From b914f59620f12af1ccb95bfacaaa3371d151f7e9 Mon Sep 17 00:00:00 2001
From: Jared Lewis <jared@jared.kiwi.nz>
Date: Sun, 21 Jun 2026 20:25:02 +1000
Subject: [PATCH 01/12] feat(test-cases): add output slots and decompose verbs
 onto stages

Materialise every run/replay/mint/build into a gitignored output slot
(`<case>/output/<label>/`) holding the curated native set,
the rebuilt committed bundle, and a `.source.json` stamp,
so a developer can see and diff what a run produced.

Refactor run/replay/mint onto a shared stage toolkit
(execute / materialise / rebuild / build / upload / compare) and add:

- a `build` verb that rebuilds the committed bundle from a slot without re-executing
- `mint --from-replay` to re-author the manifest from stored native instead of re-running the diagnostic
- `--label` on run/replay/mint/build to keep named slots side by side
- changed-digest upload skip and a native-staleness warning

run/build write the slot on every invocation
but only promote the rebuilt bundle to the tracked `regression/` baseline
on `--force-regen` or when seeding;
the native block stays mint-owned, and mint uploads before it promotes.
---
 .gitignore                                    |   3 +
 docs/background/regression-baselines.md       |  45 +-
 .../src/climate_ref_core/testing.py           |  23 +
 .../src/climate_ref/cli/_test_case_stages.py  | 293 +++++++++++
 .../src/climate_ref/cli/test_cases.py         | 493 ++++++++++--------
 .../tests/unit/cli/test_test_cases.py         | 487 ++++++++++-------
 6 files changed, 943 insertions(+), 401 deletions(-)
 create mode 100644 packages/climate-ref/src/climate_ref/cli/_test_case_stages.py

diff --git a/.gitignore b/.gitignore
index 3f1088ad6..9ceae0334 100644
--- a/.gitignore
+++ b/.gitignore
@@ -167,6 +167,9 @@ packages/*/NOTICE
 # User-specific catalog paths (test data)
 *.paths.yaml
 
+# Materialised test-case output slots (local inspection only; never committed)
+**/test-data/**/output/
+
 # Debug log files
 **/main_log_debug.txt
 
diff --git a/docs/background/regression-baselines.md b/docs/background/regression-baselines.md
index 1954f925f..d65276966 100644
--- a/docs/background/regression-baselines.md
+++ b/docs/background/regression-baselines.md
@@ -61,12 +61,49 @@ flowchart LR
 
 | Verb | Credentials | What it does |
 | --- | --- | --- |
-| `run` | none | Execute the diagnostic, curate outputs, write the committed bundle and seed `manifest.json` (`native = {}`). |
-| `mint` | write | Upload the curated native files to the object store and populate `manifest.native`. Generally run by CI. |
-| `sync` | public read | Fetch the native blobs referenced by the manifest into the local tree. |
-| `replay` | public read | Materialise the native baseline, re-run only `build_execution_result`, and tolerantly compare to the committed bundle. |
+| `run` | none | Execute the diagnostic, curate its native into the output slot `output/<label>/`, rebuild the committed bundle, and — when seeding or `--force-regen` — promote it to `regression/` and seed `manifest.json` (`native = {}`). |
+| `build` | none | Rebuild the committed bundle from an existing output slot (no execution), under the same promotion gate as `run`. Handy for regenerating the bundle after an extraction-code change, from already-materialised native. |
+| `mint` | write | Execute (or, with `--from-replay`, replay the stored native), upload the curated native to the object store, and populate `manifest.native`. Generally run by CI. |
+| `sync` | public read | Fetch the native blobs referenced by the manifest into the local store cache. |
+| `replay` | public read | Materialise the native baseline into a slot, re-run only `build_execution_result`, and tolerantly compare to the committed bundle. |
 | `check-store` | write | Preflight the writable native store (credentials + bucket) without uploading anything. Run this before a slow `mint` to confirm credentials are correct. |
 
+### Output slots
+
+Every `run`, `build`, `replay`, and `mint` materialises what it produced into a gitignored
+*output slot*, so a developer can actually see and diff what a run or replay generated:
+
+```text
+<test case>/output/<label>/
+├── diagnostic.json     # the curated native set, flat at manifest-relative paths
+├── output.json
+├── series.json
+├── ...                 # plus any referenced plots/data/html and native .nc files
+├── regression/         # the committed bundle rebuilt from this slot
+│   ├── diagnostic.json
+│   ├── output.json
+│   └── series.json
+└── .source.json        # {label, verb, source, test_case_version, created}
+```
+
+Slots are never committed — the whole `**/test-data/**/output/` tree is gitignored —
+they exist purely for local inspection.
+
+The `--label` option names a slot (default `latest`, overwritten on every run).
+Named slots persist, so two runs can be compared side by side:
+for example `run --label fresh` then `replay --label fromstore`,
+or `run --label before`, edit the diagnostic, then `run --label after`.
+
+`run` and `build` write the slot on every invocation
+but only *promote* the rebuilt bundle to the tracked `regression/` baseline
+when `--force-regen` is given or no baseline exists yet,
+so a labelled run never silently clobbers a committed baseline;
+`mint` always promotes and uploads.
+When a promoted bundle's underlying native digests differ from the minted baseline,
+`run` and `build` warn (they never block) that a re-mint is needed.
+`mint --from-replay` re-authors the manifest from the stored native instead of re-executing,
+and uploads only blobs whose digest actually changed.
+
 ## CMIP7 test data
 
 CMIP7 data is not yet available on ESGF,
diff --git a/packages/climate-ref-core/src/climate_ref_core/testing.py b/packages/climate-ref-core/src/climate_ref_core/testing.py
index 78008c26e..af884c9c7 100644
--- a/packages/climate-ref-core/src/climate_ref_core/testing.py
+++ b/packages/climate-ref-core/src/climate_ref_core/testing.py
@@ -31,6 +31,7 @@
 from climate_ref_core.esgf.base import ESGFRequest
 from climate_ref_core.metric_values.typing import SeriesMetricValue
 from climate_ref_core.output_files import from_placeholders, ordered_replacements
+from climate_ref_core.paths import safe_path
 from climate_ref_core.pycmec.metric import CMECMetric
 from climate_ref_core.pycmec.output import CMECOutput
 from climate_ref_core.regression.manifest import Manifest
@@ -201,6 +202,28 @@ def manifest(self) -> Path:
         """Path to manifest.json (the regression bundle manifest, tracked in git)."""
         return self.root / "manifest.json"
 
+    @property
+    def output(self) -> Path:
+        """Path to the output/ directory (gitignored; holds materialised native slots)."""
+        return self.root / "output"
+
+    def output_slot(self, label: str = "latest") -> Path:
+        """
+        Path to a named output slot under ``output/`` (gitignored).
+
+        A slot is a self-contained, inspectable snapshot of one execute/materialise:
+        the curated native set (flat, at manifest-relative paths) plus a ``regression/``
+        subdirectory holding the rebuilt committed bundle and a ``.source.json`` stamp.
+        ``latest`` (the default) is overwritten on every run; named slots persist so two
+        runs can be diffed (e.g. ``--label before`` vs ``--label after``).
+
+        Parameters
+        ----------
+        label
+            Slot name. Must be a single path segment (no separators or ``..``).
+        """
+        return safe_path(label, self.output, label="output slot label", single_segment=True)
+
     @property
     def test_data_dir(self) -> Path:
         """Path to the test-data directory (parent of diagnostic slug dir)."""
diff --git a/packages/climate-ref/src/climate_ref/cli/_test_case_stages.py b/packages/climate-ref/src/climate_ref/cli/_test_case_stages.py
new file mode 100644
index 000000000..57719d8cb
--- /dev/null
+++ b/packages/climate-ref/src/climate_ref/cli/_test_case_stages.py
@@ -0,0 +1,293 @@
+"""
+Composable stages behind the ``ref test-cases`` verbs.
+
+The verbs ``run`` / ``mint`` / ``replay`` / ``build`` are thin compositions over a small
+set of stages:
+
+- **execute** -- run the diagnostic and copy its curated native set into a slot
+- **materialise** -- fetch a committed manifest's native blobs from the store into a slot
+- **build** -- assemble the committed bundle from the native in a slot
+- **upload** -- push changed-digest native blobs to the store
+- **compare** -- diff a slot's rebuilt bundle against the tracked committed baseline
+
+Native produced by a source stage (execute or materialise) lands in a gitignored *output
+slot* (``<case>/output/<label>/``), flat at manifest-relative paths, with a ``regression/``
+subdirectory holding the rebuilt committed bundle and a ``.source.json`` stamp.
+``latest`` (the default label) is overwritten on every run; named slots persist so two runs
+can be diffed (``--label before`` vs ``--label after``).
+See ``docs/background/regression-baselines.md``.
+"""
+
+from __future__ import annotations
+
+import json
+import shutil
+from datetime import UTC, datetime
+from pathlib import Path
+from typing import TYPE_CHECKING, NamedTuple
+
+from loguru import logger
+
+from climate_ref_core.diagnostics import ExecutionDefinition
+from climate_ref_core.output_files import copy_execution_outputs, from_placeholders
+from climate_ref_core.regression import (
+    COMMITTED_BUNDLE_FILES,
+    Tolerance,
+    assert_bundle_regression,
+    materialise_native,
+)
+from climate_ref_core.regression.capture import build_native_snapshot, write_committed_bundle
+from climate_ref_core.testing import TestCasePaths, load_datasets_from_yaml
+
+if TYPE_CHECKING:
+    from climate_ref.config import Config
+    from climate_ref_core.datasets import ExecutionDatasetCollection
+    from climate_ref_core.diagnostics import Diagnostic, ExecutionResult
+    from climate_ref_core.regression.manifest import Manifest, NativeEntry
+    from climate_ref_core.regression.store import NativeStore
+    from climate_ref_core.testing import TestCase
+
+SLOT_REGRESSION_DIRNAME = "regression"
+SLOT_SOURCE_STAMP = ".source.json"
+
+
+class StageError(Exception):
+    """A test-case stage failed in a way the caller should report and skip."""
+
+
+class SourceOutputs(NamedTuple):
+    """
+    The native a source stage placed in a slot, plus what ``build`` needs to consume it.
+
+    ``bundle_output_dir`` is the absolute output directory the rebuilt bundle's text
+    contents reference -- the real execution directory for ``execute`` (the copied bundle
+    still points there), or the slot itself for ``materialise`` (``build_execution_result``
+    rewrote the bundle into the slot).
+    """
+
+    result: ExecutionResult
+    bundle_output_dir: Path
+
+
+def prepare_slot(paths: TestCasePaths, label: str) -> Path:
+    """
+    Wipe and recreate ``output/<label>/`` and return the slot base directory.
+
+    Used by the source stages (execute / materialise), which repopulate the native set.
+    ``build`` does not call this -- it reuses the native already in the slot.
+    """
+    slot = paths.output_slot(label)
+    if slot.exists():
+        shutil.rmtree(slot)
+    slot.mkdir(parents=True, exist_ok=True)
+    return slot
+
+
+def slot_native_relpaths(slot: Path) -> list[Path]:
+    """
+    Return the native files in a slot -- everything except the rebuilt bundle and the stamp.
+
+    A slot is populated only by a source stage with the curated output set, so this is
+    exactly the curated native set (it excludes the ``regression/`` subdirectory written
+    by ``build`` and the ``.source.json`` stamp).
+    """
+    relpaths: list[Path] = []
+    for path in sorted(slot.rglob("*")):
+        if not path.is_file():
+            continue
+        rel = path.relative_to(slot)
+        if rel.parts[0] == SLOT_REGRESSION_DIRNAME or rel.name == SLOT_SOURCE_STAMP:
+            continue
+        relpaths.append(rel)
+    return relpaths
+
+
+def stage_execute(  # noqa: PLR0913
+    *,
+    config: Config,
+    diag: Diagnostic,
+    tc: TestCase,
+    datasets: ExecutionDatasetCollection,
+    slot: Path,
+    execution_dir: Path | None,
+    clean: bool,
+) -> SourceOutputs:
+    """Run the diagnostic and copy its curated native set (flat) into ``slot``."""
+    from climate_ref.testing import TestCaseRunner
+
+    runner = TestCaseRunner(config=config, datasets=datasets)
+    result = runner.run(diag, tc.name, execution_dir, clean=clean)
+    if not result.successful:
+        raise StageError("execution was not successful")
+
+    real_output_dir = result.definition.output_directory
+    # Copy the curated subset from the real execution dir into the slot, flat (fragment=".").
+    # The copied bundle text still references real_output_dir, so build substitutes that.
+    copy_execution_outputs(real_output_dir, slot, ".", result)
+    return SourceOutputs(result=result, bundle_output_dir=real_output_dir)
+
+
+def stage_materialise(  # noqa: PLR0913
+    *,
+    diag: Diagnostic,
+    tc: TestCase,
+    paths: TestCasePaths,
+    manifest: Manifest,
+    store: NativeStore,
+    slot: Path,
+) -> SourceOutputs:
+    """Fetch the manifest's native blobs into ``slot`` and rebuild the result from them."""
+    materialise_native(manifest.native, store, slot)
+    return stage_rebuild_from_slot(diag=diag, tc=tc, paths=paths, slot=slot)
+
+
+def stage_rebuild_from_slot(
+    *,
+    diag: Diagnostic,
+    tc: TestCase,
+    paths: TestCasePaths,
+    slot: Path,
+) -> SourceOutputs:
+    """
+    Rebuild the execution result from native already present in ``slot``.
+
+    Hydrates portable placeholders to concrete paths, then re-runs ``build_execution_result``
+    so the rebuilt bundle is written into the slot (referencing the slot). No execution and
+    no store access -- this is the shared core of ``replay`` (after a fetch) and ``build``.
+    """
+    from_placeholders(slot, output_dir=slot, test_data_dir=paths.test_data_dir)
+    datasets = load_datasets_from_yaml(paths.catalog)
+    definition = ExecutionDefinition(
+        diagnostic=diag,
+        key=f"test-{tc.name}",
+        datasets=datasets,
+        output_directory=slot,
+        root_directory=slot.parent,
+    )
+    result = diag.build_execution_result(definition)
+    return SourceOutputs(result=result, bundle_output_dir=slot)
+
+
+def stage_build(*, slot: Path, source: SourceOutputs, paths: TestCasePaths) -> dict[str, str]:
+    """
+    Assemble the committed bundle into the slot's ``regression/`` directory.
+
+    Returns the committed digests ``{filename: sha256}`` of the sanitised, float-quantised
+    bytes just written -- suitable for ``Manifest.committed`` and identical to what would be
+    promoted to the tracked baseline.
+    """
+    return write_committed_bundle(
+        slot,
+        slot / SLOT_REGRESSION_DIRNAME,
+        output_dir=source.bundle_output_dir,
+        test_data_dir=paths.test_data_dir,
+    )
+
+
+def snapshot_native(slot: Path) -> dict[str, NativeEntry]:
+    """Record a sha256 + size snapshot of the slot's native set (for the manifest / upload)."""
+    return build_native_snapshot(slot, slot_native_relpaths(slot))
+
+
+def promote_to_baseline(slot: Path, paths: TestCasePaths) -> None:
+    """
+    Copy a slot's rebuilt committed bundle into the tracked ``regression/`` baseline.
+
+    The slot bundle is already sanitised and float-quantised, so the promoted bytes (and
+    therefore their digests) match what ``stage_build`` returned.
+    """
+    slot_regression = slot / SLOT_REGRESSION_DIRNAME
+    if paths.regression.exists():
+        shutil.rmtree(paths.regression)
+    paths.regression.mkdir(parents=True, exist_ok=True)
+    for filename in COMMITTED_BUNDLE_FILES:
+        source = slot_regression / filename
+        if source.exists():
+            shutil.copy(source, paths.regression / filename)
+
+
+def stage_upload(
+    *,
+    slot: Path,
+    native: dict[str, NativeEntry],
+    store: NativeStore,
+    previous: dict[str, NativeEntry],
+) -> list[str]:
+    """
+    Upload native blobs to the store, skipping any whose digest is unchanged and present.
+
+    A blob is uploaded only when its digest differs from the previous manifest entry or the
+    store does not already serve it, so a re-mint after a bundle-only change (e.g.
+    ``mint --from-replay``) uploads nothing. Returns digest-mismatch error messages
+    (empty on success).
+    """
+    errors: list[str] = []
+    uploaded = 0
+    skipped = 0
+    for relpath, entry in native.items():
+        prev = previous.get(relpath)
+        if prev is not None and prev.sha256 == entry.sha256 and store.has(entry.sha256):
+            skipped += 1
+            continue
+        digest = store.put(slot / relpath)
+        if digest != entry.sha256:
+            errors.append(f"digest mismatch for {relpath} (store={digest}, captured={entry.sha256})")
+        else:
+            uploaded += 1
+    logger.info(f"Uploaded {uploaded} native blob(s), skipped {skipped} unchanged")
+    return errors
+
+
+def stage_compare(*, slot: Path, paths: TestCasePaths, slug: str) -> tuple[list[str], list[str]]:
+    """
+    Compare a slot's rebuilt bundle against the tracked committed baseline.
+
+    Both sides are already placeholder-sanitised, so no replacements are needed.
+    Returns ``(failures, compared)`` -- the drift messages and the filenames compared.
+    """
+    slot_regression = slot / SLOT_REGRESSION_DIRNAME
+    compared = [f for f in COMMITTED_BUNDLE_FILES if (paths.regression / f).exists()]
+    failures: list[str] = []
+    for filename in compared:
+        try:
+            assert_bundle_regression(
+                paths.regression / filename,
+                slot_regression / filename,
+                slug=slug,
+                tol=Tolerance(),
+                replacements={},
+            )
+        except AssertionError as exc:
+            failures.append(str(exc))
+    return failures, compared
+
+
+def native_is_stale(fresh: dict[str, NativeEntry], previous: dict[str, NativeEntry]) -> bool:
+    """
+    Return True when a previous (mint-owned) native block exists and differs from the fresh snapshot.
+
+    Used to warn -- not block -- after a committed-bundle regeneration whose underlying native
+    has drifted, so the author knows to re-mint.
+    """
+    if not previous:
+        return False
+    return {k: v.sha256 for k, v in fresh.items()} != {k: v.sha256 for k, v in previous.items()}
+
+
+def write_source_stamp(
+    slot: Path,
+    *,
+    label: str,
+    verb: str,
+    source: str,
+    test_case_version: int,
+) -> None:
+    """Write the slot's ``.source.json`` so it is clear what currently populates the slot."""
+    stamp = {
+        "label": label,
+        "verb": verb,
+        "source": source,
+        "test_case_version": test_case_version,
+        "created": datetime.now(UTC).isoformat(),
+    }
+    (slot / SLOT_SOURCE_STAMP).write_text(json.dumps(stamp, indent=2) + "\n", encoding="utf-8")
diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases.py b/packages/climate-ref/src/climate_ref/cli/test_cases.py
index ddbe37fb4..844ae8d0c 100644
--- a/packages/climate-ref/src/climate_ref/cli/test_cases.py
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases.py
@@ -7,7 +7,6 @@
 
 from __future__ import annotations
 
-import shutil
 from pathlib import Path
 from typing import TYPE_CHECKING, Annotated
 
@@ -17,6 +16,21 @@
 from rich.table import Table
 
 from climate_ref.cli._git_utils import collect_regression_file_info, get_repo_for_path
+from climate_ref.cli._test_case_stages import (
+    StageError,
+    native_is_stale,
+    prepare_slot,
+    promote_to_baseline,
+    slot_native_relpaths,
+    snapshot_native,
+    stage_build,
+    stage_compare,
+    stage_execute,
+    stage_materialise,
+    stage_rebuild_from_slot,
+    stage_upload,
+    write_source_stamp,
+)
 from climate_ref.cli._utils import format_size
 from climate_ref.config import Config
 from climate_ref_core.exceptions import (
@@ -503,62 +517,67 @@ def _run_single_test_case(  # noqa: PLR0911, PLR0912, PLR0915
     console: Console,
     diag: Diagnostic,
     tc: TestCase,
-    output_directory: Path | None,
+    *,
+    execution_dir: Path | None,
     force_regen: bool,
     fetch: bool,
     size_threshold: float,
     clean: bool,
+    label: str,
 ) -> bool:
     """
-    Run a single test case for a diagnostic.
+    Run a single test case for a diagnostic, writing its native into an output slot.
+
+    Always (re)populates ``output/<label>/`` with the executed native set and its rebuilt
+    committed bundle. The tracked ``regression/`` baseline is only updated ("promoted") when
+    ``--force-regen`` is given or no baseline exists yet, so a labelled run never silently
+    clobbers a committed baseline.
 
     Returns True if successful, False otherwise.
     """
-    import tempfile
-
-    from climate_ref.testing import TestCaseRunner
-    from climate_ref_core.regression.capture import capture_execution
     from climate_ref_core.regression.manifest import Manifest
-    from climate_ref_core.testing import (
-        TestCasePaths,
-        load_datasets_from_yaml,
-    )
+    from climate_ref_core.testing import TestCasePaths, load_datasets_from_yaml
 
     provider_slug = diag.provider.slug
     diagnostic_slug = diag.slug
     test_case_name = tc.name
+    case_id = f"{provider_slug}/{diagnostic_slug}/{test_case_name}"
 
-    # Resolve datasets: either fetch from ESGF or load from pre-built catalog
+    # Resolve datasets: either fetch from ESGF or load from the pre-built catalog.
     if fetch:
-        logger.info(f"Fetching test data for {provider_slug}/{diagnostic_slug}/{test_case_name}")
+        logger.info(f"Fetching test data for {case_id}")
         try:
             datasets, _ = _fetch_and_build_catalog(diag, tc)
         except (DatasetResolutionError, InvalidDiagnosticException) as e:
-            logger.exception(
-                f"Failed to fetch data for {provider_slug}/{diagnostic_slug}/{test_case_name}: {e}"
-            )
-            return False
-    else:
-        paths = TestCasePaths.from_diagnostic(diag, test_case_name)
-        if paths is None:
-            logger.error(f"Could not determine test data directory for {provider_slug}/{diagnostic_slug}")
+            logger.exception(f"Failed to fetch data for {case_id}: {e}")
             return False
 
+    paths = TestCasePaths.from_diagnostic(diag, test_case_name)
+    if paths is None:
+        logger.error(f"Could not determine test data directory for {provider_slug}/{diagnostic_slug}")
+        return False
+
+    if not fetch:
         if not paths.catalog.exists():
-            logger.error(f"No catalog file found for {provider_slug}/{diagnostic_slug}/{test_case_name}")
+            logger.error(f"No catalog file found for {case_id}")
             logger.error("Run 'ref test-cases fetch' first or use --fetch flag")
             return False
-
         logger.info(f"Loading catalog from {paths.catalog}")
         datasets = load_datasets_from_yaml(paths.catalog)
 
-    # Create runner and execute
-    runner = TestCaseRunner(config=config, datasets=datasets)
-
+    paths.create()
+    slot = prepare_slot(paths, label)
     logger.info(f"Running test case {test_case_name!r} for {provider_slug}/{diagnostic_slug}")
-
     try:
-        result = runner.run(diag, test_case_name, output_directory, clean=clean)
+        source = stage_execute(
+            config=config,
+            diag=diag,
+            tc=tc,
+            datasets=datasets,
+            slot=slot,
+            execution_dir=execution_dir,
+            clean=clean,
+        )
     except NoTestDataSpecError:
         logger.error(f"Diagnostic {provider_slug}/{diagnostic_slug} has no test_data_spec")
         return False
@@ -571,80 +590,53 @@ def _run_single_test_case(  # noqa: PLR0911, PLR0912, PLR0915
         logger.error(str(e))
         logger.error("Have you run 'ref test-cases fetch' first?")
         return False
+    except StageError:
+        logger.error(f"Execution failed: {case_id}")
+        return False
     except Exception as e:
-        case_id = f"{provider_slug}/{diagnostic_slug}/{test_case_name}"
         logger.error(f"Diagnostic execution failed for {case_id}: {e!s}")
         return False
 
-    if not result.successful:
-        logger.error(f"Execution failed: {provider_slug}/{diagnostic_slug}/{test_case_name}")
-        return False
-
-    logger.info(f"Execution completed: {provider_slug}/{diagnostic_slug}/{test_case_name}")
+    result = source.result
+    logger.info(f"Execution completed: {case_id}")
     if result.metric_bundle_filename:
         logger.info(f"Metric bundle: {result.to_output_path(result.metric_bundle_filename)}")
     if result.output_bundle_filename:
         logger.info(f"Output bundle: {result.to_output_path(result.output_bundle_filename)}")
 
-    # Handle regression baseline comparison/regeneration
-    paths = TestCasePaths.from_diagnostic(diag, test_case_name)
-
-    if paths is None:
-        logger.warning("Could not determine test case directory for provider package")
-        return True
-
-    if force_regen:
-        paths.create()
+    # Rebuild the slot's committed bundle, then decide whether to promote it to the
+    # tracked baseline. The native block is mint-owned, so a run preserves the previous
+    # one (or seeds an empty set) and never authors native here.
+    committed = stage_build(slot=slot, source=source, paths=paths)
+    previous = Manifest.load(paths.manifest) if paths.manifest.exists() else None
+    version = previous.test_case_version if previous else 1
 
     if force_regen or not paths.regression.exists():
-        if paths.regression.exists():
-            shutil.rmtree(paths.regression)
-        paths.regression.mkdir(parents=True, exist_ok=True)
-
-        defn = result.definition
-        output_dir = defn.output_directory
-        fragment = defn.output_fragment()
-        scratch_root = output_dir.parent
-
-        # results_base must differ from the scratch root for copy_execution_outputs.
-        # Keep it alive only until capture completes (run() does not mint to a store).
-        with tempfile.TemporaryDirectory() as results_base:
-            committed_digests, native = capture_execution(
-                scratch_root,
-                Path(results_base),
-                fragment,
-                result,
-                regression_dir=paths.regression,
-                output_dir=output_dir,
-                test_data_dir=paths.test_data_dir,
-            )
-
-        # Refresh the manifest's committed block (and catalog hash) only; the native
-        # block is mint-owned, so preserve the previous one when the manifest exists.
-        if paths.manifest.exists():
-            previous = Manifest.load(paths.manifest)
+        promote_to_baseline(slot, paths)
+        native = snapshot_native(slot)
+        if previous is not None:
             _write_test_case_manifest(
                 paths,
                 test_case_version=previous.test_case_version,
-                committed=committed_digests,
+                committed=committed,
                 native=previous.native,
                 schema=previous.schema,
             )
+            if native_is_stale(native, previous.native):
+                logger.warning(
+                    f"{case_id}: committed bundle regenerated but the native baseline differs; "
+                    "re-mint with `ref test-cases mint` (or `mint --from-replay`)"
+                )
         else:
-            _write_test_case_manifest(
-                paths,
-                test_case_version=1,
-                committed=committed_digests,
-                native={},
-            )
-
-        logger.info(f"Captured {len(native)} native output file(s) (not minted)")
-        logger.info(f"Updated regression data: {paths.regression}")
+            _write_test_case_manifest(paths, test_case_version=1, committed=committed, native={})
+        logger.info(f"Updated regression baseline: {paths.regression}")
         _print_regression_summary(console, paths.regression, size_threshold)
-    elif paths.regression.exists():
-        logger.info(f"Regression data exists at: {paths.regression}")
-        logger.info("Use --force-regen to update the baseline")
+    else:
+        logger.info(
+            f"Wrote output slot {slot} (committed baseline unchanged; use --force-regen to update it)"
+        )
 
+    write_source_stamp(slot, label=label, verb="run", source="execute", test_case_version=version)
     return True
 
 
@@ -695,6 +687,10 @@ def run_test_case(  # noqa: PLR0912, PLR0915
         bool,
         typer.Option(help="Delete existing output directory before running"),
     ] = False,
+    label: Annotated[
+        str,
+        typer.Option(help="Output slot name under output/ (default: latest)"),
+    ] = "latest",
 ) -> None:
     """
     Run test cases for diagnostics.
@@ -807,11 +803,12 @@ def run_test_case(  # noqa: PLR0912, PLR0915
             console=console,
             diag=diag,
             tc=tc,
-            output_directory=output_directory,
+            execution_dir=output_directory,
             force_regen=force_regen,
             fetch=fetch,
             size_threshold=size_threshold,
             clean=clean,
+            label=label,
         )
         if success:
             successes += 1
@@ -965,6 +962,10 @@ def replay_test_case(  # noqa: PLR0912, PLR0915
         str | None,
         typer.Option(help="Specific test case name to replay"),
     ] = None,
+    label: Annotated[
+        str,
+        typer.Option(help="Output slot name under output/ (default: latest)"),
+    ] = "latest",
 ) -> None:
     """
     Replay committed baselines from native blobs and compare to the committed bundle.
@@ -980,25 +981,10 @@ def replay_test_case(  # noqa: PLR0912, PLR0915
         ref test-cases replay --provider example
         ref test-cases replay --provider example --diagnostic global-mean-timeseries
     """
-    import tempfile
-
     from climate_ref.provider_registry import ProviderRegistry
-    from climate_ref_core.diagnostics import ExecutionDefinition
-    from climate_ref_core.output_files import (
-        PLACEHOLDER_OUTPUT_DIR,
-        PLACEHOLDER_TEST_DATA_DIR,
-        from_placeholders,
-    )
-    from climate_ref_core.regression import (
-        COMMITTED_BUNDLE_FILES,
-        Manifest,
-        Tolerance,
-        assert_bundle_regression,
-        materialise_native,
-        verify_committed_integrity,
-    )
+    from climate_ref_core.regression import Manifest, verify_committed_integrity
     from climate_ref_core.regression.store import build_native_store
-    from climate_ref_core.testing import TestCasePaths, load_datasets_from_yaml
+    from climate_ref_core.testing import TestCasePaths
 
     config: Config = ctx.obj.config
     db = ctx.obj.database
@@ -1057,56 +1043,29 @@ def replay_test_case(  # noqa: PLR0912, PLR0915
             failures.append(case_id)
             continue
 
-        with tempfile.TemporaryDirectory() as tmp:
-            tmp_dir = Path(tmp)
-            output_dir = tmp_dir / "output"
-            output_dir.mkdir(parents=True, exist_ok=True)
-
-            try:
-                materialise_native(manifest.native, store, output_dir)
-            except Exception as exc:
-                logger.error(f"{case_id}: failed to materialise native blobs: {exc}")
-                failures.append(case_id)
-                continue
-
-            # Expand placeholders so the re-run reads concrete paths (mirrors the validator).
-            from_placeholders(output_dir, output_dir=output_dir, test_data_dir=paths.test_data_dir)
-
-            datasets = load_datasets_from_yaml(paths.catalog)
-            definition = ExecutionDefinition(
-                diagnostic=diag,
-                key=f"test-{tc.name}",
-                datasets=datasets,
-                output_directory=output_dir,
-                root_directory=tmp_dir,
+        slot = prepare_slot(paths, label)
+        try:
+            source = stage_materialise(
+                diag=diag, tc=tc, paths=paths, manifest=manifest, store=store, slot=slot
             )
+        except Exception as exc:
+            logger.error(f"{case_id}: failed to materialise/rebuild native: {exc}")
+            failures.append(case_id)
+            continue
 
-            try:
-                result = diag.build_execution_result(definition)
-            except Exception as exc:
-                logger.error(f"{case_id}: build_execution_result failed during replay: {exc}")
-                failures.append(case_id)
-                continue
-
-            replacements = {
-                str(output_dir): PLACEHOLDER_OUTPUT_DIR,
-                str(paths.test_data_dir): PLACEHOLDER_TEST_DATA_DIR,
-            }
-            # The comparator silently skips a bundle file with no committed copy,
-            compared = [f for f in COMMITTED_BUNDLE_FILES if (paths.regression / f).exists()]
-            try:
-                for filename in compared:
-                    assert_bundle_regression(
-                        paths.regression / filename,
-                        result.to_output_path(filename),
-                        slug=diag.slug,
-                        tol=Tolerance(),
-                        replacements=replacements,
-                    )
-            except AssertionError as exc:
-                logger.error(f"{case_id}: replay drift detected:\n{exc}")
-                failures.append(case_id)
-                continue
+        stage_build(slot=slot, source=source, paths=paths)
+        cmp_failures, compared = stage_compare(slot=slot, paths=paths, slug=diag.slug)
+        write_source_stamp(
+            slot,
+            label=label,
+            verb="replay",
+            source="materialise",
+            test_case_version=manifest.test_case_version,
+        )
+        if cmp_failures:
+            logger.error(f"{case_id}: replay drift detected:\n" + "\n".join(cmp_failures))
+            failures.append(case_id)
+            continue
 
         successes += 1
         if mismatches:
@@ -1148,6 +1107,17 @@ def mint_native(  # noqa: PLR0912, PLR0915
         str | None,
         typer.Option(help="Specific test case name to mint"),
     ] = None,
+    label: Annotated[
+        str,
+        typer.Option(help="Output slot name under output/ (default: latest)"),
+    ] = "latest",
+    from_replay: Annotated[
+        bool,
+        typer.Option(
+            "--from-replay",
+            help="Author from a replay of the stored native instead of re-running the diagnostic",
+        ),
+    ] = False,
     bump_version: Annotated[
         bool,
         typer.Option(help="Increment test_case_version when authoring the manifest"),
@@ -1171,11 +1141,7 @@ def mint_native(  # noqa: PLR0912, PLR0915
         ref test-cases mint --provider example --bump-version
         ref test-cases mint --provider example --dry-run
     """
-    import tempfile
-
     from climate_ref.provider_registry import ProviderRegistry
-    from climate_ref.testing import TestCaseRunner
-    from climate_ref_core.regression.capture import capture_execution
     from climate_ref_core.regression.manifest import Manifest
     from climate_ref_core.regression.store import NativeStoreUnavailableError, build_native_store
     from climate_ref_core.testing import TestCasePaths, load_datasets_from_yaml
@@ -1233,72 +1199,72 @@ def mint_native(  # noqa: PLR0912, PLR0915
             failures.append(case_id)
             continue
 
-        datasets = load_datasets_from_yaml(paths.catalog)
-        runner = TestCaseRunner(config=config, datasets=datasets)
+        paths.create()
+        previous = Manifest.load(paths.manifest) if paths.manifest.exists() else None
+        # Validate the --from-replay precondition before wiping the slot, so a never-minted
+        # case does not destroy a pre-existing output/<label>/ on its way to failing.
+        if from_replay and (previous is None or not previous.native):
+            logger.error(f"{case_id}: --from-replay needs an existing minted manifest")
+            failures.append(case_id)
+            continue
+
+        slot = prepare_slot(paths, label)
+
+        # Populate the slot's native set: either re-execute the diagnostic, or (with
+        # --from-replay) materialise the previously minted native from the store. The
+        # writable store's fetch/has back the materialise, so no separate read store is needed.
         try:
-            result = runner.run(diag, tc.name, None, clean=True)
-        except Exception as exc:
-            logger.error(f"{case_id}: execution failed during mint: {exc}")
+            if from_replay and previous is not None:  # previous is non-None by the guard above
+                source = stage_materialise(
+                    diag=diag, tc=tc, paths=paths, manifest=previous, store=store, slot=slot
+                )
+                source_kind = "materialise"
+            else:
+                datasets = load_datasets_from_yaml(paths.catalog)
+                source = stage_execute(
+                    config=config,
+                    diag=diag,
+                    tc=tc,
+                    datasets=datasets,
+                    slot=slot,
+                    execution_dir=None,
+                    clean=True,
+                )
+                source_kind = "execute"
+        except StageError as exc:
+            logger.error(f"{case_id}: {exc}")
             failures.append(case_id)
             continue
-        if not result.successful:
-            logger.error(f"{case_id}: execution was not successful")
+        except Exception as exc:
+            logger.error(f"{case_id}: source stage failed during mint: {exc}")
             failures.append(case_id)
             continue
 
-        defn = result.definition
-        output_dir = defn.output_directory
-        fragment = defn.output_fragment()
-        scratch_root = output_dir.parent
-
-        # Any existing results are wiped to make sure we have a clean slate
-        paths.create()
-        if paths.regression.exists():
-            shutil.rmtree(paths.regression)
-        paths.regression.mkdir(parents=True, exist_ok=True)
-
-        with tempfile.TemporaryDirectory() as results_base:
-            results_dir = Path(results_base)
-            committed_digests, native = capture_execution(
-                scratch_root,
-                results_dir,
-                fragment,
-                result,
-                regression_dir=paths.regression,
-                output_dir=output_dir,
-                test_data_dir=paths.test_data_dir,
-            )
-
-            base_dir = results_dir / fragment
-            mismatch = False
-            for relpath, entry in native.items():
-                digest = store.put(base_dir / relpath)
-                if digest != entry.sha256:
-                    logger.error(
-                        f"{case_id}: digest mismatch for {relpath} (store={digest}, captured={entry.sha256})"
-                    )
-                    mismatch = True
-            if mismatch:
-                failures.append(case_id)
-                continue
+        committed = stage_build(slot=slot, source=source, paths=paths)
+        native = snapshot_native(slot)
+        errors = stage_upload(
+            slot=slot, native=native, store=store, previous=(previous.native if previous else {})
+        )
+        if errors:
+            for error in errors:
+                logger.error(f"{case_id}: {error}")
+            failures.append(case_id)
+            continue
 
-        # Author the committed manifest: native block written ONLY here.
-        if paths.manifest.exists():
-            previous = Manifest.load(paths.manifest)
+        # Promote the rebuilt bundle and author the committed manifest: the native block
+        # is written ONLY here.
+        promote_to_baseline(slot, paths)
+        if previous is not None:
             version = previous.test_case_version + 1 if bump_version else previous.test_case_version
         else:
             version = 1
-        _write_test_case_manifest(
-            paths,
-            test_case_version=version,
-            committed=committed_digests,
-            native=native,
-        )
+        _write_test_case_manifest(paths, test_case_version=version, committed=committed, native=native)
+        write_source_stamp(slot, label=label, verb="mint", source=source_kind, test_case_version=version)
 
         minted += 1
         logger.info(
             f"Minted native baseline: {case_id} "
-            f"({len(native)} native file(s), {len(committed_digests)} committed file(s), "
+            f"({len(native)} native file(s), {len(committed)} committed file(s), "
             f"test_case_version={version})"
         )
 
@@ -1312,6 +1278,125 @@ def mint_native(  # noqa: PLR0912, PLR0915
     console.print(f"[green]Minted {minted} native baseline(s)[/green]")
 
