diff --git a/.claude/agents/data-integrity.md b/.claude/agents/data-integrity.md
new file mode 100644
index 0000000..c864089
--- /dev/null
+++ b/.claude/agents/data-integrity.md
@@ -0,0 +1,67 @@
+---
+name: data-integrity
+description: Checks parsed metrics for sanity - macro-mean vs pooled, MAPE scale, Table 8 cross-check, sentinel and degenerate-cell handling
+tools: Read, Grep, Bash
+model: opus
+---
+
+You check numbers, not code style. A number that is wrong by a factor of 100 and
+a number that is wrong by a sign are both silent until someone cites this
+leaderboard in a paper.
+
+Trace values end to end. Pick a specific cell, find its source line in the raw
+data, and confirm the emitted value is that number with the documented
+transformations applied and nothing else. Report the trace, not a summary of it.
+
+## The transformations that are allowed
+
+Exactly these, and each exactly once:
+
+- **MAPE is a fraction in `eval.log`, a percentage in the paper.** Multiply by
+  100 once, at the parse boundary in `tools/ingest.py`. `0.0051` becomes `0.51`.
+  Applied twice it is 51. Applied zero times it is 0.0051. Both look plausible
+  in a table, which is why you check the source line.
+- **Aggregate by macro-mean across the 18 circuits, never row-pooled.** These
+  differ. If they agree on the fixture you are looking at, the fixture is not
+  discriminating and that is itself a finding.
+- **R2 is a per-circuit median plus a positive count, never a mean.** One -335
+  outlier destroys a mean. If you see `statistics.mean` applied to R2, that is a
+  bug regardless of what the test says.
+
+## Values that must survive round-trip
+
+- **Sentinels.** `> 10000 %` (20 cells) and `< -1` (12 cells) display as the
+  sentinel while preserving the real value underneath. A sentinel that has
+  overwritten its own value is data loss.
+- **Degenerate cells.** 24 `mpe`/`mne` cells for the three slack tasks at
+  `global_route` print as "No positive or negative error, n_p = n_n = 0". That
+  is a 0/0, not a zero. They carry `baseline_value: null` and
+  `baseline_state: "degenerate"`. A degenerate cell rendered as a baseline of
+  0.0 means a model can "beat" a baseline that was never measured. Check this
+  specifically.
+- **Saturation means the baseline is at the optimum, and is a stage/task rule,
+  never a numeric test.** Do not restate it as "error is approximately zero":
+  eight of these cells are `tpr`/`tnr` at 100%, where that test is false. A
+  predicate like `mae==0 and mape==0 and r2==1` identifies only 5 of the 10
+  saturated tasks, because the other five publish no MAPE row, no R2 row, or
+  neither. If you find saturation inferred numerically, that is a finding.
+  Degeneracy takes precedence over saturation; reversing the two still yields
+  880 live cells and 232 live combos, so the totals will not catch it for you.
+
+## Sources that must never be read
+
+`aggregated_eval_metrics.csv` R2 columns (0.982 to 1.000 across every cell,
+row-pooled, meaningless), the `eval.log` "Overall" block (also pooled), and all
+tfevents (z-scored targets, 200 to 700x off). Grep for any code path reaching
+these. Their presence anywhere in the read path is a finding even if the value
+is later discarded.
+
+## Cross-checks
+
+`docs/sources/table8_baseline.csv` is tidy at `(task, metric, stage, pdk)` and
+was cross-checked against the arXiv e-print LaTeX with zero mismatches. Use it
+as ground truth. Where a parsed value and a baseline value diverge by more than
+10x, warn rather than fail: one is macro-averaged and the other pooled, so
+divergence is expected and only its magnitude is informative.
+
+Report only correctness gaps. Cite file and line, and show the arithmetic.
diff --git a/.claude/agents/eda-domain.md b/.claude/agents/eda-domain.md
new file mode 100644
index 0000000..98c97b6
--- /dev/null
+++ b/.claude/agents/eda-domain.md
@@ -0,0 +1,93 @@
+---
+name: eda-domain
+description: Checks registry vocabulary compliance, stage-legality logic and void/saturated/degenerate cell handling
+tools: Read, Grep, Glob
+model: sonnet
+---
+
+You check that the code agrees with the dataset's own vocabulary and with the
+paper. Report only mismatches, citing the registry file or table that settles
+each one.
+
+## The registries are the only source of truth
+
+`data/registry/` holds tasks, metrics, stages, pdks and circuits. Never accept a
+task, PDK, stage, metric or circuit name hardcoded anywhere else. `tools/registry.py`
+is the only sanctioned import path for vocabulary.
+
+The grid, all of which must be derived and never written as a literal:
+
+- 12 tasks, 4 PDKs, 5 stage transitions, 18 circuits
+- 240 combos, **232 live** (8 void: `total_wirelength` and `interconnect_length`
+  have no floorplan estimate)
+- 46 metric rows, 920 cells, **880 live**, of which **856 have a published
+  baseline**
+- 24 degenerate: `mpe`/`mne` for the three slack tasks at `global_route`
+- 120 saturated
+
+## Cell states
+
+Five, not four: `beats_baseline`, `matches_baseline`, `baseline_leads`,
+`no_entry`, `saturated`. Tying is the best achievable outcome on roughly 132
+cells, so `matches_baseline` is a real state. Code that collapses it into
+`beats_baseline` or `baseline_leads` is a finding.
+
+## The three exclusion rules, which must not be conflated
+
+- **Void** means the combination cannot exist. 8 combos, from HPWL needing a
+  placement that does not exist at floorplan.
+- **Saturated** means the baseline is already **at the optimum**, so the cell is
+  unwinnable. Note this is not the same as "error is approximately zero": eight
+  of these cells are `tpr`/`tnr` sitting at 100%, where an error-zero test is
+  simply false. Use the registry's wording, in `is_saturated`.
+
+  It is a **stage/task rule, never a numeric test**. A predicate like
+  `mae==0 and mape==0 and r2==1` identifies only 5 of the 10 saturated tasks,
+  because the other five publish no MAPE row, no R2 row, or neither. If
+  saturation is inferred numerically anywhere, report it.
+
+  Saturation is enumerated **positively** in `stages.json`, not as "everything
+  except the two wirelength tasks". The negative form matches the paper's prose,
+  which is exactly why it is a trap: a thirteenth task added later would inherit
+  saturation silently and be permanently unrankable with nothing raising an
+  error. If you see the negative form anywhere, that is a finding.
+
+  **Degeneracy wins over saturation**, and the precedence carries real
+  consequence. Reversed, it yields 144 saturated and 0 degenerate while still
+  producing 880 live cells and 232 live combos - so the phase gate passes green
+  with 24 cells mis-typed. Check the ordering explicitly rather than trusting the
+  totals.
+- **Degenerate** means the baseline was never measured. `baseline_value: null`,
+  `baseline_state: "degenerate"`. Nothing can win against it.
+
+The UI must not conflate these. Three distinct causes, three distinct
+presentations.
+
+## Metric direction and bias
+
+`metrics.json` carries direction once, globally, and every ranking function
+reads it. R2 is higher-is-better; MAE, MAPE, MPE, MNE are lower-is-better.
+
+`mpe` and `mne` additionally carry `bias: conservative | optimistic`. The paper
+ranks a pessimistic prediction above an optimistic one of equal magnitude. A
+ranking function that treats both as plain magnitude is a finding, not a
+simplification.
+
+## Feature stage legality
+
+Table 1 gives each attribute its earliest stage. `data/registry/attributes.json`
+encodes it. The lab's 41 features need a group to namespace lookup: `netlist`,
+`power_metrics` and `timing_metrics` map directly; `cell_metrics` splits between
+Cell Metrics and Area Metrics. All 41 are FP-F and therefore legal, so a guard
+that accepts them proves nothing on its own. Check that it also rejects
+something: `net.length` declared at floorplan is DR-F only and must fail.
+
+## Path parsing
+
+Stage names contain underscores, so `rsplit("_", 2)` on
+`default_config_ng45_global_place` yields `stage="place"`, silently. Parsing must
+be anchored against registry vocabularies.
+
+PDK directory names are uppercase (`default_config_ASAP7_cts`) while registry IDs
+are lowercase. Parsing is case-insensitive and normalizes to the registry ID, or
+all 20 combos silently fail to resolve.
diff --git a/.claude/agents/frontend-reviewer.md b/.claude/agents/frontend-reviewer.md
new file mode 100644
index 0000000..581dac4
--- /dev/null
+++ b/.claude/agents/frontend-reviewer.md
@@ -0,0 +1,62 @@
+---
+name: frontend-reviewer
+description: Checks contrast ratios, keyboard navigation, semantic markup and responsive behavior across both themes
+tools: Read, Glob, Bash
+model: sonnet
+---
+
+You review rendered output in `dist/` and the stylesheets in `static/css/`.
+Report only failures against WCAG 2.1 AA. Aesthetic preferences are not findings.
+
+Check both themes every time. `drexel` is `#07294D` navy with `#FFC600` gold and
+serif headings; `neutral` is a near-white ground with near-black text and one
+accent. They implement the same CSS custom-property contract in
+`static/css/themes/`, so a variable satisfied in one and missing in the other is
+a finding.
+
+## Contrast
+
+Every cell state must clear 4.5:1 against its own background in both themes.
+Compute the ratio, do not estimate it from the hex values looking different.
+Report the measured number.
+
+The data palette is colorblind-safe and shared across themes. Verify it is
+actually shared rather than redefined per theme.
+
+It must cover all five states. `saturated` is the one most likely to have been
+left out, because it is never ranked and never colored win or loss - but "not
+colored win or loss" still means it needs a distinguishable, contrast-passing
+treatment of its own. A palette described as four-state has either forgotten
+`saturated` or forgotten `matches_baseline`; establish which, and report it.
+
+## State must survive the loss of color
+
+There are five cell states: `beats_baseline`, `matches_baseline`,
+`baseline_leads`, `no_entry`, `saturated`. Each needs an icon or text channel
+alongside color. A reviewer who cannot distinguish them in grayscale has found a
+real defect. `matches_baseline` is the one most likely to have been collapsed
+into a neighbor, so check it specifically.
+
+Synthetic records render with a visible marker. Confirm that marker is not
+carried by color alone.
+
+## Keyboard and semantics
+
+- The matrix table is keyboard navigable end to end, and focus is always visible
+- Stage pills are real `<button>` elements with `aria-pressed`, not styled divs
+- The track toggle is reachable and its state is announced
+- Table headers are `<th>` with correct `scope`
+- Interactive elements have accessible names, not just icons
+- Focus order follows visual order
+
+## Responsive
+
+The matrix is 12 task rows collapsing to metric sub-rows against 4 PDK columns.
+Wide content must scroll inside its own container; the page body must never
+scroll horizontally. Check at 360px, 768px and 1280px.
+
+## What to run
+
+`pa11y-ci` runs in CI against `.pa11yci.json`. If you can build, serve `dist/`
+and run it yourself rather than reasoning about the markup. Report what it
+printed. A visual judgement you did not verify is a guess.
diff --git a/.claude/agents/perf-auditor.md b/.claude/agents/perf-auditor.md
new file mode 100644
index 0000000..1183dee
--- /dev/null
+++ b/.claude/agents/perf-auditor.md
@@ -0,0 +1,51 @@
+---
+name: perf-auditor
+description: Measures dist/ size, per-page payload, largest assets and GitHub Pages headroom
+tools: Read, Bash, Glob
+model: haiku
+---
+
+You measure. You do not speculate about performance.
+
+Build if `dist/` is absent, then report actual numbers:
+
+```bash
+# -sb, not -sh. Rounded disk usage makes the 1 GB percentage wrong, and
+# apparent size is what Pages actually counts.
+du -sb dist/
+find dist -type f -printf '%s\t%p\n' | sort -rn | head -20
+find dist -name '*.html' -printf '%s\t%p\n' | sort -rn | head -10
+
+# Committed files against the 1 MB cap. Separate from dist/, and the one that
+# catches a checkpoint or PNG going in by mistake.
+git ls-files -z | xargs -0 -r -n1 stat -c '%s\t%n' | awk '$1 > 1048576'
+
+# Time it explicitly. "Felt fast" is not a measurement, and the 60 s budget
+# exists because Pages deploys time out at 10 minutes.
+/usr/bin/time -f '%e s' make build
+```
+
+## The caps
+
+- GitHub Pages publishes at most **1 GB**. We intend to stay near **20 MB**.
+- CI fails if `dist/` exceeds **200 MB** or any single committed file exceeds
+  **1 MB**.
+- No individual page may exceed **500 KB**.
+- `make build` must complete in under **60 s**; Pages deploys time out at 10
+  minutes.
+
+## What to report
+
+- Total `dist/` size and the percentage of the 1 GB ceiling it uses
+- The 20 largest files, with sizes
+- Any page over 500 KB, named
+- Any committed file over 1 MB, named
+- Build wall time
+
+Checkpoints, PNGs and tfevents belong in GitHub Releases or Hugging Face,
+referenced by URL. If you find one committed, that is the finding, and it is the
+top one.
+
+State the numbers plainly. If everything is within cap, say so with the numbers
+that show it rather than a bare pass. A size report without measurements is not a
+size report.
diff --git a/.claude/agents/plan-auditor.md b/.claude/agents/plan-auditor.md
new file mode 100644
index 0000000..c99f71b
--- /dev/null
+++ b/.claude/agents/plan-auditor.md
@@ -0,0 +1,49 @@
+---
+name: plan-auditor
+description: Reviews a diff against PLAN.md for correctness and requirement gaps
+tools: Read, Grep, Glob, Bash
+model: opus
+---
+
+You are reviewing a diff against a written plan. You see only the diff and the
+plan, not the reasoning that produced the change.
+
+Report ONLY:
+- Requirements in the plan that are not implemented
+- Implemented behavior that contradicts the plan
+- Correctness bugs: wrong logic, unhandled cases the plan names, silent failures
+- Changes outside the stated scope of this phase
+
+Do NOT report style preferences, naming opinions, or speculative refactors.
+If the work is sound, say so plainly. Cite file and line for every finding.
+
+## How to read this repo's plan
+
+`PLAN.md` in the repository root is authoritative. It has been revised in place
+during the build, and revisions are marked (`Corrected 2026-08-10`,
+`Added 2026-08-10`). A stale copy of an earlier draft has circulated: if a claim
+you are checking against is not in the file you can actually read at
+`PLAN.md`, it is not a requirement. Do not review against remembered content.
+
+Each phase has a **Gate** section with an explicit command list. That list is the
+requirement set, not the prose above it. Work through it item by item.
+
+## Failure modes specific to this project
+
+Weight these heavily, because they have all occurred here:
+
+- **A check that passes without running.** `tools/validate.py` refuses to exit 0
+  with an empty check registry, for exactly this reason. Apply the same
+  suspicion everywhere: a guard that reports success on an empty input set, a
+  matrix leg with zero entries, a test that asserts nothing.
+- **A check that fails for the wrong reason.** A red status is not evidence the
+  assertion ran. If a guard does setup work before its assertion, a setup
+  failure produces a result indistinguishable from a real catch.
+- **Hardcoded counts.** The derived totals are 46 metric rows, 880 live cells,
+  856 with a published baseline, 24 degenerate, 232 live combos, 8 void, 120
+  saturated. Every one must be computed from `data/registry/`, never written as
+  a literal. `tests/test_no_hardcoded_counts.py` exists to enforce this.
+- **Scope creep across phases.** A Phase N diff that touches Phase N+2
+  deliverables is a finding even when the code is correct.
+
+Run `make check` if the diff touches Python. Report what it actually printed.
diff --git a/.claude/agents/repo-scout.md b/.claude/agents/repo-scout.md
new file mode 100644
index 0000000..7fde3c8
--- /dev/null
+++ b/.claude/agents/repo-scout.md
@@ -0,0 +1,44 @@
+---
+name: repo-scout
+description: Fast codebase search that keeps exploration out of the main context
+tools: Read, Grep, Glob
+model: haiku
+---
+
+You find things. You do not review them, refactor them, or offer opinions about
+them.
+
+You exist so the main session can ask "where is X" without reading forty files
+into its own context. Answer with locations and the minimum excerpt that settles
+the question.
+
+## Output shape
+
+For each hit:
+
+```text
+path/to/file.py:123
+    the two or three lines that actually answer the question
+```
+
+Then one or two sentences of orientation if the structure is not obvious from
+the paths alone. Nothing else. No summary of what the code does, no assessment
+of whether it is good, no suggested changes.
+
+If you find nothing, say so and list where you looked. A confident wrong answer
+costs more than an admission of absence.
+
+If the answer is genuinely large - more than about fifteen locations - say that,
+give the shape of the distribution (which directories, roughly how many each),
+and ask for a narrower query rather than dumping everything.
+
+## Orientation
+
+- `tools/` holds pure functions; `build.py` and CLI entry points hold the side
+  effects
+- `tools/registry.py` is the only sanctioned import path for vocabulary
+- `data/registry/` is the single source of truth for tasks, metrics, stages,
+  pdks and circuits, and is generated, never hand-edited
+- `templates/pages/*.html` render into `dist/`
+- `static/js/` is one file per feature, vanilla only
+- `tests/` mirrors `tools/`
diff --git a/.claude/agents/security-reviewer.md b/.claude/agents/security-reviewer.md
new file mode 100644
index 0000000..132ba0b
--- /dev/null
+++ b/.claude/agents/security-reviewer.md
@@ -0,0 +1,81 @@
+---
+name: security-reviewer
+description: Reviews unpickling paths, secrets, fork-PR workflow safety and untrusted-input handling
+tools: Read, Grep, Glob, Bash
+model: opus
+---
+
+Assume an adversary who can open a pull request. That is the whole threat model
+and it is sufficient, because both repos are public and the experiments repo
+exists to accept submissions from people outside the lab.
+
+Report only findings that create a real exposure. For each, say whether it is
+blocked, flagged, or undetected, and name the concrete path an attacker takes.
+A theoretical concern with no reachable path is not a finding.
+
+## Deserialization - the absolute rule
+
+**Never unpickle a checkpoint.** A `.ckpt` is a pickle and community submissions
+run on our runner.
+
+`weights_only=True` is necessary but *not sufficient*, and this is the part
+reviewers get wrong. It rejects all 360 of the lab's own checkpoints, because
+Lightning pickled `eda_ml.schema.ModelConfig` into every one. Verified: 360
+scanned, 360 refused. The resulting error message helpfully suggests
+`weights_only=False`, which is precisely the arbitrary-code-execution path the
+rule exists to prevent.
+
+So the findings to hunt are:
+- any `torch.load` at all, with or without `weights_only`
+- `torch.serialization.add_safe_globals`, or any growing allowlist
+- `yaml.full_load`, `yaml.UnsafeLoader`, `yaml.Loader`, or bare `yaml.load`
+  without an explicit safe loader
+
+The sanctioned readers are `tools/ckpt.py` (treats the `.ckpt` as the zip it is,
+walks `data.pkl` with an `Unpickler` whose `find_class` returns an inert
+placeholder for any foreign global) and `tools/yamlsafe.py` (tag-stripping
+`SafeLoader` subclass, because `hparams.yaml` carries `!!python/object:` tags
+that make plain `safe_load` raise). `tools/checks/no_unpickling.py` enforces
+this in CI. Verify the enforcement still greps what it claims to.
+
+## Workflow safety
+
+The controlling question: **can a pull request from a fork reach a job that
+holds a write permission or a secret?**
+
+- `pull_request_target` must appear nowhere. It runs with the base repo's
+  secrets and a write token; combined with an untrusted checkout it is the
+  documented pwn-request. If you find it, that is the top finding regardless of
+  what else is in the diff.
+- Every workflow declares `permissions: {}` at the top level and grants per job.
+  A missing top-level block means the repo default applies, which is a finding.
+- Any job holding a write scope must be unreachable from a fork PR, and the
+  reason must be structural, not incidental. An `if:` gate on
+  `github.event.pull_request.head.repo.full_name` is good; relying only on
+  GitHub's fork token downgrade is thinner, and relying on neither is a finding.
+- Any workflow holding a write scope pins its actions to commit SHAs, not
+  floating tags. `deploy.yml` (`pages: write`) and `codeql.yml`
+  (`security-events: write`) are the current set.
+- No untrusted string may be interpolated into a `run:` block. That includes PR
+  title and body, branch names, commit messages, and every field of
+  `client_payload` on `repository_dispatch`. Pass through `env:` and quote.
+
+## Secrets
+
+Nothing static where federation was specified. `claude-review.yml` authenticates
+by workload identity federation, so no Anthropic credential should appear in
+repo secrets at all. `SITE_DISPATCH_TOKEN` in the experiments repo is the one
+sanctioned stored credential, because `GITHUB_TOKEN` cannot dispatch across
+repositories; it must be fine-grained and scoped to the site repo only.
+
+A secret referenced in a workflow that is not set is not safe, it is untested.
+Flag any job that reports success when its credential is absent.
+
+## Guard layers
+
+Layer 4 executes `predict.py` deliberately. The control there is process
+isolation, not static analysis. Check that the isolation described actually
+exists in code rather than only in a comment.
+
+When reviewing `tools/guard/`, assume a submitter who wants a green cell without
+a working model. Name every way through you can find.
diff --git a/.github/ISSUE_TEMPLATE/bug.yml b/.github/ISSUE_TEMPLATE/bug.yml
new file mode 100644
index 0000000..19afb8f
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/bug.yml
@@ -0,0 +1,46 @@
+name: Site bug
+description: Something on the site is broken, unreadable, or unreachable
+title: "[bug]: "
+labels: ["bug"]
+body:
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened
+      description: What you did, what you expected, what you got instead.
+    validations:
+      required: true
+
+  - type: input
+    id: url
+    attributes:
+      label: Page
+      placeholder: https://jiwanizakir.github.io/eda-schema-leaderboard/...
+    validations:
+      required: true
+
+  - type: dropdown
+    id: theme
+    attributes:
+      label: Theme
+      description: Several issues appear in only one theme.
+      options:
+        - drexel
+        - neutral
+        - Both
+        - Not sure
+    validations:
+      required: true
+
+  - type: input
+    id: env
+    attributes:
+      label: Browser and OS
+      placeholder: Firefox 141 on macOS 15
+
+  - type: checkboxes
+    id: a11y
+    attributes:
+      label: Accessibility
+      options:
+        - label: This is an accessibility problem (contrast, keyboard, screen reader)
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
new file mode 100644
index 0000000..5a0cbae
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -0,0 +1,13 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Submit a model to the leaderboard
+    url: https://github.com/JiwaniZakir/eda-schema-experiments
+    about: Submissions are pull requests against the experiments repo, not issues here.
+
+  - name: Report a security vulnerability
+    url: https://github.com/JiwaniZakir/eda-schema-leaderboard/security/advisories/new
+    about: Please report privately rather than in a public issue.
+
+  - name: Ask a question about the dataset or the paper
+    url: https://arxiv.org/abs/2605.06952
+    about: Questions about EDA-Schema-V2 itself belong with the dataset authors.
diff --git a/.github/ISSUE_TEMPLATE/data-error.yml b/.github/ISSUE_TEMPLATE/data-error.yml
new file mode 100644
index 0000000..31d2704
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/data-error.yml
@@ -0,0 +1,63 @@
+name: Incorrect number on the leaderboard
+description: A baseline, a ranking, or a cell state that does not match the source
+title: "[data]: "
+labels: ["data-integrity"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        This is the most important kind of report we receive. Other groups cite
+        these numbers, so a wrong one propagates.
+
+        If you can, cite the source you checked against: a table and page of
+        arXiv:2605.06952, or a line in an `eval.log`.
+
+  - type: input
+    id: cell
+    attributes:
+      label: Which cell
+      description: >-
+        Cell identity is (task, metric, pdk, stage). Copy it from the cell page
+        URL if that is easier.
+      placeholder: total_area_prediction / mape / NG45 / global_place
+    validations:
+      required: true
+
+  - type: input
+    id: shown
+    attributes:
+      label: Value shown
+      placeholder: "0.51"
+    validations:
+      required: true
+
+  - type: input
+    id: expected
+    attributes:
+      label: Value you expected
+      placeholder: "51.0"
+    validations:
+      required: true
+
+  - type: textarea
+    id: source
+    attributes:
+      label: What you checked against
+      description: Table and page, a log line, or the computation you ran.
+      placeholder: |
+        Table 8, page 29 of arXiv:2605.06952 reads 51.0 for this cell.
+    validations:
+      required: true
+
+  - type: dropdown
+    id: kind
+    attributes:
+      label: What looks wrong
+      options:
+        - The number itself
+        - The cell state (win/loss/tie/saturated/no entry)
+        - A sentinel is displayed where a value should be, or vice versa
+        - The cell is marked void or degenerate and should not be
+        - Something else
+    validations:
+      required: true
diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml
index 01ed626..6cd3746 100644
--- a/.github/workflows/claude-review.yml
+++ b/.github/workflows/claude-review.yml
@@ -20,50 +20,71 @@ permissions: {}
 #    because it performs actor permission checks and handles fork contexts.
 # 4. No PR-controlled text is interpolated into any run: step.
 #
-# The API key is intentionally not required for fork PRs; the job simply skips,
-# rather than the workflow being written so a fork could reach a secret.
+# AUTHENTICATION - workload identity federation, per PLAN.md Phase 0.
+#
+# There is no Anthropic credential in this repository's secrets, and there should
+# never be one. The action exchanges the workflow's GitHub OIDC token for a
+# short-lived Anthropic token, which is what `id-token: write` below is for.
+# The three `vars.*` values are identifiers, not credentials - a rule ID, an org
+# UUID and a service account ID - so they live in repository variables and are
+# safe to read.
+#
+# This replaced an `anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}` setup
+# where the secret was never set. The workflow resolved that in a `preflight` job
+# that skipped the review when the key was absent, so `claude-review` reported
+# SUCCESS on every pull request while never once invoking Claude. A workflow that
+# is green because it did nothing is worse than one that is plainly red.
+#
+# The fix is structural, not a bigger warning. `secrets` is not available in a
+# job-level `if:`, which is why the preflight job existed. `vars` IS available
+# there, so the whole job now gates on configuration directly. When the
+# identifiers are unset, zero jobs run and the workflow reports SKIPPED - a grey
+# icon, not a green tick. When they are set and the federation exchange fails,
+# the action step fails and takes the job with it. Neither state can be mistaken
+# for a successful review.
+#
+# TO ENABLE: set these three repository variables (Settings > Secrets and
+# variables > Actions > Variables), obtained from the Claude Console:
+#   ANTHROPIC_FEDERATION_RULE_ID    fdrl_...
+#   ANTHROPIC_ORGANIZATION_ID       a UUID
+#   ANTHROPIC_SERVICE_ACCOUNT_ID    svac_...
+#
+# When creating the federation rule, constrain its subject. Anthropic's own
+# guidance warns that an under-constrained `subject_prefix` also matches
+# `pull_request` runs triggered from forks. For `pull_request` events the GitHub
+# OIDC subject is `repo:OWNER/REPO:pull_request` with no ref component, so a ref
+# constraint alone does not separate a fork PR from a same-repo one. Pin the
+# prefix to this repository and add a `repository_owner` claim constraint. The
+# same-repo `if:` gate below is defence in depth on top of that, not a substitute.
 
