diff --git a/changelog.d/uk-cut-modal.added.md b/changelog.d/uk-cut-modal.added.md
new file mode 100644
index 0000000000..266cc5d453
--- /dev/null
+++ b/changelog.d/uk-cut-modal.added.md
@@ -0,0 +1 @@
+`tools/modal_uk_cut.py` runs the UK cut runner in a Modal container, with its work directory on a Modal volume so a rerun resumes, for when the build machine is busy or asleep.
diff --git a/changelog.d/uk-cut-pepy-certification.added.md b/changelog.d/uk-cut-pepy-certification.added.md
new file mode 100644
index 0000000000..26c39703d7
--- /dev/null
+++ b/changelog.d/uk-cut-pepy-certification.added.md
@@ -0,0 +1 @@
+`tools/certify_uk_cut_in_policyengine_py.py` certifies a published UK cut into policyengine.py on a fresh branch: it refuses when another pull request or branch is already certifying the cut, checks the regional route before writing anything, runs certify-data, the lock, TRO, constant and snapshot regeneration and the strict bundle check, measures the UC floor and runs the tests, then drafts the pull request with every judgment call left as a checklist. An accepted regional model mismatch certifies with policyengine.py's audited input-surface evidence (policyengine.py#699). Its load limit, commit co-authors and pull request footer are the operator's to set.
diff --git a/changelog.d/uk-cut-runner.added.md b/changelog.d/uk-cut-runner.added.md
new file mode 100644
index 0000000000..4f5d61c565
--- /dev/null
+++ b/changelog.d/uk-cut-runner.added.md
@@ -0,0 +1 @@
+`tools/run_uk_cut.py` builds, signs and assembles a Microcosm UK national cut in one resumable command, fetching every input from Hugging Face by the pins the build already enforces (`tools/uk_cut_inputs.json` says only where each input lives; the Chronicle artifact's path follows `chronicle_feed.json`). It resumes a cut only under the key that signed it, chains the certification's Logbook row on the build's own row, and never submits an Orrery publication. `tools/modal_rebuild_uk_chronicle_artifact.py` rebuilds the pinned Chronicle UK consumer artifact on Modal and hosts it privately.
diff --git a/changelog.d/uk-gate-signing-key-registry.added.md b/changelog.d/uk-gate-signing-key-registry.added.md
new file mode 100644
index 0000000000..1aa86c968c
--- /dev/null
+++ b/changelog.d/uk-gate-signing-key-registry.added.md
@@ -0,0 +1 @@
+UK gate reports, release-cut certifications and dense gate reports now verify only under a signing key registered in `microcosm.data.gate_signing_keys`, and every UK signer refuses an unregistered or retired key. The national build checks its key before loading any input, instead of failing after the solve. `python -m microcosm.data.gate_signing_keys check` reports whether the key in the environment may sign.
diff --git a/changelog.d/uk-gate-team-signing-key.added.md b/changelog.d/uk-gate-team-signing-key.added.md
new file mode 100644
index 0000000000..608de22d50
--- /dev/null
+++ b/changelog.d/uk-gate-team-signing-key.added.md
@@ -0,0 +1 @@
+Register a second UK gate signing key, `uk-gate-team-2026`, held by Max Ghenis in the agent store on his build Mac, so cuts can be built and signed without the first builder's key. The key that signed every earlier cut stays active.
diff --git a/changelog.d/uk-gate-vahid-signing-key.added.md b/changelog.d/uk-gate-vahid-signing-key.added.md
new file mode 100644
index 0000000000..c2cb386405
--- /dev/null
+++ b/changelog.d/uk-gate-vahid-signing-key.added.md
@@ -0,0 +1 @@
+Register a third UK gate signing key, `uk-gate-vahid-ahmadi-2026`, held by Vahid Ahmadi in his laptop's login keychain, so he can build and sign a cut.
diff --git a/conftest.py b/conftest.py
index f434d79435..7a7c44ebf3 100644
--- a/conftest.py
+++ b/conftest.py
@@ -130,3 +130,44 @@ def unexpected_start(*args, **options):
     yield emitters
     for emitter in emitters:
         emitter.close()
+
+
+@pytest.fixture(autouse=True)
+def _admit_test_gate_signing_keys(request, monkeypatch):
+    """Let tests sign with their own UK gate keys.
+
+    Production verifies only keys registered in
+    ``microcosm.data.gate_signing_keys``. Tests sign with throwaway keys, so
+    every unregistered key counts as an active test key here, while the
+    committed entries keep their real status. A test marked
+    ``committed_gate_key_registry`` sees the committed registry unchanged.
+    """
+
+    if request.node.get_closest_marker("committed_gate_key_registry"):
+        return
+    try:
+        from microcosm.data import gate_signing_keys
+    except ImportError:
+        return
+    committed = gate_signing_keys._registry
+
+    class _AdmitTestKeys(dict):
+        def __missing__(self, key_sha256):
+            return gate_signing_keys.GateSigningKey(
+                key_sha256=key_sha256,
+                label="test-key",
+                status="active",
+                custodian="the test suite",
+                held_in="the test",
+                registered="test",
+                evidence="admitted by the root conftest",
+            )
+
+        def get(self, key_sha256, default=None):
+            return self[key_sha256]
+
+    def registry(country):
+        entries = committed(country)
+        return None if entries is None else _AdmitTestKeys(entries)
+
+    monkeypatch.setattr(gate_signing_keys, "_registry", registry)
diff --git a/docs/agent-guide.md b/docs/agent-guide.md
index 455aad6cbb..47ddbc1411 100644
--- a/docs/agent-guide.md
+++ b/docs/agent-guide.md
@@ -232,7 +232,10 @@ grades every waiver register on the staged frame before the solve; see README
 "Dry-running the release's registers". Publication also refuses a
 release whose build recorded staging telemetry that never reached its repo
 (`--allow-missing-staging` overrides); a build that declared `--no-staging`
-publishes without the flag. Never publish or promote artifacts as a side
+publishes without the flag. A UK national cut runs end to end with
+`tools/run_uk_cut.py` ([uk-cut-anyone.md](uk-cut-anyone.md)): inputs fetched
+by pin, a signing key registered in `microcosm.data.gate_signing_keys`, and
+an inspection-only `--publish`. Never publish or promote artifacts as a side
 effect of another task. A UK rowwise run's **staged** bundle
 (`staged/<run_id>/` in the private repository, written by the build itself)
 is inspection evidence, not a release: it never moves `releases/` or
diff --git a/docs/uk-cut-anyone.md b/docs/uk-cut-anyone.md
new file mode 100644
index 0000000000..7edd3efdb3
--- /dev/null
+++ b/docs/uk-cut-anyone.md
@@ -0,0 +1,438 @@
+# Building a UK national cut without the original builder's machine
+
+Any team member or agent session with the credentials below can build, sign
+and publish a Microcosm UK national cut, then open its policyengine.py
+certification pull request. Each input comes from Hugging Face and is checked
+against the pins the build itself enforces.
+
+This is the short path. The step-by-step reference behind it stays in
+[uk-national-release-assembly-runbook-806.md](uk-national-release-assembly-runbook-806.md).
+
+**Status (2026-10-26).** The runner's steps have so far run end to end only
+against stand-in tools. Its first real run, by Vahid Ahmadi from his own
+laptop with his own registered key, is the last check before it is relied
+on for a re-cut; until then the hand-run launchers stay the fallback.
+
+## What you need
+
+| Need | Where it comes from | Check |
+|---|---|---|
+| A clean checkout of `main` locked at the policyengine-uk you want | a "Lock policyengine-uk X" PR merged to main | `tools/run_uk_cut.py preflight` |
+| `HF_TOKEN` | write access to `policyengine/populace-uk-private` and `policyengine/populace-uk-staging`, and read access to the input repos below | preflight |
+| `MICROCOSM_UK_TERMINAL_GATE_SIGNING_KEY` | a key registered **active** in `microcosm.data.gate_signing_keys` (see [Signing keys](#signing-keys)) | `python -m microcosm.data.gate_signing_keys check` |
+| Cover under the UK Data Service licences for the FRS, SPI, WAS, LCFS, NTS and ETB | the licence holders | access to the input repositories (below) |
+| About 60 GB of free disk, AC power, a quiet host | the machine | preflight |
+
+## One command
+
+```bash
+cd <clean checkout of main>
+uv sync --all-packages --locked --extra uk
+export HF_TOKEN=…
+# The key goes to this one command, never to the whole shell:
+MICROCOSM_UK_TERMINAL_GATE_SIGNING_KEY="$(security find-generic-password -a "$USER" -s microcosm-uk-gate-signing-key -w)" \
+  uv run --no-sync python tools/run_uk_cut.py all --label sat24              # build, certify, assemble
+# add --publish to publish for inspection
+```
+
+The runner passes the key on only to the steps that sign (spine, national
+build, certification) or verify (assembly, publication); the dry run, the
+scoring, the stage-1 comparison and the preflight tests never see it.
+
+Agent sessions on Max's build Mac read the team key, whose custodian is Max,
+with `agent-secret get microcosm/uk-gate-signing-key-team maxghenis`, and
+`HF_TOKEN` with `agent-secret get HUGGING_FACE_TOKEN_MAX maxghenis`.
+
+`all` runs these steps in order:
+
+1. `fetch`
+2. `preflight`
+3. spine
+4. national dry run, then the national calibration
+5. re-score, only when the in-build evaluation did not pass
+6. certify
+7. stage-1 comparison (with `--previous-h5`)
+8. assemble
+9. publish preflight
+10. publish (with `--publish`)
+
+Every step first checks whether its outputs already exist and verify, and
+skips itself if they do. So when a run stops, fix the cause and run the same
+command again.
+
+Nothing is overwritten:
+
+- An unfinished spine attempt is left for you to inspect. The builder
+  deletes a spine's sidecars when it starts, including a gate-blocked
+  attempt's signed report, so a retry needs `--retry-spine`, which moves the
+  whole attempt to `spine.failed-<time>` first.
+- An unfinished national run is moved aside only with `--retry-national`.
+- A score receipt, a certification or a stage-1 comparison that is redone
+  keeps the earlier one as `<name>.superseded-<time>`.
+- An existing release directory is never re-assembled.
+
+Other subcommands:
+
+- `status --label L`: where each step stands.
+- `fetch`: install and verify the inputs only.
+- `preflight --label L`: every check, with nothing built.
+- `inputs`: the resolved pins.
+
+Outputs go to `~/microcosm-uk-work`, outside any repository, because they
+derive from licensed data:
+
+| Path | Contents |
+|---|---|
+| `inputs/` | shared verified inputs |
+| `cuts/<label>-<sha9>/spine/` | the spine |
+| `cuts/<label>-<sha9>/national/` | the calibration run |
+| `cuts/<label>-<sha9>/release/` | the assembled release |
+| `cuts/<label>-<sha9>/logs/` | one log per step |
+| `cuts/<label>-<sha9>/cut_receipt.json` | commit, engine, the signing key's fingerprint (from the signed reports), input pins, step timings, tag |
+
+If the machine runs a disk cleaner, keep it away from the work directory for
+the length of a run. On a host booked through a reservation tool, pass
+`--reservation-tool <path> --reservation-caller <name>`: preflight then asks
+`<tool> allowed <name>` before anything is built, and fails if the tool is
+missing. Without them no reservation is checked.
+
+### What it will not do
+
+- **It never moves a default.** `--publish` always passes `--no-latest
+  --tag-only`, so `populace-uk-private`'s main branch, its root files and
+  `latest-*.json` stay where they are.
+- **It never promotes.** Promotion (`--promote-line national`) is a separate,
+  reviewed call. The runner prints the command for it.
+- **It never publishes to the Orrery.** The national step always passes
+  `--no-publish-orrery`, as the hand-run launchers do. The graph files stay
+  in the run directory; publishing them is a separate, deliberate step
+  ([orrery-publication.md](orrery-publication.md)).
+- **It never certifies into policyengine.py.** That is a pull request in
+  another repository; see [Certifying into policyengine.py](#certifying-into-policyenginepy).
+- **It builds only from main.** It refuses a commit that is not on
+  `origin/main`, unless you pass `--allow-off-main "<who agreed and why>"` for
+  a pushed commit.
+
+### When the build Mac can't: Modal
+
+`tools/modal_uk_cut.py` runs the same command in a Modal container, for when
+the Mac is busy, short of disk or asleep. The container:
+
+- clones a pushed commit on main;
+- syncs that commit's own lock with the `uk` extra;
+- keeps the work directory, with its inputs and every step's outputs, on the
+  `microcosm-uk-cuts` volume, so a rerun resumes.
+
+**Processing UKDS microdata on Modal needs the data owners' OK before first
+use.** Three things move to Modal with a run:
+
+- `HF_TOKEN` and the signing key, as an ephemeral secret attached to that
+  run only. Modal holds both for the run; no named workspace secret keeps
+  them. A key used there is then also held on Modal, and its registry
+  entry's `held_in` must say so first.
+- The UKDS inputs and every output, on the `microcosm-uk-cuts` volume, which
+  anyone in the Modal workspace can read. Only a workspace or environment
+  restricted to licensed users may hold it.
+- The app and its image, built from the pushed commit.
+
+Planning contacts no Modal service and sends nothing. `modal run` creates
+the app before its entrypoint can refuse, so it attaches the credentials
+only when `MICROCOSM_UK_CUT_MODAL_RUN=1` is set:
+
+```bash
+python tools/modal_uk_cut.py --commit <sha on main> --label sat24                         # plan, sends nothing
+MICROCOSM_UK_CUT_MODAL_RUN=1 modal run --detach tools/modal_uk_cut.py --commit <sha> --label sat24 --run [--publish]  # paid
+```
+
+## Inputs
+
+`tools/uk_cut_inputs.json` says where each input lives. Every expected digest
+is read at run time from the pins the build already checks:
+`uk/source_stages.json`, `uk/frs_release.json`, `uk/chronicle_feed.json` and
+`uk/gates.json`. The one exception is the input-mass reference: the build
+binds it by a canonical digest of its contents, so the manifest also carries
+the hosted file's byte sha256. A file is installed only if it
+is byte-identical to what the build will accept, and nothing unverified is
+ever left at an input's path.
+
+**Who can read them.** `policyengine/microcosm-uk-build-inputs`,
+`policyengine/populace-uk-private` and `policyengine/populace-uk-staging` are
+private. `policyengine/policyengine-uk-data-private`, which holds the UKDS
+zips, is a *gated* model repository: anyone can see its file list, and its
+files download only after an access request is approved. So that approval
+is what admits a builder to the licensed inputs.
+
+| Input | Hosted at | State |
+|---|---|---|
+| FRS 2024-25 (14 tabs) | `policyengine/policyengine-uk-data-private` `frs_2024_25.zip` @ `a2039519` (gated) | fetched, every member matches its pin |
+| SPI 2022-23, WAS round 8, ETB 1977-2024 | the same repo's `spi_2022_23.zip`, `was_2006_22.zip`, `etb_1977_24.zip` | fetched, matches |
+| HMRC personal incomes ODS | gov.uk URL pinned in `source_stages.json` | fetched, matches |
+| Incumbent enhanced FRS | `policyengine-uk-data-private` `enhanced_frs_2024_25.h5` @ `a9e52499` | fetched, matches |
+| Input-mass reference | `policyengine/microcosm-uk-build-inputs` (private) `input-mass-reference/fd41cb5f…/` | fetched, matches |
+| Chronicle UK consumer artifact (about 7.4 GB) | `policyengine/microcosm-uk-build-inputs` `chronicle-uk/<the feed's source commit>/`, read at main | fetched, both files match the feed pin. The path follows `chronicle_feed.json`, so each re-pin needs its artifact hosted (below). 272c987's (main's pin) was uploaded on 2026-10-26 from the build #1359 pinned; abf0921's was rebuilt on Modal and reproduced the pin byte for byte |
+| NTS 2002-2024 (5 tabs) | `policyengine-uk-data-private` `nts_2002_24.zip` @ `559b69e9` | fetched, every member matches its pin |
+| LCFS 2024-25 (2 tabs) | `policyengine-uk-data-private` `lcfs_2024_25.zip` @ `11051052` (a repack of the extracted files) | fetched, every member matches its pin |
+
+### NTS and LCFS
+
+Both were uploaded once by a UKDS licence holder (2026-10-25) and are pinned
+by revision and archive sha256 in `tools/uk_cut_inputs.json`:
+
+- `nts_2002_24.zip` is the UK Data Service TAB download of SN 5340 (19th
+  edition), unchanged.
+- `lcfs_2024_25.zip` (SN 9603, 2nd edition, TAB) is a repack of the
+  extracted files: all seven tabs and the two mrdoc workbooks, under
+  `lcfs_2024_25/`. The original download zip was no longer available.
+
+The runner finds each tab by name inside the zip and checks it against its
+pin, so the folder layout inside does not matter. To check both without
+building anything:
+
+```bash
+uv run --no-sync python tools/run_uk_cut.py fetch --only nts_2002_2024 --only lcfs_2024_25
+```
+
+A tab that differs from its pin is refused by name: that upload is a
+different edition from the one the build was reviewed against. A
+re-upload needs its new revision and archive sha256 pinned in
+`tools/uk_cut_inputs.json`.
+
+### Rebuilding the Chronicle artifact
+
+The UK feed is built from the public Chronicle repository. It reads its
+committed source files plus two DESNZ workbooks, which it fetches from the
+publisher by pinned sha256 (`LEDGER_SOURCE_ARTIFACT_FETCH=1`). No R2
+credentials are needed. The bundle needs tens of gigabytes, so it runs on
+Modal:
+
+```bash
+python tools/modal_rebuild_uk_chronicle_artifact.py                          # plan, sends nothing
+HF_TOKEN=… MICROCOSM_UK_CHRONICLE_MODAL_UPLOAD=1 \
+  modal run --detach tools/modal_rebuild_uk_chronicle_artifact.py --build --upload   # rebuild and host
+```
+
+The artifact is uploaded under `chronicle-uk/<commit>/` only when both of its
+digests match `chronicle_feed.json`. The 2026-10-22 rebuild reproduced both
+(bundle 2h24m, artifact 30 min, peak memory 35.5 GB). Otherwise only the receipt and the bundle
+reports go to `diagnostic/`, so the difference can be traced. `modal run`
+creates the app before its entrypoint runs, so the token, which can write to
+the private repositories, is attached only with
+`MICROCOSM_UK_CHRONICLE_MODAL_UPLOAD=1`. It then goes to Modal as an
+ephemeral secret for that run; no named workspace secret keeps it. A rebuild
+without `--upload` sends no credential at all.
+
+### Regenerating the input-mass reference
+
+The certifier binds the reference by a canonical digest of its identity and
+totals. The emitted column set follows the installed policyengine-uk.
+Today's engine adds `bus_fare_spending` and `sic_industry_division`. That
+changes the digest, though all 131 shared totals are identical. Reproduce the
+pinned file (`fd41cb5f…`) at the commit that pinned it:
+
+```bash
+git worktree add --detach ../mc-0eac9bbbd 0eac9bbbd && cd ../mc-0eac9bbbd
+uv sync --all-packages --locked --extra uk        # policyengine-uk 2.89.0
+uv run --no-sync python tools/build_uk_efrs_parity_reference.py \
+  --input-h5 <enhanced_frs_2024_25.h5 @ a9e52499> --emit-weighted-totals <outside the repo>.json
+```
+
+The hosted copy's receipt records this recipe.
+
+## Signing keys
+
+Gate reports, release-cut certifications and dense gate reports are signed
+with HMAC-SHA256. Verification now also requires the key's fingerprint to be
+registered in `microcosm.data.gate_signing_keys`. Before this, any key that
+signed a report also verified it.
+
+Each registered key has a status:
+
+- **active**: signs and verifies.
+- **retired**: verifies the cuts it already signed, but signs nothing new.
+- **revoked**: does neither.
+
+Every UK signer refuses an unregistered or retired key:
+
+- the gate battery;
+- the certifier;
+- the scoped re-signer;
+- the national role, which checks before it loads any input. Before, a
+  missing key failed only after the solve.
+
+HMAC verification needs the secret that signed. So a cut is signed,
+certified and published by one key holder, and the registry holds one key
+per builder rather than one shared secret. The runner holds a cut to that:
+its preflight refuses to resume a cut under any key but the one its signed
+reports name (`attestation.signing_key_sha256`), and `cut_receipt.json`
+records that signer, whoever resumed it.
+
+| Label | Fingerprint | Held by | Status |
+|---|---|---|---|
+| `uk-gate-juaristi22-2026` | `66bf0e29…` | María Juaristi's build machine | active; signed every cut on record |
+| `uk-gate-team-2026` | `dd31e325…` | Max Ghenis: agent-secret `microcosm/uk-gate-signing-key-team` on his build Mac, readable by agent sessions on that Mac | active |
+| `uk-gate-vahid-ahmadi-2026` | `e9ab40bd…` | Vahid Ahmadi: his laptop's login keychain, service `microcosm-uk-gate-signing-key` | active |
+
+**Add a builder or rotate a key.**
+
+1. On macOS, run `uv run --no-sync python -m microcosm.data.gate_signing_keys
+   generate --keychain-service microcosm-uk-gate-signing-key`. It stores the
+   key in your login keychain through `security -i` on stdin, so the key is
+   in no process list, reads it back, and prints only its fingerprint. It
+   never replaces an item that is already there. Elsewhere, pipe
+   `generate`'s stdout straight into a secret store: it refuses to print a
+   key to a terminal, where scrollback and agent transcripts would keep it.
+2. Never commit, post or print the key.
+3. Open a pull request that adds the fingerprint as `active`.
+4. To rotate, store the new key under a new `--keychain-service` name, so
+   the old key stays held. Then set the old entry to `retired` with a
+   `retired_on` date, in the same or a later PR. Its cuts still verify, but
+   only for someone who still holds that key.
+
+A key stored this way is readable, with no prompt, by any process running
+as your user that asks `security find-generic-password -w`, which is how the
+recipes above read it. The login keychain, like Max's agent store, shields
+the key from other users, not from your own agent sessions.
+
+**Revoke a leaked key.** Set it to `revoked`. Every cut it signed then fails
+verification, so re-sign or withdraw those cuts.
+
+**What the signature does not prove.** The reports are signed with HMAC,
+which is symmetric, so:
+
+- Verifying a cut needs the secret that signed it, and whoever can verify
+  can also sign. A "certified" cut is its key holder vouching for their own
+  reports. policyengine.py and anyone downstream rely on Hugging Face write
+  access to the private repositories and on this reviewed registry, not on
+  a signature they can check themselves.
+- Retiring a key stops the registry's checks from accepting new signatures
+  from it, but `retired_on` is only recorded: whoever still holds a retired
+  key can mint reports that verify.
+- Revocation binds only checkouts and wheels that include the revoking
+  commit.
+
+A public-key scheme (Ed25519) would let the registry hold public keys and
+anyone verify; that is tracked in microcosm#1406.
+
+## Certifying into policyengine.py
+
+```bash
+uv run --no-sync python tools/certify_uk_cut_in_policyengine_py.py \
+  --national-tag microcosm-uk-2024-25-national-<ts>-<id> \
+  (--dense-tag <tag> | --keep-regional-release | --area-coded-national-uri <uri> | --drop-regional-release) \
+  --pepy-repo <your clone of PolicyEngine/policyengine.py> \
+  [--max-load1 <load>] [--min-free-gb <GB>] [--push --open-pr]
+```
+
+Each heavy step first checks the host. The disk floor defaults to 55 GB
+(`--min-free-gb`). There is no load limit unless you set one with
+`--max-load1`, because a sensible limit depends on the machine.
+
+For an accepted mismatch (see [Regions](#regions-the-dense-cut)), add
+`--accept-regional-model-mismatch "<who accepted it and why>"`,
+`--audited-by "<who ran the audit>"` (it appears in policyengine.py's public
+bundle) and at least one `--regional-limitation "<text>"`. The base needs
+policyengine.py#699's audit, and a base without it refuses before anything
+is downloaded. Until #699 merges, test the route with `--base-ref
+origin/accept-regional-model-mismatch --pr-base accept-regional-model-mismatch`.
+The audit and `certify-data` also need `uv` and PyPI: both read the build
+model through a pinned `uv` probe, and `certify-data` re-reads both models
+rather than trusting the evidence's lists.
+
+The certification commit and the pull request body credit nobody but the
+git identity that commits. An agent session adds its own credit:
+`--co-author "Claude Opus 5.5 <noreply@anthropic.com>"` (repeatable) for the
+commit trailer, and `--pr-body-footer "🤖 Generated with [Claude Code](https://claude.com/claude-code)"`
+for the body.
+
+The script does the mechanical part of what policyengine.py#685 did by hand,
+on a new branch from policyengine.py's main.
+
+**Before writing anything:**
+
+- It refuses if another writer is already certifying the cut: an open pull
+  request that names the tag, or any open pull request or branch whose name
+  contains `certify-uk-<id>`, including suffixed ones such as
+  `certify-uk-a133f37a-national`. If it cannot read either listing, it
+  refuses rather than passing.
+- It reads both manifests at their tags.
+- It refuses a regional cut built on another policyengine-uk, naming the
+  routes.
+
+**Then:**
+
+1. `certify-data` at the cut's own model and core.
+2. `uv lock` and `release_lock.py`.
+3. `generate --include-tros`.
+4. policyengine.py's own certified-constant rewrite, plus the local-area tag.
+5. The household snapshots.
+6. `check --published-spm --include-tros --strict-tros`.
+7. The UC floor.
+8. The tests.
+
+It commits. It pushes and opens a draft only when asked. The pull request
+body lists what needs a person: the UC floor acceptance, any dataset overlays
+certification dropped, warnings and failing tests.
+
+## Regions: the dense cut
+
+policyengine.py routes constituency and local-authority runs only to a dense
+cut that covers the certified policyengine-uk. A dense build takes hours, and
+its two-build sign-off longer, so a national cut can move to a newer
+policyengine-uk before a dense cut on that version exists. There are four
+routes:
+
+1. **Ship together.** Build a dense cut on the same version. This is correct
+   but slow, and it needs the atomic-support files that only María holds.
+   The policyengine-uk 2.151.0 pair (national `a6299504`, dense `c9df4b86`)
+   went this way.
+2. **Accept the older dense cut, recorded as a mismatch.** policyengine.py
+   accepts this only with audited evidence (policyengine.py#699).
+   - Area receipts are already uncertified: the certificate covers the
+     national dataset only (policyengine.py#685).
+   - policyengine-uk loads an older file under a newer model, skipping
+     stored columns the model no longer defines. Inputs added since the
+     build model default in area runs, and the mismatch record lists them.
+3. **Drop routing.** sim-api then cannot serve the UK default's constituency
+   and local-authority runs.
+4. **An enhanced-FRS release that claims the version.** This needs a new
+   uk-data release on Max's go.
+
+**Measured cost of route 2.** This is measured on the 2.132.6 dense file's
+own columns (2026-10-23), under policyengine-uk 2.147.2. The UK hub's
+rehearsal probe agrees.
+
+- No stored column is dropped on load.
+- `pip_dl_category` and `pip_m_category` became formulas in 2.144.0, but the
+  file's stored values still load.
+- 16 inputs take their defaults in area runs, where the build model computed
+  them or did not have them:
+  - `salary_sacrifice_returned_to_income` and `local_bus_uncapped_single_fare`;
+  - the property flags and debts (`additional_residential_property_purchased`,
+    `non_residential_property_purchased`, `non_residential_property_secured_debt`,
+    `other_residential_property_secured_debt`);
+  - pension inputs (`defined_benefit_pension_share`,
+    `pension_annual_allowance_taxable_lump_sum_death_benefits`,
+    `pension_contributions_via_salary_sacrifice_pre_2015`);
+  - `directly_held_shares`, `unit_and_investment_trusts`,
+    `early_years_school_start_deferred`, `is_full_year_category_a_director`
+    and `war_widows_pension_reported`;
+  - `pip_dl_points` and `pip_m_points`, unused while the stored categories load.
+- National figures are unaffected. An area breakdown of a reform that works
+  through any of these inputs would be wrong.
+- `tools/certify_uk_cut_in_policyengine_py.py` measures this whenever a
+  mismatch is accepted, with policyengine.py's own audit:
+  - it downloads every regional microdata H5 at its manifest pin and checks
+    its sha256;
+  - in the certification worktree it installs the target policyengine-uk
+    and core, and runs `scripts/audit_regional_input_surface.py`, which reads
+    only column names and measures them against the regional cut's build
+    model (from its manifest) and the target model;
+  - it refuses evidence that is not build-relative (schema 2) or that drops
+    a stored column, and passes the evidence to `certify-data`.
+
+  The pull request lists the defaulted inputs, the count of stored columns
+  neither model defines (recorded only, such as the area codes) and the
+  recorded limitations. There is no override for a dropped column.
+
+Routes 3 and 4 are not recommended. Which route a cut takes is María's
+call.
diff --git a/packages/microcosm-build/src/microcosm/build/gate_battery.py b/packages/microcosm-build/src/microcosm/build/gate_battery.py
index 0a75277c90..bddda6c93a 100644
--- a/packages/microcosm-build/src/microcosm/build/gate_battery.py
+++ b/packages/microcosm-build/src/microcosm/build/gate_battery.py
@@ -62,6 +62,7 @@
     weights_audit_gate,
 )
 from microcosm.build.trace import compute_composition_fingerprint
+from microcosm.data.gate_signing_keys import require_registered_gate_signing_key
 from microcosm.frame import Frame
 
 __all__ = [
@@ -155,7 +156,9 @@ def _signing_key(country: str) -> bytes:
         raise RuntimeError(f"{env} must be valid base64.") from exc
     if len(key) != 32:
         raise RuntimeError(f"{env} must decode to exactly 32 bytes.")
-    return key
+    # A key the committed registry does not let sign would produce reports
+    # no verifier accepts; refuse it here so the report says why.
+    return require_registered_gate_signing_key(country, key, purpose="sign")
 
 
 def _json_safe(value: object) -> object:
diff --git a/packages/microcosm-build/src/microcosm/build/uk_runtime/calibration_run.py b/packages/microcosm-build/src/microcosm/build/uk_runtime/calibration_run.py
index 6298dbc81e..3c2dc7f058 100644
--- a/packages/microcosm-build/src/microcosm/build/uk_runtime/calibration_run.py
+++ b/packages/microcosm-build/src/microcosm/build/uk_runtime/calibration_run.py
@@ -51,6 +51,7 @@
     uk_time_period,
 )
 from microcosm.calibrate import TargetRegistry
+from microcosm.data.gate_signing_keys import require_registered_gate_signing_key
 from microcosm.frame import Frame
 
 _REPOSITORY = Path(__file__).resolve().parents[6]
@@ -1003,6 +1004,7 @@ def resign_uk_gate_report(payload: dict[str, object]) -> None:
         raise RuntimeError(f"{env} must be valid base64.") from exc
     if len(key) != 32:
         raise RuntimeError(f"{env} must decode to exactly 32 bytes.")
+    require_registered_gate_signing_key("uk", key, purpose="sign")
     attestation.pop("signing_error", None)
     attestation["signing_key_sha256"] = hashlib.sha256(key).hexdigest()
     attestation["signature"] = None
diff --git a/packages/microcosm-build/src/microcosm/build/uk_runtime/full_build_cli.py b/packages/microcosm-build/src/microcosm/build/uk_runtime/full_build_cli.py
index 834d4ded51..76df2238b0 100644
--- a/packages/microcosm-build/src/microcosm/build/uk_runtime/full_build_cli.py
+++ b/packages/microcosm-build/src/microcosm/build/uk_runtime/full_build_cli.py
@@ -3588,6 +3588,7 @@ def _national_attempt(
         # These checks must precede input loading. The emitter is already
         # running so a refusal is visible as a failed attempt.
         refuse_occupied_national_output(args)
+        national_role.require_signing_key()
         preflight_staged_dataset(args)
         predecessor = resolve_predecessor(args.logbook_prev_row_digest)
         telemetry = create_staging_run_bundle(args, build_id=state.build_id)
diff --git a/packages/microcosm-build/src/microcosm/build/uk_runtime/national_role.py b/packages/microcosm-build/src/microcosm/build/uk_runtime/national_role.py
index 5ffc89ce7b..e52e1b2656 100644
--- a/packages/microcosm-build/src/microcosm/build/uk_runtime/national_role.py
+++ b/packages/microcosm-build/src/microcosm/build/uk_runtime/national_role.py
@@ -28,6 +28,7 @@
 import numpy as np
 import pandas as pd
 
+from microcosm.build.gate_battery import _signing_key
 from microcosm.build.logbook_adoption import atomic_write_json
 from microcosm.build.staging_dataset import (
     SHA256SUMS_FILENAME,
@@ -62,6 +63,7 @@
     "national_dry_run",
     "national_manifest",
     "require_bound_input",
+    "require_signing_key",
 ]
 
 
@@ -126,6 +128,24 @@ def require_bound_input(args: argparse.Namespace) -> None:
 _require_bound_input = require_bound_input
 
 
+def require_signing_key() -> None:
+    """Refuse a national build whose gate reports could not be signed.
+
+    The seam signs its terminal report only after the solve, so a missing,
+    malformed or unregistered key used to surface 25-40 minutes in, as
+    "unsigned full-scale calibration runs refuse to stage". Check it before
+    any input is read.
+    """
+
+    try:
+        _signing_key("uk")
+    except RuntimeError as error:
+        raise ValueError(
+            "--release-role national signs its gate reports and needs a "
+            f"registered UK gate signing key: {error}"
+        ) from error
+
+
 def national_dry_run(
     args: argparse.Namespace,
     *,
diff --git a/packages/microcosm-build/src/microcosm/build/uk_runtime/release_certification.py b/packages/microcosm-build/src/microcosm/build/uk_runtime/release_certification.py
index 9785ca34e8..fc637ab561 100644
--- a/packages/microcosm-build/src/microcosm/build/uk_runtime/release_certification.py
+++ b/packages/microcosm-build/src/microcosm/build/uk_runtime/release_certification.py
@@ -61,6 +61,10 @@
     uk_cgt_projection_read_from_engine,
 )
 from microcosm.build.uk_runtime.terminal_gates import uk_export_candidate_columns
+from microcosm.data.gate_signing_keys import (
+    GateSigningKeyError,
+    require_registered_gate_signing_key,
+)
 