 
+@app.command(name="build")
+def build_test_case(  # noqa: PLR0912, PLR0915
+    ctx: typer.Context,
+    provider: Annotated[
+        str,
+        typer.Option(help="Provider slug (required, e.g., 'example', 'ilamb')"),
+    ],
+    diagnostic: Annotated[
+        str | None,
+        typer.Option(help="Specific diagnostic slug to build"),
+    ] = None,
+    test_case: Annotated[
+        str | None,
+        typer.Option(help="Specific test case name to build"),
+    ] = None,
+    label: Annotated[
+        str,
+        typer.Option(help="Output slot to rebuild from (default: latest)"),
+    ] = "latest",
+    force_regen: Annotated[
+        bool,
+        typer.Option(help="Promote the rebuilt bundle to the tracked regression baseline"),
+    ] = False,
+) -> None:
+    """
+    Rebuild the committed bundle from an existing output slot, without re-executing.
+
+    Reuses the native already materialised in ``output/<label>/`` (by a previous
+    ``run`` / ``replay`` / ``mint``) to regenerate the slot's committed bundle. The tracked
+    ``regression/`` baseline is only promoted when ``--force-regen`` is given or no baseline
+    exists yet, so a rebuild never silently clobbers a committed baseline.
+
+    Examples
+    --------
+        ref test-cases build --provider example
+        ref test-cases build --provider example --label before --force-regen
+    """
+    from climate_ref.provider_registry import ProviderRegistry
+    from climate_ref_core.regression.manifest import Manifest
+    from climate_ref_core.testing import TestCasePaths
+
+    config: Config = ctx.obj.config
+    db = ctx.obj.database
+    console: Console = ctx.obj.console
+
+    registry = ProviderRegistry.build_from_config(config, db)
+    cases = list(_iter_test_cases(registry, provider=provider, diagnostic=diagnostic, test_case=test_case))
+    if not cases:
+        logger.warning(f"No test cases found for provider {provider!r}")
+        raise typer.Exit(code=0)
+
+    built = 0
+    failures: list[str] = []
+
+    for diag, tc in cases:
+        case_id = f"{provider}/{diag.slug}/{tc.name}"
+        paths = TestCasePaths.from_diagnostic(diag, tc.name)
+        if paths is None:
+            logger.warning(f"Could not determine test case directory for {case_id}")
+            continue
+        slot = paths.output_slot(label)
+        if not slot.exists() or not slot_native_relpaths(slot):
+            logger.error(f"{case_id}: no native in output slot {label!r}; run/replay/mint it first")
+            failures.append(case_id)
+            continue
+        if not paths.catalog.exists():
+            logger.error(f"No catalog file for {case_id}; run `ref test-cases fetch` first")
+            failures.append(case_id)
+            continue
+
+        try:
+            source = stage_rebuild_from_slot(diag=diag, tc=tc, paths=paths, slot=slot)
+        except Exception as exc:
+            logger.error(f"{case_id}: failed to rebuild bundle from slot: {exc}")
+            failures.append(case_id)
+            continue
+
+        committed = stage_build(slot=slot, source=source, paths=paths)
+        previous = Manifest.load(paths.manifest) if paths.manifest.exists() else None
+        version = previous.test_case_version if previous else 1
+
+        if force_regen or not paths.regression.exists():
+            promote_to_baseline(slot, paths)
+            native = snapshot_native(slot)
+            if previous is not None:
+                _write_test_case_manifest(
+                    paths,
+                    test_case_version=previous.test_case_version,
+                    committed=committed,
+                    native=previous.native,
+                    schema=previous.schema,
+                )
+                if native_is_stale(native, previous.native):
+                    logger.warning(
+                        f"{case_id}: committed bundle rebuilt but the native baseline differs; "
+                        "re-mint with `ref test-cases mint`"
+                    )
+            else:
+                _write_test_case_manifest(paths, test_case_version=1, committed=committed, native={})
+            logger.info(f"Promoted rebuilt bundle to regression baseline: {paths.regression}")
+        else:
+            logger.info(
+                f"Wrote output slot {slot}/regression "
+                "(committed baseline unchanged; use --force-regen to promote it)"
+            )
+
+        write_source_stamp(slot, label=label, verb="build", source="rebuild", test_case_version=version)
+        built += 1
+
+    console.print()
+    if failures:
+        console.print(f"[yellow]Build: {built} built, {len(failures)} failed[/yellow]")
+        console.print("[red]Failed builds:[/red]")
+        for case in failures:
+            console.print(f"  - {case}")
+        raise typer.Exit(code=1)
+    console.print(f"[green]Built {built} committed bundle(s) from output slots[/green]")
+
+
 @app.command(name="check-store")
 def check_store(
     ctx: typer.Context,
diff --git a/packages/climate-ref/tests/unit/cli/test_test_cases.py b/packages/climate-ref/tests/unit/cli/test_test_cases.py
index 44d969b3d..2b78cecf9 100644
--- a/packages/climate-ref/tests/unit/cli/test_test_cases.py
+++ b/packages/climate-ref/tests/unit/cli/test_test_cases.py
@@ -536,33 +536,9 @@ def test_run_no_test_case_dir(self, invoke_cli, mocker):
             expected_exit_code=1,
         )
 
-    def test_run_with_fetch_flag(self, invoke_cli, mocker):
-        """Test run command with --fetch flag fetches data first."""
-        mock_tc = MagicMock()
-        mock_tc.name = "default"
-        mock_tc.description = "test"
-        mock_spec = MagicMock()
-        mock_spec.test_cases = [mock_tc]
-        mock_diag = MagicMock(slug="test-diag", test_data_spec=mock_spec)
-        mock_diag.provider = MagicMock(slug="example")
-        mock_provider = MagicMock(slug="example")
-        mock_provider.diagnostics.return_value = [mock_diag]
-        mock_registry = MagicMock(providers=[mock_provider])
-
-        mock_result = MagicMock(successful=True, metric_bundle_filename=None, output_bundle_filename=None)
-        mock_runner = MagicMock()
-        mock_runner.run.return_value = mock_result
-
-        mocker.patch(
-            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
-            return_value=mock_registry,
-        )
-        mocker.patch(
-            "climate_ref.cli.test_cases._fetch_and_build_catalog",
-            return_value=(MagicMock(), True),
-        )
-        mocker.patch("climate_ref.testing.TestCaseRunner", return_value=mock_runner)
-        mocker.patch("climate_ref_core.testing.TestCasePaths.from_diagnostic", return_value=None)
+    def test_run_with_fetch_flag(self, invoke_cli, mocker, tmp_path):
+        """`run --fetch` fetches data, executes, and materialises the output slot (exit 0)."""
+        paths, _scratch, _regression, _runner = _setup_real_run(mocker, tmp_path, fetch=True)
 
         result = invoke_cli(
             [
@@ -576,6 +552,8 @@ def test_run_with_fetch_flag(self, invoke_cli, mocker):
             ],
         )
         assert result.exit_code == 0
+        # The slot was populated with the executed native set.
+        assert (paths.output_slot("latest") / "diagnostic.json").exists()
 
     def test_run_with_fetch_flag_raises_error(self, invoke_cli, mocker):
         """Test run command with --fetch flag handles DatasetResolutionError."""
@@ -622,39 +600,8 @@ def test_run_with_fetch_flag_raises_error(self, invoke_cli, mocker):
         ],
     )
     def test_run_handles_exceptions(self, invoke_cli, mocker, tmp_path, exception_cls, exception_msg):
-        """Test run command handles various exceptions from runner."""
-        mock_tc = MagicMock()
-        mock_tc.name = "default"
-        mock_tc.description = "test"
-        mock_spec = MagicMock()
-        mock_spec.test_cases = [mock_tc]
-        mock_diag = MagicMock(slug="test-diag", test_data_spec=mock_spec)
-        mock_diag.provider = MagicMock(slug="example")
-        mock_provider = MagicMock(slug="example")
-        mock_provider.diagnostics.return_value = [mock_diag]
-        mock_registry = MagicMock(providers=[mock_provider])
-
-        test_case_dir = tmp_path / "test-diag" / "default"
-        test_case_dir.mkdir(parents=True)
-        catalog_path = test_case_dir / "catalog.yaml"
-        catalog_path.touch()
-
-        mock_paths = MagicMock()
-        mock_paths.catalog = catalog_path
-
-        mock_runner = MagicMock()
-        mock_runner.run.side_effect = exception_cls(exception_msg)
-
-        mocker.patch(
-            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
-            return_value=mock_registry,
-        )
-        mocker.patch(
-            "climate_ref_core.testing.TestCasePaths.from_diagnostic",
-            return_value=mock_paths,
-        )
-        mocker.patch("climate_ref_core.testing.load_datasets_from_yaml", return_value=MagicMock())
-        mocker.patch("climate_ref.testing.TestCaseRunner", return_value=mock_runner)
+        """A diagnostic execution exception is caught and fails the test case (exit 1)."""
+        _setup_real_run(mocker, tmp_path, runner_result=exception_cls(exception_msg))
 
         invoke_cli(
             ["test-cases", "run", "--provider", "example", "--diagnostic", "test-diag"],
@@ -662,90 +609,19 @@ def test_run_handles_exceptions(self, invoke_cli, mocker, tmp_path, exception_cl
         )
 
     def test_run_successful_execution(self, invoke_cli, mocker, tmp_path):
-        """Test run command with successful execution."""
-        mock_tc = MagicMock()
-        mock_tc.name = "default"
-        mock_tc.description = "test"
-        mock_spec = MagicMock()
-        mock_spec.test_cases = [mock_tc]
-        mock_diag = MagicMock(slug="test-diag", test_data_spec=mock_spec)
-        mock_diag.provider = MagicMock(slug="example")
-        mock_provider = MagicMock(slug="example")
-        mock_provider.diagnostics.return_value = [mock_diag]
-        mock_registry = MagicMock(providers=[mock_provider])
-
-        test_case_dir = tmp_path / "test-diag" / "default"
-        test_case_dir.mkdir(parents=True)
-        catalog_path = test_case_dir / "catalog.yaml"
-        catalog_path.touch()
-
-        # Create existing regression dir to avoid copy being triggered
-        regression_dir = test_case_dir / "regression"
-        regression_dir.mkdir()
-
-        mock_paths = MagicMock()
-        mock_paths.catalog = catalog_path
-        mock_paths.regression = regression_dir  # Use real dir that exists
-
-        mock_result = MagicMock(
-            successful=True,
-            metric_bundle_filename="metrics.json",
-            output_bundle_filename="output.json",
-        )
-        mock_result.to_output_path.side_effect = lambda x: tmp_path / x
-        mock_runner = MagicMock()
-        mock_runner.run.return_value = mock_result
-
-        mocker.patch(
-            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
-            return_value=mock_registry,
-        )
-        mocker.patch(
-            "climate_ref_core.testing.TestCasePaths.from_diagnostic",
-            return_value=mock_paths,
-        )
-        mocker.patch("climate_ref_core.testing.load_datasets_from_yaml", return_value=MagicMock())
-        mocker.patch("climate_ref.testing.TestCaseRunner", return_value=mock_runner)
+        """A successful execution writes the slot and exits 0 (baseline already present)."""
+        paths, _scratch, _regression, _runner = _setup_real_run(mocker, tmp_path, regression_files={})
 
         result = invoke_cli(
             ["test-cases", "run", "--provider", "example", "--diagnostic", "test-diag"],
         )
         assert result.exit_code == 0
+        # The slot holds the rebuilt committed bundle even when the baseline is untouched.
+        assert (paths.output_slot("latest") / "regression" / "diagnostic.json").exists()
 
     def test_run_unsuccessful_execution(self, invoke_cli, mocker, tmp_path):
-        """Test run command with unsuccessful execution result."""
-        mock_tc = MagicMock()
-        mock_tc.name = "default"
-        mock_tc.description = "test"
-        mock_spec = MagicMock()
-        mock_spec.test_cases = [mock_tc]
-        mock_diag = MagicMock(slug="test-diag", test_data_spec=mock_spec)
-        mock_diag.provider = MagicMock(slug="example")
-        mock_provider = MagicMock(slug="example")
-        mock_provider.diagnostics.return_value = [mock_diag]
-        mock_registry = MagicMock(providers=[mock_provider])
-
-        test_case_dir = tmp_path / "test-diag" / "default"
-        test_case_dir.mkdir(parents=True)
-        catalog_path = test_case_dir / "catalog.yaml"
-        catalog_path.touch()
-
-        mock_paths = MagicMock()
-        mock_paths.catalog = catalog_path
-
-        mock_runner = MagicMock()
-        mock_runner.run.return_value = MagicMock(successful=False)
-
-        mocker.patch(
-            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
-            return_value=mock_registry,
-        )
-        mocker.patch(
-            "climate_ref_core.testing.TestCasePaths.from_diagnostic",
-            return_value=mock_paths,
-        )
-        mocker.patch("climate_ref_core.testing.load_datasets_from_yaml", return_value=MagicMock())
-        mocker.patch("climate_ref.testing.TestCaseRunner", return_value=mock_runner)
+        """An unsuccessful execution result fails the test case (exit 1)."""
+        _setup_real_run(mocker, tmp_path, runner_result="unsuccessful")
 
         invoke_cli(
             ["test-cases", "run", "--provider", "example", "--diagnostic", "test-diag"],
@@ -848,59 +724,17 @@ def test_run_with_force_regen(self, invoke_cli, mocker, tmp_path):
         }
 
     def test_run_with_existing_baseline(self, invoke_cli, mocker, tmp_path):
-        """Test run command logs when baseline exists."""
-        mock_tc = MagicMock()
-        mock_tc.name = "default"
-        mock_tc.description = "test"
-        mock_spec = MagicMock()
-        mock_spec.test_cases = [mock_tc]
-        mock_diag = MagicMock(slug="test-diag", test_data_spec=mock_spec)
-        mock_diag.provider = MagicMock(slug="example")
-        mock_provider = MagicMock(slug="example")
-        mock_provider.diagnostics.return_value = [mock_diag]
-        mock_registry = MagicMock(providers=[mock_provider])
-
-        # Set up test case directory structure with existing regression data
-        test_case_dir = tmp_path / "test-diag" / "default"
-        test_case_dir.mkdir(parents=True)
-        catalog_path = test_case_dir / "catalog.yaml"
-        catalog_path.touch()
-
-        # Create existing regression directory with baseline file
-        regression_dir = test_case_dir / "regression"
-        regression_dir.mkdir(parents=True)
-        baseline_file = regression_dir / "metrics.json"
-        baseline_file.write_text('{"existing": "baseline"}')
-
-        mock_paths = MagicMock()
-        mock_paths.catalog = catalog_path
-        mock_paths.regression = regression_dir
-
-        mock_result = MagicMock(
-            successful=True,
-            metric_bundle_filename="metrics.json",
-            output_bundle_filename=None,
-        )
-        mock_result.to_output_path.return_value = tmp_path / "metrics.json"
-        mock_runner = MagicMock()
-        mock_runner.run.return_value = mock_result
-
-        mocker.patch(
-            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
-            return_value=mock_registry,
+        """Without --force-regen, an existing baseline is left untouched (promotion gate)."""
+        _paths, _scratch, regression_dir, _runner = _setup_real_run(
+            mocker, tmp_path, regression_files={"metrics.json": '{"existing": "baseline"}'}
         )
-        mocker.patch(
-            "climate_ref_core.testing.TestCasePaths.from_diagnostic",
-            return_value=mock_paths,
-        )
-        mocker.patch("climate_ref_core.testing.load_datasets_from_yaml", return_value=MagicMock())
-        mocker.patch("climate_ref.testing.TestCaseRunner", return_value=mock_runner)
+        baseline_file = regression_dir / "metrics.json"
 
         result = invoke_cli(
             ["test-cases", "run", "--provider", "example", "--diagnostic", "test-diag"],
         )
         assert result.exit_code == 0
-        # Without --force-regen, baseline should be unchanged
+        # Without --force-regen, the committed baseline is not promoted.
         assert baseline_file.read_text() == '{"existing": "baseline"}'
 
     def test_run_with_only_missing_skips_existing(self, invoke_cli, mocker, tmp_path):
@@ -974,6 +808,71 @@ def test_run_with_if_changed_skips_unchanged(self, invoke_cli, mocker, tmp_path)
         )
         assert "No test cases found" in result.stderr
 
+    def test_run_label_slots_coexist(self, invoke_cli, mocker, tmp_path):
+        """Two runs under different --label slots persist side by side."""
+        paths, _scratch, _regression, _runner = _setup_real_run(mocker, tmp_path)
+
+        for label in ("before", "after"):
+            assert (
+                invoke_cli(
+                    [
+                        "test-cases",
+                        "run",
+                        "--provider",
+                        "example",
+                        "--diagnostic",
+                        "test-diag",
+                        "--label",
+                        label,
+                        "--force-regen",
+                    ]
+                ).exit_code
+                == 0
+            )
+
+        assert (paths.output_slot("before") / "diagnostic.json").exists()
+        assert (paths.output_slot("after") / "diagnostic.json").exists()
+        # The default slot was never written.
+        assert not paths.output_slot("latest").exists()
+
+    def test_run_force_regen_promotes_over_existing_baseline(self, invoke_cli, mocker, tmp_path):
+        """--force-regen replaces an existing committed baseline with the freshly built bundle."""
+        _paths, _scratch, regression_dir, _runner = _setup_real_run(
+            mocker, tmp_path, regression_files={"diagnostic.json": '{"old": "baseline"}'}
+        )
+
+        assert (
+            invoke_cli(
+                ["test-cases", "run", "--provider", "example", "--diagnostic", "test-diag", "--force-regen"]
+            ).exit_code
+            == 0
+        )
+        # The stale baseline was promoted over by the rebuilt bundle.
+        assert (regression_dir / "diagnostic.json").read_text() != '{"old": "baseline"}'
+
+    def test_run_warns_when_native_stale(self, invoke_cli, mocker, tmp_path):
+        """force-regen warns (does not block) when the rebuilt native differs from the minted baseline."""
+        from climate_ref_core.regression.manifest import SCHEMA_VERSION, Manifest, NativeEntry
+
+        paths, _scratch, _regression, _runner = _setup_real_run(mocker, tmp_path, regression_files={})
+        # A previously minted manifest whose native digests will not match the freshly built slot.
+        Manifest(
+            schema=SCHEMA_VERSION,
+            test_case_version=3,
+            committed={},
+            native={"diagnostic.json": NativeEntry(sha256="00" * 32, size=1)},
+        ).dump(paths.manifest)
+
+        result = invoke_cli(
+            ["test-cases", "run", "--provider", "example", "--diagnostic", "test-diag", "--force-regen"]
+        )
+        assert result.exit_code == 0
+        assert "native baseline differs" in result.stderr
+        # run preserves the mint-owned native block and version (it never authors native).
+        manifest = Manifest.load(paths.manifest)
+        assert manifest.test_case_version == 3
+        assert set(manifest.native) == {"diagnostic.json"}
+
 
 class TestFetchAndBuildCatalogSourceTypes:
     """Tests for _fetch_and_build_catalog with different source types."""
@@ -1325,6 +1224,90 @@ def _make_case_mocks():
     return registry, diag, tc
 
 
+def _setup_real_run(mocker, tmp_path, *, runner_result="success", regression_files=None, fetch=False):
+    """
+    Wire a ``run``/``build`` test against a real ``TestCasePaths`` and scratch execution dir.
+
+    The slot-based ``run`` materialises ``output/<label>/`` on every invocation, so it needs
+    real on-disk paths (a ``MagicMock`` slot cannot be wiped or recreated). This builds a real
+    test case directory plus a scratch output dir holding a curated CMEC bundle, and a mock
+    runner whose result points at that scratch dir.
+
+    Parameters
+    ----------
+    runner_result
+        ``"success"`` (default) for a successful result, ``"unsuccessful"`` for
+        ``successful=False``, or an ``Exception`` instance for the runner to raise.
+    regression_files
+        ``{filename: text}`` pre-written into ``regression/`` (creating it), or ``None`` to
+        leave the baseline absent.
+    fetch
+        When True, patch ``_fetch_and_build_catalog`` (for ``run --fetch``) instead of
+        ``load_datasets_from_yaml``.
+
+    Returns
+    -------
+    :
+        ``(paths, scratch_output_dir, regression_dir, runner)``.
+    """
+    from climate_ref_core.pycmec.output import CMECOutput
+    from climate_ref_core.testing import TestCasePaths
+
+    registry, _diag, _tc = _make_case_mocks()
+
+    test_case_dir = tmp_path / "td" / "test-diag" / "default"
+    test_case_dir.mkdir(parents=True)
+    # A minimal but valid catalog so the real load_datasets_from_yaml returns an empty
+    # ExecutionDatasetCollection. The slot stages load the catalog directly (via the stages
+    # module's own binding), so patching only climate_ref_core.testing would not reach them.
+    (test_case_dir / "catalog.yaml").write_text("_metadata:\n  hash: abc123\n")
+    paths = TestCasePaths(root=test_case_dir)
+
+    if regression_files is not None:
+        paths.regression.mkdir(parents=True)
+        for name, text in regression_files.items():
+            (paths.regression / name).write_text(text)
+
+    scratch_output_dir = tmp_path / "scratch" / "frag"
+    scratch_output_dir.mkdir(parents=True)
+    (scratch_output_dir / "diagnostic.json").write_text('{"test": "data"}')
+    (scratch_output_dir / "output.json").write_text(json.dumps(CMECOutput.create_template()))
+    (scratch_output_dir / "series.json").write_text("[]")
+
+    defn = MagicMock()
+    defn.output_directory = scratch_output_dir
+    defn.output_fragment.return_value = Path("frag")
+    result = MagicMock(
+        successful=(runner_result == "success"),
+        metric_bundle_filename=Path("diagnostic.json"),
+        output_bundle_filename=Path("output.json"),
+        series_filename=Path("series.json"),
+    )
+    result.to_output_path.side_effect = lambda f: scratch_output_dir / f
+    result.definition = defn
+
+    runner = MagicMock()
+    if isinstance(runner_result, BaseException):
+        runner.run.side_effect = runner_result
+    else:
+        runner.run.return_value = result
+
+    mocker.patch(
+        "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+        return_value=registry,
+    )
+    mocker.patch("climate_ref_core.testing.TestCasePaths.from_diagnostic", return_value=paths)
+    mocker.patch("climate_ref.testing.TestCaseRunner", return_value=runner)
+    mocker.patch("climate_ref_core.testing.get_catalog_hash", return_value="abc123")
+    if fetch:
+        mocker.patch(
+            "climate_ref.cli.test_cases._fetch_and_build_catalog",
+            return_value=(MagicMock(), True),
+        )
+
+    return paths, scratch_output_dir, paths.regression, runner
+
+
 class TestSyncCommand:
     """Tests for the `test-cases sync` CLI verb."""
 
@@ -1488,7 +1471,7 @@ def test_replay_integrity_mismatch_warns_and_continues(self, invoke_cli, mocker,
     def test_replay_reconciles_integrity_mismatch_within_tolerance(self, invoke_cli, mocker, tmp_path):
         """A byte-level baseline difference forgiven by the tolerant comparison is reported as reconciled.
 
-        This proves the follow-up comparison actually ran after the integrity warning: the success line
+        This proves the comparison stage actually ran after the integrity warning: the success line
         names the bundle files compared and states they are equivalent within tolerance, rather than
         silently claiming a match.
         """
@@ -1520,14 +1503,14 @@ def test_replay_reconciles_integrity_mismatch_within_tolerance(self, invoke_cli,
         )
         mocker.patch("climate_ref_core.testing.TestCasePaths.from_diagnostic", return_value=paths)
         mocker.patch("climate_ref_core.regression.store.build_native_store", return_value=store)
-        # Stub the heavy replay internals so we deterministically reach the success branch:
-        # native materialisation, placeholder expansion, dataset load, definition, and the tolerant
-        # comparison itself (a no-op assert == "equivalent within tolerance").
-        mocker.patch("climate_ref_core.regression.materialise_native")
-        mocker.patch("climate_ref_core.output_files.from_placeholders")
-        mocker.patch("climate_ref_core.testing.load_datasets_from_yaml", return_value=[])
-        mocker.patch("climate_ref_core.diagnostics.ExecutionDefinition")
-        mocker.patch("climate_ref_core.regression.assert_bundle_regression")
+        # Stub the slot stages so we deterministically reach the success branch: materialise +
+        # rebuild, committed-bundle build, and the tolerant comparison (no drift, 3 files compared).
+        mocker.patch("climate_ref.cli.test_cases.stage_materialise")
+        mocker.patch("climate_ref.cli.test_cases.stage_build")
+        mocker.patch(
+            "climate_ref.cli.test_cases.stage_compare",
+            return_value=([], ["series.json", "diagnostic.json", "output.json"]),
+        )
 
         result = invoke_cli(
             [
@@ -1676,6 +1659,124 @@ def test_mint_writes_blobs_and_manifest(self, invoke_cli, mocker, tmp_path):
         for entry in manifest.native.values():
             assert store.has(entry.sha256)
 
+    def test_mint_skips_unchanged_native_on_remint(self, invoke_cli, mocker, tmp_path):
+        """Re-executing a mint with byte-identical native uploads nothing (changed-digest skip)."""
+        from climate_ref_core.regression.store import LocalFilesystemStore
+
+        _setup_real_run(mocker, tmp_path)
+        store = LocalFilesystemStore(root=tmp_path / "store")
+        mocker.patch("climate_ref_core.regression.store.build_native_store", return_value=store)
+
+        first = invoke_cli(["test-cases", "mint", "--provider", "example"])
+        assert first.exit_code == 0
+        assert "Uploaded 3 native blob(s), skipped 0" in first.stderr  # first mint uploads everything
+
+        # A second mint with identical outputs re-executes but uploads nothing new.
+        second = invoke_cli(["test-cases", "mint", "--provider", "example"])
+        assert second.exit_code == 0
+        assert "Uploaded 0 native blob(s), skipped 3" in second.stderr
+
+    def test_mint_from_replay_reauthors_without_reexecuting(self, invoke_cli, mocker, tmp_path):
+        """`mint --from-replay` rebuilds from stored native, uploading nothing and not re-executing."""
+        from climate_ref_core.regression.manifest import Manifest
+        from climate_ref_core.regression.store import LocalFilesystemStore
+
+        paths, _scratch, _regression, runner = _setup_real_run(mocker, tmp_path)
+        store = LocalFilesystemStore(root=tmp_path / "store")
+        mocker.patch("climate_ref_core.regression.store.build_native_store", return_value=store)
+
+        # First mint executes the diagnostic and uploads the native set.
+        first = invoke_cli(["test-cases", "mint", "--provider", "example"])
+        assert first.exit_code == 0
+        minted = Manifest.load(paths.manifest)
+        assert set(minted.native) == {"diagnostic.json", "output.json", "series.json"}
+        assert runner.run.call_count == 1
+        assert "Uploaded 3 native blob(s), skipped 0" in first.stderr
+
+        # Re-mint from the stored native: no execution, no new uploads, identical native block.
+        result = invoke_cli(["test-cases", "mint", "--provider", "example", "--from-replay"])
+        assert result.exit_code == 0
+        assert runner.run.call_count == 1  # unchanged: the diagnostic was not re-run
+        assert "Uploaded 0 native blob(s), skipped 3" in result.stderr
+        replayed = Manifest.load(paths.manifest)
+        assert {k: v.sha256 for k, v in replayed.native.items()} == {
+            k: v.sha256 for k, v in minted.native.items()
+        }
+        # The slot records the from-replay source.
+        stamp = json.loads((paths.output_slot("latest") / ".source.json").read_text())
+        assert stamp["verb"] == "mint"
+        assert stamp["source"] == "materialise"
+
+    def test_mint_from_replay_requires_minted_manifest(self, invoke_cli, mocker, tmp_path):
+        """`mint --from-replay` fails when there is no existing minted native to replay from."""
+        from climate_ref_core.regression.store import LocalFilesystemStore
+
+        _setup_real_run(mocker, tmp_path)
+        store = LocalFilesystemStore(root=tmp_path / "store")
+        mocker.patch("climate_ref_core.regression.store.build_native_store", return_value=store)
+
+        result = invoke_cli(
+            ["test-cases", "mint", "--provider", "example", "--from-replay"],
+            expected_exit_code=1,
+        )
+        assert "--from-replay needs an existing minted manifest" in result.stderr
+
+
+class TestBuildCommand:
+    """Tests for the `test-cases build` CLI verb."""
+
+    def test_build_help(self, invoke_cli):
+        result = invoke_cli(["test-cases", "build", "--help"])
+        assert "Rebuild the committed bundle" in result.stdout
+
+    def test_build_fails_without_slot(self, invoke_cli, mocker, tmp_path):
+        """build refuses when the named output slot has no native to rebuild from."""
+        _setup_real_run(mocker, tmp_path)  # catalog present, but no output slot materialised
+        result = invoke_cli(
+            ["test-cases", "build", "--provider", "example", "--diagnostic", "test-diag"],
+            expected_exit_code=1,
+        )
+        assert "no native in output slot" in result.stderr.lower()
+
+    def test_build_rebuilds_from_slot_without_executing(self, invoke_cli, mocker, tmp_path):
+        """build regenerates the committed bundle from an existing slot, never re-running."""
+        paths, _scratch, _regression, runner = _setup_real_run(mocker, tmp_path)
+
+        # Seed a slot (and baseline) with one run.
+        assert (
+            invoke_cli(
+                ["test-cases", "run", "--provider", "example", "--diagnostic", "test-diag", "--force-regen"]
+            ).exit_code
+            == 0
+        )
+        assert runner.run.call_count == 1
+
+        # Rebuild the committed bundle from that slot, without executing the diagnostic.
+        result = invoke_cli(["test-cases", "build", "--provider", "example", "--diagnostic", "test-diag"])
+        assert result.exit_code == 0
+        assert runner.run.call_count == 1  # build did not re-run the diagnostic
+        assert (paths.output_slot("latest") / "regression" / "diagnostic.json").exists()
+        stamp = json.loads((paths.output_slot("latest") / ".source.json").read_text())
+        assert stamp["verb"] == "build"
+        assert stamp["source"] == "rebuild"
+
+
+def test_output_slot_pattern_is_gitignored(tmp_path):
+    """The repo .gitignore shadows materialised output slots under any test-data tree."""
+    from git import Repo
+
+    repo_gitignore = Path(__file__).resolve().parents[5] / ".gitignore"
+    repo = Repo.init(tmp_path)
+    (tmp_path / ".gitignore").write_text(repo_gitignore.read_text())
+
+    slot = tmp_path / "packages" / "pkg" / "tests" / "test-data" / "diag" / "default" / "output" / "latest"
+    slot.mkdir(parents=True)
+    (slot / "native.nc").write_bytes(b"x")
+
+    rel = "packages/pkg/tests/test-data/diag/default/output/latest/native.nc"
+    # git check-ignore echoes the path when it is ignored (and exits non-zero otherwise).
+    assert repo.git.check_ignore(rel) == rel
+
 
 class TestCheckStoreCommand:
     """Tests for the ``ref test-cases check-store`` command."""

From 81203ce7c81488ae40dbef02c9c6fd4df38d3183 Mon Sep 17 00:00:00 2001
From: Jared Lewis <jared@jared.kiwi.nz>
Date: Sun, 21 Jun 2026 21:47:51 +1000
Subject: [PATCH 02/12] refactor(test-cases): split the test_cases CLI into a
 subpackage

test_cases.py had grown past 1700 lines. Split it into a
climate_ref.cli.test_cases package grouped by concern: discovery
(fetch/list), run, baselines (replay/mint/build), store
(sync/check-store) and ci_gate, over _catalog/_common/_stages helpers
and an _app module holding the shared Typer app.

Command implementations are carried over unchanged. The package
re-exports the helpers the unit tests import directly and registers the
command modules in a fixed order so `ref test-cases --help` keeps its
verb ordering. _test_case_stages.py moves in as _stages.py; the test
mock targets are updated to the new module paths.
---
 .../src/climate_ref/cli/test_cases.py         | 1706 -----------------
 .../climate_ref/cli/test_cases/__init__.py    |   38 +
 .../src/climate_ref/cli/test_cases/_app.py    |   13 +
 .../climate_ref/cli/test_cases/_catalog.py    |  176 ++
 .../src/climate_ref/cli/test_cases/_common.py |   91 +
 .../_stages.py}                               |   10 +-
 .../climate_ref/cli/test_cases/baselines.py   |  489 +++++
 .../src/climate_ref/cli/test_cases/ci_gate.py |  293 +++
 .../climate_ref/cli/test_cases/discovery.py   |  231 +++
 .../src/climate_ref/cli/test_cases/run.py     |  426 ++++
 .../src/climate_ref/cli/test_cases/store.py   |  143 ++
 .../tests/unit/cli/test_test_cases.py         |   30 +-
 12 files changed, 1920 insertions(+), 1726 deletions(-)
 delete mode 100644 packages/climate-ref/src/climate_ref/cli/test_cases.py
 create mode 100644 packages/climate-ref/src/climate_ref/cli/test_cases/__init__.py
 create mode 100644 packages/climate-ref/src/climate_ref/cli/test_cases/_app.py
 create mode 100644 packages/climate-ref/src/climate_ref/cli/test_cases/_catalog.py
 create mode 100644 packages/climate-ref/src/climate_ref/cli/test_cases/_common.py
 rename packages/climate-ref/src/climate_ref/cli/{_test_case_stages.py => test_cases/_stages.py} (96%)
 create mode 100644 packages/climate-ref/src/climate_ref/cli/test_cases/baselines.py
 create mode 100644 packages/climate-ref/src/climate_ref/cli/test_cases/ci_gate.py
 create mode 100644 packages/climate-ref/src/climate_ref/cli/test_cases/discovery.py
 create mode 100644 packages/climate-ref/src/climate_ref/cli/test_cases/run.py
 create mode 100644 packages/climate-ref/src/climate_ref/cli/test_cases/store.py

diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases.py b/packages/climate-ref/src/climate_ref/cli/test_cases.py
deleted file mode 100644
index 844ae8d0c..000000000
--- a/packages/climate-ref/src/climate_ref/cli/test_cases.py
+++ /dev/null
@@ -1,1706 +0,0 @@
-"""
-Test data management commands for diagnostic development.
-
-These commands are intended for developers working on diagnostics and require
-a source checkout of the project with test data directories available.
-"""
-
-from __future__ import annotations
-
-from pathlib import Path
-from typing import TYPE_CHECKING, Annotated
-
-import typer
-from loguru import logger
-from rich.console import Console
-from rich.table import Table
-
-from climate_ref.cli._git_utils import collect_regression_file_info, get_repo_for_path
-from climate_ref.cli._test_case_stages import (
-    StageError,
-    native_is_stale,
-    prepare_slot,
-    promote_to_baseline,
-    slot_native_relpaths,
-    snapshot_native,
-    stage_build,
-    stage_compare,
-    stage_execute,
-    stage_materialise,
-    stage_rebuild_from_slot,
-    stage_upload,
-    write_source_stamp,
-)
-from climate_ref.cli._utils import format_size
-from climate_ref.config import Config
-from climate_ref_core.exceptions import (
-    DatasetResolutionError,
-    InvalidDiagnosticException,
-    NoTestDataSpecError,
-    TestCaseNotFoundError,
-)
-
-if TYPE_CHECKING:
-    from collections.abc import Iterator
-
-    import pandas as pd
-
-    from climate_ref.datasets import DatasetAdapter
-    from climate_ref.provider_registry import ProviderRegistry
-    from climate_ref_core.datasets import ExecutionDatasetCollection, SourceDatasetType
-    from climate_ref_core.diagnostics import Diagnostic
-    from climate_ref_core.regression.manifest import Manifest, NativeEntry
-    from climate_ref_core.testing import TestCase, TestCasePaths
-
-
-app = typer.Typer(help=__doc__)
-
-
-def _build_catalog(dataset_adapter: DatasetAdapter, file_paths: list[Path]) -> pd.DataFrame:
-    """
-    Parses a list of datasets using a dataset adapter
-
-    Parameters
-    ----------
-    file_paths
-        List of files to build a catalog from
-
-    Returns
-    -------
-    pd.DataFrame
-        DataFrame catalog of datasets with metadata and paths
-    """
-    import pandas as pd
-
-    # Collect unique parent directories since the adapter scans directories
-    parent_dirs = list({fp.parent for fp in file_paths})
-
-    catalog_dfs = []
-    for parent_dir in parent_dirs:
-        try:
-            df = dataset_adapter.find_local_datasets(parent_dir)
-
-            # Filter to only include the files we fetched
-            fetched_files = {str(fp) for fp in file_paths}
-            df = df[df["path"].isin(fetched_files)]
-            if df.empty:
-                logger.warning(f"No matching files found in catalog for {parent_dir}")
-            catalog_dfs.append(df)
-        except Exception as e:
-            logger.warning(f"Failed to parse {parent_dir}: {e}")
-
-    if not catalog_dfs:
-        return pd.DataFrame()
-    return pd.concat(catalog_dfs, ignore_index=True)
-
-
-def _solve_test_case(
-    diagnostic: Diagnostic,
-    data_catalog: dict[SourceDatasetType, pd.DataFrame],
-) -> ExecutionDatasetCollection:
-    """
-    Solve for test case datasets by applying the diagnostic's data requirements.
-
-    Runs the solver to determine which datasets from the catalog
-    satisfy the diagnostic's requirements.
-    """
-    from climate_ref.solver import solve_executions
-
-    executions = list(solve_executions(data_catalog, diagnostic, diagnostic.provider))
-
-    if not executions:
-        raise ValueError(f"No valid executions found for diagnostic {diagnostic.slug}")
-
-    return executions[0].datasets
-
-
-def _fetch_and_build_catalog(
-    diag: Diagnostic,
-    tc: TestCase,
-    *,
-    force: bool = False,
-) -> tuple[ExecutionDatasetCollection, bool]:
-    """
-    Fetch test data and build catalog.
-
-    This function:
-    1. Fetches ESGF data using ESGFFetcher (files stored in intake-esgf cache)
-    2. Uses CMIP6DatasetAdapter to create a data catalog
-    3. Solves for datasets using the diagnostic's data requirements
-    4. Writes catalog YAML to .catalogs/{provider}/{diagnostic}/{test_case}.yaml
-    5. Returns the solved datasets and whether the catalog was written
-
-    By default, the catalog is only written if the content has changed.
-    Use `force=True` to always write.
-
-    Parameters
-    ----------
-    diag
-        The diagnostic to fetch data for
-    tc
-        The test case to fetch data for
-    force
-        If True, always write the catalog even if unchanged
-
-    Returns
-    -------
-    :
-        Tuple of (datasets, catalog_was_written)
-    """
-    from climate_ref.datasets import (
-        CMIP6DatasetAdapter,
-        CMIP7DatasetAdapter,
-        Obs4MIPsDatasetAdapter,
-        PMPClimatologyDatasetAdapter,
-    )
-    from climate_ref_core.datasets import SourceDatasetType
-    from climate_ref_core.esgf import ESGFFetcher
-    from climate_ref_core.testing import TestCasePaths, save_datasets_to_yaml
-
-    fetcher = ESGFFetcher()
-
-    # Fetch all requests - returns DataFrame with metadata + paths
-    combined = fetcher.fetch_for_test_case(tc.requests)
-
-    if combined.empty:
-        raise DatasetResolutionError(
-            f"No datasets found for {diag.provider.slug}/{diag.slug} test case '{tc.name}'"
-        )
-
-    # Group paths by source type and use adapters to build proper catalog
-    data_catalog: dict[SourceDatasetType, pd.DataFrame] = {}
-
-    for source_type, group_df in combined.groupby("source_type"):
-        file_paths = [Path(p) for p in group_df["path"].unique().tolist()]
-
-        if source_type == "CMIP6":
-            data_catalog[SourceDatasetType.CMIP6] = _build_catalog(CMIP6DatasetAdapter(), file_paths)
-
-        elif source_type == "CMIP7":
-            data_catalog[SourceDatasetType.CMIP7] = _build_catalog(CMIP7DatasetAdapter(), file_paths)
-
-        elif source_type == "obs4MIPs":
-            data_catalog[SourceDatasetType.obs4MIPs] = _build_catalog(Obs4MIPsDatasetAdapter(), file_paths)
-
-        elif source_type == "PMPClimatology":
-            data_catalog[SourceDatasetType.PMPClimatology] = _build_catalog(
-                PMPClimatologyDatasetAdapter(), file_paths
-            )
-
-    if not data_catalog:
-        raise DatasetResolutionError(
-            f"No datasets found for {diag.provider.slug}/{diag.slug} test case '{tc.name}'"
-        )
-
-    # Solve for datasets
-    datasets = _solve_test_case(diag, data_catalog)
-
-    # Write catalog YAML to package-local test case directory
-    catalog_written = False
-    paths = TestCasePaths.from_diagnostic(diag, tc.name)
-    if paths:
-        paths.create()
-        catalog_written = save_datasets_to_yaml(datasets, paths.catalog, force=force)
-
-    return datasets, catalog_written
-
-
-@app.command(name="fetch")
-def fetch_test_data(  # noqa: PLR0912, PLR0915
-    ctx: typer.Context,
-    provider: Annotated[
-        str | None,
-        typer.Option(help="Specific provider to fetch data for (e.g., 'esmvaltool', 'ilamb')"),
-    ] = None,
-    diagnostic: Annotated[
-        str | None,
-        typer.Option(help="Specific diagnostic slug to fetch data for"),
-    ] = None,
-    test_case: Annotated[
-        str | None,
-        typer.Option(help="Specific test case name to fetch data for"),
-    ] = None,
-    dry_run: Annotated[
-        bool,
-        typer.Option(help="Show what would be fetched without downloading"),
-    ] = False,
-    only_missing: Annotated[
-        bool,
-        typer.Option(help="Only fetch data for test cases without existing catalogs"),
-    ] = False,
-    force: Annotated[
-        bool,
-        typer.Option(help="Force overwrite catalog even if unchanged"),
-    ] = False,
-) -> None:
-    """
-    Fetch test data from ESGF for running diagnostic tests.
-
-    Downloads full-resolution ESGF data based on diagnostic test_data_spec.
-    Use --provider or --diagnostic to limit scope.
-
-    Examples
-    --------
-        ref test-cases fetch                   # Fetch all test data
-        ref test-cases fetch --provider ilamb  # Fetch ILAMB test data only
-        ref test-cases fetch --diagnostic ecs  # Fetch ECS diagnostic data
-        ref test-cases fetch --only-missing    # Skip test cases with existing catalogs
-    """
-    from climate_ref.provider_registry import ProviderRegistry
-    from climate_ref_core.testing import TestCasePaths
-
-    config = ctx.obj.config
-    db = ctx.obj.database
-
-    # Build provider registry to access diagnostics
-    registry = ProviderRegistry.build_from_config(config, db)
-
-    # Check if the requested provider exists in the registry
-    available_providers = [p.slug for p in registry.providers]
-    if provider and provider not in available_providers:
-        logger.error(f"Provider '{provider}' is not configured")
-        if available_providers:
-            logger.error(f"Available providers: {', '.join(sorted(available_providers))}")
-        else:
-            logger.error("No providers are configured. Check your configuration file.")
-        logger.error("To add a provider, update your config file or set REF_DIAGNOSTIC_PROVIDERS")
-        raise typer.Exit(code=1)
-
-    # Collect diagnostics to process
-    diagnostics_to_process: list[Diagnostic] = []
-
-    for provider_instance in registry.providers:
-        if provider and provider_instance.slug != provider:
-            continue
-
-        for diag in provider_instance.diagnostics():
-            if diagnostic and diag.slug != diagnostic:
-                continue
-            if diag.test_data_spec is None:
-                continue
-            diagnostics_to_process.append(diag)
-
-    if not diagnostics_to_process:
-        if provider:
-            logger.warning(f"No diagnostics with test_data_spec found for provider '{provider}'")
-        else:
-            logger.warning("No diagnostics with test_data_spec found")
-        raise typer.Exit(code=0)
-
-    logger.info(f"Found {len(diagnostics_to_process)} diagnostics with test data specifications")
-
-    if dry_run:  # pragma: no cover
-        for diag in diagnostics_to_process:
-            logger.info(f"Would fetch data for: {diag.provider.slug}/{diag.slug}")
-            if diag.test_data_spec:
-                for tc in diag.test_data_spec.test_cases:
-                    if test_case and tc.name != test_case:
-                        continue
-                    # Check if catalog exists when using --only-missing
-                    if only_missing:
-                        paths = TestCasePaths.from_diagnostic(diag, tc.name)
-                        if paths and paths.catalog.exists():
-                            logger.info(f"  Test case: {tc.name} - [SKIP: catalog exists]")
-                            continue
-                    logger.info(f"  Test case: {tc.name} - {tc.description}")
-                    if tc.requests:
-                        for req in tc.requests:
-                            logger.info(f"    Request: {req.slug} ({req.source_type})")
-        return
-
-    # Process each diagnostic test case
-    for diag in diagnostics_to_process:  # pragma: no cover
-        logger.info(f"Fetching data for: {diag.provider.slug}/{diag.slug}")
-        if diag.test_data_spec:
-            for tc in diag.test_data_spec.test_cases:
-                if test_case and tc.name != test_case:
-                    continue
-                # Skip if catalog exists when using --only-missing
-                if only_missing:
-                    paths = TestCasePaths.from_diagnostic(diag, tc.name)
-                    if paths and paths.catalog.exists():
-                        logger.info(f"  Skipping test case: {tc.name} (catalog exists)")
-                        continue
-                if tc.requests:
-                    logger.info(f"  Processing test case: {tc.name}")
-                    try:
-                        _, catalog_written = _fetch_and_build_catalog(diag, tc, force=force)
-                        if not catalog_written:
-                            logger.info(f"  Catalog unchanged for {tc.name}")
-                    except (DatasetResolutionError, ValueError) as e:
-                        logger.warning(f"  Could not build catalog for {tc.name}: {e}")
-
-
-@app.command(name="list")
-def list_cases(
-    ctx: typer.Context,
-    provider: Annotated[
-        str | None,
-        typer.Option(help="Filter by provider"),
-    ] = None,
-) -> None:
-    """
-    List test cases for all diagnostics.
-
-    Shows which test cases are defined for each diagnostic and their descriptions.
-    Also shows whether catalog and regression data exist for each test case.
-    """
-    from climate_ref.provider_registry import ProviderRegistry
-    from climate_ref_core.testing import TestCasePaths
-
-    config = ctx.obj.config
-    db = ctx.obj.database
-    console = ctx.obj.console
-
-    # Build provider registry to access diagnostics
-    registry = ProviderRegistry.build_from_config(config, db)
-
-    # Check if the requested provider exists in the registry
-    available_providers = [p.slug for p in registry.providers]
-    if provider and provider not in available_providers:
-        logger.error(f"Provider '{provider}' is not configured")
-        if available_providers:
-            logger.error(f"Available providers: {', '.join(sorted(available_providers))}")
-        else:
-            logger.error("No providers are configured. Check your configuration file.")
-        raise typer.Exit(code=1)
-
-    table = Table(title="Test Data Specifications")
-    table.add_column("Provider", style="cyan")
-    table.add_column("Diagnostic", style="green")
-    table.add_column("Test Case", style="yellow")
-    table.add_column("Description")
-    table.add_column("Requests", justify="right")
-    table.add_column("Catalog", justify="center")
-    table.add_column("Regression", justify="center")
-
-    for provider_instance in registry.providers:
-        if provider and provider_instance.slug != provider:
-            continue
-
-        for diag in provider_instance.diagnostics():
-            if diag.test_data_spec is None:
-                table.add_row(
-                    provider_instance.slug,
-                    diag.slug,
-                    "-",
-                    "(no test_data_spec)",
-                    "0",
-                    "-",
-                    "-",
-                )
-                continue
-
-            for tc in diag.test_data_spec.test_cases:
-                num_requests = len(tc.requests) if tc.requests else 0
-
-                # Check if catalog and regression data exist
-                paths = TestCasePaths.from_diagnostic(diag, tc.name)
-                if paths:
-                    catalog_status = "[green]yes[/green]" if paths.catalog.exists() else "[red]no[/red]"
-                    regression_status = "[green]yes[/green]" if paths.regression.exists() else "[red]no[/red]"
-                else:
-                    catalog_status = "[dim]-[/dim]"
-                    regression_status = "[dim]-[/dim]"
-
-                table.add_row(
-                    provider_instance.slug,
-                    diag.slug,
-                    tc.name,
-                    tc.description,
-                    str(num_requests),
-                    catalog_status,
-                    regression_status,
-                )
-
-    console.print(table)
-
-
-def _print_regression_summary(  # pragma: no cover
-    console: Console,
-    regression_dir: Path,
-    size_threshold_mb: float = 1.0,
-) -> None:
-    """
-    Print a summary of the regression directory with file sizes and git status.
-
-    Parameters
-    ----------
-    console
-        Rich console for output
-    regression_dir
-        Path to the regression data directory
-    size_threshold_mb
-        Files larger than this (in MB) will be flagged
-    """
-    repo = get_repo_for_path(regression_dir)
-    repo_root = Path(repo.working_dir) if repo else regression_dir
-
-    threshold_bytes = int(size_threshold_mb * 1024 * 1024)
-    file_info = collect_regression_file_info(regression_dir, repo, threshold_bytes)
-
-    if not file_info:
-        console.print("[yellow]No files in regression directory[/yellow]")
-        return
-
-    total_size = sum(f["size"] for f in file_info)
-    large_files = sum(1 for f in file_info if f["is_large"])
-
-    table = Table(title=f"Regression Data: {regression_dir.relative_to(repo_root)}")
-    table.add_column("File", style="cyan", no_wrap=False)
-    table.add_column("Size", justify="right")
-    table.add_column("Git Status", justify="center")
-
-    for info in file_info:
-        # Format size with color
-        size_str = format_size(info["size"])
-        if info["is_large"]:
-            size_str = f"[bold red]{size_str}[/bold red]"
-
-        # Get git status with color
-        git_status = info["git_status"]
-        status_colors = {
-            "new": "[green]new[/green]",
-            "staged": "[green]staged[/green]",
-            "modified": "[yellow]modified[/yellow]",
-            "tracked": "[dim]tracked[/dim]",
-            "untracked": "[red]untracked[/red]",
-            "deleted": "[red]deleted[/red]",
-            "unknown": "[dim]?[/dim]",
-        }
-        git_status_str = status_colors.get(git_status, f"[dim]{git_status}[/dim]")
-
-        table.add_row(info["rel_path"], size_str, git_status_str)
-
-    console.print(table)
-
-    # Summary line
-    summary = f"\n[bold]Total:[/bold] {len(file_info)} files, {format_size(total_size)}"
-    if large_files > 0:
-        summary += f" ([red]{large_files} files > {size_threshold_mb} MB[/red])"
-    console.print(summary)
-
-
-def _write_test_case_manifest(
-    paths: TestCasePaths,
-    *,
-    test_case_version: int,
-    committed: dict[str, str],
-    native: dict[str, NativeEntry],
-    schema: int | None = None,
-) -> Manifest:
-    """
-    Construct and write a test case ``manifest.json``, recording the input catalog hash.
-
-    Shared by ``run`` (which preserves the existing version and native block) and
-    ``mint`` (which authors the native block and may bump the version); the two
-    callers differ only in the ``test_case_version`` and ``native`` they supply.
-    The ``catalog_hash`` is always (re)derived from the current ``catalog.yaml`` so
-    the manifest stays coupled to the inputs that produced the committed bundle.
-    """
-    from climate_ref_core.regression.manifest import SCHEMA_VERSION, Manifest
-    from climate_ref_core.testing import get_catalog_hash
-
-    manifest = Manifest(
-        schema=SCHEMA_VERSION if schema is None else schema,
-        test_case_version=test_case_version,
-        committed=dict(committed),
-        native=native,
-        catalog_hash=get_catalog_hash(paths.catalog),
-    )
-    manifest.dump(paths.manifest)
-    return manifest
-
-
-def _run_single_test_case(  # noqa: PLR0911, PLR0912, PLR0915
-    config: Config,
-    console: Console,
-    diag: Diagnostic,
-    tc: TestCase,
-    *,
-    execution_dir: Path | None,
-    force_regen: bool,
-    fetch: bool,
-    size_threshold: float,
-    clean: bool,
-    label: str,
-) -> bool:
-    """
-    Run a single test case for a diagnostic, writing its native into an output slot.
-
-    Always (re)populates ``output/<label>/`` with the executed native set and its rebuilt
-    committed bundle. The tracked ``regression/`` baseline is only updated ("promoted") when
-    ``--force-regen`` is given or no baseline exists yet, so a labelled run never silently
-    clobbers a committed baseline.
-
-    Returns True if successful, False otherwise.
-    """
-    from climate_ref_core.regression.manifest import Manifest
-    from climate_ref_core.testing import TestCasePaths, load_datasets_from_yaml
-
-    provider_slug = diag.provider.slug
-    diagnostic_slug = diag.slug
-    test_case_name = tc.name
-    case_id = f"{provider_slug}/{diagnostic_slug}/{test_case_name}"
-
-    # Resolve datasets: either fetch from ESGF or load from the pre-built catalog.
-    if fetch:
-        logger.info(f"Fetching test data for {case_id}")
-        try:
-            datasets, _ = _fetch_and_build_catalog(diag, tc)
-        except (DatasetResolutionError, InvalidDiagnosticException) as e:
-            logger.exception(f"Failed to fetch data for {case_id}: {e}")
-            return False
-
-    paths = TestCasePaths.from_diagnostic(diag, test_case_name)
-    if paths is None:
-        logger.error(f"Could not determine test data directory for {provider_slug}/{diagnostic_slug}")
-        return False
-
-    if not fetch:
-        if not paths.catalog.exists():
-            logger.error(f"No catalog file found for {case_id}")
-            logger.error("Run 'ref test-cases fetch' first or use --fetch flag")
-            return False
-        logger.info(f"Loading catalog from {paths.catalog}")
-        datasets = load_datasets_from_yaml(paths.catalog)
-
-    paths.create()
-    slot = prepare_slot(paths, label)
-    logger.info(f"Running test case {test_case_name!r} for {provider_slug}/{diagnostic_slug}")
-    try:
-        source = stage_execute(
-            config=config,
-            diag=diag,
-            tc=tc,
-            datasets=datasets,
-            slot=slot,
-            execution_dir=execution_dir,
-            clean=clean,
-        )
-    except NoTestDataSpecError:
-        logger.error(f"Diagnostic {provider_slug}/{diagnostic_slug} has no test_data_spec")
-        return False
-    except TestCaseNotFoundError:
-        logger.error(f"Test case {test_case_name!r} not found for {provider_slug}/{diagnostic_slug}")
-        if diag.test_data_spec:
-            logger.error(f"Available test cases: {diag.test_data_spec.case_names}")
-        return False
-    except DatasetResolutionError as e:
-        logger.error(str(e))
-        logger.error("Have you run 'ref test-cases fetch' first?")
-        return False
-    except StageError:
-        logger.error(f"Execution failed: {case_id}")
-        return False
-    except Exception as e:
-        logger.error(f"Diagnostic execution failed for {case_id}: {e!s}")
-        return False
-
-    result = source.result
-    logger.info(f"Execution completed: {case_id}")
-    if result.metric_bundle_filename:
-        logger.info(f"Metric bundle: {result.to_output_path(result.metric_bundle_filename)}")
-    if result.output_bundle_filename:
-        logger.info(f"Output bundle: {result.to_output_path(result.output_bundle_filename)}")
-
-    # Rebuild the slot's committed bundle, then decide whether to promote it to the
-    # tracked baseline. The native block is mint-owned, so a run preserves the previous
-    # one (or seeds an empty set) and never authors native here.
-    committed = stage_build(slot=slot, source=source, paths=paths)
-    previous = Manifest.load(paths.manifest) if paths.manifest.exists() else None
-    version = previous.test_case_version if previous else 1
-
-    if force_regen or not paths.regression.exists():
-        promote_to_baseline(slot, paths)
-        native = snapshot_native(slot)
-        if previous is not None:
-            _write_test_case_manifest(
-                paths,
-                test_case_version=previous.test_case_version,
-                committed=committed,
-                native=previous.native,
-                schema=previous.schema,
-            )
-            if native_is_stale(native, previous.native):
-                logger.warning(
-                    f"{case_id}: committed bundle regenerated but the native baseline differs; "
-                    "re-mint with `ref test-cases mint` (or `mint --from-replay`)"
-                )
-        else:
-            _write_test_case_manifest(paths, test_case_version=1, committed=committed, native={})
-        logger.info(f"Updated regression baseline: {paths.regression}")
-        _print_regression_summary(console, paths.regression, size_threshold)
-    else:
-        logger.info(
-            f"Wrote output slot {slot} (committed baseline unchanged; use --force-regen to update it)"
-        )
-
-    write_source_stamp(slot, label=label, verb="run", source="execute", test_case_version=version)
-    return True
-
-
-@app.command(name="run")
-def run_test_case(  # noqa: PLR0912, PLR0915
-    ctx: typer.Context,
-    provider: Annotated[
-        str,
-        typer.Option(help="Provider slug (required, e.g., 'example', 'ilamb')"),
-    ],
-    diagnostic: Annotated[
-        str | None,
-        typer.Option(help="Specific diagnostic slug to run (e.g., 'global-mean-timeseries')"),
-    ] = None,
-    test_case: Annotated[
-        str | None,
-        typer.Option(help="Specific test case name to run (e.g., 'default')"),
-    ] = None,
-    output_directory: Annotated[
-        Path | None,
-        typer.Option(help="Output directory for execution results"),
-    ] = None,
-    force_regen: Annotated[
-        bool,
-        typer.Option(help="Force regeneration of regression baselines"),
-    ] = False,
-    fetch: Annotated[
-        bool,
-        typer.Option(help="Fetch test data from ESGF before running"),
-    ] = False,
-    size_threshold: Annotated[
-        float,
-        typer.Option(help="Flag files larger than this size in MB (default: 1.0)"),
-    ] = 1.0,
-    dry_run: Annotated[
-        bool,
-        typer.Option(help="Show what would be run without executing"),
-    ] = False,
-    only_missing: Annotated[
-        bool,
-        typer.Option(help="Only run test cases without existing regression data"),
-    ] = False,
-    if_changed: Annotated[
-        bool,
-        typer.Option(help="Only run if catalog has changed since regression data was generated"),
-    ] = False,
-    clean: Annotated[
-        bool,
-        typer.Option(help="Delete existing output directory before running"),
-    ] = False,
-    label: Annotated[
-        str,
-        typer.Option(help="Output slot name under output/ (default: latest)"),
-    ] = "latest",
-) -> None:
-    """
-    Run test cases for diagnostics.
-
-    Executes diagnostics using pre-defined datasets from the test_data_spec
-    and optionally compares against regression baselines.
-
-    Use --provider to select which provider's diagnostics to run (required).
-    Use --diagnostic and --test-case to further narrow the scope.
-
-    Examples
-    --------
-        ref test-cases run --provider ilamb              # Run all ILAMB test cases
-        ref test-cases run --provider example --diagnostic global-mean-timeseries
-        ref test-cases run --provider ilamb --test-case default --fetch
-        ref test-cases run --provider pmp --only-missing # Skip test cases with regression data
-        ref test-cases run --provider pmp --if-changed   # Only run if catalog changed
-    """
-    from climate_ref.provider_registry import ProviderRegistry
-    from climate_ref_core.testing import (
-        TestCasePaths,
-        catalog_changed_since_regression,
-    )
-
-    config: Config = ctx.obj.config
-    db = ctx.obj.database
-    console: Console = ctx.obj.console
-
-    # Build provider registry
-    registry = ProviderRegistry.build_from_config(config, db)
-
-    # Find the provider
-    provider_instance = None
-    for p in registry.providers:
-        if p.slug == provider:
-            provider_instance = p
-            break
-
-    if provider_instance is None:
-        logger.error(f"Provider '{provider}' not found")
-        available = [p.slug for p in registry.providers]
-        logger.error(f"Available providers: {available}")
-        raise typer.Exit(code=1)
-
-    # Collect test cases to run
-    test_cases_to_run: list[tuple[Diagnostic, TestCase]] = []
-    skipped_cases: list[tuple[Diagnostic, TestCase]] = []
-
-    for diag in provider_instance.diagnostics():
-        if diagnostic and diag.slug != diagnostic:
-            continue
-        if diag.test_data_spec is None:
-            continue
-
-        for tc in diag.test_data_spec.test_cases:
-            if test_case and tc.name != test_case:
-                continue
-            # Skip if regression exists when using --only-missing
-            paths = TestCasePaths.from_diagnostic(diag, tc.name)
-            if only_missing:
-                if paths and paths.regression.exists():
-                    skipped_cases.append((diag, tc))
-                    continue
-            # Skip if catalog hasn't changed when using --if-changed
-            if if_changed:
-                if paths and not catalog_changed_since_regression(paths):
-                    skipped_cases.append((diag, tc))
-                    continue
-            test_cases_to_run.append((diag, tc))
-
-    if not test_cases_to_run:
-        logger.warning(f"No test cases found for provider '{provider}'")
-        if diagnostic:
-            logger.warning(f"  with diagnostic filter: {diagnostic}")
-        if test_case:
-            logger.warning(f"  with test case filter: {test_case}")
-        if only_missing and skipped_cases:
-            logger.info(f"  ({len(skipped_cases)} test case(s) skipped due to --only-missing)")
-        raise typer.Exit(code=0)
-
-    logger.info(f"Found {len(test_cases_to_run)} test case(s) to run")
-    if skipped_cases:
-        logger.info(f"Skipping {len(skipped_cases)} test case(s) with existing regression data")
-
-    if dry_run:  # pragma: no cover
-        table = Table(title="Test Cases to Run")
-        table.add_column("Provider", style="cyan")
-        table.add_column("Diagnostic", style="green")
-        table.add_column("Test Case", style="yellow")
-        table.add_column("Description")
-        table.add_column("Status", justify="center")
-
-        for diag, tc in test_cases_to_run:
-            table.add_row(provider, diag.slug, tc.name, tc.description, "[green]will run[/green]")
-
-        for diag, tc in skipped_cases:
-            table.add_row(provider, diag.slug, tc.name, tc.description, "[dim]skip (regression exists)[/dim]")
-
-        console.print(table)
-        return
-
-    # Run each test case
-    successes = 0
-    failures = 0
-    failed_cases: list[str] = []
-
-    for diag, tc in test_cases_to_run:
-        success = _run_single_test_case(
-            config=config,
-            console=console,
-            diag=diag,
-            tc=tc,
-            execution_dir=output_directory,
-            force_regen=force_regen,
-            fetch=fetch,
-            size_threshold=size_threshold,
-            clean=clean,
-            label=label,
-        )
-        if success:
-            successes += 1
-        else:
-            failures += 1
-            failed_cases.append(f"{provider}/{diag.slug}/{tc.name}")
-
-    # Print summary
-    console.print()
-    if failures == 0:
-        console.print(f"[green]All {successes} test case(s) passed[/green]")
-    else:
-        console.print(f"[yellow]Results: {successes} passed, {failures} failed[/yellow]")
-        console.print("[red]Failed test cases:[/red]")
-        for case in failed_cases:
-            console.print(f"  - {case}")
-        raise typer.Exit(code=1)
-
-
-def _iter_test_cases(
-    registry: ProviderRegistry,
-    *,
-    provider: str | None = None,
-    diagnostic: str | None = None,
-    test_case: str | None = None,
-) -> Iterator[tuple[Diagnostic, TestCase]]:
-    """
-    Yield ``(diagnostic, test_case)`` pairs from the registry, applying filters.
-
-    Parameters
-    ----------
-    registry
-        The provider registry to enumerate.
-    provider
-        Optional provider slug filter.
-    diagnostic
-        Optional diagnostic slug filter.
-    test_case
-        Optional test case name filter.
-
-    Yields
-    ------
-    :
-        Matching ``(diagnostic, test_case)`` pairs.
-    """
-    for provider_instance in registry.providers:
-        if provider and provider_instance.slug != provider:
-            continue
-        for diag in provider_instance.diagnostics():
-            if diagnostic and diag.slug != diagnostic:
-                continue
-            if diag.test_data_spec is None:
-                continue
-            for tc in diag.test_data_spec.test_cases:
-                if test_case and tc.name != test_case:
-                    continue
-                yield diag, tc
-
-
-@app.command(name="sync")
-def sync_native(
-    ctx: typer.Context,
-    provider: Annotated[
-        str | None,
-        typer.Option(help="Limit sync to a single provider slug"),
-    ] = None,
-    diagnostic: Annotated[
-        str | None,
-        typer.Option(help="Limit sync to a single diagnostic slug"),
-    ] = None,
-    test_case: Annotated[
-        str | None,
-        typer.Option(help="Limit sync to a single test case name"),
-    ] = None,
-) -> None:
-    """
-    Fetch native baseline blobs referenced by committed manifests into the store cache.
-
-    Reads each committed ``manifest.json``'s ``native`` block
-    and ensures every referenced blob is present in the read store (public, credential-free).
-    Blobs already cached are skipped (idempotent).
-    A referenced digest the store cannot serve is a hard failure.
-
-    Examples
-    --------
-        ref test-cases sync                  # Sync all providers
-        ref test-cases sync --provider ilamb # Sync a single provider
-    """
-    import tempfile
-
-    from climate_ref.provider_registry import ProviderRegistry
-    from climate_ref_core.regression.manifest import Manifest
-    from climate_ref_core.regression.store import build_native_store
-    from climate_ref_core.testing import TestCasePaths
-
-    config: Config = ctx.obj.config
-    db = ctx.obj.database
-    console: Console = ctx.obj.console
-
-    registry = ProviderRegistry.build_from_config(config, db)
-    store = build_native_store(config.native_store, writable=False)
-
-    # When a specific case is named, a missing manifest is a hard failure.
-    named = bool(diagnostic or test_case)
-
-    fetched = 0
-    skipped = 0
-    failures: list[str] = []
-
-    for diag, tc in _iter_test_cases(registry, provider=provider, diagnostic=diagnostic, test_case=test_case):
-        case_id = f"{diag.provider.slug}/{diag.slug}/{tc.name}"
-        paths = TestCasePaths.from_diagnostic(diag, tc.name)
-        if paths is None or not paths.manifest.exists():
-            if named:
-                logger.error(f"No manifest.json for {case_id}; run `ref test-cases mint` first")
-                failures.append(case_id)
-            continue
-        manifest = Manifest.load(paths.manifest)
-        for relpath, entry in manifest.native.items():
-            if store.has(entry.sha256):
-                skipped += 1
-                continue
-            with tempfile.TemporaryDirectory() as tmp:
-                try:
-                    store.fetch(entry.sha256, Path(tmp) / "blob")
-                except Exception as exc:
-                    failures.append(f"{case_id}: cannot serve native blob {entry.sha256} ({relpath}): {exc}")
-                    continue
-            fetched += 1
-
-    console.print(f"[green]Synced native blobs:[/green] {fetched} fetched, {skipped} already cached")
-    if failures:
-        console.print("[red]Failed to fetch referenced native blobs:[/red]")
-        for failure in failures:
-            console.print(f"  - {failure}")
-        raise typer.Exit(code=1)
-
-
-@app.command(name="replay")
-def replay_test_case(  # noqa: PLR0912, PLR0915
-    ctx: typer.Context,
-    provider: Annotated[
-        str,
-        typer.Option(help="Provider slug (required, e.g., 'example', 'ilamb')"),
-    ],
-    diagnostic: Annotated[
-        str | None,
-        typer.Option(help="Specific diagnostic slug to replay"),
-    ] = None,
-    test_case: Annotated[
-        str | None,
-        typer.Option(help="Specific test case name to replay"),
-    ] = None,
-    label: Annotated[
-        str,
-        typer.Option(help="Output slot name under output/ (default: latest)"),
-    ] = "latest",
-) -> None:
-    """
-    Replay committed baselines from native blobs and compare to the committed bundle.
-
-    Materialises the committed manifest's native blobs (public, credential-free)
-    into a fresh output directory at their stored relative paths, re-runs ``build_execution_result``,
-    and compares the regenerated committed bundle to the in-repo copy using the tolerant content comparator.
-
-    Exits non-zero on drift.
-
-    Examples
-    --------
-        ref test-cases replay --provider example
-        ref test-cases replay --provider example --diagnostic global-mean-timeseries
-    """
-    from climate_ref.provider_registry import ProviderRegistry
-    from climate_ref_core.regression import Manifest, verify_committed_integrity
-    from climate_ref_core.regression.store import build_native_store
-    from climate_ref_core.testing import TestCasePaths
-
-    config: Config = ctx.obj.config
-    db = ctx.obj.database
-    console: Console = ctx.obj.console
-
-    registry = ProviderRegistry.build_from_config(config, db)
-    store = build_native_store(config.native_store, writable=False)
-
-    cases = list(_iter_test_cases(registry, provider=provider, diagnostic=diagnostic, test_case=test_case))
-    if not cases:
-        logger.warning(f"No test cases found for provider {provider!r}")
-        raise typer.Exit(code=0)
-
-    # When a specific case is named, a missing manifest/catalog is a hard failure.
-    named = bool(diagnostic or test_case)
-
-    successes = 0
-    failures: list[str] = []
-
-    for diag, tc in cases:
-        paths = TestCasePaths.from_diagnostic(diag, tc.name)
-        case_id = f"{provider}/{diag.slug}/{tc.name}"
-        if paths is None:
-            logger.warning(f"Could not determine test case directory for {case_id}")
-            continue
-        if not paths.manifest.exists():
-            message = f"No manifest.json for {case_id}; run `ref test-cases mint` first"
-            if named:
-                logger.error(message)
-                failures.append(case_id)
-            else:
-                logger.warning(message)
-            continue
-        if not paths.catalog.exists():
-            logger.error(f"No catalog file for {case_id}; run `ref test-cases fetch` first")
-            failures.append(case_id)
-            continue
-
-        manifest = Manifest.load(paths.manifest)
-
-        # The byte-exact digest check is advisory that the committed baseline is not bitwise identical.
-        # The tolerant bundle comparison below may still find them equivalent within tolerance.
-        mismatches = verify_committed_integrity(manifest, paths.regression)
-        if mismatches:
-            logger.warning(
-                f"{case_id}: committed baseline differs from the digests recorded in {paths.manifest}"
-            )
-            for mismatch in mismatches:
-                logger.warning(f"  - {mismatch}")
-
-        if not manifest.native:
-            logger.error(
-                f"{case_id}: manifest has no native baselines — not yet minted. "
-                "Run `ref test-cases mint` first."
-            )
-            failures.append(case_id)
-            continue
-
-        slot = prepare_slot(paths, label)
-        try:
-            source = stage_materialise(
-                diag=diag, tc=tc, paths=paths, manifest=manifest, store=store, slot=slot
-            )
-        except Exception as exc:
-            logger.error(f"{case_id}: failed to materialise/rebuild native: {exc}")
-            failures.append(case_id)
-            continue
-
-        stage_build(slot=slot, source=source, paths=paths)