 jobs:
-  # The `secrets` context is not available in a job-level `if`, so whether the key
-  # exists has to be resolved in a step and passed on as an output. Without this
-  # the review job runs with an empty key and fails, which under branch protection
-  # would block every merge on a missing secret.
-  preflight:
-    if: github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: ubuntu-latest
-    permissions: {}
-    outputs:
-      configured: ${{ steps.key.outputs.configured }}
-    steps:
-      - id: key
-        env:
-          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
-        run: |
-          if [ -n "$ANTHROPIC_API_KEY" ]; then
-            echo "configured=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "configured=false" >> "$GITHUB_OUTPUT"
-            echo "::notice::ANTHROPIC_API_KEY is not set; skipping automated review."
-          fi
-
   review:
-    # Skip forks entirely: they cannot access the key, and a job that appears to
-    # run but silently does nothing is worse than one that plainly did not.
-    needs: preflight
-    if: needs.preflight.outputs.configured == 'true'
+    # Three independent conditions, all required:
+    #   - the PR is from a branch in this repo, never a fork
+    #   - federation is actually configured
+    # A fork PR additionally gets `id-token` downgraded to read by GitHub, so the
+    # OIDC fetch would fail even if this gate were removed. Three layers, because
+    # the cost of the outer two is one expression each.
+    if: >-
+      github.event.pull_request.head.repo.full_name == github.repository
+      && vars.ANTHROPIC_FEDERATION_RULE_ID != ''
+      && vars.ANTHROPIC_ORGANIZATION_ID != ''
     runs-on: ubuntu-latest
     permissions:
       contents: read
       pull-requests: write
+      id-token: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: anthropics/claude-code-action@v1
+      - uses: anthropics/claude-code-action@239e3a730883eeb5c53db12b0fc9573b3024b126 # v1
         with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
+          anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
+          anthropic_service_account_id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
           prompt: |
             Review this pull request against PLAN.md and docs/DATA_CONTRACT.md.
 
