessible gangway — insufficient support means the field is nulled, not
+estimated, not defaulted, not carried over.
+
+This decision extends the quarantine to **`logistics.emergency_phone`**, which
+was not in the original scope. The generators derive it from a country
+allow-list with an else-branch, producing `112` for Mexico, Barbados, the
+Cayman Islands and Israel — all incorrect. A wrong emergency number published
+under `OFFICIAL` is the most directly harmful fact in the corpus, and D5
+admits no exception for it.
+
+`logistics.currency` is quarantined on the same basis: 31 ports carry the
+literal string `"Local"`, an else-branch artefact rather than a value.
+
+### D6 — Consumers absorb UNKNOWN; they do not restore values
+
+Where a downstream consumer breaks because a field became null, the consumer
+is fixed to handle the null. Restoring a synthetic value to keep a consumer
+working reintroduces the defect and converts a knowledge-layer problem into a
+permanent one.
+
+---
+
+## Quarantine boundary
+
+### Quarantined — removed from canonical trust
+
+| Field | Action | Basis |
+|---|---|---|
+| `timezone` | → `null` | Template constant `"UTC"` × 119; all-aboard-critical |
+| `terminals[].walking_time_min` | → `null` | Template constant `10` × 119 |
+| `terminals[].distance_to_city_center_m` | → `null` | Template constants `500`/`800` |
+| `terminals[].gangway_deck_default` | → `null` | Template constants `5`/`2` |
+| `terminals[].step_free_access` | → `null` | Template constant `true` × 119; accessibility claim |
+| `terminals[].berths` | → `[]` | Synthetic names interpolated from slug |
+| `logistics.card_acceptance_pct` | → `null` | Template constant `98` × 119 |
+| `logistics.currency` | → `null` | Generator lookup; 31 ports hold `"Local"` |
+| `logistics.emergency_phone` | → `null` | Generator else-branch; confirmed wrong values (D5) |
+| `negative_intelligence` | → `[]` | Two templates with port name interpolated |
+| `sources[]` where `field == "all"` and `source_id == "src:official-port-authority"` | removed | D2, D3 |
+
+Scalars become `null` and lists become `[]` rather than being deleted. The key
+remains present, so the data itself records that a claim was asserted and
+withdrawn. A deleted key is indistinguishable from a claim never made.
+
+### Preserved — but explicitly NOT promoted
+
+`slug`, `name`, `un_locode`, `country`, `region`, `coordinates`,
+`terminals[].name`.
+
+These are retained as **candidate identity data** for referential integrity;
+consumers resolve ports by slug and the graph would lose 119 nodes without
+them. Retention is a compatibility measure and confers no trust:
+
+- They are **not** validated. All 119 LOCODEs are syntactically well-formed and
+ none has been checked against the UNECE list.
+- `USPEF` (`fort-lauderdale`, `port-everglades`) and `ITTRS` (`trieste`,
+ `venice-trieste`) each appear twice, indicating unresolved entity identity.
+- Coordinates are generator-supplied and unverified.
+- **No provenance is invented for them.** They carry no source record, which
+ correctly reflects that no evidence has been produced. Fabricating a
+ plausible source to fill the gap would repeat the defect this ADR exists to
+ correct.
+
+Validation is separate work requiring a real UNECE artifact.
+
+### Explicitly excluded from this decision
+
+**Barcelona, Genoa, Marseille, Messina, Naples, Valletta** hold a richer
+eight-file layout (`port.json`, `transport.json`, `medical.json`,
+`emergency.json`, `terminals.json`, `sustainability.json`, `weather.json`).
+
+Their provenance model is separately inadequate: `source_artifact:
+"CRUISE_PORT_INTELLIGENCE_PROFILE_WEST_MED_2026"` is a name rather than a
+content address, and per-item `provenance` strings such as `"BCN-PA-TERM-A"`
+resolve to nothing.