 __all__ = [
     "UK_RELEASE_CERTIFICATION_KIND",
@@ -584,7 +588,12 @@ def _require_signing_key() -> bytes:
         raise UKReleaseCertificationError(
             f"{env_name} must decode to exactly 32 bytes."
         )
-    return key
+    # The certifier verifies every part and signs the certification with
+    # this one key, so it must be a registered key that may still sign.
+    try:
+        return require_registered_gate_signing_key("uk", key, purpose="sign")
+    except GateSigningKeyError as exc:
+        raise UKReleaseCertificationError(f"{env_name}: {exc}") from exc
 
 
 def _verify_part(
diff --git a/packages/microcosm-build/tests/engine_free/uk/test_certify_uk_cut_in_policyengine_py.py b/packages/microcosm-build/tests/engine_free/uk/test_certify_uk_cut_in_policyengine_py.py
new file mode 100644
index 0000000000..b4d124b368
--- /dev/null
+++ b/packages/microcosm-build/tests/engine_free/uk/test_certify_uk_cut_in_policyengine_py.py
@@ -0,0 +1,641 @@
+"""The policyengine.py certification handoff: routing, guards and rewrites."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import subprocess
+
+import pytest
+from hypothesis import given, settings
+from hypothesis import strategies as st
+
+from tools import certify_uk_cut_in_policyengine_py as handoff
+
+NATIONAL = "microcosm-uk-2024-25-national-20261021T195620Z-a858c100"
+DENSE = "microcosm-uk-2024-25-dense-20261019T000432Z-ee5c2dbe"
+NEW_DENSE = "microcosm-uk-2024-25-dense-20261026T010203Z-0badc0de"
+
+
+def test_only_cut_tags_are_certified():
+    assert handoff.check_tag(NATIONAL, "national") == NATIONAL
+    for bad in ("main", NATIONAL + "x", DENSE, "microcosm-uk-2024-25-national"):
+        with pytest.raises(handoff.CertifyError, match="never @main"):
+            handoff.check_tag(bad, "national")
+
+
+@pytest.mark.parametrize(
+    ("model", "claims", "version", "covered"),
+    [
+        ("2.134.4", ("==2.134.4",), "2.134.4", True),
+        ("2.132.6", ("==2.132.6",), "2.134.4", False),
+        ("2.132.6", ("==2.132.6", "==2.134.4"), "2.134.4", True),
+    ],
+)
+def test_coverage_is_built_with_or_an_exact_claim(model, claims, version, covered):
+    cut = handoff.CutVersions(tag=DENSE, model=model, core="3.33.3", claims=claims)
+    assert handoff.covers(cut, version) is covered
+
+
+def _args(**kwargs):
+    base = dict(
+        dense_tag=None,
+        keep_regional_release=False,
+        area_coded_national_uri=None,
+        drop_regional_release=False,
+    )
+    return argparse.Namespace(**{**base, **kwargs})
+
+
+def test_each_route_produces_its_certify_data_flags():
+    record = {"regional_source_manifest_uri": handoff.manifest_uri(DENSE, "x")}
+    dense = handoff.regional_flags(_args(dense_tag=NEW_DENSE), record)
+    assert dense[0] == "--regional-manifest-uri" and f"@{NEW_DENSE}/" in dense[1]
+    assert handoff.regional_tag(dense) == NEW_DENSE
+    kept = handoff.regional_flags(_args(keep_regional_release=True), record)
+    assert kept == ["--regional-manifest-uri", record["regional_source_manifest_uri"]]
+    area = handoff.regional_flags(_args(area_coded_national_uri="hf://model/x@1/r"), {})
+    assert area[-2:] == ["--regional-release-kind", "area_coded_national"]
+    assert handoff.regional_tag(area) is None
+    dropped = handoff.regional_flags(_args(drop_regional_release=True), record)
+    assert dropped == ["--drop-regional-release"]
+    with pytest.raises(handoff.CertifyError, match="no regional release"):
+        handoff.regional_flags(_args(keep_regional_release=True), {})
+
+
+def test_routes_are_mutually_exclusive_and_required():
+    repo = ["--pepy-repo", "pepy"]
+    with pytest.raises(SystemExit):
+        handoff.parse(["--national-tag", NATIONAL, *repo])
+    with pytest.raises(SystemExit):
+        handoff.parse(
+            [
+                "--national-tag",
+                NATIONAL,
+                "--dense-tag",
+                DENSE,
+                "--drop-regional-release",
+                *repo,
+            ]
+        )
+    with pytest.raises(SystemExit):
+        handoff.parse(
+            ["--national-tag", NATIONAL, "--drop-regional-release", "--open-pr", *repo]
+        )
+    # The policyengine.py clone is the operator's to name; no machine's layout.
+    with pytest.raises(SystemExit):
+        handoff.parse(["--national-tag", NATIONAL, "--drop-regional-release"])
+
+
+def test_the_regional_tag_is_rewritten_only_as_a_literal(tmp_path):
+    for relative in handoff.CONSTANT_FILES:
+        path = tmp_path / relative
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text(
+            f'A = "{DENSE}"\nB = "hf://x@{DENSE}/releases/r.json"\n'
+            f"# {DENSE} in a comment stays\nC = 'x{DENSE}'\n"
+        )
+    changed = handoff.rewrite_regional_constants(tmp_path, DENSE, NEW_DENSE)
+    assert sorted(changed) == sorted(handoff.CONSTANT_FILES)
+    text = (tmp_path / handoff.CONSTANT_FILES[0]).read_text()
+    assert f'A = "{NEW_DENSE}"' in text
+    assert f"@{NEW_DENSE}/releases" in text
+    assert f"# {DENSE} in a comment stays" in text
+    assert handoff.rewrite_regional_constants(tmp_path, DENSE, DENSE) == []
+
+
+@given(
+    old=st.from_regex(r"[a-z0-9.\-]{3,20}", fullmatch=True),
+    new=st.from_regex(r"[a-z0-9.\-]{3,20}", fullmatch=True),
+)
+@settings(deadline=None)  # This property performs file I/O on a shared build host.
+def test_the_rewrite_is_a_bijection_on_literals(tmp_path_factory, old, new):
+    """Rewriting old->new then new->old restores a file of quoted literals."""
+
+    if old == new or old in new or new in old:
+        return
+    root = tmp_path_factory.mktemp("constants")
+    original = f'X = "{old}"\nY = "@{old}/"\n'
+    for relative in handoff.CONSTANT_FILES:
+        path = root / relative
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text(original)
+    handoff.rewrite_regional_constants(root, old, new)
+    handoff.rewrite_regional_constants(root, new, old)
+    for relative in handoff.CONSTANT_FILES:
+        assert (root / relative).read_text() == original
+
+
+def test_dropped_overlays_are_reported():
+    old = {"dataset_overlays": {"uk": {"frs_2024_25": {}, "enhanced_frs_2024_25": {}}}}
+    new = {"dataset_overlays": {"uk": {"frs_2024_25": {}}}}
+    assert handoff.overlay_diff(old, new) == ["enhanced_frs_2024_25"]
+    assert handoff.overlay_diff({}, {}) == []
+
+
+def test_the_pr_body_leaves_every_judgment_to_a_person():
+    body = handoff.pr_body(
+        {
+            "national_tag": NATIONAL,
+            "model": "2.134.4",
+            "core": "3.33.3",
+            "regional_summary": "`--drop-regional-release`",
+            "basis": "built_with_model_package",
+            "microcosm_commit": "a" * 40,
+            "commands": ["python scripts/bundle.py certify-data ..."],
+            "dropped_overlays": ["enhanced_frs_2024_25"],
+            "warnings": ["regional release: certifying on a claim"],
+            "tests_failed": ["tests/test_models.py::test_x"],
+            "uc_floor_passed": False,
+        }
+    )
+    for needed in (
+        "UC floor acceptance",
+        "enhanced_frs_2024_25",
+        "Certification warnings",
+        "tests/test_models.py::test_x",
+        "One writer",
+        "- [ ]",
+    ):
+        assert needed in body
+
+
+MISMATCH = [
+    "--accept-regional-model-mismatch",
+    "area receipts are uncertified (#685)",
+    "--audited-by",
+    "A Reviewer",
+    "--regional-limitation",
+    "VAT predates the factor fix",
+]
+
+
+def _dense_route(monkeypatch, tmp_path, *, audit_support=None):
+    """A national cut on 2.134.4 and a regional cut on 2.132.6, offline."""
+
+    cuts = {
+        NATIONAL: handoff.CutVersions(NATIONAL, "2.134.4", "3.33.3", ("==2.134.4",)),
+        DENSE: handoff.CutVersions(DENSE, "2.132.6", "3.33.3", ("==2.132.6",)),
+    }
+    monkeypatch.setattr(handoff, "read_cut", lambda tag, release: cuts[tag])
+    monkeypatch.setattr(handoff, "writer_check", lambda tag, repo: [])
+    monkeypatch.setattr(
+        handoff, "regional_audit_support", lambda repo, base: audit_support
+    )
+    downloads = []
+    monkeypatch.setattr(
+        handoff,
+        "fetch_regional_microdata",
+        lambda tag, release, **kw: downloads.append(tag) or {},
+    )
+    monkeypatch.setattr(
+        handoff.subprocess,
+        "run",
+        lambda *a, **k: handoff.subprocess.CompletedProcess(a, 0, "", ""),
+    )
+    bundle = (
+        '{"data_releases": {"uk": {"regional_source_manifest_uri": '
+        f'"{handoff.manifest_uri(DENSE, handoff.DENSE_RELEASE)}"}}}}}}'
+    )
+
+    def check_output(argv, **kwargs):
+        if argv[:2] == ["git", "show"]:
+            return bundle
+        if argv == ["git", "rev-parse", "HEAD"]:
+            return "a" * 40
+        return "b" * 40
+
+    monkeypatch.setattr(handoff.subprocess, "check_output", check_output)
+    return downloads
+
+
+def test_a_dry_run_refuses_an_uncovered_dense_cut_before_writing(monkeypatch, tmp_path):
+    downloads = _dense_route(monkeypatch, tmp_path)
+    base = ["--national-tag", NATIONAL, "--keep-regional-release", "--dry-run",
+            "--pepy-repo", str(tmp_path)]  # fmt: skip
+    with pytest.raises(
+        handoff.CertifyError, match="built with policyengine-uk 2.132.6"
+    ):
+        handoff.certify(handoff.parse(base))
+    # An accepted mismatch plans the audit; a dry run downloads nothing.
+    assert handoff.certify(handoff.parse([*base, *MISMATCH])) == 0
+    assert downloads == []
+    another = handoff.parse(
+        ["--national-tag", NATIONAL, "--dense-tag", DENSE, "--dry-run",
+         "--pepy-repo", str(tmp_path)]
+    )  # fmt: skip
+    monkeypatch.setattr(handoff, "writer_check", lambda tag, repo: ["#700 open"])
+    with pytest.raises(handoff.CertifyError, match="already being certified"):
+        handoff.certify(another)
+
+
+def test_a_base_without_the_audit_refuses_before_any_download(monkeypatch, tmp_path):
+    downloads = _dense_route(
+        monkeypatch, tmp_path, audit_support=f"it has no {handoff.AUDIT_SCRIPT}"
+    )
+    args = handoff.parse(
+        ["--national-tag", NATIONAL, "--keep-regional-release",
+         "--pepy-repo", str(tmp_path), "--skip-tests", *MISMATCH]
+    )  # fmt: skip
+    with pytest.raises(handoff.CertifyError, match="policyengine.py#699"):
+        handoff.certify(args)
+    assert downloads == []
+
+
+@pytest.mark.parametrize(
+    "drop",
+    [
+        ["--audited-by", "A Reviewer"],
+        ["--regional-limitation", "VAT predates the factor fix"],
+    ],
+)
+def test_an_accepted_mismatch_needs_an_auditor_and_a_limitation(drop):
+    flags = list(MISMATCH)
+    index = flags.index(drop[0])
+    del flags[index : index + 2]
+    with pytest.raises(SystemExit):
+        handoff.parse(
+            ["--national-tag", NATIONAL, "--keep-regional-release",
+             "--pepy-repo", "p", *flags]
+        )  # fmt: skip
+    with pytest.raises(SystemExit):
+        handoff.parse(
+            ["--national-tag", NATIONAL, "--keep-regional-release",
+             "--pepy-repo", "p", *drop]
+        )  # fmt: skip
+
+
+@pytest.mark.parametrize("flag", MISMATCH[0::2])
+@pytest.mark.parametrize("text", ["   ", "\u200b"])
+def test_a_mismatch_needs_readable_text_in_every_field(flag, text):
+    """policyengine.py refuses these later; refuse them before any work."""
+
+    flags = list(MISMATCH)
+    flags[flags.index(flag) + 1] = text
+    with pytest.raises(SystemExit):
+        handoff.parse(
+            ["--national-tag", NATIONAL, "--keep-regional-release",
+             "--pepy-repo", "p", *flags]
+        )  # fmt: skip
+    assert handoff.readable("ok") and not handoff.readable(text)
+
+
+def test_the_audit_support_check_reads_the_base(monkeypatch, tmp_path):
+    answers = {"cat-file": 0, "grep": 0}
+
+    def run(argv, **kwargs):
+        assert argv[0] == "git" and kwargs["cwd"] == tmp_path
+        return handoff.subprocess.CompletedProcess(argv, answers[argv[1]], b"", b"")
+
+    monkeypatch.setattr(handoff.subprocess, "run", run)
+    assert handoff.regional_audit_support(tmp_path, "c" * 40) is None
+    answers["grep"] = 1
+    assert "--regional-input-surface-evidence" in handoff.regional_audit_support(
+        tmp_path, "c" * 40
+    )
+    answers["cat-file"] = 128
+    assert handoff.AUDIT_SCRIPT in handoff.regional_audit_support(tmp_path, "c" * 40)
+
+
+def test_every_regional_microdata_file_is_fetched_and_checked(monkeypatch, tmp_path):
+    import hashlib
+    import sys
+    import types
+
+    files = {"dense.h5": b"dense", "other.H5": b"other", "notes.csv": b"csv"}
+    for name, data in files.items():
+        (tmp_path / name).write_bytes(data)
+    manifest = {
+        "artifacts": {
+            "microcosm_uk_2024_25_dense": {
+                "kind": "microdata", "path": "dense.h5", "revision": "r1",
+                "sha256": hashlib.sha256(b"dense").hexdigest(),
+            },
+            "second": {
+                "kind": "microdata", "path": "other.H5", "revision": "r2",
+                "sha256": hashlib.sha256(b"other").hexdigest(),
+            },
+            "table": {"kind": "microdata", "path": "notes.csv", "revision": "r3",
+                      "sha256": "0" * 64},
+            "receipt": {"kind": "evidence", "path": "dense.h5", "revision": "r4",
+                        "sha256": "0" * 64},
+        }
+    }  # fmt: skip
+    (tmp_path / "release_manifest.json").write_text(json.dumps(manifest))
+
+    def download(repo, path, **kwargs):
+        name = path.rsplit("/", 1)[-1]
+        return str(
+            tmp_path / ("release_manifest.json" if name.endswith(".json") else name)
+        )
+
+    monkeypatch.setitem(
+        sys.modules, "huggingface_hub", types.SimpleNamespace(hf_hub_download=download)
+    )
+    found = handoff.fetch_regional_microdata(
+        DENSE, handoff.DENSE_RELEASE, timings=tmp_path / "t.jsonl"
+    )
+    assert found == {
+        "microcosm_uk_2024_25_dense": tmp_path / "dense.h5",
+        "second": tmp_path / "other.H5",
+    }
+    (tmp_path / "other.H5").write_bytes(b"changed")
+    with pytest.raises(handoff.CertifyError, match="not the manifest's"):
+        handoff.fetch_regional_microdata(
+            DENSE, handoff.DENSE_RELEASE, timings=tmp_path / "t.jsonl"
+        )
+
+
+def test_the_audit_argv_passes_every_file_and_limitation(tmp_path):
+    argv = handoff.regional_audit_argv(
+        "py",
+        manifest_uri="hf://x",
+        artifacts={"b": tmp_path / "b.h5", "a": tmp_path / "a.h5"},
+        model="2.147.2",
+        audited_by="A Reviewer",
+        limitations=["one", "two"],
+        output=tmp_path / "evidence.json",
+    )
+    assert argv[:4] == ["py", handoff.AUDIT_SCRIPT, "--regional-manifest-uri", "hf://x"]
+    assert argv.count("--artifact") == 2 and argv.count("--limitation") == 2
+    assert argv[argv.index("--artifact") + 1] == f"a={tmp_path / 'a.h5'}"
+    assert argv[-2:] == ["--output", str(tmp_path / "evidence.json")]
+    help_text = "usage: --regional-manifest-uri --artifact --model-version --output"
+    assert handoff.undeclared_flags(help_text, argv) == ["--audited-by", "--limitation"]
+
+
+GOOD_EVIDENCE = {
+    "schema_version": 2,
+    "model_version": "2.147.2",
+    "build_model_version": "2.132.6",
+    "dropped_columns": [],
+    "defaulted_inputs": ["local_bus_uncapped_single_fare"],
+    "never_modelled_columns": ["constituency_code_oa"],
+    "audited_by": "A Reviewer",
+    "limitations": ["VAT predates the factor fix"],
+}
+
+
+@pytest.mark.parametrize(
+    "changes, message",
+    [
+        ({"schema_version": 1}, "target model only"),
+        ({"model_version": "2.151.0"}, "model_version"),
+        ({"build_model_version": "2.144.0"}, "build_model_version"),
+        ({"dropped_columns": ["age"]}, "would lose them: age"),
+    ],
+)
+def test_only_build_relative_drop_free_evidence_is_used(tmp_path, changes, message):
+    path = tmp_path / "evidence.json"
+    path.write_text(json.dumps({**GOOD_EVIDENCE, **changes}))
+    with pytest.raises(handoff.CertifyError, match=message):
+        handoff.read_regional_evidence(path, model="2.147.2", build_model="2.132.6")
+
+
+def test_build_relative_evidence_is_read(tmp_path):
+    path = tmp_path / "evidence.json"
+    path.write_text(json.dumps(GOOD_EVIDENCE))
+    evidence = handoff.read_regional_evidence(
+        path, model="2.147.2", build_model="2.132.6"
+    )
+    assert evidence["defaulted_inputs"] == ["local_bus_uncapped_single_fare"]
+    with pytest.raises(handoff.CertifyError, match="no readable"):
+        handoff.read_regional_evidence(
+            tmp_path / "missing.json", model="2.147.2", build_model="2.132.6"
+        )
+
+
+def test_the_pr_body_lists_the_audited_area_input_surface():
+    body = handoff.pr_body(
+        {
+            "national_tag": NATIONAL,
+            "model": "2.147.2",
+            "core": "3.33.3",
+            "regional_summary": "`--keep-regional-release`",
+            "microcosm_commit": "a" * 40,
+            "commands": [],
+            "regional_evidence": {
+                "build_model_version": "2.132.6",
+                "audited_by": "A Reviewer",
+                "dropped_columns": [],
+                "defaulted_inputs": ["local_bus_uncapped_single_fare"],
+                "never_modelled_columns": ["constituency_code_oa", "la_code_oa"],
+                "limitations": ["VAT predates the factor fix"],
+            },
+        }
+    )
+    assert "built on 2.132.6, audited by A Reviewer" in body
+    assert "local_bus_uncapped_single_fare" in body
+    assert "2 stored columns neither model defines" in body
+    assert "VAT predates the factor fix" in body
+
+
+def test_the_resource_limits_are_the_operators_to_set(monkeypatch, tmp_path):
+    """No load limit unless the operator sets one; the disk floor is a default."""
+
+    monkeypatch.setattr(handoff.os, "getloadavg", lambda: (12.0, 0.0, 0.0))
+    args = handoff.parse(
+        ["--national-tag", NATIONAL, "--drop-regional-release", "--pepy-repo", "p"]
+    )
+    assert args.max_load1 is None
+    assert handoff.resource_guard(tmp_path, min_free_bytes=0)["load1"] == 12.0
+    assert handoff.resource_guard(tmp_path, max_load1=20, min_free_bytes=0)
+    with pytest.raises(handoff.CertifyError, match="maximum 8"):
+        handoff.resource_guard(tmp_path, max_load1=8, min_free_bytes=0)
+    shell = handoff.Shell(tmp_path, tmp_path / "run.log", max_load1=8, min_free_bytes=0)
+    spawned = []
+    monkeypatch.setattr(handoff, "run_logged", lambda *a, **k: spawned.append(a))
+    with pytest.raises(handoff.CertifyError, match="maximum 8"):
+        shell(["heavy"])
+    assert not spawned
+
+
+def _writer_listing(monkeypatch, *, prs=(), heads=(), ls_remote_code=0):
+    """Fake ``gh pr list`` and ``git ls-remote`` for the one-writer check."""
+
+    calls = []
+
+    def run(argv, **kwargs):
+        calls.append(argv)
+        if argv[:3] == ["gh", "pr", "list"]:
+            return subprocess.CompletedProcess(argv, 0, json.dumps(list(prs)), "")
+        lines = "".join(f"{'0' * 40}\trefs/heads/{head}\n" for head in heads)
+        return subprocess.CompletedProcess(argv, ls_remote_code, lines, "no access")
+
+    monkeypatch.setattr(handoff.subprocess, "run", run)
+    return calls
+
+
+@pytest.mark.parametrize(
+    "head",
+    [
+        "certify-uk-a858c100",
+        "certify-uk-a858c100-national",
+        "hub/certify-uk-a858c100",
+    ],
+)
+def test_any_branch_naming_the_cut_is_another_writer(monkeypatch, tmp_path, head):
+    _writer_listing(monkeypatch, heads=["main", head])
+    assert handoff.writer_check(NATIONAL, tmp_path) == [
+        f"branch {head} exists on origin"
+    ]
+
+
+def test_an_open_pull_request_naming_the_cut_is_another_writer(monkeypatch, tmp_path):
+    prs = [
+        {"number": 1, "title": "x", "body": "", "headRefName": "certify-uk-a858c100-b"},
+        {"number": 2, "title": f"Certify {NATIONAL}", "body": "", "headRefName": "y"},
+        {"number": 3, "title": "z", "body": f"uses {NATIONAL}", "headRefName": "z"},
+        {
+            "number": 4,
+            "title": "other",
+            "body": "",
+            "headRefName": "certify-uk-ffff0000",
+        },
+    ]
+    calls = _writer_listing(monkeypatch, prs=prs)
+    found = handoff.writer_check(NATIONAL, tmp_path)
+    assert [line.split()[0] for line in found] == ["#1", "#2", "#3"]
+    listing = calls[0]
+    assert listing[listing.index("--limit") + 1] == "1000"
+
+
+def test_another_cuts_branch_is_not_a_writer(monkeypatch, tmp_path):
+    _writer_listing(monkeypatch, heads=["certify-uk-ffff0000", "main"])
+    assert handoff.writer_check(NATIONAL, tmp_path) == []
+
+
+def test_an_unreadable_branch_listing_refuses(monkeypatch, tmp_path):
+    _writer_listing(monkeypatch, ls_remote_code=128)
+    with pytest.raises(handoff.CertifyError, match="could not list policyengine.py"):
+        handoff.writer_check(NATIONAL, tmp_path)
+
+
+GOOD_UC_RECEIPT = {
+    "check": "uk_uc_floor",
+    "passed": True,
+    "measures": [
+        {"name": "benefit_units", "ratio": 0.92, "passed": True},
+        {"name": "spend", "ratio": 0.96, "passed": True},
+    ],
+}
+
+
+def _with(**changes):
+    receipt = json.loads(json.dumps(GOOD_UC_RECEIPT))
+    receipt.update(changes)
+    return receipt
+
+
+def _with_measure(index, **changes):
+    receipt = _with()
+    receipt["measures"][index].update(changes)
+    return receipt
+
+
+@pytest.mark.parametrize(
+    "receipt",
+    [
+        [GOOD_UC_RECEIPT],
+        "uk_uc_floor",
+        None,
+        {key: value for key, value in GOOD_UC_RECEIPT.items() if key != "passed"},
+        _with(passed="true"),
+        _with(check="other"),
+        _with(measures={"benefit_units": 1}),
+        _with(measures=[["benefit_units", 1.0, True]]),
+        _with(measures=[*GOOD_UC_RECEIPT["measures"], {"ratio": 1.0, "passed": True}]),
+        _with(measures=[*GOOD_UC_RECEIPT["measures"], GOOD_UC_RECEIPT["measures"][0]]),
+        _with(measures=GOOD_UC_RECEIPT["measures"][:1]),
+        _with_measure(0, passed=None),
+        _with_measure(0, ratio=True),
+        _with_measure(0, ratio="0.9"),
+        _with_measure(0, ratio=10**400),
+        _with_measure(0, ratio=float("nan")),
+        _with_measure(0, passed=False),
+    ],
+)
+def test_an_incomplete_uc_floor_receipt_fails_operationally(receipt):
+    with pytest.raises(handoff.CertifyError, match="failed operationally"):
+        handoff.uc_floor_summary(receipt)
+
+
+def test_a_complete_uc_floor_receipt_summarizes_its_measures():
+    passed, summary = handoff.uc_floor_summary(GOOD_UC_RECEIPT)
+    assert passed is True
+    assert summary == (
+        "passed; measured/benchmark ratios: benefit_units=0.920000, spend=0.960000"
+    )
+
+
+_json = st.recursive(
+    st.none()
+    | st.booleans()
+    | st.integers()
+    | st.floats(allow_nan=True)
+    | st.text(max_size=12)
+    | st.sampled_from(["uk_uc_floor", "benefit_units", "spend"]),
+    lambda children: (
+        st.lists(children, max_size=4)
+        | st.dictionaries(
+            st.sampled_from(["check", "passed", "measures", "name", "ratio"]),
+            children,
+            max_size=5,
+        )
+    ),
+    max_leaves=20,
+)
+
+
+@settings(max_examples=300, deadline=None)
+@given(receipt=_json)
+def test_any_json_receipt_summarizes_or_fails_operationally(receipt):
+    try:
+        passed, summary = handoff.uc_floor_summary(receipt)
+    except handoff.CertifyError as error:
+        assert "failed operationally" in str(error)
+    else:
+        assert isinstance(passed, bool) and summary
+
+
+def test_the_certification_commit_credits_only_named_co_authors():
+    assert handoff.commit_message(NATIONAL) == f"Certify Microcosm UK cut {NATIONAL}"
+    message = handoff.commit_message(
+        NATIONAL, co_authors=["A Person <a@example.org>", "B <b@example.org>"]
+    )
+    assert message.splitlines()[2:] == [
+        "Co-Authored-By: A Person <a@example.org>",
+        "Co-Authored-By: B <b@example.org>",
+    ]
+
+
+@pytest.mark.parametrize(
+    "author", ["no email", "Name <a@b>\nCo-Authored-By: x <y@z>", "<a@b.org>"]
+)
+def test_a_co_author_must_be_one_name_and_email(author):
+    with pytest.raises(SystemExit):
+        handoff.parse(
+            [
+                "--national-tag",
+                NATIONAL,
+                "--drop-regional-release",
+                "--pepy-repo",
+                "p",
+                "--co-author",
+                author,
+            ]
+        )
+
+
+def test_the_pr_body_footer_is_the_operators_choice():
+    context = {
+        "national_tag": NATIONAL,
+        "model": "2.162.3",
+        "core": "3.33.3",
+        "regional_summary": "`--drop-regional-release`",
+        "microcosm_commit": "a" * 40,
+        "commands": [],
+    }
+    assert "Claude" not in handoff.pr_body(context)
+    footer = "🤖 Generated with [Claude Code](https://claude.com/claude-code)"
+    assert handoff.pr_body({**context, "footer": footer}).rstrip().endswith(footer)
diff --git a/packages/microcosm-build/tests/engine_free/uk/test_certify_uk_cut_rehearsal_regressions.py b/packages/microcosm-build/tests/engine_free/uk/test_certify_uk_cut_rehearsal_regressions.py
new file mode 100644
index 0000000000..5b2ae8c55d
--- /dev/null
+++ b/packages/microcosm-build/tests/engine_free/uk/test_certify_uk_cut_rehearsal_regressions.py
@@ -0,0 +1,818 @@
+"""Offline regression tests for the certification orchestration safeguards."""
+
+import faulthandler
+import io
+import json
+import os
+import subprocess
+import sys
+import tempfile
+import types
+import unittest
+from pathlib import Path
+from unittest.mock import Mock, patch
+
+from tools import certify_uk_cut_in_policyengine_py as runner
+
+TAG = "microcosm-uk-2024-25-national-20261023T075039Z-a133f37a"
+DENSE_TAG = "microcosm-uk-2024-25-dense-20261019T000432Z-ee5c2dbe"
+EVIDENCE = {
+    "schema_version": 2,
+    "model_version": "2.147.2",
+    "build_model_version": "2.132.6",
+    "dropped_columns": [],
+    "defaulted_inputs": ["local_bus_uncapped_single_fare"],
+    "never_modelled_columns": ["constituency_code_oa"],
+    "audited_by": "A Reviewer",
+    "limitations": ["VAT predates the factor fix"],
+}
+
+
+class RunnerTests(unittest.TestCase):
+    def test_hugging_face_token_is_explicit_and_not_logged(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            manifest = Path(tmp) / "manifest.json"
+            manifest.write_text(
+                json.dumps(
+                    {
+                        "build": {
+                            "cut_tag": TAG,
+                            "built_with_model_package": {"version": "2.147.2"},
+                            "built_with_core_package": {"version": "3.0"},
+                        }
+                    }
+                )
+            )
+            download = Mock(return_value=str(manifest))
+            with (
+                patch.dict(
+                    sys.modules,
+                    {
+                        "huggingface_hub": types.SimpleNamespace(
+                            hf_hub_download=download
+                        )
+                    },
+                ),
+                patch.dict(os.environ, {"HUGGING_FACE_TOKEN": "private-value"}),
+            ):
+                self.assertEqual(
+                    runner.read_cut(TAG, runner.NATIONAL_RELEASE).model, "2.147.2"
+                )
+            self.assertEqual(download.call_args.kwargs["token"], "private-value")
+
+    def test_shell_records_failed_commands(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            shell = runner.Shell(root, root / "run.log")
+            with (
+                patch.object(runner, "resource_guard", return_value={"load1": 1}),
+                patch.object(
+                    runner,
+                    "run_logged",
+                    return_value=subprocess.CompletedProcess(["false"], 2, "bad"),
+                ),
+            ):
+                with self.assertRaisesRegex(runner.CertifyError, "exited 2"):
+                    shell(["false"], step="failure")
+            record = json.loads(shell.timings.read_text())
+            self.assertEqual(record["step"], "failure")
+            self.assertEqual(record["returncode"], 2)
+            self.assertGreaterEqual(record["elapsed_seconds"], 0)
+
+    def test_pytest_bootstrap_preserves_arguments_and_exit_status(self):
+        arguments = ["tests/snapshot.py", "-q"]
+        argv = runner.pytest_command("python", arguments)
+        self.assertEqual(argv[:2], ["python", "-c"])
+        self.assertEqual(argv[3:], arguments)
+        for exit_status in (0, 4):
+            with self.subTest(exit_status=exit_status):
+                stream = Mock()
+                pytest = types.SimpleNamespace(main=Mock(return_value=exit_status))
+                with (
+                    patch.dict(sys.modules, {"pytest": pytest}),
+                    patch.object(sys, "argv", ["-c", *arguments]),
+                    patch.object(os, "dup", return_value=123) as duplicate,
+                    patch.object(os, "fdopen", return_value=stream) as opened,
+                    patch.object(faulthandler, "dump_traceback_later") as timer,
+                    patch.object(faulthandler, "cancel_dump_traceback_later") as cancel,
+                ):
+                    with self.assertRaises(SystemExit) as result:
+                        exec(argv[2], {})
+                self.assertEqual(result.exception.code, exit_status)
+                pytest.main.assert_called_once_with(arguments)
+                duplicate.assert_called_once_with(2)
+                opened.assert_called_once_with(123, "w")
+                timer.assert_called_once_with(300.0, repeat=True, file=stream)
+                cancel.assert_called_once_with()
+                stream.close.assert_called_once_with()
+
+    def test_pytest_bootstrap_cleans_up_after_pytest_exception(self):
+        stream = Mock()
+        pytest = types.SimpleNamespace(
+            main=Mock(side_effect=RuntimeError("pytest failed"))
+        )
+        argv = runner.pytest_command("python", ["tests/test_x.py"])
+        with (
+            patch.dict(sys.modules, {"pytest": pytest}),
+            patch.object(sys, "argv", ["-c", "tests/test_x.py"]),
+            patch.object(os, "dup", return_value=123),
+            patch.object(os, "fdopen", return_value=stream),
+            patch.object(faulthandler, "dump_traceback_later"),
+            patch.object(faulthandler, "cancel_dump_traceback_later") as cancel,
+        ):
+            with self.assertRaisesRegex(RuntimeError, "pytest failed"):
+                exec(argv[2], {})
+        cancel.assert_called_once_with()
+        stream.close.assert_called_once_with()
+
+    def test_guard_prevents_process_and_records_refusal(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            shell = runner.Shell(Path(tmp), Path(tmp) / "run.log")
+            with (
+                patch.object(
+                    runner,
+                    "resource_guard",
+                    side_effect=runner.CertifyError("resource guard"),
+                ),
+                patch.object(runner, "run_logged") as spawn,
+            ):
+                with self.assertRaises(runner.CertifyError):
+                    shell(["heavy"])
+                spawn.assert_not_called()
+            self.assertIn(
+                "resource guard", json.loads(shell.timings.read_text())["error"]
+            )
+
+    def test_output_streams_and_is_retained(self):
+        handle = io.StringIO()
+        process = Mock()
+        process.stdout = iter(["first\n", "second\n"])
+        process.wait.return_value = 3
+        spawn = Mock()
+        spawn.return_value.__enter__ = Mock(return_value=process)
+        spawn.return_value.__exit__ = Mock(return_value=False)
+        with patch.object(runner.subprocess, "Popen", spawn):
+            result = runner.run_logged(["work"], cwd=Path.cwd(), env={}, handle=handle)
+        self.assertEqual(handle.getvalue(), "first\nsecond\n")
+        self.assertEqual(result.stdout, handle.getvalue())
+        self.assertEqual(result.returncode, 3)
+
+    def test_resource_thresholds_are_decimal(self):
+        with (
+            patch.object(runner.os, "getloadavg", return_value=(110, 1, 1)),
+            patch.object(
+                runner.shutil,
+                "disk_usage",
+                return_value=types.SimpleNamespace(free=55_000_000_000),
+            ),
+        ):
+            runner.resource_guard(Path.cwd(), max_load1=110)
+        for load, free in ((110.1, 55_000_000_000), (1, 54_999_999_999)):
+            with (
+                patch.object(runner.os, "getloadavg", return_value=(load, 1, 1)),
+                patch.object(
+                    runner.shutil,
+                    "disk_usage",
+                    return_value=types.SimpleNamespace(free=free),
+                ),
+            ):
+                with self.assertRaises(runner.CertifyError):
+                    runner.resource_guard(Path.cwd(), max_load1=110)
+
+    def test_temp_preflight_rejects_git_directory_or_worktree_file(self):
+        for marker_is_directory in (True, False):
+            with self.subTest(marker_is_directory=marker_is_directory):
+                with tempfile.TemporaryDirectory() as tmp:
+                    repository = Path(tmp) / "repository"
+                    repository.mkdir()
+                    marker = repository / ".git"
+                    if marker_is_directory:
+                        marker.mkdir()
+                    else:
+                        marker.write_text("gitdir: /unused/worktree-metadata\n")
+                    directory = repository / "private-temp"
+                    directory.mkdir()
+                    with self.assertRaisesRegex(
+                        runner.CertifyError, "Set TMPDIR.*outside every Git"
+                    ) as refusal:
+                        runner.check_test_temp_directory(directory)
+                    self.assertIn(str(repository), str(refusal.exception))
+
+    def test_temp_preflight_resolves_symlinks_before_checking_ancestors(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            repository = Path(tmp) / "repository"
+            repository.mkdir()
+            (repository / ".git").mkdir()
+            directory = repository / "private-temp"
+            directory.mkdir()
+            alias = Path(tmp) / "alias"
+            alias.symlink_to(directory, target_is_directory=True)
+            with self.assertRaisesRegex(runner.CertifyError, "inside Git"):
+                runner.check_test_temp_directory(alias)
+
+    def test_temp_preflight_accepts_an_outside_git_location_without_writing(self):
+        external = Path("/external-private-temp")
+        with (
+            patch.object(runner.tempfile, "gettempdir", return_value=str(external)),
+            patch.object(Path, "exists", return_value=False),
+        ):
+            self.assertEqual(runner.check_test_temp_directory(), external)
+
+    def test_temp_preflight_refuses_before_network_or_model_work(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            args = runner.parse(
+                [
+                    "--national-tag",
+                    TAG,
+                    "--drop-regional-release",
+                    "--pepy-repo",
+                    tmp,
+                ]
+            )
+            with (
+                patch.object(
+                    runner.subprocess, "check_output", return_value="microcosm"
+                ),
+                patch.object(
+                    runner,
+                    "check_test_temp_directory",
+                    side_effect=runner.CertifyError("temporary directory inside Git"),
+                ),
+                patch.object(runner, "read_cut") as manifest,
+                patch.object(runner, "fetch_regional_microdata") as microdata,
+                patch.object(runner.subprocess, "run") as spawn,
+            ):
+                with self.assertRaisesRegex(runner.CertifyError, "inside Git"):
+                    runner.certify(args)
+            manifest.assert_not_called()
+            microdata.assert_not_called()
+            spawn.assert_not_called()
+
+    def test_workers_are_limited(self):
+        for workers in (0, 5):
+            with self.assertRaises(SystemExit):
+                runner.parse(
+                    [
+                        "--national-tag",
+                        TAG,
+                        "--drop-regional-release",
+                        "--pepy-repo",
+                        "pepy",
+                        "--test-workers",
+                        str(workers),
+                    ]
+                )
+        self.assertEqual(
+            runner.parse(
+                [
+                    "--national-tag",
+                    TAG,
+                    "--drop-regional-release",
+                    "--pepy-repo",
+                    "pepy",
+                    "--test-workers",
+                    "4",
+                ]
+            ).test_workers,
+            4,
+        )
+
+    def test_pr_base_accepts_explicit_stack_target(self):
+        common = [
+            "--national-tag",
+            TAG,
+            "--drop-regional-release",
+            "--pepy-repo",
+            "pepy",
+        ]
+        self.assertEqual(runner.parse(common).pr_base, "main")
+        args = runner.parse(common + ["--pr-base", "budget-local-data-manifest"])
+        self.assertEqual(args.pr_base, "budget-local-data-manifest")
+        self.assertFalse(args.push)
+        self.assertFalse(args.open_pr)
+
+    def test_local_base_is_resolved_once_and_used_for_old_bundle(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            args = runner.parse(
+                [
+                    "--national-tag",
+                    TAG,
+                    "--drop-regional-release",
+                    "--dry-run",
+                    "--base-ref",
+                    "stack-local",
+                    "--pepy-repo",
+                    tmp,
+                    "--skip-writer-check",
+                    "offline regression",
+                ]
+            )
+            old = {"data_releases": {"uk": {}}}
+            with (
+                patch.object(
+                    runner.subprocess,
+                    "check_output",
+                    side_effect=["microcosm\n", "immutable-sha\n", json.dumps(old)],
+                ) as read,
+                patch.object(runner.subprocess, "run") as spawn,
+                patch.object(
+                    runner,
+                    "read_cut",
+                    return_value=runner.CutVersions(TAG, "2.147.2", "3.0", ()),
+                ),
+            ):
+                self.assertEqual(runner.certify(args), 0)
+            spawn.assert_not_called()
+            self.assertEqual(
+                read.call_args_list[1].args[0],
+                ["git", "rev-parse", "--verify", "stack-local^{commit}"],
+            )
+            self.assertEqual(
+                read.call_args_list[2].args[0],
+                [
+                    "git",
+                    "show",
+                    "immutable-sha:src/policyengine/data/bundle/manifest.json",
+                ],
+            )
+
+    def test_certification_changes_preserve_auxiliary_untracked_files(self):
+        manifest = "src/policyengine/data/bundle/manifest.json"
+        changelog = f"changelog.d/certify-uk-{TAG}.changed.md"
+        with patch.object(
+            runner.subprocess,
+            "check_output",
+            side_effect=[
+                f"pyproject.toml\0{manifest}\0",
+                f"{changelog}\0data\0operator-notes.md\0"
+                "src/policyengine/data/bundle/operator-private.json\0"
+                "tests/fixtures/household_calculator_snapshots/operator-helper.json\0",
+            ],
+        ):
+            paths = runner.certification_changes(Path.cwd(), TAG)
+        self.assertEqual(paths, sorted(["pyproject.toml", manifest, changelog]))
+
+    def test_certification_changes_refuse_unrelated_tracked_edits(self):
+        with patch.object(