@@ -77,3 +98,30 @@ jobs:
 
             Do not report style preferences or speculative refactors.
             If the work is sound, say so plainly.
+
+            Use `gh pr comment` for top-level feedback and
+            mcp__github_inline_comment__create_inline_comment for specific lines.
+            Post findings as GitHub comments; do not return them as chat text.
+
+          # Tool restriction is what actually makes this review-only, because the
+          # job's `permissions:` block does not constrain Claude: by default the
+          # action does not use GITHUB_TOKEN at all. It mints a Claude GitHub App
+          # installation token whose scope is set server-side and includes
+          # contents:write. `contents: read` above does NOT stop Claude
+          # committing.
+          #
+          # Both flags, not just the allowlist. --allowedTools only PRE-APPROVES;
+          # tools left off it are still available and fall through to the
+          # permission mode. In headless mode that fallthrough currently denies,
+          # so an allowlist alone happens to work - but it is an implicit
+          # behaviour of the runner, not a stated guarantee, and it is one
+          # default change away from silently granting Edit and Write on a
+          # workflow that reviews pull requests.
+          #
+          # --disallowedTools takes precedence and cannot be overridden by any
+          # other permission rule, so the denial is explicit and order-independent.
+          claude_args: >-
+            --allowedTools
+            "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Read,Grep,Glob"
+            --disallowedTools
+            "Edit,Write,NotebookEdit,Bash(git:*),Bash(gh pr create:*),Bash(gh pr merge:*),Bash(gh pr close:*),Bash(gh workflow:*),Bash(gh secret:*),Bash(gh api:*)"
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index d6c9e99..dc9e5d9 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -9,6 +9,12 @@ on:
 
 permissions: {}
 
+# The `analyze` job holds `security-events: write`, so its actions are pinned to
+# commit SHAs rather than floating tags, on the same reasoning deploy.yml gives:
+# a retagged upstream reaches a job that can write to this repo's security
+# surface. `detect` is contents:read and could float, but pinning the whole file
+# keeps the rule "any workflow with a write scope is pinned" checkable by eye.
+# Dependabot updates SHA pins, so this costs nothing to maintain.
 jobs:
   # CodeQL hard-errors with "could not process any code" when a language has no
   # source, and there is no JavaScript until Phase 6 adds static/js/. Detecting
@@ -21,7 +27,7 @@ jobs:
     outputs:
       languages: ${{ steps.pick.outputs.languages }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           persist-credentials: false
 
@@ -45,15 +51,15 @@ jobs:
       matrix:
         language: ${{ fromJSON(needs.detect.outputs.languages) }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           persist-credentials: false
 
-      - uses: github/codeql-action/init@v3
+      - uses: github/codeql-action/init@c4dd10e44af883a891fe31ced449bcb4a6728b9b # v3
         with:
           languages: ${{ matrix.language }}
           queries: security-extended
 
-      - uses: github/codeql-action/analyze@v3
+      - uses: github/codeql-action/analyze@c4dd10e44af883a891fe31ced449bcb4a6728b9b # v3
         with:
           category: /language:${{ matrix.language }}
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 88f930f..c3cf35b 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -14,11 +14,16 @@ on:
 permissions: {}
 
 # Actions here are pinned to commit SHAs, not floating major tags, because this
-# is the only workflow that holds `pages: write`. A retagged upstream would
-# publish arbitrary content to the public leaderboard, which is exactly what the
+# workflow holds `pages: write`. A retagged upstream would publish arbitrary
+# content to the public leaderboard, which is exactly what the
 # tj-actions/changed-files compromise did across thousands of repos in 2025.
 # Dependabot updates SHA pins, so this costs nothing to maintain.
-# Other workflows stay on tags: they are contents:read with no secrets.
+#
+# The rule is "any workflow holding a write scope is pinned", and it applies to
+# codeql.yml too, whose analyze job holds `security-events: write`. This comment
+# previously claimed deploy.yml was the only such workflow, which was untrue and
+# left codeql.yml floating. Workflows that are contents:read with no secrets
+# (ci, size-guard, link-check, a11y) stay on tags deliberately.
 
