diff --git a/.gitignore b/.gitignore
index 3f1088ad6..9ceae0334 100644
--- a/.gitignore
+++ b/.gitignore
@@ -167,6 +167,9 @@ packages/*/NOTICE
 # User-specific catalog paths (test data)
 *.paths.yaml
 
+# Materialised test-case output slots (local inspection only; never committed)
+**/test-data/**/output/
+
 # Debug log files
 **/main_log_debug.txt
 
diff --git a/changelog/748.feature.md b/changelog/748.feature.md
new file mode 100644
index 000000000..2565338f6
--- /dev/null
+++ b/changelog/748.feature.md
@@ -0,0 +1,6 @@
+`ref test-cases` runs now materialise their outputs into an inspectable, gitignored output slot
+(`<case>/output/<label>/`) holding the curated native files, the rebuilt committed bundle, and a source stamp,
+so you can see and diff exactly what a run produced.
+Added a `build` verb that rebuilds the committed bundle from an existing slot without re-executing the diagnostic,
+a `mint --from-replay` option that re-authors a baseline from the stored native instead of re-running it,
+and a `--label` option that keeps several runs side by side for comparison.
diff --git a/changelog/748.trivial.md b/changelog/748.trivial.md
new file mode 100644
index 000000000..414dc67f2
--- /dev/null
+++ b/changelog/748.trivial.md
@@ -0,0 +1,3 @@
+Reorganised the `ref test-cases` CLI into a package split by concern
+(discovery, run, baseline lifecycle, store, and the CI gate),
+with no change to the commands or their behaviour.
diff --git a/docs/background/regression-baselines.md b/docs/background/regression-baselines.md
index 1954f925f..8adff92fd 100644
--- a/docs/background/regression-baselines.md
+++ b/docs/background/regression-baselines.md
@@ -61,12 +61,49 @@ flowchart LR
 
 | Verb | Credentials | What it does |
 | --- | --- | --- |
-| `run` | none | Execute the diagnostic, curate outputs, write the committed bundle and seed `manifest.json` (`native = {}`). |
-| `mint` | write | Upload the curated native files to the object store and populate `manifest.native`. Generally run by CI. |
-| `sync` | public read | Fetch the native blobs referenced by the manifest into the local tree. |
-| `replay` | public read | Materialise the native baseline, re-run only `build_execution_result`, and tolerantly compare to the committed bundle. |
+| `run` | none | Execute the diagnostic, curate its native into the output slot `output/<label>/`, rebuild the committed bundle, and — when seeding or `--force-regen` — promote it to `regression/` and update `manifest.json` (first seed uses `native = {}`; existing manifests keep their native block). |
+| `build` | none | Rebuild the committed bundle from an existing output slot (no execution), under the same promotion gate as `run`. Handy for regenerating the bundle after an extraction-code change, from already-materialised native. |
+| `mint` | write | Execute (or, with `--from-replay`, replay the stored native), upload the curated native to the object store, and populate `manifest.native`. Generally run by CI. |
+| `sync` | public read | Fetch the native blobs referenced by the manifest into the local store cache. |
+| `replay` | public read | Materialise the native baseline into a slot, re-run only `build_execution_result`, and tolerantly compare to the committed bundle. |
 | `check-store` | write | Preflight the writable native store (credentials + bucket) without uploading anything. Run this before a slow `mint` to confirm credentials are correct. |
 
+### Output slots
+
+Every `run`, `build`, `replay`, and `mint` materialises what it produced into a gitignored
+*output slot*, so a developer can actually see and diff what a run or replay generated:
+
+```text
+<test case>/output/<label>/
+├── diagnostic.json     # the curated native set, flat at manifest-relative paths
+├── output.json
+├── series.json
+├── ...                 # plus any referenced plots/data/html and native .nc files
+├── regression/         # the committed bundle rebuilt from this slot
+│   ├── diagnostic.json
+│   ├── output.json
+│   └── series.json
+└── .source.json        # {label, verb, source, test_case_version, created}
+```
+
+Slots are never committed — the whole `**/test-data/**/output/` tree is gitignored —
+they exist purely for local inspection.
+
+The `--label` option names a slot (default `latest`, overwritten on every run).
+Named slots persist, so two runs can be compared side by side:
+for example `run --label fresh` then `replay --label fromstore`,
+or `run --label before`, edit the diagnostic, then `run --label after`.
+
+`run` and `build` write the slot on every invocation
+but only *promote* the rebuilt bundle to the tracked `regression/` baseline
+when `--force-regen` is given or no baseline exists yet,
+so a labelled run never silently clobbers a committed baseline;
+`mint` always promotes and uploads.
+When a promoted bundle's underlying native digests differ from the minted baseline,
+`run` and `build` warn (they never block) that a re-mint is needed.
+`mint --from-replay` re-authors the manifest from the stored native instead of re-executing,
+and uploads only blobs whose digest actually changed.
+
 ## CMIP7 test data
 
 CMIP7 data is not yet available on ESGF,
diff --git a/packages/climate-ref-core/src/climate_ref_core/logging.py b/packages/climate-ref-core/src/climate_ref_core/logging.py
index 1e8289a12..1d1a8b485 100644
--- a/packages/climate-ref-core/src/climate_ref_core/logging.py
+++ b/packages/climate-ref-core/src/climate_ref_core/logging.py
@@ -70,6 +70,23 @@ def emit(self, record: logging.LogRecord) -> None:
         logger.opt(depth=depth, exception=record.exc_info).log(level, record.getMessage())
 
 
+def _retention_count_ignore_missing(logs: list[str]) -> None:  # pragma: no cover
+    """Remove old log files, tolerating concurrent cleanup by another process."""
+    keep = 10
+    existing_logs = []
+    for log in logs:
+        path = Path(log)
+        try:
+            mtime = path.stat().st_mtime
+        except FileNotFoundError:
+            continue
+        existing_logs.append((mtime, path))
+
+    for _, path in sorted(existing_logs, key=lambda item: (-item[0], item[1].as_posix()))[keep:]:
+        with contextlib.suppress(FileNotFoundError):
+            path.unlink()
+
+
 def initialise_logging(level: int | str, format: str, log_directory: str | Path) -> None:  # noqa: A002 # pragma: no cover
     """
     Initialise the logging for the REF
@@ -88,7 +105,7 @@ def initialise_logging(level: int | str, format: str, log_directory: str | Path)
     filename = f"climate-ref_{{time:YYYY-MM-DD_HH-mm}}_{process_name}.log"
     logger.add(
         sink=log_directory / filename,
-        retention=10,
+        retention=_retention_count_ignore_missing,
         level="DEBUG",
         format=VERBOSE_LOG_FORMAT,
         colorize=False,
diff --git a/packages/climate-ref-core/src/climate_ref_core/regression/_quantise.py b/packages/climate-ref-core/src/climate_ref_core/regression/_quantise.py
index 272d66c0c..89817be3c 100644
--- a/packages/climate-ref-core/src/climate_ref_core/regression/_quantise.py
+++ b/packages/climate-ref-core/src/climate_ref_core/regression/_quantise.py
@@ -1,12 +1,17 @@
 """
 Float quantisation for committed regression bundles.
 
-Committed regression JSON (``series.json`` / ``diagnostic.json`` / ``output.json``)
+The rounded committed JSON (``series.json`` / ``diagnostic.json``)
 records full-precision floats whose least-significant digits are platform-dependent
 (CPU, BLAS, library versions).
 Those last digits churn byte-for-byte between CI and local runs even when the result is numerically identical,
 producing noisy, unreviewable diffs in the committed bundle.
 
+``output.json`` is excluded from rounding: it is the CMEC *output* bundle (metadata only, no
+float leaves by construction) and is serialised by Pydantic's ``model_dump_json(indent=2)`` which
+does not sort keys, so re-dumping it with ``json.dumps(sort_keys=True)`` would reorder its keys and
+churn the committed bytes (see :data:`climate_ref_core.regression.capture._UNROUNDED_COMMITTED_FILES`).
+
 Rounding every float to a fixed number of significant figures at write time gives
 stable, reviewable committed bytes.
 We round to seven significant figures: one digit finer than the regression compare
diff --git a/packages/climate-ref-core/src/climate_ref_core/regression/capture.py b/packages/climate-ref-core/src/climate_ref_core/regression/capture.py
index 4c2bb781c..e26a1669b 100644
--- a/packages/climate-ref-core/src/climate_ref_core/regression/capture.py
+++ b/packages/climate-ref-core/src/climate_ref_core/regression/capture.py
@@ -25,6 +25,8 @@
 from pathlib import Path
 from typing import TYPE_CHECKING
 
+from loguru import logger
+
 from climate_ref_core.output_files import copy_execution_outputs, to_placeholders
 from climate_ref_core.paths import safe_path
 
@@ -41,26 +43,43 @@
     from climate_ref_core.regression.store import NativeStore
 
 
-# Per-file serialisation parameters for the committed bundle,
-# mirroring exactly how each artefact is written natively.
+# Serialisation parameters for committed-bundle files that contain floats.
 _COMMITTED_FLOAT_JSON_KWARGS: dict[str, dict[str, object]] = {
     "series.json": {"indent": 2, "allow_nan": False, "sort_keys": True},
     "diagnostic.json": {"indent": 2, "allow_nan": False, "sort_keys": True},
 }
 
+# Committed files deliberately NOT float-rounded
+# output.json is the CMEC *output* bundle, which by construction carries no float values.
+_UNROUNDED_COMMITTED_FILES: frozenset[str] = frozenset({"output.json"})
+
+
+def _contains_float(obj: object) -> bool:
+    """Return True if ``obj`` (a parsed-JSON structure) has any float leaf (bool excluded)."""
+    if isinstance(obj, bool):
+        return False
+    if isinstance(obj, float):
+        return True
+    if isinstance(obj, dict):
+        return any(_contains_float(v) for v in obj.values())
+    if isinstance(obj, list):
+        return any(_contains_float(v) for v in obj)
+    return False
+
 
 def _round_committed_floats(regression_dir: Path) -> None:
     """
     Round floats in the committed JSON bundle to seven significant figures in place.
 
-    Full-precision floats in ``series.json`` / ``diagnostic.json`` churn byte-for-byte
+    Only ``series.json`` / ``diagnostic.json`` are rounded.
+    Full-precision floats in those files churn byte-for-byte
     between CI and local runs even when numerically identical,
     producing noisy diffs in the committed (git-tracked) bundle.
     Rounding stabilises those bytes;
     seven figures stays an order of magnitude under the regression compare tolerance (``rtol=1e-6``),
     so a gate verdict is never flipped (see :mod:`climate_ref_core.regression._quantise`).
 
-    Each file is re-serialised with the same JSON parameters used to write it natively,
+    Each rounded file is re-serialised with the same JSON parameters used to write it natively,
     so the only byte difference versus the copied file is reduced float precision.
     A file is rewritten only when rounding actually changes its parsed content,
     keeping float-free artefacts byte-identical to the copy.
@@ -82,6 +101,12 @@ def _round_committed_floats(regression_dir: Path) -> None:
             continue
         path.write_text(json.dumps(rounded, **dump_kwargs), encoding="utf-8")  # type: ignore[arg-type]
 
+    # Check that the unrounded files don't contain floats
+    for filename in _UNROUNDED_COMMITTED_FILES:
+        path = regression_dir / filename
+        if path.exists() and _contains_float(json.loads(path.read_text(encoding="utf-8"))):
+            logger.warning(f"{filename} contains float values but is not float-rounded.")
+
 
 def write_committed_bundle(
     source_dir: Path,
diff --git a/packages/climate-ref-core/src/climate_ref_core/regression/manifest.py b/packages/climate-ref-core/src/climate_ref_core/regression/manifest.py
index 47dba4af1..13a95cef2 100644
--- a/packages/climate-ref-core/src/climate_ref_core/regression/manifest.py
+++ b/packages/climate-ref-core/src/climate_ref_core/regression/manifest.py
@@ -202,6 +202,13 @@ def loads(cls, text: str, *, source: str = "<string>") -> Manifest:
                 "The manifest may be corrupted or written by an incompatible version; "
                 "regenerate it with `ref test-cases run --force-regen`."
             )
+        schema = data["schema"]
+        if isinstance(schema, bool) or not isinstance(schema, int) or schema != SCHEMA_VERSION:
+            raise ValueError(
+                f"Invalid manifest {source}: unsupported schema {schema!r}, "
+                f"expected {SCHEMA_VERSION}. The manifest was written by an incompatible "
+                "version; regenerate it with `ref test-cases run --force-regen`."
+            )
         try:
             native = {
                 relpath: NativeEntry(sha256=entry["sha256"], size=entry["size"])
@@ -220,6 +227,11 @@ def loads(cls, text: str, *, source: str = "<string>") -> Manifest:
             except ValueError as exc:
                 raise ValueError(f"Invalid manifest {source}: {exc}") from exc
             _validate_digest(entry.sha256)
+            if isinstance(entry.size, bool) or not isinstance(entry.size, int) or entry.size < 0:
+                raise ValueError(
+                    f"Invalid manifest {source}: native entry {relpath!r} has invalid size "
+                    f"{entry.size!r}; expected a non-negative integer."
+                )
         return cls(
             schema=data["schema"],
             test_case_version=data["test_case_version"],
diff --git a/packages/climate-ref-core/src/climate_ref_core/testing.py b/packages/climate-ref-core/src/climate_ref_core/testing.py
index 78008c26e..af884c9c7 100644
--- a/packages/climate-ref-core/src/climate_ref_core/testing.py
+++ b/packages/climate-ref-core/src/climate_ref_core/testing.py
@@ -31,6 +31,7 @@
 from climate_ref_core.esgf.base import ESGFRequest
 from climate_ref_core.metric_values.typing import SeriesMetricValue
 from climate_ref_core.output_files import from_placeholders, ordered_replacements
+from climate_ref_core.paths import safe_path
 from climate_ref_core.pycmec.metric import CMECMetric
 from climate_ref_core.pycmec.output import CMECOutput
 from climate_ref_core.regression.manifest import Manifest
@@ -201,6 +202,28 @@ def manifest(self) -> Path:
         """Path to manifest.json (the regression bundle manifest, tracked in git)."""
         return self.root / "manifest.json"
 
+    @property
+    def output(self) -> Path:
+        """Path to the output/ directory (gitignored; holds materialised native slots)."""
+        return self.root / "output"
+
+    def output_slot(self, label: str = "latest") -> Path:
+        """
+        Path to a named output slot under ``output/`` (gitignored).
+
+        A slot is a self-contained, inspectable snapshot of one execute/materialise:
+        the curated native set (flat, at manifest-relative paths) plus a ``regression/``
+        subdirectory holding the rebuilt committed bundle and a ``.source.json`` stamp.
+        ``latest`` (the default) is overwritten on every run; named slots persist so two
+        runs can be diffed (e.g. ``--label before`` vs ``--label after``).
+
+        Parameters
+        ----------
+        label
+            Slot name. Must be a single path segment (no separators or ``..``).
+        """
+        return safe_path(label, self.output, label="output slot label", single_segment=True)
+
     @property
     def test_data_dir(self) -> Path:
         """Path to the test-data directory (parent of diagnostic slug dir)."""
diff --git a/packages/climate-ref-core/tests/unit/regression/test_capture.py b/packages/climate-ref-core/tests/unit/regression/test_capture.py
index eabd001b5..44d3de6fc 100644
--- a/packages/climate-ref-core/tests/unit/regression/test_capture.py
+++ b/packages/climate-ref-core/tests/unit/regression/test_capture.py
@@ -9,12 +9,15 @@
 from climate_ref_core.output_files import PLACEHOLDER_OUTPUT_DIR, PLACEHOLDER_TEST_DATA_DIR
 from climate_ref_core.pycmec.output import CMECOutput
 from climate_ref_core.regression.capture import (
+    _COMMITTED_FLOAT_JSON_KWARGS,
+    _UNROUNDED_COMMITTED_FILES,
+    _contains_float,
     build_native_snapshot,
     capture_execution,
     materialise_native,
     write_committed_bundle,
 )
-from climate_ref_core.regression.manifest import NativeEntry, sha256_file
+from climate_ref_core.regression.manifest import COMMITTED_BUNDLE_FILES, NativeEntry, sha256_file
 from climate_ref_core.regression.store import LocalFilesystemStore
 
 
@@ -106,6 +109,66 @@ def test_write_committed_bundle_rounds_floats(tmp_path):
     assert series[0]["values"] == [1.761334, 9.876543]
 
 
+def test_committed_float_classification_is_exhaustive():
+    assert set(_COMMITTED_FLOAT_JSON_KWARGS) | _UNROUNDED_COMMITTED_FILES == set(COMMITTED_BUNDLE_FILES)
+    assert set(_COMMITTED_FLOAT_JSON_KWARGS).isdisjoint(_UNROUNDED_COMMITTED_FILES)
+
+
+def test_output_json_is_float_free_by_construction(tmp_path):
+    # Codifies the invariant the output.json exclusion relies on: a representative output bundle,
+    # serialised the way REF writes it natively, carries no float leaves.
+    output = CMECOutput.model_validate(CMECOutput.create_template())
+    output.update(
+        "data",
+        short_name="example",
+        dict_content={
+            "filename": "data/example.nc",
+            "long_name": "Example output",
+            "description": "An example data file",
+        },
+    )
+    output.update(
+        "html",
+        short_name="index",
+        dict_content={
+            "filename": "index.html",
+            "long_name": "Index page",
+            "description": "The landing page",
+        },
+    )
+    json_path = tmp_path / "output.json"
+    output.dump_to_json(json_path)
+    loaded = json.loads(json_path.read_text(encoding="utf-8"))
+
+    assert _contains_float(loaded) is False
+
+
+def test_write_committed_bundle_leaves_output_json_bytes_unchanged(tmp_path):
+    # output.json must pass through write_committed_bundle byte-for-byte (no key reorder / rewrite),
+    # while the float-bearing artefacts are rounded.
+    output_dir = (tmp_path / "scratch" / "frag").resolve()
+    test_data_dir = (tmp_path / "test-data").resolve()
+    source = tmp_path / "scratch" / "frag"
+    source.mkdir(parents=True)
+    # output.json written the native (Pydantic) way: indent=2, keys NOT sorted, no floats.
+    CMECOutput.model_validate(CMECOutput.create_template()).dump_to_json(source / "output.json")
+    source_output_bytes = (source / "output.json").read_bytes()
+    # Float-bearing artefacts that rounding must rewrite.
+    (source / "diagnostic.json").write_text(json.dumps({"PROVENANCE": {"score": 1.843240715970751}}))
+    (source / "series.json").write_text(
+        json.dumps([{"dimensions": {"region": "global"}, "values": [1.761333624017425]}])
+    )
+    regression_dir = tmp_path / "regression"
+
+    write_committed_bundle(source, regression_dir, output_dir=output_dir, test_data_dir=test_data_dir)
+
+    # output.json is byte-identical to the copied source: not re-dumped, keys not reordered.
+    assert (regression_dir / "output.json").read_bytes() == source_output_bytes
+    # The float-bearing artefacts were rounded (proving the bundle was processed, not skipped).
+    assert json.loads((regression_dir / "diagnostic.json").read_text())["PROVENANCE"]["score"] == 1.843241
+    assert json.loads((regression_dir / "series.json").read_text())[0]["values"] == [1.761334]
+
+
 def test_build_native_snapshot_digests_relpaths(tmp_path):
     base = tmp_path / "results" / "frag"
     base.mkdir(parents=True)
diff --git a/packages/climate-ref-core/tests/unit/regression/test_manifest.py b/packages/climate-ref-core/tests/unit/regression/test_manifest.py
index b5b2c5e1f..90700bcb6 100644
--- a/packages/climate-ref-core/tests/unit/regression/test_manifest.py
+++ b/packages/climate-ref-core/tests/unit/regression/test_manifest.py
@@ -191,6 +191,28 @@ def test_load_rejects_bad_native_digest(self, tmp_path: Path, bad_digest: str) -
         with pytest.raises(ValueError, match="Invalid sha256 digest"):
             Manifest.load(p)
 
+    @pytest.mark.parametrize("bad_schema", [2, 0, "1", True, 1.0])
+    def test_load_rejects_unknown_schema(self, bad_schema: object) -> None:
+        payload = {
+            "schema": bad_schema,
+            "test_case_version": 1,
+            "committed": {},
+            "native": {},
+        }
+        with pytest.raises(ValueError, match="unsupported schema"):
+            Manifest.loads(json.dumps(payload))
+
+    @pytest.mark.parametrize("bad_size", [-1, 3.0, "10", True])
+    def test_load_rejects_invalid_native_size(self, bad_size: object) -> None:
+        payload = {
+            "schema": SCHEMA_VERSION,
+            "test_case_version": 1,
+            "committed": {},
+            "native": {"file.nc": {"sha256": "aa" * 32, "size": bad_size}},
+        }
+        with pytest.raises(ValueError, match="invalid size"):
+            Manifest.loads(json.dumps(payload))
+
 
 class TestComputeCommittedDigests:
     def test_all_three_present(self, regression_dir: Path) -> None:
diff --git a/packages/climate-ref-core/tests/unit/test_logging.py b/packages/climate-ref-core/tests/unit/test_logging.py
index 03cb92b5a..789fde736 100644
--- a/packages/climate-ref-core/tests/unit/test_logging.py
+++ b/packages/climate-ref-core/tests/unit/test_logging.py
@@ -4,7 +4,12 @@
 from loguru import logger
 
 from climate_ref_core.diagnostics import ExecutionDefinition
-from climate_ref_core.logging import EXECUTION_LOG_FILENAME, capture_logging, redirect_logs
+from climate_ref_core.logging import (
+    EXECUTION_LOG_FILENAME,
+    _retention_count_ignore_missing,
+    capture_logging,
+    redirect_logs,
+)
 
 
 @pytest.fixture
@@ -74,6 +79,21 @@ def test_redirect_logs_stdlog_captured(definition):
     assert "stdlog debug" not in output_file.read_text()
 
 
+def test_retention_count_ignores_missing_files(tmp_path):
+    """Log retention cleanup should tolerate files removed by another process."""
+    logs = []
+    for idx in range(12):
+        log = tmp_path / f"log-{idx}.log"
+        log.write_text(str(idx))
+        logs.append(str(log))
+    missing = tmp_path / "already-removed.log"
+    logs.append(str(missing))
+
+    _retention_count_ignore_missing(logs)
+
+    assert len(list(tmp_path.glob("*.log"))) == 10
+
+
 def test_redirect_logs_exception(definition, caplog):
     log_level = "DEBUG"
 