+            runner.subprocess,
+            "check_output",
+            return_value="src/policyengine/core/simulation.py\0",
+        ):
+            with self.assertRaisesRegex(runner.CertifyError, "unrelated tracked"):
+                runner.certification_changes(Path.cwd(), TAG)
+
+    def test_resume_validates_identity_and_preserves_unfinished_generated_files(self):
+        for problem in (
+            None,
+            "branch",
+            "registration",
+            "owner",
+            "head",
+            "merge",
+            "tracked",
+            "cut",
+        ):
+            with self.subTest(problem=problem), tempfile.TemporaryDirectory() as tmp:
+                root = Path(tmp)
+                repo, worktree = root / "repo", root / "worktree"
+                repo.mkdir()
+                worktree.mkdir()
+                branch, base = "certify-uk-a133f37a", "b" * 40
+                relative = "src/policyengine/data/bundle/manifest.json"
+                path = worktree / relative
+                path.parent.mkdir(parents=True)
+                path.write_text(
+                    json.dumps(
+                        {
+                            "data_releases": {
+                                "uk": {
+                                    "data_package": {
+                                        "release_manifest_revision": "another-cut"
+                                        if problem == "cut"
+                                        else TAG
+                                    }
+                                }
+                            }
+                        }
+                    )
+                )
+                original = path.read_bytes()
+
+                def output(
+                    argv,
+                    *,
+                    cwd,
+                    problem=problem,
+                    root=root,
+                    repo=repo,
+                    worktree=worktree,
+                    branch=branch,
+                    base=base,
+                    relative=relative,
+                    **kwargs,
+                ):
+                    # The loop variables are bound as defaults: each subtest's fake
+                    # answers for its own repository.
+                    if argv[1:3] == ["worktree", "list"]:
+                        location = (
+                            root / "elsewhere"
+                            if problem == "registration"
+                            else worktree
+                        )
+                        registered_branch = "other" if problem == "branch" else branch
+                        return f"worktree {location}\0HEAD {base}\0branch refs/heads/{registered_branch}\0\0"
+                    if argv[1:] == ["rev-parse", "--git-common-dir"]:
+                        if problem == "owner" and cwd == worktree:
+                            return str(root / "other/.git")
+                        return str(repo / ".git")
+                    if argv[1:] == ["rev-parse", "HEAD"]:
+                        return "c" * 40 if problem == "head" else base
+                    if argv[1:3] == ["ls-files", "--unmerged"]:
+                        return "unmerged" if problem == "merge" else ""
+                    if argv[1:3] == ["diff", "--name-only"]:
+                        return (
+                            "README.md\0" if problem == "tracked" else relative + "\0"
+                        )
+                    if argv[1:3] == ["ls-files", "--others"]:
+                        return "data\0operator-notes.md\0"
+                    self.fail(f"unexpected validation command: {argv}")
+
+                with (
+                    patch.object(runner.subprocess, "check_output", side_effect=output),
+                    patch.object(runner.subprocess, "run") as mutation,
+                ):
+                    if problem:
+                        with self.assertRaises(runner.CertifyError):
+                            runner.validate_resume_worktree(
+                                repo, worktree, branch, base, TAG
+                            )
+                    else:
+                        self.assertEqual(
+                            runner.validate_resume_worktree(
+                                repo, worktree, branch, base, TAG
+                            ),
+                            [relative],
+                        )
+                    mutation.assert_not_called()
+                self.assertEqual(path.read_bytes(), original)
+
+    def run_mock_pipeline(
+        self,
+        *,
+        pytest_code=0,
+        uc_code=0,
+        receipt=None,
+        call_details=None,
+        resume=False,
+        evidence=None,
+    ):
+        if receipt is None and uc_code == 0:
+            receipt = {
+                "check": "uk_uc_floor",
+                "passed": True,
+                "measures": [
+                    {"name": "benefit_units", "ratio": 0.92524521, "passed": True},
+                    {"name": "spend", "ratio": 0.95781282, "passed": True},
+                ],
+            }
+        tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(tmp.cleanup)
+        root = Path(tmp.name)
+        worktree = root / "certification"
+        bundle = {"data_releases": {"uk": {"default_dataset": "candidate"}}}
+        if resume:
+            path = worktree / "src/policyengine/data/bundle/manifest.json"
+            path.parent.mkdir(parents=True)
+            path.write_text(json.dumps(bundle))
+        route = ["--drop-regional-release"]
+        if evidence is not None:
+            route = [
+                "--dense-tag",
+                DENSE_TAG,
+                "--accept-regional-model-mismatch",
+                "recorded rehearsal mismatch",
+                "--audited-by",
+                "A Reviewer",
+                "--regional-limitation",
+                "VAT predates the factor fix",
+            ]
+        args = runner.parse(
+            [
+                "--national-tag",
+                TAG,
+                *route,
+                "--base-ref",
+                "local",
+                "--pepy-repo",
+                str(root),
+                "--worktree",
+                str(worktree),
+                "--skip-writer-check",
+                "offline regression",
+                *(["--resume-worktree"] if resume else []),
+            ]
+        )
+        calls = []
+        cuts = {
+            TAG: runner.CutVersions(TAG, "2.147.2", "3.0", ()),
+            DENSE_TAG: runner.CutVersions(DENSE_TAG, "2.132.6", "3.0", ()),
+        }
+
+        def command(argv, **kwargs):
+            calls.append(argv)
+            if argv[:3] == ["git", "worktree", "add"]:
+                manifest = worktree / "src/policyengine/data/bundle/manifest.json"
+                manifest.parent.mkdir(parents=True)
+                manifest.write_text(json.dumps(bundle))
+            return subprocess.CompletedProcess(argv, 0, "", "")
+
+        def shell(argv, **kwargs):
+            calls.append(argv)
+            if call_details is not None:
+                call_details.append((argv, kwargs))
+            if "constant-rewrite" == kwargs.get("step"):
+                return subprocess.CompletedProcess(argv, 0, "[]", "")
+            if "audit-help" == kwargs.get("step"):
+                flags = (
+                    "--regional-manifest-uri --artifact --model-version "
+                    "--audited-by --limitation --output"
+                )
+                return subprocess.CompletedProcess(argv, 0, f"usage: {flags}", "")
+            if "regional-input-audit" == kwargs.get("step"):
+                output = Path(argv[argv.index("--output") + 1])
+                output.write_text(json.dumps(evidence))
+                return subprocess.CompletedProcess(argv, 0, "", "")
+            if "UC-floor" == kwargs.get("step"):
+                if receipt is not None:
+                    (root / "certification.uc_floor.json").write_text(
+                        json.dumps(receipt)
+                    )
+                return subprocess.CompletedProcess(argv, uc_code, "traceback", "")
+            if "tests" == kwargs.get("step"):
+                return subprocess.CompletedProcess(
+                    argv, pytest_code, "ERROR: unrecognized arguments: -n", ""
+                )
+            return subprocess.CompletedProcess(argv, 0, "", "")
+
+        with (
+            patch.object(
+                runner.subprocess,
+                "check_output",
+                side_effect=["microcosm", "immutable-sha", json.dumps(bundle)],
+            ),
+            patch.object(runner.subprocess, "run", side_effect=command),
+            patch.object(runner, "read_cut", side_effect=lambda tag, _: cuts[tag]),
+            patch.object(runner, "regional_audit_support", return_value=None),
+            patch.object(
+                runner,
+                "fetch_regional_microdata",
+                return_value={"microcosm_uk_2024_25_dense": root / "dense.h5"},
+            ),
+            patch.object(runner.Shell, "__call__", side_effect=shell),
+            patch.object(
+                runner,
+                "check_test_temp_directory",
+                return_value=root / "isolated-test-temp",
+            ),
+            patch.object(runner, "validate_resume_worktree", return_value=[]),
+            patch.object(
+                runner,
+                "certification_changes",
+                return_value=["src/policyengine/data/bundle/manifest.json"],
+            ),
+        ):
+            result = runner.certify(args)
+        return result, calls, root
+
+    def test_an_accepted_mismatch_audits_then_certifies_with_its_evidence(self):
+        details = []
+        result, calls, root = self.run_mock_pipeline(
+            evidence=EVIDENCE, call_details=details
+        )
+        self.assertEqual(result, 0)
+        steps = [kwargs.get("step") for _, kwargs in details]
+        order = [
+            "initial-sync",
+            "audit-model-install",
+            "audit-help",
+            "regional-input-audit",
+            "certify-data",
+            "lock",
+            "certified-sync",
+        ]
+        self.assertEqual([s for s in steps if s in order], order)
+        by_step = {kwargs.get("step"): argv for argv, kwargs in details}
+        install = by_step["audit-model-install"]
+        self.assertIn("policyengine-uk==2.147.2", install)
+        self.assertIn("policyengine-core==3.0", install)
+        audit, certify = by_step["regional-input-audit"], by_step["certify-data"]
+        evidence = audit[audit.index("--output") + 1]
+        self.assertEqual(
+            certify[certify.index("--regional-input-surface-evidence") + 1], evidence
+        )
+        self.assertEqual(
+            certify[certify.index("--regional-manifest-uri") + 1],
+            audit[audit.index("--regional-manifest-uri") + 1],
+        )
+        self.assertIn(
+            f"microcosm_uk_2024_25_dense={root / 'dense.h5'}",
+            audit,
+        )
+        body = (root / "certification.pr-body.md").read_text()
+        self.assertIn("local_bus_uncapped_single_fare", body)
+        self.assertIn("audited by A Reviewer", body)
+
+    def test_package_steps_get_no_hugging_face_token(self):
+        details = []
+        self.run_mock_pipeline(evidence=EVIDENCE, call_details=details)
+        package_steps = {
+            "initial-sync",
+            "audit-model-install",
+            "lock",
+            "certified-sync",
+            "check-pytest-xdist",
+        }
+        by_step = {kwargs.get("step"): kwargs for _, kwargs in details}
+        for step in package_steps:
+            self.assertIs(by_step[step].get("credentials"), False, step)
+        for step in ("regional-input-audit", "certify-data", "UC-floor", "tests"):
+            self.assertIsNot(by_step[step].get("credentials"), False, step)
+
+    def test_a_credential_free_step_sees_no_hugging_face_token(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            shell = runner.Shell(Path(tmp), Path(tmp) / "run.log")
+            with (
+                patch.dict(os.environ, {"HF_TOKEN": "a", "HUGGING_FACE_TOKEN": "b"}),
+                patch.object(runner, "resource_guard", return_value={}),
+                patch.object(
+                    runner,
+                    "run_logged",
+                    return_value=subprocess.CompletedProcess(["uv"], 0, "", ""),
+                ) as spawn,
+            ):
+                shell(["uv", "sync"], credentials=False)
+                quiet = spawn.call_args.kwargs["env"]
+                shell(["python", "scripts/bundle.py"])
+                loud = spawn.call_args.kwargs["env"]
+            self.assertFalse({"HF_TOKEN", "HUGGING_FACE_TOKEN"} & set(quiet))
+            self.assertEqual((loud["HF_TOKEN"], loud["HUGGING_FACE_TOKEN"]), ("a", "b"))
+
+    def test_an_audit_reporting_drops_refuses_before_certify_data(self):
+        details = []
+        with self.assertRaisesRegex(runner.CertifyError, "would lose them: age"):
+            self.run_mock_pipeline(
+                evidence={**EVIDENCE, "dropped_columns": ["age"]},
+                call_details=details,
+            )
+        self.assertNotIn("certify-data", [k.get("step") for _, k in details])
+
+    def test_policyengine_py_commands_never_see_the_callers_venv_or_key(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            shell = runner.Shell(Path(tmp), Path(tmp) / "run.log")
+            caller = {
+                "UV_PROJECT_ENVIRONMENT": "/microcosm/.venv",
+                "VIRTUAL_ENV": "/microcosm/.venv",
+                runner.UK_GATE_SIGNING_KEY_ENV: "key-under-test",
+                "HF_TOKEN": "hf-under-test",
+                "KEEP_ME": "1",
+            }
+            with (
+                patch.dict(os.environ, caller),
+                patch.object(runner, "resource_guard", return_value={}),
+                patch.object(
+                    runner,
+                    "run_logged",
+                    return_value=subprocess.CompletedProcess(["uv"], 0, "", ""),
+                ) as spawn,
+            ):
+                shell(["uv", "sync"], env={"EXTRA": "2"})
+            env = spawn.call_args.kwargs["env"]
+            self.assertNotIn("UV_PROJECT_ENVIRONMENT", env)
+            self.assertNotIn("VIRTUAL_ENV", env)
+            self.assertNotIn(runner.UK_GATE_SIGNING_KEY_ENV, env)
+            self.assertEqual(env["HF_TOKEN"], "hf-under-test")
+            self.assertEqual((env["KEEP_ME"], env["EXTRA"]), ("1", "2"))
+
+    def test_pytest_configuration_error_is_failure_without_failed_lines(self):
+        result, calls, root = self.run_mock_pipeline(pytest_code=4)
+        self.assertEqual(result, 1)
+        self.assertIn(
+            "pytest exited 4", (root / "certification.pr-body.md").read_text()
+        )
+        worktree_call = next(c for c in calls if c[:3] == ["git", "worktree", "add"])
+        self.assertEqual(worktree_call[-1], "immutable-sha")
+
+    def test_resume_replays_without_creating_or_resetting_worktree(self):
+        result, calls, _ = self.run_mock_pipeline(resume=True)
+        self.assertEqual(result, 0)
+        self.assertFalse(any(call[:3] == ["git", "worktree", "add"] for call in calls))
+        self.assertFalse(any(call[:2] == ["git", "reset"] for call in calls))
+        self.assertIn(
+            ["git", "add", "--", "src/policyengine/data/bundle/manifest.json"], calls
+        )
+        self.assertNotIn(["git", "add", "-A"], calls)
+
+    def test_uc_operational_failure_refuses(self):
+        with self.assertRaisesRegex(runner.CertifyError, "failed operationally"):
+            self.run_mock_pipeline(uc_code=1)
+
+    def test_measured_uc_floor_failure_keeps_human_acceptance(self):
+        result, _, root = self.run_mock_pipeline(
+            uc_code=1,
+            receipt={
+                "check": "uk_uc_floor",
+                "passed": False,
+                "measures": [
+                    {"name": "benefit_units", "ratio": 0.8, "passed": False},
+                    {"name": "spend", "ratio": 0.95, "passed": True},
+                ],
+            },
+        )
+        self.assertEqual(result, 0)
+        self.assertIn(
+            "UC floor acceptance", (root / "certification.pr-body.md").read_text()
+        )
+        self.assertIn(
+            "FAILED; measured/benchmark ratios: benefit_units=0.800000, spend=0.950000",
+            (root / "certification.pr-body.md").read_text(),
+        )
+
+    def test_passed_uc_floor_reports_ratios_without_acceptance_request(self):
+        result, _, root = self.run_mock_pipeline()
+        self.assertEqual(result, 0)
+        body = (root / "certification.pr-body.md").read_text()
+        self.assertIn(
+            "passed; measured/benchmark ratios: benefit_units=0.925245, spend=0.957813",
+            body,
+        )
+        self.assertNotIn("UC floor acceptance", body)
+
+    def test_incomplete_uc_floor_receipt_refuses_even_after_zero_exit(self):
+        with self.assertRaisesRegex(runner.CertifyError, "failed operationally"):
+            self.run_mock_pipeline(receipt={})
+
+    def test_uc_floor_rejects_contradictory_measure_status(self):
+        with self.assertRaisesRegex(runner.CertifyError, "failed operationally"):
+            self.run_mock_pipeline(
+                receipt={
+                    "check": "uk_uc_floor",
+                    "passed": True,
+                    "measures": [
+                        {"name": "benefit_units", "ratio": 0.8, "passed": False},
+                        {"name": "spend", "ratio": 0.95, "passed": True},
+                    ],
+                }
+            )
+
+    def test_handoff_marks_wrapper_qualification_pending(self):
+        _, _, root = self.run_mock_pipeline()
+        body = (root / "certification.pr-body.md").read_text()
+        for expected in (
+            "Mechanical handoff; wrapper qualification pending",
+            "19 producer release-cut gates and passing pytest do not establish",
+            "- [ ] **Wrapper qualification.**",
+            "full reform contract",
+            "metrics review and reform responsiveness",
+            "scorecard replay evidence",
+            "this script waives no gate",
+        ):
+            self.assertIn(expected, body)
+
+    def test_country_import_skip_is_scoped_to_constants_and_uc_floor(self):
+        details = []
+        self.run_mock_pipeline(call_details=details)
+        envs = {kwargs.get("step"): kwargs.get("env", {}) for _, kwargs in details}
+        skipped = {
+            step
+            for step, env in envs.items()
+            if env.get("POLICYENGINE_SKIP_COUNTRY_IMPORTS") == "1"
+        }
+        self.assertEqual(skipped, {"constant-rewrite", "UC-floor"})
+        self.assertEqual(envs["snapshots"], {"PE_UPDATE_SNAPSHOTS": "1"})
+        self.assertEqual(envs["tests"], {})
+
+    def test_stall_diagnostic_is_fullsuite_only_and_does_not_request_exit(self):
+        details = []
+        self.run_mock_pipeline(call_details=details)
+        steps = {kwargs.get("step"): argv for argv, kwargs in details}
+        fullsuite = steps["tests"]
+        overrides = [
+            fullsuite[index + 1]
+            for index, option in enumerate(fullsuite)
+            if option == "-o"
+        ]
+        self.assertIn("faulthandler_timeout=300", overrides)
+        self.assertFalse(any("exit_on_timeout" in option for option in fullsuite))
+        snapshot = steps["snapshots"]
+        snapshot_overrides = [
+            snapshot[index + 1]
+            for index, option in enumerate(snapshot)
+            if option == "-o"
+        ]
+        self.assertFalse(
+            any("faulthandler_timeout" in option for option in snapshot_overrides)
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/packages/microcosm-build/tests/engine_free/uk/test_modal_uk_cut.py b/packages/microcosm-build/tests/engine_free/uk/test_modal_uk_cut.py
new file mode 100644
index 0000000000..3277591051
--- /dev/null
+++ b/packages/microcosm-build/tests/engine_free/uk/test_modal_uk_cut.py
@@ -0,0 +1,172 @@
+"""tools/modal_uk_cut.py, imported against a stub ``modal`` module."""
+
+from __future__ import annotations
+
+import importlib.util
+import shutil
+import sys
+from pathlib import Path
+from unittest.mock import MagicMock
+
+import pytest
+
+from microcosm.data.gate_signing_keys import UK_GATE_SIGNING_KEY_ENV
+
+ROOT = Path(__file__).resolve().parents[5]
+
+
+def _load_app(monkeypatch, tool="modal_uk_cut.py"):
+    """A Modal tool as the launcher sees it: ``modal.is_local()`` is true."""
+
+    stub = MagicMock(name="modal")
+    stub.is_local.return_value = True
+    stub.App.return_value.function.side_effect = lambda **options: (
+        lambda function: setattr(function, "modal_options", options) or function
+    )
+    stub.App.return_value.local_entrypoint.side_effect = lambda **_: lambda f: f
+    monkeypatch.setitem(sys.modules, "modal", stub)
+    spec = importlib.util.spec_from_file_location(
+        f"{tool.removesuffix('.py')}_under_test", ROOT / "tools" / tool
+    )
+    module = importlib.util.module_from_spec(spec)
+    assert spec.loader is not None
+    spec.loader.exec_module(module)
+    return module, stub
+
+
+def test_a_deliberate_run_passes_the_registry_variable(monkeypatch):
+    monkeypatch.setenv("HF_TOKEN", "hf-test")
+    monkeypatch.setenv(UK_GATE_SIGNING_KEY_ENV, "key-test")
+    monkeypatch.setenv("MICROCOSM_UK_CUT_MODAL_RUN", "1")
+    module, stub = _load_app(monkeypatch)
+    assert module.registry.UK_GATE_SIGNING_KEY_ENV == UK_GATE_SIGNING_KEY_ENV
+    stub.Secret.from_dict.assert_called_once_with(
+        {"HF_TOKEN": "hf-test", UK_GATE_SIGNING_KEY_ENV: "key-test"}
+    )
+    assert module.cut.modal_options["secrets"] == [stub.Secret.from_dict.return_value]
+
+
+def test_without_the_opt_in_no_credential_is_attached(monkeypatch):
+    """modal run sends an app's secrets before its entrypoint runs."""
+
+    monkeypatch.setenv("HF_TOKEN", "hf-test")
+    monkeypatch.setenv(UK_GATE_SIGNING_KEY_ENV, "key-test")
+    monkeypatch.delenv("MICROCOSM_UK_CUT_MODAL_RUN", raising=False)
+    module, stub = _load_app(monkeypatch)
+    stub.Secret.from_dict.assert_not_called()
+    assert module.cut.modal_options["secrets"] == []
+    with pytest.raises(SystemExit, match="deliberate, paid run"):
+        module.main("a" * 40, "t", run=True)
+
+
+def test_planning_contacts_no_modal_service(monkeypatch, capsys):
+    monkeypatch.setenv("HF_TOKEN", "hf-test")
+    monkeypatch.delenv(UK_GATE_SIGNING_KEY_ENV, raising=False)
+    module, stub = _load_app(monkeypatch)
+    monkeypatch.setattr(
+        module.subprocess,
+        "run",
+        lambda argv, **kw: module.subprocess.CompletedProcess(argv, 0),
+    )
+    stub.reset_mock()
+    assert module.plan("a" * 40, "t") == [UK_GATE_SIGNING_KEY_ENV]
+    assert stub.mock_calls == []
+    assert "missing credentials" in capsys.readouterr().out
+
+
+def test_the_image_carries_the_registry_for_the_container(monkeypatch):
+    module, stub = _load_app(monkeypatch)
+    built = stub.Image.debian_slim.return_value.apt_install.return_value
+    added = built.pip_install.return_value.env.return_value.add_local_file
+    added.assert_called_once_with(str(module.REGISTRY_SOURCE), module.REGISTRY_REMOTE)
+    assert module.REGISTRY_SOURCE.is_file()
+    # Modal places the app module in /root, beside the registry's copy.
+    assert Path(module.REGISTRY_REMOTE).parent == Path("/root")
+
+
+def test_the_registry_loads_from_a_bare_copy(monkeypatch, tmp_path):
+    """In the container only the copied file exists, with no microcosm."""
+
+    module, _ = _load_app(monkeypatch)
+    copy = tmp_path / "gate_signing_keys.py"
+    shutil.copyfile(module.REGISTRY_SOURCE, copy)
+    loaded = module.load_gate_signing_keys(copy)
+    assert loaded.UK_GATE_SIGNING_KEY_ENV == UK_GATE_SIGNING_KEY_ENV
+    assert set(loaded.UK_GATE_SIGNING_KEYS) == set(module.registry.UK_GATE_SIGNING_KEYS)
+
+
+def test_an_opted_in_run_without_run_says_the_credentials_were_sent(monkeypatch):
+    monkeypatch.setenv("HF_TOKEN", "hf-test")
+    monkeypatch.setenv("MICROCOSM_UK_CUT_MODAL_RUN", "1")
+    module, _ = _load_app(monkeypatch)
+    with pytest.raises(SystemExit, match="already sent to Modal"):
+        module.main("a" * 40, "t")
+
+
+def test_missing_credentials_are_asked_for_one_command(monkeypatch):
+    monkeypatch.setenv("MICROCOSM_UK_CUT_MODAL_RUN", "1")
+    monkeypatch.delenv("HF_TOKEN", raising=False)
+    monkeypatch.delenv(UK_GATE_SIGNING_KEY_ENV, raising=False)
+    module, _ = _load_app(monkeypatch)
+    monkeypatch.setattr(
+        module.subprocess,
+        "run",
+        lambda argv, **kw: module.subprocess.CompletedProcess(argv, 0),
+    )
+    with pytest.raises(SystemExit, match="to this command") as refusal:
+        module.main("a" * 40, "t", run=True)
+    assert "export " not in str(refusal.value).replace("exported", "")
+
+
+def test_the_container_syncs_without_credentials(monkeypatch):
+    monkeypatch.setenv("HF_TOKEN", "hf-test")
+    monkeypatch.setenv(UK_GATE_SIGNING_KEY_ENV, "key-test")
+    module, _ = _load_app(monkeypatch)
+    synced, ran = [], []
+    monkeypatch.setattr(
+        module, "_sh", lambda argv, **kw: synced.append((argv, kw.get("env")))
+    )
+    monkeypatch.setattr(
+        module.subprocess,
+        "run",
+        lambda argv, **kw: (
+            ran.append(kw["env"]) or module.subprocess.CompletedProcess(argv, 0)
+        ),
+    )
+    assert module.cut("a" * 40, "t", False, []) == 0
+    sync_env = next(env for argv, env in synced if argv[:2] == ["uv", "sync"])
+    assert "HF_TOKEN" not in sync_env and UK_GATE_SIGNING_KEY_ENV not in sync_env
+    assert ran[0]["HF_TOKEN"] == "hf-test"
+    assert ran[0][UK_GATE_SIGNING_KEY_ENV] == "key-test"
+
+
+CHRONICLE = "modal_rebuild_uk_chronicle_artifact.py"
+
+
+def test_the_chronicle_rebuild_sends_no_token_without_the_opt_in(monkeypatch):
+    monkeypatch.setenv("HF_TOKEN", "hf-test")
+    monkeypatch.delenv("MICROCOSM_UK_CHRONICLE_MODAL_UPLOAD", raising=False)
+    module, stub = _load_app(monkeypatch, CHRONICLE)
+    stub.Secret.from_dict.assert_not_called()
+    assert module.rebuild.modal_options["secrets"] == []
+    with pytest.raises(SystemExit, match="paid rebuild"):
+        module.main()
+    with pytest.raises(SystemExit, match="MICROCOSM_UK_CHRONICLE_MODAL_UPLOAD"):
+        module.main(build=True, upload=True)
+
+
+def test_an_opted_in_chronicle_upload_attaches_the_token(monkeypatch):
+    monkeypatch.setenv("HF_TOKEN", "hf-test")
+    monkeypatch.setenv("MICROCOSM_UK_CHRONICLE_MODAL_UPLOAD", "1")
+    module, stub = _load_app(monkeypatch, CHRONICLE)
+    stub.Secret.from_dict.assert_called_once_with({"HF_TOKEN": "hf-test"})
+    with pytest.raises(SystemExit, match="already sent to Modal"):
+        module.main()
+
+
+def test_chronicle_planning_contacts_no_modal_service(monkeypatch, capsys):
+    module, stub = _load_app(monkeypatch, CHRONICLE)
+    stub.reset_mock()
+    summary = module.plan()
+    assert summary["chronicle_commit"] == module.PIN["source_commit"]
+    assert stub.mock_calls == []
diff --git a/packages/microcosm-build/tests/engine_free/uk/test_run_uk_cut.py b/packages/microcosm-build/tests/engine_free/uk/test_run_uk_cut.py
new file mode 100644
index 0000000000..f7ade4782a
--- /dev/null
+++ b/packages/microcosm-build/tests/engine_free/uk/test_run_uk_cut.py
@@ -0,0 +1,1020 @@
+"""The one-command UK cut runner: pins, fetching, argv and resumability."""
+
+from __future__ import annotations
+
+import base64
+import dataclasses
+import hashlib
+import io
+import json
+import re
+import zipfile
+from contextlib import redirect_stdout
+from pathlib import Path
+
+import pytest
+from hypothesis import HealthCheck, given, settings
+from hypothesis import strategies as st
+
+from tools import run_uk_cut as cut
+
+REPO = Path(cut.__file__).resolve().parents[1]
+
+
+def _sha(data: bytes) -> str:
+    return hashlib.sha256(data).hexdigest()
+
+
+# --------------------------------------------------------------------------- #
+# Pins: the runner accepts exactly what the build checks                        #
+# --------------------------------------------------------------------------- #
+
+
+def test_every_declared_input_resolves_to_a_committed_pin():
+    sources = {source.key: source for source in cut.load_input_sources()}
+    assert set(sources) == {
+        "frs_2024_25",
+        "spi_2022_23",
+        "was_round_8",
+        "etb_1977_2024",
+        "nts_2002_2024",
+        "lcfs_2024_25",
+        "hmrc_personal_incomes_ods",
+        "chronicle_uk",
+        "input_mass_reference",
+        "incumbent_efrs",
+    }
+    for source in sources.values():
+        assert source.files
+        for pin in source.files:
+            assert len(pin.sha256) == 64 and int(pin.sha256, 16) >= 0
+
+
+def test_every_hosted_archive_is_pinned_to_a_revision_and_digest():
+    """Each zip is read at a fixed commit and checked whole before any member."""
+
+    for source in cut.load_input_sources():
+        if source.kind != "hf_zip_members":
+            continue
+        assert re.fullmatch(r"[0-9a-f]{40}", source.revision or ""), source.key
+        assert re.fullmatch(r"[0-9a-f]{64}", source.archive_sha256 or ""), source.key
+
+
+def test_the_runner_pins_are_the_build_pins():
+    """Lockstep with the files the build itself reads its pins from."""
+
+    sources = {source.key: source for source in cut.load_input_sources()}
+    feed = json.loads((cut.UK_DIR / "chronicle_feed.json").read_text())
+    chronicle = {pin.name: pin.sha256 for pin in sources["chronicle_uk"].files}
+    assert chronicle == {
+        "manifest.json": feed["manifest_sha256"],
+        "consumer_facts.jsonl": feed["facts_sha256"],
+    }
+    assert (
+        sources["chronicle_uk"].path_in_repo == f"chronicle-uk/{feed['source_commit']}"
+    )
+    frs = json.loads((cut.UK_DIR / "frs_release.json").read_text())["acquisition"]
+    assert sources["frs_2024_25"].revision == frs["huggingface_revision"]
+    assert sources["frs_2024_25"].archive_sha256 == frs["zip_sha256"]
+    assert sources["frs_2024_25"].filename == frs["zip_filename"]
+    identity = cut._gate_reference_identity(cut.UK_DIR)
+    incumbent = sources["incumbent_efrs"]
+    assert incumbent.revision == identity["revision"]
+    assert incumbent.files[0].sha256 == identity["sha256"]
+    stage_pins = cut.committed_source_pins()
+    for key in ("frs_2024_25", "spi_2022_23", "was_round_8", "etb_1977_2024"):
+        for pin in sources[key].files:
+            assert pin.sha256 == stage_pins[pin.name]["sha256"]
+            assert pin.size_bytes == stage_pins[pin.name]["size_bytes"]
+
+
+def test_the_chronicle_path_follows_the_feed_pin(tmp_path):
+    """A re-pin of chronicle_feed.json needs no edit to the inputs manifest."""
+
+    for name in ("source_stages.json", "frs_release.json", "gates.json"):
+        (tmp_path / name).write_bytes((cut.UK_DIR / name).read_bytes())
+    feed = json.loads((cut.UK_DIR / "chronicle_feed.json").read_text())
+    feed["source_commit"] = "f" * 40
+    (tmp_path / "chronicle_feed.json").write_text(json.dumps(feed))
+    sources = {s.key: s for s in cut.load_input_sources(cut.CUT_INPUTS, tmp_path)}
+    assert sources["chronicle_uk"].path_in_repo == "chronicle-uk/" + "f" * 40
+    raw = next(
+        s
+        for s in json.loads(cut.CUT_INPUTS.read_text())["sources"]
+        if s["key"] == "chronicle_uk"
+    )
+    assert raw["revision"] is None
+    assert not re.search(r"[0-9a-f]{40}", json.dumps(raw))
+
+
+def test_an_unknown_pin_selector_is_refused(tmp_path):
+    manifest = json.loads(cut.CUT_INPUTS.read_text())
+    manifest["sources"][0]["revison_pin"] = "frs_release"
+    path = tmp_path / "uk_cut_inputs.json"
+    path.write_text(json.dumps(manifest))
+    with pytest.raises(cut.CutError, match="unknown pin selector"):
+        cut.load_input_sources(path)
+
+
+def test_the_hosted_mass_reference_is_the_one_the_gate_binds():
+    from microcosm.build.uk_runtime.weighted_integrity import (
+        UK_INPUT_MASS_REFERENCE_EVIDENCE_SHA256,
+    )
+
+    manifest = json.loads(cut.CUT_INPUTS.read_text())
+    pin = manifest["file_pins"]["uk_input_mass_reference.json"]
+    assert pin["canonical_evidence_sha256"] == UK_INPUT_MASS_REFERENCE_EVIDENCE_SHA256
+    source = next(s for s in manifest["sources"] if s["key"] == "input_mass_reference")
+    assert source["path_in_repo"].endswith(UK_INPUT_MASS_REFERENCE_EVIDENCE_SHA256)
+
+
+def test_every_spine_tab_flag_has_a_pinned_input():
+    """The spine's licensed tabs are all fetched, under the names it reads."""
+
+    paths = cut.CutPaths(Path("/w"), "t", "0" * 40)
+    argv = cut.spine_argv(paths, python="py", staging_local_only=True)
+    sources = {s.key: s for s in cut.load_input_sources()}
+    fetched = {
+        str(paths.input_file(s.directory, pin.name))
+        for s in sources.values()
+        for pin in s.files
+    }
+    values = [a for a in argv[2:] if a.startswith("/w/inputs/")]
+    assert values
+    for value in values:
+        assert value in fetched or value == str(paths.inputs / "frs_2024_25")
+
+
+# --------------------------------------------------------------------------- #
+# Every argv is accepted by the tool's own parser                               #
+# --------------------------------------------------------------------------- #
+
+
+def _paths(tmp_path: Path) -> cut.CutPaths:
+    return cut.CutPaths(tmp_path, "test", "a" * 40)
+
+
+def test_spine_argv_parses():
+    from microcosm.build.uk_runtime import spine_build
+
+    paths = cut.CutPaths(Path("/w"), "t", "a" * 40)
+    args = spine_build._parse_args(
+        cut.spine_argv(paths, python="py", staging_local_only=True)[2:]
+    )
+    assert args.release_candidate is True
+    assert str(args.spine_h5) == str(paths.spine_h5)
+
+
+@pytest.mark.parametrize("dry_run", [True, False])
+def test_national_argv_parses(tmp_path, dry_run):
+    from microcosm.build.uk_runtime import full_build_cli
+
+    sources = {s.key: s for s in cut.load_input_sources()}
+    argv = cut.national_argv(
+        _paths(tmp_path),
+        python="py",
+        spine_sha256="b" * 64,
+        sources=sources,
+        dry_run=dry_run,
+        logbook_prev_row_digest="c" * 64,
+    )
+    args = full_build_cli.parse_args(argv[2:])
+    assert args.release_role == "national"
+    assert args.dry_run is dry_run
+    assert args.input_sha256 == "b" * 64
+
+
+@pytest.mark.parametrize("dry_run", [True, False])
+def test_the_national_build_never_publishes_to_the_orrery(tmp_path, dry_run):
+    """With remote staging, the build would otherwise submit its graph."""
+
+    from microcosm.build.uk_runtime import full_build_cli
+    from microcosm.build.uk_runtime.orrery_publication import publication_enabled
+
+    sources = {s.key: s for s in cut.load_input_sources()}
+    argv = cut.national_argv(
+        _paths(tmp_path),
+        python="py",
+        spine_sha256="b" * 64,
+        sources=sources,
+        dry_run=dry_run,
+    )
+    assert "--publish-orrery" not in argv
+    assert publication_enabled(full_build_cli.parse_args(argv[2:])) is False
+
+
+def _tool(name: str):
+    import importlib
+
+    return importlib.import_module(f"tools.{name}")
+
+
+def test_certify_and_assemble_argv_parse(tmp_path):
+    sources = {s.key: s for s in cut.load_input_sources()}
+    paths = _paths(tmp_path)
+    certify = _tool("certify_uk_release_cut")._parse_args(
+        cut.certify_argv(
+            paths,
+            python="py",
+            candidate_sha256="d" * 64,
+            spine_sha256="e" * 64,
+            sources=sources,
+        )[2:]
+    )
+    assert certify.release_id == cut.RELEASE_ID
+    assemble = _tool("assemble_uk_release_dir")._parse_args(
+        cut.assemble_argv(paths, python="py")[2:]
+    )
+    assert str(assemble.out_dir) == "releases"
+
+
+def test_score_argv_names_only_flags_the_scorer_declares(tmp_path, capsys):
+    sources = {s.key: s for s in cut.load_input_sources()}
+    argv = cut.score_argv(
+        _paths(tmp_path), python="py", candidate_sha256="f" * 64, sources=sources
+    )
+    with pytest.raises(SystemExit):
+        _tool("score_uk_national_candidate").main(["--help"])
+    help_text = capsys.readouterr().out
+    for flag in (a for a in argv[2:] if a.startswith("--")):
+        assert flag in help_text
+
+
+@given(tag=st.text(min_size=1, max_size=80))
+def test_publication_is_always_inspection_only(tag):
+    """Whatever the tag, the publisher is told not to move main or a pointer."""
+
+    paths = cut.CutPaths(Path("/w"), "t", "a" * 40)
+    for preflight in (True, False):
+        argv = cut.publish_argv(paths, python="py", tag=tag, preflight_only=preflight)
+        assert "--no-latest" in argv and "--tag-only" in argv
+        assert "--promote-line" not in argv
+        assert argv[argv.index("--repo-id") + 1] == cut.PUBLISH_REPO
+        assert argv[argv.index("--tag-name") + 1] == tag
+
+
+def test_publication_argv_uses_only_declared_flags(capsys):
+    from microcosm.data import publish_cli
+
+    paths = cut.CutPaths(Path("/w"), "t", "a" * 40)
+    argv = cut.publish_argv(paths, python="py", tag="x", preflight_only=True)
+    assert argv[1:3] == ["-m", "microcosm.data.publish_cli"]
+    assert argv[3] == str(paths.release_dir)
+    with pytest.raises(SystemExit):
+        publish_cli.main(["--help"])
+    help_text = capsys.readouterr().out
+    for flag in (a for a in argv[4:] if a.startswith("--")):
+        assert flag in help_text
+
+
+# --------------------------------------------------------------------------- #
+# Fetching: verified or absent, and idempotent                                  #
+# --------------------------------------------------------------------------- #
+
+
+class FakeHub:
+    """Serves files and zips from memory and counts downloads."""
+
+    def __init__(self, root: Path, files: dict[str, bytes]) -> None:
+        self.root = root
+        self.files = files
+        self.downloads = 0
+
+    def hf_file(self, *, repo_id, repo_type, filename, revision, local_dir=None):
+        self.downloads += 1
+        if filename not in self.files:
+            raise FileNotFoundError(f"404 {filename}")
+        path = (local_dir or self.root / "hub") / filename
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_bytes(self.files[filename])
+        return path
+
+    def url(self, url, dest):
+        self.downloads += 1
+        dest.write_bytes(self.files[url])
+        return dest
+
+
+def _zip(members: dict[str, bytes]) -> bytes:
+    buffer = io.BytesIO()
+    with zipfile.ZipFile(buffer, "w") as bundle:
+        for name, data in members.items():
+            bundle.writestr(f"UKDA-0000-tab/tab/{name}", data)
+    return buffer.getvalue()
+
+
+def _zip_source(members: dict[str, bytes], *, pins=None) -> cut.InputSource:
+    pins = pins or {name: _sha(data) for name, data in members.items()}
+    return cut.InputSource(
+        key="survey",
+        kind="hf_zip_members",
+        directory="survey",
+        files=tuple(cut.PinnedFile(name, pins[name]) for name in members),
+        repo_id="org/repo",
+        repo_type="model",
+        revision="r",
+        filename="survey.zip",
+    )
+
+
+member_maps = st.dictionaries(
+    st.from_regex(r"[a-z]{1,8}\.tab", fullmatch=True),
+    st.binary(max_size=256),
+    min_size=1,
+    max_size=4,
+)
+
+
+@settings(suppress_health_check=[HealthCheck.function_scoped_fixture], deadline=None)
+@given(members=member_maps)
+def test_a_matching_archive_installs_once(tmp_path_factory, members):
+    root = tmp_path_factory.mktemp("fetch")
+    hub = FakeHub(root, {"survey.zip": _zip(members)})
+    source = _zip_source(members)
+    first = cut.fetch_inputs([source], root / "inputs", downloader=hub)
+    assert [r.status for r in first] == ["fetched"]
+    for name, data in members.items():
+        assert (root / "inputs/survey" / name).read_bytes() == data
+    downloads = hub.downloads
+    second = cut.fetch_inputs([source], root / "inputs", downloader=hub)
+    assert [r.status for r in second] == ["present"]