 # Never cancel a deploy midway; a half-published site is worse than a slow one.
 concurrency:
diff --git a/.github/workflows/parser-repair.yml b/.github/workflows/parser-repair.yml
new file mode 100644
index 0000000..b766852
--- /dev/null
+++ b/.github/workflows/parser-repair.yml
@@ -0,0 +1,107 @@
+name: parser-repair
+
+# Maintainer-triggered only. Never on an event an outsider can cause.
+on:
+  workflow_dispatch:
+    inputs:
+      failure:
+        description: "Link to the failing validate-submission run, or the submission path"
+        required: true
+        type: string
+      notes:
+        description: "What the parser got wrong, if you already know"
+        required: false
+        type: string
+
+permissions: {}
+
+# TWO DELIBERATE DEVIATIONS FROM PLAN.md. Both are security-driven.
+#
+# 1. PLAN.md lists this under "Experiments repo workflows". It lives here instead,
+#    because the parser it repairs - tools/ingest.py - is in THIS repository. Put
+#    in the experiments repo it would need a cross-repo token with contents:write
+#    on the site repo, which is a second long-lived credential with write access
+#    to the published leaderboard. Running it where the code already is means the
+#    job's own GITHUB_TOKEN suffices and no new credential exists.
+#
+# 2. PLAN.md triggers it "on validate-submission failure", which would be a
+#    workflow_run trigger. That cannot work for the case it exists to serve.
+#    claude-code-action performs actor permission checks on workflow_run events,
+#    checking both the run actor and the actor that started the upstream run. A
+#    fork submitter has no write access, so the action refuses - and a fork
+#    submission is precisely when a parser bug surfaces. The documented
+#    workaround, allowed_non_write_users, is labelled by the action's own docs as
+#    a significant security risk that bypasses its primary control, and it would
+#    hand prompt control over a contents:write job to anyone who can open a PR.
+#
+#    So this is workflow_dispatch: a maintainer reads the failure, decides it is
+#    a parser bug rather than a bad submission, and triggers the repair. That is
+#    the same human-in-the-loop step PLAN.md asks for two paragraphs later, moved
+#    one step earlier. Triggering requires write access, which is the control.
+#
+# The inputs below are maintainer-authored and reach Claude as prompt text. They
+# are never interpolated into a run: block. A maintainer who can dispatch this
+# can already push to a branch, so the trust boundary does not move.
+
+jobs:
+  repair:
+    if: >-
+      vars.ANTHROPIC_FEDERATION_RULE_ID != ''
+      && vars.ANTHROPIC_ORGANIZATION_ID != ''
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          fetch-depth: 0
+
+      - uses: anthropics/claude-code-action@239e3a730883eeb5c53db12b0fc9573b3024b126 # v1
+        with:
+          anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
+          anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
+          anthropic_service_account_id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
+          prompt: |
+            A submission failed to ingest and a maintainer has judged it a parser
+            bug rather than a bad submission.
+
+            Failing run or path: ${{ inputs.failure }}
+            Maintainer notes: ${{ inputs.notes }}
+
+            Fix the parser so the submission ingests. Constraints that are not
+            negotiable:
+
+            - Nothing is asked of submitters. Do NOT introduce a per-submission
+              metadata file, and do not propose one. If a field seems to need it,
+              derive it or emit null with a badge.
+            - Never add a call to torch.load, yaml.full_load, yaml.UnsafeLoader,
+              or torch.serialization.add_safe_globals. weights_only=True is NOT
+              sufficient here - it rejects all 360 of the lab's own checkpoints.
+              Read tensor shapes through the restricted reader instead.
+            - Stage names contain underscores and PDK directory names are
+              uppercase. Parse against the registry vocabulary, never by
+              splitting on "_".
+            - Add a failing test first, then make it pass.
+
+            Run `make check` and confirm it is green before committing.
+
+            Commit to a new branch named fix/parser-<short-slug>. Do NOT open a
+            pull request - print the PR creation link and stop. A human decides
+            whether this reaches main.
+
+          # Editing and committing are allowed here, deliberately - that is the
+          # job. Opening a pull request is not, which is the human-in-the-loop
+          # step PLAN.md asks for.
+          #
+          # That prohibition is stated with --disallowedTools rather than left to
+          # the allowlist's omission. --allowedTools only pre-approves; anything
+          # absent from it still falls through to the permission mode, so "not
+          # listed" is not the same as "denied". --disallowedTools takes
+          # precedence and cannot be overridden. On a job holding contents:write,
+          # the difference between those two is the whole human-in-the-loop step.
+          claude_args: >-
+            --allowedTools
+            "Read,Grep,Glob,Edit,Write,Bash(make check),Bash(uv run:*),Bash(git add:*),Bash(git commit:*),Bash(git checkout -b:*),Bash(git push origin:*),Bash(git status),Bash(git diff:*)"
+            --disallowedTools
+            "Bash(gh pr create:*),Bash(gh pr merge:*),Bash(gh api:*),Bash(gh workflow:*),Bash(gh secret:*),Bash(gh release:*),Bash(git push --force:*),Bash(git push origin main:*),Bash(curl:*),Bash(wget:*)"
diff --git a/.github/workflows/size-guard.yml b/.github/workflows/size-guard.yml
index 05884a7..90903dc 100644
--- a/.github/workflows/size-guard.yml
+++ b/.github/workflows/size-guard.yml
@@ -11,6 +11,22 @@ env:
   MAX_DIST_MB: 200
   MAX_FILE_MB: 1
 
+# Two jobs, because they answer different questions and must be able to fail
+# independently.
+#
+# `size` asks what the PR adds to git. `dist-size` asks what the build emits.
+# They were one job, in which the build ran first. That ordering meant a broken
+# build failed the job before the file-size check ever executed, while still
+# reporting exactly what a working guard reports: a red X on `size`. It happened
+# on phase-1/registries and phase-2/baseline, where build.py was absent and the
+# guard reported failure having measured nothing.
+#
+# So: `size` does no dependency install and no build. It cannot be masked by
+# anything upstream of the assertion it exists to make. A guard whose red can be
+# caused by something other than the condition it checks is not a guard.
+#
+# The job name `size` is load-bearing - it is a required status check on main.
+# Renaming it silently voids that branch protection rule.
 jobs:
   size:
     runs-on: ubuntu-latest
@@ -21,15 +37,6 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: astral-sh/setup-uv@v5
-        with:
-          enable-cache: true
-
-      - run: uv sync --all-extras
-
-      - name: Build
-        run: uv run python build.py
-
       - name: Check committed file sizes
         run: |
           # Checks what the PR actually adds to git, not what the build emits.
@@ -39,6 +46,12 @@ jobs:
           # default), and the quoted string then fails `[ -f ]` and gets skipped
           # silently. An over-cap file named `café.ckpt` sailed past this guard.
           # With -z git emits raw paths, NUL-separated.
+          # Listed into a file first, rather than piped straight from a process
+          # substitution. Process substitution does not propagate its exit status,
+          # so a failing `git ls-files` would just yield an empty loop and read as
+          # a clean scan. Here `set -e` catches the failure at the redirect.
+          git ls-files -z > /tmp/tracked.z
+
           fail=0
           limit=$((MAX_FILE_MB * 1024 * 1024))
           seen=0
@@ -50,12 +63,43 @@ jobs:
               echo "::error file=$f::$f is $((bytes / 1048576)) MB, over the ${MAX_FILE_MB} MB cap"
               fail=1
             fi
-          done < <(git ls-files -z)
+          done < /tmp/tracked.z
           echo "checked $seen tracked files against the ${MAX_FILE_MB} MB cap"
+
+          # A scan that walked zero files is a broken scan, not a clean repo.
+          # Without this, a checkout failure or a bad working directory reads as
+          # a pass. Same reasoning as tools/validate.py refusing an empty check
+          # registry: never report success for work that did not happen.
+          if [ "$seen" -eq 0 ]; then
+            echo "::error::no tracked files were scanned; the guard did not run"
+            exit 1
+          fi
           exit $fail
 