diff --git a/packages/climate-ref/src/climate_ref/cli/__init__.py b/packages/climate-ref/src/climate_ref/cli/__init__.py
index 0e223f828..cda8b6233 100644
--- a/packages/climate-ref/src/climate_ref/cli/__init__.py
+++ b/packages/climate-ref/src/climate_ref/cli/__init__.py
@@ -42,6 +42,7 @@
     ("test-cases", "sync"),
     ("test-cases", "replay"),
     ("test-cases", "mint"),
+    ("test-cases", "build"),
     ("test-cases", "ci-gate"),
     ("test-cases", "check-store"),
 }
diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases.py b/packages/climate-ref/src/climate_ref/cli/test_cases.py
deleted file mode 100644
index ddbe37fb4..000000000
--- a/packages/climate-ref/src/climate_ref/cli/test_cases.py
+++ /dev/null
@@ -1,1621 +0,0 @@
-"""
-Test data management commands for diagnostic development.
-
-These commands are intended for developers working on diagnostics and require
-a source checkout of the project with test data directories available.
-"""
-
-from __future__ import annotations
-
-import shutil
-from pathlib import Path
-from typing import TYPE_CHECKING, Annotated
-
-import typer
-from loguru import logger
-from rich.console import Console
-from rich.table import Table
-
-from climate_ref.cli._git_utils import collect_regression_file_info, get_repo_for_path
-from climate_ref.cli._utils import format_size
-from climate_ref.config import Config
-from climate_ref_core.exceptions import (
-    DatasetResolutionError,
-    InvalidDiagnosticException,
-    NoTestDataSpecError,
-    TestCaseNotFoundError,
-)
-
-if TYPE_CHECKING:
-    from collections.abc import Iterator
-
-    import pandas as pd
-
-    from climate_ref.datasets import DatasetAdapter
-    from climate_ref.provider_registry import ProviderRegistry
-    from climate_ref_core.datasets import ExecutionDatasetCollection, SourceDatasetType
-    from climate_ref_core.diagnostics import Diagnostic
-    from climate_ref_core.regression.manifest import Manifest, NativeEntry
-    from climate_ref_core.testing import TestCase, TestCasePaths
-
-
-app = typer.Typer(help=__doc__)
-
-
-def _build_catalog(dataset_adapter: DatasetAdapter, file_paths: list[Path]) -> pd.DataFrame:
-    """
-    Parses a list of datasets using a dataset adapter
-
-    Parameters
-    ----------
-    file_paths
-        List of files to build a catalog from
-
-    Returns
-    -------
-    pd.DataFrame
-        DataFrame catalog of datasets with metadata and paths
-    """
-    import pandas as pd
-
-    # Collect unique parent directories since the adapter scans directories
-    parent_dirs = list({fp.parent for fp in file_paths})
-
-    catalog_dfs = []
-    for parent_dir in parent_dirs:
-        try:
-            df = dataset_adapter.find_local_datasets(parent_dir)
-
-            # Filter to only include the files we fetched
-            fetched_files = {str(fp) for fp in file_paths}
-            df = df[df["path"].isin(fetched_files)]
-            if df.empty:
-                logger.warning(f"No matching files found in catalog for {parent_dir}")
-            catalog_dfs.append(df)
-        except Exception as e:
-            logger.warning(f"Failed to parse {parent_dir}: {e}")
-
-    if not catalog_dfs:
-        return pd.DataFrame()
-    return pd.concat(catalog_dfs, ignore_index=True)
-
-
-def _solve_test_case(
-    diagnostic: Diagnostic,
-    data_catalog: dict[SourceDatasetType, pd.DataFrame],
-) -> ExecutionDatasetCollection:
-    """
-    Solve for test case datasets by applying the diagnostic's data requirements.
-
-    Runs the solver to determine which datasets from the catalog
-    satisfy the diagnostic's requirements.
-    """
-    from climate_ref.solver import solve_executions
-
-    executions = list(solve_executions(data_catalog, diagnostic, diagnostic.provider))
-
-    if not executions:
-        raise ValueError(f"No valid executions found for diagnostic {diagnostic.slug}")
-
-    return executions[0].datasets
-
-
-def _fetch_and_build_catalog(
-    diag: Diagnostic,
-    tc: TestCase,
-    *,
-    force: bool = False,
-) -> tuple[ExecutionDatasetCollection, bool]:
-    """
-    Fetch test data and build catalog.
-
-    This function:
-    1. Fetches ESGF data using ESGFFetcher (files stored in intake-esgf cache)
-    2. Uses CMIP6DatasetAdapter to create a data catalog
-    3. Solves for datasets using the diagnostic's data requirements
-    4. Writes catalog YAML to .catalogs/{provider}/{diagnostic}/{test_case}.yaml
-    5. Returns the solved datasets and whether the catalog was written
-
-    By default, the catalog is only written if the content has changed.
-    Use `force=True` to always write.
-
-    Parameters
-    ----------
-    diag
-        The diagnostic to fetch data for
-    tc
-        The test case to fetch data for
-    force
-        If True, always write the catalog even if unchanged
-
-    Returns
-    -------
-    :
-        Tuple of (datasets, catalog_was_written)
-    """
-    from climate_ref.datasets import (
-        CMIP6DatasetAdapter,
-        CMIP7DatasetAdapter,
-        Obs4MIPsDatasetAdapter,
-        PMPClimatologyDatasetAdapter,
-    )
-    from climate_ref_core.datasets import SourceDatasetType
-    from climate_ref_core.esgf import ESGFFetcher
-    from climate_ref_core.testing import TestCasePaths, save_datasets_to_yaml
-
-    fetcher = ESGFFetcher()
-
-    # Fetch all requests - returns DataFrame with metadata + paths
-    combined = fetcher.fetch_for_test_case(tc.requests)
-
-    if combined.empty:
-        raise DatasetResolutionError(
-            f"No datasets found for {diag.provider.slug}/{diag.slug} test case '{tc.name}'"
-        )
-
-    # Group paths by source type and use adapters to build proper catalog
-    data_catalog: dict[SourceDatasetType, pd.DataFrame] = {}
-
-    for source_type, group_df in combined.groupby("source_type"):
-        file_paths = [Path(p) for p in group_df["path"].unique().tolist()]
-
-        if source_type == "CMIP6":
-            data_catalog[SourceDatasetType.CMIP6] = _build_catalog(CMIP6DatasetAdapter(), file_paths)
-
-        elif source_type == "CMIP7":
-            data_catalog[SourceDatasetType.CMIP7] = _build_catalog(CMIP7DatasetAdapter(), file_paths)
-
-        elif source_type == "obs4MIPs":
-            data_catalog[SourceDatasetType.obs4MIPs] = _build_catalog(Obs4MIPsDatasetAdapter(), file_paths)
-
-        elif source_type == "PMPClimatology":
-            data_catalog[SourceDatasetType.PMPClimatology] = _build_catalog(
-                PMPClimatologyDatasetAdapter(), file_paths
-            )
-
-    if not data_catalog:
-        raise DatasetResolutionError(
-            f"No datasets found for {diag.provider.slug}/{diag.slug} test case '{tc.name}'"
-        )
-
-    # Solve for datasets
-    datasets = _solve_test_case(diag, data_catalog)
-
-    # Write catalog YAML to package-local test case directory
-    catalog_written = False
-    paths = TestCasePaths.from_diagnostic(diag, tc.name)
-    if paths:
-        paths.create()
-        catalog_written = save_datasets_to_yaml(datasets, paths.catalog, force=force)
-
-    return datasets, catalog_written
-
-
-@app.command(name="fetch")
-def fetch_test_data(  # noqa: PLR0912, PLR0915
-    ctx: typer.Context,
-    provider: Annotated[
-        str | None,
-        typer.Option(help="Specific provider to fetch data for (e.g., 'esmvaltool', 'ilamb')"),
-    ] = None,
-    diagnostic: Annotated[
-        str | None,
-        typer.Option(help="Specific diagnostic slug to fetch data for"),
-    ] = None,
-    test_case: Annotated[
-        str | None,
-        typer.Option(help="Specific test case name to fetch data for"),
-    ] = None,
-    dry_run: Annotated[
-        bool,
-        typer.Option(help="Show what would be fetched without downloading"),
-    ] = False,
-    only_missing: Annotated[
-        bool,
-        typer.Option(help="Only fetch data for test cases without existing catalogs"),
-    ] = False,
-    force: Annotated[
-        bool,
-        typer.Option(help="Force overwrite catalog even if unchanged"),
-    ] = False,
-) -> None:
-    """
-    Fetch test data from ESGF for running diagnostic tests.
-
-    Downloads full-resolution ESGF data based on diagnostic test_data_spec.
-    Use --provider or --diagnostic to limit scope.
-
-    Examples
-    --------
-        ref test-cases fetch                   # Fetch all test data
-        ref test-cases fetch --provider ilamb  # Fetch ILAMB test data only
-        ref test-cases fetch --diagnostic ecs  # Fetch ECS diagnostic data
-        ref test-cases fetch --only-missing    # Skip test cases with existing catalogs
-    """
-    from climate_ref.provider_registry import ProviderRegistry
-    from climate_ref_core.testing import TestCasePaths
-
-    config = ctx.obj.config
-    db = ctx.obj.database
-
-    # Build provider registry to access diagnostics
-    registry = ProviderRegistry.build_from_config(config, db)
-
-    # Check if the requested provider exists in the registry
-    available_providers = [p.slug for p in registry.providers]
-    if provider and provider not in available_providers:
-        logger.error(f"Provider '{provider}' is not configured")
-        if available_providers:
-            logger.error(f"Available providers: {', '.join(sorted(available_providers))}")
-        else:
-            logger.error("No providers are configured. Check your configuration file.")
-        logger.error("To add a provider, update your config file or set REF_DIAGNOSTIC_PROVIDERS")
-        raise typer.Exit(code=1)
-
-    # Collect diagnostics to process
-    diagnostics_to_process: list[Diagnostic] = []
-
-    for provider_instance in registry.providers:
-        if provider and provider_instance.slug != provider:
-            continue
-
-        for diag in provider_instance.diagnostics():
-            if diagnostic and diag.slug != diagnostic:
-                continue
-            if diag.test_data_spec is None:
-                continue
-            diagnostics_to_process.append(diag)
-
-    if not diagnostics_to_process:
-        if provider:
-            logger.warning(f"No diagnostics with test_data_spec found for provider '{provider}'")
-        else:
-            logger.warning("No diagnostics with test_data_spec found")
-        raise typer.Exit(code=0)
-
-    logger.info(f"Found {len(diagnostics_to_process)} diagnostics with test data specifications")
-
-    if dry_run:  # pragma: no cover
-        for diag in diagnostics_to_process:
-            logger.info(f"Would fetch data for: {diag.provider.slug}/{diag.slug}")
-            if diag.test_data_spec:
-                for tc in diag.test_data_spec.test_cases:
-                    if test_case and tc.name != test_case:
-                        continue
-                    # Check if catalog exists when using --only-missing
-                    if only_missing:
-                        paths = TestCasePaths.from_diagnostic(diag, tc.name)
-                        if paths and paths.catalog.exists():
-                            logger.info(f"  Test case: {tc.name} - [SKIP: catalog exists]")
-                            continue
-                    logger.info(f"  Test case: {tc.name} - {tc.description}")
-                    if tc.requests:
-                        for req in tc.requests:
-                            logger.info(f"    Request: {req.slug} ({req.source_type})")
-        return
-
-    # Process each diagnostic test case
-    for diag in diagnostics_to_process:  # pragma: no cover
-        logger.info(f"Fetching data for: {diag.provider.slug}/{diag.slug}")
-        if diag.test_data_spec:
-            for tc in diag.test_data_spec.test_cases:
-                if test_case and tc.name != test_case:
-                    continue
-                # Skip if catalog exists when using --only-missing
-                if only_missing:
-                    paths = TestCasePaths.from_diagnostic(diag, tc.name)
-                    if paths and paths.catalog.exists():
-                        logger.info(f"  Skipping test case: {tc.name} (catalog exists)")
-                        continue
-                if tc.requests:
-                    logger.info(f"  Processing test case: {tc.name}")
-                    try:
-                        _, catalog_written = _fetch_and_build_catalog(diag, tc, force=force)
-                        if not catalog_written:
-                            logger.info(f"  Catalog unchanged for {tc.name}")
-                    except (DatasetResolutionError, ValueError) as e:
-                        logger.warning(f"  Could not build catalog for {tc.name}: {e}")
-
-
-@app.command(name="list")
-def list_cases(
-    ctx: typer.Context,
-    provider: Annotated[
-        str | None,
-        typer.Option(help="Filter by provider"),
-    ] = None,
-) -> None:
-    """
-    List test cases for all diagnostics.
-
-    Shows which test cases are defined for each diagnostic and their descriptions.
-    Also shows whether catalog and regression data exist for each test case.
-    """
-    from climate_ref.provider_registry import ProviderRegistry
-    from climate_ref_core.testing import TestCasePaths
-
-    config = ctx.obj.config
-    db = ctx.obj.database
-    console = ctx.obj.console
-
-    # Build provider registry to access diagnostics
-    registry = ProviderRegistry.build_from_config(config, db)
-
-    # Check if the requested provider exists in the registry
-    available_providers = [p.slug for p in registry.providers]
-    if provider and provider not in available_providers:
-        logger.error(f"Provider '{provider}' is not configured")
-        if available_providers:
-            logger.error(f"Available providers: {', '.join(sorted(available_providers))}")
-        else:
-            logger.error("No providers are configured. Check your configuration file.")
-        raise typer.Exit(code=1)
-
-    table = Table(title="Test Data Specifications")
-    table.add_column("Provider", style="cyan")
-    table.add_column("Diagnostic", style="green")
-    table.add_column("Test Case", style="yellow")
-    table.add_column("Description")
-    table.add_column("Requests", justify="right")
-    table.add_column("Catalog", justify="center")
-    table.add_column("Regression", justify="center")
-
-    for provider_instance in registry.providers:
-        if provider and provider_instance.slug != provider:
-            continue
-
-        for diag in provider_instance.diagnostics():
-            if diag.test_data_spec is None:
-                table.add_row(
-                    provider_instance.slug,
-                    diag.slug,
-                    "-",
-                    "(no test_data_spec)",
-                    "0",
-                    "-",
-                    "-",
-                )
-                continue
-
-            for tc in diag.test_data_spec.test_cases:
-                num_requests = len(tc.requests) if tc.requests else 0
-
-                # Check if catalog and regression data exist
-                paths = TestCasePaths.from_diagnostic(diag, tc.name)
-                if paths:
-                    catalog_status = "[green]yes[/green]" if paths.catalog.exists() else "[red]no[/red]"
-                    regression_status = "[green]yes[/green]" if paths.regression.exists() else "[red]no[/red]"
-                else:
-                    catalog_status = "[dim]-[/dim]"
-                    regression_status = "[dim]-[/dim]"
-
-                table.add_row(
-                    provider_instance.slug,
-                    diag.slug,
-                    tc.name,
-                    tc.description,
-                    str(num_requests),
-                    catalog_status,
-                    regression_status,
-                )
-
-    console.print(table)
-
-
-def _print_regression_summary(  # pragma: no cover
-    console: Console,
-    regression_dir: Path,
-    size_threshold_mb: float = 1.0,
-) -> None:
-    """
-    Print a summary of the regression directory with file sizes and git status.
-
-    Parameters
-    ----------
-    console
-        Rich console for output
-    regression_dir
-        Path to the regression data directory
-    size_threshold_mb
-        Files larger than this (in MB) will be flagged
-    """
-    repo = get_repo_for_path(regression_dir)
-    repo_root = Path(repo.working_dir) if repo else regression_dir
-
-    threshold_bytes = int(size_threshold_mb * 1024 * 1024)
-    file_info = collect_regression_file_info(regression_dir, repo, threshold_bytes)
-
-    if not file_info:
-        console.print("[yellow]No files in regression directory[/yellow]")
-        return
-
-    total_size = sum(f["size"] for f in file_info)
-    large_files = sum(1 for f in file_info if f["is_large"])
-
-    table = Table(title=f"Regression Data: {regression_dir.relative_to(repo_root)}")
-    table.add_column("File", style="cyan", no_wrap=False)
-    table.add_column("Size", justify="right")
-    table.add_column("Git Status", justify="center")
-
-    for info in file_info:
-        # Format size with color
-        size_str = format_size(info["size"])
-        if info["is_large"]:
-            size_str = f"[bold red]{size_str}[/bold red]"
-
-        # Get git status with color
-        git_status = info["git_status"]
-        status_colors = {
-            "new": "[green]new[/green]",
-            "staged": "[green]staged[/green]",
-            "modified": "[yellow]modified[/yellow]",
-            "tracked": "[dim]tracked[/dim]",
-            "untracked": "[red]untracked[/red]",
-            "deleted": "[red]deleted[/red]",
-            "unknown": "[dim]?[/dim]",
-        }
-        git_status_str = status_colors.get(git_status, f"[dim]{git_status}[/dim]")
-
-        table.add_row(info["rel_path"], size_str, git_status_str)
-
-    console.print(table)
-
-    # Summary line
-    summary = f"\n[bold]Total:[/bold] {len(file_info)} files, {format_size(total_size)}"
-    if large_files > 0:
-        summary += f" ([red]{large_files} files > {size_threshold_mb} MB[/red])"
-    console.print(summary)
-
-
-def _write_test_case_manifest(
-    paths: TestCasePaths,
-    *,
-    test_case_version: int,
-    committed: dict[str, str],
-    native: dict[str, NativeEntry],
-    schema: int | None = None,
-) -> Manifest:
-    """
-    Construct and write a test case ``manifest.json``, recording the input catalog hash.
-
-    Shared by ``run`` (which preserves the existing version and native block) and
-    ``mint`` (which authors the native block and may bump the version); the two
-    callers differ only in the ``test_case_version`` and ``native`` they supply.
-    The ``catalog_hash`` is always (re)derived from the current ``catalog.yaml`` so
-    the manifest stays coupled to the inputs that produced the committed bundle.
-    """
-    from climate_ref_core.regression.manifest import SCHEMA_VERSION, Manifest
-    from climate_ref_core.testing import get_catalog_hash
-
-    manifest = Manifest(
-        schema=SCHEMA_VERSION if schema is None else schema,
-        test_case_version=test_case_version,
-        committed=dict(committed),
-        native=native,
-        catalog_hash=get_catalog_hash(paths.catalog),
-    )
-    manifest.dump(paths.manifest)
-    return manifest
-
-
-def _run_single_test_case(  # noqa: PLR0911, PLR0912, PLR0915
-    config: Config,
-    console: Console,
-    diag: Diagnostic,
-    tc: TestCase,
-    output_directory: Path | None,
-    force_regen: bool,
-    fetch: bool,
-    size_threshold: float,
-    clean: bool,
-) -> bool:
-    """
-    Run a single test case for a diagnostic.
-
-    Returns True if successful, False otherwise.
-    """
-    import tempfile
-
-    from climate_ref.testing import TestCaseRunner
-    from climate_ref_core.regression.capture import capture_execution
-    from climate_ref_core.regression.manifest import Manifest
-    from climate_ref_core.testing import (
-        TestCasePaths,
-        load_datasets_from_yaml,
-    )
-
-    provider_slug = diag.provider.slug
-    diagnostic_slug = diag.slug
-    test_case_name = tc.name
-
-    # Resolve datasets: either fetch from ESGF or load from pre-built catalog
-    if fetch:
-        logger.info(f"Fetching test data for {provider_slug}/{diagnostic_slug}/{test_case_name}")
-        try:
-            datasets, _ = _fetch_and_build_catalog(diag, tc)
-        except (DatasetResolutionError, InvalidDiagnosticException) as e:
-            logger.exception(
-                f"Failed to fetch data for {provider_slug}/{diagnostic_slug}/{test_case_name}: {e}"
-            )
-            return False
-    else:
-        paths = TestCasePaths.from_diagnostic(diag, test_case_name)
-        if paths is None:
-            logger.error(f"Could not determine test data directory for {provider_slug}/{diagnostic_slug}")
-            return False
-
-        if not paths.catalog.exists():
-            logger.error(f"No catalog file found for {provider_slug}/{diagnostic_slug}/{test_case_name}")
-            logger.error("Run 'ref test-cases fetch' first or use --fetch flag")
-            return False
-
-        logger.info(f"Loading catalog from {paths.catalog}")
-        datasets = load_datasets_from_yaml(paths.catalog)
-
-    # Create runner and execute
-    runner = TestCaseRunner(config=config, datasets=datasets)
-
-    logger.info(f"Running test case {test_case_name!r} for {provider_slug}/{diagnostic_slug}")
-
-    try:
-        result = runner.run(diag, test_case_name, output_directory, clean=clean)
-    except NoTestDataSpecError:
-        logger.error(f"Diagnostic {provider_slug}/{diagnostic_slug} has no test_data_spec")
-        return False
-    except TestCaseNotFoundError:
-        logger.error(f"Test case {test_case_name!r} not found for {provider_slug}/{diagnostic_slug}")
-        if diag.test_data_spec:
-            logger.error(f"Available test cases: {diag.test_data_spec.case_names}")
-        return False
-    except DatasetResolutionError as e:
-        logger.error(str(e))
-        logger.error("Have you run 'ref test-cases fetch' first?")
-        return False
-    except Exception as e:
-        case_id = f"{provider_slug}/{diagnostic_slug}/{test_case_name}"
-        logger.error(f"Diagnostic execution failed for {case_id}: {e!s}")
-        return False
-
-    if not result.successful:
-        logger.error(f"Execution failed: {provider_slug}/{diagnostic_slug}/{test_case_name}")
-        return False
-
-    logger.info(f"Execution completed: {provider_slug}/{diagnostic_slug}/{test_case_name}")
-    if result.metric_bundle_filename:
-        logger.info(f"Metric bundle: {result.to_output_path(result.metric_bundle_filename)}")
-    if result.output_bundle_filename:
-        logger.info(f"Output bundle: {result.to_output_path(result.output_bundle_filename)}")
-
-    # Handle regression baseline comparison/regeneration
-    paths = TestCasePaths.from_diagnostic(diag, test_case_name)
-
-    if paths is None:
-        logger.warning("Could not determine test case directory for provider package")
-        return True
-
-    if force_regen:
-        paths.create()
-
-    if force_regen or not paths.regression.exists():
-        if paths.regression.exists():
-            shutil.rmtree(paths.regression)
-        paths.regression.mkdir(parents=True, exist_ok=True)
-
-        defn = result.definition
-        output_dir = defn.output_directory
-        fragment = defn.output_fragment()
-        scratch_root = output_dir.parent
-
-        # results_base must differ from the scratch root for copy_execution_outputs.
-        # Keep it alive only until capture completes (run() does not mint to a store).
-        with tempfile.TemporaryDirectory() as results_base:
-            committed_digests, native = capture_execution(
-                scratch_root,
-                Path(results_base),
-                fragment,
-                result,
-                regression_dir=paths.regression,
-                output_dir=output_dir,
-                test_data_dir=paths.test_data_dir,
-            )
-
-        # Refresh the manifest's committed block (and catalog hash) only; the native
-        # block is mint-owned, so preserve the previous one when the manifest exists.
-        if paths.manifest.exists():
-            previous = Manifest.load(paths.manifest)
-            _write_test_case_manifest(
-                paths,
-                test_case_version=previous.test_case_version,
-                committed=committed_digests,
-                native=previous.native,
-                schema=previous.schema,
-            )
-        else:
-            _write_test_case_manifest(
-                paths,
-                test_case_version=1,
-                committed=committed_digests,
-                native={},
-            )
-
-        logger.info(f"Captured {len(native)} native output file(s) (not minted)")
-        logger.info(f"Updated regression data: {paths.regression}")
-        _print_regression_summary(console, paths.regression, size_threshold)
-    elif paths.regression.exists():
-        logger.info(f"Regression data exists at: {paths.regression}")
-        logger.info("Use --force-regen to update the baseline")
-
-    return True
-
-
-@app.command(name="run")
-def run_test_case(  # noqa: PLR0912, PLR0915
-    ctx: typer.Context,
-    provider: Annotated[
-        str,
-        typer.Option(help="Provider slug (required, e.g., 'example', 'ilamb')"),
-    ],
-    diagnostic: Annotated[
-        str | None,
-        typer.Option(help="Specific diagnostic slug to run (e.g., 'global-mean-timeseries')"),
-    ] = None,
-    test_case: Annotated[
-        str | None,
-        typer.Option(help="Specific test case name to run (e.g., 'default')"),
-    ] = None,
-    output_directory: Annotated[
-        Path | None,
-        typer.Option(help="Output directory for execution results"),
-    ] = None,
-    force_regen: Annotated[
-        bool,
-        typer.Option(help="Force regeneration of regression baselines"),
-    ] = False,
-    fetch: Annotated[
-        bool,
-        typer.Option(help="Fetch test data from ESGF before running"),
-    ] = False,
-    size_threshold: Annotated[
-        float,
-        typer.Option(help="Flag files larger than this size in MB (default: 1.0)"),
-    ] = 1.0,
-    dry_run: Annotated[
-        bool,
-        typer.Option(help="Show what would be run without executing"),
-    ] = False,
-    only_missing: Annotated[
-        bool,
-        typer.Option(help="Only run test cases without existing regression data"),
-    ] = False,
-    if_changed: Annotated[
-        bool,
-        typer.Option(help="Only run if catalog has changed since regression data was generated"),
-    ] = False,
-    clean: Annotated[
-        bool,
-        typer.Option(help="Delete existing output directory before running"),
-    ] = False,
-) -> None:
-    """
-    Run test cases for diagnostics.
-
-    Executes diagnostics using pre-defined datasets from the test_data_spec
-    and optionally compares against regression baselines.
-
-    Use --provider to select which provider's diagnostics to run (required).
-    Use --diagnostic and --test-case to further narrow the scope.
-
-    Examples
-    --------
-        ref test-cases run --provider ilamb              # Run all ILAMB test cases
-        ref test-cases run --provider example --diagnostic global-mean-timeseries
-        ref test-cases run --provider ilamb --test-case default --fetch
-        ref test-cases run --provider pmp --only-missing # Skip test cases with regression data
-        ref test-cases run --provider pmp --if-changed   # Only run if catalog changed
-    """
-    from climate_ref.provider_registry import ProviderRegistry
-    from climate_ref_core.testing import (
-        TestCasePaths,
-        catalog_changed_since_regression,
-    )
-
-    config: Config = ctx.obj.config
-    db = ctx.obj.database
-    console: Console = ctx.obj.console
-
-    # Build provider registry
-    registry = ProviderRegistry.build_from_config(config, db)
-
-    # Find the provider
-    provider_instance = None
-    for p in registry.providers:
-        if p.slug == provider:
-            provider_instance = p
-            break
-
-    if provider_instance is None:
-        logger.error(f"Provider '{provider}' not found")
-        available = [p.slug for p in registry.providers]
-        logger.error(f"Available providers: {available}")
-        raise typer.Exit(code=1)
-
-    # Collect test cases to run
-    test_cases_to_run: list[tuple[Diagnostic, TestCase]] = []
-    skipped_cases: list[tuple[Diagnostic, TestCase]] = []
-
-    for diag in provider_instance.diagnostics():
-        if diagnostic and diag.slug != diagnostic:
-            continue
-        if diag.test_data_spec is None:
-            continue
-
-        for tc in diag.test_data_spec.test_cases:
-            if test_case and tc.name != test_case:
-                continue
-            # Skip if regression exists when using --only-missing
-            paths = TestCasePaths.from_diagnostic(diag, tc.name)
-            if only_missing:
-                if paths and paths.regression.exists():
-                    skipped_cases.append((diag, tc))
-                    continue
-            # Skip if catalog hasn't changed when using --if-changed
-            if if_changed:
-                if paths and not catalog_changed_since_regression(paths):
-                    skipped_cases.append((diag, tc))
-                    continue
-            test_cases_to_run.append((diag, tc))
-
-    if not test_cases_to_run:
-        logger.warning(f"No test cases found for provider '{provider}'")
-        if diagnostic:
-            logger.warning(f"  with diagnostic filter: {diagnostic}")
-        if test_case:
-            logger.warning(f"  with test case filter: {test_case}")
-        if only_missing and skipped_cases:
-            logger.info(f"  ({len(skipped_cases)} test case(s) skipped due to --only-missing)")
-        raise typer.Exit(code=0)
-
-    logger.info(f"Found {len(test_cases_to_run)} test case(s) to run")
-    if skipped_cases:
-        logger.info(f"Skipping {len(skipped_cases)} test case(s) with existing regression data")
-
-    if dry_run:  # pragma: no cover
-        table = Table(title="Test Cases to Run")
-        table.add_column("Provider", style="cyan")
-        table.add_column("Diagnostic", style="green")
-        table.add_column("Test Case", style="yellow")
-        table.add_column("Description")
-        table.add_column("Status", justify="center")
-
-        for diag, tc in test_cases_to_run:
-            table.add_row(provider, diag.slug, tc.name, tc.description, "[green]will run[/green]")
-
-        for diag, tc in skipped_cases:
-            table.add_row(provider, diag.slug, tc.name, tc.description, "[dim]skip (regression exists)[/dim]")
-
-        console.print(table)
-        return
-
-    # Run each test case
-    successes = 0
-    failures = 0
-    failed_cases: list[str] = []
-
-    for diag, tc in test_cases_to_run:
-        success = _run_single_test_case(
-            config=config,
-            console=console,
-            diag=diag,
-            tc=tc,
-            output_directory=output_directory,
-            force_regen=force_regen,
-            fetch=fetch,
-            size_threshold=size_threshold,
-            clean=clean,
-        )
-        if success:
-            successes += 1
-        else:
-            failures += 1
-            failed_cases.append(f"{provider}/{diag.slug}/{tc.name}")
-
-    # Print summary
-    console.print()
-    if failures == 0:
-        console.print(f"[green]All {successes} test case(s) passed[/green]")
-    else:
-        console.print(f"[yellow]Results: {successes} passed, {failures} failed[/yellow]")
-        console.print("[red]Failed test cases:[/red]")
-        for case in failed_cases:
-            console.print(f"  - {case}")
-        raise typer.Exit(code=1)
-
-
-def _iter_test_cases(
-    registry: ProviderRegistry,
-    *,
-    provider: str | None = None,
-    diagnostic: str | None = None,
-    test_case: str | None = None,
-) -> Iterator[tuple[Diagnostic, TestCase]]:
-    """
-    Yield ``(diagnostic, test_case)`` pairs from the registry, applying filters.
-
-    Parameters
-    ----------
-    registry
-        The provider registry to enumerate.
-    provider
-        Optional provider slug filter.
-    diagnostic
-        Optional diagnostic slug filter.
-    test_case
-        Optional test case name filter.
-
-    Yields
-    ------
-    :
-        Matching ``(diagnostic, test_case)`` pairs.
-    """
-    for provider_instance in registry.providers:
-        if provider and provider_instance.slug != provider:
-            continue
-        for diag in provider_instance.diagnostics():
-            if diagnostic and diag.slug != diagnostic:
-                continue
-            if diag.test_data_spec is None:
-                continue
-            for tc in diag.test_data_spec.test_cases:
-                if test_case and tc.name != test_case:
-                    continue
-                yield diag, tc
-
-
-@app.command(name="sync")
-def sync_native(
-    ctx: typer.Context,
-    provider: Annotated[
-        str | None,
-        typer.Option(help="Limit sync to a single provider slug"),
-    ] = None,
-    diagnostic: Annotated[
-        str | None,
-        typer.Option(help="Limit sync to a single diagnostic slug"),
-    ] = None,
-    test_case: Annotated[
-        str | None,
-        typer.Option(help="Limit sync to a single test case name"),
-    ] = None,
-) -> None:
-    """
-    Fetch native baseline blobs referenced by committed manifests into the store cache.
-
-    Reads each committed ``manifest.json``'s ``native`` block
-    and ensures every referenced blob is present in the read store (public, credential-free).
-    Blobs already cached are skipped (idempotent).
-    A referenced digest the store cannot serve is a hard failure.
-
-    Examples
-    --------
-        ref test-cases sync                  # Sync all providers
-        ref test-cases sync --provider ilamb # Sync a single provider
-    """
-    import tempfile
-
-    from climate_ref.provider_registry import ProviderRegistry
-    from climate_ref_core.regression.manifest import Manifest
-    from climate_ref_core.regression.store import build_native_store
-    from climate_ref_core.testing import TestCasePaths
-
-    config: Config = ctx.obj.config
-    db = ctx.obj.database
-    console: Console = ctx.obj.console
-
-    registry = ProviderRegistry.build_from_config(config, db)
-    store = build_native_store(config.native_store, writable=False)
-
-    # When a specific case is named, a missing manifest is a hard failure.
-    named = bool(diagnostic or test_case)
-
-    fetched = 0
-    skipped = 0
-    failures: list[str] = []
-
-    for diag, tc in _iter_test_cases(registry, provider=provider, diagnostic=diagnostic, test_case=test_case):
-        case_id = f"{diag.provider.slug}/{diag.slug}/{tc.name}"
-        paths = TestCasePaths.from_diagnostic(diag, tc.name)
-        if paths is None or not paths.manifest.exists():
-            if named:
-                logger.error(f"No manifest.json for {case_id}; run `ref test-cases mint` first")
-                failures.append(case_id)
-            continue
-        manifest = Manifest.load(paths.manifest)
-        for relpath, entry in manifest.native.items():
-            if store.has(entry.sha256):
-                skipped += 1
-                continue
-            with tempfile.TemporaryDirectory() as tmp:
-                try:
-                    store.fetch(entry.sha256, Path(tmp) / "blob")
-                except Exception as exc:
-                    failures.append(f"{case_id}: cannot serve native blob {entry.sha256} ({relpath}): {exc}")
-                    continue
-            fetched += 1
-
-    console.print(f"[green]Synced native blobs:[/green] {fetched} fetched, {skipped} already cached")
-    if failures:
-        console.print("[red]Failed to fetch referenced native blobs:[/red]")
-        for failure in failures:
-            console.print(f"  - {failure}")
-        raise typer.Exit(code=1)
-
-
-@app.command(name="replay")
-def replay_test_case(  # noqa: PLR0912, PLR0915
-    ctx: typer.Context,
-    provider: Annotated[
-        str,
-        typer.Option(help="Provider slug (required, e.g., 'example', 'ilamb')"),
-    ],
-    diagnostic: Annotated[
-        str | None,
-        typer.Option(help="Specific diagnostic slug to replay"),
-    ] = None,
-    test_case: Annotated[
-        str | None,
-        typer.Option(help="Specific test case name to replay"),
-    ] = None,
-) -> None:
-    """
-    Replay committed baselines from native blobs and compare to the committed bundle.
-
-    Materialises the committed manifest's native blobs (public, credential-free)
-    into a fresh output directory at their stored relative paths, re-runs ``build_execution_result``,
-    and compares the regenerated committed bundle to the in-repo copy using the tolerant content comparator.
-
-    Exits non-zero on drift.
-
-    Examples
-    --------
-        ref test-cases replay --provider example
-        ref test-cases replay --provider example --diagnostic global-mean-timeseries
-    """
-    import tempfile
-
-    from climate_ref.provider_registry import ProviderRegistry
-    from climate_ref_core.diagnostics import ExecutionDefinition
-    from climate_ref_core.output_files import (
-        PLACEHOLDER_OUTPUT_DIR,
-        PLACEHOLDER_TEST_DATA_DIR,
-        from_placeholders,
-    )
-    from climate_ref_core.regression import (
-        COMMITTED_BUNDLE_FILES,
-        Manifest,
-        Tolerance,
-        assert_bundle_regression,
-        materialise_native,
-        verify_committed_integrity,
-    )
-    from climate_ref_core.regression.store import build_native_store
-    from climate_ref_core.testing import TestCasePaths, load_datasets_from_yaml
-
-    config: Config = ctx.obj.config
-    db = ctx.obj.database
-    console: Console = ctx.obj.console
-
-    registry = ProviderRegistry.build_from_config(config, db)
-    store = build_native_store(config.native_store, writable=False)
-
-    cases = list(_iter_test_cases(registry, provider=provider, diagnostic=diagnostic, test_case=test_case))
-    if not cases:
-        logger.warning(f"No test cases found for provider {provider!r}")
-        raise typer.Exit(code=0)
-
-    # When a specific case is named, a missing manifest/catalog is a hard failure.
-    named = bool(diagnostic or test_case)
-
-    successes = 0
-    failures: list[str] = []
-
-    for diag, tc in cases:
-        paths = TestCasePaths.from_diagnostic(diag, tc.name)
-        case_id = f"{provider}/{diag.slug}/{tc.name}"
-        if paths is None:
-            logger.warning(f"Could not determine test case directory for {case_id}")
-            continue
-        if not paths.manifest.exists():
-            message = f"No manifest.json for {case_id}; run `ref test-cases mint` first"
-            if named:
-                logger.error(message)
-                failures.append(case_id)
-            else:
-                logger.warning(message)
-            continue
-        if not paths.catalog.exists():
-            logger.error(f"No catalog file for {case_id}; run `ref test-cases fetch` first")
-            failures.append(case_id)
-            continue
-
-        manifest = Manifest.load(paths.manifest)
-
-        # The byte-exact digest check is advisory that the committed baseline is not bitwise identical.
-        # The tolerant bundle comparison below may still find them equivalent within tolerance.
-        mismatches = verify_committed_integrity(manifest, paths.regression)
-        if mismatches:
-            logger.warning(
-                f"{case_id}: committed baseline differs from the digests recorded in {paths.manifest}"
-            )
-            for mismatch in mismatches:
-                logger.warning(f"  - {mismatch}")
-
-        if not manifest.native:
-            logger.error(
-                f"{case_id}: manifest has no native baselines — not yet minted. "
-                "Run `ref test-cases mint` first."
-            )
-            failures.append(case_id)
-            continue
-
-        with tempfile.TemporaryDirectory() as tmp:
-            tmp_dir = Path(tmp)
-            output_dir = tmp_dir / "output"
-            output_dir.mkdir(parents=True, exist_ok=True)
-
-            try:
-                materialise_native(manifest.native, store, output_dir)
-            except Exception as exc:
-                logger.error(f"{case_id}: failed to materialise native blobs: {exc}")
-                failures.append(case_id)
-                continue
-
-            # Expand placeholders so the re-run reads concrete paths (mirrors the validator).
-            from_placeholders(output_dir, output_dir=output_dir, test_data_dir=paths.test_data_dir)
-
-            datasets = load_datasets_from_yaml(paths.catalog)
-            definition = ExecutionDefinition(
-                diagnostic=diag,
-                key=f"test-{tc.name}",
-                datasets=datasets,
-                output_directory=output_dir,
-                root_directory=tmp_dir,
-            )
-
-            try:
-                result = diag.build_execution_result(definition)
-            except Exception as exc:
-                logger.error(f"{case_id}: build_execution_result failed during replay: {exc}")
-                failures.append(case_id)
-                continue
-
-            replacements = {
-                str(output_dir): PLACEHOLDER_OUTPUT_DIR,
-                str(paths.test_data_dir): PLACEHOLDER_TEST_DATA_DIR,
-            }
-            # The comparator silently skips a bundle file with no committed copy,
-            compared = [f for f in COMMITTED_BUNDLE_FILES if (paths.regression / f).exists()]
-            try:
-                for filename in compared:
-                    assert_bundle_regression(
-                        paths.regression / filename,
-                        result.to_output_path(filename),
-                        slug=diag.slug,
-                        tol=Tolerance(),
-                        replacements=replacements,
-                    )
-            except AssertionError as exc:
-                logger.error(f"{case_id}: replay drift detected:\n{exc}")
-                failures.append(case_id)
-                continue
-
-        successes += 1
-        if mismatches:
-            # The byte-level warning above was reconciled by the tolerant comparison.
-            logger.info(
-                f"Replay reconciled committed bundle: {case_id} "
-                f"({len(manifest.native)} native file(s) materialised, "
-                f"{len(compared)} bundle file(s) equivalent within tolerance)"
-            )
-        else:
-            logger.info(
-                f"Replay matched committed bundle: {case_id} "
-                f"({len(manifest.native)} native file(s) materialised, "
-                f"{len(compared)} bundle file(s) compared)"
-            )
-
-    console.print()
-    if failures:
-        console.print(f"[yellow]Replay: {successes} passed, {len(failures)} failed[/yellow]")
-        console.print("[red]Failed replays:[/red]")
-        for case in failures:
-            console.print(f"  - {case}")
-        raise typer.Exit(code=1)
-    console.print(f"[green]All {successes} replay(s) matched the committed bundle[/green]")
-
-
-@app.command(name="mint")
-def mint_native(  # noqa: PLR0912, PLR0915
-    ctx: typer.Context,
-    provider: Annotated[
-        str,
-        typer.Option(help="Provider slug (required, e.g., 'example', 'ilamb')"),
-    ],
-    diagnostic: Annotated[
-        str | None,
-        typer.Option(help="Specific diagnostic slug to mint"),
-    ] = None,
-    test_case: Annotated[
-        str | None,
-        typer.Option(help="Specific test case name to mint"),
-    ] = None,
-    bump_version: Annotated[
-        bool,
-        typer.Option(help="Increment test_case_version when authoring the manifest"),
-    ] = False,
-    dry_run: Annotated[
-        bool,
-        typer.Option(help="Preflight the store and list what would be minted, without running or uploading"),
-    ] = False,
-) -> None:
-    """
-    Mint canonical native baselines
-
-    Runs each test case, stores its native snapshot in the writable store,
-    and authors the committed ``manifest.json``'s ``native`` block.
-
-    This requires write credentials and is generally run by the CI.
-
-    Examples
-    --------
-        ref test-cases mint --provider example
-        ref test-cases mint --provider example --bump-version
-        ref test-cases mint --provider example --dry-run
-    """
-    import tempfile
-
-    from climate_ref.provider_registry import ProviderRegistry
-    from climate_ref.testing import TestCaseRunner
-    from climate_ref_core.regression.capture import capture_execution
-    from climate_ref_core.regression.manifest import Manifest
-    from climate_ref_core.regression.store import NativeStoreUnavailableError, build_native_store
-    from climate_ref_core.testing import TestCasePaths, load_datasets_from_yaml
-
-    config: Config = ctx.obj.config
-    db = ctx.obj.database
-    console: Console = ctx.obj.console
-
-    try:
-        store = build_native_store(config.native_store, writable=True)
-    except (NotImplementedError, ValueError) as exc:
-        logger.error(
-            "Cannot mint: no writable native store is configured. For the remote (R2) store set "
-            "REF_NATIVE_STORE_S3_ENDPOINT_URL and REF_NATIVE_STORE_BUCKET, and authenticate via "
-            "REF_NATIVE_STORE_ACCESS_KEY_ID / REF_NATIVE_STORE_SECRET_ACCESS_KEY or a named "
-            "REF_NATIVE_STORE_PROFILE; or set REF_NATIVE_STORE_URL to a local file:// path for "
-            f"development: {exc}"
-        )
-        raise typer.Exit(code=1) from exc
-
-    # Preflight the store (credentials / bucket reachability) before running any diagnostics,
-    # so a misconfiguration fails fast instead of after the (slow) execution.
-    try:
-        store.preflight()
-    except NativeStoreUnavailableError as exc:
-        logger.error(f"Cannot mint: {exc}")
-        raise typer.Exit(code=1) from exc
-
-    registry = ProviderRegistry.build_from_config(config, db)
-    cases = list(_iter_test_cases(registry, provider=provider, diagnostic=diagnostic, test_case=test_case))
-    if not cases:
-        logger.warning(f"No test cases found for provider {provider!r}")
-        raise typer.Exit(code=0)
-
-    if dry_run:
-        # The store preflight has already passed at this point; report scope and stop before
-        # running any diagnostics or uploading anything.
-        console.print(f"[cyan]Dry run — would mint {len(cases)} test case(s):[/cyan]")
-        for diag, tc in cases:
-            console.print(f"  - {provider}/{diag.slug}/{tc.name}")
-        console.print("[cyan]Store preflight passed; nothing was run or uploaded.[/cyan]")
-        return
-
-    minted = 0
-    failures: list[str] = []
-
-    for diag, tc in cases:
-        case_id = f"{provider}/{diag.slug}/{tc.name}"
-        paths = TestCasePaths.from_diagnostic(diag, tc.name)
-        if paths is None:
-            logger.warning(f"Could not determine test case directory for {case_id}")
-            continue
-        if not paths.catalog.exists():
-            logger.error(f"No catalog file for {case_id}; run `ref test-cases fetch` first")
-            failures.append(case_id)
-            continue
-
-        datasets = load_datasets_from_yaml(paths.catalog)
-        runner = TestCaseRunner(config=config, datasets=datasets)
-        try:
-            result = runner.run(diag, tc.name, None, clean=True)
-        except Exception as exc:
-            logger.error(f"{case_id}: execution failed during mint: {exc}")
-            failures.append(case_id)
-            continue
-        if not result.successful:
-            logger.error(f"{case_id}: execution was not successful")
-            failures.append(case_id)
-            continue
-
-        defn = result.definition
-        output_dir = defn.output_directory
-        fragment = defn.output_fragment()
-        scratch_root = output_dir.parent
-
-        # Any existing results are wiped to make sure we have a clean slate
-        paths.create()
-        if paths.regression.exists():
-            shutil.rmtree(paths.regression)
-        paths.regression.mkdir(parents=True, exist_ok=True)
-
-        with tempfile.TemporaryDirectory() as results_base:
-            results_dir = Path(results_base)
-            committed_digests, native = capture_execution(
-                scratch_root,
-                results_dir,
-                fragment,
-                result,
-                regression_dir=paths.regression,
-                output_dir=output_dir,
-                test_data_dir=paths.test_data_dir,
-            )
-
-            base_dir = results_dir / fragment
-            mismatch = False
-            for relpath, entry in native.items():
-                digest = store.put(base_dir / relpath)
-                if digest != entry.sha256:
-                    logger.error(
-                        f"{case_id}: digest mismatch for {relpath} (store={digest}, captured={entry.sha256})"
-                    )
-                    mismatch = True
-            if mismatch:
-                failures.append(case_id)
-                continue
-
-        # Author the committed manifest: native block written ONLY here.
-        if paths.manifest.exists():
-            previous = Manifest.load(paths.manifest)
-            version = previous.test_case_version + 1 if bump_version else previous.test_case_version
-        else:
-            version = 1
-        _write_test_case_manifest(
-            paths,
-            test_case_version=version,
-            committed=committed_digests,
-            native=native,
-        )
-
-        minted += 1
-        logger.info(
-            f"Minted native baseline: {case_id} "
-            f"({len(native)} native file(s), {len(committed_digests)} committed file(s), "
-            f"test_case_version={version})"
-        )
-
-    console.print()
-    if failures:
-        console.print(f"[yellow]Mint: {minted} minted, {len(failures)} failed[/yellow]")
-        console.print("[red]Failed mints:[/red]")
-        for case in failures:
-            console.print(f"  - {case}")
-        raise typer.Exit(code=1)
-    console.print(f"[green]Minted {minted} native baseline(s)[/green]")
-
-
-@app.command(name="check-store")
-def check_store(
-    ctx: typer.Context,
-) -> None:
-    """
-    Check connectivity and credentials for the writable native baseline store.
-
-    Builds the writable store from the configuration and preflights it (an authenticated
-    no-op probe) without running any diagnostics or uploading anything. Use this to confirm a
-    mint will work — that the credentials (REF_NATIVE_STORE_PROFILE or the access-key env
-    vars) and the bucket are correct — before a slow mint run.
-
-    Examples
-    --------
-        ref test-cases check-store
-        REF_NATIVE_STORE_PROFILE=my-profile ref test-cases check-store
-    """
-    from climate_ref_core.regression.store import NativeStoreUnavailableError, build_native_store
-
-    config: Config = ctx.obj.config
-    console: Console = ctx.obj.console
-
-    try:
-        store = build_native_store(config.native_store, writable=True)
-    except (NotImplementedError, ValueError) as exc:
-        logger.error(
-            "Native store is not configured for writing. For the remote (R2) store set "
-            "REF_NATIVE_STORE_S3_ENDPOINT_URL and REF_NATIVE_STORE_BUCKET, and authenticate via "
-            "REF_NATIVE_STORE_ACCESS_KEY_ID / REF_NATIVE_STORE_SECRET_ACCESS_KEY or a named "
-            f"REF_NATIVE_STORE_PROFILE; or set REF_NATIVE_STORE_URL to a local file:// path: {exc}"
-        )
-        raise typer.Exit(code=1) from exc
-
-    try:
-        store.preflight()
-    except NativeStoreUnavailableError as exc:
-        logger.error(str(exc))
-        raise typer.Exit(code=1) from exc
-
-    console.print("[green]Native store OK:[/green] credentials accepted and the store is reachable.")
-
-
-def _provider_source_root(diag: Diagnostic, repo_root: Path) -> str | None:
-    """
-    Return the diagnostic's provider package source directory, relative to the repo root.
-
-    Used to decide whether a changed file touches the diagnostic's extraction code.
-    The returned path is POSIX-style so it can be compared against
-    ``git diff --name-only`` output.
-
-    Parameters
-    ----------
-    diag
-        The diagnostic whose provider source directory is wanted.
-    repo_root
-        The repository working-tree root.
-
-    Returns
-    -------
-    :
-        The provider package source directory relative to ``repo_root``, or ``None``
-        if it cannot be located or lies outside the repository.
-    """
-    import importlib.util
-
-    top_package = type(diag).__module__.split(".")[0]
-    try:
-        spec = importlib.util.find_spec(top_package)
-    except (ImportError, ValueError):
-        return None
-    if spec is None or not spec.submodule_search_locations:
-        return None
-    package_dir = Path(next(iter(spec.submodule_search_locations))).resolve()
-    try:
-        return package_dir.relative_to(repo_root.resolve()).as_posix()
-    except ValueError:
-        return None
-
-
-def _core_extraction_roots(repo_root: Path) -> list[str]:
-    """
-    Return the core paths whose change affects replay/execute for every test case.
-
-    ``build_execution_result`` (the function replay/execute re-run) depends on more
-    than the regression package: it builds and reads CMEC bundles via
-    :mod:`climate_ref_core.pycmec`, persists curated outputs via
-    :mod:`climate_ref_core.output_files`, and is dispatched through
-    :mod:`climate_ref_core.diagnostics`. A change under any of these can alter the
-    regenerated bundle, so all of them count as an extraction change.
-
-    Detection is deliberately coarse and errs toward REPLAY (cheap, credential-free):
-    a false positive only triggers an unnecessary replay, never a missed one.
-    Roots are derived from the installed package location (rather than hardcoded
-    paths) so they survive a package move; any root outside the repository
-    (e.g. an installed wheel) is dropped.
-
-    Parameters
-    ----------
-    repo_root
-        The repository working-tree root.
-
-    Returns
-    -------
-    :
-        Repo-relative POSIX paths for the core extraction surfaces that lie inside the repo.
-    """
-    import climate_ref_core
-
-    core_dir = Path(climate_ref_core.__file__).resolve().parent
-    repo_root_resolved = repo_root.resolve()
-    candidates = [
-        core_dir / "regression",
-        core_dir / "pycmec",
-        core_dir / "output_files.py",
-        core_dir / "diagnostics.py",
-    ]
-    roots: list[str] = []
-    for candidate in candidates:
-        try:
-            roots.append(candidate.relative_to(repo_root_resolved).as_posix())
-        except ValueError:
-            continue
-    return roots
-
-
-@app.command(name="ci-gate")
-def ci_gate(  # noqa: PLR0912, PLR0915
-    ctx: typer.Context,
-    base: Annotated[
-        str,
-        typer.Option(help="Git ref to compare against (the PR base branch)"),
-    ] = "origin/main",
-    provider: Annotated[
-        str | None,
-        typer.Option(help="Limit the gate to a single provider slug"),
-    ] = None,
-    diagnostic: Annotated[
-        str | None,
-        typer.Option(help="Limit the gate to a single diagnostic slug"),
-    ] = None,
-    test_case: Annotated[
-        str | None,
-        typer.Option(help="Limit the gate to a single test case name"),
-    ] = None,
-    output_json: Annotated[
-        bool,
-        typer.Option("--json", help="Emit the per-case decisions as JSON on stdout"),
-    ] = False,
-) -> None:
-    """
-    Decide how CI should verify each test case's regression baseline.
-
-    Compares each committed ``manifest.json`` to its counterpart on the base branch
-    and reports the action CI should take per case: ``replay`` (cheap, against the
-    cached native baseline), ``execute`` (full re-run, when ``test_case_version`` was
-    bumped), ``skip`` (nothing relevant changed), or ``fail`` (an unauthorised
-    baseline change). Exits non-zero if any case is gated ``fail``.
-
-    The ``--json`` output is intended for CI to dispatch ``replay``/``run`` jobs.
-
-    Examples
-    --------
-        ref test-cases ci-gate                       # Gate all cases against origin/main
-        ref test-cases ci-gate --base origin/develop
-        ref test-cases ci-gate --provider example --json
-    """
-    import json as _json
-
-    from git import GitCommandError
-
-    from climate_ref.provider_registry import ProviderRegistry
-    from climate_ref_core.regression.gate import Action, decide_coupling, paths_under
-    from climate_ref_core.regression.manifest import Manifest, compute_committed_digests
-    from climate_ref_core.testing import TestCasePaths, get_catalog_hash
-
-    config: Config = ctx.obj.config
-    db = ctx.obj.database
-    console: Console = ctx.obj.console
-
-    repo = get_repo_for_path(Path.cwd())
-    if repo is None or repo.working_dir is None:
-        logger.error("ci-gate must be run inside a git repository")
-        raise typer.Exit(code=1)
-    repo_root = Path(repo.working_dir)
-
-    # Resolve the set of files changed on this branch relative to the base ref.
-    # `base...HEAD` diffs against the merge-base, so unrelated base-branch churn
-    # is excluded.
-    try:
-        diff_output = repo.git.diff("--name-only", f"{base}...HEAD")
-    except GitCommandError as exc:
-        logger.error(f"Could not diff against base ref {base!r}: {exc}")
-        raise typer.Exit(code=1) from exc
-    changed_files = [line.strip() for line in diff_output.splitlines() if line.strip()]
-
-    # The core machinery behind build_execution_result affects every replay/execute,
-    # so a change there counts as an extraction change for all cases. Extraction-change
-    # detection is deliberately coarse: any change under a diagnostic's provider package
-    # (see `_provider_source_root`) or under the core extraction surfaces counts for
-    # every case in that provider. This errs toward REPLAY (cheap, credential-free),
-    # never away from it.
-    core_changed = paths_under(changed_files, _core_extraction_roots(repo_root))
-
-    # Hoisted once: repo_root.resolve() is filesystem-touching, and a provider's source
-    # root is identical for every case in that provider, so memoise it per provider slug
-    # rather than recomputing find_spec on each case.
-    repo_root_resolved = repo_root.resolve()
-    source_root_cache: dict[str, str | None] = {}
-
-    registry = ProviderRegistry.build_from_config(config, db)
-
-    decisions: list[dict[str, str]] = []
-    has_failure = False
-
-    def record(case: str, action: Action, reason: str) -> None:
-        nonlocal has_failure
-        if action is Action.FAIL:
-            has_failure = True
-        decisions.append({"case": case, "action": action.value, "reason": reason})
-
-    for diag, tc in _iter_test_cases(registry, provider=provider, diagnostic=diagnostic, test_case=test_case):
-        case_id = f"{diag.provider.slug}/{diag.slug}/{tc.name}"
-        paths = TestCasePaths.from_diagnostic(diag, tc.name)
-
-        # A corrupt manifest authored in this change is a hard failure for that case,
-        # not a crash for the whole gate.
-        manifest: Manifest | None = None
-        if paths is not None and paths.manifest.exists():
-            try:
-                manifest = Manifest.load(paths.manifest)
-            except ValueError as exc:
-                logger.error(f"{case_id}: invalid manifest.json: {exc}")
-                record(case_id, Action.FAIL, f"invalid manifest.json: {exc}")
-                continue
-
-        base_manifest: Manifest | None = None
-        if paths is not None:
-            try:
-                rel_manifest = paths.manifest.resolve().relative_to(repo_root_resolved).as_posix()
-            except ValueError:
-                rel_manifest = None
-            if rel_manifest is not None:
-                try:
-                    base_text = repo.git.show(f"{base}:{rel_manifest}")
-                except GitCommandError:
-                    base_manifest = None
-                else:
-                    # A corrupt manifest on the base branch can't be compared against;
-                    # fall back to seeding (REPLAY) rather than aborting the gate.
-                    try:
-                        base_manifest = Manifest.loads(base_text, source=f"{base}:{rel_manifest}")
-                    except ValueError as exc:
-                        logger.warning(
-                            f"{case_id}: base manifest at {base}:{rel_manifest} is invalid "
-                            f"({exc}); treating as newly added"
-                        )
-                        base_manifest = None
-
-        provider_slug = diag.provider.slug
-        if provider_slug not in source_root_cache:
-            source_root_cache[provider_slug] = _provider_source_root(diag, repo_root)
-        source_root = source_root_cache[provider_slug]
-        extraction_roots = [r for r in (source_root,) if r]
-        extraction_changed = core_changed or paths_under(changed_files, extraction_roots)
-
-        # Verify the committed bundle on disk still matches the manifest digests.
-        # A drift (edited/added/removed committed file without regenerating the
-        # manifest) must fail closed rather than slip through as SKIP.
-        committed_integrity_ok = True
-        # Verify the input catalog still matches the manifest's recorded hash. A catalog
-        # edit without regenerating the baseline leaves it silently stale; fail closed.
-        # Legacy manifests without a catalog_hash have nothing to compare, so stay OK.
-        catalog_integrity_ok = True
-        if manifest is not None and paths is not None:
-            committed_integrity_ok = compute_committed_digests(paths.regression) == manifest.committed
-            if manifest.catalog_hash is not None:
-                catalog_integrity_ok = get_catalog_hash(paths.catalog) == manifest.catalog_hash
-
-        decision = decide_coupling(
-            manifest,
-            base_manifest,
-            extraction_changed=extraction_changed,
-            committed_integrity_ok=committed_integrity_ok,
-            catalog_integrity_ok=catalog_integrity_ok,
-        )
-        record(case_id, decision.action, decision.reason)
-
-    if output_json:
-        console.print_json(_json.dumps(decisions))
-    else:
-        table = Table(title=f"CI coupling gate (base: {base})")
-        table.add_column("Test case", style="cyan", no_wrap=True)
-        table.add_column("Action")
-        table.add_column("Reason")
-        style_for = {
-            Action.FAIL.value: "red",
-            Action.EXECUTE.value: "yellow",
-            Action.REPLAY.value: "green",
-            Action.SKIP.value: "dim",
-        }
-        for entry in decisions:
-            style = style_for[entry["action"]]
-            table.add_row(entry["case"], f"[{style}]{entry['action']}[/{style}]", entry["reason"])
-        console.print(table)
-
-    if has_failure:
-        raise typer.Exit(code=1)
diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases/__init__.py b/packages/climate-ref/src/climate_ref/cli/test_cases/__init__.py
new file mode 100644
index 000000000..06d14cdde
--- /dev/null
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases/__init__.py
@@ -0,0 +1,38 @@
+"""
+Test management commands for diagnostic development.
+
+These commands are intended for diagnostic and require
+a source checkout of the project with test data directories available.
+
+The command group is split across modules by concern:
+
+- :mod:`~climate_ref.cli.test_cases.discovery` -- ``fetch`` / ``list``
+- :mod:`~climate_ref.cli.test_cases.run` -- ``run``
+- :mod:`~climate_ref.cli.test_cases.baselines` -- ``replay`` / ``mint`` / ``build``
+- :mod:`~climate_ref.cli.test_cases.store` -- ``sync`` / ``check-store``
+- :mod:`~climate_ref.cli.test_cases.ci_gate` -- ``ci-gate``
+"""
+
+from importlib import import_module
+
+from climate_ref.cli.test_cases._app import app
+from climate_ref.cli.test_cases._catalog import (
+    _build_catalog,
+    _fetch_and_build_catalog,
+    _solve_test_case,
+)
+from climate_ref.cli.test_cases._common import _iter_test_cases
+
+# Import each command module for its registration side effect on ``app``.
+# The sequence below is the order the verbs appear in ``ref test-cases --help``
+# a dynamic import keeps it explicit, where a plain ``import`` block would be alphabetised by ruff.
+for _command_module in ("discovery", "run", "baselines", "store", "ci_gate"):
+    import_module(f"{__name__}.{_command_module}")
+
+__all__ = [
+    "_build_catalog",
+    "_fetch_and_build_catalog",
+    "_iter_test_cases",
+    "_solve_test_case",
+    "app",
+]
diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases/_app.py b/packages/climate-ref/src/climate_ref/cli/test_cases/_app.py
new file mode 100644
index 000000000..f2da11350
--- /dev/null
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases/_app.py
@@ -0,0 +1,13 @@
+"""
+The Typer application backing the ``ref test-cases`` command group.
+"""
+
+import typer
+
+app = typer.Typer(
+    help=(
+        "Test data management commands for diagnostic development.\n\n"
+        "These commands are intended for diagnostic developers and require "
+        "a source checkout of the project with test data directories available."
+    )
+)
diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases/_catalog.py b/packages/climate-ref/src/climate_ref/cli/test_cases/_catalog.py
new file mode 100644
index 000000000..0dca4ead3
--- /dev/null
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases/_catalog.py
@@ -0,0 +1,178 @@
+"""
+Catalog construction helpers shared by the ``fetch`` and ``run`` commands.
+
+These turn a diagnostic's test-data requests into a solved
+:class:`~climate_ref_core.datasets.ExecutionDatasetCollection` and persist the
+input catalog YAML next to the test case.
+"""
+
+# ``from __future__ import annotations`` keeps the heavy signature types
+# (pandas, dataset adapters, diagnostics) under ``TYPE_CHECKING`` so importing
+# this module -- which happens on every ``ref`` invocation -- stays cheap.
+from __future__ import annotations
+
+from pathlib import Path
+from typing import TYPE_CHECKING
+
+from loguru import logger
+
+from climate_ref_core.exceptions import DatasetResolutionError
+
+if TYPE_CHECKING:
+    import pandas as pd
+
+    from climate_ref.datasets import DatasetAdapter
+    from climate_ref_core.datasets import ExecutionDatasetCollection, SourceDatasetType
+    from climate_ref_core.diagnostics import Diagnostic
+    from climate_ref_core.testing import TestCase
+
+
+def _build_catalog(dataset_adapter: DatasetAdapter, file_paths: list[Path]) -> pd.DataFrame:
+    """
+    Parse a list of datasets using a dataset adapter
+
+    Parameters
+    ----------
+    file_paths
+        List of files to build a catalog from
+
+    Returns
+    -------
+    pd.DataFrame
+        DataFrame catalog of datasets with metadata and paths
+    """
+    import pandas as pd
+
+    # Collect unique parent directories since the adapter scans directories.
+    # Sort for deterministic traversal/catalog order so baseline selection
+    # (``_solve_test_case`` takes ``executions[0]``) is reproducible.
+    parent_dirs = sorted({fp.parent for fp in file_paths}, key=lambda p: p.as_posix())
+
+    catalog_dfs = []
+    for parent_dir in parent_dirs:
+        try:
+            df = dataset_adapter.find_local_datasets(parent_dir)
+
+            # Filter to only include the files we fetched
+            fetched_files = {str(fp) for fp in file_paths}
+            df = df[df["path"].isin(fetched_files)]
+            if df.empty:
+                logger.warning(f"No matching files found in catalog for {parent_dir}")
+            catalog_dfs.append(df)
+        except Exception as e:
+            raise DatasetResolutionError(f"Failed to parse fetched datasets in {parent_dir}") from e
+
+    if not catalog_dfs:
+        return pd.DataFrame()
+    return pd.concat(catalog_dfs, ignore_index=True)
+
+
+def _solve_test_case(
+    diagnostic: Diagnostic,
+    data_catalog: dict[SourceDatasetType, pd.DataFrame],
+) -> ExecutionDatasetCollection:
+    """
+    Solve for test case datasets by applying the diagnostic's data requirements.
+
+    Runs the solver to determine which datasets from the catalog
+    satisfy the diagnostic's requirements.
+    """
+    from climate_ref.solver import solve_executions
+
+    executions = list(solve_executions(data_catalog, diagnostic, diagnostic.provider))
+
+    if not executions:
+        raise ValueError(f"No valid executions found for diagnostic {diagnostic.slug}")
+
+    return executions[0].datasets
+
+
+def _fetch_and_build_catalog(
+    diag: Diagnostic,
+    tc: TestCase,
+    *,
+    force: bool = False,
+) -> tuple[ExecutionDatasetCollection, bool]:
+    """
+    Fetch test data and build catalog.
+
+    This function:
+    1. Fetches ESGF data using ESGFFetcher (files stored in intake-esgf cache)
+    2. Uses CMIP6DatasetAdapter to create a data catalog
+    3. Solves for datasets using the diagnostic's data requirements
+    4. Writes catalog YAML to .catalogs/{provider}/{diagnostic}/{test_case}.yaml
+    5. Returns the solved datasets and whether the catalog was written
+
+    By default, the catalog is only written if the content has changed.
+    Use `force=True` to always write.
+
+    Parameters
+    ----------
+    diag
+        The diagnostic to fetch data for
+    tc
+        The test case to fetch data for
+    force
+        If True, always write the catalog even if unchanged
+
+    Returns
+    -------
+    :
+        Tuple of (datasets, catalog_was_written)
+    """
+    from climate_ref.datasets import (
+        CMIP6DatasetAdapter,
+        CMIP7DatasetAdapter,
+        Obs4MIPsDatasetAdapter,
+        PMPClimatologyDatasetAdapter,
+    )
+    from climate_ref_core.datasets import SourceDatasetType
+    from climate_ref_core.esgf import ESGFFetcher
+    from climate_ref_core.testing import TestCasePaths, save_datasets_to_yaml
+
+    fetcher = ESGFFetcher()
+
+    # Fetch all requests - returns DataFrame with metadata + paths
+    combined = fetcher.fetch_for_test_case(tc.requests)
+
+    if combined.empty:
+        raise DatasetResolutionError(
+            f"No datasets found for {diag.provider.slug}/{diag.slug} test case '{tc.name}'"
+        )
+
+    # Group paths by source type and use adapters to build proper catalog
+    data_catalog: dict[SourceDatasetType, pd.DataFrame] = {}
+
+    for source_type, group_df in combined.groupby("source_type"):
+        file_paths = [Path(p) for p in group_df["path"].unique().tolist()]
+
+        if source_type == "CMIP6":
+            data_catalog[SourceDatasetType.CMIP6] = _build_catalog(CMIP6DatasetAdapter(), file_paths)
+
+        elif source_type == "CMIP7":
+            data_catalog[SourceDatasetType.CMIP7] = _build_catalog(CMIP7DatasetAdapter(), file_paths)
+
+        elif source_type == "obs4MIPs":
+            data_catalog[SourceDatasetType.obs4MIPs] = _build_catalog(Obs4MIPsDatasetAdapter(), file_paths)
+
+        elif source_type == "PMPClimatology":
+            data_catalog[SourceDatasetType.PMPClimatology] = _build_catalog(
+                PMPClimatologyDatasetAdapter(), file_paths
+            )
+
+    if not data_catalog:
+        raise DatasetResolutionError(
+            f"No datasets found for {diag.provider.slug}/{diag.slug} test case '{tc.name}'"
+        )
+
+    # Solve for datasets
+    datasets = _solve_test_case(diag, data_catalog)
+
+    # Write catalog YAML to package-local test case directory
+    catalog_written = False
+    paths = TestCasePaths.from_diagnostic(diag, tc.name)
+    if paths:
+        paths.create()
+        catalog_written = save_datasets_to_yaml(datasets, paths.catalog, force=force)
+
+    return datasets, catalog_written
diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases/_common.py b/packages/climate-ref/src/climate_ref/cli/test_cases/_common.py
new file mode 100644
index 000000000..8dbddb538
--- /dev/null
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases/_common.py
@@ -0,0 +1,171 @@
+"""
+Helpers shared across several ``ref test-cases`` commands.
+
+``_iter_test_cases`` enumerates ``(diagnostic, test_case)`` pairs from the
+provider registry (used by ``sync`` / ``replay`` / ``mint`` / ``build`` /
+``ci-gate``) and ``_write_test_case_manifest`` authors the committed
+``manifest.json`` (used by ``run`` / ``mint`` / ``build``).
+"""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+import typer
+from loguru import logger
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+
+    from climate_ref.provider_registry import ProviderRegistry
+    from climate_ref_core.diagnostics import Diagnostic
+    from climate_ref_core.regression.manifest import Manifest, NativeEntry
+    from climate_ref_core.testing import TestCase, TestCasePaths
+
+
+def _validate_provider_in_registry(registry: ProviderRegistry, provider: str | None) -> None:
+    """
+    Validate that ``provider`` (if given) is configured in the registry.
+
+    Logs a helpful error listing the available providers and exits with code 1
+    when the requested provider is not present. A falsy ``provider`` is a no-op.
+    """
+    if not provider:
+        return
+    available_providers = [p.slug for p in registry.providers]
+    if provider not in available_providers:
+        logger.error(f"Provider '{provider}' is not configured")
+        if available_providers:
+            logger.error(f"Available providers: {', '.join(sorted(available_providers))}")
+        else:
+            logger.error("No providers are configured. Check your configuration file.")
+        logger.error("To add a provider, update your config file or set REF_DIAGNOSTIC_PROVIDERS")
+        raise typer.Exit(code=1)
+
+
+def _validate_requested_filters(
+    registry: ProviderRegistry,
+    *,
+    provider: str | None = None,
+    diagnostic: str | None = None,
+    test_case: str | None = None,
+) -> None:
+    """
+    Fail fast when an explicit diagnostic or test-case selector matches nothing.
+
+    Empty selections caused by skip flags (for example ``--only-missing``) are not handled here.
+    Callers should decide whether those are successful no-ops.
+    This helper only guards likely typos in user-supplied selectors.
+    """
+    if not diagnostic and not test_case:
+        return
+
+    provider_instances = [p for p in registry.providers if provider is None or p.slug == provider]
+    diagnostics = [
+        diag for provider_instance in provider_instances for diag in provider_instance.diagnostics()
+    ]
+
+    if diagnostic:
+        matching_diagnostics = [diag for diag in diagnostics if diag.slug == diagnostic]
+        if not matching_diagnostics:
+            scope = f" for provider '{provider}'" if provider else ""
+            logger.error(f"Diagnostic '{diagnostic}' was not found{scope}")
+            available = sorted({diag.slug for diag in diagnostics})
+            if available:
+                logger.error(f"Available diagnostics: {', '.join(available)}")
+            raise typer.Exit(code=1)
+        diagnostics = matching_diagnostics
+
+    if test_case:
+        available_cases = sorted(
+            {
+                tc.name
+                for diag in diagnostics
+                if diag.test_data_spec is not None
+                for tc in diag.test_data_spec.test_cases
+            }
+        )
+        if test_case not in available_cases:
+            scope_parts = []
+            if provider:
+                scope_parts.append(f"provider '{provider}'")
+            if diagnostic:
+                scope_parts.append(f"diagnostic '{diagnostic}'")
+            scope = f" for {' and '.join(scope_parts)}" if scope_parts else ""
+            logger.error(f"Test case '{test_case}' was not found{scope}")
+            if available_cases:
+                logger.error(f"Available test cases: {', '.join(available_cases)}")
+            else:
+                logger.error("No test cases are defined for the selected diagnostics")
+            raise typer.Exit(code=1)
+
+
+def _write_test_case_manifest(
+    paths: TestCasePaths,
+    *,
+    test_case_version: int,
+    committed: dict[str, str],
+    native: dict[str, NativeEntry],
+    schema: int | None = None,
+) -> Manifest:
+    """
+    Construct and write a test case ``manifest.json``, recording the input catalog hash.
+
+    Shared by ``run`` (which preserves the existing version and native block) and
+    ``mint`` (which authors the native block and may bump the version); the two
+    callers differ only in the ``test_case_version`` and ``native`` they supply.
+    The ``catalog_hash`` is always (re)derived from the current ``catalog.yaml`` so
+    the manifest stays coupled to the inputs that produced the committed bundle.
+    """
+    from climate_ref_core.regression.manifest import SCHEMA_VERSION, Manifest
+    from climate_ref_core.testing import get_catalog_hash
+
+    manifest = Manifest(
+        schema=SCHEMA_VERSION if schema is None else schema,
+        test_case_version=test_case_version,
+        committed=dict(committed),
+        native=native,
+        catalog_hash=get_catalog_hash(paths.catalog),
+    )
+    manifest.dump(paths.manifest)
+    return manifest
+
+
+def _iter_test_cases(
+    registry: ProviderRegistry,
+    *,
+    provider: str | None = None,
+    diagnostic: str | None = None,
+    test_case: str | None = None,
+) -> Iterator[tuple[Diagnostic, TestCase]]:
+    """
+    Yield ``(diagnostic, test_case)`` pairs from the registry, applying filters.
+
+    Parameters
+    ----------
+    registry
+        The provider registry to enumerate.
+    provider
+        Optional provider slug filter.
+    diagnostic
+        Optional diagnostic slug filter.
+    test_case
+        Optional test case name filter.
+
+    Yields
+    ------
+    :
+        Matching ``(diagnostic, test_case)`` pairs.
+    """
+    for provider_instance in registry.providers:
+        if provider and provider_instance.slug != provider:
+            continue
+        for diag in provider_instance.diagnostics():
+            if diagnostic and diag.slug != diagnostic:
+                continue
+            if diag.test_data_spec is None:
+                continue
+            for tc in diag.test_data_spec.test_cases:
+                if test_case and tc.name != test_case:
+                    continue
+                yield diag, tc
diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases/_stages.py b/packages/climate-ref/src/climate_ref/cli/test_cases/_stages.py
new file mode 100644
index 000000000..016f07737
--- /dev/null
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases/_stages.py
@@ -0,0 +1,327 @@
+"""
+Composable stages behind the ``ref test-cases`` verbs.
+
+The verbs ``run`` / ``mint`` / ``replay`` / ``build`` are thin compositions over a small
+set of stages:
+
+- **execute** -- run the diagnostic and copy its curated native set into a slot
+- **materialise** -- fetch a committed manifest's native blobs from the store into a slot
+- **build** -- assemble the committed bundle from the native in a slot
+- **upload** -- push changed-digest native blobs to the store
+- **compare** -- diff a slot's rebuilt bundle against the tracked committed baseline
+
+Native produced by a source stage (execute or materialise) lands in a gitignored *output slot*
+(``<case>/output/<label>/``), flat at manifest-relative paths,
+with a ``regression/`` subdirectory holding the rebuilt committed bundle and a ``.source.json`` stamp.
+``latest`` (the default label) is overwritten on every run.
+A custom named slot persists so two runs can be diffed (``--label before`` vs ``--label after``).
+See ``docs/background/regression-baselines.md``.
+"""
+
+from __future__ import annotations
+
+import json
+import shutil
+from datetime import UTC, datetime
+from pathlib import Path
+from typing import TYPE_CHECKING, NamedTuple
+
+from loguru import logger
+
+from climate_ref_core.diagnostics import ExecutionDefinition
+from climate_ref_core.output_files import copy_execution_outputs, from_placeholders
+from climate_ref_core.regression import (
+    COMMITTED_BUNDLE_FILES,
+    Tolerance,
+    assert_bundle_regression,
+    materialise_native,
+)
+from climate_ref_core.regression.capture import build_native_snapshot, write_committed_bundle
+
+if TYPE_CHECKING:
+    from collections.abc import Iterable
+
+    from climate_ref.config import Config
+    from climate_ref_core.datasets import ExecutionDatasetCollection
+    from climate_ref_core.diagnostics import Diagnostic, ExecutionResult
+    from climate_ref_core.regression.manifest import Manifest, NativeEntry
+    from climate_ref_core.regression.store import NativeStore
+    from climate_ref_core.testing import TestCase, TestCasePaths
+
+SLOT_REGRESSION_DIRNAME = "regression"
+SLOT_SOURCE_STAMP = ".source.json"
+
+
+class StageError(Exception):
+    """A test-case stage failed in a way the caller should report and skip."""
+
+
+class SourceOutputs(NamedTuple):
+    """
+    The native a source stage placed in a slot, plus what ``build`` needs to consume it.
+
+    ``bundle_output_dir`` is the absolute output directory the rebuilt bundle's text
+    contents reference -- the real execution directory for ``execute`` (the copied bundle
+    still points there), or the slot itself for ``materialise`` (``build_execution_result``
+    rewrote the bundle into the slot).
+    """
+
+    result: ExecutionResult
+    bundle_output_dir: Path
+
+
+def prepare_slot(paths: TestCasePaths, label: str) -> Path:
+    """
+    Wipe and recreate ``output/<label>/`` and return the slot base directory.
+
+    Used by the source stages (execute / materialise), which repopulate the native set.
+    ``build`` does not call this -- it reuses the native already in the slot.
+    """
+    slot = paths.output_slot(label)
+    if slot.exists():
+        shutil.rmtree(slot)
+    slot.mkdir(parents=True, exist_ok=True)
+    return slot
+
+
+def slot_native_relpaths(slot: Path) -> list[Path]:
+    """
+    Return the native files in a slot -- everything except the rebuilt bundle and the stamp.
+
+    A slot is populated only by a source stage with the curated output set, so this is
+    exactly the curated native set (it excludes the ``regression/`` subdirectory written
+    by ``build`` and the ``.source.json`` stamp).
+    """
+    relpaths: list[Path] = []
+    for path in sorted(slot.rglob("*")):
+        if not path.is_file():
+            continue
+        rel = path.relative_to(slot)
+        if rel.parts[0] == SLOT_REGRESSION_DIRNAME or rel.name == SLOT_SOURCE_STAMP:
+            continue
+        relpaths.append(rel)
+    return relpaths
+
+
+def stage_execute(  # noqa: PLR0913
+    *,
+    config: Config,
+    diag: Diagnostic,
+    tc: TestCase,
+    datasets: ExecutionDatasetCollection,
+    slot: Path,
+    execution_dir: Path | None,
+    clean: bool,
+) -> SourceOutputs:
+    """Run the diagnostic and copy its curated native set (flat) into ``slot``."""
+    from climate_ref.testing import TestCaseRunner
+
+    runner = TestCaseRunner(config=config, datasets=datasets)
+    result = runner.run(diag, tc.name, execution_dir, clean=clean)
+    if not result.successful:
+        raise StageError("execution was not successful")
+
+    real_output_dir = result.definition.output_directory
+    # Copy the curated subset from the real execution dir into the slot, flat (fragment=".").
+    # The copied bundle text still references real_output_dir, so build substitutes that.
+    copy_execution_outputs(real_output_dir, slot, ".", result)
+    return SourceOutputs(result=result, bundle_output_dir=real_output_dir)
+
+
+def stage_materialise(  # noqa: PLR0913
+    *,
+    diag: Diagnostic,
+    tc: TestCase,
+    paths: TestCasePaths,
+    manifest: Manifest,
+    store: NativeStore,
+    slot: Path,
+) -> SourceOutputs:
+    """Fetch the manifest's native blobs into ``slot`` and rebuild the result from them."""
+    materialise_native(manifest.native, store, slot)
+    return stage_rebuild_from_slot(diag=diag, tc=tc, paths=paths, slot=slot)
+
+
+def stage_rebuild_from_slot(
+    *,
+    diag: Diagnostic,
+    tc: TestCase,
+    paths: TestCasePaths,
+    slot: Path,
+) -> SourceOutputs:
+    """
+    Rebuild the execution result from native already present in ``slot``.
+
+    Hydrates portable placeholders to concrete paths, then re-runs ``build_execution_result``
+    so the rebuilt bundle is written into the slot (referencing the slot). No execution and
+    no store access -- this is the shared core of ``replay`` (after a fetch) and ``build``.
+    """
+    from climate_ref_core.testing import load_datasets_from_yaml
+
+    from_placeholders(slot, output_dir=slot, test_data_dir=paths.test_data_dir)
+    datasets = load_datasets_from_yaml(paths.catalog)
+    definition = ExecutionDefinition(
+        diagnostic=diag,
+        key=f"test-{tc.name}",
+        datasets=datasets,
+        output_directory=slot,
+        root_directory=slot.parent,
+    )
+    result = diag.build_execution_result(definition)
+    return SourceOutputs(result=result, bundle_output_dir=slot)
+
+
+def stage_build(*, slot: Path, source: SourceOutputs, paths: TestCasePaths) -> dict[str, str]:
+    """
+    Assemble the committed bundle into the slot's ``regression/`` directory.
+
+    Returns the committed digests ``{filename: sha256}`` of the sanitised, float-quantised
+    bytes just written -- suitable for ``Manifest.committed`` and identical to what would be
+    promoted to the tracked baseline.
+    """
+    return write_committed_bundle(
+        slot,
+        slot / SLOT_REGRESSION_DIRNAME,
+        output_dir=source.bundle_output_dir,
+        test_data_dir=paths.test_data_dir,
+    )
+
+
+def snapshot_native(slot: Path) -> dict[str, NativeEntry]:
+    """Record a sha256 + size snapshot of the slot's native set (for the manifest / upload)."""
+    return build_native_snapshot(slot, slot_native_relpaths(slot))
+
+
+def promote_to_baseline(slot: Path, paths: TestCasePaths) -> None:
+    """
+    Copy a slot's rebuilt committed bundle into the tracked ``regression/`` baseline.
+
+    The slot bundle is already sanitised and float-quantised, so the promoted bytes (and
+    therefore their digests) match what ``stage_build`` returned.
+    """
+    slot_regression = slot / SLOT_REGRESSION_DIRNAME
+    if paths.regression.exists():
+        shutil.rmtree(paths.regression)
+    paths.regression.mkdir(parents=True, exist_ok=True)
+    for filename in COMMITTED_BUNDLE_FILES:
+        source = slot_regression / filename
+        if source.exists():
+            shutil.copy(source, paths.regression / filename)
+
+
+def stage_upload(
+    *,
+    slot: Path,
+    native: dict[str, NativeEntry],
+    store: NativeStore,
+    previous: dict[str, NativeEntry],
+) -> list[str]:
+    """
+    Upload native blobs to the store, skipping any whose digest is unchanged and present.
+
+    A blob is uploaded only when its digest differs from the previous manifest entry or the
+    store does not already serve it, so a re-mint after a bundle-only change (e.g.
+    ``mint --from-replay``) uploads nothing. Returns digest-mismatch error messages
+    (empty on success).
+    """
+    errors: list[str] = []
+    uploaded = 0
+    skipped = 0
+    for relpath, entry in native.items():
+        prev = previous.get(relpath)
+        try:
+            if prev is not None and prev.sha256 == entry.sha256 and store.has(entry.sha256):
+                skipped += 1
+                continue
+            digest = store.put(slot / relpath)
+        except Exception as exc:
+            errors.append(f"upload failed for {relpath}: {exc}")
+            continue
+        if digest != entry.sha256:
+            errors.append(f"digest mismatch for {relpath} (store={digest}, captured={entry.sha256})")
+        else:
+            uploaded += 1
+    logger.info(f"Uploaded {uploaded} native blob(s), skipped {skipped} unchanged")
+    return errors
+
+
+def stage_compare(
+    *, slot: Path, paths: TestCasePaths, slug: str, expected: Iterable[str]
+) -> tuple[list[str], list[str]]:
+    """
+    Compare a slot's rebuilt bundle against the tracked committed baseline.
+
+    ``expected`` is the committed bundle's source of truth -- the filenames the manifest
+    records under ``committed``. Every expected file must be present both in the tracked
+    ``regression/`` baseline and in the slot's regenerated bundle, and must match within
+    tolerance; a file missing on either side, or an empty expected set, is a hard failure.
+    Driving the comparison from the manifest (rather than from whatever happens to exist on
+    disk) stops a replay reporting success when the committed baseline is absent or incomplete.
+
+    Both sides are already placeholder-sanitised, so no replacements are needed.
+    Returns ``(failures, compared)`` -- the drift/missing messages and the filenames compared.
+    """
+    slot_regression = slot / SLOT_REGRESSION_DIRNAME
+    expected_files = list(expected)
+    if not expected_files:
+        return ["manifest records no committed bundle to compare against"], []
+
+    failures: list[str] = []
+    compared: list[str] = []
+    for filename in expected_files:
+        baseline = paths.regression / filename
+        regenerated = slot_regression / filename
+        if not baseline.exists():
+            failures.append(f"committed baseline file missing from regression/: {filename}")
+            continue
+        if not regenerated.exists():
+            failures.append(f"rebuilt bundle did not regenerate committed file: {filename}")
+            continue
+        try:
+            assert_bundle_regression(
+                baseline,
+                regenerated,
+                slug=slug,
+                tol=Tolerance(),
+                replacements={},
+            )
+        except AssertionError as exc:
+            failures.append(str(exc))
+        except json.JSONDecodeError as exc:
+            # A committed baseline (or regenerated file) that no longer parses is drift, not a
+            # crash -- report it so replay fails cleanly instead of letting the error escape.
+            failures.append(f"{filename}: committed bundle is not valid JSON ({exc})")
+        else:
+            compared.append(filename)
+    return failures, compared
+
+
+def native_is_stale(fresh: dict[str, NativeEntry], previous: dict[str, NativeEntry]) -> bool:
+    """
+    Return True when a previous (mint-owned) native block exists and differs from the fresh snapshot.
+
+    Used to warn -- not block -- after a committed-bundle regeneration whose underlying native
+    has drifted, so the author knows to re-mint.
+    """
+    if not previous:
+        return False
+    return {k: v.sha256 for k, v in fresh.items()} != {k: v.sha256 for k, v in previous.items()}
+
+
+def write_source_stamp(
+    slot: Path,
+    *,
+    label: str,
+    verb: str,
+    source: str,
+    test_case_version: int,
+) -> None:
+    """Write the slot's ``.source.json`` so it is clear what currently populates the slot."""
+    stamp = {
+        "label": label,
+        "verb": verb,
+        "source": source,
+        "test_case_version": test_case_version,
+        "created": datetime.now(UTC).isoformat(),
+    }
+    (slot / SLOT_SOURCE_STAMP).write_text(json.dumps(stamp, indent=2) + "\n", encoding="utf-8")
diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases/baselines.py b/packages/climate-ref/src/climate_ref/cli/test_cases/baselines.py
new file mode 100644
index 000000000..05db12197
--- /dev/null
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases/baselines.py
@@ -0,0 +1,510 @@
+"""
+The native-baseline lifecycle verbs: ``replay``, ``mint`` and ``build``.
+
+Each is a thin composition over the stages in
+:mod:`climate_ref.cli.test_cases._stages`:
+
+- ``replay`` materialises committed native from the store and checks it rebuilds
+  the committed bundle within tolerance.
+- ``mint`` (re)authors the canonical native baselines and uploads them.
+- ``build`` rebuilds the committed bundle from an existing output slot without
+  re-executing.
+"""
+
+from typing import TYPE_CHECKING, Annotated
+
+import typer
+from loguru import logger
+
+from climate_ref.cli.test_cases._app import app
+from climate_ref.cli.test_cases._common import (
+    _iter_test_cases,
+    _validate_provider_in_registry,
+    _validate_requested_filters,
+    _write_test_case_manifest,
+)
+from climate_ref.cli.test_cases._stages import (
+    StageError,
+    native_is_stale,
+    prepare_slot,
+    promote_to_baseline,
+    slot_native_relpaths,
+    snapshot_native,
+    stage_build,
+    stage_compare,
+    stage_execute,
+    stage_materialise,
+    stage_rebuild_from_slot,
+    stage_upload,
+    write_source_stamp,
+)
+from climate_ref.config import Config
+
+if TYPE_CHECKING:
+    from rich.console import Console
+
+
+@app.command(name="replay")
+def replay_test_case(  # noqa: PLR0912, PLR0915
+    ctx: typer.Context,
+    provider: Annotated[
+        str,
+        typer.Option(help="Provider slug (required, e.g., 'example', 'ilamb')"),
+    ],
+    diagnostic: Annotated[
+        str | None,
+        typer.Option(help="Specific diagnostic slug to replay"),
+    ] = None,
+    test_case: Annotated[
+        str | None,
+        typer.Option(help="Specific test case name to replay"),
+    ] = None,
+    label: Annotated[
+        str,
+        typer.Option(help="Output slot name under output/ (default: latest)"),
+    ] = "latest",
+) -> None:
+    """
+    Replay committed baselines from native blobs and compare to the committed bundle.
+
+    Materialises the committed manifest's native blobs (public, credential-free)
+    into a fresh output directory at their stored relative paths, re-runs ``build_execution_result``,
+    and compares the regenerated committed bundle to the in-repo copy using the tolerant content comparator.
+
+    Exits non-zero on drift.
+
+    Examples
+    --------
+        ref test-cases replay --provider example
+        ref test-cases replay --provider example --diagnostic global-mean-timeseries
+    """
+    from climate_ref.provider_registry import ProviderRegistry
+    from climate_ref_core.regression import Manifest, verify_committed_integrity
+    from climate_ref_core.regression.store import build_native_store
+    from climate_ref_core.testing import TestCasePaths
+
+    config: Config = ctx.obj.config
+    db = ctx.obj.database
+    console: Console = ctx.obj.console
+
+    registry = ProviderRegistry.build_from_config(config, db)
+    _validate_provider_in_registry(registry, provider)
+    _validate_requested_filters(registry, provider=provider, diagnostic=diagnostic, test_case=test_case)
+    store = build_native_store(config.native_store, writable=False)
+
+    cases = list(_iter_test_cases(registry, provider=provider, diagnostic=diagnostic, test_case=test_case))
+    if not cases:
+        logger.warning(f"No test cases found for provider {provider!r}")
+        raise typer.Exit(code=0)
+
+    # When a specific case is named, a missing manifest/catalog is a hard failure.
+    named = bool(diagnostic or test_case)
+
+    successes = 0
+    failures: list[str] = []
+
+    for diag, tc in cases:
+        paths = TestCasePaths.from_diagnostic(diag, tc.name)
+        case_id = f"{provider}/{diag.slug}/{tc.name}"
+        if paths is None:
+            logger.warning(f"Could not determine test case directory for {case_id}")
+            continue
+        if not paths.manifest.exists():
+            message = f"No manifest.json for {case_id}; run `ref test-cases mint` first"
+            if named:
+                logger.error(message)
+                failures.append(case_id)
+            else:
+                logger.warning(message)
+            continue
+        if not paths.catalog.exists():
+            logger.error(f"No catalog file for {case_id}; run `ref test-cases fetch` first")
+            failures.append(case_id)
+            continue
+
+        manifest = Manifest.load(paths.manifest)
+
+        # The byte-exact digest check is advisory that the committed baseline is not bitwise identical.
+        # The tolerant bundle comparison below may still find them equivalent within tolerance.
+        mismatches = verify_committed_integrity(manifest, paths.regression)
+        if mismatches:
+            logger.warning(
+                f"{case_id}: committed baseline differs from the digests recorded in {paths.manifest}"
+            )
+            for mismatch in mismatches:
+                logger.warning(f"  - {mismatch}")
+
+        if not manifest.native:
+            logger.error(
+                f"{case_id}: manifest has no native baselines — not yet minted. "
+                "Run `ref test-cases mint` first."
+            )
+            failures.append(case_id)
+            continue
+
+        slot = prepare_slot(paths, label)
+        try:
+            source = stage_materialise(
+                diag=diag, tc=tc, paths=paths, manifest=manifest, store=store, slot=slot
+            )
+        except Exception as exc:
+            logger.error(f"{case_id}: failed to materialise/rebuild native: {exc}")
+            failures.append(case_id)
+            continue
+
+        stage_build(slot=slot, source=source, paths=paths)
+        cmp_failures, compared = stage_compare(
+            slot=slot, paths=paths, slug=diag.slug, expected=manifest.committed
+        )
+        write_source_stamp(
+            slot,
+            label=label,
+            verb="replay",
+            source="materialise",
+            test_case_version=manifest.test_case_version,
+        )
+        if cmp_failures:
+            logger.error(f"{case_id}: replay drift detected:\n" + "\n".join(cmp_failures))
+            failures.append(case_id)
+            continue
+
+        successes += 1
+        if mismatches:
+            # The byte-level warning above was reconciled by the tolerant comparison.
+            logger.info(
+                f"Replay reconciled committed bundle: {case_id} "
+                f"({len(manifest.native)} native file(s) materialised, "
+                f"{len(compared)} bundle file(s) equivalent within tolerance)"
+            )
+        else:
+            logger.info(
+                f"Replay matched committed bundle: {case_id} "
+                f"({len(manifest.native)} native file(s) materialised, "
+                f"{len(compared)} bundle file(s) compared)"
+            )
+
+    console.print()
+    if failures:
+        console.print(f"[yellow]Replay: {successes} passed, {len(failures)} failed[/yellow]")
+        console.print("[red]Failed replays:[/red]")
+        for case in failures:
+            console.print(f"  - {case}")
+        raise typer.Exit(code=1)
+    console.print(f"[green]All {successes} replay(s) matched the committed bundle[/green]")
+
+
+@app.command(name="mint")
+def mint_native(  # noqa: PLR0912, PLR0913, PLR0915
+    ctx: typer.Context,
+    provider: Annotated[
+        str,
+        typer.Option(help="Provider slug (required, e.g., 'example', 'ilamb')"),
+    ],
+    diagnostic: Annotated[
+        str | None,
+        typer.Option(help="Specific diagnostic slug to mint"),
+    ] = None,
+    test_case: Annotated[
+        str | None,
+        typer.Option(help="Specific test case name to mint"),
+    ] = None,
+    label: Annotated[
+        str,
+        typer.Option(help="Output slot name under output/ (default: latest)"),
+    ] = "latest",
+    from_replay: Annotated[
+        bool,
+        typer.Option(
+            "--from-replay",
+            help="Author from a replay of the stored native instead of re-running the diagnostic",
+        ),
+    ] = False,
+    bump_version: Annotated[
+        bool,
+        typer.Option(help="Increment test_case_version when authoring the manifest"),
+    ] = False,
+    dry_run: Annotated[
+        bool,
+        typer.Option(help="Preflight the store and list what would be minted, without running or uploading"),
+    ] = False,
+) -> None:
+    """
+    Mint canonical native baselines
+
+    Runs each test case, stores its native snapshot in the writable store,
+    and authors the committed ``manifest.json``'s ``native`` block.
+
+    This requires write credentials and is generally run by the CI.
+
+    Examples
+    --------
+        ref test-cases mint --provider example
+        ref test-cases mint --provider example --bump-version
+        ref test-cases mint --provider example --dry-run
+    """
+    from climate_ref.provider_registry import ProviderRegistry
+    from climate_ref_core.regression.manifest import Manifest
+    from climate_ref_core.regression.store import NativeStoreUnavailableError, build_native_store
+    from climate_ref_core.testing import TestCasePaths, load_datasets_from_yaml
+
+    config: Config = ctx.obj.config
+    db = ctx.obj.database
+    console: Console = ctx.obj.console
+
+    registry = ProviderRegistry.build_from_config(config, db)
+    _validate_provider_in_registry(registry, provider)
+    _validate_requested_filters(registry, provider=provider, diagnostic=diagnostic, test_case=test_case)
+    cases = list(_iter_test_cases(registry, provider=provider, diagnostic=diagnostic, test_case=test_case))
+    if not cases:
+        logger.warning(f"No test cases found for provider {provider!r}")
+        raise typer.Exit(code=0)
+
+    try:
+        store = build_native_store(config.native_store, writable=True)
+    except (NotImplementedError, ValueError) as exc:
+        logger.error(
+            "Cannot mint: no writable native store is configured. For the remote (R2) store set "
+            "REF_NATIVE_STORE_S3_ENDPOINT_URL and REF_NATIVE_STORE_BUCKET, and authenticate via "
+            "REF_NATIVE_STORE_ACCESS_KEY_ID / REF_NATIVE_STORE_SECRET_ACCESS_KEY or a named "
+            "REF_NATIVE_STORE_PROFILE; or set REF_NATIVE_STORE_URL to a local file:// path for "
+            f"development: {exc}"
+        )
+        raise typer.Exit(code=1) from exc
+
+    # Preflight the store (credentials / bucket reachability) before running any diagnostics,
+    # so a misconfiguration fails fast instead of after the (slow) execution.
+    try:
+        store.preflight()
+    except NativeStoreUnavailableError as exc:
+        logger.error(f"Cannot mint: {exc}")
+        raise typer.Exit(code=1) from exc
+
+    if dry_run:
+        # The store preflight has already passed at this point; report scope and stop before
+        # running any diagnostics or uploading anything.
+        console.print(f"[cyan]Dry run — would mint {len(cases)} test case(s):[/cyan]")
+        for diag, tc in cases:
+            console.print(f"  - {provider}/{diag.slug}/{tc.name}")
+        console.print("[cyan]Store preflight passed; nothing was run or uploaded.[/cyan]")
+        return
+
+    minted = 0
+    failures: list[str] = []
+
+    for diag, tc in cases:
+        case_id = f"{provider}/{diag.slug}/{tc.name}"
+        paths = TestCasePaths.from_diagnostic(diag, tc.name)
+        if paths is None:
+            logger.warning(f"Could not determine test case directory for {case_id}")
+            continue
+        if not paths.catalog.exists():
+            logger.error(f"No catalog file for {case_id}; run `ref test-cases fetch` first")
+            failures.append(case_id)
+            continue
+
+        paths.create()
+        previous = Manifest.load(paths.manifest) if paths.manifest.exists() else None
+        # Validate the --from-replay precondition before wiping the slot, so a never-minted
+        # case does not destroy a pre-existing output/<label>/ on its way to failing.
+        if from_replay and (previous is None or not previous.native):
+            logger.error(f"{case_id}: --from-replay needs an existing minted manifest")
+            failures.append(case_id)
+            continue
+
+        slot = prepare_slot(paths, label)
+
+        # Populate the slot's native set: either re-execute the diagnostic, or (with
+        # --from-replay) materialise the previously minted native from the store. The
+        # writable store's fetch/has back the materialise, so no separate read store is needed.
+        try:
+            if from_replay and previous is not None:  # previous is non-None by the guard above
+                source = stage_materialise(
+                    diag=diag, tc=tc, paths=paths, manifest=previous, store=store, slot=slot
+                )
+                source_kind = "materialise"
+            else:
+                datasets = load_datasets_from_yaml(paths.catalog)
+                source = stage_execute(
+                    config=config,
+                    diag=diag,
+                    tc=tc,
+                    datasets=datasets,
+                    slot=slot,
+                    execution_dir=None,
+                    clean=True,
+                )
+                source_kind = "execute"
+        except StageError as exc:
+            logger.error(f"{case_id}: {exc}")
+            failures.append(case_id)
+            continue
+        except Exception as exc:
+            logger.error(f"{case_id}: source stage failed during mint: {exc}")
+            failures.append(case_id)
+            continue
+
+        committed = stage_build(slot=slot, source=source, paths=paths)
+        if from_replay and previous is not None:
+            # --from-replay reuses the already-minted native verbatim: stage_materialise hydrated
+            # the slot's copy in place (placeholders -> concrete paths) while rebuilding, so a fresh