-        cmp_failures, compared = stage_compare(slot=slot, paths=paths, slug=diag.slug)
-        write_source_stamp(
-            slot,
-            label=label,
-            verb="replay",
-            source="materialise",
-            test_case_version=manifest.test_case_version,
-        )
-        if cmp_failures:
-            logger.error(f"{case_id}: replay drift detected:\n" + "\n".join(cmp_failures))
-            failures.append(case_id)
-            continue
-
-        successes += 1
-        if mismatches:
-            # The byte-level warning above was reconciled by the tolerant comparison.
-            logger.info(
-                f"Replay reconciled committed bundle: {case_id} "
-                f"({len(manifest.native)} native file(s) materialised, "
-                f"{len(compared)} bundle file(s) equivalent within tolerance)"
-            )
-        else:
-            logger.info(
-                f"Replay matched committed bundle: {case_id} "
-                f"({len(manifest.native)} native file(s) materialised, "
-                f"{len(compared)} bundle file(s) compared)"
-            )
-
-    console.print()
-    if failures:
-        console.print(f"[yellow]Replay: {successes} passed, {len(failures)} failed[/yellow]")
-        console.print("[red]Failed replays:[/red]")
-        for case in failures:
-            console.print(f"  - {case}")
-        raise typer.Exit(code=1)
-    console.print(f"[green]All {successes} replay(s) matched the committed bundle[/green]")
-
-
-@app.command(name="mint")
-def mint_native(  # noqa: PLR0912, PLR0915
-    ctx: typer.Context,
-    provider: Annotated[
-        str,
-        typer.Option(help="Provider slug (required, e.g., 'example', 'ilamb')"),
-    ],
-    diagnostic: Annotated[
-        str | None,
-        typer.Option(help="Specific diagnostic slug to mint"),
-    ] = None,
-    test_case: Annotated[
-        str | None,
-        typer.Option(help="Specific test case name to mint"),
-    ] = None,
-    label: Annotated[
-        str,
-        typer.Option(help="Output slot name under output/ (default: latest)"),
-    ] = "latest",
-    from_replay: Annotated[
-        bool,
-        typer.Option(
-            "--from-replay",
-            help="Author from a replay of the stored native instead of re-running the diagnostic",
-        ),
-    ] = False,
-    bump_version: Annotated[
-        bool,
-        typer.Option(help="Increment test_case_version when authoring the manifest"),
-    ] = False,
-    dry_run: Annotated[
-        bool,
-        typer.Option(help="Preflight the store and list what would be minted, without running or uploading"),
-    ] = False,
-) -> None:
-    """
-    Mint canonical native baselines
-
-    Runs each test case, stores its native snapshot in the writable store,
-    and authors the committed ``manifest.json``'s ``native`` block.
-
-    This requires write credentials and is generally run by the CI.
-
-    Examples
-    --------
-        ref test-cases mint --provider example
-        ref test-cases mint --provider example --bump-version
-        ref test-cases mint --provider example --dry-run
-    """
-    from climate_ref.provider_registry import ProviderRegistry
-    from climate_ref_core.regression.manifest import Manifest
-    from climate_ref_core.regression.store import NativeStoreUnavailableError, build_native_store
-    from climate_ref_core.testing import TestCasePaths, load_datasets_from_yaml
-
-    config: Config = ctx.obj.config
-    db = ctx.obj.database
-    console: Console = ctx.obj.console
-
-    try:
-        store = build_native_store(config.native_store, writable=True)
-    except (NotImplementedError, ValueError) as exc:
-        logger.error(
-            "Cannot mint: no writable native store is configured. For the remote (R2) store set "
-            "REF_NATIVE_STORE_S3_ENDPOINT_URL and REF_NATIVE_STORE_BUCKET, and authenticate via "
-            "REF_NATIVE_STORE_ACCESS_KEY_ID / REF_NATIVE_STORE_SECRET_ACCESS_KEY or a named "
-            "REF_NATIVE_STORE_PROFILE; or set REF_NATIVE_STORE_URL to a local file:// path for "
-            f"development: {exc}"
-        )
-        raise typer.Exit(code=1) from exc
-
-    # Preflight the store (credentials / bucket reachability) before running any diagnostics,
-    # so a misconfiguration fails fast instead of after the (slow) execution.
-    try:
-        store.preflight()
-    except NativeStoreUnavailableError as exc:
-        logger.error(f"Cannot mint: {exc}")
-        raise typer.Exit(code=1) from exc
-
-    registry = ProviderRegistry.build_from_config(config, db)
-    cases = list(_iter_test_cases(registry, provider=provider, diagnostic=diagnostic, test_case=test_case))
-    if not cases:
-        logger.warning(f"No test cases found for provider {provider!r}")
-        raise typer.Exit(code=0)
-
-    if dry_run:
-        # The store preflight has already passed at this point; report scope and stop before
-        # running any diagnostics or uploading anything.
-        console.print(f"[cyan]Dry run — would mint {len(cases)} test case(s):[/cyan]")
-        for diag, tc in cases:
-            console.print(f"  - {provider}/{diag.slug}/{tc.name}")
-        console.print("[cyan]Store preflight passed; nothing was run or uploaded.[/cyan]")
-        return
-
-    minted = 0
-    failures: list[str] = []
-
-    for diag, tc in cases:
-        case_id = f"{provider}/{diag.slug}/{tc.name}"
-        paths = TestCasePaths.from_diagnostic(diag, tc.name)
-        if paths is None:
-            logger.warning(f"Could not determine test case directory for {case_id}")
-            continue
-        if not paths.catalog.exists():
-            logger.error(f"No catalog file for {case_id}; run `ref test-cases fetch` first")
-            failures.append(case_id)
-            continue
-
-        paths.create()
-        previous = Manifest.load(paths.manifest) if paths.manifest.exists() else None
-        # Validate the --from-replay precondition before wiping the slot, so a never-minted
-        # case does not destroy a pre-existing output/<label>/ on its way to failing.
-        if from_replay and (previous is None or not previous.native):
-            logger.error(f"{case_id}: --from-replay needs an existing minted manifest")
-            failures.append(case_id)
-            continue
-
-        slot = prepare_slot(paths, label)
-
-        # Populate the slot's native set: either re-execute the diagnostic, or (with
-        # --from-replay) materialise the previously minted native from the store. The
-        # writable store's fetch/has back the materialise, so no separate read store is needed.
-        try:
-            if from_replay and previous is not None:  # previous is non-None by the guard above
-                source = stage_materialise(
-                    diag=diag, tc=tc, paths=paths, manifest=previous, store=store, slot=slot
-                )
-                source_kind = "materialise"
-            else:
-                datasets = load_datasets_from_yaml(paths.catalog)
-                source = stage_execute(
-                    config=config,
-                    diag=diag,
-                    tc=tc,
-                    datasets=datasets,
-                    slot=slot,
-                    execution_dir=None,
-                    clean=True,
-                )
-                source_kind = "execute"
-        except StageError as exc:
-            logger.error(f"{case_id}: {exc}")
-            failures.append(case_id)
-            continue
-        except Exception as exc:
-            logger.error(f"{case_id}: source stage failed during mint: {exc}")
-            failures.append(case_id)
-            continue
-
-        committed = stage_build(slot=slot, source=source, paths=paths)
-        native = snapshot_native(slot)
-        errors = stage_upload(
-            slot=slot, native=native, store=store, previous=(previous.native if previous else {})
-        )
-        if errors:
-            for error in errors:
-                logger.error(f"{case_id}: {error}")
-            failures.append(case_id)
-            continue
-
-        # Promote the rebuilt bundle and author the committed manifest: the native block
-        # is written ONLY here.
-        promote_to_baseline(slot, paths)
-        if previous is not None:
-            version = previous.test_case_version + 1 if bump_version else previous.test_case_version
-        else:
-            version = 1
-        _write_test_case_manifest(paths, test_case_version=version, committed=committed, native=native)
-        write_source_stamp(slot, label=label, verb="mint", source=source_kind, test_case_version=version)
-
-        minted += 1
-        logger.info(
-            f"Minted native baseline: {case_id} "
-            f"({len(native)} native file(s), {len(committed)} committed file(s), "
-            f"test_case_version={version})"
-        )
-
-    console.print()
-    if failures:
-        console.print(f"[yellow]Mint: {minted} minted, {len(failures)} failed[/yellow]")
-        console.print("[red]Failed mints:[/red]")
-        for case in failures:
-            console.print(f"  - {case}")
-        raise typer.Exit(code=1)
-    console.print(f"[green]Minted {minted} native baseline(s)[/green]")
-
-
-@app.command(name="build")
-def build_test_case(  # noqa: PLR0912, PLR0915
-    ctx: typer.Context,
-    provider: Annotated[
-        str,
-        typer.Option(help="Provider slug (required, e.g., 'example', 'ilamb')"),
-    ],
-    diagnostic: Annotated[
-        str | None,
-        typer.Option(help="Specific diagnostic slug to build"),
-    ] = None,
-    test_case: Annotated[
-        str | None,
-        typer.Option(help="Specific test case name to build"),
-    ] = None,
-    label: Annotated[
-        str,
-        typer.Option(help="Output slot to rebuild from (default: latest)"),
-    ] = "latest",
-    force_regen: Annotated[
-        bool,
-        typer.Option(help="Promote the rebuilt bundle to the tracked regression baseline"),
-    ] = False,
-) -> None:
-    """
-    Rebuild the committed bundle from an existing output slot, without re-executing.
-
-    Reuses the native already materialised in ``output/<label>/`` (by a previous
-    ``run`` / ``replay`` / ``mint``) to regenerate the slot's committed bundle. The tracked
-    ``regression/`` baseline is only promoted when ``--force-regen`` is given or no baseline
-    exists yet, so a rebuild never silently clobbers a committed baseline.
-
-    Examples
-    --------
-        ref test-cases build --provider example
-        ref test-cases build --provider example --label before --force-regen
-    """
-    from climate_ref.provider_registry import ProviderRegistry
-    from climate_ref_core.regression.manifest import Manifest
-    from climate_ref_core.testing import TestCasePaths
-
-    config: Config = ctx.obj.config
-    db = ctx.obj.database
-    console: Console = ctx.obj.console
-
-    registry = ProviderRegistry.build_from_config(config, db)
-    cases = list(_iter_test_cases(registry, provider=provider, diagnostic=diagnostic, test_case=test_case))
-    if not cases:
-        logger.warning(f"No test cases found for provider {provider!r}")
-        raise typer.Exit(code=0)
-
-    built = 0
-    failures: list[str] = []
-
-    for diag, tc in cases:
-        case_id = f"{provider}/{diag.slug}/{tc.name}"
-        paths = TestCasePaths.from_diagnostic(diag, tc.name)
-        if paths is None:
-            logger.warning(f"Could not determine test case directory for {case_id}")
-            continue
-        slot = paths.output_slot(label)
-        if not slot.exists() or not slot_native_relpaths(slot):
-            logger.error(f"{case_id}: no native in output slot {label!r}; run/replay/mint it first")
-            failures.append(case_id)
-            continue
-        if not paths.catalog.exists():
-            logger.error(f"No catalog file for {case_id}; run `ref test-cases fetch` first")
-            failures.append(case_id)
-            continue
-
-        try:
-            source = stage_rebuild_from_slot(diag=diag, tc=tc, paths=paths, slot=slot)
-        except Exception as exc:
-            logger.error(f"{case_id}: failed to rebuild bundle from slot: {exc}")
-            failures.append(case_id)
-            continue
-
-        committed = stage_build(slot=slot, source=source, paths=paths)
-        previous = Manifest.load(paths.manifest) if paths.manifest.exists() else None
-        version = previous.test_case_version if previous else 1
-
-        if force_regen or not paths.regression.exists():
-            promote_to_baseline(slot, paths)
-            native = snapshot_native(slot)
-            if previous is not None:
-                _write_test_case_manifest(
-                    paths,
-                    test_case_version=previous.test_case_version,
-                    committed=committed,
-                    native=previous.native,
-                    schema=previous.schema,
-                )
-                if native_is_stale(native, previous.native):
-                    logger.warning(
-                        f"{case_id}: committed bundle rebuilt but the native baseline differs; "
-                        "re-mint with `ref test-cases mint`"
-                    )
-            else:
-                _write_test_case_manifest(paths, test_case_version=1, committed=committed, native={})
-            logger.info(f"Promoted rebuilt bundle to regression baseline: {paths.regression}")
-        else:
-            logger.info(
-                f"Wrote output slot {slot}/regression "
-                "(committed baseline unchanged; use --force-regen to promote it)"
-            )
-
-        write_source_stamp(slot, label=label, verb="build", source="rebuild", test_case_version=version)
-        built += 1
-
-    console.print()
-    if failures:
-        console.print(f"[yellow]Build: {built} built, {len(failures)} failed[/yellow]")
-        console.print("[red]Failed builds:[/red]")
-        for case in failures:
-            console.print(f"  - {case}")
-        raise typer.Exit(code=1)
-    console.print(f"[green]Built {built} committed bundle(s) from output slots[/green]")
-
-
-@app.command(name="check-store")
-def check_store(
-    ctx: typer.Context,
-) -> None:
-    """
-    Check connectivity and credentials for the writable native baseline store.
-
-    Builds the writable store from the configuration and preflights it (an authenticated
-    no-op probe) without running any diagnostics or uploading anything. Use this to confirm a
-    mint will work — that the credentials (REF_NATIVE_STORE_PROFILE or the access-key env
-    vars) and the bucket are correct — before a slow mint run.
-
-    Examples
-    --------
-        ref test-cases check-store
-        REF_NATIVE_STORE_PROFILE=my-profile ref test-cases check-store
-    """
-    from climate_ref_core.regression.store import NativeStoreUnavailableError, build_native_store
-
-    config: Config = ctx.obj.config
-    console: Console = ctx.obj.console
-
-    try:
-        store = build_native_store(config.native_store, writable=True)
-    except (NotImplementedError, ValueError) as exc:
-        logger.error(
-            "Native store is not configured for writing. For the remote (R2) store set "
-            "REF_NATIVE_STORE_S3_ENDPOINT_URL and REF_NATIVE_STORE_BUCKET, and authenticate via "
-            "REF_NATIVE_STORE_ACCESS_KEY_ID / REF_NATIVE_STORE_SECRET_ACCESS_KEY or a named "
-            f"REF_NATIVE_STORE_PROFILE; or set REF_NATIVE_STORE_URL to a local file:// path: {exc}"
-        )
-        raise typer.Exit(code=1) from exc
-
-    try:
-        store.preflight()
-    except NativeStoreUnavailableError as exc:
-        logger.error(str(exc))
-        raise typer.Exit(code=1) from exc
-
-    console.print("[green]Native store OK:[/green] credentials accepted and the store is reachable.")
-
-
-def _provider_source_root(diag: Diagnostic, repo_root: Path) -> str | None:
-    """
-    Return the diagnostic's provider package source directory, relative to the repo root.
-
-    Used to decide whether a changed file touches the diagnostic's extraction code.
-    The returned path is POSIX-style so it can be compared against
-    ``git diff --name-only`` output.
-
-    Parameters
-    ----------
-    diag
-        The diagnostic whose provider source directory is wanted.
-    repo_root
-        The repository working-tree root.
-
-    Returns
-    -------
-    :
-        The provider package source directory relative to ``repo_root``, or ``None``
-        if it cannot be located or lies outside the repository.
-    """
-    import importlib.util
-
-    top_package = type(diag).__module__.split(".")[0]
-    try:
-        spec = importlib.util.find_spec(top_package)
-    except (ImportError, ValueError):
-        return None
-    if spec is None or not spec.submodule_search_locations:
-        return None
-    package_dir = Path(next(iter(spec.submodule_search_locations))).resolve()
-    try:
-        return package_dir.relative_to(repo_root.resolve()).as_posix()
-    except ValueError:
-        return None
-
-
-def _core_extraction_roots(repo_root: Path) -> list[str]:
-    """
-    Return the core paths whose change affects replay/execute for every test case.
-
-    ``build_execution_result`` (the function replay/execute re-run) depends on more
-    than the regression package: it builds and reads CMEC bundles via
-    :mod:`climate_ref_core.pycmec`, persists curated outputs via
-    :mod:`climate_ref_core.output_files`, and is dispatched through
-    :mod:`climate_ref_core.diagnostics`. A change under any of these can alter the
-    regenerated bundle, so all of them count as an extraction change.
-
-    Detection is deliberately coarse and errs toward REPLAY (cheap, credential-free):
-    a false positive only triggers an unnecessary replay, never a missed one.
-    Roots are derived from the installed package location (rather than hardcoded
-    paths) so they survive a package move; any root outside the repository
-    (e.g. an installed wheel) is dropped.
-
-    Parameters
-    ----------
-    repo_root
-        The repository working-tree root.
-
-    Returns
-    -------
-    :
-        Repo-relative POSIX paths for the core extraction surfaces that lie inside the repo.
-    """
-    import climate_ref_core
-
-    core_dir = Path(climate_ref_core.__file__).resolve().parent
-    repo_root_resolved = repo_root.resolve()
-    candidates = [
-        core_dir / "regression",
-        core_dir / "pycmec",
-        core_dir / "output_files.py",
-        core_dir / "diagnostics.py",
-    ]
-    roots: list[str] = []
-    for candidate in candidates:
-        try:
-            roots.append(candidate.relative_to(repo_root_resolved).as_posix())
-        except ValueError:
-            continue
-    return roots
-
-
-@app.command(name="ci-gate")
-def ci_gate(  # noqa: PLR0912, PLR0915
-    ctx: typer.Context,
-    base: Annotated[
-        str,
-        typer.Option(help="Git ref to compare against (the PR base branch)"),
-    ] = "origin/main",
-    provider: Annotated[
-        str | None,
-        typer.Option(help="Limit the gate to a single provider slug"),
-    ] = None,
-    diagnostic: Annotated[
-        str | None,
-        typer.Option(help="Limit the gate to a single diagnostic slug"),
-    ] = None,
-    test_case: Annotated[
-        str | None,
-        typer.Option(help="Limit the gate to a single test case name"),
-    ] = None,
-    output_json: Annotated[
-        bool,
-        typer.Option("--json", help="Emit the per-case decisions as JSON on stdout"),
-    ] = False,
-) -> None:
-    """
-    Decide how CI should verify each test case's regression baseline.
-
-    Compares each committed ``manifest.json`` to its counterpart on the base branch
-    and reports the action CI should take per case: ``replay`` (cheap, against the
-    cached native baseline), ``execute`` (full re-run, when ``test_case_version`` was
-    bumped), ``skip`` (nothing relevant changed), or ``fail`` (an unauthorised
-    baseline change). Exits non-zero if any case is gated ``fail``.
-
-    The ``--json`` output is intended for CI to dispatch ``replay``/``run`` jobs.
-
-    Examples
-    --------
-        ref test-cases ci-gate                       # Gate all cases against origin/main
-        ref test-cases ci-gate --base origin/develop
-        ref test-cases ci-gate --provider example --json
-    """
-    import json as _json
-
-    from git import GitCommandError
-
-    from climate_ref.provider_registry import ProviderRegistry
-    from climate_ref_core.regression.gate import Action, decide_coupling, paths_under
-    from climate_ref_core.regression.manifest import Manifest, compute_committed_digests
-    from climate_ref_core.testing import TestCasePaths, get_catalog_hash
-
-    config: Config = ctx.obj.config
-    db = ctx.obj.database
-    console: Console = ctx.obj.console
-
-    repo = get_repo_for_path(Path.cwd())
-    if repo is None or repo.working_dir is None:
-        logger.error("ci-gate must be run inside a git repository")
-        raise typer.Exit(code=1)
-    repo_root = Path(repo.working_dir)
-
-    # Resolve the set of files changed on this branch relative to the base ref.
-    # `base...HEAD` diffs against the merge-base, so unrelated base-branch churn
-    # is excluded.
-    try:
-        diff_output = repo.git.diff("--name-only", f"{base}...HEAD")
-    except GitCommandError as exc:
-        logger.error(f"Could not diff against base ref {base!r}: {exc}")
-        raise typer.Exit(code=1) from exc
-    changed_files = [line.strip() for line in diff_output.splitlines() if line.strip()]
-
-    # The core machinery behind build_execution_result affects every replay/execute,
-    # so a change there counts as an extraction change for all cases. Extraction-change
-    # detection is deliberately coarse: any change under a diagnostic's provider package
-    # (see `_provider_source_root`) or under the core extraction surfaces counts for
-    # every case in that provider. This errs toward REPLAY (cheap, credential-free),
-    # never away from it.
-    core_changed = paths_under(changed_files, _core_extraction_roots(repo_root))
-
-    # Hoisted once: repo_root.resolve() is filesystem-touching, and a provider's source
-    # root is identical for every case in that provider, so memoise it per provider slug
-    # rather than recomputing find_spec on each case.
-    repo_root_resolved = repo_root.resolve()
-    source_root_cache: dict[str, str | None] = {}
-
-    registry = ProviderRegistry.build_from_config(config, db)
-
-    decisions: list[dict[str, str]] = []
-    has_failure = False
-
-    def record(case: str, action: Action, reason: str) -> None:
-        nonlocal has_failure
-        if action is Action.FAIL:
-            has_failure = True
-        decisions.append({"case": case, "action": action.value, "reason": reason})
-
-    for diag, tc in _iter_test_cases(registry, provider=provider, diagnostic=diagnostic, test_case=test_case):
-        case_id = f"{diag.provider.slug}/{diag.slug}/{tc.name}"
-        paths = TestCasePaths.from_diagnostic(diag, tc.name)
-
-        # A corrupt manifest authored in this change is a hard failure for that case,
-        # not a crash for the whole gate.
-        manifest: Manifest | None = None
-        if paths is not None and paths.manifest.exists():
-            try:
-                manifest = Manifest.load(paths.manifest)
-            except ValueError as exc:
-                logger.error(f"{case_id}: invalid manifest.json: {exc}")
-                record(case_id, Action.FAIL, f"invalid manifest.json: {exc}")
-                continue
-
-        base_manifest: Manifest | None = None
-        if paths is not None:
-            try:
-                rel_manifest = paths.manifest.resolve().relative_to(repo_root_resolved).as_posix()
-            except ValueError:
-                rel_manifest = None
-            if rel_manifest is not None:
-                try:
-                    base_text = repo.git.show(f"{base}:{rel_manifest}")
-                except GitCommandError:
-                    base_manifest = None
-                else:
-                    # A corrupt manifest on the base branch can't be compared against;
-                    # fall back to seeding (REPLAY) rather than aborting the gate.
-                    try:
-                        base_manifest = Manifest.loads(base_text, source=f"{base}:{rel_manifest}")
-                    except ValueError as exc:
-                        logger.warning(
-                            f"{case_id}: base manifest at {base}:{rel_manifest} is invalid "
-                            f"({exc}); treating as newly added"
-                        )
-                        base_manifest = None
-
-        provider_slug = diag.provider.slug
-        if provider_slug not in source_root_cache:
-            source_root_cache[provider_slug] = _provider_source_root(diag, repo_root)
-        source_root = source_root_cache[provider_slug]
-        extraction_roots = [r for r in (source_root,) if r]
-        extraction_changed = core_changed or paths_under(changed_files, extraction_roots)
-
-        # Verify the committed bundle on disk still matches the manifest digests.
-        # A drift (edited/added/removed committed file without regenerating the
-        # manifest) must fail closed rather than slip through as SKIP.
-        committed_integrity_ok = True
-        # Verify the input catalog still matches the manifest's recorded hash. A catalog
-        # edit without regenerating the baseline leaves it silently stale; fail closed.
-        # Legacy manifests without a catalog_hash have nothing to compare, so stay OK.
-        catalog_integrity_ok = True
-        if manifest is not None and paths is not None:
-            committed_integrity_ok = compute_committed_digests(paths.regression) == manifest.committed
-            if manifest.catalog_hash is not None:
-                catalog_integrity_ok = get_catalog_hash(paths.catalog) == manifest.catalog_hash
-
-        decision = decide_coupling(
-            manifest,
-            base_manifest,
-            extraction_changed=extraction_changed,
-            committed_integrity_ok=committed_integrity_ok,
-            catalog_integrity_ok=catalog_integrity_ok,
-        )
-        record(case_id, decision.action, decision.reason)
-
-    if output_json:
-        console.print_json(_json.dumps(decisions))
-    else:
-        table = Table(title=f"CI coupling gate (base: {base})")
-        table.add_column("Test case", style="cyan", no_wrap=True)
-        table.add_column("Action")
-        table.add_column("Reason")
-        style_for = {
-            Action.FAIL.value: "red",
-            Action.EXECUTE.value: "yellow",
-            Action.REPLAY.value: "green",
-            Action.SKIP.value: "dim",
-        }
-        for entry in decisions:
-            style = style_for[entry["action"]]
-            table.add_row(entry["case"], f"[{style}]{entry['action']}[/{style}]", entry["reason"])
-        console.print(table)
-
-    if has_failure:
-        raise typer.Exit(code=1)
diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases/__init__.py b/packages/climate-ref/src/climate_ref/cli/test_cases/__init__.py
new file mode 100644
index 000000000..06d14cdde
--- /dev/null
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases/__init__.py
@@ -0,0 +1,38 @@
+"""
+Test management commands for diagnostic development.
+
+These commands are intended for diagnostic and require
+a source checkout of the project with test data directories available.
+
+The command group is split across modules by concern:
+
+- :mod:`~climate_ref.cli.test_cases.discovery` -- ``fetch`` / ``list``
+- :mod:`~climate_ref.cli.test_cases.run` -- ``run``
+- :mod:`~climate_ref.cli.test_cases.baselines` -- ``replay`` / ``mint`` / ``build``
+- :mod:`~climate_ref.cli.test_cases.store` -- ``sync`` / ``check-store``
+- :mod:`~climate_ref.cli.test_cases.ci_gate` -- ``ci-gate``
+"""
+
+from importlib import import_module
+
+from climate_ref.cli.test_cases._app import app
+from climate_ref.cli.test_cases._catalog import (
+    _build_catalog,
+    _fetch_and_build_catalog,
+    _solve_test_case,
+)
+from climate_ref.cli.test_cases._common import _iter_test_cases
+
+# Import each command module for its registration side effect on ``app``.
+# The sequence below is the order the verbs appear in ``ref test-cases --help``
+# a dynamic import keeps it explicit, where a plain ``import`` block would be alphabetised by ruff.
+for _command_module in ("discovery", "run", "baselines", "store", "ci_gate"):
+    import_module(f"{__name__}.{_command_module}")
+
+__all__ = [
+    "_build_catalog",
+    "_fetch_and_build_catalog",
+    "_iter_test_cases",
+    "_solve_test_case",
+    "app",
+]
diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases/_app.py b/packages/climate-ref/src/climate_ref/cli/test_cases/_app.py
new file mode 100644
index 000000000..f2da11350
--- /dev/null
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases/_app.py
@@ -0,0 +1,13 @@
+"""
+The Typer application backing the ``ref test-cases`` command group.
+"""
+
+import typer
+
+app = typer.Typer(
+    help=(
+        "Test data management commands for diagnostic development.\n\n"
+        "These commands are intended for diagnostic developers and require "
+        "a source checkout of the project with test data directories available."
+    )
+)
diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases/_catalog.py b/packages/climate-ref/src/climate_ref/cli/test_cases/_catalog.py
new file mode 100644
index 000000000..e7c122c5f
--- /dev/null
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases/_catalog.py
@@ -0,0 +1,176 @@
+"""
+Catalog construction helpers shared by the ``fetch`` and ``run`` commands.
+
+These turn a diagnostic's test-data requests into a solved
+:class:`~climate_ref_core.datasets.ExecutionDatasetCollection` and persist the
+input catalog YAML next to the test case.
+"""
+
+# ``from __future__ import annotations`` keeps the heavy signature types
+# (pandas, dataset adapters, diagnostics) under ``TYPE_CHECKING`` so importing
+# this module -- which happens on every ``ref`` invocation -- stays cheap.
+from __future__ import annotations
+
+from pathlib import Path
+from typing import TYPE_CHECKING
+
+from loguru import logger
+
+from climate_ref_core.exceptions import DatasetResolutionError
+
+if TYPE_CHECKING:
+    import pandas as pd
+
+    from climate_ref.datasets import DatasetAdapter
+    from climate_ref_core.datasets import ExecutionDatasetCollection, SourceDatasetType
+    from climate_ref_core.diagnostics import Diagnostic
+    from climate_ref_core.testing import TestCase
+
+
+def _build_catalog(dataset_adapter: DatasetAdapter, file_paths: list[Path]) -> pd.DataFrame:
+    """
+    Parse a list of datasets using a dataset adapter
+
+    Parameters
+    ----------
+    file_paths
+        List of files to build a catalog from
+
+    Returns
+    -------
+    pd.DataFrame
+        DataFrame catalog of datasets with metadata and paths
+    """
+    import pandas as pd
+
+    # Collect unique parent directories since the adapter scans directories
+    parent_dirs = list({fp.parent for fp in file_paths})
+
+    catalog_dfs = []
+    for parent_dir in parent_dirs:
+        try:
+            df = dataset_adapter.find_local_datasets(parent_dir)
+
+            # Filter to only include the files we fetched
+            fetched_files = {str(fp) for fp in file_paths}
+            df = df[df["path"].isin(fetched_files)]
+            if df.empty:
+                logger.warning(f"No matching files found in catalog for {parent_dir}")
+            catalog_dfs.append(df)
+        except Exception as e:
+            logger.warning(f"Failed to parse {parent_dir}: {e}")
+
+    if not catalog_dfs:
+        return pd.DataFrame()
+    return pd.concat(catalog_dfs, ignore_index=True)
+
+
+def _solve_test_case(
+    diagnostic: Diagnostic,
+    data_catalog: dict[SourceDatasetType, pd.DataFrame],
+) -> ExecutionDatasetCollection:
+    """
+    Solve for test case datasets by applying the diagnostic's data requirements.
+
+    Runs the solver to determine which datasets from the catalog
+    satisfy the diagnostic's requirements.
+    """
+    from climate_ref.solver import solve_executions
+
+    executions = list(solve_executions(data_catalog, diagnostic, diagnostic.provider))
+
+    if not executions:
+        raise ValueError(f"No valid executions found for diagnostic {diagnostic.slug}")
+
+    return executions[0].datasets
+
+
+def _fetch_and_build_catalog(
+    diag: Diagnostic,
+    tc: TestCase,
+    *,
+    force: bool = False,
+) -> tuple[ExecutionDatasetCollection, bool]:
+    """
+    Fetch test data and build catalog.
+
+    This function:
+    1. Fetches ESGF data using ESGFFetcher (files stored in intake-esgf cache)
+    2. Uses CMIP6DatasetAdapter to create a data catalog
+    3. Solves for datasets using the diagnostic's data requirements
+    4. Writes catalog YAML to .catalogs/{provider}/{diagnostic}/{test_case}.yaml
+    5. Returns the solved datasets and whether the catalog was written
+
+    By default, the catalog is only written if the content has changed.
+    Use `force=True` to always write.
+
+    Parameters
+    ----------
+    diag
+        The diagnostic to fetch data for
+    tc
+        The test case to fetch data for
+    force
+        If True, always write the catalog even if unchanged
+
+    Returns
+    -------
+    :
+        Tuple of (datasets, catalog_was_written)
+    """
+    from climate_ref.datasets import (
+        CMIP6DatasetAdapter,
+        CMIP7DatasetAdapter,
+        Obs4MIPsDatasetAdapter,
+        PMPClimatologyDatasetAdapter,
+    )
+    from climate_ref_core.datasets import SourceDatasetType
+    from climate_ref_core.esgf import ESGFFetcher
+    from climate_ref_core.testing import TestCasePaths, save_datasets_to_yaml
+
+    fetcher = ESGFFetcher()
+
+    # Fetch all requests - returns DataFrame with metadata + paths
+    combined = fetcher.fetch_for_test_case(tc.requests)
+
+    if combined.empty:
+        raise DatasetResolutionError(
+            f"No datasets found for {diag.provider.slug}/{diag.slug} test case '{tc.name}'"
+        )
+
+    # Group paths by source type and use adapters to build proper catalog
+    data_catalog: dict[SourceDatasetType, pd.DataFrame] = {}
+
+    for source_type, group_df in combined.groupby("source_type"):
+        file_paths = [Path(p) for p in group_df["path"].unique().tolist()]
+
+        if source_type == "CMIP6":
+            data_catalog[SourceDatasetType.CMIP6] = _build_catalog(CMIP6DatasetAdapter(), file_paths)
+
+        elif source_type == "CMIP7":
+            data_catalog[SourceDatasetType.CMIP7] = _build_catalog(CMIP7DatasetAdapter(), file_paths)
+
+        elif source_type == "obs4MIPs":
+            data_catalog[SourceDatasetType.obs4MIPs] = _build_catalog(Obs4MIPsDatasetAdapter(), file_paths)
+
+        elif source_type == "PMPClimatology":
+            data_catalog[SourceDatasetType.PMPClimatology] = _build_catalog(
+                PMPClimatologyDatasetAdapter(), file_paths
+            )
+
+    if not data_catalog:
+        raise DatasetResolutionError(
+            f"No datasets found for {diag.provider.slug}/{diag.slug} test case '{tc.name}'"
+        )
+
+    # Solve for datasets
+    datasets = _solve_test_case(diag, data_catalog)
+
+    # Write catalog YAML to package-local test case directory
+    catalog_written = False
+    paths = TestCasePaths.from_diagnostic(diag, tc.name)
+    if paths:
+        paths.create()
+        catalog_written = save_datasets_to_yaml(datasets, paths.catalog, force=force)
+
+    return datasets, catalog_written
diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases/_common.py b/packages/climate-ref/src/climate_ref/cli/test_cases/_common.py
new file mode 100644
index 000000000..5fc9ac37e
--- /dev/null
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases/_common.py
@@ -0,0 +1,91 @@
+"""
+Helpers shared across several ``ref test-cases`` commands.
+
+``_iter_test_cases`` enumerates ``(diagnostic, test_case)`` pairs from the
+provider registry (used by ``sync`` / ``replay`` / ``mint`` / ``build`` /
+``ci-gate``) and ``_write_test_case_manifest`` authors the committed
+``manifest.json`` (used by ``run`` / ``mint`` / ``build``).
+"""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+
+    from climate_ref.provider_registry import ProviderRegistry
+    from climate_ref_core.diagnostics import Diagnostic
+    from climate_ref_core.regression.manifest import Manifest, NativeEntry
+    from climate_ref_core.testing import TestCase, TestCasePaths
+
+
+def _write_test_case_manifest(
+    paths: TestCasePaths,
+    *,
+    test_case_version: int,
+    committed: dict[str, str],
+    native: dict[str, NativeEntry],
+    schema: int | None = None,
+) -> Manifest:
+    """
+    Construct and write a test case ``manifest.json``, recording the input catalog hash.
+
+    Shared by ``run`` (which preserves the existing version and native block) and
+    ``mint`` (which authors the native block and may bump the version); the two
+    callers differ only in the ``test_case_version`` and ``native`` they supply.
+    The ``catalog_hash`` is always (re)derived from the current ``catalog.yaml`` so
+    the manifest stays coupled to the inputs that produced the committed bundle.
+    """
+    from climate_ref_core.regression.manifest import SCHEMA_VERSION, Manifest
+    from climate_ref_core.testing import get_catalog_hash
+
+    manifest = Manifest(
+        schema=SCHEMA_VERSION if schema is None else schema,
+        test_case_version=test_case_version,
+        committed=dict(committed),
+        native=native,
+        catalog_hash=get_catalog_hash(paths.catalog),
+    )
+    manifest.dump(paths.manifest)
+    return manifest
+
+
+def _iter_test_cases(
+    registry: ProviderRegistry,
+    *,
+    provider: str | None = None,
+    diagnostic: str | None = None,
+    test_case: str | None = None,
+) -> Iterator[tuple[Diagnostic, TestCase]]:
+    """
+    Yield ``(diagnostic, test_case)`` pairs from the registry, applying filters.
+
+    Parameters
+    ----------
+    registry
+        The provider registry to enumerate.
+    provider
+        Optional provider slug filter.
+    diagnostic
+        Optional diagnostic slug filter.
+    test_case
+        Optional test case name filter.
+
+    Yields
+    ------
+    :
+        Matching ``(diagnostic, test_case)`` pairs.
+    """
+    for provider_instance in registry.providers:
+        if provider and provider_instance.slug != provider:
+            continue
+        for diag in provider_instance.diagnostics():
+            if diagnostic and diag.slug != diagnostic:
+                continue
+            if diag.test_data_spec is None:
+                continue
+            for tc in diag.test_data_spec.test_cases:
+                if test_case and tc.name != test_case:
+                    continue
+                yield diag, tc
diff --git a/packages/climate-ref/src/climate_ref/cli/_test_case_stages.py b/packages/climate-ref/src/climate_ref/cli/test_cases/_stages.py
similarity index 96%
rename from packages/climate-ref/src/climate_ref/cli/_test_case_stages.py
rename to packages/climate-ref/src/climate_ref/cli/test_cases/_stages.py
index 57719d8cb..bbb34a706 100644
--- a/packages/climate-ref/src/climate_ref/cli/_test_case_stages.py
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases/_stages.py
@@ -10,11 +10,11 @@
 - **upload** -- push changed-digest native blobs to the store
 - **compare** -- diff a slot's rebuilt bundle against the tracked committed baseline
 