+    assert hub.downloads == downloads
+
+
+@settings(suppress_health_check=[HealthCheck.function_scoped_fixture], deadline=None)
+@given(members=member_maps, data=st.data())
+def test_a_file_that_misses_its_pin_is_never_installed(tmp_path_factory, members, data):
+    root = tmp_path_factory.mktemp("fetch")
+    victim = data.draw(st.sampled_from(sorted(members)))
+    pins = {name: _sha(value) for name, value in members.items()}
+    pins[victim] = _sha(members[victim] + b"tampered")
+    hub = FakeHub(root, {"survey.zip": _zip(members)})
+    result = cut.fetch_inputs(
+        [_zip_source(members, pins=pins)], root / "inputs", downloader=hub
+    )
+    assert result[0].status == "refused"
+    assert not (root / "inputs/survey" / victim).exists()
+    assert not list((root / "inputs").rglob("*.partial"))
+
+
+def test_a_corrupted_installed_file_is_replaced_not_trusted(tmp_path):
+    members = {"a.tab": b"alpha", "b.tab": b"beta"}
+    hub = FakeHub(tmp_path, {"survey.zip": _zip(members)})
+    source = _zip_source(members)
+    cut.fetch_inputs([source], tmp_path / "inputs", downloader=hub)
+    installed = tmp_path / "inputs/survey/a.tab"
+    installed.write_bytes(b"ALPHA")  # same size, different bytes and mtime
+    result = cut.fetch_inputs([source], tmp_path / "inputs", downloader=hub)
+    assert result[0].status == "fetched"
+    assert installed.read_bytes() == b"alpha"
+
+
+def test_a_missing_upload_is_reported_with_its_note(tmp_path):
+    source = cut.InputSource(
+        key="nts",
+        kind="hf_zip_members",
+        directory="nts",
+        files=(cut.PinnedFile("trip.tab", "0" * 64),),
+        repo_id="org/repo",
+        repo_type="model",
+        filename="nts.zip",
+        upload_note="upload nts.zip",
+    )
+    result = cut.fetch_inputs(
+        [source], tmp_path / "inputs", downloader=FakeHub(tmp_path, {})
+    )
+    assert result[0].status == "missing"
+    assert "upload nts.zip" in result[0].detail
+
+
+def test_the_archive_digest_is_checked_when_pinned(tmp_path):
+    members = {"a.tab": b"alpha"}
+    source = _zip_source(members)
+    pinned = cut.InputSource(**{**source.__dict__, "archive_sha256": "0" * 64})
+    hub = FakeHub(tmp_path, {"survey.zip": _zip(members)})
+    result = cut.fetch_inputs([pinned], tmp_path / "inputs", downloader=hub)
+    assert result[0].status == "refused"
+    assert "survey.zip hashes to" in result[0].detail
+
+
+# --------------------------------------------------------------------------- #
+# Resumability: each step runs once, and nothing is overwritten                 #
+# --------------------------------------------------------------------------- #
+
+
+BUILD_ROW = "d" * 64
+
+
+class FakeBuild:
+    """Stands in for the five tools: writes what each step writes."""
+
+    def __init__(
+        self,
+        paths: cut.CutPaths,
+        fail: set[str] | None = None,
+        signer: str | None = None,
+    ) -> None:
+        self.paths = paths
+        self.calls: list[str] = []
+        self.argv: dict[str, list[str]] = {}
+        self.env: dict[str, dict[str, str]] = {}
+        self.fail = fail or set()
+        self.signer = signer
+
+    def _report(self, **payload) -> str:
+        """A gate report, signed by ``signer``'s fingerprint when one is set."""
+
+        if self.signer:
+            payload["attestation"] = {"signing_key_sha256": self.signer}
+        return json.dumps(payload)
+
+    def __call__(
+        self, argv: list[str], cwd: Path, log_path: Path, env: dict[str, str]
+    ) -> int:
+        tool = Path(argv[1]).name if argv[1] != "-m" else argv[2]
+        step = {
+            "build_uk_frs_spine.py": "spine",
+            "build_uk_full.py": "national-dry-run"
+            if "--dry-run" in argv
+            else "national",
+            "score_uk_national_candidate.py": "score",
+            "certify_uk_release_cut.py": "certify",
+            "assemble_uk_release_dir.py": "assemble",
+            "microcosm.data.publish_cli": "publish",
+        }[tool]
+        self.calls.append(step)
+        self.argv[step] = argv
+        self.env[step] = env
+        if step in self.fail:
+            return 1
+        getattr(self, step.replace("-", "_"))(log_path)
+        return 0
+
+    def spine(self, log_path):
+        h5 = self.paths.spine_h5
+        h5.write_bytes(b"spine")
+        h5.with_name(h5.name + ".sha256").write_text(f"{_sha(b'spine')}  {h5.name}\n")
+        h5.with_suffix(".build.json").write_text("{}")
+        h5.with_suffix(".spine_gates.json").write_text(self._report(shippable=True))
+
+    def national_dry_run(self, log_path):
+        log_path.write_text('{"dry_run": true}')
+
+    def national(self, log_path):
+        run = self.paths.run_dir
+        run.mkdir(parents=True)
+        self.paths.candidate_h5.write_bytes(b"candidate")
+        for name in (
+            "calibration_diagnostics.json",
+            "national_target_registry.json",
+            "national_contract_registry.json",
+        ):
+            (run / name).write_text("{}")
+        (run / f"{cut.CANDIDATE_NAME}.terminal_gates.json").write_text(self._report())
+        (run / "build_record.json").write_text(
+            json.dumps({"artifacts": {"staging_h5": {"sha256": _sha(b"candidate")}}})
+        )
+        (run / "logbook-spool").mkdir()
+        (run / "logbook-spool" / f"{BUILD_ROW}.json").write_text("{}")
+
+    def score(self, log_path):
+        (self.paths.run_dir / "score_vs_incumbent.json").write_text(
+            json.dumps(
+                {
+                    "artifacts": {"candidate": {"sha256": _sha(b"candidate")}},
+                    "evaluation": {"verdict": "passed"},
+                }
+            )
+        )
+
+    def certify(self, log_path):
+        run = self.paths.run_dir
+        (run / f"{cut.CANDIDATE_NAME}.release_cut_gates.json").write_text(
+            self._report(shippable=True)
+        )
+        (run / f"{cut.CANDIDATE_NAME}.release_certification.json").write_text(
+            self._report(shippable=True, candidate={"sha256": _sha(b"candidate")})
+        )
+
+    def assemble(self, log_path):
+        self.paths.release_dir.mkdir(parents=True)
+        (self.paths.release_dir / "release_manifest.json").write_text("{}")
+        log_path.write_text(
+            "assembling...\n"
+            + json.dumps({"cut_tag": "microcosm-uk-2024-25-national-x", "n": 1})
+        )
+
+    def publish(self, log_path):
+        pass
+
+
+def _runner(tmp_path, fake=None, signer=None):
+    paths = _paths(tmp_path)
+    fake = fake or FakeBuild(paths, signer=signer)
+    sources = {s.key: s for s in cut.load_input_sources()}
+    runner = cut.Runner(
+        paths=paths, sources=sources, python="py", execute=fake, log=lambda _: None
+    )
+    return runner, fake
+
+
+def _all(runner):
+    cut.run_spine(runner, staging_local_only=True)
+    cut.run_national(runner, retry=False, logbook_prev_row_digest=None)
+    cut.run_score(runner)
+    cut.run_certify(runner)
+    return cut.run_assemble(runner)
+
+
+def test_certification_chains_on_the_national_build_row(tmp_path):
+    runner, fake = _runner(tmp_path)
+    cut.run_spine(runner, staging_local_only=True)
+    cut.run_national(runner, retry=False, logbook_prev_row_digest="a" * 64)
+    cut.run_score(runner)
+    cut.run_certify(runner)
+    national, certify = fake.argv["national"], fake.argv["certify"]
+    assert national[national.index("--logbook-prev-row-digest") + 1] == "a" * 64
+    assert certify[certify.index("--logbook-prev-row-digest") + 1] == BUILD_ROW
+
+
+@pytest.mark.parametrize("rows", [0, 2])
+def test_certification_needs_exactly_one_build_row(tmp_path, rows):
+    runner, fake = _runner(tmp_path)
+    cut.run_spine(runner, staging_local_only=True)
+    cut.run_national(runner, retry=False, logbook_prev_row_digest=None)
+    cut.run_score(runner)
+    spool = runner.paths.run_dir / "logbook-spool"
+    for row in spool.glob("*.json"):
+        row.unlink()
+    for index in range(rows):
+        (spool / f"{index:064x}.json").write_text("{}")
+    with pytest.raises(cut.CutError, match="Logbook rows"):
+        cut.run_certify(runner)
+    assert "certify" not in fake.calls
+
+
+def test_a_complete_run_executes_each_step_once_and_resumes_to_nothing(tmp_path):
+    runner, fake = _runner(tmp_path)
+    summary = _all(runner)
+    assert summary["tag"] == "microcosm-uk-2024-25-national-x"
+    assert fake.calls == [
+        "spine",
+        "national-dry-run",
+        "national",
+        "score",
+        "certify",
+        "assemble",
+    ]
+    _all(runner)  # every done-check now passes
+    assert len(fake.calls) == 6
+    state = json.loads(runner.paths.state.read_text())
+    assert {step: s["status"] for step, s in state["steps"].items()} == {
+        step: "done"
+        for step in (
+            "spine",
+            "national-dry-run",
+            "national",
+            "score",
+            "certify",
+            "assemble",
+        )
+    }
+
+
+@pytest.mark.parametrize(
+    "failing", ["spine", "national", "score", "certify", "assemble"]
+)
+def test_a_failed_step_stops_the_run_and_a_rerun_resumes_there(tmp_path, failing):
+    runner, fake = _runner(tmp_path)
+    fake.fail = {failing}
+    with pytest.raises(cut.CutError, match=f"{failing} exited 1"):
+        _all(runner)
+    assert json.loads(runner.paths.state.read_text())["steps"][failing]["status"] == (
+        "failed"
+    )
+    before = list(fake.calls)
+    fake.fail = set()
+    if failing == "national":
+        # The tool refuses an occupied --out; the runner moves the failed
+        # attempt aside only when asked.
+        runner.paths.run_dir.mkdir(parents=True, exist_ok=True)
+        with pytest.raises(cut.CutError, match="--retry-national"):
+            _all(runner)
+        cut.run_national(runner, retry=True, logbook_prev_row_digest=None)
+    _all(runner)
+    assert fake.calls.count(failing) == before.count(failing) + 1
+    # Steps that finished before the failure are not repeated.
+    for done in fake.calls[: before.index(failing)]:
+        assert fake.calls.count(done) == 1
+
+
+def test_an_incomplete_spine_is_never_rebuilt_over(tmp_path):
+    runner, fake = _runner(tmp_path)
+    runner.paths.spine_dir.mkdir(parents=True)
+    runner.paths.spine_h5.write_bytes(b"half a spine")
+    with pytest.raises(cut.CutError, match="--retry-spine"):
+        cut.run_spine(runner, staging_local_only=True)
+    assert fake.calls == []
+    assert runner.paths.spine_h5.read_bytes() == b"half a spine"
+
+
+def test_retrying_the_national_run_keeps_the_failed_attempt(tmp_path):
+    runner, fake = _runner(tmp_path)
+    cut.run_spine(runner, staging_local_only=True)
+    runner.paths.run_dir.mkdir(parents=True)
+    (runner.paths.run_dir / "evidence.json").write_text("kept")
+    cut.run_national(runner, retry=True, logbook_prev_row_digest=None)
+    aside = list(runner.paths.cut.glob("national.failed-*"))
+    assert len(aside) == 1 and (aside[0] / "evidence.json").read_text() == "kept"
+
+
+def test_a_losing_candidate_is_not_certified(tmp_path):
+    runner, fake = _runner(tmp_path)
+
+    def failing_score(log_path):
+        (runner.paths.run_dir / "score_vs_incumbent.json").write_text(
+            json.dumps(
+                {
+                    "artifacts": {"candidate": {"sha256": _sha(b"candidate")}},
+                    "evaluation": {"verdict": "failed"},
+                }
+            )
+        )
+
+    fake.score = failing_score
+    cut.run_spine(runner, staging_local_only=True)
+    cut.run_national(runner, retry=False, logbook_prev_row_digest=None)
+    with pytest.raises(cut.CutError, match="does not pass the incumbent score"):
+        cut.run_score(runner)
+    assert "certify" not in fake.calls
+
+
+@given(
+    prefix=st.lists(st.text(alphabet=st.characters(blacklist_characters="{}"))),
+    tag=st.from_regex(r"[a-z0-9-]{1,40}", fullmatch=True),
+)
+def test_the_assembly_summary_is_found_after_any_log_noise(prefix, tag):
+    text = "\n".join(prefix) + "\n" + json.dumps({"cut_tag": tag, "nested": {"a": 1}})
+    assert cut._last_json_object(text)["cut_tag"] == tag
+
+
+def test_status_reads_without_running_anything(tmp_path):
+    paths = _paths(tmp_path)
+    out = io.StringIO()
+    with redirect_stdout(out):
+        cut.status(paths)
+    assert "todo spine" in out.getvalue()
+
+
+def test_a_hosted_file_is_moved_into_place_not_copied(tmp_path):
+    """A multi-gigabyte input must not occupy the disk twice."""
+
+    data = b"facts"
+    source = cut.InputSource(
+        key="chronicle",
+        kind="hf_files",
+        directory="chronicle",
+        files=(cut.PinnedFile("consumer_facts.jsonl", _sha(data)),),
+        repo_id="org/inputs",
+        repo_type="dataset",
+        path_in_repo="chronicle-uk/abc",
+    )
+    hub = FakeHub(tmp_path, {"chronicle-uk/abc/consumer_facts.jsonl": data})
+    result = cut.fetch_inputs([source], tmp_path / "inputs", downloader=hub)
+    assert result[0].status == "fetched"
+    installed = tmp_path / "inputs/chronicle/consumer_facts.jsonl"
+    assert installed.read_bytes() == data
+    leftovers = [
+        p
+        for p in (tmp_path / "inputs").rglob("*")
+        if p.is_file() and p != installed and p.name != ".verified.json"
+    ]
+    assert leftovers == []
+
+
+def test_a_failed_dry_run_is_rerun(tmp_path):
+    runner, fake = _runner(tmp_path)
+    cut.run_spine(runner, staging_local_only=True)
+    fake.fail = {"national-dry-run"}
+    with pytest.raises(cut.CutError, match="national-dry-run exited 1"):
+        cut.run_national(runner, retry=False, logbook_prev_row_digest=None)
+    fake.fail = set()
+    cut.run_national(runner, retry=False, logbook_prev_row_digest=None)
+    assert fake.calls.count("national-dry-run") == 2
+    assert fake.calls.count("national") == 1
+
+
+def test_a_retried_spine_keeps_the_signed_failure_report(tmp_path):
+    """A gate-blocked spine writes its signed report before any H5; the
+    builder deletes sidecars on start, so a retry must move the attempt."""
+
+    runner, fake = _runner(tmp_path)
+    paths = runner.paths
+    paths.spine_dir.mkdir(parents=True)
+    report = paths.spine_h5.with_suffix(".spine_gates.json")
+    report.write_text('{"shippable": false, "attestation": {"signature": "s"}}')
+    with pytest.raises(cut.CutError, match="--retry-spine"):
+        cut.run_spine(runner, staging_local_only=True)
+    assert fake.calls == [] and report.exists()
+    cut.run_spine(runner, staging_local_only=True, retry=True)
+    kept = list(paths.cut.glob("spine.failed-*/" + report.name))
+    assert len(kept) == 1 and '"shippable": false' in kept[0].read_text()
+    assert cut.spine_done(paths)[0]
+
+
+def test_retried_score_and_certification_keep_the_earlier_evidence(tmp_path):
+    runner, fake = _runner(tmp_path)
+    cut.run_spine(runner, staging_local_only=True)
+    cut.run_national(runner, retry=False, logbook_prev_row_digest=None)
+    receipt = runner.paths.run_dir / "score_vs_incumbent.json"
+    receipt.write_text('{"evaluation": {"verdict": "failed"}}')
+    cut.run_score(runner)
+    kept = list(runner.paths.run_dir.glob("score_vs_incumbent.json.superseded-*"))
+    assert len(kept) == 1 and "failed" in kept[0].read_text()
+    certification = (
+        runner.paths.run_dir / f"{cut.CANDIDATE_NAME}.release_certification.json"
+    )
+    certification.write_text('{"shippable": false}')
+    cut.run_certify(runner)
+    kept = list(runner.paths.run_dir.glob(f"{certification.name}.superseded-*"))
+    assert len(kept) == 1 and "false" in kept[0].read_text()
+    assert cut.certify_done(runner.paths)[0]
+
+
+def test_a_relative_work_dir_is_made_absolute(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    args = cut._parse(["status", "--label", "x", "--work-dir", "work",
+                       "--previous-h5", "prev.h5"])  # fmt: skip
+    assert args.work_dir == tmp_path.resolve() / "work"
+    assert args.previous_h5 == tmp_path.resolve() / "prev.h5"
+
+
+def test_a_stale_stage1_comparison_is_redone_and_kept(tmp_path):
+    runner, fake = _runner(tmp_path)
+    cut.run_spine(runner, staging_local_only=True)
+    cut.run_national(runner, retry=False, logbook_prev_row_digest=None)
+    previous = tmp_path / "previous.h5"
+    previous.write_bytes(b"previous")
+    output = runner.paths.diagnostics / "stage1_comparison.json"
+
+    def stage1(argv, cwd, log_path, env):
+        fake.calls.append("stage1")
+        output.parent.mkdir(parents=True, exist_ok=True)
+        output.write_text(
+            json.dumps(
+                {
+                    "artifacts": {
+                        "candidate": {"sha256": _sha(b"candidate")},
+                        "previous": {"sha256": _sha(previous.read_bytes())},
+                    }
+                }
+            )
+        )
+        return 0
+
+    runner.execute = stage1
+    cut.run_stage1(runner, previous)
+    cut.run_stage1(runner, previous)  # current: not rerun
+    assert fake.calls.count("stage1") == 1
+    previous.write_bytes(b"another promoted cut")
+    cut.run_stage1(runner, previous)
+    assert fake.calls.count("stage1") == 2
+    assert len(list(output.parent.glob("stage1_comparison.json.superseded-*"))) == 1
+
+
+def test_the_cache_never_trusts_bytes_it_did_not_hash(tmp_path):
+    """Equal-length replacement with the mtime restored is still re-hashed."""
+
+    import os
+
+    data = b"original-bytes"
+    path = tmp_path / "input.tab"
+    path.write_bytes(data)
+    pin = cut.PinnedFile("input.tab", _sha(data), len(data))
+    cache = cut.VerifiedFiles(tmp_path / ".verified.json")
+    assert cache.matches(path, pin)
+    stat = path.stat()
+    path.write_bytes(b"tampered-bytes")
+    os.utime(path, ns=(stat.st_atime_ns, stat.st_mtime_ns))
+    assert path.stat().st_mtime_ns == stat.st_mtime_ns
+    assert not cache.matches(path, pin)
+
+
+# --------------------------------------------------------------------------- #
+# Signing key: a cut resumes only under the key that signed it                  #
+# --------------------------------------------------------------------------- #
+
+KEY_A, KEY_B = b"\xa1" * 32, b"\xb2" * 32
+
+
+def _fp(key: bytes) -> str:
+    return hashlib.sha256(key).hexdigest()
+
+
+def _env(key: bytes) -> dict[str, str]:
+    from microcosm.data.gate_signing_keys import UK_GATE_SIGNING_KEY_ENV
+
+    return {UK_GATE_SIGNING_KEY_ENV: base64.b64encode(key).decode()}
+
+
+@pytest.fixture
+def two_builders(monkeypatch):
+    """Two registered, active builders' keys, each with its own label."""
+
+    from microcosm.data import gate_signing_keys as registry
+
+    table = {
+        _fp(key): registry.GateSigningKey(
+            key_sha256=_fp(key),
+            label=label,
+            status="active",
+            custodian=f"{label}'s holder",
+            held_in="the test",
+            registered="2026-10-26",
+            evidence="test",
+        )
+        for key, label in ((KEY_A, "builder-a"), (KEY_B, "builder-b"))
+    }
+    monkeypatch.setattr(
+        registry, "_registry", lambda country: table if country == "uk" else None
+    )
+    return table
+
+
+def test_a_resumed_cut_needs_the_key_that_signed_it(tmp_path, two_builders):
+    runner, _ = _runner(tmp_path, signer=_fp(KEY_A))
+    cut.run_spine(runner, staging_local_only=True)
+    cut.run_national(runner, retry=False, logbook_prev_row_digest=None)
+    other = cut.signing_key_check(paths=runner.paths, environ=_env(KEY_B))
+    assert not other.ok
+    assert "builder-a" in other.detail and _fp(KEY_A) in other.detail
+    assert cut.signing_key_check(paths=runner.paths, environ=_env(KEY_A)).ok
+
+
+def test_an_unfinished_attempt_does_not_bind_the_key(tmp_path, two_builders):
+    runner, _ = _runner(tmp_path, signer=_fp(KEY_A))
+    cut.run_spine(runner, staging_local_only=True)
+    run = runner.paths.run_dir
+    run.mkdir(parents=True)
+    (run / f"{cut.CANDIDATE_NAME}.terminal_gates.json").write_text(
+        json.dumps({"attestation": {"signing_key_sha256": _fp(KEY_B)}})
+    )
+    # No build record: --retry-national moves this attempt aside before it runs.
+    assert cut.signing_key_check(paths=runner.paths, environ=_env(KEY_A)).ok
+
+
+def test_a_cut_signed_by_two_keys_is_refused(tmp_path, two_builders):
+    runner, fake = _runner(tmp_path, signer=_fp(KEY_A))
+    cut.run_spine(runner, staging_local_only=True)
+    fake.signer = _fp(KEY_B)
+    cut.run_national(runner, retry=False, logbook_prev_row_digest=None)
+    check = cut.signing_key_check(paths=runner.paths, environ=_env(KEY_A))
+    assert not check.ok and "more than one key" in check.detail
+
+
+def test_a_signer_retired_after_certification_still_finishes(tmp_path, two_builders):
+    runner, _ = _runner(tmp_path, signer=_fp(KEY_A))
+    cut.run_spine(runner, staging_local_only=True)
+    cut.run_national(runner, retry=False, logbook_prev_row_digest=None)
+    cut.run_score(runner)
+    two_builders[_fp(KEY_A)] = dataclasses.replace(
+        two_builders[_fp(KEY_A)], status="retired", retired_on="2026-10-26"
+    )
+    # The certification still has to be signed, which a retired key may not do.
+    assert not cut.signing_key_check(paths=runner.paths, environ=_env(KEY_A)).ok
+    cut.run_certify(runner)
+    # Assembly and publication only verify.
+    assert cut.signing_key_check(paths=runner.paths, environ=_env(KEY_A)).ok
+
+
+def test_the_receipt_names_the_cut_signer(tmp_path, two_builders, monkeypatch):
+    runner, _ = _runner(tmp_path, signer=_fp(KEY_A))
+    _all(runner)
+    for name, value in _env(KEY_B).items():
+        monkeypatch.setenv(name, value)
+    cut.write_receipt(runner, {"tag": "t", "published": False})
+    receipt = json.loads(runner.paths.receipt.read_text())
+    assert receipt["signing_key_sha256"] == _fp(KEY_A)
+
+
+def test_the_signed_reports_are_the_ones_assembly_reads(tmp_path):
+    runner, _ = _runner(tmp_path)
+    _all(runner)
+    argv = cut.assemble_argv(runner.paths, python="py")
+
+    def value(flag: str) -> Path:
+        return Path(argv[argv.index(flag) + 1])
+
+    assert set(cut.cut_signed_reports(runner.paths)) == {
+        value("--spine-h5").with_suffix(".spine_gates.json"),
+        value("--seam-gate-report"),
+        value("--release-cut-gate-json"),
+        value("--certification-json"),
+    }
+
+
+@settings(max_examples=60, deadline=None)
+@given(signers=st.lists(st.sampled_from([None, "a", "b"]), min_size=1, max_size=4))
+def test_reports_bind_one_key_or_none(tmp_path_factory, signers):
+    root = tmp_path_factory.mktemp("reports")
+    fingerprints = {"a": _fp(KEY_A), "b": _fp(KEY_B)}
+    reports = []
+    for index, signer in enumerate(signers):
+        attestation = (
+            {} if signer is None else {"signing_key_sha256": fingerprints[signer]}
+        )
+        report = root / f"report{index}.json"
+        report.write_text(json.dumps({"attestation": attestation}))
+        reports.append(report)
+    named = {signer for signer in signers if signer}
+    if len(named) > 1:
+        with pytest.raises(cut.CutError, match="more than one key"):
+            cut.reports_signing_key(reports)
+    else:
+        expected = fingerprints[named.pop()] if named else None
+        assert cut.reports_signing_key(reports) == expected
+
+
+# --------------------------------------------------------------------------- #
+# Host checks: nothing specific to one machine unless the operator asks         #
+# --------------------------------------------------------------------------- #
+
+
+def test_no_reservation_is_checked_unless_configured(tmp_path):
+    names = [check.name for check in cut.host_checks(tmp_path, min_free_gb=0)]
+    assert "host reservation" not in names
+
+
+def test_a_configured_reservation_tool_that_is_missing_fails(tmp_path):
+    checks = cut.host_checks(
+        tmp_path,
+        min_free_gb=0,
+        reservation_tool=tmp_path / "missing.py",
+        reservation_caller="builder",
+    )
+    reservation = next(check for check in checks if check.name == "host reservation")
+    assert not reservation.ok and reservation.blocking
+
+
+@pytest.mark.parametrize("caller, allowed", [("builder", True), ("other", False)])
+def test_the_reservation_tool_is_asked_about_the_caller(tmp_path, caller, allowed):
+    tool = tmp_path / "reservation.py"
+    tool.write_text(
+        "import sys\n"
+        "raise SystemExit(0 if sys.argv[1:] == ['allowed', 'builder'] else 1)\n"
+    )
+    checks = cut.host_checks(
+        tmp_path, min_free_gb=0, reservation_tool=tool, reservation_caller=caller
+    )
+    reservation = next(check for check in checks if check.name == "host reservation")
+    assert reservation.ok is allowed
+
+
+@pytest.mark.parametrize(
+    "flags", [["--reservation-tool", "r.py"], ["--reservation-caller", "builder"]]
+)
+def test_a_reservation_needs_both_its_tool_and_its_caller(flags):
+    with pytest.raises(SystemExit):
+        cut._parse(["preflight", "--label", "t", *flags])
+
+
+def test_the_signing_key_reaches_only_the_steps_that_sign_or_verify(
+    tmp_path, monkeypatch
+):
+    from microcosm.data.gate_signing_keys import UK_GATE_SIGNING_KEY_ENV
+
+    monkeypatch.setenv(UK_GATE_SIGNING_KEY_ENV, "key-under-test")
+    monkeypatch.setenv("HF_TOKEN", "hf-under-test")
+    runner, fake = _runner(tmp_path)
+    cut.run_spine(runner, staging_local_only=True)
+    cut.run_national(runner, retry=False, logbook_prev_row_digest=None)
+    # Make the score step run, so its environment is seen too.
+    (runner.paths.run_dir / "score_vs_incumbent.json").unlink(missing_ok=True)
+    cut.run_score(runner)
+    cut.run_certify(runner)
+    cut.run_assemble(runner)
+    with_key = {
+        step for step, env in fake.env.items() if UK_GATE_SIGNING_KEY_ENV in env
+    }
+    assert with_key == {"spine", "national", "certify", "assemble"}
+    assert {"national-dry-run", "score"} <= set(fake.env) - with_key
+    assert all(env["HF_TOKEN"] == "hf-under-test" for env in fake.env.values())
+
+
+def test_the_preflight_test_runs_never_get_the_key(monkeypatch):
+    from microcosm.data.gate_signing_keys import UK_GATE_SIGNING_KEY_ENV
+
+    monkeypatch.setenv(UK_GATE_SIGNING_KEY_ENV, "key-under-test")
+    seen = []
+    monkeypatch.setattr(
+        cut.subprocess,
+        "run",
+        lambda argv, **kw: (
+            seen.append(kw["env"]) or cut.subprocess.CompletedProcess(argv, 0, "", "")
+        ),
+    )
+    cut.contract_pin_check("py")
+    cut.surfaces_check("py", Path("/facts"))
+    assert len(seen) == 2
+    assert all(UK_GATE_SIGNING_KEY_ENV not in env for env in seen)
+    assert seen[1]["CHRONICLE_UK_FACTS"] == "/facts"
diff --git a/packages/microcosm-build/tests/engine_free/uk/test_uk_full_build_cli.py b/packages/microcosm-build/tests/engine_free/uk/test_uk_full_build_cli.py
index 66ee437d4a..033a03aac0 100644
--- a/packages/microcosm-build/tests/engine_free/uk/test_uk_full_build_cli.py
+++ b/packages/microcosm-build/tests/engine_free/uk/test_uk_full_build_cli.py
@@ -261,6 +261,7 @@ def test_national_role_is_validated_then_built_through_the_graph(tmp_path, monke
     attempt id, the Hub pre-flight, the Logbook and the staging telemetry
     live in the driver's national envelope.
     """
+    monkeypatch.setenv(SIGNING_KEY_ENV, TEST_SIGNING_KEY)
     argv = _national_argv(tmp_path)
     national = cli.parse_args(argv)
     assert national._posture is cli.uk_rowwise_posture("national")
@@ -1941,6 +1942,7 @@ def test_national_interrupt_records_a_discarded_row_and_re_raises(
     one: the seam's terminal-disposition contract, kept by the driver (the
     failure sidecar names the interrupt, the row says ``discarded``, the
     interrupt propagates)."""
+    monkeypatch.setenv(SIGNING_KEY_ENV, TEST_SIGNING_KEY)
     argv = _national_argv(tmp_path)
     monkeypatch.setattr(cli, "preflight_staged_dataset", lambda args: None)
     monkeypatch.setattr(
@@ -2008,6 +2010,7 @@ def test_dense_validation_result_matches_emitted_run_status(
 def test_build_lifecycle_handles_returned_errors_and_exceptions(
     tmp_path, monkeypatch, fake_telemetry_emitters, role, outcome
 ):
+    monkeypatch.setenv(SIGNING_KEY_ENV, TEST_SIGNING_KEY)
     args = (
         arguments(tmp_path)
         if role == "dense"
@@ -2334,6 +2337,7 @@ def test_a_sigterm_during_the_national_build_records_a_discarded_row(
     tmp_path, monkeypatch
 ):
     """The national line routes a SIGTERM through its interrupt arm too."""
+    monkeypatch.setenv(SIGNING_KEY_ENV, TEST_SIGNING_KEY)
     argv = _national_argv(tmp_path)
     monkeypatch.setattr(cli, "preflight_staged_dataset", lambda args: None)
     monkeypatch.setattr(
diff --git a/packages/microcosm-build/tests/engine_free/uk/test_uk_gate_signing_key_registry.py b/packages/microcosm-build/tests/engine_free/uk/test_uk_gate_signing_key_registry.py
new file mode 100644
index 0000000000..de000d6128
--- /dev/null
+++ b/packages/microcosm-build/tests/engine_free/uk/test_uk_gate_signing_key_registry.py
@@ -0,0 +1,239 @@
+"""Every UK signer and verifier consults the committed signing key registry."""
+
+from __future__ import annotations
+
+import ast
+import base64
+import json
+from pathlib import Path
+
+import pytest
+
+from microcosm.build import gate_battery
+from microcosm.build.uk_runtime import (
+    calibration_run,
+    national_role,
+    release_certification,
+)
+from microcosm.data import contract
+from microcosm.data import gate_signing_keys as registry
+from microcosm.data.gate_signing_keys import (
+    UK_GATE_SIGNING_KEY_ENV,
+    GateSigningKey,
+    GateSigningKeyError,
+    gate_signing_key_fingerprint,
+)
+
+ACTIVE = b"\x41" * 32
+RETIRED = b"\x52" * 32
+REVOKED = b"\x56" * 32
+UNREGISTERED = b"\x55" * 32
+
+
+def _entry(key: bytes, status: str) -> GateSigningKey:
+    return GateSigningKey(
+        key_sha256=gate_signing_key_fingerprint(key),
+        label=f"test-{status}",
+        status=status,  # type: ignore[arg-type]
+        custodian="test",
+        held_in="test",
+        registered="2026-10-22",
+        evidence="test",
+        retired_on=None if status == "active" else "2026-10-22",
+    )
+
+
+@pytest.fixture
+def strict_registry(monkeypatch):
+    """A registry with one key of each status, and nothing else admitted."""
+
+    table = {
+        entry.key_sha256: entry
+        for entry in (
+            _entry(ACTIVE, "active"),
+            _entry(RETIRED, "retired"),
+            _entry(REVOKED, "revoked"),
+        )
+    }
+    monkeypatch.setattr(
+        registry, "_registry", lambda country: table if country == "uk" else None
+    )
+    return table
+
+
+def _use_key(monkeypatch, key: bytes) -> None:
+    monkeypatch.setenv(UK_GATE_SIGNING_KEY_ENV, base64.b64encode(key).decode())
+
+
+def test_every_layer_reads_one_variable():
+    assert gate_battery.gate_signing_key_env("uk") == UK_GATE_SIGNING_KEY_ENV
+    assert contract._UK_GATE_BATTERY_SIGNING_KEY_ENV == UK_GATE_SIGNING_KEY_ENV
+
+
+@pytest.mark.parametrize(
+    "tool",
+    [
+        "run_uk_cut.py",
+        "modal_uk_cut.py",
+        "preflight_uk_local_release_candidate.py",
+    ],
+)
+def test_the_uk_cut_tools_import_the_variable_name(tool):
+    """They import it from the registry, never copy it (docs/shared-constants.md)."""
+
+    source = (Path(__file__).resolve().parents[5] / "tools" / tool).read_text()
+    literals = {
+        node.value
+        for node in ast.walk(ast.parse(source))
+        if isinstance(node, ast.Constant)
+    }
+    assert UK_GATE_SIGNING_KEY_ENV not in literals
+
+
+def test_a_registry_refusal_is_a_signing_error_not_a_crash():
+    """The battery turns a RuntimeError into an unsigned, unshippable report;
+    the registry's refusal must be one."""
+
+    assert issubclass(GateSigningKeyError, RuntimeError)
+
+
+@pytest.mark.parametrize(
+    ("key", "signs"),
+    [(ACTIVE, True), (RETIRED, False), (REVOKED, False), (UNREGISTERED, False)],
+)
+def test_the_battery_signs_only_with_an_active_key(
+    strict_registry, monkeypatch, key, signs
+):
+    _use_key(monkeypatch, key)
+    if signs:
+        assert gate_battery._signing_key("uk") == key
+    else:
+        with pytest.raises(GateSigningKeyError):
+            gate_battery._signing_key("uk")
+
+
+@pytest.mark.parametrize(
+    ("key", "certifies"),
+    [(ACTIVE, True), (RETIRED, False), (REVOKED, False), (UNREGISTERED, False)],
+)
+def test_the_certifier_needs_an_active_key(
+    strict_registry, monkeypatch, key, certifies
+):
+    _use_key(monkeypatch, key)
+    if certifies:
+        assert release_certification._require_signing_key() == key
+    else:
+        with pytest.raises(release_certification.UKReleaseCertificationError):
+            release_certification._require_signing_key()
+
+
+def test_the_national_role_refuses_an_unusable_key_before_loading_inputs(
+    strict_registry, monkeypatch
+):
+    _use_key(monkeypatch, ACTIVE)
+    national_role.require_signing_key()
+    for key in (RETIRED, UNREGISTERED):
+        _use_key(monkeypatch, key)
+        with pytest.raises(ValueError, match="registered UK gate signing key"):
+            national_role.require_signing_key()
+    monkeypatch.delenv(UK_GATE_SIGNING_KEY_ENV)
+    with pytest.raises(ValueError, match=UK_GATE_SIGNING_KEY_ENV):
+        national_role.require_signing_key()
+
+
+def test_resigning_a_scoped_report_needs_an_active_key(strict_registry, monkeypatch):
+    payload = {"attestation": {"signing_error": "unsigned at battery time"}}
+    _use_key(monkeypatch, UNREGISTERED)
+    with pytest.raises(GateSigningKeyError, match="not registered"):
+        calibration_run.resign_uk_gate_report(payload)
+    assert payload["attestation"] == {"signing_error": "unsigned at battery time"}
+
+
+def test_the_local_preflight_names_an_unregistered_key(
+    strict_registry, tmp_path, monkeypatch
+):
+    import importlib.util
+    from pathlib import Path
+
+    path = (
+        Path(__file__).resolve().parents[5]
+        / "tools/preflight_uk_local_release_candidate.py"
+    )
+    spec = importlib.util.spec_from_file_location("preflight_uk_local", path)
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    failures = module.check_env(
+        pins_path=tmp_path / "missing-pins",
+        spine_h5=tmp_path / "spine.h5",
+        ladder_npz=tmp_path / "ladder.npz",
+        ledger_dir=tmp_path,
+        environ={
+            module.UK_GATE_SIGNING_KEY_ENV: base64.b64encode(UNREGISTERED).decode()
+        },
+        verify_digests=False,
+    )
+    assert any("not registered" in failure for failure in failures)
+    failures = module.check_env(
+        pins_path=tmp_path / "missing-pins",
+        spine_h5=tmp_path / "spine.h5",
+        ladder_npz=tmp_path / "ladder.npz",
+        ledger_dir=tmp_path,
+        environ={module.UK_GATE_SIGNING_KEY_ENV: base64.b64encode(ACTIVE).decode()},
+        verify_digests=False,
+    )
+    assert not any(module.UK_GATE_SIGNING_KEY_ENV in failure for failure in failures)
+
+
+def test_a_signed_report_verifies_until_its_key_is_revoked(
+    strict_registry, tmp_path, monkeypatch
+):
+    """Round trip: the battery signs under the active key and the publisher's
+    dense check accepts it; retiring keeps it verifiable; revoking does not."""
+
+    from microcosm.build.uk_runtime.graph_national import replay_uk_dense_gate_battery
+    from test_support.microcosm_build.uk_full_build_cli import STEM, gate_payload
+
+    _use_key(monkeypatch, ACTIVE)
+    report = replay_uk_dense_gate_battery(
+        json.loads(gate_payload("terminal", release_candidate=True)),
+        report_path=tmp_path / f"{STEM}.local_gates.json",
+        release_id="uk-local-candidate-f100-s0-test",
+        release_candidate=True,
+    )
+    assert report["shippable"] is True
+    assert report["attestation"]["signing_key_sha256"] == (
+        gate_signing_key_fingerprint(ACTIVE)
+    )
+
+    def failures() -> list[str]:
+        found: list[str] = []
+        contract._check_uk_dense_gate_report(
+            report, failures=found, attempt_id="uk-local-candidate-f100-s0-test"
+        )
+        return found
+
+    assert failures() == []
+    for status, verifies in (("retired", True), ("revoked", False)):
+        strict_registry[gate_signing_key_fingerprint(ACTIVE)] = _entry(ACTIVE, status)
+        assert (failures() == []) is verifies
+    # An unregistered key that signed is refused even though the HMAC is valid.
+    strict_registry.pop(gate_signing_key_fingerprint(ACTIVE))
+    assert any("not registered" in line for line in failures())
+
+
+def test_an_unregistered_signer_writes_an_unshippable_report(
+    strict_registry, tmp_path, monkeypatch
+):
+    from microcosm.build.uk_runtime.graph_national import replay_uk_dense_gate_battery
+    from test_support.microcosm_build.uk_full_build_cli import STEM, gate_payload
+
+    _use_key(monkeypatch, UNREGISTERED)
+    report = replay_uk_dense_gate_battery(
+        json.loads(gate_payload("terminal", release_candidate=True)),
+        report_path=tmp_path / f"{STEM}.local_gates.json",
+        release_id="uk-local-candidate-f100-s0-test",
+        release_candidate=True,
+    )
+    assert report["shippable"] is False
+    assert report["attestation"]["signature"] is None
+    assert "not registered" in report["attestation"]["signing_error"]
diff --git a/packages/microcosm-build/tests/engine_free/uk/test_uk_local_release_preflight.py b/packages/microcosm-build/tests/engine_free/uk/test_uk_local_release_preflight.py
index 445e0b6fa7..d3ccc4e43c 100644
--- a/packages/microcosm-build/tests/engine_free/uk/test_uk_local_release_preflight.py
+++ b/packages/microcosm-build/tests/engine_free/uk/test_uk_local_release_preflight.py
@@ -690,7 +690,7 @@ def sha(path):
     pins.write_text(
         f"spine={sha(spine)} ladder={sha(ladder)} facts={sha(ledger / 'consumer_facts.jsonl')} manifest={sha(ledger / 'manifest.json')}\n"
     )
-    good_env = {module.SIGNING_KEY_ENV: base64.b64encode(b"\x07" * 32).decode()}
+    good_env = {module.UK_GATE_SIGNING_KEY_ENV: base64.b64encode(b"\x07" * 32).decode()}
     assert (
         module.check_env(
             pins_path=pins,
@@ -704,7 +704,7 @@ def sha(path):
     failures = module.check_env(
         pins_path=pins, spine_h5=spine, ladder_npz=ladder, ledger_dir=ledger, environ={}
     )
-    assert any(module.SIGNING_KEY_ENV in f for f in failures)
+    assert any(module.UK_GATE_SIGNING_KEY_ENV in f for f in failures)
     pins.write_text("spine=deadbeef ladder=x facts=y manifest=z\n")
     failures = module.check_env(
         pins_path=pins,
diff --git a/packages/microcosm-build/tests/engine_free/us/test_us_plan.py b/packages/microcosm-build/tests/engine_free/us/test_us_plan.py
index 2d0963d80d..841fd212bc 100644
--- a/packages/microcosm-build/tests/engine_free/us/test_us_plan.py
+++ b/packages/microcosm-build/tests/engine_free/us/test_us_plan.py
@@ -986,6 +986,14 @@ def test_no_incumbent_data_package_references_in_live_tree(self) -> None:
             # never import or execute the retired data package.
             "packages/microcosm-build/src/microcosm/build/uk/efrs_parity_reference.json",
             "packages/microcosm-build/src/microcosm/build/uk/frs_release.json",
+            # The UK cut runner's input locations name the gated repository
+            # that hosts the licensed UKDS archives and the sha-pinned
+            # incumbent, as frs_release.json does: download locations
+            # verified against committed pins, never an import.
+            "tools/uk_cut_inputs.json",
+            # Its operator doc names the same repository as the upload
+            # destination for the licensed NTS and LCFS archives.
+            "docs/uk-cut-anyone.md",
             # The UK population contract's registry-parity accounting names the
             # retired data package by necessity: 651 rows at pinned ref ebf733c
             # = 609 mapped + 42 signed exclusions + 3 unmapped declarations.
diff --git a/packages/microcosm-data/src/microcosm/data/contract.py b/packages/microcosm-data/src/microcosm/data/contract.py
index 7ebb65a13d..1ab48d3554 100644
--- a/packages/microcosm-data/src/microcosm/data/contract.py
+++ b/packages/microcosm-data/src/microcosm/data/contract.py
@@ -49,6 +49,7 @@
 from pydantic import ValidationError
 