+            # snapshot would re-author manifest.native with non-portable, slot-specific blobs even
+            # though the canonical native baseline is unchanged. Preserve it -- only the committed
+            # bundle is re-derived here -- which also makes the upload below a verified no-op.
+            native = previous.native
+        else:
+            native = snapshot_native(slot)
+        errors = stage_upload(
+            slot=slot, native=native, store=store, previous=(previous.native if previous else {})
+        )
+        if errors:
+            for error in errors:
+                logger.error(f"{case_id}: {error}")
+            failures.append(case_id)
+            continue
+
+        # Promote the rebuilt bundle and author the committed manifest: the native block
+        # is written ONLY here.
+        promote_to_baseline(slot, paths)
+        if previous is not None:
+            version = previous.test_case_version + 1 if bump_version else previous.test_case_version
+        else:
+            version = 1
+        _write_test_case_manifest(paths, test_case_version=version, committed=committed, native=native)
+        write_source_stamp(slot, label=label, verb="mint", source=source_kind, test_case_version=version)
+
+        minted += 1
+        logger.info(
+            f"Minted native baseline: {case_id} "
+            f"({len(native)} native file(s), {len(committed)} committed file(s), "
+            f"test_case_version={version})"
+        )
+
+    console.print()
+    if failures:
+        console.print(f"[yellow]Mint: {minted} minted, {len(failures)} failed[/yellow]")
+        console.print("[red]Failed mints:[/red]")
+        for case in failures:
+            console.print(f"  - {case}")
+        raise typer.Exit(code=1)
+    console.print(f"[green]Minted {minted} native baseline(s)[/green]")
+
+
+@app.command(name="build")
+def build_test_case(  # noqa: PLR0912, PLR0913, PLR0915
+    ctx: typer.Context,
+    provider: Annotated[
+        str,
+        typer.Option(help="Provider slug (required, e.g., 'example', 'ilamb')"),
+    ],
+    diagnostic: Annotated[
+        str | None,
+        typer.Option(help="Specific diagnostic slug to build"),
+    ] = None,
+    test_case: Annotated[
+        str | None,
+        typer.Option(help="Specific test case name to build"),
+    ] = None,
+    label: Annotated[
+        str,
+        typer.Option(help="Output slot to rebuild from (default: latest)"),
+    ] = "latest",
+    force_regen: Annotated[
+        bool,
+        typer.Option(help="Promote the rebuilt bundle to the tracked regression baseline"),
+    ] = False,
+) -> None:
+    """
+    Rebuild the committed bundle from an existing output slot, without re-executing.
+
+    Reuses the native already materialised in ``output/<label>/`` (by a previous
+    ``run`` / ``replay`` / ``mint``) to regenerate the slot's committed bundle. The tracked
+    ``regression/`` baseline is only promoted when ``--force-regen`` is given or no baseline
+    exists yet, so a rebuild never silently clobbers a committed baseline.
+
+    Examples
+    --------
+        ref test-cases build --provider example
+        ref test-cases build --provider example --label before --force-regen
+    """
+    from climate_ref.provider_registry import ProviderRegistry
+    from climate_ref_core.regression.manifest import Manifest
+    from climate_ref_core.testing import TestCasePaths
+
+    config: Config = ctx.obj.config
+    db = ctx.obj.database
+    console: Console = ctx.obj.console
+
+    registry = ProviderRegistry.build_from_config(config, db)
+    _validate_provider_in_registry(registry, provider)
+    _validate_requested_filters(registry, provider=provider, diagnostic=diagnostic, test_case=test_case)
+    cases = list(_iter_test_cases(registry, provider=provider, diagnostic=diagnostic, test_case=test_case))
+    if not cases:
+        logger.warning(f"No test cases found for provider {provider!r}")
+        raise typer.Exit(code=0)
+
+    built = 0
+    failures: list[str] = []
+
+    for diag, tc in cases:
+        case_id = f"{provider}/{diag.slug}/{tc.name}"
+        paths = TestCasePaths.from_diagnostic(diag, tc.name)
+        if paths is None:
+            logger.warning(f"Could not determine test case directory for {case_id}")
+            continue
+        slot = paths.output_slot(label)
+        if not slot.exists() or not slot_native_relpaths(slot):
+            logger.error(f"{case_id}: no native in output slot {label!r}; run/replay/mint it first")
+            failures.append(case_id)
+            continue
+        if not paths.catalog.exists():
+            logger.error(f"No catalog file for {case_id}; run `ref test-cases fetch` first")
+            failures.append(case_id)
+            continue
+
+        try:
+            source = stage_rebuild_from_slot(diag=diag, tc=tc, paths=paths, slot=slot)
+        except Exception as exc:
+            logger.error(f"{case_id}: failed to rebuild bundle from slot: {exc}")
+            failures.append(case_id)
+            continue
+
+        committed = stage_build(slot=slot, source=source, paths=paths)
+        previous = Manifest.load(paths.manifest) if paths.manifest.exists() else None
+        version = previous.test_case_version if previous else 1
+
+        if force_regen or not paths.regression.exists():
+            promote_to_baseline(slot, paths)
+            native = snapshot_native(slot)
+            if previous is not None:
+                _write_test_case_manifest(
+                    paths,
+                    test_case_version=previous.test_case_version,
+                    committed=committed,
+                    native=previous.native,
+                    schema=previous.schema,
+                )
+                if native_is_stale(native, previous.native):
+                    logger.warning(
+                        f"{case_id}: committed bundle rebuilt but the native baseline differs; "
+                        "re-mint with `ref test-cases mint`"
+                    )
+            else:
+                _write_test_case_manifest(paths, test_case_version=1, committed=committed, native={})
+            logger.info(f"Promoted rebuilt bundle to regression baseline: {paths.regression}")
+        else:
+            logger.info(
+                f"Wrote output slot {slot}/regression "
+                "(committed baseline unchanged; use --force-regen to promote it)"
+            )
+
+        write_source_stamp(slot, label=label, verb="build", source="rebuild", test_case_version=version)
+        built += 1
+
+    console.print()
+    if failures:
+        console.print(f"[yellow]Build: {built} built, {len(failures)} failed[/yellow]")
+        console.print("[red]Failed builds:[/red]")
+        for case in failures:
+            console.print(f"  - {case}")
+        raise typer.Exit(code=1)
+    console.print(f"[green]Built {built} committed bundle(s) from output slots[/green]")
diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases/ci_gate.py b/packages/climate-ref/src/climate_ref/cli/test_cases/ci_gate.py
new file mode 100644
index 000000000..b914fa875
--- /dev/null
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases/ci_gate.py
@@ -0,0 +1,300 @@
+"""
+``ref test-cases ci-gate``.
+
+Decides, per test case, how CI should verify its regression baseline (replay,
+execute, skip, or fail) by comparing the committed ``manifest.json`` against the
+base branch and detecting extraction-code changes.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+from typing import TYPE_CHECKING, Annotated
+
+import typer
+from loguru import logger
+from rich.table import Table
+
+from climate_ref.cli._git_utils import get_repo_for_path
+from climate_ref.cli.test_cases._app import app
+from climate_ref.cli.test_cases._common import (
+    _iter_test_cases,
+    _validate_provider_in_registry,
+    _validate_requested_filters,
+)
+from climate_ref.config import Config
+
+if TYPE_CHECKING:
+    from rich.console import Console
+
+    from climate_ref_core.diagnostics import Diagnostic
+
+
+def _provider_source_root(diag: Diagnostic, repo_root: Path) -> str | None:
+    """
+    Return the diagnostic's provider package source directory, relative to the repo root.
+
+    Used to decide whether a changed file touches the diagnostic's extraction code.
+    The returned path is POSIX-style so it can be compared against
+    ``git diff --name-only`` output.
+
+    Parameters
+    ----------
+    diag
+        The diagnostic whose provider source directory is wanted.
+    repo_root
+        The repository working-tree root.
+
+    Returns
+    -------
+    :
+        The provider package source directory relative to ``repo_root``, or ``None``
+        if it cannot be located or lies outside the repository.
+    """
+    import importlib.util
+
+    top_package = type(diag).__module__.split(".")[0]
+    try:
+        spec = importlib.util.find_spec(top_package)
+    except (ImportError, ValueError):
+        return None
+    if spec is None or not spec.submodule_search_locations:
+        return None
+    package_dir = Path(next(iter(spec.submodule_search_locations))).resolve()
+    try:
+        return package_dir.relative_to(repo_root.resolve()).as_posix()
+    except ValueError:
+        return None
+
+
+def _core_extraction_roots(repo_root: Path) -> list[str]:
+    """
+    Return the core paths whose change affects replay/execute for every test case.
+
+    ``build_execution_result`` (the function replay/execute re-run) depends on more
+    than the regression package: it builds and reads CMEC bundles via
+    :mod:`climate_ref_core.pycmec`, persists curated outputs via
+    :mod:`climate_ref_core.output_files`, and is dispatched through
+    :mod:`climate_ref_core.diagnostics`. A change under any of these can alter the
+    regenerated bundle, so all of them count as an extraction change.
+
+    Detection is deliberately coarse and errs toward REPLAY (cheap, credential-free):
+    a false positive only triggers an unnecessary replay, never a missed one.
+    Roots are derived from the installed package location (rather than hardcoded
+    paths) so they survive a package move; any root outside the repository
+    (e.g. an installed wheel) is dropped.
+
+    Parameters
+    ----------
+    repo_root
+        The repository working-tree root.
+
+    Returns
+    -------
+    :
+        Repo-relative POSIX paths for the core extraction surfaces that lie inside the repo.
+    """
+    import climate_ref_core
+
+    core_dir = Path(climate_ref_core.__file__).resolve().parent
+    repo_root_resolved = repo_root.resolve()
+    candidates = [
+        core_dir / "regression",
+        core_dir / "pycmec",
+        core_dir / "output_files.py",
+        core_dir / "diagnostics.py",
+    ]
+    roots: list[str] = []
+    for candidate in candidates:
+        try:
+            roots.append(candidate.relative_to(repo_root_resolved).as_posix())
+        except ValueError:
+            continue
+    return roots
+
+
+@app.command(name="ci-gate")
+def ci_gate(  # noqa: PLR0912, PLR0913, PLR0915
+    ctx: typer.Context,
+    base: Annotated[
+        str,
+        typer.Option(help="Git ref to compare against (the PR base branch)"),
+    ] = "origin/main",
+    provider: Annotated[
+        str | None,
+        typer.Option(help="Limit the gate to a single provider slug"),
+    ] = None,
+    diagnostic: Annotated[
+        str | None,
+        typer.Option(help="Limit the gate to a single diagnostic slug"),
+    ] = None,
+    test_case: Annotated[
+        str | None,
+        typer.Option(help="Limit the gate to a single test case name"),
+    ] = None,
+    output_json: Annotated[
+        bool,
+        typer.Option("--json", help="Emit the per-case decisions as JSON on stdout"),
+    ] = False,
+) -> None:
+    """
+    Decide how CI should verify each test case's regression baseline.
+
+    Compares each committed ``manifest.json`` to its counterpart on the base branch
+    and reports the action CI should take per case: ``replay`` (cheap, against the
+    cached native baseline), ``execute`` (full re-run, when ``test_case_version`` was
+    bumped), ``skip`` (nothing relevant changed), or ``fail`` (an unauthorised
+    baseline change). Exits non-zero if any case is gated ``fail``.
+
+    The ``--json`` output is intended for CI to dispatch ``replay``/``run`` jobs.
+
+    Examples
+    --------
+        ref test-cases ci-gate                       # Gate all cases against origin/main
+        ref test-cases ci-gate --base origin/develop
+        ref test-cases ci-gate --provider example --json
+    """
+    import json as _json
+
+    from git import GitCommandError
+
+    from climate_ref.provider_registry import ProviderRegistry
+    from climate_ref_core.regression.gate import Action, decide_coupling, paths_under
+    from climate_ref_core.regression.manifest import Manifest, compute_committed_digests
+    from climate_ref_core.testing import TestCasePaths, get_catalog_hash
+
+    config: Config = ctx.obj.config
+    db = ctx.obj.database
+    console: Console = ctx.obj.console
+
+    repo = get_repo_for_path(Path.cwd())
+    if repo is None or repo.working_dir is None:
+        logger.error("ci-gate must be run inside a git repository")
+        raise typer.Exit(code=1)
+    repo_root = Path(repo.working_dir)
+
+    # Resolve the set of files changed on this branch relative to the base ref.
+    # `base...HEAD` diffs against the merge-base, so unrelated base-branch churn
+    # is excluded.
+    try:
+        diff_output = repo.git.diff("--name-only", f"{base}...HEAD")
+    except GitCommandError as exc:
+        logger.error(f"Could not diff against base ref {base!r}: {exc}")
+        raise typer.Exit(code=1) from exc
+    changed_files = [line.strip() for line in diff_output.splitlines() if line.strip()]
+
+    # The core machinery behind build_execution_result affects every replay/execute,
+    # so a change there counts as an extraction change for all cases. Extraction-change
+    # detection is deliberately coarse: any change under a diagnostic's provider package
+    # (see `_provider_source_root`) or under the core extraction surfaces counts for
+    # every case in that provider. This errs toward REPLAY (cheap, credential-free),
+    # never away from it.
+    core_changed = paths_under(changed_files, _core_extraction_roots(repo_root))
+
+    # Hoisted once: repo_root.resolve() is filesystem-touching, and a provider's source
+    # root is identical for every case in that provider, so memoise it per provider slug
+    # rather than recomputing find_spec on each case.
+    repo_root_resolved = repo_root.resolve()
+    source_root_cache: dict[str, str | None] = {}
+
+    registry = ProviderRegistry.build_from_config(config, db)
+    _validate_provider_in_registry(registry, provider)
+    _validate_requested_filters(registry, provider=provider, diagnostic=diagnostic, test_case=test_case)
+    cases = list(_iter_test_cases(registry, provider=provider, diagnostic=diagnostic, test_case=test_case))
+
+    decisions: list[dict[str, str]] = []
+    has_failure = False
+
+    def record(case: str, action: Action, reason: str) -> None:
+        nonlocal has_failure
+        if action is Action.FAIL:
+            has_failure = True
+        decisions.append({"case": case, "action": action.value, "reason": reason})
+
+    for diag, tc in cases:
+        case_id = f"{diag.provider.slug}/{diag.slug}/{tc.name}"
+        paths = TestCasePaths.from_diagnostic(diag, tc.name)
+
+        # A corrupt manifest authored in this change is a hard failure for that case,
+        # not a crash for the whole gate.
+        manifest: Manifest | None = None
+        if paths is not None and paths.manifest.exists():
+            try:
+                manifest = Manifest.load(paths.manifest)
+            except ValueError as exc:
+                logger.error(f"{case_id}: invalid manifest.json: {exc}")
+                record(case_id, Action.FAIL, f"invalid manifest.json: {exc}")
+                continue
+
+        base_manifest: Manifest | None = None
+        if paths is not None:
+            try:
+                rel_manifest = paths.manifest.resolve().relative_to(repo_root_resolved).as_posix()
+            except ValueError:
+                rel_manifest = None
+            if rel_manifest is not None:
+                try:
+                    base_text = repo.git.show(f"{base}:{rel_manifest}")
+                except GitCommandError:
+                    base_manifest = None
+                else:
+                    # A corrupt manifest on the base branch can't be compared against;
+                    # fall back to seeding (REPLAY) rather than aborting the gate.
+                    try:
+                        base_manifest = Manifest.loads(base_text, source=f"{base}:{rel_manifest}")
+                    except ValueError as exc:
+                        logger.warning(
+                            f"{case_id}: base manifest at {base}:{rel_manifest} is invalid "
+                            f"({exc}); treating as newly added"
+                        )
+                        base_manifest = None
+
+        provider_slug = diag.provider.slug
+        if provider_slug not in source_root_cache:
+            source_root_cache[provider_slug] = _provider_source_root(diag, repo_root)
+        source_root = source_root_cache[provider_slug]
+        extraction_roots = [r for r in (source_root,) if r]
+        extraction_changed = core_changed or paths_under(changed_files, extraction_roots)
+
+        # Verify the committed bundle on disk still matches the manifest digests.
+        # A drift (edited/added/removed committed file without regenerating the
+        # manifest) must fail closed rather than slip through as SKIP.
+        committed_integrity_ok = True
+        # Verify the input catalog still matches the manifest's recorded hash. A catalog
+        # edit without regenerating the baseline leaves it silently stale; fail closed.
+        # Legacy manifests without a catalog_hash have nothing to compare, so stay OK.
+        catalog_integrity_ok = True
+        if manifest is not None and paths is not None:
+            committed_integrity_ok = compute_committed_digests(paths.regression) == manifest.committed
+            if manifest.catalog_hash is not None:
+                catalog_integrity_ok = get_catalog_hash(paths.catalog) == manifest.catalog_hash
+
+        decision = decide_coupling(
+            manifest,
+            base_manifest,
+            extraction_changed=extraction_changed,
+            committed_integrity_ok=committed_integrity_ok,
+            catalog_integrity_ok=catalog_integrity_ok,
+        )
+        record(case_id, decision.action, decision.reason)
+
+    if output_json:
+        console.print_json(_json.dumps(decisions))
+    else:
+        table = Table(title=f"CI coupling gate (base: {base})")
+        table.add_column("Test case", style="cyan", no_wrap=True)
+        table.add_column("Action")
+        table.add_column("Reason")
+        style_for = {
+            Action.FAIL.value: "red",
+            Action.EXECUTE.value: "yellow",
+            Action.REPLAY.value: "green",
+            Action.SKIP.value: "dim",
+        }
+        for entry in decisions:
+            style = style_for[entry["action"]]
+            table.add_row(entry["case"], f"[{style}]{entry['action']}[/{style}]", entry["reason"])
+        console.print(table)
+
+    if has_failure:
+        raise typer.Exit(code=1)
diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases/discovery.py b/packages/climate-ref/src/climate_ref/cli/test_cases/discovery.py
new file mode 100644
index 000000000..1b02932ce
--- /dev/null
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases/discovery.py
@@ -0,0 +1,242 @@
+"""
+``ref test-cases fetch`` and ``ref test-cases list``.
+
+Commands for discovering test cases and fetching their input data from ESGF.
+"""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Annotated
+
+import typer
+from loguru import logger
+from rich.table import Table
+
+from climate_ref.cli.test_cases._app import app
+from climate_ref.cli.test_cases._catalog import _fetch_and_build_catalog
+from climate_ref.cli.test_cases._common import _validate_provider_in_registry, _validate_requested_filters
+from climate_ref_core.exceptions import DatasetResolutionError
+
+if TYPE_CHECKING:
+    from climate_ref_core.diagnostics import Diagnostic
+
+
+@app.command(name="fetch")
+def fetch_test_data(  # noqa: PLR0912, PLR0913, PLR0915
+    ctx: typer.Context,
+    provider: Annotated[
+        str | None,
+        typer.Option(help="Specific provider to fetch data for (e.g., 'esmvaltool', 'ilamb')"),
+    ] = None,
+    diagnostic: Annotated[
+        str | None,
+        typer.Option(help="Specific diagnostic slug to fetch data for"),
+    ] = None,
+    test_case: Annotated[
+        str | None,
+        typer.Option(help="Specific test case name to fetch data for"),
+    ] = None,
+    dry_run: Annotated[
+        bool,
+        typer.Option(help="Show what would be fetched without downloading"),
+    ] = False,
+    only_missing: Annotated[
+        bool,
+        typer.Option(help="Only fetch data for test cases without existing catalogs"),
+    ] = False,
+    force: Annotated[
+        bool,
+        typer.Option(help="Force overwrite catalog even if unchanged"),
+    ] = False,
+) -> None:
+    """
+    Fetch test data from ESGF for running diagnostic tests.
+
+    Downloads full-resolution ESGF data based on diagnostic test_data_spec.
+    Use --provider or --diagnostic to limit scope.
+
+    Examples
+    --------
+        ref test-cases fetch                   # Fetch all test data
+        ref test-cases fetch --provider ilamb  # Fetch ILAMB test data only
+        ref test-cases fetch --diagnostic ecs  # Fetch ECS diagnostic data
+        ref test-cases fetch --only-missing    # Skip test cases with existing catalogs
+    """
+    from climate_ref.provider_registry import ProviderRegistry
+    from climate_ref_core.testing import TestCasePaths
+
+    config = ctx.obj.config
+    db = ctx.obj.database
+
+    # Build provider registry to access diagnostics
+    registry = ProviderRegistry.build_from_config(config, db)
+
+    # Check if the requested provider exists in the registry and selectors are valid
+    _validate_provider_in_registry(registry, provider)
+    _validate_requested_filters(registry, provider=provider, diagnostic=diagnostic, test_case=test_case)
+
+    # Collect diagnostics to process
+    diagnostics_to_process: list[Diagnostic] = []
+
+    for provider_instance in registry.providers:
+        if provider and provider_instance.slug != provider:
+            continue
+
+        for diag in provider_instance.diagnostics():
+            if diagnostic and diag.slug != diagnostic:
+                continue
+            if diag.test_data_spec is None:
+                continue
+            diagnostics_to_process.append(diag)
+
+    if not diagnostics_to_process:
+        if provider:
+            logger.warning(f"No diagnostics with test_data_spec found for provider '{provider}'")
+        else:
+            logger.warning("No diagnostics with test_data_spec found")
+        raise typer.Exit(code=0)
+
+    logger.info(f"Found {len(diagnostics_to_process)} diagnostics with test data specifications")
+
+    if dry_run:  # pragma: no cover
+        for diag in diagnostics_to_process:
+            logger.info(f"Would fetch data for: {diag.provider.slug}/{diag.slug}")
+            if diag.test_data_spec:
+                for tc in diag.test_data_spec.test_cases:
+                    if test_case and tc.name != test_case:
+                        continue
+                    # Check if catalog exists when using --only-missing
+                    if only_missing:
+                        paths = TestCasePaths.from_diagnostic(diag, tc.name)
+                        if paths and paths.catalog.exists():
+                            logger.info(f"  Test case: {tc.name} - [SKIP: catalog exists]")
+                            continue
+                    logger.info(f"  Test case: {tc.name} - {tc.description}")
+                    if tc.requests:
+                        for req in tc.requests:
+                            logger.info(f"    Request: {req.slug} ({req.source_type})")
+        return
+
+    # Process each diagnostic test case
+    for diag in diagnostics_to_process:  # pragma: no cover
+        logger.info(f"Fetching data for: {diag.provider.slug}/{diag.slug}")
+        if diag.test_data_spec:
+            for tc in diag.test_data_spec.test_cases:
+                if test_case and tc.name != test_case:
+                    continue
+                paths = TestCasePaths.from_diagnostic(diag, tc.name)
+                # Skip if catalog exists when using --only-missing
+                if only_missing and paths and paths.catalog.exists():
+                    logger.info(f"  Skipping test case: {tc.name} (catalog exists)")
+                    continue
+                if tc.requests:
+                    if paths and paths.catalog.exists() and not force:
+                        logger.info(
+                            f"  Refreshing existing catalog for {tc.name} "
+                            "(use --only-missing to skip existing catalogs)"
+                        )
+                    logger.info(f"  Processing test case: {tc.name}")
+                    try:
+                        _, catalog_written = _fetch_and_build_catalog(diag, tc, force=force)
+                        if not catalog_written:
+                            logger.info(f"  Catalog unchanged for {tc.name}")
+                    except (DatasetResolutionError, ValueError) as e:
+                        logger.warning(f"  Could not build catalog for {tc.name}: {e}")
+
+
+@app.command(name="list")
+def list_cases(
+    ctx: typer.Context,
+    provider: Annotated[
+        str | None,
+        typer.Option(help="Filter by provider"),
+    ] = None,
+    verbose: Annotated[
+        bool,
+        typer.Option("--verbose", "-v", help="Show test case descriptions"),
+    ] = False,
+) -> None:
+    """
+    List test cases for all diagnostics.
+
+    Shows which test cases are defined for each diagnostic and their descriptions.
+    Also shows whether catalog and regression data exist for each test case.
+    """
+    from climate_ref.provider_registry import ProviderRegistry
+    from climate_ref_core.testing import TestCasePaths
+
+    config = ctx.obj.config
+    db = ctx.obj.database
+    console = ctx.obj.console
+
+    # Build provider registry to access diagnostics.
+    # Listing is metadata-only, so skip provider configuration to avoid setup side effects.
+    registry = ProviderRegistry.build_from_config(config, db, configure=False)
+
+    # Check if the requested provider exists in the registry
+    _validate_provider_in_registry(registry, provider)
+
+    table = Table(title="Test Data Specifications")
+    table.add_column("Provider", style="cyan", no_wrap=True)
+    table.add_column("Diagnostic", style="green", no_wrap=True)
+    table.add_column("Test Case", style="yellow", no_wrap=True)
+    if verbose:
+        table.add_column("Description", overflow="fold")
+    table.add_column("Requests", justify="right", no_wrap=True)
+    table.add_column("Catalog", justify="center", no_wrap=True)
+    table.add_column("Regression", justify="center", no_wrap=True)
+
+    total_cases = 0
+    missing_catalogs = 0
+    missing_regressions = 0
+
+    for provider_instance in registry.providers:
+        if provider and provider_instance.slug != provider:
+            continue
+
+        for diag in provider_instance.diagnostics():
+            if diag.test_data_spec is None:
+                row = [
+                    provider_instance.slug,
+                    diag.slug,
+                    "-",
+                ]
+                if verbose:
+                    row.append("(no test_data_spec)")
+                row.extend(["0", "-", "-"])
+                table.add_row(*row)
+                continue
+
+            for tc in diag.test_data_spec.test_cases:
+                num_requests = len(tc.requests) if tc.requests else 0
+
+                # Check if catalog and regression data exist
+                paths = TestCasePaths.from_diagnostic(diag, tc.name)
+                if paths:
+                    catalog_exists = paths.catalog.exists()
+                    regression_exists = paths.regression.exists()
+                    catalog_status = "[green]yes[/green]" if catalog_exists else "[red]no[/red]"
+                    regression_status = "[green]yes[/green]" if regression_exists else "[red]no[/red]"
+                    missing_catalogs += not catalog_exists
+                    missing_regressions += not regression_exists
+                else:
+                    catalog_status = "[dim]-[/dim]"
+                    regression_status = "[dim]-[/dim]"
+
+                total_cases += 1
+                row = [
+                    provider_instance.slug,
+                    diag.slug,
+                    tc.name,
+                ]
+                if verbose:
+                    row.append(tc.description)
+                row.extend([str(num_requests), catalog_status, regression_status])
+                table.add_row(*row)
+
+    console.print(table)
+    console.print(
+        f"[dim]{total_cases} test case(s); "
+        f"{missing_catalogs} missing catalog(s); "
+        f"{missing_regressions} missing regression baseline(s)[/dim]"
+    )
diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases/run.py b/packages/climate-ref/src/climate_ref/cli/test_cases/run.py
new file mode 100644
index 000000000..d47afd325
--- /dev/null
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases/run.py
@@ -0,0 +1,444 @@
+"""
+``ref test-cases run``.
+
+Executes diagnostics for their declared test cases, writes the native into an
+output slot, rebuilds the committed bundle, and (when asked) promotes it to the
+tracked regression baseline.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+from typing import TYPE_CHECKING, Annotated
+
+import typer
+from loguru import logger
+from rich.table import Table
+
+from climate_ref.cli._git_utils import collect_regression_file_info, get_repo_for_path
+from climate_ref.cli._utils import format_size
+from climate_ref.cli.test_cases._app import app
+from climate_ref.cli.test_cases._catalog import _fetch_and_build_catalog
+from climate_ref.cli.test_cases._common import (
+    _validate_provider_in_registry,
+    _validate_requested_filters,
+    _write_test_case_manifest,
+)
+from climate_ref.cli.test_cases._stages import (
+    StageError,
+    native_is_stale,
+    prepare_slot,
+    promote_to_baseline,
+    snapshot_native,
+    stage_build,
+    stage_execute,
+    write_source_stamp,
+)
+from climate_ref.config import Config
+from climate_ref_core.exceptions import (
+    DatasetResolutionError,
+    InvalidDiagnosticException,
+    NoTestDataSpecError,
+    TestCaseNotFoundError,
+)
+
+if TYPE_CHECKING:
+    from rich.console import Console
+
+    from climate_ref_core.diagnostics import Diagnostic
+    from climate_ref_core.testing import TestCase
+
+
+def _print_regression_summary(  # pragma: no cover
+    console: Console,
+    regression_dir: Path,
+    size_threshold_mb: float = 1.0,
+) -> None:
+    """
+    Print a summary of the regression directory with file sizes and git status.
+
+    Parameters
+    ----------
+    console
+        Rich console for output
+    regression_dir
+        Path to the regression data directory
+    size_threshold_mb
+        Files larger than this (in MB) will be flagged
+    """
+    repo = get_repo_for_path(regression_dir)
+    repo_root = Path(repo.working_dir) if repo else regression_dir
+
+    threshold_bytes = int(size_threshold_mb * 1024 * 1024)
+    file_info = collect_regression_file_info(regression_dir, repo, threshold_bytes)
+
+    if not file_info:
+        console.print("[yellow]No files in regression directory[/yellow]")
+        return
+
+    total_size = sum(f["size"] for f in file_info)
+    large_files = sum(1 for f in file_info if f["is_large"])
+
+    table = Table(title=f"Regression Data: {regression_dir.relative_to(repo_root)}")
+    table.add_column("File", style="cyan", no_wrap=False)
+    table.add_column("Size", justify="right")
+    table.add_column("Git Status", justify="center")
+
+    for info in file_info:
+        # Format size with color
+        size_str = format_size(info["size"])
+        if info["is_large"]:
+            size_str = f"[bold red]{size_str}[/bold red]"
+
+        # Get git status with color
+        git_status = info["git_status"]
+        status_colors = {
+            "new": "[green]new[/green]",
+            "staged": "[green]staged[/green]",
+            "modified": "[yellow]modified[/yellow]",
+            "tracked": "[dim]tracked[/dim]",
+            "untracked": "[red]untracked[/red]",
+            "deleted": "[red]deleted[/red]",
+            "unknown": "[dim]?[/dim]",
+        }
+        git_status_str = status_colors.get(git_status, f"[dim]{git_status}[/dim]")
+
+        table.add_row(info["rel_path"], size_str, git_status_str)
+
+    console.print(table)
+
+    # Summary line
+    summary = f"\n[bold]Total:[/bold] {len(file_info)} files, {format_size(total_size)}"
+    if large_files > 0:
+        summary += f" ([red]{large_files} files > {size_threshold_mb} MB[/red])"
+    console.print(summary)
+
+
+def _run_single_test_case(  # noqa: PLR0911, PLR0912, PLR0913, PLR0915
+    config: Config,
+    console: Console,
+    diag: Diagnostic,
+    tc: TestCase,
+    *,
+    execution_dir: Path | None,
+    force_regen: bool,
+    fetch: bool,
+    size_threshold: float,
+    clean: bool,
+    label: str,
+) -> bool:
+    """
+    Run a single test case for a diagnostic, writing its native into an output slot.
+
+    Always (re)populates ``output/<label>/`` with the executed native set and its rebuilt
+    committed bundle. The tracked ``regression/`` baseline is only updated ("promoted") when
+    ``--force-regen`` is given or no baseline exists yet, so a labelled run never silently
+    clobbers a committed baseline.
+
+    Returns True if successful, False otherwise.
+    """
+    from climate_ref_core.regression.manifest import Manifest
+    from climate_ref_core.testing import TestCasePaths, load_datasets_from_yaml
+
+    provider_slug = diag.provider.slug
+    diagnostic_slug = diag.slug
+    test_case_name = tc.name
+    case_id = f"{provider_slug}/{diagnostic_slug}/{test_case_name}"
+
+    # Resolve datasets: either fetch from ESGF or load from the pre-built catalog.
+    if fetch:
+        logger.info(f"Fetching test data for {case_id}")
+        try:
+            datasets, _ = _fetch_and_build_catalog(diag, tc)
+        except (DatasetResolutionError, InvalidDiagnosticException) as e:
+            logger.exception(f"Failed to fetch data for {case_id}: {e}")
+            return False
+
+    paths = TestCasePaths.from_diagnostic(diag, test_case_name)
+    if paths is None:
+        logger.error(f"Could not determine test data directory for {provider_slug}/{diagnostic_slug}")
+        return False
+
+    if not fetch:
+        if not paths.catalog.exists():
+            logger.error(f"No catalog file found for {case_id}")
+            logger.error("Run 'ref test-cases fetch' first or use --fetch flag")
+            return False
+        logger.info(f"Loading catalog from {paths.catalog}")
+        datasets = load_datasets_from_yaml(paths.catalog)
+
+    paths.create()
+    slot = prepare_slot(paths, label)
+    logger.info(f"Running test case {test_case_name!r} for {provider_slug}/{diagnostic_slug}")
+    try:
+        source = stage_execute(
+            config=config,
+            diag=diag,
+            tc=tc,
+            datasets=datasets,
+            slot=slot,
+            execution_dir=execution_dir,
+            clean=clean,
+        )
+    except NoTestDataSpecError:
+        logger.error(f"Diagnostic {provider_slug}/{diagnostic_slug} has no test_data_spec")
+        return False
+    except TestCaseNotFoundError:
+        logger.error(f"Test case {test_case_name!r} not found for {provider_slug}/{diagnostic_slug}")
+        if diag.test_data_spec:
+            logger.error(f"Available test cases: {diag.test_data_spec.case_names}")
+        return False
+    except DatasetResolutionError as e:
+        logger.error(str(e))
+        logger.error("Have you run 'ref test-cases fetch' first?")
+        return False
+    except StageError:
+        logger.error(f"Execution failed: {case_id}")
+        return False
+    except Exception as e:
+        logger.error(f"Diagnostic execution failed for {case_id}: {e!s}")
+        return False
+
+    result = source.result
+    logger.info(f"Execution completed: {case_id}")
+    if result.metric_bundle_filename:
+        logger.info(f"Metric bundle: {result.to_output_path(result.metric_bundle_filename)}")
+    if result.output_bundle_filename:
+        logger.info(f"Output bundle: {result.to_output_path(result.output_bundle_filename)}")
+
+    # Rebuild the slot's committed bundle, then decide whether to promote it to the
+    # tracked baseline. The native block is mint-owned, so a run preserves the previous
+    # one (or seeds an empty set) and never authors native here.
+    committed = stage_build(slot=slot, source=source, paths=paths)
+    previous = Manifest.load(paths.manifest) if paths.manifest.exists() else None
+    version = previous.test_case_version if previous else 1
+
+    if force_regen or not paths.regression.exists():
+        promote_to_baseline(slot, paths)
+        native = snapshot_native(slot)
+        if previous is not None:
+            _write_test_case_manifest(
+                paths,
+                test_case_version=previous.test_case_version,
+                committed=committed,
+                native=previous.native,
+                schema=previous.schema,
+            )
+            if native_is_stale(native, previous.native):
+                logger.warning(
+                    f"{case_id}: committed bundle regenerated but the native baseline differs; "
+                    "re-mint with `ref test-cases mint` (or `mint --from-replay`)"
+                )
+        else:
+            _write_test_case_manifest(paths, test_case_version=1, committed=committed, native={})
+        logger.info(f"Updated regression baseline: {paths.regression}")
+        _print_regression_summary(console, paths.regression, size_threshold)
+    else:
+        logger.info(
+            f"Wrote output slot {slot} (committed baseline unchanged; use --force-regen to update it)"
+        )
+
+    write_source_stamp(slot, label=label, verb="run", source="execute", test_case_version=version)
+    return True
+
+
+@app.command(name="run")
+def run_test_case(  # noqa: PLR0912, PLR0913, PLR0915
+    ctx: typer.Context,
+    provider: Annotated[
+        str,
+        typer.Option(help="Provider slug (required, e.g., 'example', 'ilamb')"),
+    ],
+    diagnostic: Annotated[
+        str | None,
+        typer.Option(help="Specific diagnostic slug to run (e.g., 'global-mean-timeseries')"),
+    ] = None,
+    test_case: Annotated[
+        str | None,
+        typer.Option(help="Specific test case name to run (e.g., 'default')"),
+    ] = None,
+    output_directory: Annotated[
+        Path | None,
+        typer.Option(
+            help=(
+                "Scratch directory for the diagnostic execution results. "
+                "The regression workflow also writes the gitignored output/<label> slot."
+            )
+        ),
+    ] = None,
+    force_regen: Annotated[
+        bool,
+        typer.Option(help="Force regeneration of regression baselines"),
+    ] = False,
+    fetch: Annotated[
+        bool,
+        typer.Option(help="Fetch test data from ESGF before running"),
+    ] = False,
+    size_threshold: Annotated[
+        float,
+        typer.Option(help="Flag files larger than this size in MB (default: 1.0)"),
+    ] = 1.0,
+    dry_run: Annotated[
+        bool,
+        typer.Option(help="Show what would be run without executing"),
+    ] = False,
+    only_missing: Annotated[
+        bool,
+        typer.Option(help="Only run test cases without existing regression data"),
+    ] = False,
+    if_changed: Annotated[
+        bool,
+        typer.Option(help="Only run if catalog has changed since regression data was generated"),
+    ] = False,
+    clean: Annotated[
+        bool,
+        typer.Option(help="Delete existing output directory before running"),
+    ] = False,
+    label: Annotated[
+        str,
+        typer.Option(help="Output slot name under output/ (default: latest)"),
+    ] = "latest",
+) -> None:
+    """
+    Run test cases for diagnostics.
+
+    Executes diagnostics using pre-defined datasets from the test_data_spec
+    and optionally compares against regression baselines.
+
+    Use --provider to select which provider's diagnostics to run (required).
+    Use --diagnostic and --test-case to further narrow the scope.
+
+    Examples
+    --------
+        ref test-cases run --provider ilamb              # Run all ILAMB test cases
+        ref test-cases run --provider example --diagnostic global-mean-timeseries
+        ref test-cases run --provider ilamb --test-case default --fetch
+        ref test-cases run --provider pmp --only-missing # Skip test cases with regression data
+        ref test-cases run --provider pmp --if-changed   # Only run if catalog changed
+    """
+    from climate_ref.provider_registry import ProviderRegistry
+    from climate_ref_core.testing import (
+        TestCasePaths,
+        catalog_changed_since_regression,
+    )
+
+    config: Config = ctx.obj.config
+    db = ctx.obj.database
+    console: Console = ctx.obj.console
+
+    # Build provider registry
+    registry = ProviderRegistry.build_from_config(config, db)
+
+    # Find the provider
+    _validate_provider_in_registry(registry, provider)
+    _validate_requested_filters(registry, provider=provider, diagnostic=diagnostic, test_case=test_case)
+    provider_instance = next(p for p in registry.providers if p.slug == provider)
+
+    # Collect test cases to run
+    test_cases_to_run: list[tuple[Diagnostic, TestCase]] = []
+    skipped_cases: list[tuple[Diagnostic, TestCase]] = []
+
+    for diag in provider_instance.diagnostics():
+        if diagnostic and diag.slug != diagnostic:
+            continue
+        if diag.test_data_spec is None:
+            continue
+
+        for tc in diag.test_data_spec.test_cases:
+            if test_case and tc.name != test_case:
+                continue
+            # Skip if regression exists when using --only-missing
+            paths = TestCasePaths.from_diagnostic(diag, tc.name)
+            if only_missing:
+                if paths and paths.regression.exists():
+                    skipped_cases.append((diag, tc))
+                    continue
+            # Skip if catalog hasn't changed when using --if-changed
+            if if_changed:
+                if paths and not catalog_changed_since_regression(paths):
+                    skipped_cases.append((diag, tc))
+                    continue
+            test_cases_to_run.append((diag, tc))
+
+    if not test_cases_to_run:
+        if only_missing and skipped_cases:
+            logger.info(
+                f"All {len(skipped_cases)} matching test case(s) skipped because "
+                "regression baselines already exist"
+            )
+        elif if_changed and skipped_cases:
+            logger.info(
+                f"All {len(skipped_cases)} matching test case(s) skipped because catalogs are unchanged"
+            )
+        else:
+            logger.warning(f"No test cases found for provider '{provider}'")
+            if diagnostic:
+                logger.warning(f"  with diagnostic filter: {diagnostic}")
+            if test_case:
+                logger.warning(f"  with test case filter: {test_case}")
+        raise typer.Exit(code=0)
+
+    logger.info(f"Found {len(test_cases_to_run)} test case(s) to run")
+    if skipped_cases:
+        if only_missing:
+            logger.info(f"Skipping {len(skipped_cases)} test case(s) with existing regression data")
+        elif if_changed:
+            logger.info(f"Skipping {len(skipped_cases)} test case(s) with unchanged catalogs")
+
+    if dry_run:  # pragma: no cover
+        table = Table(title="Test Cases to Run")
+        table.add_column("Provider", style="cyan")
+        table.add_column("Diagnostic", style="green")
+        table.add_column("Test Case", style="yellow")
+        table.add_column("Description")
+        table.add_column("Status", justify="center")
+
+        for diag, tc in test_cases_to_run:
+            table.add_row(provider, diag.slug, tc.name, tc.description, "[green]will run[/green]")
+
+        for diag, tc in skipped_cases:
+            table.add_row(provider, diag.slug, tc.name, tc.description, "[dim]skip (regression exists)[/dim]")
+
+        console.print(table)
+        return
+
+    # Run each test case
+    successes = 0
+    failures = 0
+    failed_cases: list[str] = []
+
+    if output_directory is not None:
+        logger.info(
+            f"Using {output_directory} as the execution scratch directory; rebuilt native/bundle files "
+            f"will also be written to each test case's gitignored output/{label} slot"
+        )
+
+    for diag, tc in test_cases_to_run:
+        success = _run_single_test_case(
+            config=config,
+            console=console,
+            diag=diag,
+            tc=tc,
+            execution_dir=output_directory,
+            force_regen=force_regen,
+            fetch=fetch,
+            size_threshold=size_threshold,
+            clean=clean,
+            label=label,
+        )
+        if success:
+            successes += 1
+        else:
+            failures += 1
+            failed_cases.append(f"{provider}/{diag.slug}/{tc.name}")
+
+    # Print summary
+    console.print()
+    if failures == 0:
+        console.print(f"[green]All {successes} test case(s) passed[/green]")
+    else:
+        console.print(f"[yellow]Results: {successes} passed, {failures} failed[/yellow]")
+        console.print("[red]Failed test cases:[/red]")
+        for case in failed_cases:
+            console.print(f"  - {case}")
+        raise typer.Exit(code=1)
diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases/store.py b/packages/climate-ref/src/climate_ref/cli/test_cases/store.py
new file mode 100644
index 000000000..6b580f0b9
--- /dev/null
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases/store.py
@@ -0,0 +1,154 @@
+"""
+Native-store commands: ``ref test-cases sync`` and ``ref test-cases check-store``.
+
+``sync`` warms the local cache with the native blobs referenced by committed
+manifests; ``check-store`` preflights the writable store's credentials before a
+mint.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+from typing import TYPE_CHECKING, Annotated
+
+import typer
+from loguru import logger
+
+from climate_ref.cli.test_cases._app import app
+from climate_ref.cli.test_cases._common import (
+    _iter_test_cases,
+    _validate_provider_in_registry,
+    _validate_requested_filters,
+)
+from climate_ref.config import Config
+
+if TYPE_CHECKING:
+    from rich.console import Console
+
+
+@app.command(name="sync")
+def sync_native(
+    ctx: typer.Context,
+    provider: Annotated[
+        str | None,
+        typer.Option(help="Limit sync to a single provider slug"),
+    ] = None,
+    diagnostic: Annotated[
+        str | None,
+        typer.Option(help="Limit sync to a single diagnostic slug"),
+    ] = None,
+    test_case: Annotated[
+        str | None,
+        typer.Option(help="Limit sync to a single test case name"),
+    ] = None,
+) -> None:
+    """
+    Fetch native baseline blobs referenced by committed manifests into the store cache.
+
+    Reads each committed ``manifest.json``'s ``native`` block
+    and ensures every referenced blob is present in the read store (public, credential-free).
+    Blobs already cached are skipped (idempotent).
+    A referenced digest the store cannot serve is a hard failure.
+
+    Examples
+    --------
+        ref test-cases sync                  # Sync all providers
+        ref test-cases sync --provider ilamb # Sync a single provider
+    """
+    import tempfile
+
+    from climate_ref.provider_registry import ProviderRegistry
+    from climate_ref_core.regression.manifest import Manifest
+    from climate_ref_core.regression.store import build_native_store
+    from climate_ref_core.testing import TestCasePaths
+
+    config: Config = ctx.obj.config
+    db = ctx.obj.database
+    console: Console = ctx.obj.console
+
+    registry = ProviderRegistry.build_from_config(config, db)
+    _validate_provider_in_registry(registry, provider)
+    _validate_requested_filters(registry, provider=provider, diagnostic=diagnostic, test_case=test_case)
+    store = build_native_store(config.native_store, writable=False)
+
+    # When a specific case is named, a missing manifest is a hard failure.
+    named = bool(diagnostic or test_case)
+    cases = list(_iter_test_cases(registry, provider=provider, diagnostic=diagnostic, test_case=test_case))
+
+    if not cases:
+        logger.warning("No test cases found for the selected filters")
+        raise typer.Exit(code=0)
+
+    fetched = 0
+    skipped = 0
+    failures: list[str] = []
+
+    for diag, tc in cases:
+        case_id = f"{diag.provider.slug}/{diag.slug}/{tc.name}"
+        paths = TestCasePaths.from_diagnostic(diag, tc.name)
+        if paths is None or not paths.manifest.exists():
+            if named:
+                logger.error(f"No manifest.json for {case_id}; run `ref test-cases mint` first")
+                failures.append(case_id)
+            continue
+        manifest = Manifest.load(paths.manifest)
+        for relpath, entry in manifest.native.items():
+            if store.has(entry.sha256):
+                skipped += 1
+                continue
+            with tempfile.TemporaryDirectory() as tmp:
+                try:
+                    store.fetch(entry.sha256, Path(tmp) / "blob")
+                except Exception as exc:
+                    failures.append(f"{case_id}: cannot serve native blob {entry.sha256} ({relpath}): {exc}")
+                    continue
+            fetched += 1
+
+    console.print(f"[green]Synced native blobs:[/green] {fetched} fetched, {skipped} already cached")
+    if failures:
+        console.print("[red]Failed to fetch referenced native blobs:[/red]")
+        for failure in failures:
+            console.print(f"  - {failure}")
+        raise typer.Exit(code=1)
+
+
+@app.command(name="check-store")
+def check_store(
+    ctx: typer.Context,
+) -> None:
+    """
+    Check connectivity and credentials for the writable native baseline store.
+
+    Builds the writable store from the configuration and preflights it (an authenticated
+    no-op probe) without running any diagnostics or uploading anything. Use this to confirm a
+    mint will work — that the credentials (REF_NATIVE_STORE_PROFILE or the access-key env
+    vars) and the bucket are correct — before a slow mint run.
+
+    Examples
+    --------
+        ref test-cases check-store
+        REF_NATIVE_STORE_PROFILE=my-profile ref test-cases check-store
+    """
+    from climate_ref_core.regression.store import NativeStoreUnavailableError, build_native_store
+
+    config: Config = ctx.obj.config
+    console: Console = ctx.obj.console
+
+    try:
+        store = build_native_store(config.native_store, writable=True)
+    except (NotImplementedError, ValueError) as exc:
+        logger.error(
+            "Native store is not configured for writing. For the remote (R2) store set "
+            "REF_NATIVE_STORE_S3_ENDPOINT_URL and REF_NATIVE_STORE_BUCKET, and authenticate via "
+            "REF_NATIVE_STORE_ACCESS_KEY_ID / REF_NATIVE_STORE_SECRET_ACCESS_KEY or a named "
+            f"REF_NATIVE_STORE_PROFILE; or set REF_NATIVE_STORE_URL to a local file:// path: {exc}"
+        )
+        raise typer.Exit(code=1) from exc
+
+    try:
+        store.preflight()
+    except NativeStoreUnavailableError as exc:
+        logger.error(str(exc))
+        raise typer.Exit(code=1) from exc
+
+    console.print("[green]Native store OK:[/green] credentials accepted and the store is reachable.")
diff --git a/packages/climate-ref/src/climate_ref/conftest_plugin.py b/packages/climate-ref/src/climate_ref/conftest_plugin.py
index 71b9036e8..a213ccf92 100644
--- a/packages/climate-ref/src/climate_ref/conftest_plugin.py
+++ b/packages/climate-ref/src/climate_ref/conftest_plugin.py
@@ -294,7 +294,10 @@ def invoke_cli(config: Config, monkeypatch: pytest.MonkeyPatch) -> Callable[...,
     runner.mix_stderr = False  # type: ignore[attr-defined]
 