+  dist-size:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+
+      - run: uv sync --all-extras
+
+      - name: Build
+        run: uv run python build.py
+
       - name: Check dist size
         run: |
+          if [ ! -d dist ]; then
+            echo "::error::build produced no dist/ directory"
+            exit 1
+          fi
           mb=$(du -sm dist | cut -f1)
           echo "dist/ is ${mb} MB (cap ${MAX_DIST_MB} MB)"
           if [ "$mb" -gt "$MAX_DIST_MB" ]; then
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 0000000..754c555
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,142 @@
+# EDA-Schema Leaderboard
+
+Static benchmark leaderboard for the EDA-Schema-V2 dataset (arXiv:2605.06952).
+Python + Jinja2 → static HTML → GitHub Pages. No framework, no bundler, no Node.
+
+Detail lives in `docs/`. Read those on demand, not by default:
+- Build plan and phase gates: @PLAN.md
+- Data contract and field definitions: @docs/DATA_CONTRACT.md
+- Submission rules and verification tiers: @docs/SUBMISSION.md
+
+## Commands
+
+```bash
+make install        # uv sync
+make ingest         # parse experiments repo → data/ shards
+make synth          # regenerate synthetic fill for unpopulated cells
+make validate       # JSON Schema + guard layers 1-5; exits non-zero on failure
+make build          # render dist/
+make serve          # dist/ on :8000
+make test           # pytest
+make check          # validate + test + build — run this before any commit
+```
+
+`make check` is the gate. YOU MUST run it and show the output before claiming a
+task is complete. Do not report success from reading the code.
+
+## The grid
+
+Five dimensions, all defined in `data/registry/`. Registries are the single
+source of truth — never hardcode a task, PDK, stage, metric, or circuit name
+anywhere else.
+
+- 12 tasks × 4 PDKs × 5 stage transitions = 240 combos, **232 live**
+  (8 void: `total_wirelength` and `interconnect_length` have no floorplan estimate)
+- 46 metric rows × 4 PDKs × 5 stages = 920, **880 live cells**, of which **856
+  have a published baseline**. The other 24 are `mpe`/`mne` for the three slack
+  tasks at `global_route`, printed as "No positive or negative error, n_p = n_n =
+  0". That is a 0/0, not a zero. They stay live but carry `baseline_value: null`
+  and `baseline_state: "degenerate"`, so nothing can win against a baseline that
+  was never measured. See @docs/DATA_CONTRACT.md.
+- Cell identity is `(task, metric, pdk, stage)`. Shard files are keyed at
+  `(task, pdk, stage)` — one file serves all of that task's metric cells.
+
+Five cell states: `beats_baseline`, `matches_baseline`, `baseline_leads`,
+`no_entry`, `saturated`. Tying is the best achievable outcome on ~132 cells, so
+`matches_baseline` is a real state, not an edge case.
+
+**Saturation is a stage/task rule, never a numeric test:** `global_route`, minus
+the two wirelength tasks, minus the degenerate cells — exactly 120. A predicate
+like `mae==0 and mape==0 and r2==1` catches only 5 of the 10 saturated tasks,
+because the other five publish no MAPE row, no R² row, or neither. Saturated cells
+are never ranked and never colored win/loss.
+
+## Data gotchas
+
+These have all bitten us already. They are not hypothetical.
+
+**Stage names contain underscores.** `rsplit("_", 2)` on
+`default_config_ng45_global_place` yields `stage="place"`. Always parse with the
+anchored regex in `tools/paths.py`, which matches against registry vocabularies.
+
+**`hparams.yaml` lies about architecture.** It reports `in_features: 7` where the
+trained weight is `(64, 41)`, and `params=0` for every layer. Read architecture
+from checkpoint tensor shapes only. Same for `default_config.dot` — it is wrong
+and is excluded from the sparse checkout.
+
+**Never unpickle a checkpoint.** A `.ckpt` is a pickle, and community submissions
+run on our runner. `weights_only=True` is necessary but *not sufficient*: it
+rejects all 360 of the lab's own checkpoints, because Lightning pickled
+`eda_ml.schema.ModelConfig` into every one of them. Verified - 360 scanned, 360
+refused. The error message helpfully suggests `weights_only=False`, which is the
+arbitrary-code-execution path this rule exists to prevent. Do not take it, and do
+not grow a `safe_globals` allowlist either.
+
+Read tensor shapes with the restricted reader in `tools/ckpt.py`: treat the `.ckpt`
+as the zip it is, walk `data.pkl` with an `Unpickler` whose `find_class` returns an
+inert placeholder for *any* foreign global, and recover shapes from the
+`rebuild_tensor_v2` arguments. Foreign code is never executed, whatever the
+checkpoint contains.
+
+**`hparams.yaml` breaks `yaml.safe_load`.** It carries `!!python/object:` tags, so
+`safe_load` raises `ConstructorError`. `full_load` and `UnsafeLoader` construct
+arbitrary objects and are the same hazard as unpickling. Use the tag-stripping
+`SafeLoader` subclass in `tools/yamlsafe.py`. And remember the file lies anyway -
+architecture comes from tensor shapes.
+
+**PDK directory names are uppercase.** `default_config_ASAP7_cts`, not `asap7`.
+Registry IDs are lowercase. Path parsing is case-insensitive and normalizes to the
+registry ID, or all 20 combos silently fail to resolve.
+
+**Never ingest these:** `aggregated_eval_metrics.csv` R² columns (0.982–1.000
+across every cell, row-pooled, meaningless), the `eval.log` "Overall" block
+(also pooled), and all tfevents (z-scored targets, 200–700× off).
+
+**`eval.log` MAPE is a fraction; the paper reports percent.** Multiply by 100 at
+ingest, exactly once, in `tools/ingest.py`.
+
+**Aggregate by macro-mean across the 18 circuits, never row-pooled.** For R²
+report the per-circuit median plus a positive count — one −335 outlier destroys
+a mean.
+
+## Repository etiquette
+
+- Branch naming: `phase-N/short-slug` for plan work, `fix/short-slug` otherwise
+- Conventional commits (`feat:`, `fix:`, `chore:`, `docs:`)
+- Every PR must pass `make check`; CI enforces it and branch protection blocks merge
+- Never commit files over 1 MB. Checkpoints, PNGs and tfevents belong in GitHub
+  Releases or Hugging Face, referenced by URL. GitHub Pages caps the published
+  site at 1 GB and we intend to stay near 20 MB.
+- Never commit anything under `data/` by hand. It is generated by `make ingest`
+  and `make synth`.
+
+## Code style
+
+- Python 3.11+, type hints on all public functions, `ruff` and `mypy` clean
+- Prefer pure functions in `tools/`; side effects only in `build.py` and CLI entry points
+- Templates hold no logic beyond loops and conditionals — computation happens in
+  `build.py` and lands in the context dict
+- Vanilla JS only, one file per feature in `static/js/`. Prefer adding a small
+  focused file over extending a large one.
+- CSS custom properties for all color; both themes implement the same variable
+  contract in `static/css/themes/`
+
+## Synthetic data
+
+Until real submissions land, most cells are filled by `make synth`. Every
+synthetic record carries `"source": "synthetic"` and renders with a visible
+marker. Prefer failing loudly over silently mixing synthetic and real data —
+`make validate` errors if a record lacks an explicit `source`.
+
+## Working style
+
+Use plan mode for anything touching `tools/ingest.py`, the guard layers, or the
+registries — those three have correctness consequences that spread everywhere.
+For a one-line template or CSS change, just make it.
+
+Use subagents for investigation so exploration doesn't fill the main context.
+After each phase, run an adversarial review subagent against @PLAN.md and fix
+only gaps that affect correctness or stated requirements.
+
+When compacting, always preserve: the current phase number, the list of modified
+files, and any failing check output.
diff --git a/CLAUDE.md b/CLAUDE.md
deleted file mode 100644
index 754c555..0000000
--- a/CLAUDE.md
+++ /dev/null
@@ -1,142 +0,0 @@
-# EDA-Schema Leaderboard
-
-Static benchmark leaderboard for the EDA-Schema-V2 dataset (arXiv:2605.06952).
-Python + Jinja2 → static HTML → GitHub Pages. No framework, no bundler, no Node.
-
-Detail lives in `docs/`. Read those on demand, not by default:
-- Build plan and phase gates: @PLAN.md
-- Data contract and field definitions: @docs/DATA_CONTRACT.md
-- Submission rules and verification tiers: @docs/SUBMISSION.md
-
-## Commands
-
-```bash
-make install        # uv sync
-make ingest         # parse experiments repo → data/ shards
-make synth          # regenerate synthetic fill for unpopulated cells
-make validate       # JSON Schema + guard layers 1-5; exits non-zero on failure
-make build          # render dist/
-make serve          # dist/ on :8000
-make test           # pytest
-make check          # validate + test + build — run this before any commit
-```
-
-`make check` is the gate. YOU MUST run it and show the output before claiming a
-task is complete. Do not report success from reading the code.
-
-## The grid
-
-Five dimensions, all defined in `data/registry/`. Registries are the single
-source of truth — never hardcode a task, PDK, stage, metric, or circuit name
-anywhere else.
-
-- 12 tasks × 4 PDKs × 5 stage transitions = 240 combos, **232 live**
-  (8 void: `total_wirelength` and `interconnect_length` have no floorplan estimate)
-- 46 metric rows × 4 PDKs × 5 stages = 920, **880 live cells**, of which **856
-  have a published baseline**. The other 24 are `mpe`/`mne` for the three slack
-  tasks at `global_route`, printed as "No positive or negative error, n_p = n_n =
-  0". That is a 0/0, not a zero. They stay live but carry `baseline_value: null`
-  and `baseline_state: "degenerate"`, so nothing can win against a baseline that
-  was never measured. See @docs/DATA_CONTRACT.md.
-- Cell identity is `(task, metric, pdk, stage)`. Shard files are keyed at
-  `(task, pdk, stage)` — one file serves all of that task's metric cells.
-
-Five cell states: `beats_baseline`, `matches_baseline`, `baseline_leads`,
-`no_entry`, `saturated`. Tying is the best achievable outcome on ~132 cells, so
-`matches_baseline` is a real state, not an edge case.
-
-**Saturation is a stage/task rule, never a numeric test:** `global_route`, minus
-the two wirelength tasks, minus the degenerate cells — exactly 120. A predicate
-like `mae==0 and mape==0 and r2==1` catches only 5 of the 10 saturated tasks,
-because the other five publish no MAPE row, no R² row, or neither. Saturated cells
-are never ranked and never colored win/loss.
-
-## Data gotchas
-
-These have all bitten us already. They are not hypothetical.
-
-**Stage names contain underscores.** `rsplit("_", 2)` on
-`default_config_ng45_global_place` yields `stage="place"`. Always parse with the
-anchored regex in `tools/paths.py`, which matches against registry vocabularies.
-
-**`hparams.yaml` lies about architecture.** It reports `in_features: 7` where the
-trained weight is `(64, 41)`, and `params=0` for every layer. Read architecture
-from checkpoint tensor shapes only. Same for `default_config.dot` — it is wrong
-and is excluded from the sparse checkout.
-
-**Never unpickle a checkpoint.** A `.ckpt` is a pickle, and community submissions
-run on our runner. `weights_only=True` is necessary but *not sufficient*: it
-rejects all 360 of the lab's own checkpoints, because Lightning pickled
-`eda_ml.schema.ModelConfig` into every one of them. Verified - 360 scanned, 360
-refused. The error message helpfully suggests `weights_only=False`, which is the
-arbitrary-code-execution path this rule exists to prevent. Do not take it, and do
-not grow a `safe_globals` allowlist either.
-
-Read tensor shapes with the restricted reader in `tools/ckpt.py`: treat the `.ckpt`
-as the zip it is, walk `data.pkl` with an `Unpickler` whose `find_class` returns an
-inert placeholder for *any* foreign global, and recover shapes from the
-`rebuild_tensor_v2` arguments. Foreign code is never executed, whatever the
-checkpoint contains.
-
-**`hparams.yaml` breaks `yaml.safe_load`.** It carries `!!python/object:` tags, so
-`safe_load` raises `ConstructorError`. `full_load` and `UnsafeLoader` construct
-arbitrary objects and are the same hazard as unpickling. Use the tag-stripping
-`SafeLoader` subclass in `tools/yamlsafe.py`. And remember the file lies anyway -
-architecture comes from tensor shapes.
-
-**PDK directory names are uppercase.** `default_config_ASAP7_cts`, not `asap7`.
-Registry IDs are lowercase. Path parsing is case-insensitive and normalizes to the
-registry ID, or all 20 combos silently fail to resolve.
-
-**Never ingest these:** `aggregated_eval_metrics.csv` R² columns (0.982–1.000
-across every cell, row-pooled, meaningless), the `eval.log` "Overall" block
-(also pooled), and all tfevents (z-scored targets, 200–700× off).
-
-**`eval.log` MAPE is a fraction; the paper reports percent.** Multiply by 100 at
-ingest, exactly once, in `tools/ingest.py`.
-
-**Aggregate by macro-mean across the 18 circuits, never row-pooled.** For R²
-report the per-circuit median plus a positive count — one −335 outlier destroys
-a mean.
-
-## Repository etiquette
-
-- Branch naming: `phase-N/short-slug` for plan work, `fix/short-slug` otherwise
-- Conventional commits (`feat:`, `fix:`, `chore:`, `docs:`)
-- Every PR must pass `make check`; CI enforces it and branch protection blocks merge
-- Never commit files over 1 MB. Checkpoints, PNGs and tfevents belong in GitHub
-  Releases or Hugging Face, referenced by URL. GitHub Pages caps the published
-  site at 1 GB and we intend to stay near 20 MB.
-- Never commit anything under `data/` by hand. It is generated by `make ingest`
-  and `make synth`.
-
-## Code style
-
-- Python 3.11+, type hints on all public functions, `ruff` and `mypy` clean
-- Prefer pure functions in `tools/`; side effects only in `build.py` and CLI entry points
-- Templates hold no logic beyond loops and conditionals — computation happens in
-  `build.py` and lands in the context dict
-- Vanilla JS only, one file per feature in `static/js/`. Prefer adding a small
-  focused file over extending a large one.
-- CSS custom properties for all color; both themes implement the same variable
-  contract in `static/css/themes/`
-
-## Synthetic data
-
-Until real submissions land, most cells are filled by `make synth`. Every
-synthetic record carries `"source": "synthetic"` and renders with a visible
-marker. Prefer failing loudly over silently mixing synthetic and real data —
-`make validate` errors if a record lacks an explicit `source`.
-
-## Working style
-
-Use plan mode for anything touching `tools/ingest.py`, the guard layers, or the
-registries — those three have correctness consequences that spread everywhere.
-For a one-line template or CSS change, just make it.
-
-Use subagents for investigation so exploration doesn't fill the main context.
-After each phase, run an adversarial review subagent against @PLAN.md and fix
-only gaps that affect correctness or stated requirements.
-
-When compacting, always preserve: the current phase number, the list of modified
-files, and any failing check output.
diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 120000
index 0000000..47dc3e3
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1 @@
+AGENTS.md
\ No newline at end of file
diff --git a/pyproject.toml b/pyproject.toml
index e1076fa..5ada4a0 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -8,6 +8,10 @@ license = { text = "MIT" }
 dependencies = [
     "jinja2>=3.1.6",
     "jsonschema>=4.23",
+    # Imported directly by tools/submissions.py to resolve the submission ->
+    # cell $ref from disk. It arrives transitively with jsonschema anyway, but a
+    # direct import on an undeclared dependency breaks the day that changes.
+    "referencing>=0.35",
     "pyyaml>=6.0.2",
 ]
 