 from microcosm.data.denied_pools import denied_pool_publication_for
+from microcosm.data.gate_signing_keys import unregistered_gate_signing_key_problem
 from microcosm.data.stored_inputs import is_model_named
 from microcosm.data.us_critical_targets import (
     US_CRITICAL_TARGET_FIT_REQUIREMENTS as _US_CRITICAL_TARGET_FIT_REQUIREMENTS,
@@ -1099,15 +1100,39 @@ def _uk_release_key_from_env(env_var: str, failures: list[str]) -> bytes | None:
 
 
 def _uk_terminal_verification_key(failures: list[str]) -> bytes | None:
-    """The legacy aggregator's trust root (schema-3 reports)."""
+    """The legacy aggregator's trust root (schema-3 reports).
 
-    return _uk_release_key_from_env(_UK_TERMINAL_GATE_SIGNING_KEY_ENV, failures)
+    Bound to the same committed registry as schema 4: no schema-3 report is
+    published (every UK terminal report on the Hub is schema 4), so a
+    legacy report verifies only under a registered key.
+    """
+
+    key = _uk_release_key_from_env(_UK_TERMINAL_GATE_SIGNING_KEY_ENV, failures)
+    if key is None:
+        return None
+    problem = unregistered_gate_signing_key_problem("uk", key, purpose="verify")
+    if problem is not None:
+        failures.append(f"{_UK_TERMINAL_GATE_SIGNING_KEY_ENV}: {problem}")
+        return None
+    return key
 
 
 def _uk_gate_battery_verification_key(failures: list[str]) -> bytes | None:
-    """The shared executor's trust root (schema-4 reports)."""
+    """The shared executor's trust root (schema-4 reports).
 
-    return _uk_release_key_from_env(_UK_GATE_BATTERY_SIGNING_KEY_ENV, failures)
+    The key in the environment must also be registered (active or retired)
+    in ``microcosm.data.gate_signing_keys``: without that, any key that
+    signed a report would verify it.
+    """
+
+    key = _uk_release_key_from_env(_UK_GATE_BATTERY_SIGNING_KEY_ENV, failures)
+    if key is None:
+        return None
+    problem = unregistered_gate_signing_key_problem("uk", key, purpose="verify")
+    if problem is not None:
+        failures.append(f"{_UK_GATE_BATTERY_SIGNING_KEY_ENV}: {problem}")
+        return None
+    return key
 