     def _invoke_cli(args: list[str], expected_exit_code: int = 0, always_log: bool = False) -> Result:
+        # Render help/output deterministically for substring assertions.
+        # TERM=dumb makes Rich emit no escape codes at all. COLUMNS keeps help from wrapping mid-token.
         monkeypatch.setenv("NO_COLOR", "1")
+        monkeypatch.setenv("TERM", "dumb")
         monkeypatch.setenv("COLUMNS", "200")
 
         result = runner.invoke(app=cli.app, args=args)
diff --git a/packages/climate-ref/src/climate_ref/provider_registry.py b/packages/climate-ref/src/climate_ref/provider_registry.py
index 9b98766a1..7d69f8a03 100644
--- a/packages/climate-ref/src/climate_ref/provider_registry.py
+++ b/packages/climate-ref/src/climate_ref/provider_registry.py
@@ -118,26 +118,35 @@ def get_metric(self, provider_slug: str, diagnostic_slug: str) -> "Diagnostic":
         return self.get(provider_slug).get(diagnostic_slug)
 
     @staticmethod
-    def build_from_config(config: Config, db: Database) -> "ProviderRegistry":
+    def build_from_config(
+        config: Config,
+        db: Database,
+        *,
+        configure: bool = True,
+    ) -> "ProviderRegistry":
         """
-        Create a ProviderRegistry instance using information from the database
+        Create a ProviderRegistry instance using information from the database.
 