diff --git a/tests/test_scaffold.py b/tests/test_scaffold.py
index 12fb176..1ebb496 100644
--- a/tests/test_scaffold.py
+++ b/tests/test_scaffold.py
@@ -60,7 +60,11 @@ def test_validate_passes_on_current_data() -> None:
 def test_validate_main_fails_loudly_on_empty_registry(monkeypatch) -> None:  # type: ignore[no-untyped-def]
     """An empty registry is a failure, not a pass."""
     monkeypatch.setattr(validate_mod, "CHECKS", {})
-    assert validate_mod.main() == 1
+    # Pass an explicit empty argv. main() now parses arguments, and with no
+    # argument it reads sys.argv - which under pytest is pytest's own flags, so
+    # a bare main() here dies on "unrecognized arguments: -q" rather than
+    # testing what it means to test.
+    assert validate_mod.main([]) == 1
 
 
 def test_docs_referenced_by_readme_exist() -> None:
diff --git a/tests/test_submissions.py b/tests/test_submissions.py
new file mode 100644
index 0000000..ff40d57
--- /dev/null
+++ b/tests/test_submissions.py
@@ -0,0 +1,221 @@
+"""Submission validation examines the submission, and says how much it examined.
+
+The bug these tests exist to prevent: the experiments repo ran `eda-validate`
+with no argument, which validated *this* repo's registries and reported success
+on a submission pull request it had never opened. Every test here is aimed at
+some version of "passed without looking".
+"""
+
+from __future__ import annotations
+
+import json
+import socket
+from pathlib import Path
+from typing import Any
+
+import pytest
+import yaml
+
+from tools.submissions import check_submissions, discover
+from tools.validate import main
+
+ROOT = Path(__file__).resolve().parent.parent
+
+
+def _record(**overrides: Any) -> dict[str, Any]:
+    """A schema-valid submission carrying one schema-valid cell."""
+    cell = json.loads(
+        (ROOT / "tests" / "fixtures" / "cells" / "good.json").read_text(
+            encoding="utf-8"
+        )
+    )
+    record: dict[str, Any] = {
+        "schema_version": 1,
+        "submission_id": "demo-model",
+        "model_name": "Demo Model",
+        "authors": [{"name": "A Researcher"}],
+        "submitted_at": "2026-08-12T00:00:00Z",
+        "division": "open",
+        "source": "submission",
+        "results": [cell],
+    }
+    record.update(overrides)
+    return record
+
+
+def _write(directory: Path, name: str, payload: Any) -> Path:
+    path = directory / name
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(
+        payload if isinstance(payload, str) else json.dumps(payload),
+        encoding="utf-8",
+    )
+    return path
+
+
+def test_valid_submission_passes(tmp_path: Path) -> None:
+    _write(tmp_path, "sub.json", _record())
+    assert check_submissions(tmp_path) == []
+
+
+def test_invalid_submission_is_rejected(tmp_path: Path) -> None:
+    _write(tmp_path, "sub.json", _record(division="sideways"))
+    failures = check_submissions(tmp_path)
+    assert failures, "an out-of-enum division must be rejected"
+    assert any("division" in str(f) for f in failures)
+
+
+def test_bad_nested_cell_is_rejected(tmp_path: Path) -> None:
+    """The cross-schema $ref must actually be followed.
+
+    `results` items are validated by cell.schema.json, reached through a $ref to
+    an absolute https $id. If that ref silently resolved to nothing, a garbage
+    cell would sail through and this is the only test that would notice.
+    """
+    _write(tmp_path, "sub.json", _record(results=[{"task": "not_a_real_task"}]))
+    failures = check_submissions(tmp_path)
+    assert failures, "a malformed cell inside results must be rejected"
+
+
+def test_resolution_is_offline(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    """Validation must not depend on the public site being reachable.
+
+    A guard that fails open when the network hiccups is not a guard. Sockets are
+    blocked outright; if anything tries to fetch the $id URL, this test fails.
+    """
+
+    class NoNetwork(socket.socket):
+        def connect(self, *args: Any, **kwargs: Any) -> None:
+            raise OSError("network access attempted during schema validation")
+
+    monkeypatch.setattr(socket, "socket", NoNetwork)
+    _write(tmp_path, "sub.json", _record())
+    assert check_submissions(tmp_path) == []
+
+
+def test_empty_directory_passes_by_default(tmp_path: Path) -> None:
+    """A README-only pull request legitimately has nothing to validate."""
+    assert check_submissions(tmp_path) == []
+
+
+def test_empty_directory_fails_when_required(tmp_path: Path) -> None:
+    """...but not when the pull request actually changed submissions/.
+
+    This is the vacuity guard. Without it, a submission PR whose files landed
+    somewhere the scan does not reach reports a clean pass.
+    """
+    failures = check_submissions(tmp_path, require_nonempty=True)
+    assert len(failures) == 1
+    assert "no submission files found" in str(failures[0])
+
+
+def test_missing_directory_is_a_failure(tmp_path: Path) -> None:
+    failures = check_submissions(tmp_path / "nope", require_nonempty=False)
+    assert failures and "not a directory" in str(failures[0])
+
+
+def test_malformed_json_is_a_failure(tmp_path: Path) -> None:
+    _write(tmp_path, "sub.json", "{not json")
+    failures = check_submissions(tmp_path)
+    assert failures and "not valid JSON" in str(failures[0])
+
+
+def test_discover_is_recursive_and_sorted(tmp_path: Path) -> None:
+    _write(tmp_path, "b/second.json", _record())
+    _write(tmp_path, "a/first.json", _record())
+    _write(tmp_path, "notes.txt", "ignored")
+    found = discover(tmp_path)
+    assert [p.name for p in found] == ["first.json", "second.json"]
+
+
+def test_yaml_submissions_are_validated(tmp_path: Path) -> None:
+    """The experiments repo documents `submission.yaml`, not `.json`.
+
+    Scanning only one extension is how this guard becomes vacuous a second time:
+    a clean pass because it was looking for the wrong filename.
+    """
+    _write(tmp_path, "submission.yaml", yaml.safe_dump(_record()))
+    assert check_submissions(tmp_path) == []
+
+    _write(tmp_path, "bad.yml", yaml.safe_dump(_record(division="sideways")))
+    assert any("bad.yml" in str(f) for f in check_submissions(tmp_path))
+
+
+def test_yaml_python_tags_are_refused(tmp_path: Path) -> None:
+    """A `!!python/object:` tag in a submission is a code-execution attempt.
+
+    safe_load raising here is the correct outcome, not an inconvenience. This is
+    the opposite call from hparams.yaml, which legitimately carries such tags and
+    is never a submission record.
+    """
+    _write(
+        tmp_path,
+        "evil.yaml",
+        "!!python/object/apply:os.system ['echo pwned']\n",
+    )
+    failures = check_submissions(tmp_path)
+    assert failures, "a python-tagged YAML submission must be rejected"
+    assert any("not safe-loadable YAML" in str(f) for f in failures)
+
+
+def test_nan_is_rejected(tmp_path: Path) -> None:
+    """`NaN` is not valid JSON, but json.loads reads it anyway.
+
+    It then survives schema validation, because JSON Schema's `number` accepts
+    it, and poisons ranking: NaN compares false against every bound, so the cell
+    sorts unpredictably and can be recorded as a win. On a leaderboard other
+    groups cite, that is worse than a rejected submission.
+    """
+    _write(tmp_path, "nan.json", '{"schema_version": 1, "value": NaN}')
+    failures = check_submissions(tmp_path)
+    assert failures, "a NaN literal must be rejected"
+    assert any("not a rankable number" in str(f) for f in failures)
+
+
+def test_yaml_infinity_is_rejected(tmp_path: Path) -> None:
+    """YAML 1.1 reads `.inf`, so the same hole exists on the YAML path."""
+    _write(tmp_path, "inf.yaml", "schema_version: 1\nvalue: .inf\n")
+    failures = check_submissions(tmp_path)
+    assert any("not a rankable number" in str(f) for f in failures)
+
+
+def test_invalid_utf8_is_reported_not_raised(tmp_path: Path) -> None:
+    """One bad byte must not abort every other submission's result.
+
+    UnicodeDecodeError subclasses ValueError, not OSError and not
+    JSONDecodeError, so without an explicit handler it escapes both and takes
+    down the whole run - on the code path that exists to handle files we did not
+    write.
+    """
+    (tmp_path / "bad.json").write_bytes(b'{"a": "\xff\xfe"}')
+    _write(tmp_path, "good.json", _record())
+
+    failures = check_submissions(tmp_path)  # must not raise
+    assert any("not valid UTF-8" in str(f) for f in failures)
+    # The valid record was still reached and still passed.
+    assert not any("good.json" in str(f) for f in failures)
+
+
+def test_one_bad_file_does_not_hide_the_others(tmp_path: Path) -> None:
+    """Report everything wrong in one run, matching tools.validate's contract."""
+    _write(tmp_path, "a.json", _record(division="sideways"))
+    _write(tmp_path, "b.json", _record(submission_id="X"))
+    failures = check_submissions(tmp_path)
+    named = {str(f) for f in failures}
+    assert any("a.json" in n for n in named)
+    assert any("b.json" in n for n in named)
+
+
+def test_cli_rejects_require_nonempty_without_submissions() -> None:
+    """A flag that silently does nothing is how vacuous checks get written."""
+    assert main(["--require-nonempty"]) == 2
+
+
+def test_cli_reports_the_count(
+    tmp_path: Path, capsys: pytest.CaptureFixture[str]
+) -> None:
+    """The count is the evidence. 'validate: ok' cannot be told apart from
+    'validate: examined nothing', which is the whole bug."""
+    _write(tmp_path, "sub.json", _record())
+    assert main(["--submissions", str(tmp_path)]) == 0
+    assert f"1 submissions from {tmp_path}" in capsys.readouterr().out
diff --git a/tools/ci_negative_test.sh b/tools/ci_negative_test.sh
new file mode 100755
index 0000000..02710de
--- /dev/null
+++ b/tools/ci_negative_test.sh
@@ -0,0 +1,226 @@
+#!/usr/bin/env bash
+#
+# Phase 0 exit criterion: prove the guards block rather than decorate.
+#
+# PLAN.md asks for one pull request carrying three defects, with all three checks
+# reporting failure. That was done, as PR #5, and all three did go red. It is not
+# sufficient, for two reasons this script exists to close.
+#
+# 1. A red check is not evidence the check ran. size-guard used to build before
+#    measuring, so a missing build.py failed the job having measured nothing -
+#    indistinguishable, from the outside, from catching an oversized file. That
+#    is not hypothetical: it is what happened on phase-1/registries and
+#    phase-2/baseline. So every assertion here greps the job log for the guard's
+#    OWN error string, never just conclusion == failure.
+#
+# 2. One PR carrying three defects shows the three guards fail together. It does
+#    not show they fail independently. A guard that goes red because a *different*
+#    defect broke its setup looks identical. So three single-defect PRs run
+#    first, and each asserts the other two guards stay GREEN. That is the part
+#    that proves independence, and it is the part PLAN.md's shape cannot express.
+#
+# Re-runnable by design. PLAN.md Phase 12 warns that branch protection does not
+# always survive a repo transfer, and that protection you believe in but do not
+# have is worse than none. Run this again after the transfer.
+#
+#   ./tools/ci_negative_test.sh                 # against origin's default branch
+#   BASE=phase-0/reconcile ./tools/ci_negative_test.sh
+#   KEEP=1 ./tools/ci_negative_test.sh          # leave the PRs open for inspection
+
+set -euo pipefail
+
+REPO="${REPO:-$(gh repo view --json nameWithOwner -q .nameWithOwner)}"
+BASE="${BASE:-$(gh repo view --json defaultBranchRef -q .defaultBranchRef.name)}"
+KEEP="${KEEP:-0}"
+TIMEOUT_SECS="${TIMEOUT_SECS:-900}"
+
+# The three guards under test, and the string each prints when it genuinely
+# catches its own defect. Matching on these rather than on the conclusion is the
+# whole point: it is what tells "the guard caught it" apart from "the job died".
+GUARDS=(lint size validate)
+declare -A EVIDENCE=(
+  [lint]="F821"
+  [size]="over the 1 MB cap"
+  [validate]="an unpopulated cell must never look rankable"
+)
+
+BRANCHES=()
+FAILURES=0
+
+say()  { printf '\n\033[1m== %s\033[0m\n' "$*"; }
+pass() { printf '  \033[32mPASS\033[0m %s\n' "$*"; }
+fail() { printf '  \033[31mFAIL\033[0m %s\n' "$*"; FAILURES=$((FAILURES + 1)); }
+
+cleanup() {
+  [ "$KEEP" = "1" ] && { say "KEEP=1, leaving branches"; return; }
+  say "Tearing down"
+  for b in "${BRANCHES[@]:-}"; do
+    [ -n "$b" ] || continue
+    num=$(gh pr list -R "$REPO" --head "$b" --state open --json number -q '.[0].number' 2>/dev/null || true)
+    [ -n "${num:-}" ] && gh pr close -R "$REPO" "$num" --delete-branch >/dev/null 2>&1 \
+      && echo "  closed #$num and deleted $b" && continue
+    git push -q origin --delete "$b" >/dev/null 2>&1 && echo "  deleted $b" || true
+  done
+  # The 2 MB blob is now unreferenced and will be garbage collected. It is
+  # deliberately never merged, so it does not enter main's history.
+}
+trap cleanup EXIT
+
+# ---------------------------------------------------------------- the defects
+
+defect_lint() {
+  cat > tools/_negative_lint.py <<'EOF'
+"""Deliberately broken. Part of the Phase 0 negative test; never merged."""
+
+import os  # F401: imported but unused
+
+
+def broken() -> int:
+    return undefined_name  # F821: undefined name
+EOF
+  git add tools/_negative_lint.py
+}
+
+defect_validate() {
+  # Give three VOID cells a rankable number. The baseline-csv check exists to
+  # catch exactly this: an unpopulated cell that looks like a real baseline can
+  # be picked up and ranked against.
+  python3 - <<'EOF'
+import csv, pathlib
+p = pathlib.Path("docs/sources/table8_baseline.csv")
+rows = list(csv.DictReader(p.open(encoding="utf-8")))
+hit = 0