-Native produced by a source stage (execute or materialise) lands in a gitignored *output
-slot* (``<case>/output/<label>/``), flat at manifest-relative paths, with a ``regression/``
-subdirectory holding the rebuilt committed bundle and a ``.source.json`` stamp.
-``latest`` (the default label) is overwritten on every run; named slots persist so two runs
-can be diffed (``--label before`` vs ``--label after``).
+Native produced by a source stage (execute or materialise) lands in a gitignored *output slot*
+(``<case>/output/<label>/``), flat at manifest-relative paths,
+with a ``regression/`` subdirectory holding the rebuilt committed bundle and a ``.source.json`` stamp.
+``latest`` (the default label) is overwritten on every run.
+A custom named slot persists so two runs can be diffed (``--label before`` vs ``--label after``).
 See ``docs/background/regression-baselines.md``.
 """
 
diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases/baselines.py b/packages/climate-ref/src/climate_ref/cli/test_cases/baselines.py
new file mode 100644
index 000000000..0818bcc63
--- /dev/null
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases/baselines.py
@@ -0,0 +1,489 @@
+"""
+The native-baseline lifecycle verbs: ``replay``, ``mint`` and ``build``.
+
+Each is a thin composition over the stages in
+:mod:`climate_ref.cli.test_cases._stages`:
+
+- ``replay`` materialises committed native from the store and checks it rebuilds
+  the committed bundle within tolerance.
+- ``mint`` (re)authors the canonical native baselines and uploads them.
+- ``build`` rebuilds the committed bundle from an existing output slot without
+  re-executing.
+"""
+
+from typing import TYPE_CHECKING, Annotated
+
+import typer
+from loguru import logger
+
+from climate_ref.cli.test_cases._app import app
+from climate_ref.cli.test_cases._common import _iter_test_cases, _write_test_case_manifest
+from climate_ref.cli.test_cases._stages import (
+    StageError,
+    native_is_stale,
+    prepare_slot,
+    promote_to_baseline,
+    slot_native_relpaths,
+    snapshot_native,
+    stage_build,
+    stage_compare,
+    stage_execute,
+    stage_materialise,
+    stage_rebuild_from_slot,
+    stage_upload,
+    write_source_stamp,
+)
+from climate_ref.config import Config
+
+if TYPE_CHECKING:
+    from rich.console import Console
+
+
+@app.command(name="replay")
+def replay_test_case(  # noqa: PLR0912, PLR0915
+    ctx: typer.Context,
+    provider: Annotated[
+        str,
+        typer.Option(help="Provider slug (required, e.g., 'example', 'ilamb')"),
+    ],
+    diagnostic: Annotated[
+        str | None,
+        typer.Option(help="Specific diagnostic slug to replay"),
+    ] = None,
+    test_case: Annotated[
+        str | None,
+        typer.Option(help="Specific test case name to replay"),
+    ] = None,
+    label: Annotated[
+        str,
+        typer.Option(help="Output slot name under output/ (default: latest)"),
+    ] = "latest",
+) -> None:
+    """
+    Replay committed baselines from native blobs and compare to the committed bundle.
+
+    Materialises the committed manifest's native blobs (public, credential-free)
+    into a fresh output directory at their stored relative paths, re-runs ``build_execution_result``,
+    and compares the regenerated committed bundle to the in-repo copy using the tolerant content comparator.
+
+    Exits non-zero on drift.
+
+    Examples
+    --------
+        ref test-cases replay --provider example
+        ref test-cases replay --provider example --diagnostic global-mean-timeseries
+    """
+    from climate_ref.provider_registry import ProviderRegistry
+    from climate_ref_core.regression import Manifest, verify_committed_integrity
+    from climate_ref_core.regression.store import build_native_store
+    from climate_ref_core.testing import TestCasePaths
+
+    config: Config = ctx.obj.config
+    db = ctx.obj.database
+    console: Console = ctx.obj.console
+
+    registry = ProviderRegistry.build_from_config(config, db)
+    store = build_native_store(config.native_store, writable=False)
+
+    cases = list(_iter_test_cases(registry, provider=provider, diagnostic=diagnostic, test_case=test_case))
+    if not cases:
+        logger.warning(f"No test cases found for provider {provider!r}")
+        raise typer.Exit(code=0)
+
+    # When a specific case is named, a missing manifest/catalog is a hard failure.
+    named = bool(diagnostic or test_case)
+
+    successes = 0
+    failures: list[str] = []
+
+    for diag, tc in cases:
+        paths = TestCasePaths.from_diagnostic(diag, tc.name)
+        case_id = f"{provider}/{diag.slug}/{tc.name}"
+        if paths is None:
+            logger.warning(f"Could not determine test case directory for {case_id}")
+            continue
+        if not paths.manifest.exists():
+            message = f"No manifest.json for {case_id}; run `ref test-cases mint` first"
+            if named:
+                logger.error(message)
+                failures.append(case_id)
+            else:
+                logger.warning(message)
+            continue
+        if not paths.catalog.exists():
+            logger.error(f"No catalog file for {case_id}; run `ref test-cases fetch` first")
+            failures.append(case_id)
+            continue
+
+        manifest = Manifest.load(paths.manifest)
+
+        # The byte-exact digest check is advisory that the committed baseline is not bitwise identical.
+        # The tolerant bundle comparison below may still find them equivalent within tolerance.
+        mismatches = verify_committed_integrity(manifest, paths.regression)
+        if mismatches:
+            logger.warning(
+                f"{case_id}: committed baseline differs from the digests recorded in {paths.manifest}"
+            )
+            for mismatch in mismatches:
+                logger.warning(f"  - {mismatch}")
+
+        if not manifest.native:
+            logger.error(
+                f"{case_id}: manifest has no native baselines — not yet minted. "
+                "Run `ref test-cases mint` first."
+            )
+            failures.append(case_id)
+            continue
+
+        slot = prepare_slot(paths, label)
+        try:
+            source = stage_materialise(
+                diag=diag, tc=tc, paths=paths, manifest=manifest, store=store, slot=slot
+            )
+        except Exception as exc:
+            logger.error(f"{case_id}: failed to materialise/rebuild native: {exc}")
+            failures.append(case_id)
+            continue
+
+        stage_build(slot=slot, source=source, paths=paths)
+        cmp_failures, compared = stage_compare(slot=slot, paths=paths, slug=diag.slug)
+        write_source_stamp(
+            slot,
+            label=label,
+            verb="replay",
+            source="materialise",
+            test_case_version=manifest.test_case_version,
+        )
+        if cmp_failures:
+            logger.error(f"{case_id}: replay drift detected:\n" + "\n".join(cmp_failures))
+            failures.append(case_id)
+            continue
+
+        successes += 1
+        if mismatches:
+            # The byte-level warning above was reconciled by the tolerant comparison.
+            logger.info(
+                f"Replay reconciled committed bundle: {case_id} "
+                f"({len(manifest.native)} native file(s) materialised, "
+                f"{len(compared)} bundle file(s) equivalent within tolerance)"
+            )
+        else:
+            logger.info(
+                f"Replay matched committed bundle: {case_id} "
+                f"({len(manifest.native)} native file(s) materialised, "
+                f"{len(compared)} bundle file(s) compared)"
+            )
+
+    console.print()
+    if failures:
+        console.print(f"[yellow]Replay: {successes} passed, {len(failures)} failed[/yellow]")
+        console.print("[red]Failed replays:[/red]")
+        for case in failures:
+            console.print(f"  - {case}")
+        raise typer.Exit(code=1)
+    console.print(f"[green]All {successes} replay(s) matched the committed bundle[/green]")
+
+
+@app.command(name="mint")
+def mint_native(  # noqa: PLR0912, PLR0913, PLR0915
+    ctx: typer.Context,
+    provider: Annotated[
+        str,
+        typer.Option(help="Provider slug (required, e.g., 'example', 'ilamb')"),
+    ],
+    diagnostic: Annotated[
+        str | None,
+        typer.Option(help="Specific diagnostic slug to mint"),
+    ] = None,
+    test_case: Annotated[
+        str | None,
+        typer.Option(help="Specific test case name to mint"),
+    ] = None,
+    label: Annotated[
+        str,
+        typer.Option(help="Output slot name under output/ (default: latest)"),
+    ] = "latest",
+    from_replay: Annotated[
+        bool,
+        typer.Option(
+            "--from-replay",
+            help="Author from a replay of the stored native instead of re-running the diagnostic",
+        ),
+    ] = False,
+    bump_version: Annotated[
+        bool,
+        typer.Option(help="Increment test_case_version when authoring the manifest"),
+    ] = False,
+    dry_run: Annotated[
+        bool,
+        typer.Option(help="Preflight the store and list what would be minted, without running or uploading"),
+    ] = False,
+) -> None:
+    """
+    Mint canonical native baselines
+
+    Runs each test case, stores its native snapshot in the writable store,
+    and authors the committed ``manifest.json``'s ``native`` block.
+
+    This requires write credentials and is generally run by the CI.
+
+    Examples
+    --------
+        ref test-cases mint --provider example
+        ref test-cases mint --provider example --bump-version
+        ref test-cases mint --provider example --dry-run
+    """
+    from climate_ref.provider_registry import ProviderRegistry
+    from climate_ref_core.regression.manifest import Manifest
+    from climate_ref_core.regression.store import NativeStoreUnavailableError, build_native_store
+    from climate_ref_core.testing import TestCasePaths, load_datasets_from_yaml
+
+    config: Config = ctx.obj.config
+    db = ctx.obj.database
+    console: Console = ctx.obj.console
+
+    try:
+        store = build_native_store(config.native_store, writable=True)
+    except (NotImplementedError, ValueError) as exc:
+        logger.error(
+            "Cannot mint: no writable native store is configured. For the remote (R2) store set "
+            "REF_NATIVE_STORE_S3_ENDPOINT_URL and REF_NATIVE_STORE_BUCKET, and authenticate via "
+            "REF_NATIVE_STORE_ACCESS_KEY_ID / REF_NATIVE_STORE_SECRET_ACCESS_KEY or a named "
+            "REF_NATIVE_STORE_PROFILE; or set REF_NATIVE_STORE_URL to a local file:// path for "
+            f"development: {exc}"
+        )
+        raise typer.Exit(code=1) from exc
+
+    # Preflight the store (credentials / bucket reachability) before running any diagnostics,
+    # so a misconfiguration fails fast instead of after the (slow) execution.
+    try:
+        store.preflight()
+    except NativeStoreUnavailableError as exc:
+        logger.error(f"Cannot mint: {exc}")
+        raise typer.Exit(code=1) from exc
+
+    registry = ProviderRegistry.build_from_config(config, db)
+    cases = list(_iter_test_cases(registry, provider=provider, diagnostic=diagnostic, test_case=test_case))
+    if not cases:
+        logger.warning(f"No test cases found for provider {provider!r}")
+        raise typer.Exit(code=0)
+
+    if dry_run:
+        # The store preflight has already passed at this point; report scope and stop before
+        # running any diagnostics or uploading anything.
+        console.print(f"[cyan]Dry run — would mint {len(cases)} test case(s):[/cyan]")
+        for diag, tc in cases:
+            console.print(f"  - {provider}/{diag.slug}/{tc.name}")
+        console.print("[cyan]Store preflight passed; nothing was run or uploaded.[/cyan]")
+        return
+
+    minted = 0
+    failures: list[str] = []
+
+    for diag, tc in cases:
+        case_id = f"{provider}/{diag.slug}/{tc.name}"
+        paths = TestCasePaths.from_diagnostic(diag, tc.name)
+        if paths is None:
+            logger.warning(f"Could not determine test case directory for {case_id}")
+            continue
+        if not paths.catalog.exists():
+            logger.error(f"No catalog file for {case_id}; run `ref test-cases fetch` first")
+            failures.append(case_id)
+            continue
+
+        paths.create()
+        previous = Manifest.load(paths.manifest) if paths.manifest.exists() else None
+        # Validate the --from-replay precondition before wiping the slot, so a never-minted
+        # case does not destroy a pre-existing output/<label>/ on its way to failing.
+        if from_replay and (previous is None or not previous.native):
+            logger.error(f"{case_id}: --from-replay needs an existing minted manifest")
+            failures.append(case_id)
+            continue
+
+        slot = prepare_slot(paths, label)
+
+        # Populate the slot's native set: either re-execute the diagnostic, or (with
+        # --from-replay) materialise the previously minted native from the store. The
+        # writable store's fetch/has back the materialise, so no separate read store is needed.
+        try:
+            if from_replay and previous is not None:  # previous is non-None by the guard above
+                source = stage_materialise(
+                    diag=diag, tc=tc, paths=paths, manifest=previous, store=store, slot=slot
+                )
+                source_kind = "materialise"
+            else:
+                datasets = load_datasets_from_yaml(paths.catalog)
+                source = stage_execute(
+                    config=config,
+                    diag=diag,
+                    tc=tc,
+                    datasets=datasets,
+                    slot=slot,
+                    execution_dir=None,
+                    clean=True,
+                )
+                source_kind = "execute"
+        except StageError as exc:
+            logger.error(f"{case_id}: {exc}")
+            failures.append(case_id)
+            continue
+        except Exception as exc:
+            logger.error(f"{case_id}: source stage failed during mint: {exc}")
+            failures.append(case_id)
+            continue
+
+        committed = stage_build(slot=slot, source=source, paths=paths)
+        native = snapshot_native(slot)
+        errors = stage_upload(
+            slot=slot, native=native, store=store, previous=(previous.native if previous else {})
+        )
+        if errors:
+            for error in errors:
+                logger.error(f"{case_id}: {error}")
+            failures.append(case_id)
+            continue
+
+        # Promote the rebuilt bundle and author the committed manifest: the native block
+        # is written ONLY here.
+        promote_to_baseline(slot, paths)
+        if previous is not None:
+            version = previous.test_case_version + 1 if bump_version else previous.test_case_version
+        else:
+            version = 1
+        _write_test_case_manifest(paths, test_case_version=version, committed=committed, native=native)
+        write_source_stamp(slot, label=label, verb="mint", source=source_kind, test_case_version=version)
+
+        minted += 1
+        logger.info(
+            f"Minted native baseline: {case_id} "
+            f"({len(native)} native file(s), {len(committed)} committed file(s), "
+            f"test_case_version={version})"
+        )
+
+    console.print()
+    if failures:
+        console.print(f"[yellow]Mint: {minted} minted, {len(failures)} failed[/yellow]")
+        console.print("[red]Failed mints:[/red]")
+        for case in failures:
+            console.print(f"  - {case}")
+        raise typer.Exit(code=1)
+    console.print(f"[green]Minted {minted} native baseline(s)[/green]")
+
+
+@app.command(name="build")
+def build_test_case(  # noqa: PLR0912, PLR0913, PLR0915
+    ctx: typer.Context,
+    provider: Annotated[
+        str,
+        typer.Option(help="Provider slug (required, e.g., 'example', 'ilamb')"),
+    ],
+    diagnostic: Annotated[
+        str | None,
+        typer.Option(help="Specific diagnostic slug to build"),
+    ] = None,
+    test_case: Annotated[
+        str | None,
+        typer.Option(help="Specific test case name to build"),
+    ] = None,
+    label: Annotated[
+        str,
+        typer.Option(help="Output slot to rebuild from (default: latest)"),
+    ] = "latest",
+    force_regen: Annotated[
+        bool,
+        typer.Option(help="Promote the rebuilt bundle to the tracked regression baseline"),
+    ] = False,
+) -> None:
+    """
+    Rebuild the committed bundle from an existing output slot, without re-executing.
+
+    Reuses the native already materialised in ``output/<label>/`` (by a previous
+    ``run`` / ``replay`` / ``mint``) to regenerate the slot's committed bundle. The tracked
+    ``regression/`` baseline is only promoted when ``--force-regen`` is given or no baseline
+    exists yet, so a rebuild never silently clobbers a committed baseline.
+
+    Examples
+    --------
+        ref test-cases build --provider example
+        ref test-cases build --provider example --label before --force-regen
+    """
+    from climate_ref.provider_registry import ProviderRegistry
+    from climate_ref_core.regression.manifest import Manifest
+    from climate_ref_core.testing import TestCasePaths
+
+    config: Config = ctx.obj.config
+    db = ctx.obj.database
+    console: Console = ctx.obj.console
+
+    registry = ProviderRegistry.build_from_config(config, db)
+    cases = list(_iter_test_cases(registry, provider=provider, diagnostic=diagnostic, test_case=test_case))
+    if not cases:
+        logger.warning(f"No test cases found for provider {provider!r}")
+        raise typer.Exit(code=0)
+
+    built = 0
+    failures: list[str] = []
+
+    for diag, tc in cases:
+        case_id = f"{provider}/{diag.slug}/{tc.name}"
+        paths = TestCasePaths.from_diagnostic(diag, tc.name)
+        if paths is None:
+            logger.warning(f"Could not determine test case directory for {case_id}")
+            continue
+        slot = paths.output_slot(label)
+        if not slot.exists() or not slot_native_relpaths(slot):
+            logger.error(f"{case_id}: no native in output slot {label!r}; run/replay/mint it first")
+            failures.append(case_id)
+            continue
+        if not paths.catalog.exists():
+            logger.error(f"No catalog file for {case_id}; run `ref test-cases fetch` first")
+            failures.append(case_id)
+            continue
+
+        try:
+            source = stage_rebuild_from_slot(diag=diag, tc=tc, paths=paths, slot=slot)
+        except Exception as exc:
+            logger.error(f"{case_id}: failed to rebuild bundle from slot: {exc}")
+            failures.append(case_id)
+            continue
+
+        committed = stage_build(slot=slot, source=source, paths=paths)
+        previous = Manifest.load(paths.manifest) if paths.manifest.exists() else None
+        version = previous.test_case_version if previous else 1
+
+        if force_regen or not paths.regression.exists():
+            promote_to_baseline(slot, paths)
+            native = snapshot_native(slot)
+            if previous is not None:
+                _write_test_case_manifest(
+                    paths,
+                    test_case_version=previous.test_case_version,
+                    committed=committed,
+                    native=previous.native,
+                    schema=previous.schema,
+                )
+                if native_is_stale(native, previous.native):
+                    logger.warning(
+                        f"{case_id}: committed bundle rebuilt but the native baseline differs; "
+                        "re-mint with `ref test-cases mint`"
+                    )
+            else:
+                _write_test_case_manifest(paths, test_case_version=1, committed=committed, native={})
+            logger.info(f"Promoted rebuilt bundle to regression baseline: {paths.regression}")
+        else:
+            logger.info(
+                f"Wrote output slot {slot}/regression "
+                "(committed baseline unchanged; use --force-regen to promote it)"
+            )
+
+        write_source_stamp(slot, label=label, verb="build", source="rebuild", test_case_version=version)
+        built += 1
+
+    console.print()
+    if failures:
+        console.print(f"[yellow]Build: {built} built, {len(failures)} failed[/yellow]")
+        console.print("[red]Failed builds:[/red]")
+        for case in failures:
+            console.print(f"  - {case}")
+        raise typer.Exit(code=1)
+    console.print(f"[green]Built {built} committed bundle(s) from output slots[/green]")
diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases/ci_gate.py b/packages/climate-ref/src/climate_ref/cli/test_cases/ci_gate.py
new file mode 100644
index 000000000..6f6780edd
--- /dev/null
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases/ci_gate.py
@@ -0,0 +1,293 @@
+"""
+``ref test-cases ci-gate``.
+
+Decides, per test case, how CI should verify its regression baseline (replay,
+execute, skip, or fail) by comparing the committed ``manifest.json`` against the
+base branch and detecting extraction-code changes.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+from typing import TYPE_CHECKING, Annotated
+
+import typer
+from loguru import logger
+from rich.table import Table
+
+from climate_ref.cli._git_utils import get_repo_for_path
+from climate_ref.cli.test_cases._app import app
+from climate_ref.cli.test_cases._common import _iter_test_cases
+from climate_ref.config import Config
+
+if TYPE_CHECKING:
+    from rich.console import Console
+
+    from climate_ref_core.diagnostics import Diagnostic
+
+
+def _provider_source_root(diag: Diagnostic, repo_root: Path) -> str | None:
+    """
+    Return the diagnostic's provider package source directory, relative to the repo root.
+
+    Used to decide whether a changed file touches the diagnostic's extraction code.
+    The returned path is POSIX-style so it can be compared against
+    ``git diff --name-only`` output.
+
+    Parameters
+    ----------
+    diag
+        The diagnostic whose provider source directory is wanted.
+    repo_root
+        The repository working-tree root.
+
+    Returns
+    -------
+    :
+        The provider package source directory relative to ``repo_root``, or ``None``
+        if it cannot be located or lies outside the repository.
+    """
+    import importlib.util
+
+    top_package = type(diag).__module__.split(".")[0]
+    try:
+        spec = importlib.util.find_spec(top_package)
+    except (ImportError, ValueError):
+        return None
+    if spec is None or not spec.submodule_search_locations:
+        return None
+    package_dir = Path(next(iter(spec.submodule_search_locations))).resolve()
+    try:
+        return package_dir.relative_to(repo_root.resolve()).as_posix()
+    except ValueError:
+        return None
+
+
+def _core_extraction_roots(repo_root: Path) -> list[str]:
+    """
+    Return the core paths whose change affects replay/execute for every test case.
+
+    ``build_execution_result`` (the function replay/execute re-run) depends on more
+    than the regression package: it builds and reads CMEC bundles via
+    :mod:`climate_ref_core.pycmec`, persists curated outputs via
+    :mod:`climate_ref_core.output_files`, and is dispatched through
+    :mod:`climate_ref_core.diagnostics`. A change under any of these can alter the
+    regenerated bundle, so all of them count as an extraction change.
+
+    Detection is deliberately coarse and errs toward REPLAY (cheap, credential-free):
+    a false positive only triggers an unnecessary replay, never a missed one.
+    Roots are derived from the installed package location (rather than hardcoded
+    paths) so they survive a package move; any root outside the repository
+    (e.g. an installed wheel) is dropped.
+
+    Parameters
+    ----------
+    repo_root
+        The repository working-tree root.
+
+    Returns
+    -------
+    :
+        Repo-relative POSIX paths for the core extraction surfaces that lie inside the repo.
+    """
+    import climate_ref_core
+
+    core_dir = Path(climate_ref_core.__file__).resolve().parent
+    repo_root_resolved = repo_root.resolve()
+    candidates = [
+        core_dir / "regression",
+        core_dir / "pycmec",
+        core_dir / "output_files.py",
+        core_dir / "diagnostics.py",
+    ]
+    roots: list[str] = []
+    for candidate in candidates:
+        try:
+            roots.append(candidate.relative_to(repo_root_resolved).as_posix())
+        except ValueError:
+            continue
+    return roots
+
+
+@app.command(name="ci-gate")
+def ci_gate(  # noqa: PLR0912, PLR0913, PLR0915
+    ctx: typer.Context,
+    base: Annotated[
+        str,
+        typer.Option(help="Git ref to compare against (the PR base branch)"),
+    ] = "origin/main",
+    provider: Annotated[
+        str | None,
+        typer.Option(help="Limit the gate to a single provider slug"),
+    ] = None,
+    diagnostic: Annotated[
+        str | None,
+        typer.Option(help="Limit the gate to a single diagnostic slug"),
+    ] = None,
+    test_case: Annotated[
+        str | None,
+        typer.Option(help="Limit the gate to a single test case name"),
+    ] = None,
+    output_json: Annotated[
+        bool,
+        typer.Option("--json", help="Emit the per-case decisions as JSON on stdout"),
+    ] = False,
+) -> None:
+    """
+    Decide how CI should verify each test case's regression baseline.
+
+    Compares each committed ``manifest.json`` to its counterpart on the base branch
+    and reports the action CI should take per case: ``replay`` (cheap, against the
+    cached native baseline), ``execute`` (full re-run, when ``test_case_version`` was
+    bumped), ``skip`` (nothing relevant changed), or ``fail`` (an unauthorised
+    baseline change). Exits non-zero if any case is gated ``fail``.
+
+    The ``--json`` output is intended for CI to dispatch ``replay``/``run`` jobs.
+
+    Examples
+    --------
+        ref test-cases ci-gate                       # Gate all cases against origin/main
+        ref test-cases ci-gate --base origin/develop
+        ref test-cases ci-gate --provider example --json
+    """
+    import json as _json
+
+    from git import GitCommandError
+
+    from climate_ref.provider_registry import ProviderRegistry
+    from climate_ref_core.regression.gate import Action, decide_coupling, paths_under
+    from climate_ref_core.regression.manifest import Manifest, compute_committed_digests
+    from climate_ref_core.testing import TestCasePaths, get_catalog_hash
+
+    config: Config = ctx.obj.config
+    db = ctx.obj.database
+    console: Console = ctx.obj.console
+
+    repo = get_repo_for_path(Path.cwd())
+    if repo is None or repo.working_dir is None:
+        logger.error("ci-gate must be run inside a git repository")
+        raise typer.Exit(code=1)
+    repo_root = Path(repo.working_dir)
+
+    # Resolve the set of files changed on this branch relative to the base ref.
+    # `base...HEAD` diffs against the merge-base, so unrelated base-branch churn
+    # is excluded.
+    try:
+        diff_output = repo.git.diff("--name-only", f"{base}...HEAD")
+    except GitCommandError as exc:
+        logger.error(f"Could not diff against base ref {base!r}: {exc}")
+        raise typer.Exit(code=1) from exc
+    changed_files = [line.strip() for line in diff_output.splitlines() if line.strip()]
+
+    # The core machinery behind build_execution_result affects every replay/execute,
+    # so a change there counts as an extraction change for all cases. Extraction-change
+    # detection is deliberately coarse: any change under a diagnostic's provider package
+    # (see `_provider_source_root`) or under the core extraction surfaces counts for
+    # every case in that provider. This errs toward REPLAY (cheap, credential-free),
+    # never away from it.
+    core_changed = paths_under(changed_files, _core_extraction_roots(repo_root))
+
+    # Hoisted once: repo_root.resolve() is filesystem-touching, and a provider's source
+    # root is identical for every case in that provider, so memoise it per provider slug
+    # rather than recomputing find_spec on each case.
+    repo_root_resolved = repo_root.resolve()
+    source_root_cache: dict[str, str | None] = {}
+
+    registry = ProviderRegistry.build_from_config(config, db)
+
+    decisions: list[dict[str, str]] = []
+    has_failure = False
+
+    def record(case: str, action: Action, reason: str) -> None:
+        nonlocal has_failure
+        if action is Action.FAIL:
+            has_failure = True
+        decisions.append({"case": case, "action": action.value, "reason": reason})
+
+    for diag, tc in _iter_test_cases(registry, provider=provider, diagnostic=diagnostic, test_case=test_case):
+        case_id = f"{diag.provider.slug}/{diag.slug}/{tc.name}"
+        paths = TestCasePaths.from_diagnostic(diag, tc.name)
+
+        # A corrupt manifest authored in this change is a hard failure for that case,
+        # not a crash for the whole gate.
+        manifest: Manifest | None = None
+        if paths is not None and paths.manifest.exists():
+            try:
+                manifest = Manifest.load(paths.manifest)
+            except ValueError as exc:
+                logger.error(f"{case_id}: invalid manifest.json: {exc}")
+                record(case_id, Action.FAIL, f"invalid manifest.json: {exc}")
+                continue
+
+        base_manifest: Manifest | None = None
+        if paths is not None:
+            try:
+                rel_manifest = paths.manifest.resolve().relative_to(repo_root_resolved).as_posix()
+            except ValueError:
+                rel_manifest = None
+            if rel_manifest is not None:
+                try:
+                    base_text = repo.git.show(f"{base}:{rel_manifest}")
+                except GitCommandError:
+                    base_manifest = None
+                else:
+                    # A corrupt manifest on the base branch can't be compared against;
+                    # fall back to seeding (REPLAY) rather than aborting the gate.
+                    try:
+                        base_manifest = Manifest.loads(base_text, source=f"{base}:{rel_manifest}")
+                    except ValueError as exc:
+                        logger.warning(
+                            f"{case_id}: base manifest at {base}:{rel_manifest} is invalid "
+                            f"({exc}); treating as newly added"
+                        )
+                        base_manifest = None
+
+        provider_slug = diag.provider.slug
+        if provider_slug not in source_root_cache:
+            source_root_cache[provider_slug] = _provider_source_root(diag, repo_root)
+        source_root = source_root_cache[provider_slug]
+        extraction_roots = [r for r in (source_root,) if r]
+        extraction_changed = core_changed or paths_under(changed_files, extraction_roots)
+
+        # Verify the committed bundle on disk still matches the manifest digests.
+        # A drift (edited/added/removed committed file without regenerating the
+        # manifest) must fail closed rather than slip through as SKIP.
+        committed_integrity_ok = True
+        # Verify the input catalog still matches the manifest's recorded hash. A catalog
+        # edit without regenerating the baseline leaves it silently stale; fail closed.
+        # Legacy manifests without a catalog_hash have nothing to compare, so stay OK.
+        catalog_integrity_ok = True
+        if manifest is not None and paths is not None:
+            committed_integrity_ok = compute_committed_digests(paths.regression) == manifest.committed
+            if manifest.catalog_hash is not None:
+                catalog_integrity_ok = get_catalog_hash(paths.catalog) == manifest.catalog_hash
+
+        decision = decide_coupling(
+            manifest,
+            base_manifest,
+            extraction_changed=extraction_changed,
+            committed_integrity_ok=committed_integrity_ok,
+            catalog_integrity_ok=catalog_integrity_ok,
+        )
+        record(case_id, decision.action, decision.reason)
+
+    if output_json:
+        console.print_json(_json.dumps(decisions))
+    else:
+        table = Table(title=f"CI coupling gate (base: {base})")
+        table.add_column("Test case", style="cyan", no_wrap=True)
+        table.add_column("Action")
+        table.add_column("Reason")
+        style_for = {
+            Action.FAIL.value: "red",
+            Action.EXECUTE.value: "yellow",
+            Action.REPLAY.value: "green",
+            Action.SKIP.value: "dim",
+        }
+        for entry in decisions:
+            style = style_for[entry["action"]]
+            table.add_row(entry["case"], f"[{style}]{entry['action']}[/{style}]", entry["reason"])
+        console.print(table)
+
+    if has_failure:
+        raise typer.Exit(code=1)
diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases/discovery.py b/packages/climate-ref/src/climate_ref/cli/test_cases/discovery.py
new file mode 100644
index 000000000..3225a81d4
--- /dev/null
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases/discovery.py
@@ -0,0 +1,231 @@
+"""
+``ref test-cases fetch`` and ``ref test-cases list``.
+
+Commands for discovering test cases and fetching their input data from ESGF.
+"""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Annotated
+
+import typer
+from loguru import logger
+from rich.table import Table
+
+from climate_ref.cli.test_cases._app import app
+from climate_ref.cli.test_cases._catalog import _fetch_and_build_catalog
+from climate_ref_core.exceptions import DatasetResolutionError
+
+if TYPE_CHECKING:
+    from climate_ref_core.diagnostics import Diagnostic
+
+
+@app.command(name="fetch")
+def fetch_test_data(  # noqa: PLR0912, PLR0913, PLR0915
+    ctx: typer.Context,
+    provider: Annotated[
+        str | None,
+        typer.Option(help="Specific provider to fetch data for (e.g., 'esmvaltool', 'ilamb')"),
+    ] = None,
+    diagnostic: Annotated[
+        str | None,
+        typer.Option(help="Specific diagnostic slug to fetch data for"),
+    ] = None,
+    test_case: Annotated[
+        str | None,
+        typer.Option(help="Specific test case name to fetch data for"),
+    ] = None,
+    dry_run: Annotated[
+        bool,
+        typer.Option(help="Show what would be fetched without downloading"),
+    ] = False,
+    only_missing: Annotated[
+        bool,
+        typer.Option(help="Only fetch data for test cases without existing catalogs"),
+    ] = False,
+    force: Annotated[
+        bool,
+        typer.Option(help="Force overwrite catalog even if unchanged"),
+    ] = False,
+) -> None:
+    """
+    Fetch test data from ESGF for running diagnostic tests.
+
+    Downloads full-resolution ESGF data based on diagnostic test_data_spec.
+    Use --provider or --diagnostic to limit scope.
+
+    Examples
+    --------
+        ref test-cases fetch                   # Fetch all test data
+        ref test-cases fetch --provider ilamb  # Fetch ILAMB test data only
+        ref test-cases fetch --diagnostic ecs  # Fetch ECS diagnostic data
+        ref test-cases fetch --only-missing    # Skip test cases with existing catalogs
+    """
+    from climate_ref.provider_registry import ProviderRegistry
+    from climate_ref_core.testing import TestCasePaths
+
+    config = ctx.obj.config
+    db = ctx.obj.database
+
+    # Build provider registry to access diagnostics
+    registry = ProviderRegistry.build_from_config(config, db)
+
+    # Check if the requested provider exists in the registry
+    available_providers = [p.slug for p in registry.providers]
+    if provider and provider not in available_providers:
+        logger.error(f"Provider '{provider}' is not configured")
+        if available_providers:
+            logger.error(f"Available providers: {', '.join(sorted(available_providers))}")
+        else:
+            logger.error("No providers are configured. Check your configuration file.")
+        logger.error("To add a provider, update your config file or set REF_DIAGNOSTIC_PROVIDERS")
+        raise typer.Exit(code=1)
+
+    # Collect diagnostics to process
+    diagnostics_to_process: list[Diagnostic] = []
+
+    for provider_instance in registry.providers:
+        if provider and provider_instance.slug != provider:
+            continue
+
+        for diag in provider_instance.diagnostics():
+            if diagnostic and diag.slug != diagnostic:
+                continue
+            if diag.test_data_spec is None:
+                continue
+            diagnostics_to_process.append(diag)
+
+    if not diagnostics_to_process:
+        if provider:
+            logger.warning(f"No diagnostics with test_data_spec found for provider '{provider}'")
+        else:
+            logger.warning("No diagnostics with test_data_spec found")
+        raise typer.Exit(code=0)
+
+    logger.info(f"Found {len(diagnostics_to_process)} diagnostics with test data specifications")
+
+    if dry_run:  # pragma: no cover
+        for diag in diagnostics_to_process:
+            logger.info(f"Would fetch data for: {diag.provider.slug}/{diag.slug}")
+            if diag.test_data_spec:
+                for tc in diag.test_data_spec.test_cases:
+                    if test_case and tc.name != test_case:
+                        continue
+                    # Check if catalog exists when using --only-missing
+                    if only_missing:
+                        paths = TestCasePaths.from_diagnostic(diag, tc.name)
+                        if paths and paths.catalog.exists():
+                            logger.info(f"  Test case: {tc.name} - [SKIP: catalog exists]")
+                            continue
+                    logger.info(f"  Test case: {tc.name} - {tc.description}")
+                    if tc.requests:
+                        for req in tc.requests:
+                            logger.info(f"    Request: {req.slug} ({req.source_type})")
+        return
+
+    # Process each diagnostic test case
+    for diag in diagnostics_to_process:  # pragma: no cover
+        logger.info(f"Fetching data for: {diag.provider.slug}/{diag.slug}")
+        if diag.test_data_spec:
+            for tc in diag.test_data_spec.test_cases:
+                if test_case and tc.name != test_case:
+                    continue
+                # Skip if catalog exists when using --only-missing
+                if only_missing:
+                    paths = TestCasePaths.from_diagnostic(diag, tc.name)
+                    if paths and paths.catalog.exists():
+                        logger.info(f"  Skipping test case: {tc.name} (catalog exists)")
+                        continue
+                if tc.requests:
+                    logger.info(f"  Processing test case: {tc.name}")
+                    try:
+                        _, catalog_written = _fetch_and_build_catalog(diag, tc, force=force)
+                        if not catalog_written:
+                            logger.info(f"  Catalog unchanged for {tc.name}")
+                    except (DatasetResolutionError, ValueError) as e:
+                        logger.warning(f"  Could not build catalog for {tc.name}: {e}")
+
+
+@app.command(name="list")
+def list_cases(
+    ctx: typer.Context,
+    provider: Annotated[
+        str | None,
+        typer.Option(help="Filter by provider"),
+    ] = None,
+) -> None:
+    """
+    List test cases for all diagnostics.
+
+    Shows which test cases are defined for each diagnostic and their descriptions.
+    Also shows whether catalog and regression data exist for each test case.
+    """
+    from climate_ref.provider_registry import ProviderRegistry
+    from climate_ref_core.testing import TestCasePaths
+
+    config = ctx.obj.config
+    db = ctx.obj.database
+    console = ctx.obj.console
+
+    # Build provider registry to access diagnostics
+    registry = ProviderRegistry.build_from_config(config, db)
+
+    # Check if the requested provider exists in the registry
+    available_providers = [p.slug for p in registry.providers]
+    if provider and provider not in available_providers:
+        logger.error(f"Provider '{provider}' is not configured")
+        if available_providers:
+            logger.error(f"Available providers: {', '.join(sorted(available_providers))}")
+        else:
+            logger.error("No providers are configured. Check your configuration file.")
+        raise typer.Exit(code=1)
+
+    table = Table(title="Test Data Specifications")
+    table.add_column("Provider", style="cyan")
+    table.add_column("Diagnostic", style="green")
+    table.add_column("Test Case", style="yellow")
+    table.add_column("Description")
+    table.add_column("Requests", justify="right")
+    table.add_column("Catalog", justify="center")
+    table.add_column("Regression", justify="center")
+
+    for provider_instance in registry.providers:
+        if provider and provider_instance.slug != provider:
+            continue
+
+        for diag in provider_instance.diagnostics():
+            if diag.test_data_spec is None:
+                table.add_row(
+                    provider_instance.slug,
+                    diag.slug,
+                    "-",
+                    "(no test_data_spec)",
+                    "0",
+                    "-",
+                    "-",
+                )
+                continue
+
+            for tc in diag.test_data_spec.test_cases:
+                num_requests = len(tc.requests) if tc.requests else 0
+
+                # Check if catalog and regression data exist
+                paths = TestCasePaths.from_diagnostic(diag, tc.name)
+                if paths:
+                    catalog_status = "[green]yes[/green]" if paths.catalog.exists() else "[red]no[/red]"
+                    regression_status = "[green]yes[/green]" if paths.regression.exists() else "[red]no[/red]"
+                else:
+                    catalog_status = "[dim]-[/dim]"
+                    regression_status = "[dim]-[/dim]"
+
+                table.add_row(
+                    provider_instance.slug,
+                    diag.slug,
+                    tc.name,
+                    tc.description,
+                    str(num_requests),
+                    catalog_status,
+                    regression_status,
+                )
+
+    console.print(table)
diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases/run.py b/packages/climate-ref/src/climate_ref/cli/test_cases/run.py
new file mode 100644
index 000000000..1c55c5a52
--- /dev/null
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases/run.py
@@ -0,0 +1,426 @@
+"""
+``ref test-cases run``.
+
+Executes diagnostics for their declared test cases, writes the native into an
+output slot, rebuilds the committed bundle, and (when asked) promotes it to the
+tracked regression baseline.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+from typing import TYPE_CHECKING, Annotated
+
+import typer
+from loguru import logger
+from rich.table import Table
+
+from climate_ref.cli._git_utils import collect_regression_file_info, get_repo_for_path
+from climate_ref.cli._utils import format_size
+from climate_ref.cli.test_cases._app import app
+from climate_ref.cli.test_cases._catalog import _fetch_and_build_catalog
+from climate_ref.cli.test_cases._common import _write_test_case_manifest
+from climate_ref.cli.test_cases._stages import (
+    StageError,
+    native_is_stale,
+    prepare_slot,
+    promote_to_baseline,
+    snapshot_native,
+    stage_build,
+    stage_execute,
+    write_source_stamp,
+)
+from climate_ref.config import Config
+from climate_ref_core.exceptions import (
+    DatasetResolutionError,
+    InvalidDiagnosticException,
+    NoTestDataSpecError,
+    TestCaseNotFoundError,
+)
+
+if TYPE_CHECKING:
+    from rich.console import Console
+
+    from climate_ref_core.diagnostics import Diagnostic
+    from climate_ref_core.testing import TestCase
+
+
+def _print_regression_summary(  # pragma: no cover
+    console: Console,
+    regression_dir: Path,
+    size_threshold_mb: float = 1.0,
+) -> None:
+    """
+    Print a summary of the regression directory with file sizes and git status.
+
+    Parameters
+    ----------
+    console
+        Rich console for output
+    regression_dir
+        Path to the regression data directory
+    size_threshold_mb
+        Files larger than this (in MB) will be flagged
+    """
+    repo = get_repo_for_path(regression_dir)
+    repo_root = Path(repo.working_dir) if repo else regression_dir
+
+    threshold_bytes = int(size_threshold_mb * 1024 * 1024)
+    file_info = collect_regression_file_info(regression_dir, repo, threshold_bytes)
+
+    if not file_info:
+        console.print("[yellow]No files in regression directory[/yellow]")
+        return
+
+    total_size = sum(f["size"] for f in file_info)
+    large_files = sum(1 for f in file_info if f["is_large"])
+
+    table = Table(title=f"Regression Data: {regression_dir.relative_to(repo_root)}")
+    table.add_column("File", style="cyan", no_wrap=False)
+    table.add_column("Size", justify="right")
+    table.add_column("Git Status", justify="center")
+
+    for info in file_info:
+        # Format size with color
+        size_str = format_size(info["size"])
+        if info["is_large"]:
+            size_str = f"[bold red]{size_str}[/bold red]"
+
+        # Get git status with color
+        git_status = info["git_status"]
+        status_colors = {
+            "new": "[green]new[/green]",
+            "staged": "[green]staged[/green]",
+            "modified": "[yellow]modified[/yellow]",
+            "tracked": "[dim]tracked[/dim]",
+            "untracked": "[red]untracked[/red]",
+            "deleted": "[red]deleted[/red]",
+            "unknown": "[dim]?[/dim]",
+        }
+        git_status_str = status_colors.get(git_status, f"[dim]{git_status}[/dim]")
+
+        table.add_row(info["rel_path"], size_str, git_status_str)
+
+    console.print(table)
+
+    # Summary line
+    summary = f"\n[bold]Total:[/bold] {len(file_info)} files, {format_size(total_size)}"
+    if large_files > 0:
+        summary += f" ([red]{large_files} files > {size_threshold_mb} MB[/red])"
+    console.print(summary)
+
+
+def _run_single_test_case(  # noqa: PLR0911, PLR0912, PLR0913, PLR0915
+    config: Config,
+    console: Console,
+    diag: Diagnostic,
+    tc: TestCase,
+    *,
+    execution_dir: Path | None,
+    force_regen: bool,
+    fetch: bool,
+    size_threshold: float,
+    clean: bool,
+    label: str,
+) -> bool:
+    """
+    Run a single test case for a diagnostic, writing its native into an output slot.
+
+    Always (re)populates ``output/<label>/`` with the executed native set and its rebuilt
+    committed bundle. The tracked ``regression/`` baseline is only updated ("promoted") when
+    ``--force-regen`` is given or no baseline exists yet, so a labelled run never silently
+    clobbers a committed baseline.
+
+    Returns True if successful, False otherwise.
+    """
+    from climate_ref_core.regression.manifest import Manifest
+    from climate_ref_core.testing import TestCasePaths, load_datasets_from_yaml
+
+    provider_slug = diag.provider.slug
+    diagnostic_slug = diag.slug
+    test_case_name = tc.name
+    case_id = f"{provider_slug}/{diagnostic_slug}/{test_case_name}"
+
+    # Resolve datasets: either fetch from ESGF or load from the pre-built catalog.
+    if fetch:
+        logger.info(f"Fetching test data for {case_id}")
+        try:
+            datasets, _ = _fetch_and_build_catalog(diag, tc)
+        except (DatasetResolutionError, InvalidDiagnosticException) as e:
+            logger.exception(f"Failed to fetch data for {case_id}: {e}")
+            return False
+
+    paths = TestCasePaths.from_diagnostic(diag, test_case_name)
+    if paths is None:
+        logger.error(f"Could not determine test data directory for {provider_slug}/{diagnostic_slug}")
+        return False
+
+    if not fetch:
+        if not paths.catalog.exists():
+            logger.error(f"No catalog file found for {case_id}")
+            logger.error("Run 'ref test-cases fetch' first or use --fetch flag")
+            return False
+        logger.info(f"Loading catalog from {paths.catalog}")
+        datasets = load_datasets_from_yaml(paths.catalog)
+
+    paths.create()
+    slot = prepare_slot(paths, label)
+    logger.info(f"Running test case {test_case_name!r} for {provider_slug}/{diagnostic_slug}")
+    try:
+        source = stage_execute(
+            config=config,
+            diag=diag,
+            tc=tc,
+            datasets=datasets,
+            slot=slot,
+            execution_dir=execution_dir,
+            clean=clean,
+        )
+    except NoTestDataSpecError:
+        logger.error(f"Diagnostic {provider_slug}/{diagnostic_slug} has no test_data_spec")
+        return False
+    except TestCaseNotFoundError:
+        logger.error(f"Test case {test_case_name!r} not found for {provider_slug}/{diagnostic_slug}")
+        if diag.test_data_spec:
+            logger.error(f"Available test cases: {diag.test_data_spec.case_names}")
+        return False
+    except DatasetResolutionError as e:
+        logger.error(str(e))
+        logger.error("Have you run 'ref test-cases fetch' first?")
+        return False
+    except StageError:
+        logger.error(f"Execution failed: {case_id}")
+        return False
+    except Exception as e:
+        logger.error(f"Diagnostic execution failed for {case_id}: {e!s}")
+        return False
+
+    result = source.result
+    logger.info(f"Execution completed: {case_id}")
+    if result.metric_bundle_filename:
+        logger.info(f"Metric bundle: {result.to_output_path(result.metric_bundle_filename)}")
+    if result.output_bundle_filename:
+        logger.info(f"Output bundle: {result.to_output_path(result.output_bundle_filename)}")
+
+    # Rebuild the slot's committed bundle, then decide whether to promote it to the
+    # tracked baseline. The native block is mint-owned, so a run preserves the previous
+    # one (or seeds an empty set) and never authors native here.
+    committed = stage_build(slot=slot, source=source, paths=paths)
+    previous = Manifest.load(paths.manifest) if paths.manifest.exists() else None
+    version = previous.test_case_version if previous else 1
+
+    if force_regen or not paths.regression.exists():
+        promote_to_baseline(slot, paths)
+        native = snapshot_native(slot)
+        if previous is not None:
+            _write_test_case_manifest(
+                paths,
+                test_case_version=previous.test_case_version,
+                committed=committed,
+                native=previous.native,
+                schema=previous.schema,
+            )
+            if native_is_stale(native, previous.native):
+                logger.warning(
+                    f"{case_id}: committed bundle regenerated but the native baseline differs; "
+                    "re-mint with `ref test-cases mint` (or `mint --from-replay`)"
+                )
+        else:
+            _write_test_case_manifest(paths, test_case_version=1, committed=committed, native={})
+        logger.info(f"Updated regression baseline: {paths.regression}")
+        _print_regression_summary(console, paths.regression, size_threshold)
+    else:
+        logger.info(
+            f"Wrote output slot {slot} (committed baseline unchanged; use --force-regen to update it)"
+        )
+
+    write_source_stamp(slot, label=label, verb="run", source="execute", test_case_version=version)
+    return True
+
+
+@app.command(name="run")
+def run_test_case(  # noqa: PLR0912, PLR0913, PLR0915
+    ctx: typer.Context,
+    provider: Annotated[
+        str,
+        typer.Option(help="Provider slug (required, e.g., 'example', 'ilamb')"),
+    ],
+    diagnostic: Annotated[
+        str | None,
+        typer.Option(help="Specific diagnostic slug to run (e.g., 'global-mean-timeseries')"),
+    ] = None,
+    test_case: Annotated[
+        str | None,
+        typer.Option(help="Specific test case name to run (e.g., 'default')"),
+    ] = None,
+    output_directory: Annotated[
+        Path | None,
+        typer.Option(help="Output directory for execution results"),
+    ] = None,
+    force_regen: Annotated[
+        bool,
+        typer.Option(help="Force regeneration of regression baselines"),
+    ] = False,
+    fetch: Annotated[
+        bool,
+        typer.Option(help="Fetch test data from ESGF before running"),
+    ] = False,
+    size_threshold: Annotated[
+        float,
+        typer.Option(help="Flag files larger than this size in MB (default: 1.0)"),
+    ] = 1.0,
+    dry_run: Annotated[
+        bool,
+        typer.Option(help="Show what would be run without executing"),
+    ] = False,
+    only_missing: Annotated[
+        bool,
+        typer.Option(help="Only run test cases without existing regression data"),
+    ] = False,
+    if_changed: Annotated[
+        bool,
+        typer.Option(help="Only run if catalog has changed since regression data was generated"),
+    ] = False,
+    clean: Annotated[
+        bool,
+        typer.Option(help="Delete existing output directory before running"),
+    ] = False,
+    label: Annotated[
+        str,
+        typer.Option(help="Output slot name under output/ (default: latest)"),
+    ] = "latest",
+) -> None:
+    """
+    Run test cases for diagnostics.
+
+    Executes diagnostics using pre-defined datasets from the test_data_spec
+    and optionally compares against regression baselines.
+
+    Use --provider to select which provider's diagnostics to run (required).
+    Use --diagnostic and --test-case to further narrow the scope.
+
+    Examples
+    --------
+        ref test-cases run --provider ilamb              # Run all ILAMB test cases
+        ref test-cases run --provider example --diagnostic global-mean-timeseries
+        ref test-cases run --provider ilamb --test-case default --fetch
+        ref test-cases run --provider pmp --only-missing # Skip test cases with regression data
+        ref test-cases run --provider pmp --if-changed   # Only run if catalog changed
+    """
+    from climate_ref.provider_registry import ProviderRegistry
+    from climate_ref_core.testing import (
+        TestCasePaths,
+        catalog_changed_since_regression,
+    )
+
+    config: Config = ctx.obj.config
+    db = ctx.obj.database
+    console: Console = ctx.obj.console
+
+    # Build provider registry
+    registry = ProviderRegistry.build_from_config(config, db)
+
+    # Find the provider
+    provider_instance = None
+    for p in registry.providers:
+        if p.slug == provider:
+            provider_instance = p
+            break
+
+    if provider_instance is None:
+        logger.error(f"Provider '{provider}' not found")
+        available = [p.slug for p in registry.providers]
+        logger.error(f"Available providers: {available}")
+        raise typer.Exit(code=1)
+
+    # Collect test cases to run
+    test_cases_to_run: list[tuple[Diagnostic, TestCase]] = []
+    skipped_cases: list[tuple[Diagnostic, TestCase]] = []
+
+    for diag in provider_instance.diagnostics():
+        if diagnostic and diag.slug != diagnostic:
+            continue
+        if diag.test_data_spec is None:
+            continue
+
+        for tc in diag.test_data_spec.test_cases:
+            if test_case and tc.name != test_case:
+                continue
+            # Skip if regression exists when using --only-missing
+            paths = TestCasePaths.from_diagnostic(diag, tc.name)
+            if only_missing:
+                if paths and paths.regression.exists():
+                    skipped_cases.append((diag, tc))
+                    continue
+            # Skip if catalog hasn't changed when using --if-changed
+            if if_changed:
+                if paths and not catalog_changed_since_regression(paths):
+                    skipped_cases.append((diag, tc))
+                    continue
+            test_cases_to_run.append((diag, tc))
+
+    if not test_cases_to_run:
+        logger.warning(f"No test cases found for provider '{provider}'")
+        if diagnostic:
+            logger.warning(f"  with diagnostic filter: {diagnostic}")
+        if test_case:
+            logger.warning(f"  with test case filter: {test_case}")
+        if only_missing and skipped_cases:
+            logger.info(f"  ({len(skipped_cases)} test case(s) skipped due to --only-missing)")
+        raise typer.Exit(code=0)
+
+    logger.info(f"Found {len(test_cases_to_run)} test case(s) to run")
+    if skipped_cases:
+        logger.info(f"Skipping {len(skipped_cases)} test case(s) with existing regression data")
+
+    if dry_run:  # pragma: no cover
+        table = Table(title="Test Cases to Run")
+        table.add_column("Provider", style="cyan")
+        table.add_column("Diagnostic", style="green")
+        table.add_column("Test Case", style="yellow")
+        table.add_column("Description")
+        table.add_column("Status", justify="center")
+
+        for diag, tc in test_cases_to_run:
+            table.add_row(provider, diag.slug, tc.name, tc.description, "[green]will run[/green]")
+
+        for diag, tc in skipped_cases:
+            table.add_row(provider, diag.slug, tc.name, tc.description, "[dim]skip (regression exists)[/dim]")
+
+        console.print(table)
+        return
+
+    # Run each test case
+    successes = 0
+    failures = 0
+    failed_cases: list[str] = []
+
+    for diag, tc in test_cases_to_run:
+        success = _run_single_test_case(
+            config=config,
+            console=console,
+            diag=diag,
+            tc=tc,
+            execution_dir=output_directory,
+            force_regen=force_regen,
+            fetch=fetch,
+            size_threshold=size_threshold,
+            clean=clean,
+            label=label,
+        )
+        if success:
+            successes += 1
+        else:
+            failures += 1
+            failed_cases.append(f"{provider}/{diag.slug}/{tc.name}")
+
+    # Print summary
+    console.print()
+    if failures == 0:
+        console.print(f"[green]All {successes} test case(s) passed[/green]")
+    else:
+        console.print(f"[yellow]Results: {successes} passed, {failures} failed[/yellow]")
+        console.print("[red]Failed test cases:[/red]")
+        for case in failed_cases:
+            console.print(f"  - {case}")
+        raise typer.Exit(code=1)
diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases/store.py b/packages/climate-ref/src/climate_ref/cli/test_cases/store.py
new file mode 100644
index 000000000..7d468576a
--- /dev/null
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases/store.py
@@ -0,0 +1,143 @@
+"""
+Native-store commands: ``ref test-cases sync`` and ``ref test-cases check-store``.
+
+``sync`` warms the local cache with the native blobs referenced by committed
+manifests; ``check-store`` preflights the writable store's credentials before a
+mint.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+from typing import TYPE_CHECKING, Annotated
+
+import typer
+from loguru import logger
+
+from climate_ref.cli.test_cases._app import app
+from climate_ref.cli.test_cases._common import _iter_test_cases
+from climate_ref.config import Config
+
+if TYPE_CHECKING:
+    from rich.console import Console
+
+
+@app.command(name="sync")
+def sync_native(
+    ctx: typer.Context,
+    provider: Annotated[
+        str | None,
+        typer.Option(help="Limit sync to a single provider slug"),
+    ] = None,
+    diagnostic: Annotated[
+        str | None,
+        typer.Option(help="Limit sync to a single diagnostic slug"),
+    ] = None,
+    test_case: Annotated[
+        str | None,
+        typer.Option(help="Limit sync to a single test case name"),
+    ] = None,
+) -> None:
+    """
+    Fetch native baseline blobs referenced by committed manifests into the store cache.
+
+    Reads each committed ``manifest.json``'s ``native`` block
+    and ensures every referenced blob is present in the read store (public, credential-free).
+    Blobs already cached are skipped (idempotent).
+    A referenced digest the store cannot serve is a hard failure.
+
+    Examples
+    --------
+        ref test-cases sync                  # Sync all providers
+        ref test-cases sync --provider ilamb # Sync a single provider
+    """
+    import tempfile
+
+    from climate_ref.provider_registry import ProviderRegistry
+    from climate_ref_core.regression.manifest import Manifest
+    from climate_ref_core.regression.store import build_native_store
+    from climate_ref_core.testing import TestCasePaths
+
+    config: Config = ctx.obj.config
+    db = ctx.obj.database
+    console: Console = ctx.obj.console
+
+    registry = ProviderRegistry.build_from_config(config, db)
+    store = build_native_store(config.native_store, writable=False)
+
+    # When a specific case is named, a missing manifest is a hard failure.
+    named = bool(diagnostic or test_case)
+
+    fetched = 0
+    skipped = 0
+    failures: list[str] = []
+
+    for diag, tc in _iter_test_cases(registry, provider=provider, diagnostic=diagnostic, test_case=test_case):
+        case_id = f"{diag.provider.slug}/{diag.slug}/{tc.name}"
+        paths = TestCasePaths.from_diagnostic(diag, tc.name)
+        if paths is None or not paths.manifest.exists():
+            if named:
+                logger.error(f"No manifest.json for {case_id}; run `ref test-cases mint` first")
+                failures.append(case_id)
+            continue
+        manifest = Manifest.load(paths.manifest)
+        for relpath, entry in manifest.native.items():
+            if store.has(entry.sha256):
+                skipped += 1
+                continue
+            with tempfile.TemporaryDirectory() as tmp:
+                try:
+                    store.fetch(entry.sha256, Path(tmp) / "blob")
+                except Exception as exc:
+                    failures.append(f"{case_id}: cannot serve native blob {entry.sha256} ({relpath}): {exc}")
+                    continue
+            fetched += 1
+
+    console.print(f"[green]Synced native blobs:[/green] {fetched} fetched, {skipped} already cached")
+    if failures:
+        console.print("[red]Failed to fetch referenced native blobs:[/red]")
+        for failure in failures:
+            console.print(f"  - {failure}")
+        raise typer.Exit(code=1)
+
+
+@app.command(name="check-store")
+def check_store(
+    ctx: typer.Context,
+) -> None:
+    """
+    Check connectivity and credentials for the writable native baseline store.
+
+    Builds the writable store from the configuration and preflights it (an authenticated
+    no-op probe) without running any diagnostics or uploading anything. Use this to confirm a
+    mint will work — that the credentials (REF_NATIVE_STORE_PROFILE or the access-key env
+    vars) and the bucket are correct — before a slow mint run.
+
+    Examples
+    --------
+        ref test-cases check-store
+        REF_NATIVE_STORE_PROFILE=my-profile ref test-cases check-store
+    """
+    from climate_ref_core.regression.store import NativeStoreUnavailableError, build_native_store
+
+    config: Config = ctx.obj.config
+    console: Console = ctx.obj.console
+
+    try:
+        store = build_native_store(config.native_store, writable=True)
+    except (NotImplementedError, ValueError) as exc:
+        logger.error(
+            "Native store is not configured for writing. For the remote (R2) store set "
+            "REF_NATIVE_STORE_S3_ENDPOINT_URL and REF_NATIVE_STORE_BUCKET, and authenticate via "
+            "REF_NATIVE_STORE_ACCESS_KEY_ID / REF_NATIVE_STORE_SECRET_ACCESS_KEY or a named "
+            f"REF_NATIVE_STORE_PROFILE; or set REF_NATIVE_STORE_URL to a local file:// path: {exc}"
+        )
+        raise typer.Exit(code=1) from exc
+
+    try:
+        store.preflight()
+    except NativeStoreUnavailableError as exc:
+        logger.error(str(exc))
+        raise typer.Exit(code=1) from exc
+
+    console.print("[green]Native store OK:[/green] credentials accepted and the store is reachable.")
diff --git a/packages/climate-ref/tests/unit/cli/test_test_cases.py b/packages/climate-ref/tests/unit/cli/test_test_cases.py
index 2b78cecf9..9067af543 100644
--- a/packages/climate-ref/tests/unit/cli/test_test_cases.py
+++ b/packages/climate-ref/tests/unit/cli/test_test_cases.py
@@ -174,7 +174,7 @@ def test_cmip6_data_returned(self, mock_diagnostic, mock_test_case, mock_fetcher
             patch("climate_ref_core.esgf.ESGFFetcher", return_value=mock_fetcher),
             patch("climate_ref.datasets.CMIP6DatasetAdapter", return_value=mock_adapter),
             patch(
-                "climate_ref.cli.test_cases._solve_test_case",
+                "climate_ref.cli.test_cases._catalog._solve_test_case",
                 return_value=mock_datasets,
             ),
             patch(
@@ -199,7 +199,7 @@ def test_saves_catalog_yaml(self, tmp_path, mock_diagnostic, mock_test_case, moc
             patch("climate_ref_core.esgf.ESGFFetcher", return_value=mock_fetcher),
             patch("climate_ref.datasets.CMIP6DatasetAdapter", return_value=mock_adapter),
             patch(
-                "climate_ref.cli.test_cases._solve_test_case",
+                "climate_ref.cli.test_cases._catalog._solve_test_case",
                 return_value=mock_datasets,
             ),
             patch(
@@ -240,7 +240,7 @@ def test_obs4mips_data_returned(self, mock_diagnostic, mock_test_case):
             patch("climate_ref_core.esgf.ESGFFetcher", return_value=mock_fetcher),
             patch("climate_ref.datasets.Obs4MIPsDatasetAdapter", return_value=mock_adapter),
             patch(
-                "climate_ref.cli.test_cases._solve_test_case",
+                "climate_ref.cli.test_cases._catalog._solve_test_case",
                 return_value=mock_datasets,
             ),
             patch(
@@ -377,7 +377,7 @@ def test_fetch_continues_on_test_case_failure(self, invoke_cli, mocker, exceptio
         )
 
         fetch_mock = mocker.patch(
-            "climate_ref.cli.test_cases._fetch_and_build_catalog",
+            "climate_ref.cli.test_cases.discovery._fetch_and_build_catalog",
             side_effect=[exception, (MagicMock(), True)],
         )
 