         Parameters
         ----------
         config
-            Configuration object
+            Configuration object.
         db
-            Database instance
+            Database instance.
+        configure
+            Whether to call each provider's ``configure`` hook.
+            Metadata-only commands can disable this to avoid setup side effects such as conda bootstrap.
 
         Returns
         -------
         :
-            A new ProviderRegistry instance
+            A new ProviderRegistry instance.
         """
         providers = []
         for provider_info in config.diagnostic_providers:
             provider = import_provider(provider_info.provider)
-            provider.configure(config)
+            if configure:
+                provider.configure(config)
             providers.append(provider)
 
         with db.session.begin():
diff --git a/packages/climate-ref/tests/integration/test_native_roundtrip.py b/packages/climate-ref/tests/integration/test_native_roundtrip.py
index 128b13c90..5f864ec3a 100644
--- a/packages/climate-ref/tests/integration/test_native_roundtrip.py
+++ b/packages/climate-ref/tests/integration/test_native_roundtrip.py
@@ -3,36 +3,10 @@
 
 These tests prove the native-baseline lifecycle ``run -> mint -> sync -> replay``
 end-to-end against a *local* content-addressed store
-(:class:`~climate_ref_core.regression.LocalFilesystemStore`) created inside
-``tmp_path``.
-Everything runs fully offline: no R2, no ESGF, no network, and no credentials.
-
-Tests
------
-1. **Synthetic nested-output round-trip** (the main gate) — a small synthetic
-   diagnostic writes *nested* native outputs under a stable ``executions/recipe/``
-   sub-directory and emits a CMEC ``output.json`` whose ``html`` / ``provenance.log``
-   dict *keys* are absolute paths.
-   It exercises both the curated nested-native capture path and the M2
-   absolute-path key-sanitisation path in
-   :func:`~climate_ref_core.regression.assert_bundle_regression`.
-   Its :meth:`build_execution_result` genuinely *reads back* a nested native file,
-   so the round-trip fails if that file is missing after materialisation.
-
-2. **Example smoke round-trip** — the real ``example`` provider's
-   ``GlobalMeanTimeseries`` through ``TestCaseRunner`` on offline sample data,
-   minted to a ``tmp_path`` store, synced, replayed, and tolerantly compared.
-   Skipped (with a clear reason) when the sample-data fixtures are unavailable.
-
-3. **Negative — float drift** — perturbing a committed float beyond ``Tolerance()``
-   raises a path-precise ``AssertionError``; a within-tolerance perturbation passes.
-
-4. **Negative — missing blob** — deleting a referenced blob from the store makes
-   the sync/replay path fail loudly, naming the digest and relpath.
-
-5. **CLI-level tests** — driving ``ref test-cases mint`` / ``sync`` / ``replay``
-   through the project's CLI harness against a ``tmp_path`` store, asserting a
-   zero exit on success and a non-zero exit on forced failure.
+(:class:`~climate_ref_core.regression.LocalFilesystemStore`) created inside ``tmp_path``.
+
+This runs offline, without any credentials.
+
 
 Notes on the shipped capture mechanics (verified against the source)
 --------------------------------------------------------------------
@@ -95,11 +69,6 @@
 _NATIVE_DATA_RELPATH = f"{_RECIPE_SUBDIR}/data/synth_data.bin"
 
 
-# ---------------------------------------------------------------------------
-# Synthetic nested-output diagnostic
-# ---------------------------------------------------------------------------
-
-
 class _SyntheticNestedDiagnostic(Diagnostic):
     """
     A synthetic diagnostic that writes nested native outputs.
@@ -241,11 +210,6 @@ def build_execution_result(self, definition: ExecutionDefinition) -> ExecutionRe
         )
 
 
-# ---------------------------------------------------------------------------
-# Provider + synthetic catalog helpers
-# ---------------------------------------------------------------------------
-
-
 def _build_synthetic_provider() -> DiagnosticProvider:
     """Return a :class:`DiagnosticProvider` carrying the synthetic diagnostic."""
     provider = DiagnosticProvider("SyntheticTest", "0.0.1", slug="synthetic-test")
@@ -347,17 +311,12 @@ def _capture_synthetic(
     )
 
 
-# ---------------------------------------------------------------------------
-# 1. Synthetic nested-output round-trip (the main gate)
-# ---------------------------------------------------------------------------
-
-
 class TestSyntheticNestedRoundTrip:
     """
     Full ``run -> mint -> sync -> replay`` on the synthetic nested-output diagnostic.
 
-    This is the main gate: every layer of the native-baseline system is exercised
-    on nested native outputs with absolute-path dict keys.
+    This exercises every layer of the native-baseline system on nested native outputs
+    with absolute-path dict keys.
     """
 
     def test_run_mint_sync_replay(self, tmp_path: Path) -> None:
@@ -530,11 +489,6 @@ def test_replay_fails_without_nested_native_file(self, tmp_path: Path) -> None:
             definition.diagnostic.build_execution_result(replay_definition)
 
 
-# ---------------------------------------------------------------------------
-# 2. Example smoke round-trip
-# ---------------------------------------------------------------------------
-
-
 @pytest.mark.slow
 class TestExampleSmokeRoundTrip:
     """
@@ -667,11 +621,6 @@ def test_example_roundtrip(self, tmp_path: Path) -> None:  # noqa: PLR0915
         )
 
 
-# ---------------------------------------------------------------------------
-# 3. Negative — float drift beyond tolerance
-# ---------------------------------------------------------------------------
-
-
 class TestNegativeFloatDrift:
     """Perturbing a committed float beyond tolerance produces a path-precise failure."""
 
@@ -750,11 +699,6 @@ def test_float_within_tolerance_passes(self, tmp_path: Path) -> None:
         )
 
 
-# ---------------------------------------------------------------------------
-# 4. Negative — missing blob
-# ---------------------------------------------------------------------------
-
-
 class TestNegativeMissingBlob:
     """Deleting a referenced blob causes a loud, actionable failure."""
 
@@ -828,11 +772,6 @@ def test_missing_blob_detected_on_replay(self, tmp_path: Path) -> None:
         )
 
 
-# ---------------------------------------------------------------------------
-# 5. CLI-level tests
-# ---------------------------------------------------------------------------
-
-
 def _synthetic_cli_case(tmp_path: Path) -> tuple[MagicMock, Diagnostic, MagicMock]:
     """
     Build a ``(registry, diagnostic, test_case)`` trio backed by the synthetic diagnostic.
@@ -947,7 +886,8 @@ def test_replay_fails_on_corrupted_committed_bundle(
         """
         Corrupting the committed bundle after minting makes ``replay`` exit non-zero.
 