 
 def _reject_json_constant(token: str) -> None:
diff --git a/packages/microcosm-data/src/microcosm/data/gate_signing_keys.py b/packages/microcosm-data/src/microcosm/data/gate_signing_keys.py
new file mode 100644
index 0000000000..2235050a10
--- /dev/null
+++ b/packages/microcosm-data/src/microcosm/data/gate_signing_keys.py
@@ -0,0 +1,412 @@
+"""Committed registry of the keys allowed to sign UK gate-battery reports.
+
+Gate reports, release-cut certifications and dense gate reports are signed
+with HMAC-SHA256 under the key in ``MICROCOSM_UK_TERMINAL_GATE_SIGNING_KEY``.
+Before this registry, every verifier trusted whichever key was in the
+environment: a report signed by any 32-byte key verified, provided the
+verifier held the same key. Verification now also requires the key's SHA-256
+fingerprint to be registered here, so a cut can only be certified,
+assembled or published under a key the repository names.
+
+HMAC is symmetric: verifying a report needs the secret that signed it. So a
+cut is signed, certified and published end to end by one key holder, and
+the registry names one key per builder rather than one shared secret. A new
+builder gets their own key and a reviewed entry; nobody has to share a key.
+
+Statuses:
+
+* ``active``: may sign new reports and verify.
+* ``retired``: verifies reports already signed, but signs nothing new.
+  Use it for a routine rotation.
+* ``revoked``: neither signs nor verifies. Use it if a key leaks; every cut
+  it signed must then be re-signed or withdrawn.
+
+It lives in ``microcosm-data`` because the publisher verifies, and the
+build shard imports it for its signing-side checks. Entries are
+source-coded; add, retire or revoke one only in a reviewed pull request
+(the procedure is in ``docs/uk-cut-anyone.md``).
+
+Run ``python -m microcosm.data.gate_signing_keys check`` to see whether the
+key in your environment may sign.
+"""
+
+from __future__ import annotations
+
+import argparse
+import base64
+import binascii
+import getpass
+import hashlib
+import json
+import os
+import re
+import secrets
+import subprocess
+import sys
+from collections.abc import Mapping, Sequence
+from dataclasses import asdict, dataclass
+from types import MappingProxyType
+from typing import Literal
+
+__all__ = [
+    "GATE_SIGNING_KEY_STATUSES",
+    "UK_GATE_SIGNING_KEYS",
+    "UK_GATE_SIGNING_KEY_ENV",
+    "GateSigningKey",
+    "GateSigningKeyError",
+    "decode_gate_signing_key",
+    "gate_signing_key_fingerprint",
+    "registered_gate_signing_key",
+    "require_registered_gate_signing_key",
+    "store_in_keychain",
+    "unregistered_gate_signing_key_problem",
+]
+
+#: The environment variable every UK signer and verifier reads. Lockstep with
+#: ``microcosm.build.gate_battery.gate_signing_key_env("uk")``.
+UK_GATE_SIGNING_KEY_ENV = "MICROCOSM_UK_TERMINAL_GATE_SIGNING_KEY"
+
+GateSigningKeyStatus = Literal["active", "retired", "revoked"]
+GateSigningKeyPurpose = Literal["sign", "verify"]
+GATE_SIGNING_KEY_STATUSES: frozenset[str] = frozenset({"active", "retired", "revoked"})
+_PURPOSE_STATUSES: Mapping[str, frozenset[str]] = MappingProxyType(
+    {"sign": frozenset({"active"}), "verify": frozenset({"active", "retired"})}
+)
+
+
+class GateSigningKeyError(RuntimeError):
+    """The key in the environment is absent, malformed or not registered."""
+
+
+@dataclass(frozen=True)
+class GateSigningKey:
+    """One registered signing key, identified by its fingerprint only.
+
+    The fingerprint is the SHA-256 of the 32 decoded key bytes: the value
+    every report records as ``attestation.signing_key_sha256``. The secret
+    itself is never committed.
+    """
+
+    key_sha256: str
+    label: str
+    status: GateSigningKeyStatus
+    custodian: str
+    held_in: str
+    registered: str
+    evidence: str
+    retired_on: str | None = None
+
+
+UK_GATE_SIGNING_KEYS: Mapping[str, GateSigningKey] = MappingProxyType(
+    {
+        "66bf0e29dbdabc2e3d7a79f21f43ac28d17b592faaf91e67c9bcf9b30c09a6ff": (
+            GateSigningKey(
+                key_sha256=(
+                    "66bf0e29dbdabc2e3d7a79f21f43ac28d17b592faaf91e67c9bcf9b30c09a6ff"
+                ),
+                label="uk-gate-juaristi22-2026",
+                status="active",
+                custodian="María Juaristi (GitHub juaristi22)",
+                held_in="her build machine; not in a shared store",
+                registered="2026-10-22",
+                evidence=(
+                    "Signed every UK gate report on record from 2026-08-18 "
+                    "(uk/national_staging_build_record.json, #635) through the "
+                    "2026-10-19 and 2026-10-21 national cuts and the "
+                    "2026-10-19 dense cut."
+                ),
+            )
+        ),
+        "dd31e32563854596d983a71a6519c6b7860a7c1f63ffb80dbe679d5d34c4de8c": (
+            GateSigningKey(
+                key_sha256=(
+                    "dd31e32563854596d983a71a6519c6b7860a7c1f63ffb80dbe679d5d34c4de8c"
+                ),
+                label="uk-gate-team-2026",
+                status="active",
+                custodian="Max Ghenis (GitHub MaxGhenis)",
+                held_in=(
+                    "agent-secret service microcosm/uk-gate-signing-key-team, "
+                    "account maxghenis, on Max's build Mac; agent sessions on "
+                    "that Mac may read it"
+                ),
+                registered="2026-10-22",
+                evidence=(
+                    "Generated 2026-10-22 for team-built cuts (microcosm#1348); "
+                    "never printed or committed."
+                ),
+            )
+        ),
+        "e9ab40bddffa31e67c3f7c4a5fba2fe3d5f8a71d3200f92ecbc6592b877a7eb1": (
+            GateSigningKey(
+                key_sha256=(
+                    "e9ab40bddffa31e67c3f7c4a5fba2fe3d5f8a71d3200f92ecbc6592b877a7eb1"
+                ),
+                label="uk-gate-vahid-ahmadi-2026",
+                status="active",
+                custodian="Vahid Ahmadi (GitHub vahid-ahmadi)",
+                held_in=(
+                    "his laptop's login keychain, service "
+                    "microcosm-uk-gate-signing-key; not in a shared store"
+                ),
+                registered="2026-10-26",
+                evidence=(
+                    "Generated 2026-10-26 with `generate --keychain-service` for "
+                    "the verification run of microcosm#1405; only the fingerprint "
+                    "left the keychain (posted on #1405)."
+                ),
+            )
+        ),
+    }
+)
+
+
+def _registry(country: str) -> Mapping[str, GateSigningKey] | None:
+    """The registry for a country, or ``None`` when the country has none.
+
+    Countries without a registry keep the old behaviour (any well-formed key
+    in the environment). Tests replace this function to admit their keys.
+    """
+
+    return UK_GATE_SIGNING_KEYS if country == "uk" else None
+
+
+def gate_signing_key_fingerprint(key: bytes) -> str:
+    """The SHA-256 a report records for the key that signed it."""
+
+    return hashlib.sha256(key).hexdigest()
+
+
+def decode_gate_signing_key(encoded: str | None, *, env: str) -> bytes:
+    """Decode a base64 signing key, refusing anything but 32 bytes."""
+
+    if not encoded:
+        raise GateSigningKeyError(f"{env} must contain a base64-encoded 32-byte key.")
+    try:
+        key = base64.b64decode(encoded.strip(), validate=True)
+    except (binascii.Error, ValueError) as exc:
+        raise GateSigningKeyError(f"{env} must be valid base64.") from exc
+    if len(key) != 32:
+        raise GateSigningKeyError(f"{env} must decode to exactly 32 bytes.")
+    return key
+
+
+def registered_gate_signing_key(country: str, key_sha256: str) -> GateSigningKey | None:
+    """The registry entry for a fingerprint, or ``None`` if unregistered."""
+
+    registry = _registry(country)
+    if registry is None:
+        return None
+    return registry.get(key_sha256)
+
+
+def unregistered_gate_signing_key_problem(
+    country: str, key: bytes, *, purpose: GateSigningKeyPurpose
+) -> str | None:
+    """Why ``key`` may not sign or verify for ``country``, or ``None`` if it may.
+
+    Returns ``None`` for a country without a registry.
+    """
+
+    if purpose not in _PURPOSE_STATUSES:
+        raise ValueError(f"purpose must be 'sign' or 'verify', got {purpose!r}.")
+    registry = _registry(country)
+    if registry is None:
+        return None
+    fingerprint = gate_signing_key_fingerprint(key)
+    entry = registry.get(fingerprint)
+    if entry is None:
+        return (
+            f"the {country.upper()} gate signing key with fingerprint "
+            f"{fingerprint} is not registered in "
+            "microcosm.data.gate_signing_keys; a key signs or verifies "
+            "release evidence only after a reviewed pull request registers it."
+        )
+    if entry.status not in _PURPOSE_STATUSES[purpose]:
+        return (
+            f"the {country.upper()} gate signing key {entry.label} "
+            f"({fingerprint}) is {entry.status}; a {entry.status} key may not "
+            f"{purpose}."
+        )
+    return None
+
+
+def require_registered_gate_signing_key(
+    country: str, key: bytes, *, purpose: GateSigningKeyPurpose
+) -> bytes:
+    """Return ``key`` if the registry lets it ``purpose``; raise otherwise."""
+
+    problem = unregistered_gate_signing_key_problem(country, key, purpose=purpose)
+    if problem is not None:
+        raise GateSigningKeyError(problem)
+    return key
+
+
+# ---------------------------------------------------------------------------
+# Operator CLI
+# ---------------------------------------------------------------------------
+
+
+def _entry_payload(entry: GateSigningKey) -> dict[str, object]:
+    return asdict(entry)
+
+
+def _check(args: argparse.Namespace) -> int:
+    env = args.env or UK_GATE_SIGNING_KEY_ENV
+    try:
+        key = decode_gate_signing_key(os.environ.get(env), env=env)
+    except GateSigningKeyError as exc:
+        print(json.dumps({"ok": False, "env": env, "problem": str(exc)}, indent=2))
+        return 1
+    fingerprint = gate_signing_key_fingerprint(key)
+    problem = unregistered_gate_signing_key_problem(
+        args.country, key, purpose=args.purpose
+    )
+    entry = registered_gate_signing_key(args.country, fingerprint)
+    print(
+        json.dumps(
+            {
+                "ok": problem is None,
+                "env": env,
+                "country": args.country,
+                "purpose": args.purpose,
+                "key_sha256": fingerprint,
+                "registered": _entry_payload(entry) if entry else None,
+                "problem": problem,
+            },
+            indent=2,
+        )
+    )
+    return 0 if problem is None else 1
+
+
+def _list(args: argparse.Namespace) -> int:
+    registry = _registry(args.country) or {}
+    print(json.dumps([_entry_payload(entry) for entry in registry.values()], indent=2))
+    return 0
+
+
+#: Account and service names ``security -i`` can take unquoted.
+_KEYCHAIN_NAME = re.compile(r"^[A-Za-z0-9._@-]+$")
+
+
+def store_in_keychain(key: bytes, *, service: str, account: str) -> None:
+    """Store a key in the macOS login keychain without putting it in any argv.
+
+    ``security`` reads the command from stdin (``security -i``), so the key
+    never appears in a process list. The stored value is then read back and
+    compared, and is never printed. An existing item is never replaced: a
+    retired key's cuts verify only for whoever still holds it, so rotating
+    stores the new key under a new service name.
+    """
+
+    for name in (service, account):
+        if not _KEYCHAIN_NAME.match(name):
+            raise GateSigningKeyError(f"keychain name {name!r} must be plain.")
+    existing = subprocess.run(
+        ["security", "find-generic-password", "-a", account, "-s", service],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    if existing.returncode == 0:
+        raise GateSigningKeyError(
+            f"keychain service {service} already holds a key for {account}; it "
+            "is left as it is. Store a new key under a new --keychain-service "
+            "name, so the old key, and the cuts it signed, stay verifiable."
+        )
+    encoded = base64.b64encode(key).decode()
+    subprocess.run(
+        ["security", "-i"],
+        input=f"add-generic-password -a {account} -s {service} -w {encoded}\n",
+        capture_output=True,
+        text=True,
+        check=True,
+    )
+    stored = subprocess.run(
+        ["security", "find-generic-password", "-a", account, "-s", service, "-w"],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    if stored.returncode != 0 or stored.stdout.strip() != encoded:
+        raise GateSigningKeyError(
+            f"the key did not read back from keychain service {service}."
+        )
+
+
+def _generate(args: argparse.Namespace) -> int:
+    key = secrets.token_bytes(32)
+    fingerprint = f"key_sha256 {gate_signing_key_fingerprint(key)}"
+    if args.keychain_service:
+        try:
+            store_in_keychain(
+                key, service=args.keychain_service, account=getpass.getuser()
+            )
+        except (GateSigningKeyError, OSError, subprocess.CalledProcessError) as exc:
+            print(f"key not stored: {exc}", file=sys.stderr)
+            return 1
+        # Only the fingerprint is printed: it is what a pull request registers.
+        print(fingerprint)
+        return 0
+    if sys.stdout.isatty():
+        # A key printed to a terminal stays in its scrollback and in any
+        # agent transcript.
+        print(
+            "refusing to print a signing key to a terminal: pass "
+            "--keychain-service NAME to store it in the login keychain, or pipe "
+            "stdout into a secret store.",
+            file=sys.stderr,
+        )
+        return 1
+    # The key goes to stdout for the operator to pipe into a secret store;
+    # the fingerprint goes to stderr so it can be pasted into a pull request.
+    print(base64.b64encode(key).decode())
+    print(fingerprint, file=sys.stderr)
+    return 0
+
+
+def main(argv: Sequence[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(
+        prog="python -m microcosm.data.gate_signing_keys",
+        description=(
+            "Inspect the committed UK gate signing key registry and the key "
+            "in the environment."
+        ),
+    )
+    sub = parser.add_subparsers(dest="command", required=True)
+    check = sub.add_parser(
+        "check",
+        help="exit 0 when the key in the environment may sign (or verify)",
+    )
+    check.add_argument("--country", default="uk")
+    check.add_argument("--purpose", choices=("sign", "verify"), default="sign")
+    check.add_argument(
+        "--env",
+        default=None,
+        help=f"variable to read (default {UK_GATE_SIGNING_KEY_ENV})",
+    )
+    check.set_defaults(func=_check)
+    listing = sub.add_parser("list", help="print the registered keys")
+    listing.add_argument("--country", default="uk")
+    listing.set_defaults(func=_list)
+    generate = sub.add_parser(
+        "generate",
+        help=(
+            "make a fresh key and print its fingerprint: stored in the login "
+            "keychain with --keychain-service, otherwise written to stdout for "
+            "a pipe into a secret store (never to a terminal)"
+        ),
+    )
+    generate.add_argument(
+        "--keychain-service",
+        metavar="NAME",
+        help="store the key in the macOS login keychain under this service",
+    )
+    generate.set_defaults(func=_generate)
+    args = parser.parse_args(argv)
+    return args.func(args)
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/packages/microcosm-data/tests/engine_free/shared/test_gate_signing_keys.py b/packages/microcosm-data/tests/engine_free/shared/test_gate_signing_keys.py
new file mode 100644
index 0000000000..a36aeb8b8d
--- /dev/null
+++ b/packages/microcosm-data/tests/engine_free/shared/test_gate_signing_keys.py
@@ -0,0 +1,306 @@
+"""The committed UK gate signing key registry binds verification to named keys."""
+
+from __future__ import annotations
+
+import base64
+import hashlib
+import json
+import re
+import subprocess
+
+import pytest
+from hypothesis import given
+from hypothesis import strategies as st
+
+from microcosm.data import contract
+from microcosm.data import gate_signing_keys as registry
+from microcosm.data.gate_signing_keys import (
+    GATE_SIGNING_KEY_STATUSES,
+    UK_GATE_SIGNING_KEY_ENV,
+    UK_GATE_SIGNING_KEYS,
+    GateSigningKey,
+    GateSigningKeyError,
+    decode_gate_signing_key,
+    gate_signing_key_fingerprint,
+    require_registered_gate_signing_key,
+    unregistered_gate_signing_key_problem,
+)
+
+#: The key that signed every UK cut on record (T19, T21, the 10/19 dense cut).
+CONTINUITY_FINGERPRINT = (
+    "66bf0e29dbdabc2e3d7a79f21f43ac28d17b592faaf91e67c9bcf9b30c09a6ff"
+)
+UNREGISTERED_KEY = b"\x11" * 32
+
+
+def _entry(key: bytes, status: str) -> GateSigningKey:
+    return GateSigningKey(
+        key_sha256=gate_signing_key_fingerprint(key),
+        label=f"test-{status}",
+        status=status,  # type: ignore[arg-type]
+        custodian="test",
+        held_in="test",
+        registered="2026-10-22",
+        evidence="test",
+        retired_on="2026-10-22" if status != "active" else None,
+    )
+
+
+def _use_registry(monkeypatch, *entries: GateSigningKey) -> None:
+    table = {entry.key_sha256: entry for entry in entries}
+    monkeypatch.setattr(
+        registry, "_registry", lambda country: table if country == "uk" else None
+    )
+
+
+@pytest.mark.committed_gate_key_registry
+def test_the_committed_registry_is_well_formed():
+    assert UK_GATE_SIGNING_KEYS, "the UK registry must name at least one key"
+    labels = set()
+    for fingerprint, entry in UK_GATE_SIGNING_KEYS.items():
+        assert re.fullmatch(r"[0-9a-f]{64}", fingerprint)
+        assert entry.key_sha256 == fingerprint
+        assert entry.status in GATE_SIGNING_KEY_STATUSES
+        assert (entry.retired_on is None) == (entry.status == "active")
+        assert entry.label not in labels
+        labels.add(entry.label)
+        for field in ("custodian", "held_in", "registered", "evidence"):
+            assert getattr(entry, field).strip()
+    assert any(entry.status == "active" for entry in UK_GATE_SIGNING_KEYS.values())
+
+
+@pytest.mark.committed_gate_key_registry
+def test_the_key_that_signed_every_cut_on_record_still_verifies():
+    """Continuity: re-registering must never strand the published cuts."""
+
+    entry = UK_GATE_SIGNING_KEYS[CONTINUITY_FINGERPRINT]
+    assert entry.status in {"active", "retired"}
+
+
+@pytest.mark.committed_gate_key_registry
+def test_an_unregistered_key_neither_signs_nor_verifies():
+    for purpose in ("sign", "verify"):
+        problem = unregistered_gate_signing_key_problem(
+            "uk", UNREGISTERED_KEY, purpose=purpose
+        )
+        assert problem is not None
+        assert gate_signing_key_fingerprint(UNREGISTERED_KEY) in problem
+        with pytest.raises(GateSigningKeyError, match="not registered"):
+            require_registered_gate_signing_key("uk", UNREGISTERED_KEY, purpose=purpose)
+
+
+@pytest.mark.committed_gate_key_registry
+def test_countries_without_a_registry_keep_the_old_behaviour():
+    assert (
+        unregistered_gate_signing_key_problem("us", UNREGISTERED_KEY, purpose="sign")
+        is None
+    )
+    assert registry.registered_gate_signing_key("us", "0" * 64) is None
+
+
+@given(
+    key=st.binary(min_size=32, max_size=32),
+    status=st.sampled_from(sorted(GATE_SIGNING_KEY_STATUSES)),
+)
+def test_status_decides_purpose(key, status):
+    """For every key and status: active signs and verifies, retired only
+    verifies, revoked does neither, and signing implies verifying."""
+
+    entry = _entry(key, status)
+    with pytest.MonkeyPatch.context() as patch:
+        _use_registry(patch, entry)
+        may_sign = (
+            unregistered_gate_signing_key_problem("uk", key, purpose="sign") is None
+        )
+        may_verify = (
+            unregistered_gate_signing_key_problem("uk", key, purpose="verify") is None
+        )
+    assert may_sign == (status == "active")
+    assert may_verify == (status in {"active", "retired"})
+    assert not may_sign or may_verify
+
+
+@given(
+    key=st.binary(min_size=32, max_size=32),
+    other=st.binary(min_size=32, max_size=32),
+)
+def test_registration_is_by_exact_fingerprint(key, other):
+    """A registered key admits only itself: no other key verifies under it."""
+
+    with pytest.MonkeyPatch.context() as patch:
+        _use_registry(patch, _entry(key, "active"))
+        other_problem = unregistered_gate_signing_key_problem(
+            "uk", other, purpose="verify"
+        )
+    assert (other_problem is None) == (other == key)
+
+
+@given(key=st.binary(min_size=32, max_size=32))
+def test_the_fingerprint_is_the_attested_sha256(key):
+    assert gate_signing_key_fingerprint(key) == hashlib.sha256(key).hexdigest()
+    encoded = base64.b64encode(key).decode()
+    assert decode_gate_signing_key(encoded, env="E") == key
+
+
+@given(raw=st.binary(max_size=64).filter(lambda value: len(value) != 32))
+def test_a_key_of_any_other_length_is_refused(raw):
+    with pytest.raises(GateSigningKeyError, match="exactly 32 bytes|must contain"):
+        decode_gate_signing_key(base64.b64encode(raw).decode(), env="E")
+
+
+def test_malformed_base64_is_refused():
+    with pytest.raises(GateSigningKeyError, match="valid base64"):
+        decode_gate_signing_key("not base64!", env="E")
+
+
+# ---------------------------------------------------------------------------
+# The publisher's verification key
+# ---------------------------------------------------------------------------
+
+
+def _set_key(monkeypatch, key: bytes) -> None:
+    monkeypatch.setenv(UK_GATE_SIGNING_KEY_ENV, base64.b64encode(key).decode())
+
+
+@pytest.mark.parametrize(
+    ("status", "verifies"), [("active", True), ("retired", True), ("revoked", False)]
+)
+def test_the_publisher_verifies_only_registered_keys(monkeypatch, status, verifies):
+    key = b"\x22" * 32
+    _set_key(monkeypatch, key)
+    _use_registry(monkeypatch, _entry(key, status))
+    failures: list[str] = []
+    assert (contract._uk_gate_battery_verification_key(failures) == key) is verifies
+    assert (failures == []) is verifies
+    if not verifies:
+        assert "revoked" in failures[0]
+
+
+def test_the_legacy_schema_3_trust_root_is_bound_too(monkeypatch):
+    legacy_env = contract._UK_TERMINAL_GATE_SIGNING_KEY_ENV
+    monkeypatch.setenv(legacy_env, base64.b64encode(UNREGISTERED_KEY).decode())
+    _use_registry(monkeypatch, _entry(b"\x22" * 32, "active"))
+    failures: list[str] = []
+    assert contract._uk_terminal_verification_key(failures) is None
+    assert len(failures) == 1 and "not registered" in failures[0]
+    _use_registry(monkeypatch, _entry(UNREGISTERED_KEY, "retired"))
+    failures = []
+    assert contract._uk_terminal_verification_key(failures) == UNREGISTERED_KEY
+    assert failures == []
+
+
+def test_the_publisher_refuses_an_unregistered_key(monkeypatch):
+    _set_key(monkeypatch, UNREGISTERED_KEY)
+    _use_registry(monkeypatch, _entry(b"\x22" * 32, "active"))
+    failures: list[str] = []
+    assert contract._uk_gate_battery_verification_key(failures) is None
+    assert len(failures) == 1 and "not registered" in failures[0]
+
+
+# ---------------------------------------------------------------------------
+# The operator CLI
+# ---------------------------------------------------------------------------
+
+
+def test_check_reports_the_fingerprint_and_status(monkeypatch, capsys):
+    key = b"\x33" * 32
+    _set_key(monkeypatch, key)
+    _use_registry(monkeypatch, _entry(key, "retired"))
+    assert registry.main(["check", "--purpose", "verify"]) == 0
+    report = json.loads(capsys.readouterr().out)
+    assert report["ok"] is True
+    assert report["key_sha256"] == gate_signing_key_fingerprint(key)
+    assert report["registered"]["status"] == "retired"
+    assert registry.main(["check"]) == 1  # a retired key may not sign
+    assert "retired" in json.loads(capsys.readouterr().out)["problem"]
+
+
+def test_check_fails_without_a_key(monkeypatch, capsys):
+    monkeypatch.delenv(UK_GATE_SIGNING_KEY_ENV, raising=False)
+    assert registry.main(["check"]) == 1
+    assert json.loads(capsys.readouterr().out)["ok"] is False
+
+
+def test_generate_pipes_a_fresh_key_and_its_fingerprint(capsys):
+    assert registry.main(["generate"]) == 0
+    captured = capsys.readouterr()
+    key = decode_gate_signing_key(captured.out.strip(), env="E")
+    assert captured.err.strip() == f"key_sha256 {gate_signing_key_fingerprint(key)}"
+    assert registry.main(["generate"]) == 0
+    assert capsys.readouterr().out.strip() != captured.out.strip()
+
+
+def test_generate_never_prints_a_key_to_a_terminal(capsys, monkeypatch):
+    monkeypatch.setattr(registry.sys.stdout, "isatty", lambda: True)
+    assert registry.main(["generate"]) == 1
+    captured = capsys.readouterr()
+    assert captured.out == ""
+    assert "--keychain-service" in captured.err
+
+
+def test_generate_stores_the_key_without_it_in_any_argv(capsys, monkeypatch):
+    calls = []
+    store = {}
+
+    def run(argv, **kwargs):
+        calls.append((argv, kwargs.get("input")))
+        if argv[:2] == ["security", "-i"]:
+            store["value"] = kwargs["input"].split(" -w ", 1)[1].strip()
+            return subprocess.CompletedProcess(argv, 0, "", "")
+        if "-w" not in argv:  # the existence check: no item yet
+            return subprocess.CompletedProcess(argv, 44, "", "not found")
+        return subprocess.CompletedProcess(argv, 0, store["value"] + "\n", "")
+
+    monkeypatch.setattr(registry.subprocess, "run", run)
+    monkeypatch.setattr(registry.getpass, "getuser", lambda: "builder")
+    monkeypatch.setattr(registry.sys.stdout, "isatty", lambda: True)
+    assert registry.main(["generate", "--keychain-service", "uk-gate-key"]) == 0
+    printed = capsys.readouterr().out.strip()
+    key = base64.b64decode(store["value"])
+    assert printed == f"key_sha256 {gate_signing_key_fingerprint(key)}"
+    assert store["value"] not in printed
+    for argv, _ in calls:
+        assert store["value"] not in " ".join(argv)
+    add = next(entry for argv, entry in calls if argv[:2] == ["security", "-i"])
+    assert add.startswith("add-generic-password -a builder -s uk-gate-key -w ")
+
+
+def test_an_existing_keychain_item_is_never_replaced(capsys, monkeypatch):
+    calls = []
+
+    def run(argv, **kwargs):
+        calls.append(argv)
+        return subprocess.CompletedProcess(argv, 0, "attributes only", "")
+
+    monkeypatch.setattr(registry.subprocess, "run", run)
+    monkeypatch.setattr(registry.getpass, "getuser", lambda: "builder")
+    assert registry.main(["generate", "--keychain-service", "uk-gate-key"]) == 1
+    assert "already holds a key" in capsys.readouterr().err
+    assert calls == [
+        ["security", "find-generic-password", "-a", "builder", "-s", "uk-gate-key"]
+    ]
+
+
+def test_a_key_that_does_not_read_back_is_reported(capsys, monkeypatch):
+    def run(argv, **kwargs):
+        if argv[:2] == ["security", "find-generic-password"] and "-w" not in argv:
+            return subprocess.CompletedProcess(argv, 44, "", "not found")
+        return subprocess.CompletedProcess(argv, 0, "other\n", "")
+
+    monkeypatch.setattr(registry.subprocess, "run", run)
+    monkeypatch.setattr(registry.getpass, "getuser", lambda: "builder")
+    assert registry.main(["generate", "--keychain-service", "uk-gate-key"]) == 1
+    assert "did not read back" in capsys.readouterr().err
+
+
+@pytest.mark.parametrize("name", ["two words", "quo'te", ""])
+def test_keychain_names_must_be_plain(name):
+    with pytest.raises(GateSigningKeyError, match="must be plain"):
+        registry.store_in_keychain(b"k" * 32, service=name, account="builder")
+
+
+@pytest.mark.committed_gate_key_registry
+def test_list_prints_the_committed_entries(capsys):
+    assert registry.main(["list"]) == 0
+    listed = json.loads(capsys.readouterr().out)
+    assert {row["key_sha256"] for row in listed} == set(UK_GATE_SIGNING_KEYS)
diff --git a/pyproject.toml b/pyproject.toml
index 7f2c4aadbb..d6dcdd8aa6 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -63,4 +63,5 @@ markers = [
     "requires_us: needs policyengine-us (the us extra); auto-skipped when absent",
     "requires_uk: needs policyengine-uk (the uk extra); auto-skipped when absent",
     "integration: requires explicit --run-integration collection",
+    "committed_gate_key_registry: run against the committed UK gate signing key registry, not the test-key admission",
 ]
diff --git a/tools/certify_uk_cut_in_policyengine_py.py b/tools/certify_uk_cut_in_policyengine_py.py
new file mode 100644
index 0000000000..56167253e1
--- /dev/null
+++ b/tools/certify_uk_cut_in_policyengine_py.py
@@ -0,0 +1,1376 @@
+"""Certify a published Microcosm UK cut into policyengine.py, on a fresh branch.
+
+policyengine.py serves the UK cut its bundle manifest certifies; moving that
+pin is a policyengine.py pull request and release. This script does the
+mechanical part of that pull request the way policyengine.py#685 did it by
+hand (``docs/engineering/skills/data-certification.md`` there), in a new
+worktree branched from policyengine.py's ``origin/main``:
+
+1. refuse if someone is already certifying this cut (one writer per cut);
+2. read the national (and regional) release manifests at their tags and
+   check, before anything is written, that the regional route can certify;
+3. ``scripts/bundle.py certify-data`` with the national tag and the chosen
+   regional route, at the cut's own policyengine-uk and core;
+4. ``uv lock`` and ``scripts/release_lock.py``;
+5. ``bundle.py generate --include-tros``, the certified-constant rewrite of
+   policyengine.py's own qualification library, the household snapshots,
+   then ``bundle.py check --published-spm --include-tros --strict-tros``;
+6. the UK Universal Credit floor (weighted national totals only) and the
+   test suite;
+7. a commit, and a pull request body with every judgment left to a person
+   (the UC floor acceptance, dropped dataset overlays, failing tests).
+
+It pushes and opens a draft pull request only with ``--push`` and
+``--open-pr``. It never merges and never releases.
+
+Regional routes (pick one):
+
+``--dense-tag TAG``           a Microcosm local-area cut (ship together)
+``--keep-regional-release``   the bundle's current regional release
+``--area-coded-national-uri`` an enhanced-FRS release that claims the version
+``--drop-regional-release``   no area routing (sim-api's UK default then
+                              lacks constituency and local-authority runs)
+
+A regional release built on another policyengine-uk is refused by
+certification unless policyengine.py accepts a recorded mismatch:
+``--accept-regional-model-mismatch REASON`` with ``--audited-by WHO`` and at
+least one ``--regional-limitation TEXT``. The regional microdata is downloaded
+at its manifest pin, policyengine.py's own ``scripts/audit_regional_input_surface.py``
+(policyengine.py#699) audits its stored columns against the build and target
+models, and ``certify-data`` takes that evidence; any dropped column refuses
+(see ``docs/uk-cut-anyone.md``).
+
+Needs ``HF_TOKEN`` (read ``policyengine/populace-uk-private``), PyPI, and
+``gh`` for the writer check and the pull request.
+"""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+import math
+import os
+import re
+import shlex
+import shutil
+import subprocess
+import sys
+import tempfile
+import time
+from collections.abc import Sequence
+from contextlib import contextmanager
+from dataclasses import dataclass
+from datetime import UTC, datetime
+from pathlib import Path
+from typing import Any
+
+from microcosm.data.gate_signing_keys import UK_GATE_SIGNING_KEY_ENV
+
+PEPY_REPO = "PolicyEngine/policyengine.py"
+CUT_REPO = "policyengine/populace-uk-private"
+NATIONAL_RELEASE = "microcosm-uk-2024-25-national"
+DENSE_RELEASE = "microcosm-uk-2024-25-dense"
+PEPY_PYTHON = "3.13"  # certify-uk-release.yaml's interpreter
+TAG_PATTERN = re.compile(
+    r"^microcosm-uk-2024-25-(national|dense)-\d{8}T\d{6}Z-[0-9a-f]{8}$"
+)
+CONSTANT_PATTERN = r'(?P<pre>["@/-]){old}(?P<post>["/])'
+CONSTANT_FILES = (
+    "tests/test_models.py",
+    "tests/test_release_manifests.py",
+    "tests/test_uk_regions.py",
+)
+
+
+class CertifyError(RuntimeError):
+    """A refusal the operator must act on."""
+
+
+def manifest_uri(tag: str, release: str) -> str:
+    return f"hf://dataset/{CUT_REPO}@{tag}/releases/{release}/release_manifest.json"
+
+
+def check_tag(tag: str, kind: str) -> str:
+    match = TAG_PATTERN.match(tag)
+    if not match or match.group(1) != kind:
+        raise CertifyError(
+            f"{tag!r} is not a {kind} cut tag; certify cut tags only, never @main."
+        )
+    return tag
+
+
+@dataclass(frozen=True)
+class CutVersions:
+    tag: str
+    model: str
+    core: str
+    claims: tuple[str, ...]
+
+
+def read_cut(tag: str, release: str) -> CutVersions:
+    # Set before importing the hub: its HTTP timeout constants are import-time.
+    os.environ.setdefault("HF_HUB_DOWNLOAD_TIMEOUT", "120")
+    os.environ.setdefault("HF_HUB_ETAG_TIMEOUT", "60")
+    from huggingface_hub import hf_hub_download
+
+    path = hf_hub_download(
+        CUT_REPO,
+        f"releases/{release}/release_manifest.json",
+        repo_type="dataset",
+        revision=tag,
+        token=os.environ.get("HUGGING_FACE_TOKEN") or os.environ.get("HF_TOKEN"),
+        etag_timeout=60,
+    )
+    manifest = json.loads(Path(path).read_text())
+    build = manifest.get("build") or {}
+    if build.get("cut_tag") != tag:
+        raise CertifyError(f"{tag}: the manifest names cut {build.get('cut_tag')!r}.")
+    return CutVersions(
+        tag=tag,
+        model=build["built_with_model_package"]["version"],
+        core=build["built_with_core_package"]["version"],
+        claims=tuple(
+            claim["specifier"]
+            for claim in manifest.get("compatible_model_packages", ())
+            if claim.get("name") == "policyengine-uk"
+        ),
+    )
+
+
+def covers(cut: CutVersions, version: str) -> bool:
+    """policyengine.py's rule: built with the version, or an exact claim of it."""
+
+    return cut.model == version or f"=={version}" in cut.claims
+
+
+def regional_flags(args: argparse.Namespace, bundle_record: dict) -> list[str]:
+    if args.dense_tag:
+        return [
+            "--regional-manifest-uri",
+            manifest_uri(check_tag(args.dense_tag, "dense"), DENSE_RELEASE),
+        ]
+    if args.keep_regional_release:
+        uri = bundle_record.get("regional_source_manifest_uri")
+        if not uri:
+            raise CertifyError("the bundle routes no regional release to keep.")
+        return ["--regional-manifest-uri", uri]
+    if args.area_coded_national_uri:
+        return [
+            "--regional-manifest-uri",
+            args.area_coded_national_uri,
+            "--regional-release-kind",
+            "area_coded_national",
+        ]
+    return ["--drop-regional-release"]
+
+
+def regional_tag(flags: list[str]) -> str | None:
+    if "--regional-manifest-uri" not in flags:
+        return None
+    uri = flags[flags.index("--regional-manifest-uri") + 1]
+    match = re.search(r"@([^/]+)/", uri)
+    return (
+        match.group(1) if match and match.group(1).startswith(DENSE_RELEASE) else None
+    )
+
+
+#: Free disk each heavy step needs by default: the certified environment,
+#: the snapshots and the test suite's fixtures (decimal bytes).
+DEFAULT_MIN_FREE_BYTES = 55_000_000_000
+
+
+def resource_guard(
+    root: Path,
+    *,
+    max_load1: float | None = None,
+    min_free_bytes: int = DEFAULT_MIN_FREE_BYTES,
+) -> dict[str, float | int]:
+    """Refuse work before spawning a process on an overloaded or full host.
+
+    A load limit depends on the machine, so there is none unless the operator
+    sets one (``--max-load1``).
+    """
+
+    load1 = os.getloadavg()[0]
+    while not root.exists():
+        root = root.parent
+    free = shutil.disk_usage(root).free
+    overloaded = max_load1 is not None and load1 > max_load1
+    if overloaded or free < min_free_bytes:
+        maximum = "none" if max_load1 is None else f"{max_load1:g}"
+        raise CertifyError(
+            f"resource guard: load1={load1:.2f} (maximum {maximum}), "
+            f"free={free / 1e9:.2f} GB (minimum {min_free_bytes / 1e9:g} decimal GB)."
+        )
+    return {"load1": load1, "free_bytes": free}
+
+
+def check_test_temp_directory(directory: Path | None = None) -> Path:
+    """Refuse a full suite whose temporary fixtures inherit an ancestor Git repo."""
+    directory = Path(directory or tempfile.gettempdir()).expanduser().resolve()
+    for ancestor in (directory, *directory.parents):
+        if (ancestor / ".git").exists():
+            raise CertifyError(
+                f"Full-suite temporary directory {directory} is inside Git "
+                f"repository {ancestor}. Version fixtures would inherit its tags "
+                "and private disclosure audit fixtures correctly refuse Git paths. "
+                "Set TMPDIR to a private writable directory outside every Git "
+                "repository before certification. If workspace-only execution "
+                "prevents that, report full-suite validation blocked; --skip-tests "
+                "records a mechanical handoff only and does not qualify the cut."
+            )
+    return directory
+
+
+def certification_path(relative: str, national_tag: str) -> bool:
+    """Files generated by this handoff, excluding local data and operator files."""
+    snapshots = {
+        "uk_couple_two_kids",
+        "uk_model_surface",
+        "uk_single_adult_employment_income",
+        "uk_single_adult_no_income",
+        "uk_single_parent_one_child",
+        "us_married_two_kids_high_income",
+        "us_model_surface",
+        "us_single_adult_employment_income",
+        "us_single_adult_no_income",
+        "us_single_parent_one_child",
+    }
+    return relative in {
+        "pyproject.toml",
+        "uv.lock",
+        *CONSTANT_FILES,
+        f"changelog.d/certify-uk-{national_tag}.changed.md",
+        "src/policyengine/data/bundle/manifest.json",
+        "src/policyengine/data/bundle/uk.trace.tro.jsonld",
+        "src/policyengine/data/bundle/us.trace.tro.jsonld",
+        *(
+            f"tests/fixtures/household_calculator_snapshots/{name}.json"
+            for name in snapshots
+        ),
+    }
+
+
+def certification_changes(worktree: Path, national_tag: str) -> list[str]:
+    """Preserve operator files and refuse unrelated tracked/index changes."""
+    tracked = subprocess.check_output(
+        ["git", "diff", "--name-only", "-z", "HEAD"], cwd=worktree, text=True
+    ).split("\0")
+    unexpected = [
+        path for path in tracked if path and not certification_path(path, national_tag)
+    ]
+    if unexpected:
+        raise CertifyError(
+            "unrelated tracked changes are preserved; refusing to replay or commit: "
+            + ", ".join(unexpected)
+        )
+    untracked = subprocess.check_output(
+        ["git", "ls-files", "--others", "--exclude-standard", "-z"],
+        cwd=worktree,
+        text=True,
+    ).split("\0")
+    changelog = f"changelog.d/certify-uk-{national_tag}.changed.md"
+    return sorted(
+        {path for path in tracked if path}
+        | {path for path in untracked if path == changelog}
+    )
+
+
+def validate_resume_worktree(
+    repo: Path, worktree: Path, branch: str, base_commit: str, national_tag: str
+) -> list[str]:
+    """Adopt only an unfinished, registered handoff at the exact resolved base."""
+    if not worktree.is_dir():
+        raise CertifyError(f"resume worktree {worktree} does not exist.")
+    records, record = [], {}
+    output = subprocess.check_output(
+        ["git", "worktree", "list", "--porcelain", "-z"], cwd=repo, text=True
+    )
+    for field in output.split("\0"):
+        if not field:
+            if record:
+                records.append(record)
+                record = {}
+        else:
+            key, _, value = field.partition(" ")
+            record[key] = value
+    if record:
+        records.append(record)
+    entry = next(
+        (
+            item
+            for item in records
+            if "worktree" in item
+            and Path(item["worktree"]).resolve() == worktree.resolve()
+        ),
+        None,
+    )
+    if entry is None or entry.get("branch") != f"refs/heads/{branch}":
+        raise CertifyError(
+            "resume worktree is not registered on the expected certification branch."
+        )
+    common_dirs = []
+    for directory in (repo, worktree):
+        common = Path(
+            subprocess.check_output(
+                ["git", "rev-parse", "--git-common-dir"],
+                cwd=directory,
+                text=True,
+            ).strip()
+        )
+        common_dirs.append((directory / common).resolve())
+    if common_dirs[0] != common_dirs[1]:
+        raise CertifyError("resume worktree belongs to another Git repository.")
+    head = subprocess.check_output(
+        ["git", "rev-parse", "HEAD"],
+        cwd=worktree,
+        text=True,
+    ).strip()
+    if head != base_commit or entry.get("HEAD") != base_commit:
+        raise CertifyError(
+            "resume requires HEAD at the exact resolved base commit; committed "
+            "descendants/history are preserved. Use a fresh worktree for another run."
+        )
+    if subprocess.check_output(
+        ["git", "ls-files", "--unmerged", "-z"],
+        cwd=worktree,
+        text=True,
+    ):
+        raise CertifyError(
+            "resume worktree has unresolved merges; no files were changed."
+        )
+    paths = certification_changes(worktree, national_tag)
+    manifest_path = "src/policyengine/data/bundle/manifest.json"
+    if manifest_path in paths:
+        record = json.loads((worktree / manifest_path).read_text())["data_releases"][
+            "uk"
+        ]
+        revision = (record.get("data_package") or {}).get("release_manifest_revision")
+        if revision != national_tag:
+            raise CertifyError("resume worktree's modified manifest names another cut.")
+    return paths
+
+
+def record_timing(path: Path, record: dict[str, Any]) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    with path.open("a") as handle:
+        handle.write(json.dumps(record) + "\n")
+
+
+def pytest_command(
+    python: str, arguments: list[str], *, startup_timeout: float = 300.0
+) -> list[str]:
+    """Diagnose imports before pytest's session/per-test clocks can start."""
+    if not math.isfinite(startup_timeout) or startup_timeout <= 0:
+        raise ValueError("pytest startup timeout must be positive and finite")
+    bootstrap = (
+        "import faulthandler, os, sys\n"
+        "diagnostic_stream = os.fdopen(os.dup(2), 'w')\n"
+        f"faulthandler.dump_traceback_later({startup_timeout!r}, "
+        "repeat=True, file=diagnostic_stream)\n"
+        "try:\n"
+        "    import pytest\n"
+        "    raise SystemExit(pytest.main(sys.argv[1:]))\n"
+        "finally:\n"
+        "    faulthandler.cancel_dump_traceback_later()\n"
+        "    diagnostic_stream.close()\n"
+    )
+    return [python, "-c", bootstrap, *arguments]
+
+
+@contextmanager
+def timed_step(name: str, path: Path):
+    """Make network preflight and local Python work visible, including failures."""
+    started = time.monotonic()
+    record = {"step": name, "started_at": datetime.now(UTC).isoformat()}
+    print(f"[start] {name}", flush=True)
+    try:
+        yield record
+        record.setdefault("returncode", 0)
+    except Exception as error:
+        record["returncode"] = getattr(error, "returncode", None)
+        record["error"] = str(error)
+        raise
+    finally:
+        record["elapsed_seconds"] = time.monotonic() - started
+        record_timing(path, record)
+        print(
+            f"[done] {name}: {record['elapsed_seconds']:.3f}s "
+            f"(exit {record.get('returncode')})",
+            flush=True,
+        )
+
+
+def run_logged(argv: list[str], *, cwd: Path, env: dict[str, str], handle):
+    """Stream child output into the diagnostic log while retaining its result."""
+    output = []
+    with subprocess.Popen(
+        argv,
+        cwd=cwd,
+        env=env,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.STDOUT,
+        text=True,
+        bufsize=1,
+    ) as process:
+        for line in process.stdout:
+            handle.write(line)
+            handle.flush()
+            output.append(line)
+        returncode = process.wait()
+    return subprocess.CompletedProcess(argv, returncode, "".join(output), "")
+
+
+#: What policyengine.py's commands never get from this process: the caller's
+#: environment selectors (uv would sync, install into or run another
+#: project's venv) and Microcosm's gate signing key, which no policyengine.py
+#: step signs or verifies with, while its install and test steps run
+#: third-party code.
+WITHHELD_ENVIRONMENT = frozenset(
+    {"UV_PROJECT_ENVIRONMENT", "VIRTUAL_ENV", UK_GATE_SIGNING_KEY_ENV}
+)
+
+
+#: Hugging Face tokens: policyengine.py's scripts and tests read the private
+#: cut repositories with them, but package installs and syncs never need one.
+HF_TOKEN_ENVIRONMENT = frozenset(
+    {
+        "HF_TOKEN",
+        "HUGGING_FACE_TOKEN",
+        "HUGGINGFACE_HUB_TOKEN",
+        "HUGGING_FACE_HUB_TOKEN",
+    }
+)
+
+
+def policyengine_py_environment(*, credentials: bool = True) -> dict[str, str]:
+    """This process's environment, less what policyengine.py must not see.
+
+    ``credentials=False`` also withholds the Hugging Face tokens, for steps
+    that only install or resolve packages.
+    """
+
+    withheld = WITHHELD_ENVIRONMENT | (
+        frozenset() if credentials else HF_TOKEN_ENVIRONMENT
+    )
+    return {k: v for k, v in os.environ.items() if k not in withheld}
+
+
+class Shell:
+    """Runs commands in the policyengine.py worktree and records each one."""
+
+    def __init__(
+        self,
+        cwd: Path,
+        log: Path,
+        *,
+        dry_run: bool = False,
+        timings: Path | None = None,
+        max_load1: float | None = None,
+        min_free_bytes: int = DEFAULT_MIN_FREE_BYTES,
+    ) -> None:
+        self.cwd = cwd
+        self.log = log
+        self.dry_run = dry_run
+        self.timings = timings or log.with_suffix(".timings.jsonl")
+        self.limits = {"max_load1": max_load1, "min_free_bytes": min_free_bytes}
+        self.commands: list[str] = []
+
+    def __call__(
+        self,
+        argv: list[str],
+        *,
+        env: dict[str, str] | None = None,
+        check=True,
+        step: str | None = None,
+        credentials: bool = True,
+    ) -> subprocess.CompletedProcess:
+        line = shlex.join(argv)
+        self.commands.append(line)
+        print(f"$ {line}", flush=True)
+        if self.dry_run:
+            return subprocess.CompletedProcess(argv, 0, "", "")
+        started = time.monotonic()
+        timing = {
+            "step": step or line,
+            "command": line,
+            "started_at": datetime.now(UTC).isoformat(),
+            "returncode": None,
+        }
+        try:
+            timing.update(resource_guard(self.cwd, **self.limits))
+            with self.log.open("a") as handle:
+                handle.write(f"\n# {datetime.now(UTC):%Y-%m-%dT%H:%M:%SZ} $ {line}\n")
+                handle.flush()
+                result = run_logged(
+                    argv,
+                    cwd=self.cwd,
+                    env={
+                        **policyengine_py_environment(credentials=credentials),
+                        **(env or {}),
+                    },
+                    handle=handle,
+                )
+            timing["returncode"] = result.returncode
+        except Exception as error:
+            timing["error"] = str(error)
+            raise
+        finally:
+            timing["elapsed_seconds"] = time.monotonic() - started
+            record_timing(self.timings, timing)
+            print(
+                f"[done] {step or line}: {timing['elapsed_seconds']:.3f}s "
+                f"(exit {timing.get('returncode')})",
+                flush=True,
+            )
+        if check and result.returncode != 0:
+            tail = "\n".join(result.stdout.splitlines()[-25:])
+            raise CertifyError(f"{line} exited {result.returncode}:\n{tail}")
+        return result
+
+
+def writer_check(national_tag: str, pepy_repo: Path) -> list[str]:
+    """Open pull requests or branches already certifying this cut.
+
+    A writer is an open pull request that names the tag, or any open pull
+    request or remote branch whose name contains ``certify-uk-<id>``: this
+    handoff's own branch, a suffixed one such as
+    ``certify-uk-a133f37a-national``, or one under a namespace. A listing
+    that cannot be read refuses rather than passing.
+    """
+
+    marker = f"certify-uk-{national_tag.rsplit('-', 1)[-1]}"
+    found = []
+    result = subprocess.run(
+        [
+            "gh", "pr", "list", "--repo", PEPY_REPO, "--state", "open",
+            "--limit", "1000", "--json", "number,title,body,headRefName",
+        ],
+        capture_output=True,
+        text=True,
+        check=False,
+        timeout=120,
+    )  # fmt: skip
+    if result.returncode != 0:
+        raise CertifyError(
+            "could not list policyengine.py pull requests to check for another "
+            f"writer ({result.stderr.strip()[:200]}); retry, or ask the UK hub."
+        )
+    for pr in json.loads(result.stdout or "[]"):
+        text = f"{pr.get('title') or ''}\n{pr.get('body') or ''}"
+        if national_tag in text or marker in (pr.get("headRefName") or ""):
+            found.append(f"#{pr['number']} {pr['title']} ({pr['headRefName']})")
+    remote = subprocess.run(
+        ["git", "ls-remote", "--heads", "origin"],
+        cwd=pepy_repo,
+        capture_output=True,
+        text=True,
+        check=False,
+        timeout=120,
+    )
+    if remote.returncode != 0:
+        raise CertifyError(
+            "could not list policyengine.py branches to check for another "
+            f"writer ({remote.stderr.strip()[:200]}); retry, or ask the UK hub."
+        )
+    for line in remote.stdout.splitlines():
+        branch = line.split("\t", 1)[-1].removeprefix("refs/heads/")
+        if marker in branch:
+            found.append(f"branch {branch} exists on origin")
+    return found
+
+
+def rewrite_regional_constants(
+    root: Path, old: str | None, new: str | None
+) -> list[str]:
+    """Replace the old local-area cut tag in the certified-constant files."""
+
+    if not old or not new or old == new:
+        return []
+    pattern = re.compile(CONSTANT_PATTERN.format(old=re.escape(old)))
+    changed = []
+    for relative in CONSTANT_FILES:
+        path = root / relative
+        text = path.read_text()
+        updated = pattern.sub(lambda m: m.group("pre") + new + m.group("post"), text)
+        if updated != text:
+            path.write_text(updated)
+            changed.append(relative)
+    return changed
+
+
+#: policyengine.py's audit of a regional file's stored columns (policyengine.py#699).
+#: An accepted model mismatch certifies only with the evidence it writes.
+AUDIT_SCRIPT = "scripts/audit_regional_input_surface.py"
+#: The evidence version that measures drops against the regional build model.
+REGIONAL_EVIDENCE_SCHEMA = 2
+
+
+def regional_audit_support(repo: Path, base_commit: str) -> str | None:
+    """Why the base cannot certify an accepted mismatch, or ``None`` if it can.
+
+    The base needs the audit script and a ``bundle.py`` that forwards its
+    evidence (``--regional-input-surface-evidence``).
+    """
+
+    script = subprocess.run(
+        ["git", "cat-file", "-e", f"{base_commit}:{AUDIT_SCRIPT}"],
+        cwd=repo,
+        capture_output=True,
+        check=False,
+    )
+    if script.returncode != 0:
+        return f"it has no {AUDIT_SCRIPT}"
+    flag = subprocess.run(
+        ["git", "grep", "-q", "-e", "--regional-input-surface-evidence", base_commit,
+         "--", "scripts/bundle.py"],
+        cwd=repo,
+        capture_output=True,
+        check=False,
+    )  # fmt: skip
+    if flag.returncode != 0:
+        return "its scripts/bundle.py does not take --regional-input-surface-evidence"
+    return None
+
+
+def fetch_regional_microdata(
+    tag: str, release: str, *, timings: Path
+) -> dict[str, Path]:
+    """Every microdata H5 of a regional cut, by manifest name, checked by sha256.
+
+    These are the files policyengine.py's audit reads; it re-checks each
+    digest against the manifest itself.
+    """
+
+    from huggingface_hub import hf_hub_download
+
+    token = os.environ.get("HUGGING_FACE_TOKEN") or os.environ.get("HF_TOKEN")
+    with timed_step("regional-microdata", timings) as record:
+        manifest = json.loads(
+            Path(
+                hf_hub_download(