@@ -573,7 +573,7 @@ def test_run_with_fetch_flag_raises_error(self, invoke_cli, mocker):
             return_value=mock_registry,
         )
         mocker.patch(
-            "climate_ref.cli.test_cases._fetch_and_build_catalog",
+            "climate_ref.cli.test_cases.run._fetch_and_build_catalog",
             side_effect=DatasetResolutionError("No datasets found"),
         )
 
@@ -903,7 +903,7 @@ def test_cmip7_data_returned(self, mock_diagnostic, mock_test_case):
             patch("climate_ref_core.esgf.ESGFFetcher", return_value=mock_fetcher),
             patch("climate_ref.datasets.CMIP7DatasetAdapter", return_value=mock_adapter),
             patch(
-                "climate_ref.cli.test_cases._solve_test_case",
+                "climate_ref.cli.test_cases._catalog._solve_test_case",
                 return_value=mock_datasets,
             ),
             patch(
@@ -945,7 +945,7 @@ def test_pmp_climatology_data_returned(self, mock_diagnostic, mock_test_case):
                 return_value=mock_adapter,
             ),
             patch(
-                "climate_ref.cli.test_cases._solve_test_case",
+                "climate_ref.cli.test_cases._catalog._solve_test_case",
                 return_value=mock_datasets,
             ),
             patch(
@@ -986,7 +986,7 @@ def test_force_flag_passed_to_save(self, tmp_path, mock_diagnostic, mock_test_ca
             patch("climate_ref_core.esgf.ESGFFetcher", return_value=mock_fetcher),
             patch("climate_ref.datasets.CMIP6DatasetAdapter", return_value=mock_adapter),
             patch(
-                "climate_ref.cli.test_cases._solve_test_case",
+                "climate_ref.cli.test_cases._catalog._solve_test_case",
                 return_value=mock_datasets,
             ),
             patch(
@@ -1041,7 +1041,7 @@ def test_mixed_source_types(self, mock_diagnostic, mock_test_case):
                 return_value=mock_obs_adapter,
             ),
             patch(
-                "climate_ref.cli.test_cases._solve_test_case",
+                "climate_ref.cli.test_cases._catalog._solve_test_case",
                 return_value=mock_datasets,
             ),
             patch(
@@ -1301,7 +1301,7 @@ def _setup_real_run(mocker, tmp_path, *, runner_result="success", regression_fil
     mocker.patch("climate_ref_core.testing.get_catalog_hash", return_value="abc123")
     if fetch:
         mocker.patch(
-            "climate_ref.cli.test_cases._fetch_and_build_catalog",
+            "climate_ref.cli.test_cases.run._fetch_and_build_catalog",
             return_value=(MagicMock(), True),
         )
 
@@ -1505,10 +1505,10 @@ def test_replay_reconciles_integrity_mismatch_within_tolerance(self, invoke_cli,
         mocker.patch("climate_ref_core.regression.store.build_native_store", return_value=store)
         # Stub the slot stages so we deterministically reach the success branch: materialise +
         # rebuild, committed-bundle build, and the tolerant comparison (no drift, 3 files compared).
-        mocker.patch("climate_ref.cli.test_cases.stage_materialise")
-        mocker.patch("climate_ref.cli.test_cases.stage_build")
+        mocker.patch("climate_ref.cli.test_cases.baselines.stage_materialise")
+        mocker.patch("climate_ref.cli.test_cases.baselines.stage_build")
         mocker.patch(
-            "climate_ref.cli.test_cases.stage_compare",
+            "climate_ref.cli.test_cases.baselines.stage_compare",
             return_value=([], ["series.json", "diagnostic.json", "output.json"]),
         )
 
@@ -1904,7 +1904,7 @@ def _setup(
             return_value=mock_registry,
         )
         mocker.patch("climate_ref_core.testing.TestCasePaths.from_diagnostic", return_value=paths)
-        mocker.patch("climate_ref.cli.test_cases.get_repo_for_path", return_value=repo)
+        mocker.patch("climate_ref.cli.test_cases.ci_gate.get_repo_for_path", return_value=repo)
         return repo, paths, committed_digests
 
     @staticmethod
@@ -2034,7 +2034,7 @@ def test_never_managed_skips(self, invoke_cli, mocker, tmp_path):
 
     def test_not_in_repo_fails(self, invoke_cli, mocker, tmp_path):
         self._setup(mocker, tmp_path, current_version=1)
-        mocker.patch("climate_ref.cli.test_cases.get_repo_for_path", return_value=None)
+        mocker.patch("climate_ref.cli.test_cases.ci_gate.get_repo_for_path", return_value=None)
 
         result = invoke_cli(["test-cases", "ci-gate"], expected_exit_code=1)
         assert result.exit_code == 1

From f76f33adafc5318848fd8da9da64d85b9447a8dc Mon Sep 17 00:00:00 2001
From: Jared Lewis <jared@jared.kiwi.nz>
Date: Sun, 21 Jun 2026 21:52:44 +1000
Subject: [PATCH 03/12] docs(changelog): add news fragments for #748

Record the output-slots feature and the test_cases CLI package split.
---
 changelog/748.feature.md | 6 ++++++
 changelog/748.trivial.md | 3 +++
 2 files changed, 9 insertions(+)
 create mode 100644 changelog/748.feature.md
 create mode 100644 changelog/748.trivial.md

diff --git a/changelog/748.feature.md b/changelog/748.feature.md
new file mode 100644
index 000000000..2565338f6
--- /dev/null
+++ b/changelog/748.feature.md
@@ -0,0 +1,6 @@
+`ref test-cases` runs now materialise their outputs into an inspectable, gitignored output slot
+(`<case>/output/<label>/`) holding the curated native files, the rebuilt committed bundle, and a source stamp,
+so you can see and diff exactly what a run produced.
+Added a `build` verb that rebuilds the committed bundle from an existing slot without re-executing the diagnostic,
+a `mint --from-replay` option that re-authors a baseline from the stored native instead of re-running it,
+and a `--label` option that keeps several runs side by side for comparison.
diff --git a/changelog/748.trivial.md b/changelog/748.trivial.md
new file mode 100644
index 000000000..414dc67f2
--- /dev/null
+++ b/changelog/748.trivial.md
@@ -0,0 +1,3 @@
+Reorganised the `ref test-cases` CLI into a package split by concern
+(discovery, run, baseline lifecycle, store, and the CI gate),
+with no change to the commands or their behaviour.

From c20009203f384dfe8f3c6ac6b453ce1a8fbb94ee Mon Sep 17 00:00:00 2001
From: Jared Lewis <jared@jared.kiwi.nz>
Date: Sun, 21 Jun 2026 22:46:05 +1000
Subject: [PATCH 04/12] fix(test-cases): harden replay comparison and
 from-replay native authoring

Two correctness fixes in the regression replay/mint machinery surfaced by an
adversarial review:

- stage_compare now drives the committed-bundle comparison from the manifest's
  committed set and hard-fails when an expected file is missing from the tracked
  baseline or from the regenerated bundle (or when there is nothing to compare).
  It previously derived the set from whatever existed under regression/, so a
  missing baseline let a replay report success without verifying anything.

- mint --from-replay now preserves the previously minted native block verbatim
  instead of snapshotting the slot. stage_materialise hydrates the slot's native
  in place while rebuilding, so a fresh snapshot would re-author the manifest
  with non-portable, slot-specific blobs even though the canonical native
  baseline is unchanged.

Adds stage_compare unit tests and a from-replay native-preservation test.
---
 .../src/climate_ref/cli/test_cases/_stages.py |  37 +++++-
 .../climate_ref/cli/test_cases/baselines.py   |  14 +-
 .../tests/unit/cli/test_test_cases.py         | 124 ++++++++++++++++++
 3 files changed, 167 insertions(+), 8 deletions(-)

diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases/_stages.py b/packages/climate-ref/src/climate_ref/cli/test_cases/_stages.py
index bbb34a706..d829a5cce 100644
--- a/packages/climate-ref/src/climate_ref/cli/test_cases/_stages.py
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases/_stages.py
@@ -40,6 +40,8 @@
 from climate_ref_core.testing import TestCasePaths, load_datasets_from_yaml
 
 if TYPE_CHECKING:
+    from collections.abc import Iterable
+
     from climate_ref.config import Config
     from climate_ref_core.datasets import ExecutionDatasetCollection
     from climate_ref_core.diagnostics import Diagnostic, ExecutionResult
@@ -238,27 +240,50 @@ def stage_upload(
     return errors
 
 
-def stage_compare(*, slot: Path, paths: TestCasePaths, slug: str) -> tuple[list[str], list[str]]:
+def stage_compare(
+    *, slot: Path, paths: TestCasePaths, slug: str, expected: Iterable[str]
+) -> tuple[list[str], list[str]]:
     """
     Compare a slot's rebuilt bundle against the tracked committed baseline.
 
+    ``expected`` is the committed bundle's source of truth -- the filenames the manifest
+    records under ``committed``. Every expected file must be present both in the tracked
+    ``regression/`` baseline and in the slot's regenerated bundle, and must match within
+    tolerance; a file missing on either side, or an empty expected set, is a hard failure.
+    Driving the comparison from the manifest (rather than from whatever happens to exist on
+    disk) stops a replay reporting success when the committed baseline is absent or incomplete.
+
     Both sides are already placeholder-sanitised, so no replacements are needed.
-    Returns ``(failures, compared)`` -- the drift messages and the filenames compared.
+    Returns ``(failures, compared)`` -- the drift/missing messages and the filenames compared.
     """
     slot_regression = slot / SLOT_REGRESSION_DIRNAME
-    compared = [f for f in COMMITTED_BUNDLE_FILES if (paths.regression / f).exists()]
+    expected_files = list(expected)
+    if not expected_files:
+        return ["manifest records no committed bundle to compare against"], []
+
     failures: list[str] = []
-    for filename in compared:
+    compared: list[str] = []
+    for filename in expected_files:
+        baseline = paths.regression / filename
+        regenerated = slot_regression / filename
+        if not baseline.exists():
+            failures.append(f"committed baseline file missing from regression/: {filename}")
+            continue
+        if not regenerated.exists():
+            failures.append(f"rebuilt bundle did not regenerate committed file: {filename}")
+            continue
         try:
             assert_bundle_regression(
-                paths.regression / filename,
-                slot_regression / filename,
+                baseline,
+                regenerated,
                 slug=slug,
                 tol=Tolerance(),
                 replacements={},
             )
         except AssertionError as exc:
             failures.append(str(exc))
+        else:
+            compared.append(filename)
     return failures, compared
 
 
diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases/baselines.py b/packages/climate-ref/src/climate_ref/cli/test_cases/baselines.py
index 0818bcc63..ccc6e70d1 100644
--- a/packages/climate-ref/src/climate_ref/cli/test_cases/baselines.py
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases/baselines.py
@@ -146,7 +146,9 @@ def replay_test_case(  # noqa: PLR0912, PLR0915
             continue
 
         stage_build(slot=slot, source=source, paths=paths)
-        cmp_failures, compared = stage_compare(slot=slot, paths=paths, slug=diag.slug)
+        cmp_failures, compared = stage_compare(
+            slot=slot, paths=paths, slug=diag.slug, expected=manifest.committed
+        )
         write_source_stamp(
             slot,
             label=label,
@@ -333,7 +335,15 @@ def mint_native(  # noqa: PLR0912, PLR0913, PLR0915
             continue
 
         committed = stage_build(slot=slot, source=source, paths=paths)
-        native = snapshot_native(slot)
+        if from_replay and previous is not None:
+            # --from-replay reuses the already-minted native verbatim: stage_materialise hydrated
+            # the slot's copy in place (placeholders -> concrete paths) while rebuilding, so a fresh
+            # snapshot would re-author manifest.native with non-portable, slot-specific blobs even
+            # though the canonical native baseline is unchanged. Preserve it -- only the committed
+            # bundle is re-derived here -- which also makes the upload below a verified no-op.
+            native = previous.native
+        else:
+            native = snapshot_native(slot)
         errors = stage_upload(
             slot=slot, native=native, store=store, previous=(previous.native if previous else {})
         )
diff --git a/packages/climate-ref/tests/unit/cli/test_test_cases.py b/packages/climate-ref/tests/unit/cli/test_test_cases.py
index 9067af543..ece4c764b 100644
--- a/packages/climate-ref/tests/unit/cli/test_test_cases.py
+++ b/packages/climate-ref/tests/unit/cli/test_test_cases.py
@@ -1376,6 +1376,71 @@ def test_sync_hard_fails_on_unservable_blob(self, invoke_cli, mocker, tmp_path):
         invoke_cli(["test-cases", "sync", "--provider", "example"], expected_exit_code=1)
 
 
+class TestStageCompare:
+    """`stage_compare` drives replay verification from the manifest's committed set."""
+
+    @staticmethod
+    def _paths_and_slot(tmp_path):
+        from climate_ref_core.testing import TestCasePaths
+
+        case_dir = tmp_path / "td" / "test-diag" / "default"
+        case_dir.mkdir(parents=True)
+        paths = TestCasePaths(root=case_dir)
+        paths.regression.mkdir(parents=True)
+        slot = tmp_path / "slot"
+        (slot / "regression").mkdir(parents=True)
+        return paths, slot
+
+    def test_missing_baseline_is_hard_failure(self, tmp_path):
+        """A committed file the manifest expects but that is absent from regression/ fails the replay."""
+        from climate_ref.cli.test_cases._stages import stage_compare
+
+        paths, slot = self._paths_and_slot(tmp_path)
+        # The rebuild produced a bundle, but the tracked baseline is missing entirely.
+        (slot / "regression" / "diagnostic.json").write_text("{}")
+
+        failures, compared = stage_compare(slot=slot, paths=paths, slug="x", expected=["diagnostic.json"])
+        assert compared == []
+        assert any("baseline file missing" in f for f in failures)
+
+    def test_missing_regenerated_is_hard_failure(self, tmp_path):
+        """A committed file present in the baseline but not regenerated by the rebuild fails the replay."""
+        from climate_ref.cli.test_cases._stages import stage_compare
+
+        paths, slot = self._paths_and_slot(tmp_path)
+        (paths.regression / "diagnostic.json").write_text("{}")
+
+        failures, compared = stage_compare(slot=slot, paths=paths, slug="x", expected=["diagnostic.json"])
+        assert compared == []
+        assert any("did not regenerate" in f for f in failures)
+
+    def test_empty_expected_is_hard_failure(self, tmp_path):
+        """A replay that would compare nothing must fail rather than report a green match."""
+        from climate_ref.cli.test_cases._stages import stage_compare
+
+        paths, slot = self._paths_and_slot(tmp_path)
+        failures, compared = stage_compare(slot=slot, paths=paths, slug="x", expected=[])
+        assert compared == []
+        assert failures and "no committed bundle" in failures[0]
+
+    def test_present_on_both_sides_is_compared(self, tmp_path, mocker):
+        """When both sides hold the expected file, it is compared (and reported as compared)."""
+        from climate_ref.cli.test_cases import _stages
+
+        paths, slot = self._paths_and_slot(tmp_path)
+        (paths.regression / "diagnostic.json").write_text("{}")
+        (slot / "regression" / "diagnostic.json").write_text("{}")
+        # Isolate from CMEC bundle parsing: a no-op comparator stands in for "no drift".
+        assert_mock = mocker.patch.object(_stages, "assert_bundle_regression")
+
+        failures, compared = _stages.stage_compare(
+            slot=slot, paths=paths, slug="x", expected=["diagnostic.json"]
+        )
+        assert failures == []
+        assert compared == ["diagnostic.json"]
+        assert_mock.assert_called_once()
+
+
 class TestReplayCommand:
     """Tests for the `test-cases replay` CLI verb."""
 
@@ -1707,6 +1772,65 @@ def test_mint_from_replay_reauthors_without_reexecuting(self, invoke_cli, mocker
         assert stamp["verb"] == "mint"
         assert stamp["source"] == "materialise"
 
+    def test_mint_from_replay_preserves_stored_native(self, invoke_cli, mocker, tmp_path):
+        """`mint --from-replay` keeps the stored native verbatim even if the rebuilt slot drifts.
+
+        stage_materialise hydrates the slot's native in place (placeholders -> concrete paths) while
+        rebuilding, so snapshotting the slot can capture non-portable, slot-specific blobs. The minted
+        manifest must preserve the previously stored native rather than re-author it from that drift.
+        """
+        from climate_ref_core.regression.manifest import Manifest, NativeEntry
+        from climate_ref_core.testing import TestCasePaths
+
+        registry, _diag, _tc = _make_case_mocks()
+
+        case_dir = tmp_path / "td" / "test-diag" / "default"
+        case_dir.mkdir(parents=True)
+        (case_dir / "catalog.yaml").touch()
+        paths = TestCasePaths(root=case_dir)
+        stored_native = {"output.json": NativeEntry(sha256="aa" * 32, size=10)}
+        Manifest(
+            schema=1,
+            test_case_version=1,
+            committed={"diagnostic.json": "00" * 32},
+            native=stored_native,
+        ).dump(paths.manifest)
+
+        store = MagicMock()  # preflight passes; has() True so the (no-op) upload skips
+        store.has.return_value = True
+        mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=registry,
+        )
+        mocker.patch("climate_ref_core.testing.TestCasePaths.from_diagnostic", return_value=paths)
+        mocker.patch("climate_ref_core.testing.get_catalog_hash", return_value=None)
+        mocker.patch("climate_ref_core.regression.store.build_native_store", return_value=store)
+
+        # Heavy stages stubbed; the rebuild "mutates" the slot so a fresh snapshot would drift.
+        mocker.patch("climate_ref.cli.test_cases.baselines.stage_materialise")
+        mocker.patch(
+            "climate_ref.cli.test_cases.baselines.stage_build",
+            return_value={"diagnostic.json": "11" * 32},
+        )
+        snapshot = mocker.patch(
+            "climate_ref.cli.test_cases.baselines.snapshot_native",
+            return_value={"output.json": NativeEntry(sha256="bb" * 32, size=20)},
+        )
+        mocker.patch("climate_ref.cli.test_cases.baselines.promote_to_baseline")
+
+        result = invoke_cli(
+            ["test-cases", "mint", "--provider", "example", "--diagnostic", "test-diag", "--from-replay"]
+        )
+        assert result.exit_code == 0
+
+        written = Manifest.load(paths.manifest)
+        # The native block is the stored one, NOT the mutated slot snapshot ("bb"*32).
+        assert {k: v.sha256 for k, v in written.native.items()} == {
+            k: v.sha256 for k, v in stored_native.items()
+        }
+        # The from-replay path must not snapshot the hydrated slot at all.
+        snapshot.assert_not_called()
+
     def test_mint_from_replay_requires_minted_manifest(self, invoke_cli, mocker, tmp_path):
         """`mint --from-replay` fails when there is no existing minted native to replay from."""
         from climate_ref_core.regression.store import LocalFilesystemStore

From 590716e5e9c08640d807ba91f9f31c2d452c78a0 Mon Sep 17 00:00:00 2001
From: Jared Lewis <jared@jared.kiwi.nz>
Date: Mon, 22 Jun 2026 03:40:45 +1000
Subject: [PATCH 05/12] fix(test-cases): address PR review feedback

- docs: clarify run seeds manifest.native={} only on first seed
- catalog: sort parent dirs for deterministic baseline selection
- catalog: fail fast on adapter parse errors instead of a partial catalog
- stages: collect per-blob upload errors instead of aborting the mint loop
- discovery: extract duplicated provider validation to a shared helper
---
 docs/background/regression-baselines.md       |  2 +-
 .../climate_ref/cli/test_cases/_catalog.py    |  8 ++++---
 .../src/climate_ref/cli/test_cases/_common.py | 23 +++++++++++++++++++
 .../src/climate_ref/cli/test_cases/_stages.py | 14 ++++++++---
 .../climate_ref/cli/test_cases/discovery.py   | 20 +++-------------
 .../tests/unit/cli/test_test_cases.py         | 23 ++++++++++++++-----
 6 files changed, 60 insertions(+), 30 deletions(-)

diff --git a/docs/background/regression-baselines.md b/docs/background/regression-baselines.md
index d65276966..8adff92fd 100644
--- a/docs/background/regression-baselines.md
+++ b/docs/background/regression-baselines.md
@@ -61,7 +61,7 @@ flowchart LR
 
 | Verb | Credentials | What it does |
 | --- | --- | --- |
-| `run` | none | Execute the diagnostic, curate its native into the output slot `output/<label>/`, rebuild the committed bundle, and — when seeding or `--force-regen` — promote it to `regression/` and seed `manifest.json` (`native = {}`). |
+| `run` | none | Execute the diagnostic, curate its native into the output slot `output/<label>/`, rebuild the committed bundle, and — when seeding or `--force-regen` — promote it to `regression/` and update `manifest.json` (first seed uses `native = {}`; existing manifests keep their native block). |
 | `build` | none | Rebuild the committed bundle from an existing output slot (no execution), under the same promotion gate as `run`. Handy for regenerating the bundle after an extraction-code change, from already-materialised native. |
 | `mint` | write | Execute (or, with `--from-replay`, replay the stored native), upload the curated native to the object store, and populate `manifest.native`. Generally run by CI. |
 | `sync` | public read | Fetch the native blobs referenced by the manifest into the local store cache. |
diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases/_catalog.py b/packages/climate-ref/src/climate_ref/cli/test_cases/_catalog.py
index e7c122c5f..0dca4ead3 100644
--- a/packages/climate-ref/src/climate_ref/cli/test_cases/_catalog.py
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases/_catalog.py
@@ -43,8 +43,10 @@ def _build_catalog(dataset_adapter: DatasetAdapter, file_paths: list[Path]) -> p
     """
     import pandas as pd
 
-    # Collect unique parent directories since the adapter scans directories
-    parent_dirs = list({fp.parent for fp in file_paths})
+    # Collect unique parent directories since the adapter scans directories.
+    # Sort for deterministic traversal/catalog order so baseline selection
+    # (``_solve_test_case`` takes ``executions[0]``) is reproducible.
+    parent_dirs = sorted({fp.parent for fp in file_paths}, key=lambda p: p.as_posix())
 
     catalog_dfs = []
     for parent_dir in parent_dirs:
@@ -58,7 +60,7 @@ def _build_catalog(dataset_adapter: DatasetAdapter, file_paths: list[Path]) -> p
                 logger.warning(f"No matching files found in catalog for {parent_dir}")
             catalog_dfs.append(df)
         except Exception as e:
-            logger.warning(f"Failed to parse {parent_dir}: {e}")
+            raise DatasetResolutionError(f"Failed to parse fetched datasets in {parent_dir}") from e
 
     if not catalog_dfs:
         return pd.DataFrame()
diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases/_common.py b/packages/climate-ref/src/climate_ref/cli/test_cases/_common.py
index 5fc9ac37e..15ae40288 100644
--- a/packages/climate-ref/src/climate_ref/cli/test_cases/_common.py
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases/_common.py
@@ -11,6 +11,9 @@
 
 from typing import TYPE_CHECKING
 
+import typer
+from loguru import logger
+
 if TYPE_CHECKING:
     from collections.abc import Iterator
 
@@ -20,6 +23,26 @@
     from climate_ref_core.testing import TestCase, TestCasePaths
 
 
+def _validate_provider_in_registry(registry: ProviderRegistry, provider: str | None) -> None:
+    """
+    Validate that ``provider`` (if given) is configured in the registry.
+
+    Logs a helpful error listing the available providers and exits with code 1
+    when the requested provider is not present. A falsy ``provider`` is a no-op.
+    """
+    if not provider:
+        return
+    available_providers = [p.slug for p in registry.providers]
+    if provider not in available_providers:
+        logger.error(f"Provider '{provider}' is not configured")
+        if available_providers:
+            logger.error(f"Available providers: {', '.join(sorted(available_providers))}")
+        else:
+            logger.error("No providers are configured. Check your configuration file.")
+        logger.error("To add a provider, update your config file or set REF_DIAGNOSTIC_PROVIDERS")
+        raise typer.Exit(code=1)
+
+
 def _write_test_case_manifest(
     paths: TestCasePaths,
     *,
diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases/_stages.py b/packages/climate-ref/src/climate_ref/cli/test_cases/_stages.py
index d829a5cce..d3baf3c5b 100644
--- a/packages/climate-ref/src/climate_ref/cli/test_cases/_stages.py
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases/_stages.py
@@ -228,10 +228,14 @@ def stage_upload(
     skipped = 0
     for relpath, entry in native.items():
         prev = previous.get(relpath)
-        if prev is not None and prev.sha256 == entry.sha256 and store.has(entry.sha256):
-            skipped += 1
+        try:
+            if prev is not None and prev.sha256 == entry.sha256 and store.has(entry.sha256):
+                skipped += 1
+                continue
+            digest = store.put(slot / relpath)
+        except Exception as exc:
+            errors.append(f"upload failed for {relpath}: {exc}")
             continue
-        digest = store.put(slot / relpath)
         if digest != entry.sha256:
             errors.append(f"digest mismatch for {relpath} (store={digest}, captured={entry.sha256})")
         else:
@@ -282,6 +286,10 @@ def stage_compare(
             )
         except AssertionError as exc:
             failures.append(str(exc))
+        except json.JSONDecodeError as exc:
+            # A committed baseline (or regenerated file) that no longer parses is drift, not a
+            # crash -- report it so replay fails cleanly instead of letting the error escape.
+            failures.append(f"{filename}: committed bundle is not valid JSON ({exc})")
         else:
             compared.append(filename)
     return failures, compared
diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases/discovery.py b/packages/climate-ref/src/climate_ref/cli/test_cases/discovery.py
index 3225a81d4..87de53577 100644
--- a/packages/climate-ref/src/climate_ref/cli/test_cases/discovery.py
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases/discovery.py
@@ -14,6 +14,7 @@
 
 from climate_ref.cli.test_cases._app import app
 from climate_ref.cli.test_cases._catalog import _fetch_and_build_catalog
+from climate_ref.cli.test_cases._common import _validate_provider_in_registry
 from climate_ref_core.exceptions import DatasetResolutionError
 
 if TYPE_CHECKING:
@@ -71,15 +72,7 @@ def fetch_test_data(  # noqa: PLR0912, PLR0913, PLR0915
     registry = ProviderRegistry.build_from_config(config, db)
 
     # Check if the requested provider exists in the registry
-    available_providers = [p.slug for p in registry.providers]
-    if provider and provider not in available_providers:
-        logger.error(f"Provider '{provider}' is not configured")
-        if available_providers:
-            logger.error(f"Available providers: {', '.join(sorted(available_providers))}")
-        else:
-            logger.error("No providers are configured. Check your configuration file.")
-        logger.error("To add a provider, update your config file or set REF_DIAGNOSTIC_PROVIDERS")
-        raise typer.Exit(code=1)
+    _validate_provider_in_registry(registry, provider)
 
     # Collect diagnostics to process
     diagnostics_to_process: list[Diagnostic] = []
@@ -171,14 +164,7 @@ def list_cases(
     registry = ProviderRegistry.build_from_config(config, db)
 
     # Check if the requested provider exists in the registry
-    available_providers = [p.slug for p in registry.providers]
-    if provider and provider not in available_providers:
-        logger.error(f"Provider '{provider}' is not configured")
-        if available_providers:
-            logger.error(f"Available providers: {', '.join(sorted(available_providers))}")
-        else:
-            logger.error("No providers are configured. Check your configuration file.")
-        raise typer.Exit(code=1)
+    _validate_provider_in_registry(registry, provider)
 
     table = Table(title="Test Data Specifications")
     table.add_column("Provider", style="cyan")
diff --git a/packages/climate-ref/tests/unit/cli/test_test_cases.py b/packages/climate-ref/tests/unit/cli/test_test_cases.py
index ece4c764b..29bd6f74b 100644
--- a/packages/climate-ref/tests/unit/cli/test_test_cases.py
+++ b/packages/climate-ref/tests/unit/cli/test_test_cases.py
@@ -142,16 +142,14 @@ def test_empty_df_after_filtering(self, caplog):
         assert len(result) == 0
         assert "No matching files found" in caplog.text
 
-    def test_adapter_exception_logged(self, caplog):
-        """Failures in every parent_dir are logged and yield an empty DataFrame."""
+    def test_adapter_exception_raises(self):
+        """A parse failure in any parent_dir aborts with DatasetResolutionError (fail-fast)."""
         mock_adapter = MagicMock()
         mock_adapter.find_local_datasets.side_effect = Exception("Parse error")
 
         file_paths = [Path("/path/to/file.nc")]
-        result = _build_catalog(mock_adapter, file_paths)
-
-        assert result.empty
-        assert "Failed to parse" in caplog.text
+        with pytest.raises(DatasetResolutionError, match="Failed to parse fetched datasets"):
+            _build_catalog(mock_adapter, file_paths)
 
 
 class TestFetchAndBuildCatalog:
@@ -1440,6 +1438,19 @@ def test_present_on_both_sides_is_compared(self, tmp_path, mocker):
         assert compared == ["diagnostic.json"]
         assert_mock.assert_called_once()
 
+    def test_unparseable_baseline_is_hard_failure(self, tmp_path):
+        """A committed baseline that no longer parses as JSON fails cleanly rather than crashing."""
+        from climate_ref.cli.test_cases._stages import stage_compare
+
+        paths, slot = self._paths_and_slot(tmp_path)
+        # A corrupted committed baseline: valid JSON with trailing garbage appended.
+        (paths.regression / "diagnostic.json").write_text("{}\n// drift\n")
+        (slot / "regression" / "diagnostic.json").write_text("{}")
+
+        failures, compared = stage_compare(slot=slot, paths=paths, slug="x", expected=["diagnostic.json"])
+        assert compared == []
+        assert any("not valid JSON" in f for f in failures)
+
 
 class TestReplayCommand:
     """Tests for the `test-cases replay` CLI verb."""

From caf9380eedf49da7055407bc52c8f971c13af9e1 Mon Sep 17 00:00:00 2001
From: Jared Lewis <jared@jared.kiwi.nz>
Date: Mon, 22 Jun 2026 10:18:30 +1000
Subject: [PATCH 06/12] refactor(test-cases): unify load_datasets_from_yaml
 call sites

stage_rebuild_from_slot imported load_datasets_from_yaml at module level, while
the run/mint verbs import it locally inside the function. A single
climate_ref_core.testing.load_datasets_from_yaml mock therefore did not reach
the replay rebuild path, which needed a second use-site patch. Import it locally
in _stages too (TestCasePaths, annotation-only, moves under TYPE_CHECKING, so the
module no longer pulls climate_ref_core.testing into CLI startup), so one mock
target now covers every call site.

Also tidies the round-trip integration test docstrings/section comments and
corrects the corrupted-bundle test docstring: the advisory integrity check does
not gate replay; the tolerant comparison does.
---
 .../src/climate_ref/cli/test_cases/_stages.py |  5 +-
 .../integration/test_native_roundtrip.py      | 76 ++-----------------
 2 files changed, 11 insertions(+), 70 deletions(-)

diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases/_stages.py b/packages/climate-ref/src/climate_ref/cli/test_cases/_stages.py
index d3baf3c5b..016f07737 100644
--- a/packages/climate-ref/src/climate_ref/cli/test_cases/_stages.py
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases/_stages.py
@@ -37,7 +37,6 @@
     materialise_native,
 )
 from climate_ref_core.regression.capture import build_native_snapshot, write_committed_bundle
-from climate_ref_core.testing import TestCasePaths, load_datasets_from_yaml
 
 if TYPE_CHECKING:
     from collections.abc import Iterable
@@ -47,7 +46,7 @@
     from climate_ref_core.diagnostics import Diagnostic, ExecutionResult
     from climate_ref_core.regression.manifest import Manifest, NativeEntry
     from climate_ref_core.regression.store import NativeStore
-    from climate_ref_core.testing import TestCase
+    from climate_ref_core.testing import TestCase, TestCasePaths
 
 SLOT_REGRESSION_DIRNAME = "regression"
 SLOT_SOURCE_STAMP = ".source.json"
@@ -157,6 +156,8 @@ def stage_rebuild_from_slot(
     so the rebuilt bundle is written into the slot (referencing the slot). No execution and
     no store access -- this is the shared core of ``replay`` (after a fetch) and ``build``.
     """
+    from climate_ref_core.testing import load_datasets_from_yaml
+
     from_placeholders(slot, output_dir=slot, test_data_dir=paths.test_data_dir)
     datasets = load_datasets_from_yaml(paths.catalog)
     definition = ExecutionDefinition(
diff --git a/packages/climate-ref/tests/integration/test_native_roundtrip.py b/packages/climate-ref/tests/integration/test_native_roundtrip.py
index 128b13c90..5f864ec3a 100644
--- a/packages/climate-ref/tests/integration/test_native_roundtrip.py
+++ b/packages/climate-ref/tests/integration/test_native_roundtrip.py
@@ -3,36 +3,10 @@
 
 These tests prove the native-baseline lifecycle ``run -> mint -> sync -> replay``
 end-to-end against a *local* content-addressed store
-(:class:`~climate_ref_core.regression.LocalFilesystemStore`) created inside
-``tmp_path``.
-Everything runs fully offline: no R2, no ESGF, no network, and no credentials.
-
-Tests
------
-1. **Synthetic nested-output round-trip** (the main gate) — a small synthetic
-   diagnostic writes *nested* native outputs under a stable ``executions/recipe/``
-   sub-directory and emits a CMEC ``output.json`` whose ``html`` / ``provenance.log``
-   dict *keys* are absolute paths.
-   It exercises both the curated nested-native capture path and the M2
-   absolute-path key-sanitisation path in
-   :func:`~climate_ref_core.regression.assert_bundle_regression`.
-   Its :meth:`build_execution_result` genuinely *reads back* a nested native file,
-   so the round-trip fails if that file is missing after materialisation.
-
-2. **Example smoke round-trip** — the real ``example`` provider's
-   ``GlobalMeanTimeseries`` through ``TestCaseRunner`` on offline sample data,
-   minted to a ``tmp_path`` store, synced, replayed, and tolerantly compared.
-   Skipped (with a clear reason) when the sample-data fixtures are unavailable.
-
-3. **Negative — float drift** — perturbing a committed float beyond ``Tolerance()``
-   raises a path-precise ``AssertionError``; a within-tolerance perturbation passes.
-
-4. **Negative — missing blob** — deleting a referenced blob from the store makes
-   the sync/replay path fail loudly, naming the digest and relpath.
-
-5. **CLI-level tests** — driving ``ref test-cases mint`` / ``sync`` / ``replay``
-   through the project's CLI harness against a ``tmp_path`` store, asserting a
-   zero exit on success and a non-zero exit on forced failure.
+(:class:`~climate_ref_core.regression.LocalFilesystemStore`) created inside ``tmp_path``.
+
+This runs offline, without any credentials.
+
 
 Notes on the shipped capture mechanics (verified against the source)
 --------------------------------------------------------------------
@@ -95,11 +69,6 @@
 _NATIVE_DATA_RELPATH = f"{_RECIPE_SUBDIR}/data/synth_data.bin"
 
 
-# ---------------------------------------------------------------------------
-# Synthetic nested-output diagnostic
-# ---------------------------------------------------------------------------
-
-
 class _SyntheticNestedDiagnostic(Diagnostic):
     """
     A synthetic diagnostic that writes nested native outputs.
@@ -241,11 +210,6 @@ def build_execution_result(self, definition: ExecutionDefinition) -> ExecutionRe
         )
 
 
-# ---------------------------------------------------------------------------
-# Provider + synthetic catalog helpers
-# ---------------------------------------------------------------------------
-
-
 def _build_synthetic_provider() -> DiagnosticProvider:
     """Return a :class:`DiagnosticProvider` carrying the synthetic diagnostic."""
     provider = DiagnosticProvider("SyntheticTest", "0.0.1", slug="synthetic-test")
@@ -347,17 +311,12 @@ def _capture_synthetic(
     )
 
 
-# ---------------------------------------------------------------------------
-# 1. Synthetic nested-output round-trip (the main gate)
-# ---------------------------------------------------------------------------
-
-
 class TestSyntheticNestedRoundTrip:
     """
     Full ``run -> mint -> sync -> replay`` on the synthetic nested-output diagnostic.
 