-        The committed integrity check fails before native materialisation.
+        The tolerant comparison cannot reconcile the corrupted committed baseline against the
+        regenerated bundle (here it no longer parses as JSON), so replay reports drift.
         """
         registry, diag, _tc = _synthetic_cli_case(tmp_path)
         config = _local_store_config(tmp_path)
diff --git a/packages/climate-ref/tests/unit/cli/test_root.py b/packages/climate-ref/tests/unit/cli/test_root.py
index 70631eec2..342520009 100644
--- a/packages/climate-ref/tests/unit/cli/test_root.py
+++ b/packages/climate-ref/tests/unit/cli/test_root.py
@@ -166,6 +166,7 @@ def test_cli_context_skip_backup(config, mocker):
         (["test-cases", "sync"], True),
         (["test-cases", "replay", "--provider", "example"], True),
         (["test-cases", "mint", "--provider", "example"], True),
+        (["test-cases", "build", "--provider", "example"], True),
         # Data-modifying commands must still take a pre-migration backup.
         (["datasets", "ingest"], False),
         (["providers", "create-env"], False),
diff --git a/packages/climate-ref/tests/unit/cli/test_test_cases.py b/packages/climate-ref/tests/unit/cli/test_test_cases.py
index 44d969b3d..bb050977c 100644
--- a/packages/climate-ref/tests/unit/cli/test_test_cases.py
+++ b/packages/climate-ref/tests/unit/cli/test_test_cases.py
@@ -142,16 +142,14 @@ def test_empty_df_after_filtering(self, caplog):
         assert len(result) == 0
         assert "No matching files found" in caplog.text
 
-    def test_adapter_exception_logged(self, caplog):
-        """Failures in every parent_dir are logged and yield an empty DataFrame."""
+    def test_adapter_exception_raises(self):
+        """A parse failure in any parent_dir aborts with DatasetResolutionError (fail-fast)."""
         mock_adapter = MagicMock()
         mock_adapter.find_local_datasets.side_effect = Exception("Parse error")
 
         file_paths = [Path("/path/to/file.nc")]
-        result = _build_catalog(mock_adapter, file_paths)
-
-        assert result.empty
-        assert "Failed to parse" in caplog.text
+        with pytest.raises(DatasetResolutionError, match="Failed to parse fetched datasets"):
+            _build_catalog(mock_adapter, file_paths)
 
 
 class TestFetchAndBuildCatalog:
@@ -174,7 +172,7 @@ def test_cmip6_data_returned(self, mock_diagnostic, mock_test_case, mock_fetcher
             patch("climate_ref_core.esgf.ESGFFetcher", return_value=mock_fetcher),
             patch("climate_ref.datasets.CMIP6DatasetAdapter", return_value=mock_adapter),
             patch(
-                "climate_ref.cli.test_cases._solve_test_case",
+                "climate_ref.cli.test_cases._catalog._solve_test_case",
                 return_value=mock_datasets,
             ),
             patch(
@@ -199,7 +197,7 @@ def test_saves_catalog_yaml(self, tmp_path, mock_diagnostic, mock_test_case, moc
             patch("climate_ref_core.esgf.ESGFFetcher", return_value=mock_fetcher),
             patch("climate_ref.datasets.CMIP6DatasetAdapter", return_value=mock_adapter),
             patch(
-                "climate_ref.cli.test_cases._solve_test_case",
+                "climate_ref.cli.test_cases._catalog._solve_test_case",
                 return_value=mock_datasets,
             ),
             patch(
@@ -240,7 +238,7 @@ def test_obs4mips_data_returned(self, mock_diagnostic, mock_test_case):
             patch("climate_ref_core.esgf.ESGFFetcher", return_value=mock_fetcher),
             patch("climate_ref.datasets.Obs4MIPsDatasetAdapter", return_value=mock_adapter),
             patch(
-                "climate_ref.cli.test_cases._solve_test_case",
+                "climate_ref.cli.test_cases._catalog._solve_test_case",
                 return_value=mock_datasets,
             ),
             patch(
@@ -319,15 +317,41 @@ def test_fetch_with_provider_filter(self, invoke_cli):
         result = invoke_cli(["test-cases", "fetch", "--provider", "example", "--dry-run"])
         assert result.exit_code == 0
 
-    def test_fetch_with_diagnostic_filter(self, invoke_cli):
-        """Test fetch command with diagnostic filter."""
-        result = invoke_cli(["test-cases", "fetch", "--diagnostic", "nonexistent", "--dry-run"])
-        assert result.exit_code == 0
+    def test_fetch_with_unknown_diagnostic_filter_fails(self, invoke_cli):
+        """Test fetch command with a diagnostic typo fails instead of silently selecting nothing."""
+        result = invoke_cli(
+            ["test-cases", "fetch", "--diagnostic", "nonexistent", "--dry-run"],
+            expected_exit_code=1,
+        )
+        assert "Diagnostic 'nonexistent' was not found" in result.stderr
+
+    def test_fetch_with_unknown_test_case_filter_fails(self, invoke_cli, mocker):
+        """Test fetch command with a test-case typo fails instead of silently selecting nothing."""
+        mock_tc = MagicMock(description="test", requests=[])
+        mock_tc.name = "default"
+        mock_spec = MagicMock(test_cases=[mock_tc])
+        mock_diag = MagicMock(slug="test-diag", test_data_spec=mock_spec)
+        mock_diag.provider = MagicMock(slug="example")
+        mock_provider = MagicMock(slug="example")
+        mock_provider.diagnostics.return_value = [mock_diag]
+        mock_registry = MagicMock(providers=[mock_provider])
+
+        mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=mock_registry,
+        )
+
+        result = invoke_cli(
+            ["test-cases", "fetch", "--provider", "example", "--test-case", "missing", "--dry-run"],
+            expected_exit_code=1,
+        )
+        assert "Test case 'missing' was not found" in result.stderr
 
     def test_fetch_with_test_case_filter(self, invoke_cli, mocker):
         """Test fetch command with test case filter in dry run."""
         mock_request = MagicMock(slug="test-request", source_type="CMIP6")
-        mock_test_case = MagicMock(name="specific-case", description="test", requests=[mock_request])
+        mock_test_case = MagicMock(description="test", requests=[mock_request])
+        mock_test_case.name = "specific-case"
         mock_spec = MagicMock(test_cases=[mock_test_case])
         mock_diag = MagicMock(slug="test-diag", test_data_spec=mock_spec)
         mock_diag.provider = MagicMock(slug="test-provider")
@@ -377,7 +401,7 @@ def test_fetch_continues_on_test_case_failure(self, invoke_cli, mocker, exceptio
         )
 
         fetch_mock = mocker.patch(
-            "climate_ref.cli.test_cases._fetch_and_build_catalog",
+            "climate_ref.cli.test_cases.discovery._fetch_and_build_catalog",
             side_effect=[exception, (MagicMock(), True)],
         )
 
@@ -386,6 +410,70 @@ def test_fetch_continues_on_test_case_failure(self, invoke_cli, mocker, exceptio
         assert result.exit_code == 0
         assert fetch_mock.call_count == 2
 
+    def test_fetch_existing_catalog_explains_refresh(self, invoke_cli, mocker, tmp_path):
+        """Existing catalogs are refreshed by default, with a pointer to --only-missing."""
+        mock_tc = MagicMock(description="test", requests=[MagicMock()])
+        mock_tc.name = "default"
+        mock_spec = MagicMock(test_cases=[mock_tc])
+        mock_diag = MagicMock(slug="test-diag", test_data_spec=mock_spec)
+        mock_diag.provider = MagicMock(slug="example")
+        mock_provider = MagicMock(slug="example")
+        mock_provider.diagnostics.return_value = [mock_diag]
+        mock_registry = MagicMock(providers=[mock_provider])
+
+        case_dir = tmp_path / "case"
+        case_dir.mkdir()
+        catalog = case_dir / "catalog.yaml"
+        catalog.touch()
+        paths = MagicMock(catalog=catalog)
+
+        mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=mock_registry,
+        )
+        mocker.patch("climate_ref_core.testing.TestCasePaths.from_diagnostic", return_value=paths)
+        fetch_mock = mocker.patch(
+            "climate_ref.cli.test_cases.discovery._fetch_and_build_catalog",
+            return_value=(MagicMock(), False),
+        )
+
+        result = invoke_cli(["test-cases", "fetch", "--provider", "example"])
+
+        assert result.exit_code == 0
+        assert "Refreshing existing catalog for default" in result.stderr
+        assert "use --only-missing to skip existing catalogs" in result.stderr
+        fetch_mock.assert_called_once()
+
+    def test_fetch_only_missing_skips_existing_catalog(self, invoke_cli, mocker, tmp_path):
+        """--only-missing avoids ESGF work when a catalog already exists."""
+        mock_tc = MagicMock(description="test", requests=[MagicMock()])
+        mock_tc.name = "default"
+        mock_spec = MagicMock(test_cases=[mock_tc])
+        mock_diag = MagicMock(slug="test-diag", test_data_spec=mock_spec)
+        mock_diag.provider = MagicMock(slug="example")
+        mock_provider = MagicMock(slug="example")
+        mock_provider.diagnostics.return_value = [mock_diag]
+        mock_registry = MagicMock(providers=[mock_provider])
+
+        case_dir = tmp_path / "case"
+        case_dir.mkdir()
+        catalog = case_dir / "catalog.yaml"
+        catalog.touch()
+        paths = MagicMock(catalog=catalog)
+
+        mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=mock_registry,
+        )
+        mocker.patch("climate_ref_core.testing.TestCasePaths.from_diagnostic", return_value=paths)
+        fetch_mock = mocker.patch("climate_ref.cli.test_cases.discovery._fetch_and_build_catalog")
+
+        result = invoke_cli(["test-cases", "fetch", "--provider", "example", "--only-missing"])
+
+        assert result.exit_code == 0
+        assert "Skipping test case: default (catalog exists)" in result.stderr
+        fetch_mock.assert_not_called()
+
 
 class TestListCasesCommand:
     """Tests for list test cases CLI command."""
@@ -406,6 +494,76 @@ def test_list_with_provider_filter(self, invoke_cli):
         result = invoke_cli(["test-cases", "list", "--provider", "example"])
         assert result.exit_code == 0
 
+    def test_list_does_not_configure_providers(self, invoke_cli, mocker):
+        """Listing metadata avoids provider configure hooks with setup side effects."""
+        mock_registry = MagicMock(providers=[])
+        build_registry = mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=mock_registry,
+        )
+
+        result = invoke_cli(["test-cases", "list"])
+
+        assert result.exit_code == 0
+        assert build_registry.call_args.kwargs["configure"] is False
+
+    def test_list_compact_default_hides_descriptions(self, invoke_cli, mocker):
+        """The default list view stays scannable by omitting descriptions."""
+        mock_tc = MagicMock(description="long description", requests=[])
+        mock_tc.name = "default"
+        mock_spec = MagicMock(test_cases=[mock_tc])
+        mock_diag = MagicMock(slug="test-diag", test_data_spec=mock_spec)
+        mock_provider = MagicMock(slug="example")
+        mock_provider.diagnostics.return_value = [mock_diag]
+        mock_registry = MagicMock(providers=[mock_provider])
+
+        mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=mock_registry,
+        )
+        mocker.patch("climate_ref_core.testing.TestCasePaths.from_diagnostic", return_value=None)
+
+        result = invoke_cli(["test-cases", "list"])
+
+        assert result.exit_code == 0
+        assert "long description" not in result.stdout
+        assert "test-diag" in result.stdout
+
+    def test_list_summary_counts_missing_artifacts(self, invoke_cli, mocker, tmp_path):
+        """The list summary reports missing catalog and regression counts."""
+        from climate_ref_core.testing import TestCasePaths
+
+        tc_catalog_only = MagicMock(description="catalog", requests=[])
+        tc_catalog_only.name = "catalog-only"
+        tc_regression_only = MagicMock(description="regression", requests=[])
+        tc_regression_only.name = "regression-only"
+        mock_spec = MagicMock(test_cases=[tc_catalog_only, tc_regression_only])
+        mock_diag = MagicMock(slug="test-diag", test_data_spec=mock_spec)
+        mock_provider = MagicMock(slug="example")
+        mock_provider.diagnostics.return_value = [mock_diag]
+        mock_registry = MagicMock(providers=[mock_provider])
+
+        catalog_only = TestCasePaths(root=tmp_path / "catalog-only")
+        catalog_only.root.mkdir()
+        catalog_only.catalog.touch()
+        regression_only = TestCasePaths(root=tmp_path / "regression-only")
+        regression_only.root.mkdir()
+        regression_only.regression.mkdir()
+
+        mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=mock_registry,
+        )
+        mocker.patch(
+            "climate_ref_core.testing.TestCasePaths.from_diagnostic",
+            side_effect=[catalog_only, regression_only],
+        )
+
+        result = invoke_cli(["test-cases", "list"])
+
+        assert result.exit_code == 0
+        assert "2 test case(s); 1 missing catalog(s); 1 missing regression baseline(s)" in result.stdout
+
     def test_list_shows_no_test_data_spec(self, invoke_cli, mocker):
         """Test that list shows diagnostics without test_data_spec."""
         mock_diag = MagicMock(slug="no-spec-diag", test_data_spec=None)
@@ -418,7 +576,7 @@ def test_list_shows_no_test_data_spec(self, invoke_cli, mocker):
             return_value=mock_registry,
         )
 
-        result = invoke_cli(["test-cases", "list"])
+        result = invoke_cli(["test-cases", "list", "--verbose"])
         assert result.exit_code == 0
         assert "no test_data_spec" in result.stdout
 
@@ -453,6 +611,8 @@ def test_run_help(self, invoke_cli):
         """Test run command help."""
         result = invoke_cli(["test-cases", "run", "--help"])
         assert "Run test cases for diagnostics" in result.stdout
+        assert "Scratch directory" in result.stdout
+        assert "output/<label>" in result.stdout
 
     def test_run_nonexistent_diagnostic(self, invoke_cli):
         """Test running non-existent diagnostic."""
@@ -481,7 +641,7 @@ def test_run_diagnostic_no_test_data_spec(self, invoke_cli, mocker):
         assert "No test cases found" in result.stderr
 
     def test_run_nonexistent_test_case(self, invoke_cli, mocker):
-        """Test running non-existent test case shows warning and exits 0."""
+        """Test running a non-existent test case fails instead of silently selecting nothing."""
         mock_tc = MagicMock(name="default", description="test")
         mock_spec = MagicMock()
         mock_spec.test_cases = [mock_tc]
@@ -495,7 +655,6 @@ def test_run_nonexistent_test_case(self, invoke_cli, mocker):
             return_value=mock_registry,
         )
 
-        # Filtering for nonexistent test case finds nothing, exit 0
         result = invoke_cli(
             [
                 "test-cases",
@@ -507,9 +666,9 @@ def test_run_nonexistent_test_case(self, invoke_cli, mocker):
                 "--test-case",
                 "nonexistent",
             ],
-            expected_exit_code=0,
+            expected_exit_code=1,
         )
-        assert "No test cases found" in result.stderr
+        assert "Test case 'nonexistent' was not found" in result.stderr
 
     def test_run_no_test_case_dir(self, invoke_cli, mocker):
         """Test run command when test case directory can't be resolved fails the test case."""
@@ -536,33 +695,9 @@ def test_run_no_test_case_dir(self, invoke_cli, mocker):
             expected_exit_code=1,
         )
 
-    def test_run_with_fetch_flag(self, invoke_cli, mocker):
-        """Test run command with --fetch flag fetches data first."""
-        mock_tc = MagicMock()
-        mock_tc.name = "default"
-        mock_tc.description = "test"
-        mock_spec = MagicMock()
-        mock_spec.test_cases = [mock_tc]
-        mock_diag = MagicMock(slug="test-diag", test_data_spec=mock_spec)
-        mock_diag.provider = MagicMock(slug="example")
-        mock_provider = MagicMock(slug="example")
-        mock_provider.diagnostics.return_value = [mock_diag]
-        mock_registry = MagicMock(providers=[mock_provider])
-
-        mock_result = MagicMock(successful=True, metric_bundle_filename=None, output_bundle_filename=None)
-        mock_runner = MagicMock()
-        mock_runner.run.return_value = mock_result
-
-        mocker.patch(
-            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
-            return_value=mock_registry,
-        )
-        mocker.patch(
-            "climate_ref.cli.test_cases._fetch_and_build_catalog",
-            return_value=(MagicMock(), True),
-        )
-        mocker.patch("climate_ref.testing.TestCaseRunner", return_value=mock_runner)
-        mocker.patch("climate_ref_core.testing.TestCasePaths.from_diagnostic", return_value=None)
+    def test_run_with_fetch_flag(self, invoke_cli, mocker, tmp_path):
+        """`run --fetch` fetches data, executes, and materialises the output slot (exit 0)."""
+        paths, _scratch, _regression, _runner = _setup_real_run(mocker, tmp_path, fetch=True)
 
         result = invoke_cli(
             [
@@ -576,6 +711,8 @@ def test_run_with_fetch_flag(self, invoke_cli, mocker):
             ],
         )
         assert result.exit_code == 0
+        # The slot was populated with the executed native set.
+        assert (paths.output_slot("latest") / "diagnostic.json").exists()
 
     def test_run_with_fetch_flag_raises_error(self, invoke_cli, mocker):
         """Test run command with --fetch flag handles DatasetResolutionError."""
@@ -595,7 +732,7 @@ def test_run_with_fetch_flag_raises_error(self, invoke_cli, mocker):
             return_value=mock_registry,
         )
         mocker.patch(
-            "climate_ref.cli.test_cases._fetch_and_build_catalog",
+            "climate_ref.cli.test_cases.run._fetch_and_build_catalog",
             side_effect=DatasetResolutionError("No datasets found"),
         )
 
@@ -622,39 +759,8 @@ def test_run_with_fetch_flag_raises_error(self, invoke_cli, mocker):
         ],
     )
     def test_run_handles_exceptions(self, invoke_cli, mocker, tmp_path, exception_cls, exception_msg):
-        """Test run command handles various exceptions from runner."""
-        mock_tc = MagicMock()
-        mock_tc.name = "default"
-        mock_tc.description = "test"
-        mock_spec = MagicMock()
-        mock_spec.test_cases = [mock_tc]
-        mock_diag = MagicMock(slug="test-diag", test_data_spec=mock_spec)
-        mock_diag.provider = MagicMock(slug="example")
-        mock_provider = MagicMock(slug="example")
-        mock_provider.diagnostics.return_value = [mock_diag]
-        mock_registry = MagicMock(providers=[mock_provider])
-
-        test_case_dir = tmp_path / "test-diag" / "default"
-        test_case_dir.mkdir(parents=True)
-        catalog_path = test_case_dir / "catalog.yaml"
-        catalog_path.touch()
-
-        mock_paths = MagicMock()
-        mock_paths.catalog = catalog_path
-
-        mock_runner = MagicMock()
-        mock_runner.run.side_effect = exception_cls(exception_msg)
-
-        mocker.patch(
-            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
-            return_value=mock_registry,
-        )
-        mocker.patch(
-            "climate_ref_core.testing.TestCasePaths.from_diagnostic",
-            return_value=mock_paths,
-        )
-        mocker.patch("climate_ref_core.testing.load_datasets_from_yaml", return_value=MagicMock())
-        mocker.patch("climate_ref.testing.TestCaseRunner", return_value=mock_runner)
+        """A diagnostic execution exception is caught and fails the test case (exit 1)."""
+        _setup_real_run(mocker, tmp_path, runner_result=exception_cls(exception_msg))
 
         invoke_cli(
             ["test-cases", "run", "--provider", "example", "--diagnostic", "test-diag"],
@@ -662,90 +768,42 @@ def test_run_handles_exceptions(self, invoke_cli, mocker, tmp_path, exception_cl
         )
 
     def test_run_successful_execution(self, invoke_cli, mocker, tmp_path):
-        """Test run command with successful execution."""
-        mock_tc = MagicMock()
-        mock_tc.name = "default"
-        mock_tc.description = "test"
-        mock_spec = MagicMock()
-        mock_spec.test_cases = [mock_tc]
-        mock_diag = MagicMock(slug="test-diag", test_data_spec=mock_spec)
-        mock_diag.provider = MagicMock(slug="example")
-        mock_provider = MagicMock(slug="example")
-        mock_provider.diagnostics.return_value = [mock_diag]
-        mock_registry = MagicMock(providers=[mock_provider])
-
-        test_case_dir = tmp_path / "test-diag" / "default"
-        test_case_dir.mkdir(parents=True)
-        catalog_path = test_case_dir / "catalog.yaml"
-        catalog_path.touch()
-
-        # Create existing regression dir to avoid copy being triggered
-        regression_dir = test_case_dir / "regression"
-        regression_dir.mkdir()
-
-        mock_paths = MagicMock()
-        mock_paths.catalog = catalog_path
-        mock_paths.regression = regression_dir  # Use real dir that exists
-
-        mock_result = MagicMock(
-            successful=True,
-            metric_bundle_filename="metrics.json",
-            output_bundle_filename="output.json",
-        )
-        mock_result.to_output_path.side_effect = lambda x: tmp_path / x
-        mock_runner = MagicMock()
-        mock_runner.run.return_value = mock_result
-
-        mocker.patch(
-            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
-            return_value=mock_registry,
-        )
-        mocker.patch(
-            "climate_ref_core.testing.TestCasePaths.from_diagnostic",
-            return_value=mock_paths,
-        )
-        mocker.patch("climate_ref_core.testing.load_datasets_from_yaml", return_value=MagicMock())
-        mocker.patch("climate_ref.testing.TestCaseRunner", return_value=mock_runner)
+        """A successful execution writes the slot and exits 0 (baseline already present)."""
+        paths, _scratch, _regression, _runner = _setup_real_run(mocker, tmp_path, regression_files={})
 
         result = invoke_cli(
             ["test-cases", "run", "--provider", "example", "--diagnostic", "test-diag"],
         )
         assert result.exit_code == 0
+        # The slot holds the rebuilt committed bundle even when the baseline is untouched.
+        assert (paths.output_slot("latest") / "regression" / "diagnostic.json").exists()
 
-    def test_run_unsuccessful_execution(self, invoke_cli, mocker, tmp_path):
-        """Test run command with unsuccessful execution result."""
-        mock_tc = MagicMock()
-        mock_tc.name = "default"
-        mock_tc.description = "test"
-        mock_spec = MagicMock()
-        mock_spec.test_cases = [mock_tc]
-        mock_diag = MagicMock(slug="test-diag", test_data_spec=mock_spec)
-        mock_diag.provider = MagicMock(slug="example")
-        mock_provider = MagicMock(slug="example")
-        mock_provider.diagnostics.return_value = [mock_diag]
-        mock_registry = MagicMock(providers=[mock_provider])
-
-        test_case_dir = tmp_path / "test-diag" / "default"
-        test_case_dir.mkdir(parents=True)
-        catalog_path = test_case_dir / "catalog.yaml"
-        catalog_path.touch()
+    def test_run_output_directory_logs_scratch_and_slot_semantics(self, invoke_cli, mocker, tmp_path):
+        """--output-directory is explained as scratch output, not the only written location."""
+        paths, _scratch, _regression, _runner = _setup_real_run(mocker, tmp_path, regression_files={})
+        scratch = tmp_path / "scratch-output"
 
-        mock_paths = MagicMock()
-        mock_paths.catalog = catalog_path
+        result = invoke_cli(
+            [
+                "test-cases",
+                "run",
+                "--provider",
+                "example",
+                "--diagnostic",
+                "test-diag",
+                "--output-directory",
+                str(scratch),
+            ],
+        )
 
-        mock_runner = MagicMock()
-        mock_runner.run.return_value = MagicMock(successful=False)
+        assert result.exit_code == 0
+        assert f"Using {scratch} as the execution scratch directory" in result.stderr
+        assert "gitignored output/latest slot" in result.stderr
+        assert (paths.output_slot("latest") / "regression" / "diagnostic.json").exists()
 
-        mocker.patch(
-            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
-            return_value=mock_registry,
-        )
-        mocker.patch(
-            "climate_ref_core.testing.TestCasePaths.from_diagnostic",
-            return_value=mock_paths,
-        )
-        mocker.patch("climate_ref_core.testing.load_datasets_from_yaml", return_value=MagicMock())
-        mocker.patch("climate_ref.testing.TestCaseRunner", return_value=mock_runner)
+    def test_run_unsuccessful_execution(self, invoke_cli, mocker, tmp_path):
+        """An unsuccessful execution result fails the test case (exit 1)."""
+        _setup_real_run(mocker, tmp_path, runner_result="unsuccessful")
 
         invoke_cli(
             ["test-cases", "run", "--provider", "example", "--diagnostic", "test-diag"],
@@ -848,63 +906,21 @@ def test_run_with_force_regen(self, invoke_cli, mocker, tmp_path):
         }
 
     def test_run_with_existing_baseline(self, invoke_cli, mocker, tmp_path):
-        """Test run command logs when baseline exists."""
-        mock_tc = MagicMock()
-        mock_tc.name = "default"
-        mock_tc.description = "test"
-        mock_spec = MagicMock()
-        mock_spec.test_cases = [mock_tc]
-        mock_diag = MagicMock(slug="test-diag", test_data_spec=mock_spec)
-        mock_diag.provider = MagicMock(slug="example")
-        mock_provider = MagicMock(slug="example")
-        mock_provider.diagnostics.return_value = [mock_diag]
-        mock_registry = MagicMock(providers=[mock_provider])
-
-        # Set up test case directory structure with existing regression data
-        test_case_dir = tmp_path / "test-diag" / "default"
-        test_case_dir.mkdir(parents=True)
-        catalog_path = test_case_dir / "catalog.yaml"
-        catalog_path.touch()
-
-        # Create existing regression directory with baseline file
-        regression_dir = test_case_dir / "regression"
-        regression_dir.mkdir(parents=True)
-        baseline_file = regression_dir / "metrics.json"
-        baseline_file.write_text('{"existing": "baseline"}')
-
-        mock_paths = MagicMock()
-        mock_paths.catalog = catalog_path
-        mock_paths.regression = regression_dir
-
-        mock_result = MagicMock(
-            successful=True,
-            metric_bundle_filename="metrics.json",
-            output_bundle_filename=None,
-        )
-        mock_result.to_output_path.return_value = tmp_path / "metrics.json"
-        mock_runner = MagicMock()
-        mock_runner.run.return_value = mock_result
-
-        mocker.patch(
-            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
-            return_value=mock_registry,
-        )
-        mocker.patch(
-            "climate_ref_core.testing.TestCasePaths.from_diagnostic",
-            return_value=mock_paths,
-        )
-        mocker.patch("climate_ref_core.testing.load_datasets_from_yaml", return_value=MagicMock())
-        mocker.patch("climate_ref.testing.TestCaseRunner", return_value=mock_runner)
-
-        result = invoke_cli(
-            ["test-cases", "run", "--provider", "example", "--diagnostic", "test-diag"],
-        )
-        assert result.exit_code == 0
-        # Without --force-regen, baseline should be unchanged
-        assert baseline_file.read_text() == '{"existing": "baseline"}'
-
-    def test_run_with_only_missing_skips_existing(self, invoke_cli, mocker, tmp_path):
-        """Test run command with --only-missing skips test cases with existing regression data."""
+        """Without --force-regen, an existing baseline is left untouched (promotion gate)."""
+        _paths, _scratch, regression_dir, _runner = _setup_real_run(
+            mocker, tmp_path, regression_files={"metrics.json": '{"existing": "baseline"}'}
+        )
+        baseline_file = regression_dir / "metrics.json"
+
+        result = invoke_cli(
+            ["test-cases", "run", "--provider", "example", "--diagnostic", "test-diag"],
+        )
+        assert result.exit_code == 0
+        # Without --force-regen, the committed baseline is not promoted.
+        assert baseline_file.read_text() == '{"existing": "baseline"}'
+
+    def test_run_with_only_missing_skips_existing(self, invoke_cli, mocker, tmp_path):
+        """Test run command with --only-missing skips test cases with existing regression data."""
         mock_tc = MagicMock()
         mock_tc.name = "default"
         mock_tc.description = "test"
@@ -937,7 +953,8 @@ def test_run_with_only_missing_skips_existing(self, invoke_cli, mocker, tmp_path
             ["test-cases", "run", "--provider", "example", "--only-missing"],
             expected_exit_code=0,
         )
-        assert "No test cases found" in result.stderr or "skipped" in result.stderr.lower()
+        assert "All 1 matching test case(s) skipped" in result.stderr
+        assert "No test cases found" not in result.stderr
 
     def test_run_with_if_changed_skips_unchanged(self, invoke_cli, mocker, tmp_path):
         """Test run command with --if-changed skips test cases with unchanged catalogs."""
@@ -972,7 +989,72 @@ def test_run_with_if_changed_skips_unchanged(self, invoke_cli, mocker, tmp_path)
             ["test-cases", "run", "--provider", "example", "--if-changed"],
             expected_exit_code=0,
         )
-        assert "No test cases found" in result.stderr
+        assert "All 1 matching test case(s) skipped because catalogs are unchanged" in result.stderr
+
+    def test_run_label_slots_coexist(self, invoke_cli, mocker, tmp_path):
+        """Two runs under different --label slots persist side by side."""
+        paths, _scratch, _regression, _runner = _setup_real_run(mocker, tmp_path)
+
+        for label in ("before", "after"):
+            assert (
+                invoke_cli(
+                    [
+                        "test-cases",
+                        "run",
+                        "--provider",
+                        "example",
+                        "--diagnostic",
+                        "test-diag",
+                        "--label",
+                        label,
+                        "--force-regen",
+                    ]
+                ).exit_code
+                == 0
+            )
+
+        assert (paths.output_slot("before") / "diagnostic.json").exists()
+        assert (paths.output_slot("after") / "diagnostic.json").exists()
+        # The default slot was never written.
+        assert not paths.output_slot("latest").exists()
+
+    def test_run_force_regen_promotes_over_existing_baseline(self, invoke_cli, mocker, tmp_path):
+        """--force-regen replaces an existing committed baseline with the freshly built bundle."""
+        _paths, _scratch, regression_dir, _runner = _setup_real_run(
+            mocker, tmp_path, regression_files={"diagnostic.json": '{"old": "baseline"}'}
+        )
+
+        assert (
+            invoke_cli(
+                ["test-cases", "run", "--provider", "example", "--diagnostic", "test-diag", "--force-regen"]
+            ).exit_code
+            == 0
+        )
+        # The stale baseline was promoted over by the rebuilt bundle.
+        assert (regression_dir / "diagnostic.json").read_text() != '{"old": "baseline"}'
+
+    def test_run_warns_when_native_stale(self, invoke_cli, mocker, tmp_path):
+        """force-regen warns (does not block) when the rebuilt native differs from the minted baseline."""
+        from climate_ref_core.regression.manifest import SCHEMA_VERSION, Manifest, NativeEntry
+
+        paths, _scratch, _regression, _runner = _setup_real_run(mocker, tmp_path, regression_files={})
+        # A previously minted manifest whose native digests will not match the freshly built slot.
+        Manifest(
+            schema=SCHEMA_VERSION,
+            test_case_version=3,
+            committed={},
+            native={"diagnostic.json": NativeEntry(sha256="00" * 32, size=1)},
+        ).dump(paths.manifest)
+
+        result = invoke_cli(
+            ["test-cases", "run", "--provider", "example", "--diagnostic", "test-diag", "--force-regen"]
+        )
+        assert result.exit_code == 0
+        assert "native baseline differs" in result.stderr
+        # run preserves the mint-owned native block and version (it never authors native).
+        manifest = Manifest.load(paths.manifest)
+        assert manifest.test_case_version == 3
+        assert set(manifest.native) == {"diagnostic.json"}
 
 
 class TestFetchAndBuildCatalogSourceTypes:
@@ -1004,7 +1086,7 @@ def test_cmip7_data_returned(self, mock_diagnostic, mock_test_case):
             patch("climate_ref_core.esgf.ESGFFetcher", return_value=mock_fetcher),
             patch("climate_ref.datasets.CMIP7DatasetAdapter", return_value=mock_adapter),
             patch(
-                "climate_ref.cli.test_cases._solve_test_case",
+                "climate_ref.cli.test_cases._catalog._solve_test_case",
                 return_value=mock_datasets,
             ),
             patch(
@@ -1046,7 +1128,7 @@ def test_pmp_climatology_data_returned(self, mock_diagnostic, mock_test_case):
                 return_value=mock_adapter,
             ),
             patch(
-                "climate_ref.cli.test_cases._solve_test_case",
+                "climate_ref.cli.test_cases._catalog._solve_test_case",
                 return_value=mock_datasets,
             ),
             patch(
@@ -1087,7 +1169,7 @@ def test_force_flag_passed_to_save(self, tmp_path, mock_diagnostic, mock_test_ca
             patch("climate_ref_core.esgf.ESGFFetcher", return_value=mock_fetcher),
             patch("climate_ref.datasets.CMIP6DatasetAdapter", return_value=mock_adapter),
             patch(
-                "climate_ref.cli.test_cases._solve_test_case",
+                "climate_ref.cli.test_cases._catalog._solve_test_case",
                 return_value=mock_datasets,
             ),
             patch(
@@ -1142,7 +1224,7 @@ def test_mixed_source_types(self, mock_diagnostic, mock_test_case):
                 return_value=mock_obs_adapter,
             ),
             patch(
-                "climate_ref.cli.test_cases._solve_test_case",
+                "climate_ref.cli.test_cases._catalog._solve_test_case",
                 return_value=mock_datasets,
             ),
             patch(
@@ -1325,6 +1407,90 @@ def _make_case_mocks():
     return registry, diag, tc
 