+                    CUT_REPO,
+                    f"releases/{release}/release_manifest.json",
+                    repo_type="dataset",
+                    revision=tag,
+                    token=token,
+                )
+            ).read_text()
+        )
+        microdata = {
+            name: artifact
+            for name, artifact in (manifest.get("artifacts") or {}).items()
+            if artifact.get("kind") == "microdata"
+            and str(artifact.get("path", "")).lower().endswith(".h5")
+        }
+        if not microdata:
+            raise CertifyError(f"{tag}: the manifest lists no microdata H5.")
+        paths: dict[str, Path] = {}
+        for name, artifact in sorted(microdata.items()):
+            if not artifact.get("sha256") or not artifact.get("revision"):
+                raise CertifyError(
+                    f"{tag}: {name} is not pinned by revision and sha256."
+                )
+            path = Path(
+                hf_hub_download(
+                    artifact.get("repo_id") or CUT_REPO,
+                    artifact["path"],
+                    repo_type="dataset",
+                    revision=artifact["revision"],
+                    token=token,
+                )
+            )
+            digest = hashlib.sha256()
+            with path.open("rb") as handle:
+                for chunk in iter(lambda: handle.read(1 << 22), b""):
+                    digest.update(chunk)
+            if digest.hexdigest() != artifact["sha256"]:
+                raise CertifyError(
+                    f"{artifact['path']} at {artifact['revision']} hashes to "
+                    f"{digest.hexdigest()}, not the manifest's {artifact['sha256']}."
+                )
+            paths[name] = path
+        record.update(artifacts=sorted(paths))
+    return paths
+
+
+def regional_audit_argv(
+    python: str,
+    *,
+    manifest_uri: str,
+    artifacts: dict[str, Path],
+    model: str,
+    audited_by: str,
+    limitations: Sequence[str],
+    output: Path,
+) -> list[str]:
+    """The audit command for these regional files under the target model."""
+
+    argv = [python, AUDIT_SCRIPT, "--regional-manifest-uri", manifest_uri]
+    for name, path in sorted(artifacts.items()):
+        argv += ["--artifact", f"{name}={path}"]
+    argv += ["--model-version", model, "--audited-by", audited_by]
+    for limitation in limitations:
+        argv += ["--limitation", limitation]
+    return [*argv, "--output", str(output)]
+
+
+def undeclared_flags(help_text: str, argv: Sequence[str]) -> list[str]:
+    """The ``--flags`` of ``argv`` that a tool's ``--help`` does not declare."""
+
+    declared = set(re.findall(r"(--[a-z][a-z0-9-]*)", help_text))
+    return sorted({a for a in argv if a.startswith("--") and a not in declared})
+
+
+def read_regional_evidence(path: Path, *, model: str, build_model: str) -> dict:
+    """The audit's evidence, refused unless it is build-relative and drop-free."""
+
+    try:
+        evidence = json.loads(path.read_text())
+    except (FileNotFoundError, json.JSONDecodeError) as error:
+        raise CertifyError(f"the regional audit wrote no readable {path}.") from error
+    if not isinstance(evidence, dict):
+        raise CertifyError(f"{path} is not an evidence object.")
+    if evidence.get("schema_version") != REGIONAL_EVIDENCE_SCHEMA:
+        raise CertifyError(
+            f"{path} is evidence schema {evidence.get('schema_version')!r}, not "
+            f"{REGIONAL_EVIDENCE_SCHEMA}: this policyengine.py measures drops "
+            "against the target model only, so it refuses Microcosm's own "
+            "columns. Certify from a base with policyengine.py#699's "
+            "build-model baseline."
+        )
+    for field, expected in (
+        ("model_version", model),
+        ("build_model_version", build_model),
+    ):
+        if evidence.get(field) != expected:
+            raise CertifyError(
+                f"{path} audits {field} {evidence.get(field)!r}, not {expected!r}."
+            )
+    if evidence.get("dropped_columns"):
+        raise CertifyError(
+            f"policyengine-uk {model} no longer defines these stored columns of "
+            f"the {build_model} local-area file, so area runs would lose them: "
+            f"{', '.join(evidence['dropped_columns'])}. Build a dense cut on {model}."
+        )
+    return evidence
+
+
+def overlay_diff(old_bundle: dict, new_bundle: dict) -> list[str]:
+    old = set((old_bundle.get("dataset_overlays") or {}).get("uk", {}) or {})
+    new = set((new_bundle.get("dataset_overlays") or {}).get("uk", {}) or {})
+    return sorted(old - new)
+
+
+def uc_floor_summary(receipt: object) -> tuple[bool, str]:
+    """The measured floor's verdict and a summary of its ratios.
+
+    Only a complete receipt is accepted: a mapping for the ``uk_uc_floor``
+    check with a boolean verdict, and a list of measures that includes
+    ``benefit_units`` and ``spend``. Each measure has a unique name, a
+    boolean verdict and a finite numeric ratio, and the overall verdict is
+    the conjunction of theirs. Any other value, whatever its shape, is the
+    floor failing operationally, never a crash.
+    """
+
+    incomplete = CertifyError(
+        "UC floor failed operationally: incomplete measured receipt."
+    )
+    if not isinstance(receipt, dict) or receipt.get("check") != "uk_uc_floor":
+        raise incomplete
+    passed, measures = receipt.get("passed"), receipt.get("measures")
+    if not isinstance(passed, bool) or not isinstance(measures, list):
+        raise incomplete
+    rows: list[tuple[str, float, bool]] = []
+    for measure in measures:
+        if not isinstance(measure, dict):
+            raise incomplete
+        name, ratio, verdict = (measure.get(k) for k in ("name", "ratio", "passed"))
+        if not isinstance(name, str) or not name or not isinstance(verdict, bool):
+            raise incomplete
+        if isinstance(ratio, bool) or not isinstance(ratio, (int, float)):
+            raise incomplete
+        try:
+            ratio = float(ratio)
+        except OverflowError:
+            raise incomplete from None
+        if not math.isfinite(ratio):
+            raise incomplete
+        rows.append((name, ratio, verdict))
+    names = [name for name, _, _ in rows]
+    if len(set(names)) != len(names) or not {"benefit_units", "spend"} <= set(names):
+        raise incomplete
+    if passed != all(verdict for _, _, verdict in rows):
+        raise incomplete
+    ratios = ", ".join(f"{name}={ratio:.6f}" for name, ratio, _ in rows)
+    return (
+        passed,
+        f"{'passed' if passed else 'FAILED'}; measured/benchmark ratios: {ratios}",
+    )
+
+
+def pr_body(context: dict[str, Any]) -> str:
+    lines = [
+        f"Certifies Microcosm UK national cut `{context['national_tag']}` "
+        f"(policyengine-uk {context['model']}, core {context['core']}).",
+        "",
+        "**Mechanical handoff; wrapper qualification pending** unless reviewed "
+        "receipts cover this exact candidate pair, commit and bundle. Microcosm's "
+        "19 producer release-cut gates and passing pytest do not establish "
+        "wrapper qualification.",
+        "",
+        f"- **Regional route:** {context['regional_summary']}",
+        f"- **Compatibility basis:** `{context.get('basis')}`",
+        f"- **Made by** `tools/certify_uk_cut_in_policyengine_py.py` in "
+        f"PolicyEngine/microcosm at `{context['microcosm_commit'][:9]}`.",
+        "",
+        "## How it was made",
+        "",
+        "```bash",
+        *context["commands"],
+        "```",
+        "",
+        "## Receipts",
+        "",
+        f"- UC floor (weighted national totals, `scripts/check_uk_uc_floor.py`): "
+        f"{context.get('uc_floor', 'not run')}",
+        f"- Tests: {context.get('tests', 'not run')}",
+        f"- Certified-constant files rewritten: {context.get('constants') or 'none'}",
+        "",
+        "## Needs a person before this leaves draft",
+        "",
+        "- [ ] **Wrapper qualification.** Attach exact-pair receipts for every "
+        "required candidate gate, including the full reform contract, metrics "
+        "review and reform responsiveness; attach and review scorecard replay "
+        "evidence. Keep qualification pending until the evidence is reviewed. "
+        "Record any explicit reviewer-approved exception; this script waives "
+        "no gate.",
+    ]
+    if context.get("uc_floor_passed") is False:
+        lines.append(
+            "- [ ] **UC floor acceptance.** This cut has a measured floor failure "
+            "and needs explicit acceptance in its pull request "
+            "(data-certification.md, recorded exceptions). Accepted by: ___"
+        )
+    if context.get("dropped_overlays"):
+        lines.append(
+            "- [ ] **Dataset overlays dropped by certification:** "
+            f"{', '.join(context['dropped_overlays'])}. Re-add any that must stay "
+            "loadable from the previous bundle (as #685 did)."
+        )
+    evidence = context.get("regional_evidence")
+    if evidence is not None:
+        lines.append(
+            "- [ ] **Area runs on the older local-area file** (accepted mismatch, "
+            f"built on {evidence['build_model_version']}, audited by "
+            f"{evidence['audited_by']}): no stored column is dropped; inputs that "
+            f"take defaults: {', '.join(evidence['defaulted_inputs']) or 'none'}; "
+            f"{len(evidence.get('never_modelled_columns') or [])} stored columns "
+            "neither model defines are recorded only. Limitations recorded: "
+            f"{'; '.join(evidence['limitations'])}. Confirm none matters for a "
+            "reform the Budget dashboard shows by area."
+        )
+    if context.get("warnings"):
+        lines.append(
+            "- [ ] **Certification warnings** (from `certify-data`):\n  "
+            + "\n  ".join(f"- {w}" for w in context["warnings"])
+        )
+    if context.get("tests_failed"):
+        lines.append(
+            "- [ ] **Failing tests** to update for the new pair: "
+            + ", ".join(context["tests_failed"][:20])
+        )
+    lines.append("- [ ] One writer: the UK hub and María know this PR exists.")
+    if context.get("footer"):
+        lines += ["", context["footer"]]
+    return "\n".join(lines) + "\n"
+
+
+#: A commit trailer's co-author: one line, ``Name <email>``.
+CO_AUTHOR_PATTERN = re.compile(r"^[^<>\n]+ <[^<>\s@]+@[^<>\s]+>$")
+
+
+def commit_message(national_tag: str, *, co_authors: Sequence[str] = ()) -> str:
+    """The certification commit's message, crediting only the named co-authors."""
+
+    message = f"Certify Microcosm UK cut {national_tag}"
+    if co_authors:
+        trailers = "\n".join(f"Co-Authored-By: {author}" for author in co_authors)
+        message += f"\n\n{trailers}"
+    return message
+
+
+def readable(text: str | None) -> bool:
+    """At least one printable, non-space character, as policyengine.py requires
+    of a mismatch's reason, auditor and limitations (a zero-width space alone
+    is not readable)."""
+
+    return any(ch.isprintable() and not ch.isspace() for ch in text or "")
+
+
+def parse(argv: list[str] | None) -> argparse.Namespace:
+    parser = argparse.ArgumentParser(description=__doc__.split("\n\n")[0])
+    parser.add_argument("--national-tag", required=True)
+    route = parser.add_mutually_exclusive_group(required=True)
+    route.add_argument("--dense-tag")
+    route.add_argument("--keep-regional-release", action="store_true")
+    route.add_argument("--area-coded-national-uri")
+    route.add_argument("--drop-regional-release", action="store_true")
+    parser.add_argument(
+        "--accept-regional-model-mismatch",
+        metavar="REASON",
+        help=(
+            "route regions to a regional cut built on another policyengine-uk, "
+            "recording who accepted it and why; certifies only with "
+            "policyengine.py's audited input-surface evidence (#699)"
+        ),
+    )
+    parser.add_argument(
+        "--audited-by",
+        metavar="WHO",
+        help=(
+            "with an accepted mismatch: who ran the audit, as it should appear "
+            "in policyengine.py's public bundle"
+        ),
+    )
+    parser.add_argument(
+        "--regional-limitation",
+        action="append",
+        default=[],
+        metavar="TEXT",
+        help="with an accepted mismatch: a limitation to record (repeatable)",
+    )
+    parser.add_argument("--model-version", help="default: the cut's build-time model")
+    parser.add_argument("--core-version", help="default: the cut's build-time core")
+    parser.add_argument(
+        "--pepy-repo",
+        type=Path,
+        required=True,
+        help="a clone of PolicyEngine/policyengine.py with an origin remote",
+    )
+    parser.add_argument("--worktree", type=Path, help="default: beside the repo")
+    parser.add_argument(
+        "--resume-worktree",
+        action="store_true",
+        help="replay stages in an unfinished registered worktree at the exact base",
+    )
+    parser.add_argument(
+        "--base-ref",
+        default="origin/main",
+        help="base branch/ref for both the old bundle and the new worktree",
+    )
+    parser.add_argument("--skip-writer-check", metavar="WHY")
+    parser.add_argument("--skip-tests", action="store_true")
+    parser.add_argument("--test-workers", type=int, default=4)
+    parser.add_argument(
+        "--max-load1",
+        type=float,
+        help="refuse each heavy step above this 1-minute load (default: no limit)",
+    )
+    parser.add_argument(
+        "--min-free-gb",
+        type=float,
+        default=DEFAULT_MIN_FREE_BYTES / 1e9,
+        help="refuse each heavy step below this free disk (default %(default)s GB)",
+    )
+    parser.add_argument("--push", action="store_true")
+    parser.add_argument(
+        "--pr-base",
+        default="main",
+        help="pull-request target branch (default: main), independent of --base-ref",
+    )
+    parser.add_argument("--open-pr", action="store_true", help="draft; needs --push")
+    parser.add_argument("--dry-run", action="store_true", help="print the plan only")
+    parser.add_argument(
+        "--co-author",
+        action="append",
+        default=[],
+        metavar="NAME <EMAIL>",
+        help="add a Co-Authored-By trailer to the certification commit (repeatable)",
+    )
+    parser.add_argument(
+        "--pr-body-footer",
+        metavar="TEXT",
+        help="a closing line for the pull request body, such as an agent's credit",
+    )
+    args = parser.parse_args(argv)
+    if args.open_pr and not args.push:
+        parser.error("--open-pr needs --push.")
+    for author in args.co_author:
+        if not CO_AUTHOR_PATTERN.match(author):
+            parser.error(f"--co-author must be one line, 'Name <email>': {author!r}")
+    if args.accept_regional_model_mismatch is not None:
+        if not readable(args.accept_regional_model_mismatch):
+            parser.error("--accept-regional-model-mismatch needs a reason.")
+        if not readable(args.audited_by):
+            parser.error("--accept-regional-model-mismatch needs --audited-by.")
+        if not args.regional_limitation or not all(
+            readable(text) for text in args.regional_limitation
+        ):
+            parser.error(
+                "--accept-regional-model-mismatch needs at least one "
+                "--regional-limitation, each with readable text."
+            )
+    elif args.audited_by or args.regional_limitation:
+        parser.error(
+            "--audited-by and --regional-limitation go with "
+            "--accept-regional-model-mismatch."
+        )
+    if not 1 <= args.test_workers <= 4:
+        parser.error("--test-workers must be between 1 and 4.")
+    check_tag(args.national_tag, "national")
+    return args
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = parse(argv)
+    try:
+        return certify(args)
+    except CertifyError as error:
+        print(f"REFUSED: {error}", file=sys.stderr)
+        return 2
+
+
+def certify(args: argparse.Namespace) -> int:
+    microcosm_commit = subprocess.check_output(
+        ["git", "rev-parse", "HEAD"], cwd=Path(__file__).resolve().parents[1], text=True
+    ).strip()
+    repo = args.pepy_repo
+    limits = {
+        "max_load1": args.max_load1,
+        "min_free_bytes": int(args.min_free_gb * 1e9),
+    }
+    suffix = args.national_tag.rsplit("-", 1)[-1]
+    branch = f"certify-uk-{suffix}"
+    worktree = args.worktree or repo.parent / "_worktrees" / f"pepy-{branch}"
+    log = worktree.parent / f"{worktree.name}.certify.log"
+    timings = log.with_suffix(".timings.jsonl")
+    if not args.skip_tests and not args.dry_run:
+        with timed_step("test-temp-preflight", timings) as timing:
+            timing["temporary_directory"] = str(check_test_temp_directory())
+    base_ref = args.base_ref
+    if base_ref.startswith("origin/"):
+        remote_branch = base_ref.removeprefix("origin/")
+        with timed_step("git-fetch", timings):
+            subprocess.run(
+                [
+                    "git",
+                    "fetch",
+                    "--quiet",
+                    "origin",
+                    f"+refs/heads/{remote_branch}:refs/remotes/origin/{remote_branch}",
+                ],
+                cwd=repo,
+                check=True,
+                timeout=300,
+            )
+    with timed_step("resolve-base", timings):
+        base_commit = subprocess.check_output(
+            ["git", "rev-parse", "--verify", f"{base_ref}^{{commit}}"],
+            cwd=repo,
+            text=True,
+        ).strip()
+
+    replay_paths = []
+    if args.resume_worktree:
+        with timed_step("resume-worktree-validation", timings):
+            replay_paths = validate_resume_worktree(
+                repo, worktree, branch, base_commit, args.national_tag
+            )
+    elif worktree.exists():
+        raise CertifyError(
+            f"{worktree} exists; use --resume-worktree for an unfinished handoff "
+            "or choose a fresh --worktree."
+        )
+
+    if args.skip_writer_check:
+        print(f"writer check skipped: {args.skip_writer_check}")
+    else:
+        with timed_step("writer-check", timings):
+            others = writer_check(args.national_tag, repo)
+        if others:
+            raise CertifyError(
+                "this cut is already being certified: "
+                + "; ".join(others)
+                + ". Coordinate with its owner instead of opening a second PR."
+            )
+
+    with timed_step("national-manifest", timings):
+        national = read_cut(args.national_tag, NATIONAL_RELEASE)
+    model = args.model_version or national.model
+    core = args.core_version or national.core
+    if not covers(national, model):
+        raise CertifyError(
+            f"the national cut was built with policyengine-uk {national.model} and "
+            f"claims {list(national.claims)}; it cannot be certified for {model}."
+        )
+    with timed_step("old-bundle", timings):
+        old_bundle = json.loads(
+            subprocess.check_output(
+                [
+                    "git",
+                    "show",
+                    f"{base_commit}:src/policyengine/data/bundle/manifest.json",
+                ],
+                cwd=repo,
+                text=True,
+            )
+        )
+    record = old_bundle["data_releases"]["uk"]
+    flags = regional_flags(args, record)
+    new_regional = regional_tag(flags)
+    regional_summary = shlex.join(flags)
+    dense, mismatch, regional_artifacts = None, False, {}
+    if new_regional is not None:
+        with timed_step("regional-manifest", timings):
+            dense = read_cut(new_regional, DENSE_RELEASE)
+        if not covers(dense, model):
+            if not args.accept_regional_model_mismatch:
+                raise CertifyError(
+                    f"the regional cut {new_regional} was built with policyengine-uk "
+                    f"{dense.model} and claims {list(dense.claims)}, so certification "
+                    f"for {model} will refuse it. Routes: a dense cut on {model} "
+                    "(--dense-tag), --drop-regional-release, an enhanced-FRS release "
+                    "that claims the version (--area-coded-national-uri), or an "
+                    "accepted, recorded mismatch (--accept-regional-model-mismatch) "
+                    "with policyengine.py's audited evidence."
+                )
+            problem = regional_audit_support(repo, base_commit)
+            if problem is not None:
+                raise CertifyError(
+                    f"policyengine.py at {base_ref} ({base_commit[:9]}) cannot "
+                    f"certify an accepted mismatch: {problem} (policyengine.py#699). "
+                    "Use a --base-ref that has it, or another regional route."
+                )
+            mismatch = True
+            regional_summary += f" (regional built on {dense.model}; mismatch accepted)"
+            if not args.dry_run:
+                regional_artifacts = fetch_regional_microdata(
+                    new_regional, DENSE_RELEASE, timings=timings
+                )
+    old_regional = regional_tag(
+        ["--regional-manifest-uri", record.get("regional_source_manifest_uri") or ""]
+    )
+
+    plan = {
+        "base_ref": base_ref,
+        "base_commit": base_commit,
+        "national_tag": args.national_tag,
+        "model": model,
+        "core": core,
+        "regional": regional_summary,
+        "branch": branch,
+        "worktree": str(worktree),
+        "resume_worktree": args.resume_worktree,
+        "replayed_generated_paths": replay_paths,
+    }
+    print(json.dumps(plan, indent=2))
+    if args.dry_run:
+        return 0
+    if not args.resume_worktree:
+        with timed_step("git-worktree", timings):
+            subprocess.run(
+                [
+                    "git",
+                    "worktree",
+                    "add",
+                    "--quiet",
+                    "-b",
+                    branch,
+                    str(worktree),
+                    base_commit,
+                ],
+                cwd=repo,
+                check=True,
+            )
+    run = Shell(worktree, log, timings=timings, **limits)
+    python = str(worktree / ".venv/bin/python")
+    sync = ["uv", "sync", "--frozen", "--extra", "uk", "--extra", "dev",
+            "--python", PEPY_PYTHON]  # fmt: skip
+    run(sync, step="initial-sync", credentials=False)
+    evidence = None
+    if mismatch:
+        # The audit reads the target model in process, so the worktree's
+        # environment gets the target pair now; the certified sync below
+        # restores it to the new lock exactly.
+        run(
+            ["uv", "pip", "install", "--no-config", "--default-index",
+             "https://pypi.org/simple", "--python", python,
+             f"policyengine-uk=={model}", f"policyengine-core=={core}"],
+            step="audit-model-install",
+            credentials=False,
+        )  # fmt: skip
+        evidence_path = worktree.parent / f"{worktree.name}.regional-input-surface.json"
+        # An earlier attempt's evidence must not stand in for this audit.
+        evidence_path.unlink(missing_ok=True)
+        audit = regional_audit_argv(
+            python,
+            manifest_uri=flags[flags.index("--regional-manifest-uri") + 1],
+            artifacts=regional_artifacts,
+            model=model,
+            audited_by=args.audited_by,
+            limitations=args.regional_limitation,
+            output=evidence_path,
+        )
+        missing = undeclared_flags(
+            run([python, AUDIT_SCRIPT, "--help"], step="audit-help").stdout, audit
+        )
+        if missing:
+            raise CertifyError(
+                f"{AUDIT_SCRIPT} at {base_commit[:9]} does not declare "
+                f"{', '.join(missing)}; update this tool to its interface."
+            )
+        run(audit, step="regional-input-audit")
+        evidence = read_regional_evidence(
+            evidence_path, model=model, build_model=dense.model
+        )
+        flags += [
+            "--accept-regional-model-mismatch", args.accept_regional_model_mismatch,
+            "--regional-input-surface-evidence", str(evidence_path),
+        ]  # fmt: skip
+    certify_result = run(
+        [
+            python, "scripts/bundle.py", "certify-data", "--country", "uk",
+            "--data-producer", "populace",
+            "--manifest-uri", manifest_uri(args.national_tag, NATIONAL_RELEASE),
+            *flags,
+            "--model-version", model, "--core-version", core,
+        ], step="certify-data",
+    )  # fmt: skip
+    warnings = [
+        line.strip()
+        for line in certify_result.stdout.splitlines()
+        if "warning" in line.lower()
+    ]
+    run(
+        ["uv", "lock", "--no-config", "--no-sources", "--default-index",
+         "https://pypi.org/simple", "--python", python], step="lock",
+        credentials=False,
+    )  # fmt: skip
+    run(sync, step="certified-sync", credentials=False)
+    run([python, "scripts/release_lock.py"], step="release-lock")
+    run([python, "scripts/bundle.py", "generate", "--include-tros"], step="TROs")
+    new_bundle = json.loads(
+        (worktree / "src/policyengine/data/bundle/manifest.json").read_text()
+    )
+    new_record = new_bundle["data_releases"]["uk"]
+    rewrite = run(
+        [
+            python, "-c",
+            "import json, sys; from pathlib import Path; "
+            "from policyengine.provenance.uk_qualification import "
+            "certified_constant_replacements as r, rewrite_certified_constants as w; "
+            "old, new = json.loads(sys.argv[1]), json.loads(sys.argv[2]); "
+            "print(json.dumps(w(Path('.'), r(old, new))))",
+            json.dumps(record), json.dumps(new_record),
+        ], step="constant-rewrite",
+        env={"POLICYENGINE_SKIP_COUNTRY_IMPORTS": "1"},
+    )  # fmt: skip
+    constants = json.loads(rewrite.stdout.strip().splitlines()[-1] or "[]")
+    with timed_step("regional-constant-rewrite", timings):
+        constants += rewrite_regional_constants(worktree, old_regional, new_regional)
+    run(
+        pytest_command(python, ["tests/test_household_calculator_snapshot.py", "-q"]),
+        env={"PE_UPDATE_SNAPSHOTS": "1"},
+        step="snapshots",
+    )
+    run(
+        [python, "scripts/bundle.py", "check", "--published-spm", "--include-tros",
+         "--strict-tros"], step="strict-check",
+    )  # fmt: skip
+    uc_path = worktree.parent / f"{worktree.name}.uc_floor.json"
+    # An earlier attempt's receipt must not mask an operational failure.
+    uc_path.unlink(missing_ok=True)
+    uc = run(
+        [python, "scripts/check_uk_uc_floor.py", "--dataset",
+         new_record["default_dataset"], "--year", "2025", "--output", str(uc_path)],
+        check=False,
+        step="UC-floor",
+        env={"POLICYENGINE_SKIP_COUNTRY_IMPORTS": "1"},
+    )  # fmt: skip
+    if not uc_path.exists():
+        raise CertifyError(
+            f"UC floor failed operationally (exit {uc.returncode}); no measured "
+            f"receipt was produced. See {log}."
+        )
+    try:
+        receipt = json.loads(uc_path.read_text())
+    except json.JSONDecodeError as error:
+        raise CertifyError(
+            "UC floor failed operationally: invalid measured receipt."
+        ) from error
+    uc_passed, uc_summary = uc_floor_summary(receipt)
+    if uc.returncode != (0 if uc_passed else 1):
+        raise CertifyError(
+            f"UC floor failed operationally (exit {uc.returncode}); "
+            "the measured receipt disagrees with the process exit status."
+        )
+    tests_summary, tests_failed, tests_returncode = "skipped", [], 0
+    if not args.skip_tests:
+        xdist = run(
+            [python, "-c", "import xdist"],
+            check=False,
+            step="check-pytest-xdist",
+            credentials=False,
+        )
+        if xdist.returncode:
+            run(
+                ["uv", "pip", "install", "--python", python, "pytest-xdist"],
+                step="install-pytest-xdist",
+                credentials=False,
+            )
+        tests = run(
+            pytest_command(python, ["-n", str(args.test_workers), "-vv",
+             "--durations=20", "-o", "faulthandler_timeout=300",
+             "-p", "no:cacheprovider"]),
+            check=False,
+            step="tests",
+        )  # fmt: skip
+        tests_returncode = tests.returncode
+        tests_failed = re.findall(r"^FAILED (\S+)", tests.stdout, flags=re.MULTILINE)
+        tests_summary = (tests.stdout.strip().splitlines() or ["?"])[-1]
+        if tests_returncode and not tests_failed:
+            tests_failed = [f"pytest exited {tests_returncode}: {tests_summary}"]
+    context = {
+        "national_tag": args.national_tag,
+        "model": model,
+        "core": core,
+        "regional_summary": f"`{regional_summary}`",
+        "basis": (new_record.get("certification") or {}).get("compatibility_basis"),
+        "microcosm_commit": microcosm_commit,
+        "commands": run.commands,
+        "uc_floor": f"`{uc_summary}`",
+        "uc_floor_passed": uc_passed,
+        "tests": tests_summary,
+        "tests_failed": tests_failed,
+        "constants": ", ".join(constants),
+        "dropped_overlays": overlay_diff(old_bundle, new_bundle),
+        "warnings": warnings,
+        "footer": args.pr_body_footer,
+        "regional_evidence": evidence,
+    }
+    body = worktree.parent / f"{worktree.name}.pr-body.md"
+    body.write_text(pr_body(context))
+    with timed_step("generated-file-validation", timings):
+        staged_paths = certification_changes(worktree, args.national_tag)
+    if staged_paths:
+        run(["git", "add", "--", *staged_paths], step="stage-certification")
+    run(
+        ["git", "commit", "-q", "-m",
+         commit_message(args.national_tag, co_authors=args.co_author)]
+    )  # fmt: skip
+    print(f"\ncommitted on {branch} in {worktree}; PR body draft: {body}")
+    if args.push:
+        run(["git", "push", "-u", "origin", branch])
+    if args.open_pr:
+        run(
+            ["gh", "pr", "create", "--draft", "--repo", PEPY_REPO, "--base", args.pr_base,
+             "--head", branch, "--title",
+             f"Certify Microcosm UK cut {args.national_tag}", "--body-file", str(body)]
+        )  # fmt: skip
+    return 0 if not tests_returncode else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/tools/modal_rebuild_uk_chronicle_artifact.py b/tools/modal_rebuild_uk_chronicle_artifact.py
new file mode 100644
index 0000000000..d653068cd5
--- /dev/null
+++ b/tools/modal_rebuild_uk_chronicle_artifact.py
@@ -0,0 +1,341 @@
+"""Modal app: rebuild the pinned Chronicle UK consumer artifact off this machine.
+
+The UK national build pins one Chronicle consumer artifact by digest
+(``packages/microcosm-build/src/microcosm/build/uk/chronicle_feed.json``):
+``build-bundle --suite uk`` then ``build-consumer-artifact`` at one Chronicle
+commit. Chronicle is public and its UK suite builds from committed source
+files plus two DESNZ workbooks fetched from the publisher by pinned sha256
+(``LEDGER_SOURCE_ARTIFACT_FETCH=1``), so anyone can rebuild it. The bundle
+takes tens of gigabytes of disk, more than a busy laptop has spare, so this
+runs it in a Modal container and keeps only the artifact.
+
+The container clones Chronicle at the pinned commit, syncs its own
+``uv.lock``, builds the bundle and the artifact, and hashes both artifact
+files against the pin. Results go to the ``microcosm-uk-chronicle`` Modal
+volume under ``<commit>/<facts sha256>/``, with a receipt beside them.
+
+Check the pin and print the plan (plain Python; contacts no Modal service
+and sends nothing)::
+
+    python tools/modal_rebuild_uk_chronicle_artifact.py
+
+Rebuild (paid, a few hours; no credential goes to Modal)::
+
+    modal run --detach tools/modal_rebuild_uk_chronicle_artifact.py --build
+
+Rebuild and upload to the private Hugging Face repo when the digests match
+the pin. ``modal run`` creates the app before its entrypoint runs, so the
+token is attached only when ``MICROCOSM_UK_CHRONICLE_MODAL_UPLOAD=1`` says
+the upload is deliberate. ``HF_TOKEN`` needs write access to
+``policyengine/microcosm-uk-build-inputs``; give it to this one command. It
+goes to Modal as an ephemeral secret for this run only: Modal holds it for
+the run, but no named workspace secret keeps it::
+
+    HF_TOKEN=… MICROCOSM_UK_CHRONICLE_MODAL_UPLOAD=1 modal run --detach tools/modal_rebuild_uk_chronicle_artifact.py --build --upload
+
+An artifact whose digests differ from the pin is never uploaded under the
+pinned path; with ``--upload`` its receipt and bundle reports go to
+``diagnostic/`` so the difference can be traced.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import resource
+import shutil
+import subprocess
+import sys
+import time
+from datetime import UTC, datetime
+from pathlib import Path
+
+import modal
+
+APP_NAME = "microcosm-uk-chronicle-rebuild"
+VOLUME_NAME = "microcosm-uk-chronicle"
+VOLUME_MOUNT = "/artifacts"
+HF_REPO = "policyengine/microcosm-uk-build-inputs"
+CHRONICLE_URL = "https://github.com/PolicyEngine/chronicle.git"
+PYTHON_VERSION = "3.14"
+UV_VERSION = "0.11.7"
+HF_HUB_VERSION = "1.18.0"
+FEED_PIN = Path(__file__).resolve().parents[1] / (
+    "packages/microcosm-build/src/microcosm/build/uk/chronicle_feed.json"
+)
+
+
+def _load_pin() -> dict:
+    pin = json.loads(FEED_PIN.read_text())
+    if pin.get("country") != "uk" or pin.get("source_repo") != "PolicyEngine/chronicle":
+        raise SystemExit(f"{FEED_PIN} is not the UK Chronicle feed pin.")
+    return pin
+
+
+PIN = _load_pin() if modal.is_local() else json.loads(os.environ["CHRONICLE_PIN"])
+
+
+#: The launcher's opt-in for attaching HF_TOKEN to a ``modal run``.
+UPLOAD_OPT_IN = "MICROCOSM_UK_CHRONICLE_MODAL_UPLOAD"
+
+
+def _secrets() -> list[modal.Secret]:
+    # An ephemeral secret for one deliberate upload run only: modal run sends
+    # the app's secrets before the entrypoint can refuse. The container must
+    # declare the same dependencies as the launcher, and there the secret
+    # itself supplies HF_TOKEN, so both sides agree.
+    if modal.is_local() and os.environ.get(UPLOAD_OPT_IN) != "1":
+        return []
+    token = os.environ.get("HF_TOKEN")
+    return [modal.Secret.from_dict({"HF_TOKEN": token})] if token else []
+
+
+image = (
+    modal.Image.debian_slim(python_version=PYTHON_VERSION)
+    .apt_install("git", "curl", "time")
+    .pip_install(f"uv=={UV_VERSION}", f"huggingface_hub=={HF_HUB_VERSION}")
+    .run_commands(f"uv python install {PYTHON_VERSION}")
+    .env(
+        {
+            "CHRONICLE_PIN": json.dumps(PIN, sort_keys=True),
+            "UV_LINK_MODE": "copy",
+            "PYTHONDONTWRITEBYTECODE": "1",
+        }
+    )
+)
+app = modal.App(APP_NAME)
+volume = modal.Volume.from_name(VOLUME_NAME, create_if_missing=True)
+
+
+def _now() -> str:
+    return datetime.now(UTC).strftime("%Y-%m-%dT%H:%M:%SZ")
+
+
+def _sha256(path: Path) -> str:
+    digest = hashlib.sha256()
+    with path.open("rb") as handle:
+        for chunk in iter(lambda: handle.read(1 << 22), b""):
+            digest.update(chunk)
+    return digest.hexdigest()
+
+
+def _run(argv: list[str], *, cwd: Path, env: dict[str, str], log: Path) -> dict:
+    started = time.monotonic()
+    with log.open("ab") as handle:
+        handle.write(f"\n$ {' '.join(argv)}\n".encode())
+        handle.flush()
+        completed = subprocess.run(
+            ["/usr/bin/time", "-v", *argv],
+            cwd=cwd,
+            env=env,
+            stdout=handle,
+            stderr=subprocess.STDOUT,
+        )
+    if completed.returncode != 0:
+        tail = log.read_text(errors="replace")[-4000:]
+        raise RuntimeError(f"{argv[:4]} exited {completed.returncode}:\n{tail}")
+    return {"argv": argv, "seconds": round(time.monotonic() - started, 1)}
+
+
+@app.function(
+    image=image,
+    volumes={VOLUME_MOUNT: volume},
+    secrets=_secrets(),
+    cpu=8.0,
+    memory=98304,
+    ephemeral_disk=512 * 1024,  # Modal's floor; the bundle needs tens of GB
+    timeout=8 * 3600,
+)
+def rebuild(upload: bool) -> dict:
+    """Clone, build, hash and (optionally) upload; return the receipt."""
+
+    commit = PIN["source_commit"]
+    work = Path("/work")
+    repo = work / "chronicle"
+    bundle = work / "bundle"
+    artifact = work / "artifact"
+    work.mkdir(parents=True, exist_ok=True)
+    log = work / "build.log"
+    receipt: dict = {
+        "schema_version": 1,
+        "kind": "microcosm.uk_chronicle_artifact_rebuild",
+        "started_at": _now(),
+        "pin": PIN,
+        "chronicle_commit": commit,
+        "steps": [],
+    }
+    env = {
+        **os.environ,
+        "LEDGER_SOURCE_ARTIFACT_FETCH": "1",
+        "UV_PYTHON": PYTHON_VERSION,
+        "UV_PROJECT_ENVIRONMENT": str(work / "venv"),
+    }
+    env.pop("HF_TOKEN", None)  # the build itself never needs the Hub
+    subprocess.run(["git", "clone", "--quiet", CHRONICLE_URL, str(repo)], check=True)
+    subprocess.run(["git", "-C", str(repo), "checkout", "--quiet", commit], check=True)
+    head = subprocess.check_output(
+        ["git", "-C", str(repo), "rev-parse", "HEAD"], text=True
+    ).strip()
+    if head != commit:
+        raise RuntimeError(f"checked out {head}, not the pinned {commit}")
+    for argv in (
+        ["uv", "sync", "--locked"],
+        [
+            "uv",
+            "run",
+            "--no-sync",
+            "chronicle",
+            "build-bundle",
+            "--suite",
+            "uk",
+            "--out",
+            str(bundle),
+            "--replace",
+        ],
+        [
+            "uv",
+            "run",
+            "--no-sync",
+            "chronicle",
+            "build-consumer-artifact",
+            "--facts",
+            str(bundle),
+            "--out",
+            str(artifact),
+            "--replace",
+        ],
+    ):
+        receipt["steps"].append(_run(argv, cwd=repo, env=env, log=log))
+    receipt["environment"] = {
+        "python": subprocess.check_output(
+            ["uv", "run", "--no-sync", "python", "--version"],
+            cwd=repo,
+            env=env,
+            text=True,
+        ).strip(),
+        "uv_lock_sha256": _sha256(repo / "uv.lock"),
+        "peak_child_rss_kib": resource.getrusage(resource.RUSAGE_CHILDREN).ru_maxrss,
+    }
+    facts = artifact / "consumer_facts.jsonl"
+    manifest = artifact / "manifest.json"
+    observed = {
+        "facts_sha256": _sha256(facts),
+        "manifest_sha256": _sha256(manifest),
+        "facts_size_bytes": facts.stat().st_size,
+        "manifest": json.loads(manifest.read_text()),
+    }
+    matches = {
+        "facts_sha256": observed["facts_sha256"] == PIN["facts_sha256"],
+        "manifest_sha256": observed["manifest_sha256"] == PIN["manifest_sha256"],
+        "fact_row_count": observed["manifest"].get("fact_row_count")
+        == PIN["fact_row_count"],
+    }
+    receipt.update(observed=observed, matches=matches, reproduced=all(matches.values()))
+
+    # Keep the artifact and the small bundle reports; drop the bundle.
+    out = Path(VOLUME_MOUNT) / commit / observed["facts_sha256"]
+    out.mkdir(parents=True, exist_ok=True)
+    for name in ("manifest.json", "consumer_facts.jsonl"):
+        shutil.copyfile(artifact / name, out / name)
+    reports = out / "bundle-reports"
+    reports.mkdir(exist_ok=True)
+    for name in ("coverage.json", "source_packages.json", "reports/build_bundle.json"):
+        source = bundle / name
+        if source.exists():
+            shutil.copyfile(source, reports / Path(name).name)
+    shutil.copyfile(log, out / "build.log")
+    receipt["volume_path"] = f"{VOLUME_NAME}:{out.relative_to(VOLUME_MOUNT)}"
+
+    if upload:
+        receipt["upload"] = _upload(out, receipt)
+    receipt["finished_at"] = _now()
+    (out / "receipt.json").write_text(json.dumps(receipt, indent=2, sort_keys=True))
+    volume.commit()
+    return receipt
+
+
+def _upload(out: Path, receipt: dict) -> dict:
+    from huggingface_hub import HfApi
+
+    if not os.environ.get("HF_TOKEN"):
+        return {"uploaded": False, "reason": "HF_TOKEN was not exported locally"}
+    api = HfApi(token=os.environ["HF_TOKEN"])
+    commit = receipt["chronicle_commit"]
+    if receipt["reproduced"]:
+        prefix = f"chronicle-uk/{commit}"
+        allow = ["manifest.json", "consumer_facts.jsonl"]
+        message = f"Add the Chronicle UK consumer artifact rebuilt at {commit}"
+    else:
+        # Never under the pinned path: only the evidence for a diff.
+        prefix = (
+            f"diagnostic/chronicle-uk/{commit}/{receipt['observed']['facts_sha256']}"
+        )
+        allow = ["manifest.json", "bundle-reports/*", "build.log"]
+        message = (
+            f"Diagnostic: Chronicle UK rebuild at {commit} did not reproduce the pin"
+        )
+    (out / "receipt.json").write_text(json.dumps(receipt, indent=2, sort_keys=True))
+    allow.append("receipt.json")
+    result = api.upload_folder(
+        repo_id=HF_REPO,
+        repo_type="dataset",
+        folder_path=str(out),
+        path_in_repo=prefix,
+        allow_patterns=allow,
+        commit_message=message,
+    )
+    return {"uploaded": True, "path_in_repo": prefix, "commit": result.oid}
+
+
+def plan(*, upload: bool = False) -> dict:
+    """Print what a rebuild would do; contacts no Modal service."""
+
+    summary = {
+        "chronicle_commit": PIN["source_commit"],
+        "expected_facts_sha256": PIN["facts_sha256"],
+        "expected_manifest_sha256": PIN["manifest_sha256"],
+        "expected_rows": PIN["fact_row_count"],
+        "volume": VOLUME_NAME,
+        "upload_repo": HF_REPO if upload else None,
+        "hf_token_present": bool(os.environ.get("HF_TOKEN")),
+    }
+    print(json.dumps(summary, indent=2))
+    return summary
+
+
+@app.local_entrypoint()
+def main(build: bool = False, upload: bool = False) -> None:
+    sent = os.environ.get(UPLOAD_OPT_IN) == "1" and bool(os.environ.get("HF_TOKEN"))
+    if not build:
+        raise SystemExit(
+            "modal run is only for a paid rebuild: pass --build. To plan, run "
+            "`python tools/modal_rebuild_uk_chronicle_artifact.py`, which "
+            "contacts no Modal service."
+            + (
+                f" HF_TOKEN was already sent to Modal ({UPLOAD_OPT_IN}=1)."
+                if sent
+                else ""
+            )
+        )
+    if upload and not sent:
+        raise SystemExit(
+            f"--upload needs {UPLOAD_OPT_IN}=1 and HF_TOKEN given to this command "
+            "(HF_TOKEN=… VAR=1 modal run …), not exported to the shell."
+        )
+    if sent and not upload:
+        print(
+            f"HF_TOKEN was sent to Modal ({UPLOAD_OPT_IN}=1) but this run does "
+            "not upload; drop the variable when not uploading."
+        )
+    plan(upload=upload)
+    receipt = rebuild.remote(upload)
+    print(json.dumps(receipt, indent=2, sort_keys=True))
+
+
+if __name__ == "__main__":
+    plan(upload="--upload" in sys.argv[1:])
+    print(
+        "Plan only. To rebuild (paid): modal run --detach "
+        "tools/modal_rebuild_uk_chronicle_artifact.py --build [--upload]"
+    )
diff --git a/tools/modal_uk_cut.py b/tools/modal_uk_cut.py
new file mode 100644
index 0000000000..5018101c10
--- /dev/null
+++ b/tools/modal_uk_cut.py
@@ -0,0 +1,248 @@
+"""Modal app: run ``tools/run_uk_cut.py`` off this machine.
+
+For when the build Mac is busy, short of disk or asleep. The container
+clones microcosm at a pushed commit on ``main``, syncs that commit's own
+lock with the ``uk`` extra, and runs the same one command with its work
+directory on the ``microcosm-uk-cuts`` Modal volume, so fetched inputs and
+every step's outputs survive the container and a rerun resumes.
+
+Processing UK Data Service microdata on Modal needs the data owners' OK
+before first use (``docs/uk-cut-anyone.md``). The volume keeps UKDS inputs
+and outputs, and anyone in the Modal workspace can read it.
+
+Plan only (plain Python; contacts no Modal service and sends nothing)::
+
+    python tools/modal_uk_cut.py --commit <sha on main> --label sat24
+
+``modal run`` creates the app before its entrypoint runs, so it attaches the
+credentials only when ``MICROCOSM_UK_CUT_MODAL_RUN=1`` says the run is
+deliberate, and the entrypoint refuses anything but ``--run``. Run (paid;
+about three hours). ``HF_TOKEN`` and the registered
+``MICROCOSM_UK_TERMINAL_GATE_SIGNING_KEY`` go to Modal as an ephemeral secret
+for this run only: Modal holds both for the run, but no named workspace
+secret keeps them. A key used here is then also held on Modal, which its
+registry entry's ``held_in`` must say::
+
+    MICROCOSM_UK_CUT_MODAL_RUN=1 modal run --detach tools/modal_uk_cut.py --commit <sha> --label sat24 --run
+    MICROCOSM_UK_CUT_MODAL_RUN=1 modal run --detach tools/modal_uk_cut.py --commit <sha> --label sat24 --run --publish
+
+Read a finished run's receipt::
+
+    modal volume get microcosm-uk-cuts cuts/<label>-<sha9>/cut_receipt.json -
+"""
+
+from __future__ import annotations
+
+import argparse
+import importlib.util
+import os
+import re
+import subprocess
+import sys
+from pathlib import Path
+from types import ModuleType
+
+import modal
+
+APP_NAME = "microcosm-uk-cut"
+VOLUME_NAME = "microcosm-uk-cuts"
+WORK = "/work"
+REPO_URL = "https://github.com/PolicyEngine/microcosm.git"
+CHECKOUT = "/microcosm"
+PYTHON_VERSION = "3.13"  # the version PR CI tests the lock with
+UV_VERSION = "0.11.7"
+SHA = re.compile(r"^[0-9a-f]{40}$")
+#: The launcher's opt-in for attaching credentials to a ``modal run``.
+RUN_OPT_IN = "MICROCOSM_UK_CUT_MODAL_RUN"
+#: The signing-key registry's source, and where the image carries a copy
+#: (beside this module, which Modal places in /root).
+REGISTRY_SOURCE = Path(__file__).resolve().parents[1] / (
+    "packages/microcosm-data/src/microcosm/data/gate_signing_keys.py"
+)
+REGISTRY_REMOTE = "/root/gate_signing_keys.py"
+
+
+def load_gate_signing_keys(path: Path | None = None) -> ModuleType:
+    """``microcosm.data.gate_signing_keys``, loaded from its source file.
+
+    The launcher runs under the Modal CLI's own interpreter, and the container
+    imports this module before it clones microcosm, so neither can import
+    microcosm.data. The registry module needs only the standard library:
+    locally it is read from this checkout, in the container from the image's
+    copy.
+    """
+
+    if path is None:
+        path = REGISTRY_SOURCE if modal.is_local() else Path(REGISTRY_REMOTE)
+    spec = importlib.util.spec_from_file_location("uk_cut_gate_signing_keys", path)
+    if spec is None or spec.loader is None:
+        raise SystemExit(f"cannot load the signing-key registry from {path}.")
+    module = importlib.util.module_from_spec(spec)
+    # dataclasses resolve string annotations through sys.modules.
+    sys.modules[spec.name] = module
+    spec.loader.exec_module(module)
+    return module
+
+
+registry = load_gate_signing_keys()
+
+
+def _secrets() -> list[modal.Secret]:
+    # The launcher attaches the credentials only to a deliberate run: modal
+    # run sends the app's secrets before the entrypoint can refuse. In the
+    # container the environment carries the same values the launcher
+    # passed, so the dependency lists agree.
+    if modal.is_local() and os.environ.get(RUN_OPT_IN) != "1":
+        return []
+    values = {
+        name: os.environ[name]
+        for name in ("HF_TOKEN", registry.UK_GATE_SIGNING_KEY_ENV)
+        if os.environ.get(name)
+    }
+    return [modal.Secret.from_dict(values)] if values else []
+
+
+def _image() -> modal.Image:
+    image = (
+        modal.Image.debian_slim(python_version=PYTHON_VERSION)
+        .apt_install("git", "build-essential", "libhdf5-dev")
+        .pip_install(f"uv=={UV_VERSION}")
+        .env({"UV_LINK_MODE": "copy", "PYTHONDONTWRITEBYTECODE": "1"})
+    )
+    if modal.is_local():
+        # Last, because Modal refuses build steps after a local file.
+        image = image.add_local_file(str(REGISTRY_SOURCE), REGISTRY_REMOTE)
+    return image
+
+
+image = _image()
+app = modal.App(APP_NAME)
+volume = modal.Volume.from_name(VOLUME_NAME, create_if_missing=True)
+
+
+def _sh(argv: list[str], **kwargs) -> None:
+    print("$", " ".join(argv), flush=True)
+    subprocess.run(argv, check=True, **kwargs)
+
+
+@app.function(
+    image=image,
+    volumes={WORK: volume},
+    secrets=_secrets(),
+    cpu=16.0,
+    memory=98304,
+    timeout=10 * 3600,
+)
+def cut(commit: str, label: str, publish: bool, extra: list[str]) -> int:
+    """Clone at ``commit``, sync, and run the cut with its state on the volume."""
+
+    _sh(["git", "clone", "--quiet", REPO_URL, CHECKOUT])
+    _sh(["git", "-C", CHECKOUT, "checkout", "--quiet", commit])
+    env = {**os.environ, "UV_PROJECT_ENVIRONMENT": f"{CHECKOUT}/.venv"}
+    # The sync installs third-party packages and needs no credential; the
+    # runner itself scopes the signing key to the steps that use it.
+    credentials = {"HF_TOKEN", registry.UK_GATE_SIGNING_KEY_ENV}
+    _sh(
+        ["uv", "sync", "--all-packages", "--locked", "--extra", "uk"],
+        cwd=CHECKOUT,
+        env={k: v for k, v in env.items() if k not in credentials},
+    )
+    argv = [
+        f"{CHECKOUT}/.venv/bin/python",
+        "tools/run_uk_cut.py",
+        "all",
+        "--label",
+        label,
+        "--work-dir",
+        WORK,
+        # A volume reports no meaningful free space.
+        "--min-free-gb",
+        "0",
+        *extra,
+    ]
+    if publish:
+        argv.append("--publish")
+    try:
+        completed = subprocess.run(argv, cwd=CHECKOUT, env=env, check=False)
+    finally:
+        volume.commit()
+    return completed.returncode
+
+
+def plan(commit: str, label: str, *, publish: bool = False) -> list[str]:
+    """Check a cut's commit and label, print the plan, and name missing credentials.
+
+    Contacts no Modal service, so planning sends nothing anywhere.
+    """
+
+    if not SHA.match(commit):
+        raise SystemExit("--commit must be a full 40-character sha on main.")
+    if not re.match(r"^[A-Za-z0-9][A-Za-z0-9._-]{0,40}$", label):
+        raise SystemExit("--label must be a short name (letters, digits, . _ -).")
+    on_main = subprocess.run(
+        ["git", "merge-base", "--is-ancestor", commit, "origin/main"],
+        cwd=Path(__file__).resolve().parents[1],
+        check=False,
+    )
+    if on_main.returncode != 0:
+        raise SystemExit(
+            f"{commit} is not on origin/main here (git fetch first); Modal cuts "
+            "build only from main."
+        )
+    missing = [
+        name
+        for name in ("HF_TOKEN", registry.UK_GATE_SIGNING_KEY_ENV)
+        if not os.environ.get(name)
+    ]
+    print(
+        f"cut {label} at {commit[:9]} on Modal; publish={publish}; "
+        f"work dir {VOLUME_NAME}:{WORK}; missing credentials: {missing or 'none'}"
+    )
+    return missing
+
+
+@app.local_entrypoint()
+def main(
+    commit: str,
+    label: str,
+    run: bool = False,
+    publish: bool = False,
+    retry_national: bool = False,
+) -> None:
+    opted_in = os.environ.get(RUN_OPT_IN) == "1"
+    if not run or not opted_in:
+        raise SystemExit(
+            "modal run is only for a deliberate, paid run: set "
+            f"{RUN_OPT_IN}=1 and pass --run. To plan, run "
+            "`python tools/modal_uk_cut.py --commit <sha> --label <label>`, "
+            "which contacts no Modal service."
+            + (
+                f" The credentials in this environment were already sent to "
+                f"Modal ({RUN_OPT_IN}=1); nothing was built."
+                if opted_in
+                else ""
+            )
+        )
+    missing = plan(commit, label, publish=publish)
+    if missing:
+        raise SystemExit(
+            f"give {', '.join(missing)} to this command (VAR=… modal run …), "
+            "not exported to the shell, then --run again."
+        )
+    extra = ["--retry-national"] if retry_national else []
+    code = cut.remote(commit, label, publish, extra)
+    raise SystemExit(code)
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description="Plan a UK cut on Modal.")
+    parser.add_argument("--commit", required=True)
+    parser.add_argument("--label", required=True)
+    parser.add_argument("--publish", action="store_true")
+    options = parser.parse_args()
+    plan(options.commit, options.label, publish=options.publish)
+    print(
+        f"Plan only. To build (paid): {RUN_OPT_IN}=1 modal run --detach "
+        f"tools/modal_uk_cut.py --commit {options.commit} --label "
+        f"{options.label} --run" + (" --publish" if options.publish else "")
+    )
diff --git a/tools/preflight_uk_local_release_candidate.py b/tools/preflight_uk_local_release_candidate.py
index 44a4f24ce1..2e75510cdf 100644
--- a/tools/preflight_uk_local_release_candidate.py
+++ b/tools/preflight_uk_local_release_candidate.py
@@ -36,7 +36,11 @@
 from datetime import date
 from pathlib import Path
 