-    This is the main gate: every layer of the native-baseline system is exercised
-    on nested native outputs with absolute-path dict keys.
+    This exercises every layer of the native-baseline system on nested native outputs
+    with absolute-path dict keys.
     """
 
     def test_run_mint_sync_replay(self, tmp_path: Path) -> None:
@@ -530,11 +489,6 @@ def test_replay_fails_without_nested_native_file(self, tmp_path: Path) -> None:
             definition.diagnostic.build_execution_result(replay_definition)
 
 
-# ---------------------------------------------------------------------------
-# 2. Example smoke round-trip
-# ---------------------------------------------------------------------------
-
-
 @pytest.mark.slow
 class TestExampleSmokeRoundTrip:
     """
@@ -667,11 +621,6 @@ def test_example_roundtrip(self, tmp_path: Path) -> None:  # noqa: PLR0915
         )
 
 
-# ---------------------------------------------------------------------------
-# 3. Negative — float drift beyond tolerance
-# ---------------------------------------------------------------------------
-
-
 class TestNegativeFloatDrift:
     """Perturbing a committed float beyond tolerance produces a path-precise failure."""
 
@@ -750,11 +699,6 @@ def test_float_within_tolerance_passes(self, tmp_path: Path) -> None:
         )
 
 
-# ---------------------------------------------------------------------------
-# 4. Negative — missing blob
-# ---------------------------------------------------------------------------
-
-
 class TestNegativeMissingBlob:
     """Deleting a referenced blob causes a loud, actionable failure."""
 
@@ -828,11 +772,6 @@ def test_missing_blob_detected_on_replay(self, tmp_path: Path) -> None:
         )
 
 
-# ---------------------------------------------------------------------------
-# 5. CLI-level tests
-# ---------------------------------------------------------------------------
-
-
 def _synthetic_cli_case(tmp_path: Path) -> tuple[MagicMock, Diagnostic, MagicMock]:
     """
     Build a ``(registry, diagnostic, test_case)`` trio backed by the synthetic diagnostic.
@@ -947,7 +886,8 @@ def test_replay_fails_on_corrupted_committed_bundle(
         """
         Corrupting the committed bundle after minting makes ``replay`` exit non-zero.
 
-        The committed integrity check fails before native materialisation.
+        The tolerant comparison cannot reconcile the corrupted committed baseline against the
+        regenerated bundle (here it no longer parses as JSON), so replay reports drift.
         """
         registry, diag, _tc = _synthetic_cli_case(tmp_path)
         config = _local_store_config(tmp_path)

From 18cfb37f0e7a8ca9104976e9eb264baa254e5063 Mon Sep 17 00:00:00 2001
From: Jared Lewis <jared@jared.kiwi.nz>
Date: Mon, 22 Jun 2026 14:57:25 +1000
Subject: [PATCH 07/12] fix(test-cases): validate --provider in every verb
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

replay/mint/build/sync/ci-gate accepted --provider without checking it is
a configured provider, so a typo iterated zero cases and exited 0 — for
ci-gate that was a silent CI bypass that verified nothing. Route all five
verbs through the shared _validate_provider_in_registry helper and replace
run's hand-rolled lookup with it, so an unknown provider fails with exit 1
everywhere. A real provider with zero matching cases still exits 0.
---
 .../climate_ref/cli/test_cases/baselines.py   |  9 ++-
 .../src/climate_ref/cli/test_cases/ci_gate.py |  3 +-
 .../src/climate_ref/cli/test_cases/run.py     | 15 +---
 .../src/climate_ref/cli/test_cases/store.py   |  3 +-
 .../tests/unit/cli/test_test_cases.py         | 73 +++++++++++++++++++
 5 files changed, 88 insertions(+), 15 deletions(-)

diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases/baselines.py b/packages/climate-ref/src/climate_ref/cli/test_cases/baselines.py
index ccc6e70d1..a5da2d685 100644
--- a/packages/climate-ref/src/climate_ref/cli/test_cases/baselines.py
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases/baselines.py
@@ -17,7 +17,11 @@
 from loguru import logger
 
 from climate_ref.cli.test_cases._app import app
-from climate_ref.cli.test_cases._common import _iter_test_cases, _write_test_case_manifest
+from climate_ref.cli.test_cases._common import (
+    _iter_test_cases,
+    _validate_provider_in_registry,
+    _write_test_case_manifest,
+)
 from climate_ref.cli.test_cases._stages import (
     StageError,
     native_is_stale,
@@ -83,6 +87,7 @@ def replay_test_case(  # noqa: PLR0912, PLR0915
     console: Console = ctx.obj.console
 
     registry = ProviderRegistry.build_from_config(config, db)
+    _validate_provider_in_registry(registry, provider)
     store = build_native_store(config.native_store, writable=False)
 
     cases = list(_iter_test_cases(registry, provider=provider, diagnostic=diagnostic, test_case=test_case))
@@ -265,6 +270,7 @@ def mint_native(  # noqa: PLR0912, PLR0913, PLR0915
         raise typer.Exit(code=1) from exc
 
     registry = ProviderRegistry.build_from_config(config, db)
+    _validate_provider_in_registry(registry, provider)
     cases = list(_iter_test_cases(registry, provider=provider, diagnostic=diagnostic, test_case=test_case))
     if not cases:
         logger.warning(f"No test cases found for provider {provider!r}")
@@ -426,6 +432,7 @@ def build_test_case(  # noqa: PLR0912, PLR0913, PLR0915
     console: Console = ctx.obj.console
 
     registry = ProviderRegistry.build_from_config(config, db)
+    _validate_provider_in_registry(registry, provider)
     cases = list(_iter_test_cases(registry, provider=provider, diagnostic=diagnostic, test_case=test_case))
     if not cases:
         logger.warning(f"No test cases found for provider {provider!r}")
diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases/ci_gate.py b/packages/climate-ref/src/climate_ref/cli/test_cases/ci_gate.py
index 6f6780edd..809cfe743 100644
--- a/packages/climate-ref/src/climate_ref/cli/test_cases/ci_gate.py
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases/ci_gate.py
@@ -17,7 +17,7 @@
 
 from climate_ref.cli._git_utils import get_repo_for_path
 from climate_ref.cli.test_cases._app import app
-from climate_ref.cli.test_cases._common import _iter_test_cases
+from climate_ref.cli.test_cases._common import _iter_test_cases, _validate_provider_in_registry
 from climate_ref.config import Config
 
 if TYPE_CHECKING:
@@ -194,6 +194,7 @@ def ci_gate(  # noqa: PLR0912, PLR0913, PLR0915
     source_root_cache: dict[str, str | None] = {}
 
     registry = ProviderRegistry.build_from_config(config, db)
+    _validate_provider_in_registry(registry, provider)
 
     decisions: list[dict[str, str]] = []
     has_failure = False
diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases/run.py b/packages/climate-ref/src/climate_ref/cli/test_cases/run.py
index 1c55c5a52..b273d0e88 100644
--- a/packages/climate-ref/src/climate_ref/cli/test_cases/run.py
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases/run.py
@@ -19,7 +19,7 @@
 from climate_ref.cli._utils import format_size
 from climate_ref.cli.test_cases._app import app
 from climate_ref.cli.test_cases._catalog import _fetch_and_build_catalog
-from climate_ref.cli.test_cases._common import _write_test_case_manifest
+from climate_ref.cli.test_cases._common import _validate_provider_in_registry, _write_test_case_manifest
 from climate_ref.cli.test_cases._stages import (
     StageError,
     native_is_stale,
@@ -321,17 +321,8 @@ def run_test_case(  # noqa: PLR0912, PLR0913, PLR0915
     registry = ProviderRegistry.build_from_config(config, db)
 
     # Find the provider
-    provider_instance = None
-    for p in registry.providers:
-        if p.slug == provider:
-            provider_instance = p
-            break
-
-    if provider_instance is None:
-        logger.error(f"Provider '{provider}' not found")
-        available = [p.slug for p in registry.providers]
-        logger.error(f"Available providers: {available}")
-        raise typer.Exit(code=1)
+    _validate_provider_in_registry(registry, provider)
+    provider_instance = next(p for p in registry.providers if p.slug == provider)
 
     # Collect test cases to run
     test_cases_to_run: list[tuple[Diagnostic, TestCase]] = []
diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases/store.py b/packages/climate-ref/src/climate_ref/cli/test_cases/store.py
index 7d468576a..3b5f69ba7 100644
--- a/packages/climate-ref/src/climate_ref/cli/test_cases/store.py
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases/store.py
@@ -15,7 +15,7 @@
 from loguru import logger
 
 from climate_ref.cli.test_cases._app import app
-from climate_ref.cli.test_cases._common import _iter_test_cases
+from climate_ref.cli.test_cases._common import _iter_test_cases, _validate_provider_in_registry
 from climate_ref.config import Config
 
 if TYPE_CHECKING:
@@ -63,6 +63,7 @@ def sync_native(
     console: Console = ctx.obj.console
 
     registry = ProviderRegistry.build_from_config(config, db)
+    _validate_provider_in_registry(registry, provider)
     store = build_native_store(config.native_store, writable=False)
 
     # When a specific case is named, a missing manifest is a hard failure.
diff --git a/packages/climate-ref/tests/unit/cli/test_test_cases.py b/packages/climate-ref/tests/unit/cli/test_test_cases.py
index 29bd6f74b..1bfb9f702 100644
--- a/packages/climate-ref/tests/unit/cli/test_test_cases.py
+++ b/packages/climate-ref/tests/unit/cli/test_test_cases.py
@@ -1373,6 +1373,20 @@ def test_sync_hard_fails_on_unservable_blob(self, invoke_cli, mocker, tmp_path):
 
         invoke_cli(["test-cases", "sync", "--provider", "example"], expected_exit_code=1)
 
+    def test_sync_nonexistent_provider(self, invoke_cli, mocker):
+        """sync with an unknown provider exits 1 rather than silently syncing nothing."""
+        registry, _diag, _tc = _make_case_mocks()
+        mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=registry,
+        )
+
+        result = invoke_cli(
+            ["test-cases", "sync", "--provider", "nonexistent"],
+            expected_exit_code=1,
+        )
+        assert "not configured" in result.stderr
+
 
 class TestStageCompare:
     """`stage_compare` drives replay verification from the manifest's committed set."""
@@ -1499,6 +1513,20 @@ def test_replay_empty_native_is_hard_failure(self, invoke_cli, mocker, tmp_path)
         )
         assert "not yet minted" in result.stderr.lower() or "mint" in result.stderr.lower()
 
+    def test_replay_nonexistent_provider(self, invoke_cli, mocker):
+        """replay with an unknown provider exits 1 rather than reporting 'no test cases'."""
+        registry, _diag, _tc = _make_case_mocks()
+        mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=registry,
+        )
+
+        result = invoke_cli(
+            ["test-cases", "replay", "--provider", "nonexistent"],
+            expected_exit_code=1,
+        )
+        assert "not configured" in result.stderr
+
     def test_replay_integrity_mismatch_warns_and_continues(self, invoke_cli, mocker, tmp_path):
         """An integrity mismatch is advisory, not a gate."""
         from climate_ref_core.regression.manifest import Manifest
@@ -1656,6 +1684,25 @@ def test_mint_fails_fast_on_preflight_error(self, invoke_cli, mocker):
         # Fail-fast: the diagnostic runner must never have been reached.
         store.put.assert_not_called()
 
+    def test_mint_nonexistent_provider(self, invoke_cli, mocker):
+        """mint with an unknown provider exits 1 (after a passing store preflight)."""
+        registry, _diag, _tc = _make_case_mocks()
+        mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=registry,
+        )
+        store = MagicMock()  # preflight passes (no side effect)
+        mocker.patch(
+            "climate_ref_core.regression.store.build_native_store",
+            return_value=store,
+        )
+
+        result = invoke_cli(
+            ["test-cases", "mint", "--provider", "nonexistent"],
+            expected_exit_code=1,
+        )
+        assert "not configured" in result.stderr
+
     def test_mint_dry_run_lists_without_running(self, invoke_cli, mocker):
         """--dry-run preflights + lists the cases, but runs no diagnostics and uploads nothing."""
         registry, _diag, _tc = _make_case_mocks()
@@ -1873,6 +1920,20 @@ def test_build_fails_without_slot(self, invoke_cli, mocker, tmp_path):
         )
         assert "no native in output slot" in result.stderr.lower()
 
+    def test_build_nonexistent_provider(self, invoke_cli, mocker):
+        """build with an unknown provider exits 1 rather than reporting 'no test cases'."""
+        registry, _diag, _tc = _make_case_mocks()
+        mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=registry,
+        )
+
+        result = invoke_cli(
+            ["test-cases", "build", "--provider", "nonexistent"],
+            expected_exit_code=1,
+        )
+        assert "not configured" in result.stderr
+
     def test_build_rebuilds_from_slot_without_executing(self, invoke_cli, mocker, tmp_path):
         """build regenerates the committed bundle from an existing slot, never re-running."""
         paths, _scratch, _regression, runner = _setup_real_run(mocker, tmp_path)
@@ -2070,6 +2131,18 @@ def test_seeding_replays(self, invoke_cli, mocker, tmp_path):
         assert result.exit_code == 0
         assert "replay" in result.output
 
+    def test_ci_gate_nonexistent_provider(self, invoke_cli, mocker, tmp_path):
+        # An unknown provider must fail closed (exit 1), not gate nothing and silently exit 0.
+        # The registry mock only knows the 'example' provider.
+        self._setup(mocker, tmp_path, current_version=1)
+
+        result = invoke_cli(
+            ["test-cases", "ci-gate", "--provider", "nonexistent"],
+            expected_exit_code=1,
+        )
+        assert result.exit_code == 1
+        assert "not configured" in result.stderr
+
     def test_seeding_without_native_skips(self, invoke_cli, mocker, tmp_path):
         # Current manifest present with an empty native set, no base manifest -> seeding -> SKIP.
         self._setup(mocker, tmp_path, current_version=1)

From 352fc2562ede679eb38bae9d3228866334ad3a09 Mon Sep 17 00:00:00 2001
From: Jared Lewis <jared@jared.kiwi.nz>
Date: Mon, 22 Jun 2026 14:59:29 +1000
Subject: [PATCH 08/12] fix(regression): reject unknown manifest schema and
 validate native size
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Manifest.loads accepted any schema value verbatim, despite the documented
contract that the loader rejects manifests whose schema does not match
SCHEMA_VERSION — so a manifest from a future/incompatible writer would be
silently misread under today's field semantics by the coupling gate. It
also took NativeEntry.size straight from JSON, letting a negative, float,
or string size load cleanly and break the byte-identical-dump guarantee.
Enforce schema == SCHEMA_VERSION and a non-negative int size in loads.
---
 .../climate_ref_core/regression/manifest.py   | 11 ++++++++++
 .../tests/unit/regression/test_manifest.py    | 22 +++++++++++++++++++
 2 files changed, 33 insertions(+)

diff --git a/packages/climate-ref-core/src/climate_ref_core/regression/manifest.py b/packages/climate-ref-core/src/climate_ref_core/regression/manifest.py
index 47dba4af1..9e768942a 100644
--- a/packages/climate-ref-core/src/climate_ref_core/regression/manifest.py
+++ b/packages/climate-ref-core/src/climate_ref_core/regression/manifest.py
@@ -202,6 +202,12 @@ def loads(cls, text: str, *, source: str = "<string>") -> Manifest:
                 "The manifest may be corrupted or written by an incompatible version; "
                 "regenerate it with `ref test-cases run --force-regen`."
             )
+        if data["schema"] != SCHEMA_VERSION:
+            raise ValueError(
+                f"Invalid manifest {source}: unsupported schema {data['schema']!r}, "
+                f"expected {SCHEMA_VERSION}. The manifest was written by an incompatible "
+                "version; regenerate it with `ref test-cases run --force-regen`."
+            )
         try:
             native = {
                 relpath: NativeEntry(sha256=entry["sha256"], size=entry["size"])
@@ -220,6 +226,11 @@ def loads(cls, text: str, *, source: str = "<string>") -> Manifest:
             except ValueError as exc:
                 raise ValueError(f"Invalid manifest {source}: {exc}") from exc
             _validate_digest(entry.sha256)
+            if isinstance(entry.size, bool) or not isinstance(entry.size, int) or entry.size < 0:
+                raise ValueError(
+                    f"Invalid manifest {source}: native entry {relpath!r} has invalid size "
+                    f"{entry.size!r}; expected a non-negative integer."
+                )
         return cls(
             schema=data["schema"],
             test_case_version=data["test_case_version"],
diff --git a/packages/climate-ref-core/tests/unit/regression/test_manifest.py b/packages/climate-ref-core/tests/unit/regression/test_manifest.py
index b5b2c5e1f..97c8bfb0f 100644
--- a/packages/climate-ref-core/tests/unit/regression/test_manifest.py
+++ b/packages/climate-ref-core/tests/unit/regression/test_manifest.py
@@ -191,6 +191,28 @@ def test_load_rejects_bad_native_digest(self, tmp_path: Path, bad_digest: str) -
         with pytest.raises(ValueError, match="Invalid sha256 digest"):
             Manifest.load(p)
 
+    @pytest.mark.parametrize("bad_schema", [2, 0, "1"])
+    def test_load_rejects_unknown_schema(self, bad_schema: object) -> None:
+        payload = {
+            "schema": bad_schema,
+            "test_case_version": 1,
+            "committed": {},
+            "native": {},
+        }
+        with pytest.raises(ValueError, match="unsupported schema"):
+            Manifest.loads(json.dumps(payload))
+
+    @pytest.mark.parametrize("bad_size", [-1, 3.0, "10", True])
+    def test_load_rejects_invalid_native_size(self, bad_size: object) -> None:
+        payload = {
+            "schema": SCHEMA_VERSION,
+            "test_case_version": 1,
+            "committed": {},
+            "native": {"file.nc": {"sha256": "aa" * 32, "size": bad_size}},
+        }
+        with pytest.raises(ValueError, match="invalid size"):
+            Manifest.loads(json.dumps(payload))
+
 
 class TestComputeCommittedDigests:
     def test_all_three_present(self, regression_dir: Path) -> None:

From 39f6ffacd456ebc3d02fc062218cb5b5d74d81d6 Mon Sep 17 00:00:00 2001
From: Jared Lewis <jared@jared.kiwi.nz>
Date: Mon, 22 Jun 2026 14:59:46 +1000
Subject: [PATCH 09/12] fix(regression): align committed-bundle float rounding
 with its contract

The docstrings claimed output.json's floats are rounded, but it was
omitted from the rounding map, and the rounded-file set was a drift-prone
hand-maintained subset of COMMITTED_BUNDLE_FILES. output.json carries no
float leaves and is Pydantic-serialised (no sort_keys), so rounding it via
json.dumps(sort_keys=True) would reorder its keys and churn the committed
bytes. Make the rounded/not-rounded classification explicit and exhaustive
(killing the drift), correct the docstrings, and warn at runtime if an
unrounded committed file ever gains a float. No committed bytes change.
---
 .../climate_ref_core/regression/_quantise.py  |  7 +-
 .../climate_ref_core/regression/capture.py    | 33 ++++++++--
 .../tests/unit/regression/test_capture.py     | 65 ++++++++++++++++++-
 3 files changed, 99 insertions(+), 6 deletions(-)

diff --git a/packages/climate-ref-core/src/climate_ref_core/regression/_quantise.py b/packages/climate-ref-core/src/climate_ref_core/regression/_quantise.py
index 272d66c0c..89817be3c 100644
--- a/packages/climate-ref-core/src/climate_ref_core/regression/_quantise.py
+++ b/packages/climate-ref-core/src/climate_ref_core/regression/_quantise.py
@@ -1,12 +1,17 @@
 """
 Float quantisation for committed regression bundles.
 
-Committed regression JSON (``series.json`` / ``diagnostic.json`` / ``output.json``)
+The rounded committed JSON (``series.json`` / ``diagnostic.json``)
 records full-precision floats whose least-significant digits are platform-dependent
 (CPU, BLAS, library versions).
 Those last digits churn byte-for-byte between CI and local runs even when the result is numerically identical,
 producing noisy, unreviewable diffs in the committed bundle.
 
+``output.json`` is excluded from rounding: it is the CMEC *output* bundle (metadata only, no
+float leaves by construction) and is serialised by Pydantic's ``model_dump_json(indent=2)`` which
+does not sort keys, so re-dumping it with ``json.dumps(sort_keys=True)`` would reorder its keys and
+churn the committed bytes (see :data:`climate_ref_core.regression.capture._UNROUNDED_COMMITTED_FILES`).
+
 Rounding every float to a fixed number of significant figures at write time gives
 stable, reviewable committed bytes.
 We round to seven significant figures: one digit finer than the regression compare
diff --git a/packages/climate-ref-core/src/climate_ref_core/regression/capture.py b/packages/climate-ref-core/src/climate_ref_core/regression/capture.py
index 4c2bb781c..e26a1669b 100644
--- a/packages/climate-ref-core/src/climate_ref_core/regression/capture.py
+++ b/packages/climate-ref-core/src/climate_ref_core/regression/capture.py
@@ -25,6 +25,8 @@
 from pathlib import Path
 from typing import TYPE_CHECKING
 
+from loguru import logger
+
 from climate_ref_core.output_files import copy_execution_outputs, to_placeholders
 from climate_ref_core.paths import safe_path
 
@@ -41,26 +43,43 @@
     from climate_ref_core.regression.store import NativeStore
 
 
-# Per-file serialisation parameters for the committed bundle,
-# mirroring exactly how each artefact is written natively.
+# Serialisation parameters for committed-bundle files that contain floats.
 _COMMITTED_FLOAT_JSON_KWARGS: dict[str, dict[str, object]] = {
     "series.json": {"indent": 2, "allow_nan": False, "sort_keys": True},
     "diagnostic.json": {"indent": 2, "allow_nan": False, "sort_keys": True},
 }
 
+# Committed files deliberately NOT float-rounded
+# output.json is the CMEC *output* bundle, which by construction carries no float values.
+_UNROUNDED_COMMITTED_FILES: frozenset[str] = frozenset({"output.json"})
+
+
+def _contains_float(obj: object) -> bool:
+    """Return True if ``obj`` (a parsed-JSON structure) has any float leaf (bool excluded)."""
+    if isinstance(obj, bool):
+        return False
+    if isinstance(obj, float):
+        return True
+    if isinstance(obj, dict):
+        return any(_contains_float(v) for v in obj.values())
+    if isinstance(obj, list):
+        return any(_contains_float(v) for v in obj)
+    return False
+
 
 def _round_committed_floats(regression_dir: Path) -> None:
     """
     Round floats in the committed JSON bundle to seven significant figures in place.
 
-    Full-precision floats in ``series.json`` / ``diagnostic.json`` churn byte-for-byte
+    Only ``series.json`` / ``diagnostic.json`` are rounded.
+    Full-precision floats in those files churn byte-for-byte
     between CI and local runs even when numerically identical,
     producing noisy diffs in the committed (git-tracked) bundle.
     Rounding stabilises those bytes;
     seven figures stays an order of magnitude under the regression compare tolerance (``rtol=1e-6``),
     so a gate verdict is never flipped (see :mod:`climate_ref_core.regression._quantise`).
 
-    Each file is re-serialised with the same JSON parameters used to write it natively,
+    Each rounded file is re-serialised with the same JSON parameters used to write it natively,
     so the only byte difference versus the copied file is reduced float precision.
     A file is rewritten only when rounding actually changes its parsed content,
     keeping float-free artefacts byte-identical to the copy.
@@ -82,6 +101,12 @@ def _round_committed_floats(regression_dir: Path) -> None:
             continue
         path.write_text(json.dumps(rounded, **dump_kwargs), encoding="utf-8")  # type: ignore[arg-type]
 
+    # Check that the unrounded files don't contain floats
+    for filename in _UNROUNDED_COMMITTED_FILES:
+        path = regression_dir / filename
+        if path.exists() and _contains_float(json.loads(path.read_text(encoding="utf-8"))):
+            logger.warning(f"{filename} contains float values but is not float-rounded.")
+
 
 def write_committed_bundle(
     source_dir: Path,
diff --git a/packages/climate-ref-core/tests/unit/regression/test_capture.py b/packages/climate-ref-core/tests/unit/regression/test_capture.py
index eabd001b5..44d3de6fc 100644
--- a/packages/climate-ref-core/tests/unit/regression/test_capture.py
+++ b/packages/climate-ref-core/tests/unit/regression/test_capture.py
@@ -9,12 +9,15 @@
 from climate_ref_core.output_files import PLACEHOLDER_OUTPUT_DIR, PLACEHOLDER_TEST_DATA_DIR
 from climate_ref_core.pycmec.output import CMECOutput
 from climate_ref_core.regression.capture import (
+    _COMMITTED_FLOAT_JSON_KWARGS,
+    _UNROUNDED_COMMITTED_FILES,
+    _contains_float,
     build_native_snapshot,
     capture_execution,
     materialise_native,
     write_committed_bundle,
 )
-from climate_ref_core.regression.manifest import NativeEntry, sha256_file
+from climate_ref_core.regression.manifest import COMMITTED_BUNDLE_FILES, NativeEntry, sha256_file
 from climate_ref_core.regression.store import LocalFilesystemStore
 
 
@@ -106,6 +109,66 @@ def test_write_committed_bundle_rounds_floats(tmp_path):
     assert series[0]["values"] == [1.761334, 9.876543]
 
 
+def test_committed_float_classification_is_exhaustive():
+    assert set(_COMMITTED_FLOAT_JSON_KWARGS) | _UNROUNDED_COMMITTED_FILES == set(COMMITTED_BUNDLE_FILES)
+    assert set(_COMMITTED_FLOAT_JSON_KWARGS).isdisjoint(_UNROUNDED_COMMITTED_FILES)
+
+
+def test_output_json_is_float_free_by_construction(tmp_path):
+    # Codifies the invariant the output.json exclusion relies on: a representative output bundle,
+    # serialised the way REF writes it natively, carries no float leaves.
+    output = CMECOutput.model_validate(CMECOutput.create_template())
+    output.update(
+        "data",
+        short_name="example",
+        dict_content={
+            "filename": "data/example.nc",
+            "long_name": "Example output",
+            "description": "An example data file",
+        },
+    )
+    output.update(
+        "html",
+        short_name="index",
+        dict_content={
+            "filename": "index.html",
+            "long_name": "Index page",
+            "description": "The landing page",
+        },
+    )
+    json_path = tmp_path / "output.json"
+    output.dump_to_json(json_path)
+    loaded = json.loads(json_path.read_text(encoding="utf-8"))
+
+    assert _contains_float(loaded) is False
+
+
+def test_write_committed_bundle_leaves_output_json_bytes_unchanged(tmp_path):
+    # output.json must pass through write_committed_bundle byte-for-byte (no key reorder / rewrite),
+    # while the float-bearing artefacts are rounded.
+    output_dir = (tmp_path / "scratch" / "frag").resolve()
+    test_data_dir = (tmp_path / "test-data").resolve()
+    source = tmp_path / "scratch" / "frag"
+    source.mkdir(parents=True)
+    # output.json written the native (Pydantic) way: indent=2, keys NOT sorted, no floats.
+    CMECOutput.model_validate(CMECOutput.create_template()).dump_to_json(source / "output.json")
+    source_output_bytes = (source / "output.json").read_bytes()
+    # Float-bearing artefacts that rounding must rewrite.
+    (source / "diagnostic.json").write_text(json.dumps({"PROVENANCE": {"score": 1.843240715970751}}))
+    (source / "series.json").write_text(
+        json.dumps([{"dimensions": {"region": "global"}, "values": [1.761333624017425]}])
+    )
+    regression_dir = tmp_path / "regression"
+
+    write_committed_bundle(source, regression_dir, output_dir=output_dir, test_data_dir=test_data_dir)
+
+    # output.json is byte-identical to the copied source: not re-dumped, keys not reordered.
+    assert (regression_dir / "output.json").read_bytes() == source_output_bytes
+    # The float-bearing artefacts were rounded (proving the bundle was processed, not skipped).
+    assert json.loads((regression_dir / "diagnostic.json").read_text())["PROVENANCE"]["score"] == 1.843241
+    assert json.loads((regression_dir / "series.json").read_text())[0]["values"] == [1.761334]
+
+
 def test_build_native_snapshot_digests_relpaths(tmp_path):
     base = tmp_path / "results" / "frag"
     base.mkdir(parents=True)

From f82c2e93f75fb5db23342b242e1590b9909419b9 Mon Sep 17 00:00:00 2001
From: Jared Lewis <jared@jared.kiwi.nz>
Date: Mon, 22 Jun 2026 16:07:37 +1000
Subject: [PATCH 10/12] fix(regression): reject bool/float schema lookalikes in
 manifest loader

The schema guard used value equality only, so True (a bool subclass of
int) and 1.0 (1.0 == 1) were accepted as valid when SCHEMA_VERSION == 1.
Require schema to be a non-bool int equal to SCHEMA_VERSION, matching the
NativeEntry.size validation in the same loader, and extend the rejection
test to cover True and 1.0.
---
 .../src/climate_ref_core/regression/manifest.py              | 5 +++--
 .../climate-ref-core/tests/unit/regression/test_manifest.py  | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/packages/climate-ref-core/src/climate_ref_core/regression/manifest.py b/packages/climate-ref-core/src/climate_ref_core/regression/manifest.py
index 9e768942a..13a95cef2 100644
--- a/packages/climate-ref-core/src/climate_ref_core/regression/manifest.py
+++ b/packages/climate-ref-core/src/climate_ref_core/regression/manifest.py
@@ -202,9 +202,10 @@ def loads(cls, text: str, *, source: str = "<string>") -> Manifest:
                 "The manifest may be corrupted or written by an incompatible version; "
                 "regenerate it with `ref test-cases run --force-regen`."
             )
-        if data["schema"] != SCHEMA_VERSION:
+        schema = data["schema"]
+        if isinstance(schema, bool) or not isinstance(schema, int) or schema != SCHEMA_VERSION:
             raise ValueError(
-                f"Invalid manifest {source}: unsupported schema {data['schema']!r}, "
+                f"Invalid manifest {source}: unsupported schema {schema!r}, "
                 f"expected {SCHEMA_VERSION}. The manifest was written by an incompatible "
                 "version; regenerate it with `ref test-cases run --force-regen`."
             )
diff --git a/packages/climate-ref-core/tests/unit/regression/test_manifest.py b/packages/climate-ref-core/tests/unit/regression/test_manifest.py
index 97c8bfb0f..90700bcb6 100644
--- a/packages/climate-ref-core/tests/unit/regression/test_manifest.py
+++ b/packages/climate-ref-core/tests/unit/regression/test_manifest.py
@@ -191,7 +191,7 @@ def test_load_rejects_bad_native_digest(self, tmp_path: Path, bad_digest: str) -
         with pytest.raises(ValueError, match="Invalid sha256 digest"):
             Manifest.load(p)
 
-    @pytest.mark.parametrize("bad_schema", [2, 0, "1"])
+    @pytest.mark.parametrize("bad_schema", [2, 0, "1", True, 1.0])
     def test_load_rejects_unknown_schema(self, bad_schema: object) -> None:
         payload = {
             "schema": bad_schema,

From b18b2345ca1e3d3c8c7a0d9c13e67bb1b8cd56e5 Mon Sep 17 00:00:00 2001
From: Jared Lewis <jared@jared.kiwi.nz>
Date: Tue, 23 Jun 2026 17:26:07 +1000
Subject: [PATCH 11/12] fix: improve test-cases CLI DX

---
 .../src/climate_ref_core/logging.py           |  19 +-
 .../tests/unit/test_logging.py                |  22 +-
 .../src/climate_ref/cli/__init__.py           |   1 +
 .../src/climate_ref/cli/test_cases/_common.py |  57 +++
 .../climate_ref/cli/test_cases/baselines.py   |  18 +-
 .../src/climate_ref/cli/test_cases/ci_gate.py |  10 +-
 .../climate_ref/cli/test_cases/discovery.py   |  85 +++--
 .../src/climate_ref/cli/test_cases/run.py     |  45 ++-
 .../src/climate_ref/cli/test_cases/store.py   |  14 +-
 .../src/climate_ref/provider_registry.py      |  21 +-
 .../climate-ref/tests/unit/cli/test_root.py   |   1 +
 .../tests/unit/cli/test_test_cases.py         | 360 +++++++++++++++++-
 12 files changed, 577 insertions(+), 76 deletions(-)

diff --git a/packages/climate-ref-core/src/climate_ref_core/logging.py b/packages/climate-ref-core/src/climate_ref_core/logging.py
index 1e8289a12..1d1a8b485 100644
--- a/packages/climate-ref-core/src/climate_ref_core/logging.py
+++ b/packages/climate-ref-core/src/climate_ref_core/logging.py
@@ -70,6 +70,23 @@ def emit(self, record: logging.LogRecord) -> None:
         logger.opt(depth=depth, exception=record.exc_info).log(level, record.getMessage())
 
 
+def _retention_count_ignore_missing(logs: list[str]) -> None:  # pragma: no cover
+    """Remove old log files, tolerating concurrent cleanup by another process."""
+    keep = 10
+    existing_logs = []
+    for log in logs:
+        path = Path(log)
+        try:
+            mtime = path.stat().st_mtime
+        except FileNotFoundError:
+            continue
+        existing_logs.append((mtime, path))
+
+    for _, path in sorted(existing_logs, key=lambda item: (-item[0], item[1].as_posix()))[keep:]:
+        with contextlib.suppress(FileNotFoundError):
+            path.unlink()
+
+
 def initialise_logging(level: int | str, format: str, log_directory: str | Path) -> None:  # noqa: A002 # pragma: no cover
     """
     Initialise the logging for the REF
@@ -88,7 +105,7 @@ def initialise_logging(level: int | str, format: str, log_directory: str | Path)
     filename = f"climate-ref_{{time:YYYY-MM-DD_HH-mm}}_{process_name}.log"
     logger.add(
         sink=log_directory / filename,
-        retention=10,
+        retention=_retention_count_ignore_missing,
         level="DEBUG",
         format=VERBOSE_LOG_FORMAT,
         colorize=False,
diff --git a/packages/climate-ref-core/tests/unit/test_logging.py b/packages/climate-ref-core/tests/unit/test_logging.py
index 03cb92b5a..789fde736 100644
--- a/packages/climate-ref-core/tests/unit/test_logging.py
+++ b/packages/climate-ref-core/tests/unit/test_logging.py
@@ -4,7 +4,12 @@
 from loguru import logger
 
 from climate_ref_core.diagnostics import ExecutionDefinition
-from climate_ref_core.logging import EXECUTION_LOG_FILENAME, capture_logging, redirect_logs
+from climate_ref_core.logging import (
+    EXECUTION_LOG_FILENAME,
+    _retention_count_ignore_missing,
+    capture_logging,
+    redirect_logs,
+)
 
 
 @pytest.fixture
@@ -74,6 +79,21 @@ def test_redirect_logs_stdlog_captured(definition):
     assert "stdlog debug" not in output_file.read_text()
 
 
+def test_retention_count_ignores_missing_files(tmp_path):
+    """Log retention cleanup should tolerate files removed by another process."""
+    logs = []
+    for idx in range(12):
+        log = tmp_path / f"log-{idx}.log"
+        log.write_text(str(idx))
+        logs.append(str(log))
+    missing = tmp_path / "already-removed.log"
+    logs.append(str(missing))
+
+    _retention_count_ignore_missing(logs)
+
+    assert len(list(tmp_path.glob("*.log"))) == 10
+
+
 def test_redirect_logs_exception(definition, caplog):
     log_level = "DEBUG"
 
diff --git a/packages/climate-ref/src/climate_ref/cli/__init__.py b/packages/climate-ref/src/climate_ref/cli/__init__.py
index 0e223f828..cda8b6233 100644
--- a/packages/climate-ref/src/climate_ref/cli/__init__.py
+++ b/packages/climate-ref/src/climate_ref/cli/__init__.py
@@ -42,6 +42,7 @@
     ("test-cases", "sync"),
     ("test-cases", "replay"),
     ("test-cases", "mint"),
+    ("test-cases", "build"),
     ("test-cases", "ci-gate"),
     ("test-cases", "check-store"),
 }
diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases/_common.py b/packages/climate-ref/src/climate_ref/cli/test_cases/_common.py
index 15ae40288..8dbddb538 100644
--- a/packages/climate-ref/src/climate_ref/cli/test_cases/_common.py
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases/_common.py
@@ -43,6 +43,63 @@ def _validate_provider_in_registry(registry: ProviderRegistry, provider: str | N
         raise typer.Exit(code=1)
 
 
+def _validate_requested_filters(
+    registry: ProviderRegistry,
+    *,
+    provider: str | None = None,
+    diagnostic: str | None = None,
+    test_case: str | None = None,
+) -> None:
+    """
+    Fail fast when an explicit diagnostic or test-case selector matches nothing.
+
+    Empty selections caused by skip flags (for example ``--only-missing``) are not handled here.
+    Callers should decide whether those are successful no-ops.
+    This helper only guards likely typos in user-supplied selectors.
+    """
+    if not diagnostic and not test_case:
+        return
+
+    provider_instances = [p for p in registry.providers if provider is None or p.slug == provider]
+    diagnostics = [
+        diag for provider_instance in provider_instances for diag in provider_instance.diagnostics()
+    ]
+
+    if diagnostic:
+        matching_diagnostics = [diag for diag in diagnostics if diag.slug == diagnostic]
+        if not matching_diagnostics:
+            scope = f" for provider '{provider}'" if provider else ""
+            logger.error(f"Diagnostic '{diagnostic}' was not found{scope}")
+            available = sorted({diag.slug for diag in diagnostics})
+            if available:
+                logger.error(f"Available diagnostics: {', '.join(available)}")
+            raise typer.Exit(code=1)
+        diagnostics = matching_diagnostics
+
+    if test_case:
+        available_cases = sorted(
+            {
+                tc.name
+                for diag in diagnostics
+                if diag.test_data_spec is not None
+                for tc in diag.test_data_spec.test_cases
+            }
+        )
+        if test_case not in available_cases:
+            scope_parts = []
+            if provider:
+                scope_parts.append(f"provider '{provider}'")
+            if diagnostic:
+                scope_parts.append(f"diagnostic '{diagnostic}'")
+            scope = f" for {' and '.join(scope_parts)}" if scope_parts else ""
+            logger.error(f"Test case '{test_case}' was not found{scope}")
+            if available_cases:
+                logger.error(f"Available test cases: {', '.join(available_cases)}")
+            else:
+                logger.error("No test cases are defined for the selected diagnostics")
+            raise typer.Exit(code=1)
+
+
 def _write_test_case_manifest(
     paths: TestCasePaths,
     *,
diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases/baselines.py b/packages/climate-ref/src/climate_ref/cli/test_cases/baselines.py
index a5da2d685..05db12197 100644
--- a/packages/climate-ref/src/climate_ref/cli/test_cases/baselines.py
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases/baselines.py
@@ -20,6 +20,7 @@
 from climate_ref.cli.test_cases._common import (
     _iter_test_cases,
     _validate_provider_in_registry,
+    _validate_requested_filters,
     _write_test_case_manifest,
 )
 from climate_ref.cli.test_cases._stages import (
@@ -88,6 +89,7 @@ def replay_test_case(  # noqa: PLR0912, PLR0915
 
     registry = ProviderRegistry.build_from_config(config, db)
     _validate_provider_in_registry(registry, provider)
+    _validate_requested_filters(registry, provider=provider, diagnostic=diagnostic, test_case=test_case)
     store = build_native_store(config.native_store, writable=False)
 
     cases = list(_iter_test_cases(registry, provider=provider, diagnostic=diagnostic, test_case=test_case))
@@ -249,6 +251,14 @@ def mint_native(  # noqa: PLR0912, PLR0913, PLR0915
     db = ctx.obj.database
     console: Console = ctx.obj.console
 