+
+But their **content shows no template fingerprints**. Values vary per port and
+are specific and checkable — named hospitals with addresses and telephone
+numbers, named metro lines, named terminal operators. This content **must not
+be assumed invalid merely because `identity.json` in the same directory is
+synthetic.** It requires its own audit, which this ADR does not perform and
+does not prejudge. Only their `identity.json` files are quarantined here, on
+identical mechanical grounds to the other 113.
+
+---
+
+## Enforcement
+
+`tests/test_port_identity_quarantine.py` asserts thirteen corpus-wide
+invariants. They are **distribution-based, not per-file**, for the reason given
+above: a per-file assertion cannot distinguish a researched `10` from a
+template `10`, whereas a cardinality check across 119 ports can.
+
+The core rule: *a passenger-facing value may not take one identical value
+across the entire corpus unless a field-scoped source attests it.* Values
+carrying real field-scoped provenance are exempt, so the tests constrain
+unsourced data without obstructing sourced data.
+
+Documentation alone would not hold. The generators remain in `tools/` and
+would restore every quarantined value if re-run. The tests are the structural
+guard, and they fail closed.
+
+---
+
+## Consequences
+
+**Accepted:** the port knowledge base becomes visibly sparse. 119 ports lose
+most passenger-facing fields and gain no replacements. This is the correct
+state — it is what the evidence supports — and it makes the real coverage
+legible for the first time.
+
+**Not addressed:** `tools/generate_frontend_bridge.py` hardcodes the same
+synthetic values independently of the knowledge layer, so
+`frontend/src/generated/ports.ts` will continue publishing them after this
+change. It additionally emits `officialSource.url: "https://www.timonelo.com"`
+under `trustLevel: "OFFICIAL"`, and silently defaults a missing LOCODE to
+Genoa's `ITGOA`. Fixing this is a frontend contract change — the `PortData`
+interface declares these fields non-optional — and requires a decision about
+rendering UNKNOWN. See audit §7 U-1. **Until it is fixed, the passenger-facing
+surface remains contaminated.**
+
+**Not addressed:** `data/` generated artifacts are already stale on `develop`
+independently of this change (audit §7 U-2), so they are excluded here.
+
+**Follow-on work:** UNECE LOCODE validation; entity-identity ADR for the two
+duplicate pairs; provenance audit of the six rich-layout ports; frontend bridge
+remediation; retirement or gating of the two generators.
diff --git a/frontend/src/components/PortExplorer.trust.test.tsx b/frontend/src/components/PortExplorer.trust.test.tsx
new file mode 100644
index 0000000..b21bd3a
--- /dev/null
+++ b/frontend/src/components/PortExplorer.trust.test.tsx
@@ -0,0 +1,196 @@
+import { describe, it, expect } from 'vitest';
+import { renderToStaticMarkup } from 'react-dom/server';
+import { PortExplorer } from './PortExplorer';
+import { LanguageProvider } from '../i18n';
+import { PORTS_REGISTRY, getPortBySlug } from '../ports';
+import { PORTS_REGISTRY as RAW_PORTS } from '../generated/ports';
+
+/**
+ * Passenger-surface trust boundary (audit U-1).
+ *
+ * The port page is where an evidence gap becomes a decision. Someone reads a
+ * walking time and leaves the ship without a shuttle; reads an emergency
+ * number and dials it. So the rule for this surface is stricter than "do not
+ * display wrong data": it must not convert an absent value into advice.
+ *
+ * The specific defect these cover: `(walkingTimeMin ?? 0) > 0` collapsed
+ * "unknown" and "zero" into one branch and answered both with "Shuttle
+ * transfer or taxi recommended". Not knowing how far the centre is does not
+ * imply a shuttle exists, and it does not imply walking is impractical.
+ *
+ * Assertions run against real rendered markup rather than against the model,
+ * because the claim under test is what a passenger sees.