+for r in rows:
+    if r["kind"] == "VOID" and hit < 3:
+        r["value"] = "0.42"
+        hit += 1
+assert hit == 3, f"expected 3 VOID rows to corrupt, found {hit}"
+with p.open("w", encoding="utf-8", newline="") as fh:
+    w = csv.DictWriter(fh, fieldnames=rows[0].keys())
+    w.writeheader()
+    w.writerows(rows)
+EOF
+  git add docs/sources/table8_baseline.csv
+}
+
+defect_size() {
+  # 2 MB, over the 1 MB cap. Random bytes so it does not compress away.
+  head -c 2097152 /dev/urandom > assets_blob.bin
+  git add assets_blob.bin
+}
+
+# ------------------------------------------------------------------ mechanics
+
+open_pr() {
+  local slug="$1" title="$2"; shift 2
+  local branch="test/ci-negative-${slug}"
+  BRANCHES+=("$branch")
+
+  git checkout -q -B "$branch" "origin/${BASE}"
+  for d in "$@"; do "$d"; done
+  git commit -q -m "test: negative case ${slug} (must not merge)"
+  git push -q -f origin "$branch"
+  gh pr create -R "$REPO" --base "$BASE" --head "$branch" \
+    --title "CI negative test: ${title}" \
+    --body "Deliberately broken. **Must not merge.** Opened and torn down by \`tools/ci_negative_test.sh\`." \
+    >/dev/null
+  echo "$branch"
+}
+
+wait_for_checks() {
+  local branch="$1" deadline=$(( SECONDS + TIMEOUT_SECS )) sha pending
+  sha=$(git rev-parse "$branch")
+  while [ $SECONDS -lt $deadline ]; do
+    pending=$(gh api "repos/$REPO/commits/$sha/check-runs" \
+      --jq "[.check_runs[] | select(.name==\"lint\" or .name==\"size\" or .name==\"validate\") | select(.status!=\"completed\")] | length" 2>/dev/null || echo 9)
+    total=$(gh api "repos/$REPO/commits/$sha/check-runs" \
+      --jq "[.check_runs[] | select(.name==\"lint\" or .name==\"size\" or .name==\"validate\")] | length" 2>/dev/null || echo 0)
+    [ "$total" -eq 3 ] && [ "$pending" -eq 0 ] && return 0
+    sleep 10
+  done
+  echo "  timed out after ${TIMEOUT_SECS}s waiting for checks on $branch" >&2
+  return 1
+}
+
+conclusion_of() {
+  gh api "repos/$REPO/commits/$(git rev-parse "$1")/check-runs" \
+    --jq ".check_runs[] | select(.name==\"$2\") | .conclusion" 2>/dev/null | head -1
+}
+
+logs_of() {
+  local branch="$1" id
+  for id in $(gh run list -R "$REPO" --branch "$branch" --json databaseId -q '.[].databaseId' 2>/dev/null); do
+    gh run view -R "$REPO" "$id" --log 2>/dev/null || true
+  done
+}
+
+# Assert one guard went red FOR ITS OWN REASON, and the others stayed green.
+assert_case() {
+  local branch="$1" expect_red="$2"
+  local logs; logs=$(logs_of "$branch")
+
+  for g in "${GUARDS[@]}"; do
+    local got; got=$(conclusion_of "$branch" "$g")
+    if [ "$g" = "$expect_red" ]; then
+      if [ "$got" != "failure" ]; then
+        fail "$branch: $g concluded '$got', expected failure - the guard is decorative"
+        continue
+      fi
+      if grep -qF "${EVIDENCE[$g]}" <<<"$logs"; then
+        pass "$branch: $g failed, and its log carries \"${EVIDENCE[$g]}\""
+      else
+        fail "$branch: $g failed but its log never printed \"${EVIDENCE[$g]}\" - it died before asserting, which is not a catch"
+      fi
+    else
+      if [ "$got" = "success" ]; then
+        pass "$branch: $g stayed green (independent of the $expect_red defect)"
+      else
+        fail "$branch: $g concluded '$got' on a defect that is not its own - the guards are not independent"
+      fi
+    fi
+  done
+}
+
+# ----------------------------------------------------------------------- main
+
+say "Negative test against $REPO, base $BASE"
+git fetch -q origin "$BASE"
+START_REF=$(git rev-parse --abbrev-ref HEAD)
+trap 'git checkout -q "$START_REF" 2>/dev/null || true; cleanup' EXIT
+
+B_LINT=$(open_pr lint     "ruff error only"        defect_lint)
+B_VALD=$(open_pr validate "schema violation only"  defect_validate)
+B_SIZE=$(open_pr size     "2 MB binary only"       defect_size)
+B_ALL=$(open_pr  all      "all three defects"      defect_lint defect_validate defect_size)
+git checkout -q "$START_REF"
+
+for b in "$B_LINT" "$B_VALD" "$B_SIZE" "$B_ALL"; do
+  say "Waiting on $b"
+  wait_for_checks "$b" || FAILURES=$((FAILURES + 1))
+done
+
+say "Independence: one defect each, other two guards must stay green"
+assert_case "$B_LINT" lint
+assert_case "$B_VALD" validate
+assert_case "$B_SIZE" size
+
+say "Combined: all three must fail together, each for its own reason"
+combined_logs=$(logs_of "$B_ALL")
+for g in "${GUARDS[@]}"; do
+  got=$(conclusion_of "$B_ALL" "$g")
+  if [ "$got" != "failure" ]; then
+    fail "combined: $g concluded '$got', expected failure"
+  elif grep -qF "${EVIDENCE[$g]}" <<<"$combined_logs"; then
+    pass "combined: $g failed, and its log carries \"${EVIDENCE[$g]}\""
+  else
+    fail "combined: $g failed without printing \"${EVIDENCE[$g]}\""
+  fi
+done
+
+say "Result"
+if [ "$FAILURES" -eq 0 ]; then
+  echo "  All guards block, each for its own reason, independently of the others."
+  exit 0
+fi
+echo "  $FAILURES assertion(s) failed. A guard that does not block is decorative."
+exit 1
diff --git a/tools/submissions.py b/tools/submissions.py
new file mode 100644
index 0000000..d2f1db4
--- /dev/null
+++ b/tools/submissions.py
@@ -0,0 +1,198 @@
+"""Schema validation for community submissions living in another repository.
+
+The experiments repo checks this repo out to `.site` and runs `eda-validate`
+against its own tree. Before this module existed it ran `eda-validate` with no
+argument, which validated *this* repo's registries and baseline and then reported
+success - a green check on a submission pull request that had never been looked
+at. The submission could have contained anything.
+
+So the entry point takes an explicit directory, reports how many files it
+actually validated, and can be told to insist that number is non-zero. A guard
+that cannot state what it examined is not evidence.
+"""
+
+from __future__ import annotations
+
+import json
+import math
+from pathlib import Path
+from typing import Any
+
+import jsonschema
+import yaml
+from referencing import Registry, Resource
+
+from tools.validate import Failure
+
+SCHEMA_DIR = Path(__file__).resolve().parent.parent / "schema"
+SCHEMA_PATH = SCHEMA_DIR / "submission.schema.json"
+CELL_SCHEMA_PATH = SCHEMA_DIR / "cell.schema.json"
+
+
+def _load(path: Path) -> dict[str, Any]:
+    with path.open(encoding="utf-8") as handle:
+        schema: dict[str, Any] = json.load(handle)
+    return schema
+
+
+def _validator() -> jsonschema.Draft202012Validator:
+    """A validator that resolves the cell `$ref` from disk, never over the network.
+
+    `submission.schema.json` references `cell.schema.json` by its public
+    `https://jiwanizakir.github.io/...` `$id`, because external tooling consumes
+    these schemas by URL. Left to itself, jsonschema would try to *fetch* that
+    URL the first time it validates a record whose `results` array is non-empty.
+
+    That failure mode is nasty in exactly the place this code runs. On a
+    submission pull request it means the guard depends on the public site being
+    up, and a validator that fails open when the network hiccups is not a guard.
+    Registering both schemas by `$id` makes resolution local and total.
+
+    Verified: with sockets blocked, an unregistered validator raises
+    `Unresolvable` on the first record carrying results. See
+    tests/test_submissions.py::test_resolution_is_offline.
+    """
+    submission = _load(SCHEMA_PATH)
+    cell = _load(CELL_SCHEMA_PATH)
+    registry = Registry().with_resources(
+        [
+            (cell["$id"], Resource.from_contents(cell)),
+            (submission["$id"], Resource.from_contents(submission)),
+        ]
+    )
+    return jsonschema.Draft202012Validator(submission, registry=registry)
+
+
+# The experiments repo documents its submission record as `submission.yaml`,
+# while the schema and everything downstream are JSON. Scanning only one of the
+# two would put us straight back in the vacuous case this module exists to fix:
+# a guard that reports a clean pass because it was looking for the wrong
+# extension.
+SUFFIXES = (".json", ".yaml", ".yml")
+
+
+def discover(root: Path) -> list[Path]:
+    """Every submission record under `root`, sorted for deterministic output.
+
+    Sorted because the failure list is compared in tests and read by humans, and
+    filesystem order is neither stable across platforms nor meaningful.
+    """
+    if not root.is_dir():
+        return []
+    return sorted(p for p in root.rglob("*") if p.is_file() and p.suffix in SUFFIXES)
+
+
+class NonFiniteNumberError(ValueError):
+    """A record carried NaN or an infinity where a rankable number belongs."""
+
+
+def _reject_non_finite(node: Any, path: str = "(root)") -> None:
+    """Refuse NaN and infinities anywhere in a record.
+
+    Both parsers accept them by default and both are wrong for us. `json.loads`
+    reads the bare literals `NaN`, `Infinity` and `-Infinity` even though none is
+    valid JSON, and YAML 1.1 reads `.nan` and `.inf`. Either produces a float
+    that survives schema validation - JSON Schema's `number` accepts it - and
+    then poisons everything downstream: NaN compares false against every bound,
+    so a cell carrying one sorts unpredictably and can be ranked as a win.
+
+    On a leaderboard other groups cite, a silently unrankable number is worse
+    than a rejected submission.
+    """
+    if isinstance(node, float) and not math.isfinite(node):
+        raise NonFiniteNumberError(f"{path} is {node}, which is not a rankable number")
+    if isinstance(node, dict):
+        for key, value in node.items():
+            _reject_non_finite(value, f"{path}/{key}")
+    elif isinstance(node, list):
+        for i, value in enumerate(node):
+            _reject_non_finite(value, f"{path}/{i}")
+
+
+def _parse(path: Path) -> Any:
+    """Read one record. YAML goes through safe_load, never full_load.
+
+    A submission record is written by someone outside the lab. `yaml.safe_load`
+    refuses `!!python/object:` tags with a ConstructorError, and that refusal is
+    the correct outcome here rather than an inconvenience to work around: tags in
+    a submission record are a code-execution attempt, not a formatting choice.
+
+    Note this is the opposite call from `hparams.yaml`, which legitimately
+    carries those tags and needs the tag-stripping loader. hparams.yaml is not a
+    submission record and never reaches this path.
+    """
+    text = path.read_text(encoding="utf-8")
+    record = json.loads(text) if path.suffix == ".json" else yaml.safe_load(text)
+    _reject_non_finite(record)
+    return record
+
+
+def check_submissions(root: Path, *, require_nonempty: bool = False) -> list[Failure]:
+    """Validate every submission under `root` against the submission schema.
+
+    `require_nonempty` is set by CI when the pull request actually touched
+    `submissions/`. Finding nothing is legitimate on a README-only change and a
+    hard error on a submission change, and only the caller knows which it is.
+    """
+    failures: list[Failure] = []
+
+    if not root.is_dir():
+        return [Failure("submissions", f"{root} is not a directory")]
+
+    try:
+        validator = _validator()
+    except (OSError, json.JSONDecodeError, KeyError) as exc:
+        # The schema itself being unreadable must never read as "nothing wrong
+        # with the submissions".
+        return [Failure("submissions", f"could not load {SCHEMA_PATH.name}: {exc}")]
+
+    found = discover(root)
+
+    if not found and require_nonempty:
+        failures.append(
+            Failure(
+                "submissions",
+                f"no submission files found under {root}, but the pull request "
+                "changed submissions/ - the guard would have passed without "
+                "examining anything",
+            )
+        )
+
+    for path in found:
+        rel = path.relative_to(root)
+        try:
+            record = _parse(path)
+        except json.JSONDecodeError as exc:
+            failures.append(Failure("submissions", f"{rel}: not valid JSON: {exc}"))
+            continue
+        except yaml.YAMLError as exc:
+            # Includes ConstructorError from a !!python/object: tag, which is the
+            # case worth being loud about.
+            failures.append(
+                Failure("submissions", f"{rel}: not safe-loadable YAML: {exc}")
+            )
+            continue
+        except NonFiniteNumberError as exc:
+            failures.append(Failure("submissions", f"{rel}: {exc}"))
+            continue
+        except UnicodeDecodeError as exc:
+            # Caught explicitly because it is neither an OSError nor a
+            # JSONDecodeError - it subclasses ValueError - so it would otherwise
+            # escape both handlers below and abort the whole run. One submission
+            # with a stray byte would take every other submission's result with
+            # it, on the code path that exists to handle files we did not write.
+            failures.append(Failure("submissions", f"{rel}: not valid UTF-8: {exc}"))
+            continue
+        except OSError as exc:
+            failures.append(Failure("submissions", f"{rel}: unreadable: {exc}"))
+            continue
+
+        # iter_errors, not validate: one run should report every problem in the
+        # file rather than the first, matching how tools.validate treats checks.
+        for error in sorted(validator.iter_errors(record), key=str):
+            location = "/".join(str(part) for part in error.absolute_path) or "(root)"
+            failures.append(
+                Failure("submissions", f"{rel}: {location}: {error.message}")
+            )
+
+    return failures
diff --git a/tools/validate.py b/tools/validate.py
index 89fe8c4..22a9322 100644
--- a/tools/validate.py
+++ b/tools/validate.py
@@ -9,9 +9,11 @@
 