+    registry = ProviderRegistry.build_from_config(config, db)
+    _validate_provider_in_registry(registry, provider)
+    _validate_requested_filters(registry, provider=provider, diagnostic=diagnostic, test_case=test_case)
+    cases = list(_iter_test_cases(registry, provider=provider, diagnostic=diagnostic, test_case=test_case))
+    if not cases:
+        logger.warning(f"No test cases found for provider {provider!r}")
+        raise typer.Exit(code=0)
+
     try:
         store = build_native_store(config.native_store, writable=True)
     except (NotImplementedError, ValueError) as exc:
@@ -269,13 +279,6 @@ def mint_native(  # noqa: PLR0912, PLR0913, PLR0915
         logger.error(f"Cannot mint: {exc}")
         raise typer.Exit(code=1) from exc
 
-    registry = ProviderRegistry.build_from_config(config, db)
-    _validate_provider_in_registry(registry, provider)
-    cases = list(_iter_test_cases(registry, provider=provider, diagnostic=diagnostic, test_case=test_case))
-    if not cases:
-        logger.warning(f"No test cases found for provider {provider!r}")
-        raise typer.Exit(code=0)
-
     if dry_run:
         # The store preflight has already passed at this point; report scope and stop before
         # running any diagnostics or uploading anything.
@@ -433,6 +436,7 @@ def build_test_case(  # noqa: PLR0912, PLR0913, PLR0915
 
     registry = ProviderRegistry.build_from_config(config, db)
     _validate_provider_in_registry(registry, provider)
+    _validate_requested_filters(registry, provider=provider, diagnostic=diagnostic, test_case=test_case)
     cases = list(_iter_test_cases(registry, provider=provider, diagnostic=diagnostic, test_case=test_case))
     if not cases:
         logger.warning(f"No test cases found for provider {provider!r}")
diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases/ci_gate.py b/packages/climate-ref/src/climate_ref/cli/test_cases/ci_gate.py
index 809cfe743..b914fa875 100644
--- a/packages/climate-ref/src/climate_ref/cli/test_cases/ci_gate.py
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases/ci_gate.py
@@ -17,7 +17,11 @@
 
 from climate_ref.cli._git_utils import get_repo_for_path
 from climate_ref.cli.test_cases._app import app
-from climate_ref.cli.test_cases._common import _iter_test_cases, _validate_provider_in_registry
+from climate_ref.cli.test_cases._common import (
+    _iter_test_cases,
+    _validate_provider_in_registry,
+    _validate_requested_filters,
+)
 from climate_ref.config import Config
 
 if TYPE_CHECKING:
@@ -195,6 +199,8 @@ def ci_gate(  # noqa: PLR0912, PLR0913, PLR0915
 
     registry = ProviderRegistry.build_from_config(config, db)
     _validate_provider_in_registry(registry, provider)
+    _validate_requested_filters(registry, provider=provider, diagnostic=diagnostic, test_case=test_case)
+    cases = list(_iter_test_cases(registry, provider=provider, diagnostic=diagnostic, test_case=test_case))
 
     decisions: list[dict[str, str]] = []
     has_failure = False
@@ -205,7 +211,7 @@ def record(case: str, action: Action, reason: str) -> None:
             has_failure = True
         decisions.append({"case": case, "action": action.value, "reason": reason})
 
-    for diag, tc in _iter_test_cases(registry, provider=provider, diagnostic=diagnostic, test_case=test_case):
+    for diag, tc in cases:
         case_id = f"{diag.provider.slug}/{diag.slug}/{tc.name}"
         paths = TestCasePaths.from_diagnostic(diag, tc.name)
 
diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases/discovery.py b/packages/climate-ref/src/climate_ref/cli/test_cases/discovery.py
index 87de53577..1b02932ce 100644
--- a/packages/climate-ref/src/climate_ref/cli/test_cases/discovery.py
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases/discovery.py
@@ -14,7 +14,7 @@
 
 from climate_ref.cli.test_cases._app import app
 from climate_ref.cli.test_cases._catalog import _fetch_and_build_catalog
-from climate_ref.cli.test_cases._common import _validate_provider_in_registry
+from climate_ref.cli.test_cases._common import _validate_provider_in_registry, _validate_requested_filters
 from climate_ref_core.exceptions import DatasetResolutionError
 
 if TYPE_CHECKING:
@@ -71,8 +71,9 @@ def fetch_test_data(  # noqa: PLR0912, PLR0913, PLR0915
     # Build provider registry to access diagnostics
     registry = ProviderRegistry.build_from_config(config, db)
 
-    # Check if the requested provider exists in the registry
+    # Check if the requested provider exists in the registry and selectors are valid
     _validate_provider_in_registry(registry, provider)
+    _validate_requested_filters(registry, provider=provider, diagnostic=diagnostic, test_case=test_case)
 
     # Collect diagnostics to process
     diagnostics_to_process: list[Diagnostic] = []
@@ -123,13 +124,17 @@ def fetch_test_data(  # noqa: PLR0912, PLR0913, PLR0915
             for tc in diag.test_data_spec.test_cases:
                 if test_case and tc.name != test_case:
                     continue
+                paths = TestCasePaths.from_diagnostic(diag, tc.name)
                 # Skip if catalog exists when using --only-missing
-                if only_missing:
-                    paths = TestCasePaths.from_diagnostic(diag, tc.name)
-                    if paths and paths.catalog.exists():
-                        logger.info(f"  Skipping test case: {tc.name} (catalog exists)")
-                        continue
+                if only_missing and paths and paths.catalog.exists():
+                    logger.info(f"  Skipping test case: {tc.name} (catalog exists)")
+                    continue
                 if tc.requests:
+                    if paths and paths.catalog.exists() and not force:
+                        logger.info(
+                            f"  Refreshing existing catalog for {tc.name} "
+                            "(use --only-missing to skip existing catalogs)"
+                        )
                     logger.info(f"  Processing test case: {tc.name}")
                     try:
                         _, catalog_written = _fetch_and_build_catalog(diag, tc, force=force)
@@ -146,6 +151,10 @@ def list_cases(
         str | None,
         typer.Option(help="Filter by provider"),
     ] = None,
+    verbose: Annotated[
+        bool,
+        typer.Option("--verbose", "-v", help="Show test case descriptions"),
+    ] = False,
 ) -> None:
     """
     List test cases for all diagnostics.
@@ -160,20 +169,26 @@ def list_cases(
     db = ctx.obj.database
     console = ctx.obj.console
 
-    # Build provider registry to access diagnostics
-    registry = ProviderRegistry.build_from_config(config, db)
+    # Build provider registry to access diagnostics.
+    # Listing is metadata-only, so skip provider configuration to avoid setup side effects.
+    registry = ProviderRegistry.build_from_config(config, db, configure=False)
 
     # Check if the requested provider exists in the registry
     _validate_provider_in_registry(registry, provider)
 
     table = Table(title="Test Data Specifications")
-    table.add_column("Provider", style="cyan")
-    table.add_column("Diagnostic", style="green")
-    table.add_column("Test Case", style="yellow")
-    table.add_column("Description")
-    table.add_column("Requests", justify="right")
-    table.add_column("Catalog", justify="center")
-    table.add_column("Regression", justify="center")
+    table.add_column("Provider", style="cyan", no_wrap=True)
+    table.add_column("Diagnostic", style="green", no_wrap=True)
+    table.add_column("Test Case", style="yellow", no_wrap=True)
+    if verbose:
+        table.add_column("Description", overflow="fold")
+    table.add_column("Requests", justify="right", no_wrap=True)
+    table.add_column("Catalog", justify="center", no_wrap=True)
+    table.add_column("Regression", justify="center", no_wrap=True)
+
+    total_cases = 0
+    missing_catalogs = 0
+    missing_regressions = 0
 
     for provider_instance in registry.providers:
         if provider and provider_instance.slug != provider:
@@ -181,15 +196,15 @@ def list_cases(
 
         for diag in provider_instance.diagnostics():
             if diag.test_data_spec is None:
-                table.add_row(
+                row = [
                     provider_instance.slug,
                     diag.slug,
                     "-",
-                    "(no test_data_spec)",
-                    "0",
-                    "-",
-                    "-",
-                )
+                ]
+                if verbose:
+                    row.append("(no test_data_spec)")
+                row.extend(["0", "-", "-"])
+                table.add_row(*row)
                 continue
 
             for tc in diag.test_data_spec.test_cases:
@@ -198,20 +213,30 @@ def list_cases(
                 # Check if catalog and regression data exist
                 paths = TestCasePaths.from_diagnostic(diag, tc.name)
                 if paths:
-                    catalog_status = "[green]yes[/green]" if paths.catalog.exists() else "[red]no[/red]"
-                    regression_status = "[green]yes[/green]" if paths.regression.exists() else "[red]no[/red]"
+                    catalog_exists = paths.catalog.exists()
+                    regression_exists = paths.regression.exists()
+                    catalog_status = "[green]yes[/green]" if catalog_exists else "[red]no[/red]"
+                    regression_status = "[green]yes[/green]" if regression_exists else "[red]no[/red]"
+                    missing_catalogs += not catalog_exists
+                    missing_regressions += not regression_exists
                 else:
                     catalog_status = "[dim]-[/dim]"
                     regression_status = "[dim]-[/dim]"
 
-                table.add_row(
+                total_cases += 1
+                row = [
                     provider_instance.slug,
                     diag.slug,
                     tc.name,
-                    tc.description,
-                    str(num_requests),
-                    catalog_status,
-                    regression_status,
-                )
+                ]
+                if verbose:
+                    row.append(tc.description)
+                row.extend([str(num_requests), catalog_status, regression_status])
+                table.add_row(*row)
 
     console.print(table)
+    console.print(
+        f"[dim]{total_cases} test case(s); "
+        f"{missing_catalogs} missing catalog(s); "
+        f"{missing_regressions} missing regression baseline(s)[/dim]"
+    )
diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases/run.py b/packages/climate-ref/src/climate_ref/cli/test_cases/run.py
index b273d0e88..d47afd325 100644
--- a/packages/climate-ref/src/climate_ref/cli/test_cases/run.py
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases/run.py
@@ -19,7 +19,11 @@
 from climate_ref.cli._utils import format_size
 from climate_ref.cli.test_cases._app import app
 from climate_ref.cli.test_cases._catalog import _fetch_and_build_catalog
-from climate_ref.cli.test_cases._common import _validate_provider_in_registry, _write_test_case_manifest
+from climate_ref.cli.test_cases._common import (
+    _validate_provider_in_registry,
+    _validate_requested_filters,
+    _write_test_case_manifest,
+)
 from climate_ref.cli.test_cases._stages import (
     StageError,
     native_is_stale,
@@ -255,7 +259,12 @@ def run_test_case(  # noqa: PLR0912, PLR0913, PLR0915
     ] = None,
     output_directory: Annotated[
         Path | None,
-        typer.Option(help="Output directory for execution results"),
+        typer.Option(
+            help=(
+                "Scratch directory for the diagnostic execution results. "
+                "The regression workflow also writes the gitignored output/<label> slot."
+            )
+        ),
     ] = None,
     force_regen: Annotated[
         bool,
@@ -322,6 +331,7 @@ def run_test_case(  # noqa: PLR0912, PLR0913, PLR0915
 
     # Find the provider
     _validate_provider_in_registry(registry, provider)
+    _validate_requested_filters(registry, provider=provider, diagnostic=diagnostic, test_case=test_case)
     provider_instance = next(p for p in registry.providers if p.slug == provider)
 
     # Collect test cases to run
@@ -351,18 +361,29 @@ def run_test_case(  # noqa: PLR0912, PLR0913, PLR0915
             test_cases_to_run.append((diag, tc))
 
     if not test_cases_to_run:
-        logger.warning(f"No test cases found for provider '{provider}'")
-        if diagnostic:
-            logger.warning(f"  with diagnostic filter: {diagnostic}")
-        if test_case:
-            logger.warning(f"  with test case filter: {test_case}")
         if only_missing and skipped_cases:
-            logger.info(f"  ({len(skipped_cases)} test case(s) skipped due to --only-missing)")
+            logger.info(
+                f"All {len(skipped_cases)} matching test case(s) skipped because "
+                "regression baselines already exist"
+            )
+        elif if_changed and skipped_cases:
+            logger.info(
+                f"All {len(skipped_cases)} matching test case(s) skipped because catalogs are unchanged"
+            )
+        else:
+            logger.warning(f"No test cases found for provider '{provider}'")
+            if diagnostic:
+                logger.warning(f"  with diagnostic filter: {diagnostic}")
+            if test_case:
+                logger.warning(f"  with test case filter: {test_case}")
         raise typer.Exit(code=0)
 
     logger.info(f"Found {len(test_cases_to_run)} test case(s) to run")
     if skipped_cases:
-        logger.info(f"Skipping {len(skipped_cases)} test case(s) with existing regression data")
+        if only_missing:
+            logger.info(f"Skipping {len(skipped_cases)} test case(s) with existing regression data")
+        elif if_changed:
+            logger.info(f"Skipping {len(skipped_cases)} test case(s) with unchanged catalogs")
 
     if dry_run:  # pragma: no cover
         table = Table(title="Test Cases to Run")
@@ -386,6 +407,12 @@ def run_test_case(  # noqa: PLR0912, PLR0913, PLR0915
     failures = 0
     failed_cases: list[str] = []
 
+    if output_directory is not None:
+        logger.info(
+            f"Using {output_directory} as the execution scratch directory; rebuilt native/bundle files "
+            f"will also be written to each test case's gitignored output/{label} slot"
+        )
+
     for diag, tc in test_cases_to_run:
         success = _run_single_test_case(
             config=config,
diff --git a/packages/climate-ref/src/climate_ref/cli/test_cases/store.py b/packages/climate-ref/src/climate_ref/cli/test_cases/store.py
index 3b5f69ba7..6b580f0b9 100644
--- a/packages/climate-ref/src/climate_ref/cli/test_cases/store.py
+++ b/packages/climate-ref/src/climate_ref/cli/test_cases/store.py
@@ -15,7 +15,11 @@
 from loguru import logger
 
 from climate_ref.cli.test_cases._app import app
-from climate_ref.cli.test_cases._common import _iter_test_cases, _validate_provider_in_registry
+from climate_ref.cli.test_cases._common import (
+    _iter_test_cases,
+    _validate_provider_in_registry,
+    _validate_requested_filters,
+)
 from climate_ref.config import Config
 
 if TYPE_CHECKING:
@@ -64,16 +68,22 @@ def sync_native(
 
     registry = ProviderRegistry.build_from_config(config, db)
     _validate_provider_in_registry(registry, provider)
+    _validate_requested_filters(registry, provider=provider, diagnostic=diagnostic, test_case=test_case)
     store = build_native_store(config.native_store, writable=False)
 
     # When a specific case is named, a missing manifest is a hard failure.
     named = bool(diagnostic or test_case)
+    cases = list(_iter_test_cases(registry, provider=provider, diagnostic=diagnostic, test_case=test_case))
+
+    if not cases:
+        logger.warning("No test cases found for the selected filters")
+        raise typer.Exit(code=0)
 
     fetched = 0
     skipped = 0
     failures: list[str] = []
 
-    for diag, tc in _iter_test_cases(registry, provider=provider, diagnostic=diagnostic, test_case=test_case):
+    for diag, tc in cases:
         case_id = f"{diag.provider.slug}/{diag.slug}/{tc.name}"
         paths = TestCasePaths.from_diagnostic(diag, tc.name)
         if paths is None or not paths.manifest.exists():
diff --git a/packages/climate-ref/src/climate_ref/provider_registry.py b/packages/climate-ref/src/climate_ref/provider_registry.py
index 9b98766a1..7d69f8a03 100644
--- a/packages/climate-ref/src/climate_ref/provider_registry.py
+++ b/packages/climate-ref/src/climate_ref/provider_registry.py
@@ -118,26 +118,35 @@ def get_metric(self, provider_slug: str, diagnostic_slug: str) -> "Diagnostic":
         return self.get(provider_slug).get(diagnostic_slug)
 
     @staticmethod
-    def build_from_config(config: Config, db: Database) -> "ProviderRegistry":
+    def build_from_config(
+        config: Config,
+        db: Database,
+        *,
+        configure: bool = True,
+    ) -> "ProviderRegistry":
         """
-        Create a ProviderRegistry instance using information from the database
+        Create a ProviderRegistry instance using information from the database.
 
         Parameters
         ----------
         config
-            Configuration object
+            Configuration object.
         db
-            Database instance
+            Database instance.
+        configure
+            Whether to call each provider's ``configure`` hook.
+            Metadata-only commands can disable this to avoid setup side effects such as conda bootstrap.
 
         Returns
         -------
         :
-            A new ProviderRegistry instance
+            A new ProviderRegistry instance.
         """
         providers = []
         for provider_info in config.diagnostic_providers:
             provider = import_provider(provider_info.provider)
-            provider.configure(config)
+            if configure:
+                provider.configure(config)
             providers.append(provider)
 
         with db.session.begin():
diff --git a/packages/climate-ref/tests/unit/cli/test_root.py b/packages/climate-ref/tests/unit/cli/test_root.py
index 70631eec2..342520009 100644
--- a/packages/climate-ref/tests/unit/cli/test_root.py
+++ b/packages/climate-ref/tests/unit/cli/test_root.py
@@ -166,6 +166,7 @@ def test_cli_context_skip_backup(config, mocker):
         (["test-cases", "sync"], True),
         (["test-cases", "replay", "--provider", "example"], True),
         (["test-cases", "mint", "--provider", "example"], True),
+        (["test-cases", "build", "--provider", "example"], True),
         # Data-modifying commands must still take a pre-migration backup.
         (["datasets", "ingest"], False),
         (["providers", "create-env"], False),
diff --git a/packages/climate-ref/tests/unit/cli/test_test_cases.py b/packages/climate-ref/tests/unit/cli/test_test_cases.py
index 1bfb9f702..bb050977c 100644
--- a/packages/climate-ref/tests/unit/cli/test_test_cases.py
+++ b/packages/climate-ref/tests/unit/cli/test_test_cases.py
@@ -317,15 +317,41 @@ def test_fetch_with_provider_filter(self, invoke_cli):
         result = invoke_cli(["test-cases", "fetch", "--provider", "example", "--dry-run"])
         assert result.exit_code == 0
 
-    def test_fetch_with_diagnostic_filter(self, invoke_cli):
-        """Test fetch command with diagnostic filter."""
-        result = invoke_cli(["test-cases", "fetch", "--diagnostic", "nonexistent", "--dry-run"])
-        assert result.exit_code == 0
+    def test_fetch_with_unknown_diagnostic_filter_fails(self, invoke_cli):
+        """Test fetch command with a diagnostic typo fails instead of silently selecting nothing."""
+        result = invoke_cli(
+            ["test-cases", "fetch", "--diagnostic", "nonexistent", "--dry-run"],
+            expected_exit_code=1,
+        )
+        assert "Diagnostic 'nonexistent' was not found" in result.stderr
+
+    def test_fetch_with_unknown_test_case_filter_fails(self, invoke_cli, mocker):
+        """Test fetch command with a test-case typo fails instead of silently selecting nothing."""
+        mock_tc = MagicMock(description="test", requests=[])
+        mock_tc.name = "default"
+        mock_spec = MagicMock(test_cases=[mock_tc])
+        mock_diag = MagicMock(slug="test-diag", test_data_spec=mock_spec)
+        mock_diag.provider = MagicMock(slug="example")
+        mock_provider = MagicMock(slug="example")
+        mock_provider.diagnostics.return_value = [mock_diag]
+        mock_registry = MagicMock(providers=[mock_provider])
+
+        mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=mock_registry,
+        )
+
+        result = invoke_cli(
+            ["test-cases", "fetch", "--provider", "example", "--test-case", "missing", "--dry-run"],
+            expected_exit_code=1,
+        )
+        assert "Test case 'missing' was not found" in result.stderr
 
     def test_fetch_with_test_case_filter(self, invoke_cli, mocker):
         """Test fetch command with test case filter in dry run."""
         mock_request = MagicMock(slug="test-request", source_type="CMIP6")
-        mock_test_case = MagicMock(name="specific-case", description="test", requests=[mock_request])
+        mock_test_case = MagicMock(description="test", requests=[mock_request])
+        mock_test_case.name = "specific-case"
         mock_spec = MagicMock(test_cases=[mock_test_case])
         mock_diag = MagicMock(slug="test-diag", test_data_spec=mock_spec)
         mock_diag.provider = MagicMock(slug="test-provider")
@@ -384,6 +410,70 @@ def test_fetch_continues_on_test_case_failure(self, invoke_cli, mocker, exceptio
         assert result.exit_code == 0
         assert fetch_mock.call_count == 2
 
+    def test_fetch_existing_catalog_explains_refresh(self, invoke_cli, mocker, tmp_path):
+        """Existing catalogs are refreshed by default, with a pointer to --only-missing."""
+        mock_tc = MagicMock(description="test", requests=[MagicMock()])
+        mock_tc.name = "default"
+        mock_spec = MagicMock(test_cases=[mock_tc])
+        mock_diag = MagicMock(slug="test-diag", test_data_spec=mock_spec)
+        mock_diag.provider = MagicMock(slug="example")
+        mock_provider = MagicMock(slug="example")
+        mock_provider.diagnostics.return_value = [mock_diag]
+        mock_registry = MagicMock(providers=[mock_provider])
+
+        case_dir = tmp_path / "case"
+        case_dir.mkdir()
+        catalog = case_dir / "catalog.yaml"
+        catalog.touch()
+        paths = MagicMock(catalog=catalog)
+
+        mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=mock_registry,
+        )
+        mocker.patch("climate_ref_core.testing.TestCasePaths.from_diagnostic", return_value=paths)
+        fetch_mock = mocker.patch(
+            "climate_ref.cli.test_cases.discovery._fetch_and_build_catalog",
+            return_value=(MagicMock(), False),
+        )
+
+        result = invoke_cli(["test-cases", "fetch", "--provider", "example"])
+
+        assert result.exit_code == 0
+        assert "Refreshing existing catalog for default" in result.stderr
+        assert "use --only-missing to skip existing catalogs" in result.stderr
+        fetch_mock.assert_called_once()
+
+    def test_fetch_only_missing_skips_existing_catalog(self, invoke_cli, mocker, tmp_path):
+        """--only-missing avoids ESGF work when a catalog already exists."""
+        mock_tc = MagicMock(description="test", requests=[MagicMock()])
+        mock_tc.name = "default"
+        mock_spec = MagicMock(test_cases=[mock_tc])
+        mock_diag = MagicMock(slug="test-diag", test_data_spec=mock_spec)
+        mock_diag.provider = MagicMock(slug="example")
+        mock_provider = MagicMock(slug="example")
+        mock_provider.diagnostics.return_value = [mock_diag]
+        mock_registry = MagicMock(providers=[mock_provider])
+
+        case_dir = tmp_path / "case"
+        case_dir.mkdir()
+        catalog = case_dir / "catalog.yaml"
+        catalog.touch()
+        paths = MagicMock(catalog=catalog)
+
+        mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=mock_registry,
+        )
+        mocker.patch("climate_ref_core.testing.TestCasePaths.from_diagnostic", return_value=paths)
+        fetch_mock = mocker.patch("climate_ref.cli.test_cases.discovery._fetch_and_build_catalog")
+
+        result = invoke_cli(["test-cases", "fetch", "--provider", "example", "--only-missing"])
+
+        assert result.exit_code == 0
+        assert "Skipping test case: default (catalog exists)" in result.stderr
+        fetch_mock.assert_not_called()
+
 
 class TestListCasesCommand:
     """Tests for list test cases CLI command."""
@@ -404,6 +494,76 @@ def test_list_with_provider_filter(self, invoke_cli):
         result = invoke_cli(["test-cases", "list", "--provider", "example"])
         assert result.exit_code == 0
 
+    def test_list_does_not_configure_providers(self, invoke_cli, mocker):
+        """Listing metadata avoids provider configure hooks with setup side effects."""
+        mock_registry = MagicMock(providers=[])
+        build_registry = mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=mock_registry,
+        )
+
+        result = invoke_cli(["test-cases", "list"])
+
+        assert result.exit_code == 0
+        assert build_registry.call_args.kwargs["configure"] is False
+
+    def test_list_compact_default_hides_descriptions(self, invoke_cli, mocker):
+        """The default list view stays scannable by omitting descriptions."""
+        mock_tc = MagicMock(description="long description", requests=[])
+        mock_tc.name = "default"
+        mock_spec = MagicMock(test_cases=[mock_tc])
+        mock_diag = MagicMock(slug="test-diag", test_data_spec=mock_spec)
+        mock_provider = MagicMock(slug="example")
+        mock_provider.diagnostics.return_value = [mock_diag]
+        mock_registry = MagicMock(providers=[mock_provider])
+
+        mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=mock_registry,
+        )
+        mocker.patch("climate_ref_core.testing.TestCasePaths.from_diagnostic", return_value=None)
+
+        result = invoke_cli(["test-cases", "list"])
+
+        assert result.exit_code == 0
+        assert "long description" not in result.stdout
+        assert "test-diag" in result.stdout
+
+    def test_list_summary_counts_missing_artifacts(self, invoke_cli, mocker, tmp_path):
+        """The list summary reports missing catalog and regression counts."""
+        from climate_ref_core.testing import TestCasePaths
+
+        tc_catalog_only = MagicMock(description="catalog", requests=[])
+        tc_catalog_only.name = "catalog-only"
+        tc_regression_only = MagicMock(description="regression", requests=[])
+        tc_regression_only.name = "regression-only"
+        mock_spec = MagicMock(test_cases=[tc_catalog_only, tc_regression_only])
+        mock_diag = MagicMock(slug="test-diag", test_data_spec=mock_spec)
+        mock_provider = MagicMock(slug="example")
+        mock_provider.diagnostics.return_value = [mock_diag]
+        mock_registry = MagicMock(providers=[mock_provider])
+
+        catalog_only = TestCasePaths(root=tmp_path / "catalog-only")
+        catalog_only.root.mkdir()
+        catalog_only.catalog.touch()
+        regression_only = TestCasePaths(root=tmp_path / "regression-only")
+        regression_only.root.mkdir()
+        regression_only.regression.mkdir()
+
+        mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=mock_registry,
+        )
+        mocker.patch(
+            "climate_ref_core.testing.TestCasePaths.from_diagnostic",
+            side_effect=[catalog_only, regression_only],
+        )
+
+        result = invoke_cli(["test-cases", "list"])
+
+        assert result.exit_code == 0
+        assert "2 test case(s); 1 missing catalog(s); 1 missing regression baseline(s)" in result.stdout
+
     def test_list_shows_no_test_data_spec(self, invoke_cli, mocker):
         """Test that list shows diagnostics without test_data_spec."""
         mock_diag = MagicMock(slug="no-spec-diag", test_data_spec=None)
@@ -416,7 +576,7 @@ def test_list_shows_no_test_data_spec(self, invoke_cli, mocker):
             return_value=mock_registry,
         )
 
-        result = invoke_cli(["test-cases", "list"])
+        result = invoke_cli(["test-cases", "list", "--verbose"])
         assert result.exit_code == 0
         assert "no test_data_spec" in result.stdout
 
@@ -451,6 +611,8 @@ def test_run_help(self, invoke_cli):
         """Test run command help."""
         result = invoke_cli(["test-cases", "run", "--help"])
         assert "Run test cases for diagnostics" in result.stdout
+        assert "Scratch directory" in result.stdout
+        assert "output/<label>" in result.stdout
 
     def test_run_nonexistent_diagnostic(self, invoke_cli):
         """Test running non-existent diagnostic."""
@@ -479,7 +641,7 @@ def test_run_diagnostic_no_test_data_spec(self, invoke_cli, mocker):
         assert "No test cases found" in result.stderr
 
     def test_run_nonexistent_test_case(self, invoke_cli, mocker):
-        """Test running non-existent test case shows warning and exits 0."""
+        """Test running a non-existent test case fails instead of silently selecting nothing."""
         mock_tc = MagicMock(name="default", description="test")
         mock_spec = MagicMock()
         mock_spec.test_cases = [mock_tc]
@@ -493,7 +655,6 @@ def test_run_nonexistent_test_case(self, invoke_cli, mocker):
             return_value=mock_registry,
         )
 
-        # Filtering for nonexistent test case finds nothing, exit 0
         result = invoke_cli(
             [
                 "test-cases",
@@ -505,9 +666,9 @@ def test_run_nonexistent_test_case(self, invoke_cli, mocker):
                 "--test-case",
                 "nonexistent",
             ],
-            expected_exit_code=0,
+            expected_exit_code=1,
         )
-        assert "No test cases found" in result.stderr
+        assert "Test case 'nonexistent' was not found" in result.stderr
 
     def test_run_no_test_case_dir(self, invoke_cli, mocker):
         """Test run command when test case directory can't be resolved fails the test case."""
@@ -617,6 +778,29 @@ def test_run_successful_execution(self, invoke_cli, mocker, tmp_path):
         # The slot holds the rebuilt committed bundle even when the baseline is untouched.
         assert (paths.output_slot("latest") / "regression" / "diagnostic.json").exists()
 
+    def test_run_output_directory_logs_scratch_and_slot_semantics(self, invoke_cli, mocker, tmp_path):
+        """--output-directory is explained as scratch output, not the only written location."""
+        paths, _scratch, _regression, _runner = _setup_real_run(mocker, tmp_path, regression_files={})
+        scratch = tmp_path / "scratch-output"
+
+        result = invoke_cli(
+            [
+                "test-cases",
+                "run",
+                "--provider",
+                "example",
+                "--diagnostic",
+                "test-diag",
+                "--output-directory",
+                str(scratch),
+            ],
+        )
+
+        assert result.exit_code == 0
+        assert f"Using {scratch} as the execution scratch directory" in result.stderr
+        assert "gitignored output/latest slot" in result.stderr
+        assert (paths.output_slot("latest") / "regression" / "diagnostic.json").exists()
+
     def test_run_unsuccessful_execution(self, invoke_cli, mocker, tmp_path):
         """An unsuccessful execution result fails the test case (exit 1)."""
         _setup_real_run(mocker, tmp_path, runner_result="unsuccessful")
@@ -769,7 +953,8 @@ def test_run_with_only_missing_skips_existing(self, invoke_cli, mocker, tmp_path
             ["test-cases", "run", "--provider", "example", "--only-missing"],
             expected_exit_code=0,
         )
-        assert "No test cases found" in result.stderr or "skipped" in result.stderr.lower()
+        assert "All 1 matching test case(s) skipped" in result.stderr
+        assert "No test cases found" not in result.stderr
 
     def test_run_with_if_changed_skips_unchanged(self, invoke_cli, mocker, tmp_path):
         """Test run command with --if-changed skips test cases with unchanged catalogs."""
@@ -804,7 +989,7 @@ def test_run_with_if_changed_skips_unchanged(self, invoke_cli, mocker, tmp_path)
             ["test-cases", "run", "--provider", "example", "--if-changed"],
             expected_exit_code=0,
         )
-        assert "No test cases found" in result.stderr
+        assert "All 1 matching test case(s) skipped because catalogs are unchanged" in result.stderr
 
     def test_run_label_slots_coexist(self, invoke_cli, mocker, tmp_path):
         """Two runs under different --label slots persist side by side."""
@@ -1387,6 +1572,34 @@ def test_sync_nonexistent_provider(self, invoke_cli, mocker):
         )
         assert "not configured" in result.stderr
 
+    def test_sync_nonexistent_diagnostic(self, invoke_cli, mocker):
+        """sync with a bad diagnostic filter fails instead of reporting a zero sync."""
+        registry, _diag, _tc = _make_case_mocks()
+        mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=registry,
+        )
+
+        result = invoke_cli(
+            ["test-cases", "sync", "--provider", "example", "--diagnostic", "missing"],
+            expected_exit_code=1,
+        )
+        assert "Diagnostic 'missing' was not found" in result.stderr
+
+    def test_sync_nonexistent_test_case(self, invoke_cli, mocker):
+        """sync with a bad test-case filter fails instead of reporting a zero sync."""
+        registry, _diag, _tc = _make_case_mocks()
+        mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=registry,
+        )
+
+        result = invoke_cli(
+            ["test-cases", "sync", "--provider", "example", "--test-case", "missing"],
+            expected_exit_code=1,
+        )
+        assert "Test case 'missing' was not found" in result.stderr
+
 
 class TestStageCompare:
     """`stage_compare` drives replay verification from the manifest's committed set."""
@@ -1527,6 +1740,38 @@ def test_replay_nonexistent_provider(self, invoke_cli, mocker):
         )
         assert "not configured" in result.stderr
 
+    def test_replay_nonexistent_diagnostic(self, invoke_cli, mocker):
+        """replay with a bad diagnostic filter fails before opening the native store."""
+        registry, _diag, _tc = _make_case_mocks()
+        mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=registry,
+        )
+        store_builder = mocker.patch("climate_ref_core.regression.store.build_native_store")
+
+        result = invoke_cli(
+            ["test-cases", "replay", "--provider", "example", "--diagnostic", "missing"],
+            expected_exit_code=1,
+        )
+        assert "Diagnostic 'missing' was not found" in result.stderr
+        store_builder.assert_not_called()
+
+    def test_replay_nonexistent_test_case(self, invoke_cli, mocker):
+        """replay with a bad test-case filter fails before opening the native store."""
+        registry, _diag, _tc = _make_case_mocks()
+        mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=registry,
+        )
+        store_builder = mocker.patch("climate_ref_core.regression.store.build_native_store")
+
+        result = invoke_cli(
+            ["test-cases", "replay", "--provider", "example", "--test-case", "missing"],
+            expected_exit_code=1,
+        )
+        assert "Test case 'missing' was not found" in result.stderr
+        store_builder.assert_not_called()
+
     def test_replay_integrity_mismatch_warns_and_continues(self, invoke_cli, mocker, tmp_path):
         """An integrity mismatch is advisory, not a gate."""
         from climate_ref_core.regression.manifest import Manifest
@@ -1685,23 +1930,52 @@ def test_mint_fails_fast_on_preflight_error(self, invoke_cli, mocker):
         store.put.assert_not_called()
 
     def test_mint_nonexistent_provider(self, invoke_cli, mocker):
-        """mint with an unknown provider exits 1 (after a passing store preflight)."""
+        """mint with an unknown provider exits 1 before opening the writable store."""
         registry, _diag, _tc = _make_case_mocks()
         mocker.patch(
             "climate_ref.provider_registry.ProviderRegistry.build_from_config",
             return_value=registry,
         )
-        store = MagicMock()  # preflight passes (no side effect)
-        mocker.patch(
-            "climate_ref_core.regression.store.build_native_store",
-            return_value=store,
-        )
+        store_builder = mocker.patch("climate_ref_core.regression.store.build_native_store")
 
         result = invoke_cli(
             ["test-cases", "mint", "--provider", "nonexistent"],
             expected_exit_code=1,
         )
         assert "not configured" in result.stderr
+        store_builder.assert_not_called()
+
+    def test_mint_nonexistent_diagnostic(self, invoke_cli, mocker):
+        """mint with a bad diagnostic filter fails before opening the writable store."""
+        registry, _diag, _tc = _make_case_mocks()
+        mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=registry,
+        )
+        store_builder = mocker.patch("climate_ref_core.regression.store.build_native_store")
+
+        result = invoke_cli(
+            ["test-cases", "mint", "--provider", "example", "--diagnostic", "missing", "--dry-run"],
+            expected_exit_code=1,
+        )
+        assert "Diagnostic 'missing' was not found" in result.stderr
+        store_builder.assert_not_called()
+
+    def test_mint_nonexistent_test_case(self, invoke_cli, mocker):
+        """mint with a bad test-case filter fails before opening the writable store."""
+        registry, _diag, _tc = _make_case_mocks()
+        mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=registry,
+        )
+        store_builder = mocker.patch("climate_ref_core.regression.store.build_native_store")
+
+        result = invoke_cli(
+            ["test-cases", "mint", "--provider", "example", "--test-case", "missing", "--dry-run"],
+            expected_exit_code=1,
+        )
+        assert "Test case 'missing' was not found" in result.stderr
+        store_builder.assert_not_called()
 
     def test_mint_dry_run_lists_without_running(self, invoke_cli, mocker):
         """--dry-run preflights + lists the cases, but runs no diagnostics and uploads nothing."""
@@ -1934,6 +2208,34 @@ def test_build_nonexistent_provider(self, invoke_cli, mocker):
         )
         assert "not configured" in result.stderr
 
+    def test_build_nonexistent_diagnostic(self, invoke_cli, mocker):
+        """build with a bad diagnostic filter fails instead of silently selecting nothing."""
+        registry, _diag, _tc = _make_case_mocks()
+        mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=registry,
+        )
+
+        result = invoke_cli(
+            ["test-cases", "build", "--provider", "example", "--diagnostic", "missing"],
+            expected_exit_code=1,
+        )
+        assert "Diagnostic 'missing' was not found" in result.stderr
+
+    def test_build_nonexistent_test_case(self, invoke_cli, mocker):
+        """build with a bad test-case filter fails instead of silently selecting nothing."""
+        registry, _diag, _tc = _make_case_mocks()
+        mocker.patch(
+            "climate_ref.provider_registry.ProviderRegistry.build_from_config",
+            return_value=registry,
+        )
+
+        result = invoke_cli(
+            ["test-cases", "build", "--provider", "example", "--test-case", "missing"],
+            expected_exit_code=1,
+        )
+        assert "Test case 'missing' was not found" in result.stderr
+
     def test_build_rebuilds_from_slot_without_executing(self, invoke_cli, mocker, tmp_path):
         """build regenerates the committed bundle from an existing slot, never re-running."""
         paths, _scratch, _regression, runner = _setup_real_run(mocker, tmp_path)
@@ -2143,6 +2445,28 @@ def test_ci_gate_nonexistent_provider(self, invoke_cli, mocker, tmp_path):
         assert result.exit_code == 1
         assert "not configured" in result.stderr
 
+    def test_ci_gate_nonexistent_diagnostic(self, invoke_cli, mocker, tmp_path):
+        # A bad diagnostic selector must fail closed instead of emitting an empty decision list.
+        self._setup(mocker, tmp_path, current_version=1)
+
+        result = invoke_cli(
+            ["test-cases", "ci-gate", "--provider", "example", "--diagnostic", "missing"],
+            expected_exit_code=1,
+        )
+        assert result.exit_code == 1
+        assert "Diagnostic 'missing' was not found" in result.stderr
+
+    def test_ci_gate_nonexistent_test_case(self, invoke_cli, mocker, tmp_path):
+        # A bad test-case selector must fail closed instead of emitting an empty decision list.
+        self._setup(mocker, tmp_path, current_version=1)
+
+        result = invoke_cli(
+            ["test-cases", "ci-gate", "--provider", "example", "--test-case", "missing"],
+            expected_exit_code=1,
+        )
+        assert result.exit_code == 1
+        assert "Test case 'missing' was not found" in result.stderr
+
     def test_seeding_without_native_skips(self, invoke_cli, mocker, tmp_path):
         # Current manifest present with an empty native set, no base manifest -> seeding -> SKIP.
         self._setup(mocker, tmp_path, current_version=1)

From 2a8008fb925fb9352ffc2c4c6d8b6ca4ed1a14de Mon Sep 17 00:00:00 2001
From: Jared Lewis <jared@jared.kiwi.nz>
Date: Wed, 24 Jun 2026 10:59:10 +1000
Subject: [PATCH 12/12] test: force dumb terminal in invoke_cli so CI help
 assertions pass

On CI ($GITHUB_ACTIONS) Typer forces its help console into terminal mode
and emits ANSI. NO_COLOR strips colour but not the bold its highlighter
wraps around <metavars>, which split tokens like `output/<label>` and broke
the substring assertion in test_run_help (green locally, red on CI).
Set TERM=dumb so Rich emits no escape codes at all.
---
 packages/climate-ref/src/climate_ref/conftest_plugin.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/packages/climate-ref/src/climate_ref/conftest_plugin.py b/packages/climate-ref/src/climate_ref/conftest_plugin.py
index 71b9036e8..a213ccf92 100644
--- a/packages/climate-ref/src/climate_ref/conftest_plugin.py
+++ b/packages/climate-ref/src/climate_ref/conftest_plugin.py
@@ -294,7 +294,10 @@ def invoke_cli(config: Config, monkeypatch: pytest.MonkeyPatch) -> Callable[...,
     runner.mix_stderr = False  # type: ignore[attr-defined]
 
     def _invoke_cli(args: list[str], expected_exit_code: int = 0, always_log: bool = False) -> Result:
+        # Render help/output deterministically for substring assertions.
+        # TERM=dumb makes Rich emit no escape codes at all. COLUMNS keeps help from wrapping mid-token.
         monkeypatch.setenv("NO_COLOR", "1")
+        monkeypatch.setenv("TERM", "dumb")
         monkeypatch.setenv("COLUMNS", "200")
 
         result = runner.invoke(app=cli.app, args=args)