+ */
+
+const render = (slug: string) =>
+ renderToStaticMarkup(
+
+ {}} />
+ ,
+ );
+
+const ALL_SLUGS = PORTS_REGISTRY.map((p) => p.slug);
+
+/** Advice that must never appear as a consequence of a missing value. */
+const OPERATIONAL_ADVICE = [
+ 'Shuttle transfer or taxi recommended',
+ 'Shuttle-Transfer oder Taxi empfohlen',
+ 'shuttle recommended',
+ 'taxi recommended',
+ 'Taxi empfohlen',
+ 'walking not recommended',
+ 'Gehen nicht empfohlen',
+];
+
+describe('PortExplorer — unknown values stay unknown', () => {
+ it('never renders transport advice for any port', () => {
+ for (const slug of ALL_SLUGS) {
+ const html = render(slug);
+ for (const phrase of OPERATIONAL_ADVICE) {
+ expect(
+ html.toLowerCase(),
+ `port "${slug}" renders operational advice: ${phrase}`,
+ ).not.toContain(phrase.toLowerCase());
+ }
+ }
+ });
+
+ it('states walking time as unknown rather than inferring a transfer', () => {
+ for (const slug of ALL_SLUGS) {
+ const port = getPortBySlug(slug);
+ if (port?.distanceToCenterKm == null) continue; // panel not rendered
+ const html = render(slug);
+ const known =
+ typeof port.walkingTimeMin === 'number' && port.walkingTimeMin > 0;
+ if (!known) {
+ expect(
+ html.includes('Walking time unknown') ||
+ html.includes('Gehzeit unbekannt'),
+ `port "${slug}" has no walking time but does not say so`,
+ ).toBe(true);
+ }
+ }
+ });
+
+ it('renders a known positive walking time verbatim', () => {
+ // Guards against fixing the leak by suppressing real values too.
+ const withWalk = PORTS_REGISTRY.find(
+ (p) =>
+ typeof p.walkingTimeMin === 'number' &&
+ p.walkingTimeMin > 0 &&
+ p.distanceToCenterKm != null,
+ );
+ if (!withWalk) {
+ // Correct current state: every curated walking time was unsourced and
+ // has been failed closed. Nothing to assert until one is sourced.
+ expect(
+ PORTS_REGISTRY.every((p) => p.walkingTimeMin == null),
+ ).toBe(true);
+ return;
+ }
+ const html = render(withWalk.slug);
+ expect(html).toContain(String(withWalk.walkingTimeMin));
+ });
+
+ it('treats walkingTimeMin === 0 as unknown, not as "too far to walk"', () => {
+ // 0 was an undocumented sentinel. Nothing may read meaning into it.
+ const zeroed = PORTS_REGISTRY.filter((p) => p.walkingTimeMin === 0);
+ for (const port of zeroed) {
+ const html = render(port.slug);
+ expect(
+ html.includes('Walking time unknown') ||
+ html.includes('Gehzeit unbekannt'),
+ ).toBe(true);
+ }
+ });
+});
+
+describe('PortExplorer — earlier U-1 fixes stay fixed', () => {
+ it('never renders a slug-derived UN/LOCODE', () => {
+ for (const slug of ALL_SLUGS) {
+ const html = render(slug);
+ expect(
+ html,
+ `port "${slug}" renders its slug as a UN/LOCODE`,
+ ).not.toContain(`UN/LOCODE: ${slug.toUpperCase()}`);
+ }
+ });
+
+ it('never claims step-free access', () => {
+ for (const slug of ALL_SLUGS) {
+ const html = render(slug);
+ expect(html).not.toContain('step-free');
+ expect(html).not.toContain('stufenlos');
+ }
+ });
+
+ it('never cites Timonelo as an official source', () => {
+ for (const slug of ALL_SLUGS) {
+ expect(render(slug)).not.toContain('timonelo.com');
+ }
+ });
+});
+
+describe('CURATED_PORT_STORIES cannot inject unsourced operational facts', () => {
+ const OPERATIONAL_FIELDS = [
+ 'walkingTimeMin',
+ 'distanceToCenterKm',
+ 'gangwayDeck',
+ 'terminalPier',
+ 'emergencyPhone',
+ 'policePhone',
+ 'transitNoteDe',
+ 'transitNoteEn',
+ 'airportTransitDe',
+ 'airportTransitEn',
+ 'stepFreeAccess',
+ ] as const;
+
+ it.each(OPERATIONAL_FIELDS)(
+ '%s is null for every port until sourced upstream',
+ (field) => {
+ for (const port of PORTS_REGISTRY) {
+ expect(
+ port[field],
+ `port "${port.slug}" carries an unsourced ${field}`,
+ ).toBeNull();
+ }
+ },
+ );
+
+ it('does not override a null upstream value with a curated one', () => {
+ // The shim may narrow an upstream value to null; it may never widen null
+ // into a value. Checked against the generated bridge output directly.
