diff --git a/docker/bin/build-export b/docker/bin/build-export
index 3e4ebfe..6102bde 100755
--- a/docker/bin/build-export
+++ b/docker/bin/build-export
@@ -2,7 +2,12 @@
 # Build and run the exporter against the disc.
 #
 #   build-export              build only
-#   build-export --run        build, then export to ./export
+#   build-export --run        build, export to ./export, then validate it
+#
+# The validate step is not optional politeness: `export` writes a tree and
+# `check` is the only thing that says the tree is readable by anything other
+# than the program that wrote it. A build that exports and does not check has
+# not shown anything.
 #
 # Jobs are capped: this box runs two agent containers and a desktop, and an
 # unbounded parallel build has crashed it. Do not raise this to "use all cores".
@@ -13,5 +18,6 @@ cargo build --release -p sylpheed-export
 if [ "${1:-}" = "--run" ]; then
   shift
   disc="${SYLPHEED_DISC:?set SYLPHEED_DISC to the extracted disc root}"
-  exec "$CARGO_TARGET_DIR/release/sylpheed-export" --disc "$disc" --out export "$@"
+  "$CARGO_TARGET_DIR/release/sylpheed-export" export --disc "$disc" --out export "$@"
+  exec "$CARGO_TARGET_DIR/release/sylpheed-export" check --out export
 fi
diff --git a/docker/bin/build-reference-cli b/docker/bin/build-reference-cli
new file mode 100755
index 0000000..c7356f2
--- /dev/null
+++ b/docker/bin/build-reference-cli
@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# Build `sylpheed-cli` from the SAME revision of sylpheed-formats the exporter
+# is pinned to, and put it on the persistent target volume.
+#
+#   build-reference-cli       -> $CARGO_TARGET_DIR/release/sylpheed-cli
+#
+# Why not just use /reborn/target/release/sylpheed-cli: that binary is built
+# from whatever /reborn's working tree is at, which is a LIVE mount of the other
+# agent's checkout and moves under you mid-iteration. `sylpheed-cli screen
+# render` is the reference the Godot port is diffed against, so if it runs
+# different decoders than the exporter, a pixel disagreement has a free variable
+# in it and proves nothing about the port.
+#
+# The pinned source lives in CARGO_HOME, which is on the container overlay and
+# does not survive a fresh container -- cargo re-fetches it. The BINARY goes to
+# CARGO_TARGET_DIR, which is a volume, so this is a one-off per image.
+#
+# Jobs are capped for the same reason as build-export.
+set -euo pipefail
+cd "${PROJECT_DIR:-/work}"
+export CARGO_BUILD_JOBS="${CARGO_BUILD_JOBS:-3}"
+
+rev=$(sed -n 's/.*Syplheed-Reborn\.git", rev = "\([0-9a-f]*\)".*/\1/p' \
+      crates/sylpheed-export/Cargo.toml | head -1)
+[ -n "$rev" ] || { echo "build-reference-cli: no rev pin found in Cargo.toml" >&2; exit 1; }
+
+# The checkout only exists once cargo has fetched it; a fresh container has not.
+find_checkout() {
+  find "${CARGO_HOME:?}/git/checkouts" -maxdepth 2 -type d -name "${rev}*" 2>/dev/null | head -1
+}
+src=$(find_checkout)
+if [ -z "$src" ]; then
+  echo "build-reference-cli: fetching the pinned decoders ($rev)"
+  cargo fetch
+  src=$(find_checkout)
+fi
+[ -n "$src" ] || { echo "build-reference-cli: no checkout for rev $rev" >&2; exit 1; }
+
+echo "build-reference-cli: building sylpheed-cli from $rev"
+cargo build --release --manifest-path "$src/Cargo.toml" -p sylpheed-cli
+
+out="$CARGO_TARGET_DIR/release/sylpheed-cli"
+"$out" screen list "${SYLPHEED_DISC:-/disc}/dat/GP_TITLE.pak" >/dev/null \
+  || { echo "build-reference-cli: built, but 'screen list' failed" >&2; exit 1; }
+echo "build-reference-cli: $out  (rev $rev, 'screen' subcommand present)"