 
+def _setup_real_run(mocker, tmp_path, *, runner_result="success", regression_files=None, fetch=False):
+    """
+    Wire a ``run``/``build`` test against a real ``TestCasePaths`` and scratch execution dir.
+
+    The slot-based ``run`` materialises ``output/<label>/`` on every invocation, so it needs
+    real on-disk paths (a ``MagicMock`` slot cannot be wiped or recreated). This builds a real
+    test case directory plus a scratch output dir holding a curated CMEC bundle, and a mock
+    runner whose result points at that scratch dir.
+
+    Parameters
+    ----------
+    runner_result
+        ``"success"`` (default) for a successful result, ``"unsuccessful"`` for
+        ``successful=False``, or an ``Exception`` instance for the runner to raise.
+    regression_files
+        ``{filename: text}`` pre-written into ``regression/`` (creating it), or ``None`` to
+        leave the baseline absent.
+    fetch
+        When True, patch ``_fetch_and_build_catalog`` (for ``run --fetch``) instead of
+        ``load_datasets_from_yaml``.
+
+    Returns
+    -------
+    :
+        ``(paths, scratch_output_dir, regression_dir, runner)``.
+    """
+    from climate_ref_core.pycmec.output import CMECOutput
+    from climate_ref_core.testing import TestCasePaths
+
+    registry, _diag, _tc = _make_case_mocks()
+
+    test_case_dir = tmp_path / "td" / "test-diag" / "default"
+    test_case_dir.mkdir(parents=True)
+    # A minimal but valid catalog so the real load_datasets_from_yaml returns an empty
+    # ExecutionDatasetCollection. The slot stages load the catalog directly (via the stages
+    # module's own binding), so patching only climate_ref_core.testing would not reach them.
+    (test_case_dir / "catalog.yaml").write_text("_metadata:\n  hash: abc123\n")
+    paths = TestCasePaths(root=test_case_dir)
+
+    if regression_files is not None:
+        paths.regression.mkdir(parents=True)
+        for name, text in regression_files.items():
+            (paths.regression / name).write_text(text)
+
+    scratch_output_dir = tmp_path / "scratch" / "frag"
+    scratch_output_dir.mkdir(parents=True)
+    (scratch_output_dir / "diagnostic.json").write_text('{"test": "data"}')
+    (scratch_output_dir / "output.json").write_text(json.dumps(CMECOutput.create_template()))
+    (scratch_output_dir / "series.json").write_text("[]")
+
+    defn = MagicMock()
+    defn.output_directory = scratch_output_dir
+    defn.output_fragment.return_value = Path("frag")
+    result = MagicMock(
+        successful=(runner_result == "success"),
+        metric_bundle_filename=Path("diagnostic.json"),
+        output_bundle_filename=Path("output.json"),
+        series_filename=Path("series.json"),
+    )
+    result.to_output_path.side_effect = lambda f: scratch_output_dir / f
+    result.definition = defn
+
+    runner = MagicMock()
+    if isinstance(runner_result, BaseException):
+        runner.run.side_effect = runner_result
+    else:
+        runner.run.return_value = result
+
+    mocker.patch(
+        "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+        return_value=registry,
+    )
+    mocker.patch("climate_ref_core.testing.TestCasePaths.from_diagnostic", return_value=paths)
+    mocker.patch("climate_ref.testing.TestCaseRunner", return_value=runner)
+    mocker.patch("climate_ref_core.testing.get_catalog_hash", return_value="abc123")
+    if fetch:
+        mocker.patch(
+            "climate_ref.cli.test_cases.run._fetch_and_build_catalog",
+            return_value=(MagicMock(), True),
+        )
+
+    return paths, scratch_output_dir, paths.regression, runner
+
+
 class TestSyncCommand:
     """Tests for the `test-cases sync` CLI verb."""
 
@@ -1392,6 +1558,126 @@ def test_sync_hard_fails_on_unservable_blob(self, invoke_cli, mocker, tmp_path):
 
         invoke_cli(["test-cases", "sync", "--provider", "example"], expected_exit_code=1)
 
+    def test_sync_nonexistent_provider(self, invoke_cli, mocker):
+        """sync with an unknown provider exits 1 rather than silently syncing nothing."""
+        registry, _diag, _tc = _make_case_mocks()
+        mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=registry,
+        )
+
+        result = invoke_cli(
+            ["test-cases", "sync", "--provider", "nonexistent"],
+            expected_exit_code=1,
+        )
+        assert "not configured" in result.stderr
+
+    def test_sync_nonexistent_diagnostic(self, invoke_cli, mocker):
+        """sync with a bad diagnostic filter fails instead of reporting a zero sync."""
+        registry, _diag, _tc = _make_case_mocks()
+        mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=registry,
+        )
+
+        result = invoke_cli(
+            ["test-cases", "sync", "--provider", "example", "--diagnostic", "missing"],
+            expected_exit_code=1,
+        )
+        assert "Diagnostic 'missing' was not found" in result.stderr
+
+    def test_sync_nonexistent_test_case(self, invoke_cli, mocker):
+        """sync with a bad test-case filter fails instead of reporting a zero sync."""
+        registry, _diag, _tc = _make_case_mocks()
+        mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=registry,
+        )
+
+        result = invoke_cli(
+            ["test-cases", "sync", "--provider", "example", "--test-case", "missing"],
+            expected_exit_code=1,
+        )
+        assert "Test case 'missing' was not found" in result.stderr
+
+
+class TestStageCompare:
+    """`stage_compare` drives replay verification from the manifest's committed set."""
+
+    @staticmethod
+    def _paths_and_slot(tmp_path):
+        from climate_ref_core.testing import TestCasePaths
+
+        case_dir = tmp_path / "td" / "test-diag" / "default"
+        case_dir.mkdir(parents=True)
+        paths = TestCasePaths(root=case_dir)
+        paths.regression.mkdir(parents=True)
+        slot = tmp_path / "slot"
+        (slot / "regression").mkdir(parents=True)
+        return paths, slot
+
+    def test_missing_baseline_is_hard_failure(self, tmp_path):
+        """A committed file the manifest expects but that is absent from regression/ fails the replay."""
+        from climate_ref.cli.test_cases._stages import stage_compare
+
+        paths, slot = self._paths_and_slot(tmp_path)
+        # The rebuild produced a bundle, but the tracked baseline is missing entirely.
+        (slot / "regression" / "diagnostic.json").write_text("{}")
+
+        failures, compared = stage_compare(slot=slot, paths=paths, slug="x", expected=["diagnostic.json"])
+        assert compared == []
+        assert any("baseline file missing" in f for f in failures)
+
+    def test_missing_regenerated_is_hard_failure(self, tmp_path):
+        """A committed file present in the baseline but not regenerated by the rebuild fails the replay."""
+        from climate_ref.cli.test_cases._stages import stage_compare
+
+        paths, slot = self._paths_and_slot(tmp_path)
+        (paths.regression / "diagnostic.json").write_text("{}")
+
+        failures, compared = stage_compare(slot=slot, paths=paths, slug="x", expected=["diagnostic.json"])
+        assert compared == []
+        assert any("did not regenerate" in f for f in failures)
+
+    def test_empty_expected_is_hard_failure(self, tmp_path):
+        """A replay that would compare nothing must fail rather than report a green match."""
+        from climate_ref.cli.test_cases._stages import stage_compare
+
+        paths, slot = self._paths_and_slot(tmp_path)
+        failures, compared = stage_compare(slot=slot, paths=paths, slug="x", expected=[])
+        assert compared == []
+        assert failures and "no committed bundle" in failures[0]
+
+    def test_present_on_both_sides_is_compared(self, tmp_path, mocker):
+        """When both sides hold the expected file, it is compared (and reported as compared)."""
+        from climate_ref.cli.test_cases import _stages
+
+        paths, slot = self._paths_and_slot(tmp_path)
+        (paths.regression / "diagnostic.json").write_text("{}")
+        (slot / "regression" / "diagnostic.json").write_text("{}")
+        # Isolate from CMEC bundle parsing: a no-op comparator stands in for "no drift".
+        assert_mock = mocker.patch.object(_stages, "assert_bundle_regression")
+
+        failures, compared = _stages.stage_compare(
+            slot=slot, paths=paths, slug="x", expected=["diagnostic.json"]
+        )
+        assert failures == []
+        assert compared == ["diagnostic.json"]
+        assert_mock.assert_called_once()
+
+    def test_unparseable_baseline_is_hard_failure(self, tmp_path):
+        """A committed baseline that no longer parses as JSON fails cleanly rather than crashing."""
+        from climate_ref.cli.test_cases._stages import stage_compare
+
+        paths, slot = self._paths_and_slot(tmp_path)
+        # A corrupted committed baseline: valid JSON with trailing garbage appended.
+        (paths.regression / "diagnostic.json").write_text("{}\n// drift\n")
+        (slot / "regression" / "diagnostic.json").write_text("{}")
+
+        failures, compared = stage_compare(slot=slot, paths=paths, slug="x", expected=["diagnostic.json"])
+        assert compared == []
+        assert any("not valid JSON" in f for f in failures)
+
 
 class TestReplayCommand:
     """Tests for the `test-cases replay` CLI verb."""
@@ -1440,6 +1726,52 @@ def test_replay_empty_native_is_hard_failure(self, invoke_cli, mocker, tmp_path)
         )
         assert "not yet minted" in result.stderr.lower() or "mint" in result.stderr.lower()
 
+    def test_replay_nonexistent_provider(self, invoke_cli, mocker):
+        """replay with an unknown provider exits 1 rather than reporting 'no test cases'."""
+        registry, _diag, _tc = _make_case_mocks()
+        mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=registry,
+        )
+
+        result = invoke_cli(
+            ["test-cases", "replay", "--provider", "nonexistent"],
+            expected_exit_code=1,
+        )
+        assert "not configured" in result.stderr
+
+    def test_replay_nonexistent_diagnostic(self, invoke_cli, mocker):
+        """replay with a bad diagnostic filter fails before opening the native store."""
+        registry, _diag, _tc = _make_case_mocks()
+        mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=registry,
+        )
+        store_builder = mocker.patch("climate_ref_core.regression.store.build_native_store")
+
+        result = invoke_cli(
+            ["test-cases", "replay", "--provider", "example", "--diagnostic", "missing"],
+            expected_exit_code=1,
+        )
+        assert "Diagnostic 'missing' was not found" in result.stderr
+        store_builder.assert_not_called()
+
+    def test_replay_nonexistent_test_case(self, invoke_cli, mocker):
+        """replay with a bad test-case filter fails before opening the native store."""
+        registry, _diag, _tc = _make_case_mocks()
+        mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=registry,
+        )
+        store_builder = mocker.patch("climate_ref_core.regression.store.build_native_store")
+
+        result = invoke_cli(
+            ["test-cases", "replay", "--provider", "example", "--test-case", "missing"],
+            expected_exit_code=1,
+        )
+        assert "Test case 'missing' was not found" in result.stderr
+        store_builder.assert_not_called()
+
     def test_replay_integrity_mismatch_warns_and_continues(self, invoke_cli, mocker, tmp_path):
         """An integrity mismatch is advisory, not a gate."""
         from climate_ref_core.regression.manifest import Manifest
@@ -1488,7 +1820,7 @@ def test_replay_integrity_mismatch_warns_and_continues(self, invoke_cli, mocker,
     def test_replay_reconciles_integrity_mismatch_within_tolerance(self, invoke_cli, mocker, tmp_path):
         """A byte-level baseline difference forgiven by the tolerant comparison is reported as reconciled.
 
-        This proves the follow-up comparison actually ran after the integrity warning: the success line
+        This proves the comparison stage actually ran after the integrity warning: the success line
         names the bundle files compared and states they are equivalent within tolerance, rather than
         silently claiming a match.
         """
@@ -1520,14 +1852,14 @@ def test_replay_reconciles_integrity_mismatch_within_tolerance(self, invoke_cli,
         )
         mocker.patch("climate_ref_core.testing.TestCasePaths.from_diagnostic", return_value=paths)
         mocker.patch("climate_ref_core.regression.store.build_native_store", return_value=store)
-        # Stub the heavy replay internals so we deterministically reach the success branch:
-        # native materialisation, placeholder expansion, dataset load, definition, and the tolerant
-        # comparison itself (a no-op assert == "equivalent within tolerance").
-        mocker.patch("climate_ref_core.regression.materialise_native")
-        mocker.patch("climate_ref_core.output_files.from_placeholders")
-        mocker.patch("climate_ref_core.testing.load_datasets_from_yaml", return_value=[])
-        mocker.patch("climate_ref_core.diagnostics.ExecutionDefinition")
-        mocker.patch("climate_ref_core.regression.assert_bundle_regression")
+        # Stub the slot stages so we deterministically reach the success branch: materialise +
+        # rebuild, committed-bundle build, and the tolerant comparison (no drift, 3 files compared).
+        mocker.patch("climate_ref.cli.test_cases.baselines.stage_materialise")
+        mocker.patch("climate_ref.cli.test_cases.baselines.stage_build")
+        mocker.patch(
+            "climate_ref.cli.test_cases.baselines.stage_compare",
+            return_value=([], ["series.json", "diagnostic.json", "output.json"]),
+        )
 
         result = invoke_cli(
             [
@@ -1597,6 +1929,54 @@ def test_mint_fails_fast_on_preflight_error(self, invoke_cli, mocker):
         # Fail-fast: the diagnostic runner must never have been reached.
         store.put.assert_not_called()
 
+    def test_mint_nonexistent_provider(self, invoke_cli, mocker):
+        """mint with an unknown provider exits 1 before opening the writable store."""
+        registry, _diag, _tc = _make_case_mocks()
+        mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=registry,
+        )
+        store_builder = mocker.patch("climate_ref_core.regression.store.build_native_store")
+
+        result = invoke_cli(
+            ["test-cases", "mint", "--provider", "nonexistent"],
+            expected_exit_code=1,
+        )
+        assert "not configured" in result.stderr
+        store_builder.assert_not_called()
+
+    def test_mint_nonexistent_diagnostic(self, invoke_cli, mocker):
+        """mint with a bad diagnostic filter fails before opening the writable store."""
+        registry, _diag, _tc = _make_case_mocks()
+        mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=registry,
+        )
+        store_builder = mocker.patch("climate_ref_core.regression.store.build_native_store")
+
+        result = invoke_cli(
+            ["test-cases", "mint", "--provider", "example", "--diagnostic", "missing", "--dry-run"],
+            expected_exit_code=1,
+        )
+        assert "Diagnostic 'missing' was not found" in result.stderr
+        store_builder.assert_not_called()
+
+    def test_mint_nonexistent_test_case(self, invoke_cli, mocker):
+        """mint with a bad test-case filter fails before opening the writable store."""
+        registry, _diag, _tc = _make_case_mocks()
+        mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=registry,
+        )
+        store_builder = mocker.patch("climate_ref_core.regression.store.build_native_store")
+
+        result = invoke_cli(
+            ["test-cases", "mint", "--provider", "example", "--test-case", "missing", "--dry-run"],
+            expected_exit_code=1,
+        )
+        assert "Test case 'missing' was not found" in result.stderr
+        store_builder.assert_not_called()
+
     def test_mint_dry_run_lists_without_running(self, invoke_cli, mocker):
         """--dry-run preflights + lists the cases, but runs no diagnostics and uploads nothing."""
         registry, _diag, _tc = _make_case_mocks()
@@ -1676,6 +2056,225 @@ def test_mint_writes_blobs_and_manifest(self, invoke_cli, mocker, tmp_path):
         for entry in manifest.native.values():
             assert store.has(entry.sha256)
 
+    def test_mint_skips_unchanged_native_on_remint(self, invoke_cli, mocker, tmp_path):
+        """Re-executing a mint with byte-identical native uploads nothing (changed-digest skip)."""
+        from climate_ref_core.regression.store import LocalFilesystemStore
+
+        _setup_real_run(mocker, tmp_path)
+        store = LocalFilesystemStore(root=tmp_path / "store")
+        mocker.patch("climate_ref_core.regression.store.build_native_store", return_value=store)
+
+        first = invoke_cli(["test-cases", "mint", "--provider", "example"])
+        assert first.exit_code == 0
+        assert "Uploaded 3 native blob(s), skipped 0" in first.stderr  # first mint uploads everything
+
+        # A second mint with identical outputs re-executes but uploads nothing new.
+        second = invoke_cli(["test-cases", "mint", "--provider", "example"])
+        assert second.exit_code == 0
+        assert "Uploaded 0 native blob(s), skipped 3" in second.stderr
+
+    def test_mint_from_replay_reauthors_without_reexecuting(self, invoke_cli, mocker, tmp_path):
+        """`mint --from-replay` rebuilds from stored native, uploading nothing and not re-executing."""
+        from climate_ref_core.regression.manifest import Manifest
+        from climate_ref_core.regression.store import LocalFilesystemStore
+
+        paths, _scratch, _regression, runner = _setup_real_run(mocker, tmp_path)
+        store = LocalFilesystemStore(root=tmp_path / "store")
+        mocker.patch("climate_ref_core.regression.store.build_native_store", return_value=store)
+
+        # First mint executes the diagnostic and uploads the native set.
+        first = invoke_cli(["test-cases", "mint", "--provider", "example"])
+        assert first.exit_code == 0
+        minted = Manifest.load(paths.manifest)
+        assert set(minted.native) == {"diagnostic.json", "output.json", "series.json"}
+        assert runner.run.call_count == 1
+        assert "Uploaded 3 native blob(s), skipped 0" in first.stderr
+
+        # Re-mint from the stored native: no execution, no new uploads, identical native block.
+        result = invoke_cli(["test-cases", "mint", "--provider", "example", "--from-replay"])
+        assert result.exit_code == 0
+        assert runner.run.call_count == 1  # unchanged: the diagnostic was not re-run
+        assert "Uploaded 0 native blob(s), skipped 3" in result.stderr
+        replayed = Manifest.load(paths.manifest)
+        assert {k: v.sha256 for k, v in replayed.native.items()} == {
+            k: v.sha256 for k, v in minted.native.items()
+        }
+        # The slot records the from-replay source.
+        stamp = json.loads((paths.output_slot("latest") / ".source.json").read_text())
+        assert stamp["verb"] == "mint"
+        assert stamp["source"] == "materialise"
+
+    def test_mint_from_replay_preserves_stored_native(self, invoke_cli, mocker, tmp_path):
+        """`mint --from-replay` keeps the stored native verbatim even if the rebuilt slot drifts.
+
+        stage_materialise hydrates the slot's native in place (placeholders -> concrete paths) while
+        rebuilding, so snapshotting the slot can capture non-portable, slot-specific blobs. The minted
+        manifest must preserve the previously stored native rather than re-author it from that drift.
+        """
+        from climate_ref_core.regression.manifest import Manifest, NativeEntry
+        from climate_ref_core.testing import TestCasePaths
+
+        registry, _diag, _tc = _make_case_mocks()
+
+        case_dir = tmp_path / "td" / "test-diag" / "default"
+        case_dir.mkdir(parents=True)
+        (case_dir / "catalog.yaml").touch()
+        paths = TestCasePaths(root=case_dir)
+        stored_native = {"output.json": NativeEntry(sha256="aa" * 32, size=10)}
+        Manifest(
+            schema=1,
+            test_case_version=1,
+            committed={"diagnostic.json": "00" * 32},
+            native=stored_native,
+        ).dump(paths.manifest)
+
+        store = MagicMock()  # preflight passes; has() True so the (no-op) upload skips
+        store.has.return_value = True
+        mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=registry,
+        )
+        mocker.patch("climate_ref_core.testing.TestCasePaths.from_diagnostic", return_value=paths)
+        mocker.patch("climate_ref_core.testing.get_catalog_hash", return_value=None)
+        mocker.patch("climate_ref_core.regression.store.build_native_store", return_value=store)
+
+        # Heavy stages stubbed; the rebuild "mutates" the slot so a fresh snapshot would drift.
+        mocker.patch("climate_ref.cli.test_cases.baselines.stage_materialise")
+        mocker.patch(
+            "climate_ref.cli.test_cases.baselines.stage_build",
+            return_value={"diagnostic.json": "11" * 32},
+        )
+        snapshot = mocker.patch(
+            "climate_ref.cli.test_cases.baselines.snapshot_native",
+            return_value={"output.json": NativeEntry(sha256="bb" * 32, size=20)},
+        )
+        mocker.patch("climate_ref.cli.test_cases.baselines.promote_to_baseline")
+
+        result = invoke_cli(
+            ["test-cases", "mint", "--provider", "example", "--diagnostic", "test-diag", "--from-replay"]
+        )
+        assert result.exit_code == 0
+
+        written = Manifest.load(paths.manifest)
+        # The native block is the stored one, NOT the mutated slot snapshot ("bb"*32).
+        assert {k: v.sha256 for k, v in written.native.items()} == {
+            k: v.sha256 for k, v in stored_native.items()
+        }
+        # The from-replay path must not snapshot the hydrated slot at all.
+        snapshot.assert_not_called()
+
+    def test_mint_from_replay_requires_minted_manifest(self, invoke_cli, mocker, tmp_path):
+        """`mint --from-replay` fails when there is no existing minted native to replay from."""
+        from climate_ref_core.regression.store import LocalFilesystemStore
+
+        _setup_real_run(mocker, tmp_path)
+        store = LocalFilesystemStore(root=tmp_path / "store")
+        mocker.patch("climate_ref_core.regression.store.build_native_store", return_value=store)
+
+        result = invoke_cli(
+            ["test-cases", "mint", "--provider", "example", "--from-replay"],
+            expected_exit_code=1,
+        )
+        assert "--from-replay needs an existing minted manifest" in result.stderr
+
+
+class TestBuildCommand:
+    """Tests for the `test-cases build` CLI verb."""
+
+    def test_build_help(self, invoke_cli):
+        result = invoke_cli(["test-cases", "build", "--help"])
+        assert "Rebuild the committed bundle" in result.stdout
+
+    def test_build_fails_without_slot(self, invoke_cli, mocker, tmp_path):
+        """build refuses when the named output slot has no native to rebuild from."""
+        _setup_real_run(mocker, tmp_path)  # catalog present, but no output slot materialised
+        result = invoke_cli(
+            ["test-cases", "build", "--provider", "example", "--diagnostic", "test-diag"],
+            expected_exit_code=1,
+        )
+        assert "no native in output slot" in result.stderr.lower()
+
+    def test_build_nonexistent_provider(self, invoke_cli, mocker):
+        """build with an unknown provider exits 1 rather than reporting 'no test cases'."""
+        registry, _diag, _tc = _make_case_mocks()
+        mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=registry,
+        )
+
+        result = invoke_cli(
+            ["test-cases", "build", "--provider", "nonexistent"],
+            expected_exit_code=1,
+        )
+        assert "not configured" in result.stderr
+
+    def test_build_nonexistent_diagnostic(self, invoke_cli, mocker):
+        """build with a bad diagnostic filter fails instead of silently selecting nothing."""
+        registry, _diag, _tc = _make_case_mocks()
+        mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=registry,
+        )
+
+        result = invoke_cli(
+            ["test-cases", "build", "--provider", "example", "--diagnostic", "missing"],
+            expected_exit_code=1,
+        )
+        assert "Diagnostic 'missing' was not found" in result.stderr
+
+    def test_build_nonexistent_test_case(self, invoke_cli, mocker):
+        """build with a bad test-case filter fails instead of silently selecting nothing."""
+        registry, _diag, _tc = _make_case_mocks()
+        mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=registry,
+        )
+
+        result = invoke_cli(
+            ["test-cases", "build", "--provider", "example", "--test-case", "missing"],
+            expected_exit_code=1,
+        )
+        assert "Test case 'missing' was not found" in result.stderr
+
+    def test_build_rebuilds_from_slot_without_executing(self, invoke_cli, mocker, tmp_path):
+        """build regenerates the committed bundle from an existing slot, never re-running."""
+        paths, _scratch, _regression, runner = _setup_real_run(mocker, tmp_path)
+
+        # Seed a slot (and baseline) with one run.
+        assert (
+            invoke_cli(
+                ["test-cases", "run", "--provider", "example", "--diagnostic", "test-diag", "--force-regen"]
+            ).exit_code
+            == 0
+        )
+        assert runner.run.call_count == 1
+
+        # Rebuild the committed bundle from that slot, without executing the diagnostic.
+        result = invoke_cli(["test-cases", "build", "--provider", "example", "--diagnostic", "test-diag"])
+        assert result.exit_code == 0
+        assert runner.run.call_count == 1  # build did not re-run the diagnostic
+        assert (paths.output_slot("latest") / "regression" / "diagnostic.json").exists()
+        stamp = json.loads((paths.output_slot("latest") / ".source.json").read_text())
+        assert stamp["verb"] == "build"
+        assert stamp["source"] == "rebuild"
+
+
+def test_output_slot_pattern_is_gitignored(tmp_path):
+    """The repo .gitignore shadows materialised output slots under any test-data tree."""
+    from git import Repo
+
+    repo_gitignore = Path(__file__).resolve().parents[5] / ".gitignore"
+    repo = Repo.init(tmp_path)
+    (tmp_path / ".gitignore").write_text(repo_gitignore.read_text())
+
+    slot = tmp_path / "packages" / "pkg" / "tests" / "test-data" / "diag" / "default" / "output" / "latest"
+    slot.mkdir(parents=True)
+    (slot / "native.nc").write_bytes(b"x")
+
+    rel = "packages/pkg/tests/test-data/diag/default/output/latest/native.nc"
+    # git check-ignore echoes the path when it is ignored (and exits non-zero otherwise).
+    assert repo.git.check_ignore(rel) == rel
+
 
 class TestCheckStoreCommand:
     """Tests for the ``ref test-cases check-store`` command."""
@@ -1803,7 +2402,7 @@ def _setup(
             return_value=mock_registry,
         )
         mocker.patch("climate_ref_core.testing.TestCasePaths.from_diagnostic", return_value=paths)
-        mocker.patch("climate_ref.cli.test_cases.get_repo_for_path", return_value=repo)
+        mocker.patch("climate_ref.cli.test_cases.ci_gate.get_repo_for_path", return_value=repo)
         return repo, paths, committed_digests
 
     @staticmethod
@@ -1834,6 +2433,40 @@ def test_seeding_replays(self, invoke_cli, mocker, tmp_path):
         assert result.exit_code == 0
         assert "replay" in result.output
 
+    def test_ci_gate_nonexistent_provider(self, invoke_cli, mocker, tmp_path):
+        # An unknown provider must fail closed (exit 1), not gate nothing and silently exit 0.
+        # The registry mock only knows the 'example' provider.
+        self._setup(mocker, tmp_path, current_version=1)
+
+        result = invoke_cli(
+            ["test-cases", "ci-gate", "--provider", "nonexistent"],
+            expected_exit_code=1,
+        )
+        assert result.exit_code == 1
+        assert "not configured" in result.stderr
+
+    def test_ci_gate_nonexistent_diagnostic(self, invoke_cli, mocker, tmp_path):
+        # A bad diagnostic selector must fail closed instead of emitting an empty decision list.
+        self._setup(mocker, tmp_path, current_version=1)
+
+        result = invoke_cli(
+            ["test-cases", "ci-gate", "--provider", "example", "--diagnostic", "missing"],
+            expected_exit_code=1,
+        )
+        assert result.exit_code == 1
+        assert "Diagnostic 'missing' was not found" in result.stderr
+
+    def test_ci_gate_nonexistent_test_case(self, invoke_cli, mocker, tmp_path):
+        # A bad test-case selector must fail closed instead of emitting an empty decision list.
+        self._setup(mocker, tmp_path, current_version=1)
+
+        result = invoke_cli(
+            ["test-cases", "ci-gate", "--provider", "example", "--test-case", "missing"],
+            expected_exit_code=1,
+        )
+        assert result.exit_code == 1
+        assert "Test case 'missing' was not found" in result.stderr
+
     def test_seeding_without_native_skips(self, invoke_cli, mocker, tmp_path):
         # Current manifest present with an empty native set, no base manifest -> seeding -> SKIP.
         self._setup(mocker, tmp_path, current_version=1)
@@ -1933,7 +2566,7 @@ def test_never_managed_skips(self, invoke_cli, mocker, tmp_path):
 
     def test_not_in_repo_fails(self, invoke_cli, mocker, tmp_path):
         self._setup(mocker, tmp_path, current_version=1)
-        mocker.patch("climate_ref.cli.test_cases.get_repo_for_path", return_value=None)
+        mocker.patch("climate_ref.cli.test_cases.ci_gate.get_repo_for_path", return_value=None)
 
         result = invoke_cli(["test-cases", "ci-gate"], expected_exit_code=1)
         assert result.exit_code == 1