+ for (const port of PORTS_REGISTRY) {
+ const raw = RAW_PORTS.find((r) => r.slug === port.slug);
+ if (!raw) continue;
+ if (raw.walkingTimeMin == null) expect(port.walkingTimeMin).toBeNull();
+ if (raw.gangwayDeckDefault == null) expect(port.gangwayDeck).toBeNull();
+ if (raw.stepFreeAccess == null) expect(port.stepFreeAccess).toBeNull();
+ if (raw.emergencyPhone == null) expect(port.emergencyPhone).toBeNull();
+ }
+ });
+
+ it('emits no bullet list of unsourced port essentials', () => {
+ for (const port of PORTS_REGISTRY) {
+ expect(port.timEssentialsDe).toHaveLength(0);
+ expect(port.timEssentialsEn).toHaveLength(0);
+ }
+ });
+
+ it('keeps descriptive editorial copy', () => {
+ // Fail-closed applies to operational facts, not to framing. Deleting the
+ // narrative would be over-correction, and the page still needs to read.
+ for (const port of PORTS_REGISTRY) {
+ expect(port.shortName.length).toBeGreaterThan(0);
+ expect(port.headlineEn.length).toBeGreaterThan(0);
+ expect(port.storyEn.length).toBeGreaterThan(0);
+ }
+ });
+});
+
+describe('getPortBySlug', () => {
+ it('returns undefined for an unknown slug rather than another port', () => {
+ expect(getPortBySlug('not-a-real-port')).toBeUndefined();
+ });
+});
diff --git a/frontend/src/components/PortExplorer.tsx b/frontend/src/components/PortExplorer.tsx
index 7899925..3a8798d 100644
--- a/frontend/src/components/PortExplorer.tsx
+++ b/frontend/src/components/PortExplorer.tsx
@@ -55,7 +55,9 @@ export function PortExplorer({ initialPortSlug, onSelectShip }: PortExplorerProp
>
{port.shortName}
- ({port.unLocode})
+ {port.unLocode && (
+ ({port.unLocode})
+ )}
))}
@@ -68,7 +70,10 @@ export function PortExplorer({ initialPortSlug, onSelectShip }: PortExplorerProp
{isGerman ? 'Heute auf der Brücke wichtig' : "Today's Bridge Essentials"}
·
- {selectedPort.shortName} ({selectedPort.unLocode})
+
+ {selectedPort.shortName}
+ {selectedPort.unLocode ? ` (${selectedPort.unLocode})` : ''}
+
@@ -96,8 +101,8 @@ export function PortExplorer({ initialPortSlug, onSelectShip }: PortExplorerProp
- UN/LOCODE: {selectedPort.unLocode}
- {selectedPort.country}
+ UN/LOCODE: {selectedPort.unLocode ?? (isGerman ? 'unbekannt' : 'unknown')}
+ {selectedPort.country ?? (isGerman ? 'unbekannt' : 'unknown')}
@@ -120,7 +125,9 @@ export function PortExplorer({ initialPortSlug, onSelectShip }: PortExplorerProp
{isGerman ? `Deck ${selectedPort.gangwayDeck} regulär` : `Deck ${selectedPort.gangwayDeck} (Regular)`}
- {selectedPort.terminalPier}
+ {selectedPort.terminalPier && (
+ {selectedPort.terminalPier}
+ )}
)}
@@ -133,10 +140,24 @@ export function PortExplorer({ initialPortSlug, onSelectShip }: PortExplorerProp
{selectedPort.distanceToCenterKm} km
+ {/*
+ Three states, not two. `?? 0` previously collapsed null
+ into the same branch as 0 and answered both with
+ "Shuttle transfer or taxi recommended" -- turning "we do
+ not know how long the walk is" into operational advice.
