@Tim Edwards Looks like all the inputs flagged are to

EP_sky130_fd_sc_hd__clkbuf_4

. Here's an example from the extracted layout: the signal

/mprj/la_data_out[109]

is input to

/Xmgmt_buffers(EP_mgmt_protect)/Xinput14(EP_sky130_fd_sc_hd__clkbuf_4)

. This is probably before it gets to the

mgmt_core_wrapper

.