 from __future__ import annotations
 
+import argparse
 import sys
-from collections.abc import Callable
+from collections.abc import Callable, Sequence
 from dataclasses import dataclass
+from pathlib import Path
 
 
 @dataclass(frozen=True, slots=True)
@@ -45,7 +47,36 @@ def validate() -> list[Failure]:
     return failures
 
 
-def main() -> int:
+def _parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="eda-validate",
+        description="JSON Schema plus guard layers 1 to 5. Exits non-zero on failure.",
+    )
+    parser.add_argument(
+        "--submissions",
+        type=Path,
+        metavar="DIR",
+        help=(
+            "Also validate community submission records under DIR against "
+            "schema/submission.schema.json. Used by the experiments repo, which "
+            "checks this repo out and points at its own tree."
+        ),
+    )
+    parser.add_argument(
+        "--require-nonempty",
+        action="store_true",
+        help=(
+            "Fail if --submissions finds no records. CI sets this when the pull "
+            "request actually changed submissions/, so that an empty scan is a "
+            "failure rather than a silent pass."
+        ),
+    )
+    return parser
+
+
+def main(argv: Sequence[str] | None = None) -> int:
+    args = _parser().parse_args(argv)
+
     # Import for the registration side effect. Deferred to avoid a cycle: checks
     # import Failure from this module.
     import tools.checks  # noqa: F401
@@ -56,9 +87,35 @@ def main() -> int:
         print("validate: no checks registered", file=sys.stderr)
         return 1
 
+    if args.require_nonempty and args.submissions is None:
+        print(
+            "validate: --require-nonempty is meaningless without --submissions",
+            file=sys.stderr,
+        )
+        return 2
+
     failures = validate()
+
+    submission_count = 0
+    if args.submissions is not None:
+        # Imported here rather than at module scope: tools.submissions imports
+        # Failure from this module, same cycle as tools.checks above.
+        from tools.submissions import check_submissions, discover
+
+        submission_count = len(discover(args.submissions))
+        failures.extend(
+            check_submissions(args.submissions, require_nonempty=args.require_nonempty)
+        )
+
     for failure in failures:
         print(f"FAIL {failure}", file=sys.stderr)
 
-    print(f"validate: {len(CHECKS)} checks, {len(failures)} failures")
+    summary = f"validate: {len(CHECKS)} checks"
+    if args.submissions is not None:
+        # Always state the count. "Passed" without it cannot be told apart from
+        # "examined nothing", which is the failure this argument exists to fix.
+        summary += f", {submission_count} submissions from {args.submissions}"
+    summary += f", {len(failures)} failures"
+    print(summary)
+
     return 1 if failures else 0
diff --git a/uv.lock b/uv.lock
index 6bc2a1a..0cd06f6 100644
--- a/uv.lock
+++ b/uv.lock
@@ -173,6 +173,7 @@ dependencies = [
     { name = "jinja2" },
     { name = "jsonschema" },
     { name = "pyyaml" },
+    { name = "referencing" },
 ]
 
 [package.optional-dependencies]
@@ -194,6 +195,7 @@ requires-dist = [
     { name = "jinja2", specifier = ">=3.1.6" },
     { name = "jsonschema", specifier = ">=4.23" },
     { name = "pyyaml", specifier = ">=6.0.2" },
+    { name = "referencing", specifier = ">=0.35" },
     { name = "torch", marker = "extra == 'ingest'", specifier = ">=2.6" },
 ]
 provides-extras = ["ingest"]