+ An unknown walking time does not imply that walking is
+ impractical, that a shuttle exists, or that a taxi is
+ warranted.
+
+ 0 is treated as unknown as well: it appears in the data
+ as an informal sentinel for "too far to walk", but that
+ meaning is documented nowhere and is indistinguishable
+ here from a missing value.
+ */}
- {(selectedPort.walkingTimeMin ?? 0) > 0
- ? (isGerman ? `ca. ${selectedPort.walkingTimeMin} Min. Gehzeit (stufenlos)` : `approx. ${selectedPort.walkingTimeMin} min walk (step-free)`)
- : (isGerman ? 'Shuttle-Transfer oder Taxi empfohlen' : 'Shuttle transfer or taxi recommended')}
+ {typeof selectedPort.walkingTimeMin === 'number' && selectedPort.walkingTimeMin > 0
+ ? (isGerman ? `ca. ${selectedPort.walkingTimeMin} Min. Gehzeit` : `approx. ${selectedPort.walkingTimeMin} min walk`)
+ : (isGerman ? 'Gehzeit unbekannt' : 'Walking time unknown')}
)}
@@ -148,25 +169,40 @@ export function PortExplorer({ initialPortSlug, onSelectShip }: PortExplorerProp
{t.ports.localTransit}
-
-
-
-
- {isGerman ? 'Öffentlicher Nahverkehr & Fußweg' : 'Local Transit & Walking Path'}
-
-
{transit}
+ {transit && (
+
+
+
+
+ {isGerman ? 'Öffentlicher Nahverkehr & Fußweg' : 'Local Transit & Walking Path'}
+
+
{transit}
+
-
+ )}
-
-
-
-
- {isGerman ? 'Flughafen-Transfer' : 'Airport Connection'}
-
-
{airport}
+ {airport && (
+
+
+
+
+ {isGerman ? 'Flughafen-Transfer' : 'Airport Connection'}
+
+
{airport}
+
-
+ )}
+
+ {/* No transit guidance without evidence. The heading promises
+ a recommendation, so say plainly that there isn't one
+ rather than leaving an empty panel that reads as a bug. */}
+ {!transit && !airport && (
+
+ {isGerman
+ ? 'Keine gesicherten Transferinformationen für diesen Hafen hinterlegt.'
+ : 'No verified transit information on file for this port.'}
+
+ )}
-
{isGerman ? 'Hafen / Polizei:' : 'Port / Police:'} {selectedPort.policePhone}
-
{isGerman ? 'Notarzt & Rettung:' : 'Medical & Emergency:'} {selectedPort.emergencyPhone}
+ {selectedPort.policePhone && (
+
{isGerman ? 'Hafen / Polizei:' : 'Port / Police:'} {selectedPort.policePhone}
+ )}
+ {selectedPort.emergencyPhone && (
+
{isGerman ? 'Notarzt & Rettung:' : 'Medical & Emergency:'} {selectedPort.emergencyPhone}
+ )}
+ {!selectedPort.policePhone && !selectedPort.emergencyPhone && (
+
+ {isGerman
+ ? 'Keine gesicherten Notrufnummern hinterlegt.'
+ : 'No verified emergency numbers on file.'}
+
+ )}