-SIGNING_KEY_ENV = "MICROCOSM_UK_TERMINAL_GATE_SIGNING_KEY"
+from microcosm.data.gate_signing_keys import (
+    UK_GATE_SIGNING_KEY_ENV,
+    unregistered_gate_signing_key_problem,
+)
+
 PIN_NAMES = ("spine", "ladder", "facts", "manifest")
 RELEASE_BLOCKING = "release_blocking"
 
@@ -60,21 +64,27 @@ def check_env(
 ) -> list[str]:
     env = os.environ if environ is None else environ
     failures: list[str] = []
-    key = env.get(SIGNING_KEY_ENV, "")
+    key = env.get(UK_GATE_SIGNING_KEY_ENV, "")
     if not key.strip():
         failures.append(
-            f"{SIGNING_KEY_ENV} is not set: the gate report cannot be signed."
+            f"{UK_GATE_SIGNING_KEY_ENV} is not set: the gate report cannot be signed."
         )
     else:
         try:
             raw = base64.b64decode(key.strip(), validate=True)
             if len(raw) != 32:
                 failures.append(
-                    f"{SIGNING_KEY_ENV} decodes to {len(raw)} bytes; the gate "
+                    f"{UK_GATE_SIGNING_KEY_ENV} decodes to {len(raw)} bytes; the gate "
                     "battery signs only with exactly 32."
                 )
+            else:
+                problem = unregistered_gate_signing_key_problem(
+                    "uk", raw, purpose="sign"
+                )
+                if problem is not None:
+                    failures.append(f"{UK_GATE_SIGNING_KEY_ENV}: {problem}")
         except Exception:
-            failures.append(f"{SIGNING_KEY_ENV} is not valid base64.")
+            failures.append(f"{UK_GATE_SIGNING_KEY_ENV} is not valid base64.")
     if not pins_path.exists():
         failures.append(f"pins file missing: {pins_path}")
         return failures
diff --git a/tools/run_uk_cut.py b/tools/run_uk_cut.py
new file mode 100644
index 0000000000..cdeca07727
--- /dev/null
+++ b/tools/run_uk_cut.py
@@ -0,0 +1,1906 @@
+"""Build, sign and assemble a Microcosm UK national cut in one resumable command.
+
+A cut used to be five commands run by hand on one machine (spine, national
+calibration, certify, assemble, publish; ``docs/uk-national-release-assembly-runbook-806.md``),
+with inputs gathered from wherever they happened to be. This command runs
+them in order from a clean checkout, with every input fetched and checked
+against the pins the build itself enforces, so anyone with the credentials
+can cut at the policyengine-uk version their checkout locks::
+
+    uv run --no-sync python tools/run_uk_cut.py status  --label sat24
+    uv run --no-sync python tools/run_uk_cut.py fetch
+    uv run --no-sync python tools/run_uk_cut.py preflight --label sat24
+    uv run --no-sync python tools/run_uk_cut.py all --label sat24
+    uv run --no-sync python tools/run_uk_cut.py all --label sat24 --publish
+
+``all`` is resumable: each step first checks whether its outputs already
+exist and verify (the done-check), and skips if so. A step that fails leaves
+its outputs for inspection; nothing here deletes a spine, a calibration run
+or a release directory. Re-run ``all`` after fixing the cause; a failed
+national run is moved aside only with ``--retry-national``.
+
+Outward-facing steps are opt-in. ``--publish`` publishes for inspection
+only, always with ``--no-latest --tag-only``, so the repository's main
+branch and its ``latest-*.json`` pointers never move. Promotion and the
+policyengine.py certification are separate, deliberate calls; this command
+prints them and runs neither.
+
+Credentials come from the environment: ``HF_TOKEN`` (write access to
+``policyengine/populace-uk-private`` and ``policyengine/populace-uk-staging``,
+read access to the input repositories) and
+``MICROCOSM_UK_TERMINAL_GATE_SIGNING_KEY``, which must be registered in
+``microcosm.data.gate_signing_keys``. See ``docs/uk-cut-anyone.md``.
+"""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+import os
+import platform
+import shlex
+import shutil
+import subprocess
+import sys
+import tempfile
+import time
+import zipfile
+from collections.abc import Callable, Mapping, Sequence
+from dataclasses import dataclass, field
+from datetime import UTC, date, datetime
+from pathlib import Path
+from typing import Any, Protocol
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+UK_DIR = REPO_ROOT / "packages/microcosm-build/src/microcosm/build/uk"
+CUT_INPUTS = REPO_ROOT / "tools/uk_cut_inputs.json"
+DEFAULT_WORK_DIR = Path("~/microcosm-uk-work").expanduser()
+RELEASE_ID = "microcosm-uk-2024-25-national"
+CANDIDATE_NAME = "microcosm_uk_2024_25"
+SPINE_NAME = "uk_frs_spine_2024_25.h5"
+PUBLISH_REPO = "policyengine/populace-uk-private"
+TELEMETRY_REPO = "policyengine/populace-uk-staging"
+STAGING_BRANCH = f"release-staging/{RELEASE_ID}"
+
+
+#: The steps that sign gate reports (spine, national, certify) or verify them
+#: (assembly and publication). Every other step and check runs without the key.
+KEY_STEPS = frozenset(
+    {"spine", "national", "certify", "assemble", "publish-preflight", "publish"}
+)
+
+
+class CutError(RuntimeError):
+    """A refusal the operator must act on; the message says how."""
+
+
+def step_environment(
+    step: str, *, environ: Mapping[str, str] | None = None
+) -> dict[str, str]:
+    """The environment for one step: the signing key only where it is used."""
+
+    from microcosm.data.gate_signing_keys import UK_GATE_SIGNING_KEY_ENV
+
+    env = dict(os.environ if environ is None else environ)
+    if step not in KEY_STEPS:
+        env.pop(UK_GATE_SIGNING_KEY_ENV, None)
+    return env
+
+
+# --------------------------------------------------------------------------- #
+# Pins and input sources                                                        #
+# --------------------------------------------------------------------------- #
+
+
+@dataclass(frozen=True)
+class PinnedFile:
+    """One input file and the digest the build checks it against."""
+
+    name: str
+    sha256: str
+    size_bytes: int | None = None
+
+
+@dataclass(frozen=True)
+class InputSource:
+    """Where one group of input files comes from (``tools/uk_cut_inputs.json``)."""
+
+    key: str
+    kind: str
+    directory: str
+    files: tuple[PinnedFile, ...]
+    repo_id: str | None = None
+    repo_type: str | None = None
+    revision: str | None = None
+    filename: str | None = None
+    path_in_repo: str | None = None
+    archive_sha256: str | None = None
+    url: str | None = None
+    upload_note: str | None = None
+
+
+def _sha256_file(path: Path) -> str:
+    digest = hashlib.sha256()
+    with path.open("rb") as handle:
+        for chunk in iter(lambda: handle.read(1 << 22), b""):
+            digest.update(chunk)
+    return digest.hexdigest()
+
+
+def _walk_artifacts(node: object):
+    if isinstance(node, Mapping):
+        if "sha256" in node and (node.get("filename") or node.get("locator")):
+            yield node
+        for value in node.values():
+            yield from _walk_artifacts(value)
+    elif isinstance(node, list):
+        for value in node:
+            yield from _walk_artifacts(value)
+
+
+def committed_source_pins(uk_dir: Path = UK_DIR) -> dict[str, dict[str, Any]]:
+    """Every file pin in ``source_stages.json``, by file name.
+
+    Tabs are named by ``filename`` or ``locator``; the HMRC workbook by its
+    URL, whose last segment is its file name. A name pinned twice must carry
+    the same digest.
+    """
+
+    stages = json.loads((uk_dir / "source_stages.json").read_text())
+    pins: dict[str, dict[str, Any]] = {}
+    for artifact in _walk_artifacts(stages):
+        raw = str(artifact.get("filename") or artifact.get("locator"))
+        name = raw.rsplit("/", 1)[-1]
+        pin = {
+            "sha256": str(artifact["sha256"]),
+            "size_bytes": artifact.get("size_bytes"),
+            "url": raw if raw.startswith("https://") else None,
+        }
+        previous = pins.get(name)
+        if previous is not None and previous["sha256"] != pin["sha256"]:
+            raise CutError(f"source_stages.json pins {name} to two digests.")
+        pins[name] = previous or pin
+    return pins
+
+
+def _gate_reference_identity(uk_dir: Path) -> Mapping[str, str]:
+    gates = json.loads((uk_dir / "gates.json").read_text())
+    entries = gates["gates"] if isinstance(gates, Mapping) else gates
+    for entry in entries:
+        if entry.get("gate") == "input_mass_parity":
+            params = entry["parameters"]
+            return params["reference_registry"][params["reference"]]["identity"]
+    raise CutError("gates.json declares no input_mass_parity reference identity.")
+
+
+#: The ``*_pin`` selectors a source may carry, each naming the committed pin
+#: a field is read from. Any other ``*_pin`` is refused, never ignored.
+PIN_SELECTORS: Mapping[str, frozenset[str]] = {
+    "archive_sha256_pin": frozenset({"frs_release"}),
+    "revision_pin": frozenset({"gates:input_mass_parity"}),
+    "path_in_repo_pin": frozenset({"chronicle_feed"}),
+}
+
+
+def _check_pin_selectors(raw: Mapping[str, Any]) -> None:
+    for name, value in raw.items():
+        if not name.endswith("_pin"):
+            continue
+        if name == "url_pin":
+            known = value in {f"source_stages:{member}" for member in raw["members"]}
+        else:
+            known = value in PIN_SELECTORS.get(name, frozenset())
+        if not known:
+            raise CutError(f"{raw['key']}: unknown pin selector {name}={value!r}.")
+
+
+def load_input_sources(
+    manifest_path: Path = CUT_INPUTS, uk_dir: Path = UK_DIR
+) -> list[InputSource]:
+    """Resolve each declared source to files and the digests the build checks."""
+
+    manifest = json.loads(manifest_path.read_text())
+    if manifest.get("version") != 1:
+        raise CutError(f"{manifest_path}: version must be 1.")
+    stage_pins = committed_source_pins(uk_dir)
+    feed = json.loads((uk_dir / "chronicle_feed.json").read_text())
+    frs_release = json.loads((uk_dir / "frs_release.json").read_text())
+    reference = _gate_reference_identity(uk_dir)
+    extra = manifest.get("file_pins", {})
+    sources: list[InputSource] = []
+    for raw in manifest["sources"]:
+        _check_pin_selectors(raw)
+        key = raw["key"]
+        revision = raw.get("revision")
+        archive_sha256 = raw.get("archive_sha256")
+        path_in_repo = raw.get("path_in_repo")
+        if raw.get("path_in_repo_pin") == "chronicle_feed":
+            # The hosted artifact sits under its Chronicle commit, so the
+            # path follows every re-pin of chronicle_feed.json.
+            path_in_repo = f"{path_in_repo}/{feed['source_commit']}"
+        url = None
+        files: list[PinnedFile] = []
+        for member in raw["members"]:
+            if key == "chronicle_uk":
+                digest = {
+                    "manifest.json": feed["manifest_sha256"],
+                    "consumer_facts.jsonl": feed["facts_sha256"],
+                }[member]
+                files.append(PinnedFile(member, digest))
+            elif key == "incumbent_efrs":
+                if member != reference["filename"]:
+                    raise CutError(
+                        f"incumbent member {member} is not the gate's "
+                        f"reference {reference['filename']}."
+                    )
+                files.append(PinnedFile(member, reference["sha256"]))
+            elif member in extra:
+                files.append(PinnedFile(member, extra[member]["sha256"]))
+            elif member in stage_pins:
+                pin = stage_pins[member]
+                files.append(PinnedFile(member, pin["sha256"], pin["size_bytes"]))
+                url = url or pin["url"]
+            else:
+                raise CutError(
+                    f"{key}: no committed pin for {member}; every input must be "
+                    "pinned in source_stages.json, chronicle_feed.json or gates.json."
+                )
+        if raw.get("archive_sha256_pin") == "frs_release":
+            acquisition = frs_release["acquisition"]
+            archive_sha256 = acquisition["zip_sha256"]
+            if acquisition["huggingface_revision"] != revision:
+                raise CutError(
+                    "frs_2024_25 revision disagrees with uk/frs_release.json."
+                )
+        if raw.get("revision_pin") == "gates:input_mass_parity":
+            revision = reference["revision"]
+        if raw["kind"] == "url" and not url:
+            raise CutError(f"{key}: the pin carries no https URL.")
+        sources.append(
+            InputSource(
+                key=key,
+                kind=raw["kind"],
+                directory=raw["directory"],
+                files=tuple(files),
+                repo_id=raw.get("repo_id"),
+                repo_type=raw.get("repo_type"),
+                revision=revision,
+                filename=raw.get("filename"),
+                path_in_repo=path_in_repo,
+                archive_sha256=archive_sha256,
+                url=url if raw["kind"] == "url" else None,
+                upload_note=raw.get("upload_note"),
+            )
+        )
+    return sources
+
+
+# --------------------------------------------------------------------------- #
+# Fetching                                                                      #
+# --------------------------------------------------------------------------- #
+
+
+class Downloader(Protocol):
+    def hf_file(
+        self,
+        *,
+        repo_id: str,
+        repo_type: str,
+        filename: str,
+        revision: str | None,
+        local_dir: Path | None = None,
+    ) -> Path: ...
+
+    def url(self, url: str, dest: Path) -> Path: ...
+
+
+class HubDownloader:
+    """Download through the Hugging Face cache (resumable, deduplicated)."""
+
+    def __init__(self, cache_dir: Path) -> None:
+        self.cache_dir = cache_dir
+
+    def hf_file(
+        self,
+        *,
+        repo_id: str,
+        repo_type: str,
+        filename: str,
+        revision: str | None,
+        local_dir: Path | None = None,
+    ) -> Path:
+        """Through the cache, or straight into ``local_dir`` for a file that
+        will be moved into place (no second copy of a multi-gigabyte input)."""
+
+        from huggingface_hub import hf_hub_download
+
+        location = (
+            {"local_dir": str(local_dir)}
+            if local_dir is not None
+            else {"cache_dir": str(self.cache_dir)}
+        )
+        return Path(
+            hf_hub_download(
+                repo_id, filename, repo_type=repo_type, revision=revision, **location
+            )
+        )
+
+    def url(self, url: str, dest: Path) -> Path:
+        import urllib.request
+
+        tmp = dest.with_name(dest.name + ".partial")
+        with (
+            urllib.request.urlopen(url, timeout=120) as response,
+            tmp.open("wb") as handle,
+        ):
+            shutil.copyfileobj(response, handle)
+        tmp.replace(dest)
+        return dest
+
+
+class VerifiedFiles:
+    """Remembers files already hashed, keyed by inode, size, mtime and ctime.
+
+    A file is re-hashed when any of these changes, or always with
+    ``reverify``. ``ctime`` moves on every write and on every ``utime`` call
+    and cannot be set back from user space, so replacing a file's bytes and
+    restoring its mtime still invalidates the entry: a cache entry never
+    vouches for bytes it did not hash.
+    """
+
+    def __init__(self, path: Path, *, reverify: bool = False) -> None:
+        self.path = path
+        self.reverify = reverify
+        try:
+            self.entries: dict[str, dict[str, Any]] = json.loads(path.read_text())
+        except (FileNotFoundError, json.JSONDecodeError):
+            self.entries = {}
+
+    @staticmethod
+    def _identity(stat: os.stat_result) -> dict[str, int]:
+        return {
+            "inode": stat.st_ino,
+            "size": stat.st_size,
+            "mtime_ns": stat.st_mtime_ns,
+            "ctime_ns": stat.st_ctime_ns,
+        }
+
+    def matches(self, file: Path, pin: PinnedFile) -> bool:
+        if not file.is_file():
+            return False
+        stat = file.stat()
+        if pin.size_bytes is not None and stat.st_size != pin.size_bytes:
+            return False
+        key = str(file.resolve())
+        identity = self._identity(stat)
+        cached = self.entries.get(key)
+        if (
+            not self.reverify
+            and cached is not None
+            and all(cached.get(field) == value for field, value in identity.items())
+        ):
+            return cached.get("sha256") == pin.sha256
+        digest = _sha256_file(file)
+        self.entries[key] = {**identity, "sha256": digest}
+        return digest == pin.sha256
+
+    def save(self) -> None:
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        tmp = self.path.with_name(self.path.name + ".tmp")
+        tmp.write_text(json.dumps(self.entries, indent=2, sort_keys=True))
+        tmp.replace(self.path)
+
+
+def _place(source: Path, dest: Path, pin: PinnedFile, *, move: bool = False) -> None:
+    """Verify, then install at ``dest`` by an atomic rename.
+
+    ``move`` installs ``source`` itself (a download staged beside ``dest``);
+    otherwise a copy is verified, so a shared cache entry is never moved.
+    A file that misses its pin is deleted, never installed.
+    """
+
+    dest.parent.mkdir(parents=True, exist_ok=True)
+    tmp = dest.with_name(dest.name + ".partial")
+    if move:
+        try:
+            os.replace(source, tmp)
+        except OSError:  # another filesystem: fall back to a copy
+            shutil.copyfile(source, tmp)
+            source.unlink(missing_ok=True)
+    else:
+        shutil.copyfile(source, tmp)
+    digest = _sha256_file(tmp)
+    if digest != pin.sha256:
+        tmp.unlink()
+        raise CutError(
+            f"{source} hashes to {digest}, not the pinned {pin.sha256} for "
+            f"{pin.name}; it was not installed."
+        )
+    tmp.replace(dest)
+
+
+def _extract_member(archive: Path, pin: PinnedFile, dest: Path) -> None:
+    with zipfile.ZipFile(archive) as bundle:
+        matches = [
+            info
+            for info in bundle.infolist()
+            if Path(info.filename).name == pin.name
+            and not info.filename.startswith("__MACOSX")
+            and not info.is_dir()
+        ]
+        if len(matches) != 1:
+            raise CutError(
+                f"{archive.name} holds {len(matches)} members named {pin.name}; "
+                "expected exactly one."
+            )
+        dest.parent.mkdir(parents=True, exist_ok=True)
+        tmp = dest.with_name(dest.name + ".partial")
+        digest = hashlib.sha256()
+        with bundle.open(matches[0]) as member, tmp.open("wb") as handle:
+            for chunk in iter(lambda: member.read(1 << 22), b""):
+                digest.update(chunk)
+                handle.write(chunk)
+    if digest.hexdigest() != pin.sha256:
+        tmp.unlink()
+        raise CutError(
+            f"{archive.name}:{pin.name} hashes to {digest.hexdigest()}, not the "
+            f"pinned {pin.sha256}; it was not installed."
+        )
+    tmp.replace(dest)
+
+
+@dataclass
+class FetchResult:
+    key: str
+    status: str  # present | fetched | missing | refused
+    detail: str = ""
+    files: dict[str, str] = field(default_factory=dict)
+
+
+def fetch_inputs(
+    sources: Sequence[InputSource],
+    inputs_dir: Path,
+    *,
+    downloader: Downloader,
+    reverify: bool = False,
+    only: set[str] | None = None,
+) -> list[FetchResult]:
+    """Install every pinned input under ``inputs_dir`` and verify it.
+
+    Idempotent: a file already present with its pinned digest is left alone.
+    Nothing unverified is ever left at an input's final path.
+    """
+
+    verified = VerifiedFiles(inputs_dir / ".verified.json", reverify=reverify)
+    results: list[FetchResult] = []
+    try:
+        for source in sources:
+            if only and source.key not in only:
+                continue
+            target = inputs_dir / source.directory
+            paths = {pin.name: target / pin.name for pin in source.files}
+            if all(verified.matches(paths[pin.name], pin) for pin in source.files):
+                results.append(
+                    FetchResult(
+                        source.key,
+                        "present",
+                        files={n: str(p) for n, p in paths.items()},
+                    )
+                )
+                continue
+            try:
+                _fetch_source(source, paths, downloader=downloader, verified=verified)
+            except CutError as error:
+                results.append(FetchResult(source.key, "refused", str(error)))
+                continue
+            except Exception as error:  # the Hub's 404/401, a dropped connection
+                status = "missing" if _looks_missing(error) else "refused"
+                detail = f"{type(error).__name__}: {error}"
+                if status == "missing" and source.upload_note:
+                    detail += f" | needs upload: {source.upload_note}"
+                results.append(FetchResult(source.key, status, detail))
+                continue
+            results.append(
+                FetchResult(
+                    source.key, "fetched", files={n: str(p) for n, p in paths.items()}
+                )
+            )
+    finally:
+        verified.save()
+    return results
+
+
+def _looks_missing(error: Exception) -> bool:
+    name = type(error).__name__
+    return name in {"EntryNotFoundError", "RemoteEntryNotFoundError"} or (
+        "404" in str(error)
+    )
+
+
+def _fetch_source(
+    source: InputSource,
+    paths: Mapping[str, Path],
+    *,
+    downloader: Downloader,
+    verified: VerifiedFiles,
+) -> None:
+    pending = [
+        pin for pin in source.files if not verified.matches(paths[pin.name], pin)
+    ]
+    if source.kind == "hf_zip_members":
+        archive = downloader.hf_file(
+            repo_id=source.repo_id,
+            repo_type=source.repo_type,
+            filename=source.filename,
+            revision=source.revision,
+        )
+        if source.archive_sha256 is not None:
+            digest = _sha256_file(archive)
+            if digest != source.archive_sha256:
+                raise CutError(
+                    f"{source.filename} hashes to {digest}, not the pinned "
+                    f"{source.archive_sha256}."
+                )
+        for pin in pending:
+            _extract_member(archive, pin, paths[pin.name])
+    elif source.kind == "hf_files":
+        for pin in pending:
+            name = (
+                f"{source.path_in_repo}/{pin.name}" if source.path_in_repo else pin.name
+            )
+            local = downloader.hf_file(
+                repo_id=source.repo_id,
+                repo_type=source.repo_type,
+                filename=name,
+                revision=source.revision,
+                local_dir=paths[pin.name].parent / ".download",
+            )
+            _place(local, paths[pin.name], pin, move=True)
+    elif source.kind == "url":
+        for pin in pending:
+            with tempfile.TemporaryDirectory() as scratch:
+                local = downloader.url(source.url, Path(scratch) / pin.name)
+                _place(local, paths[pin.name], pin, move=True)
+    else:
+        raise CutError(f"{source.key}: unknown source kind {source.kind!r}.")
+    for pin in pending:
+        if not verified.matches(paths[pin.name], pin):
+            raise CutError(f"{paths[pin.name]} did not verify after install.")
+
+
+# --------------------------------------------------------------------------- #
+# The cut's layout                                                              #
+# --------------------------------------------------------------------------- #
+
+
+@dataclass(frozen=True)
+class CutPaths:
+    """Every path a cut reads or writes, derived from the work dir, label and commit."""
+
+    work_dir: Path
+    label: str
+    commit: str
+
+    @property
+    def inputs(self) -> Path:
+        return self.work_dir / "inputs"
+
+    @property
+    def cut(self) -> Path:
+        return self.work_dir / "cuts" / f"{self.label}-{self.commit[:9]}"
+
+    @property
+    def spine_dir(self) -> Path:
+        return self.cut / "spine"
+
+    @property
+    def spine_h5(self) -> Path:
+        return self.spine_dir / SPINE_NAME
+
+    @property
+    def run_dir(self) -> Path:
+        return self.cut / "national"
+
+    @property
+    def candidate_h5(self) -> Path:
+        return self.run_dir / f"{CANDIDATE_NAME}.h5"
+
+    @property
+    def release_parent(self) -> Path:
+        return self.cut / "release"
+
+    @property
+    def release_dir(self) -> Path:
+        return self.release_parent / "releases" / RELEASE_ID
+
+    @property
+    def logs(self) -> Path:
+        return self.cut / "logs"
+
+    @property
+    def diagnostics(self) -> Path:
+        return self.cut / "diagnostics"
+
+    @property
+    def state(self) -> Path:
+        return self.cut / "state.json"
+
+    @property
+    def receipt(self) -> Path:
+        return self.cut / "cut_receipt.json"
+
+    def input_file(self, directory: str, name: str) -> Path:
+        return self.inputs / directory / name
+
+
+def spine_argv(paths: CutPaths, *, python: str, staging_local_only: bool) -> list[str]:
+    """The spine command, every input taken from the verified inputs dir."""
+
+    def tab(directory: str, name: str) -> str:
+        return str(paths.input_file(directory, name))
+
+    argv = [
+        python,
+        str(REPO_ROOT / "tools/build_uk_frs_spine.py"),
+        "--frs-raw-dir", str(paths.inputs / "frs_2024_25"),
+        "--spi-tab", tab("spi_2022_23", "put2223uk.tab"),
+        "--hmrc-ods", tab("hmrc", "Collated_Tables_3_1_to_3_11_2324.ods"),
+        "--was-tab", tab("was_round_8", "was_round_8_hhold_eul_may_2025_230525.tab"),
+        "--was-person-tab",
+        tab("was_round_8", "was_round_8_person_eul_may_2025_230525.tab"),
+        "--nts-household-tab", tab("nts_2002_2024", "household_eul_2002-2024.tab"),
+        "--nts-individual-tab", tab("nts_2002_2024", "individual_eul_2002-2024.tab"),
+        "--nts-trip-tab", tab("nts_2002_2024", "trip_eul_2002-2024.tab"),
+        "--nts-stage-tab", tab("nts_2002_2024", "stage_eul_2002-2024.tab"),
+        "--nts-ticket-tab", tab("nts_2002_2024", "ticket_eul_2002-2024.tab"),
+        "--lcfs-hh-tab", tab("lcfs_2024_25", "dvhh_uk_anon_v3_2024.tab"),
+        "--lcfs-person-tab", tab("lcfs_2024_25", "dvper_uk_anon_2024.tab"),
+        "--etb-tab", tab("etb_1977_2024", "householdv2_1977-2024.tab"),
+        "--release-candidate",
+        "--spine-h5", str(paths.spine_h5),
+    ]  # fmt: skip
+    if staging_local_only:
+        argv.append("--staging-local-only")
+    return argv
+
+
+def national_argv(
+    paths: CutPaths,
+    *,
+    python: str,
+    spine_sha256: str,
+    sources: Mapping[str, InputSource],
+    dry_run: bool,
+    logbook_prev_row_digest: str | None = None,
+) -> list[str]:
+    chronicle = {pin.name: pin.sha256 for pin in sources["chronicle_uk"].files}
+    incumbent = sources["incumbent_efrs"].files[0]
+    argv = [
+        python,
+        str(REPO_ROOT / "tools/build_uk_full.py"),
+        "--release-role", "national",
+        "--input-h5", str(paths.spine_h5),
+        "--input-sha256", spine_sha256,
+        "--ledger-facts", str(paths.inputs / "chronicle_uk"),
+        "--ledger-facts-sha256", chronicle["consumer_facts.jsonl"],
+        "--ledger-manifest-sha256", chronicle["manifest.json"],
+        "--incumbent-h5", str(paths.input_file("incumbent", incumbent.name)),
+        "--incumbent-sha256", incumbent.sha256,
+        # The build otherwise submits its graph to the public Orrery whenever
+        # staging is remote; the graph files stay in the run directory.
+        "--no-publish-orrery",
+        "--out", str(paths.run_dir),
+    ]  # fmt: skip
+    if logbook_prev_row_digest:
+        argv += ["--logbook-prev-row-digest", logbook_prev_row_digest]
+    if dry_run:
+        argv.append("--dry-run")
+    return argv
+
+
+def score_argv(
+    paths: CutPaths, *, python: str, candidate_sha256: str, sources: Mapping
+) -> list[str]:
+    incumbent = sources["incumbent_efrs"].files[0]
+    return [
+        python,
+        str(REPO_ROOT / "tools/score_uk_national_candidate.py"),
+        "--candidate-h5", str(paths.candidate_h5),
+        "--candidate-sha256", candidate_sha256,
+        "--incumbent-h5", str(paths.input_file("incumbent", incumbent.name)),
+        "--incumbent-sha256", incumbent.sha256,
+        "--registry-json", str(paths.run_dir / "national_target_registry.json"),
+        "--band-edge-registry-json",
+        str(paths.run_dir / "national_contract_registry.json"),
+        "--output-json", str(paths.run_dir / "score_vs_incumbent.json"),
+    ]  # fmt: skip
+
+
+def certify_argv(
+    paths: CutPaths,
+    *,
+    python: str,
+    candidate_sha256: str,
+    spine_sha256: str,
+    sources: Mapping,
+    logbook_prev_row_digest: str | None = None,
+) -> list[str]:
+    chronicle = {pin.name: pin.sha256 for pin in sources["chronicle_uk"].files}
+    reference = sources["input_mass_reference"].files[0]
+    argv = [
+        python,
+        str(REPO_ROOT / "tools/certify_uk_release_cut.py"),
+        "--candidate-h5", str(paths.candidate_h5),
+        "--candidate-sha256", candidate_sha256,
+        "--candidate-name", CANDIDATE_NAME,
+        "--spine-h5", str(paths.spine_h5),
+        "--spine-sha256", spine_sha256,
+        "--diagnostics-json", str(paths.run_dir / "calibration_diagnostics.json"),
+        "--build-record-json", str(paths.run_dir / "build_record.json"),
+        "--seam-gate-report",
+        str(paths.run_dir / f"{CANDIDATE_NAME}.terminal_gates.json"),
+        "--ledger-facts", str(paths.inputs / "chronicle_uk"),
+        "--ledger-facts-sha256", chronicle["consumer_facts.jsonl"],
+        "--ledger-manifest-sha256", chronicle["manifest.json"],
+        "--input-mass-reference",
+        str(paths.input_file("input_mass_reference", reference.name)),
+        "--score-receipt", str(paths.run_dir / "score_vs_incumbent.json"),
+        "--release-id", RELEASE_ID,
+    ]  # fmt: skip
+    if logbook_prev_row_digest:
+        argv += ["--logbook-prev-row-digest", logbook_prev_row_digest]
+    return argv
+
+
+def assemble_argv(paths: CutPaths, *, python: str) -> list[str]:
+    return [
+        python,
+        str(REPO_ROOT / "tools/assemble_uk_release_dir.py"),
+        "--candidate-h5", str(paths.candidate_h5),
+        "--spine-h5", str(paths.spine_h5),
+        "--certification-json",
+        str(paths.run_dir / f"{CANDIDATE_NAME}.release_certification.json"),
+        "--build-record-json", str(paths.run_dir / "build_record.json"),
+        "--diagnostics-json", str(paths.run_dir / "calibration_diagnostics.json"),
+        "--seam-gate-report",
+        str(paths.run_dir / f"{CANDIDATE_NAME}.terminal_gates.json"),
+        "--release-cut-gate-json",
+        str(paths.run_dir / f"{CANDIDATE_NAME}.release_cut_gates.json"),
+        "--score-receipt", str(paths.run_dir / "score_vs_incumbent.json"),
+        "--out-dir", "releases",
+    ]  # fmt: skip
+
+
+def publish_argv(
+    paths: CutPaths, *, python: str, tag: str, preflight_only: bool
+) -> list[str]:
+    """Inspection publication: never the default line, never main's files."""
+
+    argv = [
+        python, "-m", "microcosm.data.publish_cli", str(paths.release_dir),
+        "--repo-id", PUBLISH_REPO,
+        "--artifact-root", str(paths.run_dir),
+        "--no-latest", "--tag-only",
+        "--tag-name", tag,
+    ]  # fmt: skip
+    if preflight_only:
+        argv.append("--preflight-only")
+    return argv
+
+
+def promote_command(paths: CutPaths, tag: str) -> str:
+    return shlex.join(
+        [
+            "uv", "run", "--no-sync", "python", "-m", "microcosm.data.publish_cli",
+            str(paths.release_dir), "--repo-id", PUBLISH_REPO,
+            "--artifact-root", str(paths.run_dir),
+            "--promote-line", "national", "--tag-name", tag,
+        ]
+    )  # fmt: skip
+
+
+# --------------------------------------------------------------------------- #
+# Done-checks                                                                   #
+# --------------------------------------------------------------------------- #
+
+
+def _read_json(path: Path) -> dict[str, Any] | None:
+    try:
+        value = json.loads(path.read_text())
+    except (FileNotFoundError, json.JSONDecodeError):
+        return None
+    return value if isinstance(value, dict) else None
+
+
+def spine_sha256(paths: CutPaths) -> str | None:
+    sidecar = paths.spine_h5.with_name(paths.spine_h5.name + ".sha256")
+    try:
+        return sidecar.read_text().split()[0]
+    except (FileNotFoundError, IndexError):
+        return None
+
+
+def spine_done(paths: CutPaths) -> tuple[bool, str]:
+    """A complete spine: H5, sidecars, matching digest, shippable gate report."""
+
+    h5 = paths.spine_h5
+    if not h5.exists():
+        return False, "no spine yet"
+    recorded = spine_sha256(paths)
+    for suffix in (".build.json", ".spine_gates.json"):
+        if not h5.with_suffix(suffix).exists():
+            return False, f"spine sidecar {h5.with_suffix(suffix).name} is missing"
+    if recorded is None:
+        return False, "spine .sha256 sidecar is missing"
+    if _sha256_file(h5) != recorded:
+        return False, "spine H5 does not match its .sha256 sidecar"
+    gates = _read_json(h5.with_suffix(".spine_gates.json")) or {}
+    if gates.get("shippable") is not True:
+        return False, "spine gate report is not shippable"
+    return True, f"spine {recorded}"
+
+
+def national_done(paths: CutPaths) -> tuple[bool, str]:
+    record = _read_json(paths.run_dir / "build_record.json")
+    if record is None:
+        return False, "no build_record.json"
+    for name in (
+        f"{CANDIDATE_NAME}.h5",
+        "calibration_diagnostics.json",
+        f"{CANDIDATE_NAME}.terminal_gates.json",
+        "national_target_registry.json",
+        "national_contract_registry.json",
+    ):
+        if not (paths.run_dir / name).exists():
+            return False, f"{name} is missing"
+    expected = (record.get("artifacts") or {}).get("staging_h5", {}).get("sha256")
+    if not expected or _sha256_file(paths.candidate_h5) != expected:
+        return False, "candidate H5 does not match build_record.json"
+    return True, f"candidate {expected}"
+
+
+def candidate_sha256(paths: CutPaths) -> str:
+    record = _read_json(paths.run_dir / "build_record.json") or {}
+    return str(record["artifacts"]["staging_h5"]["sha256"])
+
+
+def score_done(paths: CutPaths) -> tuple[bool, str]:
+    """The fields the certifier reads: the scored candidate and the verdict."""
+
+    receipt = _read_json(paths.run_dir / "score_vs_incumbent.json")
+    if receipt is None:
+        return False, "no score receipt"
+    scored = ((receipt.get("artifacts") or {}).get("candidate") or {}).get("sha256")
+    if scored != candidate_sha256(paths):
+        return False, "score receipt names another candidate"
+    verdict = (receipt.get("evaluation") or {}).get("verdict")
+    if verdict != "passed":
+        return False, f"score verdict is {verdict!r}"
+    return True, "score passed"
+
+
+def certify_done(paths: CutPaths) -> tuple[bool, str]:
+    cert = _read_json(paths.run_dir / f"{CANDIDATE_NAME}.release_certification.json")
+    if cert is None:
+        return False, "no release certification"
+    if cert.get("shippable") is not True:
+        return False, "certification is not shippable"
+    if (cert.get("candidate") or {}).get("sha256") != candidate_sha256(paths):
+        return False, "certification names another candidate"
+    return True, "certified shippable"
+
+
+def assemble_done(paths: CutPaths) -> tuple[bool, str]:
+    manifest = paths.release_dir / "release_manifest.json"
+    summary = _read_json(paths.cut / "assemble_summary.json")
+    if not manifest.exists():
+        return False, "no release directory"
+    if summary is None or not summary.get("tag"):
+        return False, "release directory exists but its assembly summary is missing"
+    return True, f"assembled {summary['tag']}"
+
+
+# --------------------------------------------------------------------------- #
+# Preflight                                                                     #
+# --------------------------------------------------------------------------- #
+
+
+@dataclass
+class Check:
+    name: str
+    ok: bool
+    detail: str
+    blocking: bool = True
+
+
+def _git(*argv: str, cwd: Path = REPO_ROOT) -> str:
+    return subprocess.check_output(["git", *argv], cwd=cwd, text=True).strip()
+
+
+def git_checks(*, allow_off_main: str | None) -> list[Check]:
+    checks = []
+    dirty = _git("status", "--porcelain", "--untracked-files=no")
+    checks.append(Check("clean checkout", not dirty, dirty or "clean"))
+    head = _git("rev-parse", "HEAD")
+    subprocess.run(
+        ["git", "fetch", "--quiet", "origin", "main"], cwd=REPO_ROOT, check=False
+    )
+    on_main = (
+        subprocess.run(
+            ["git", "merge-base", "--is-ancestor", head, "origin/main"],
+            cwd=REPO_ROOT,
+            check=False,
+        ).returncode
+        == 0
+    )
+    if on_main:
+        checks.append(Check("commit on origin/main", True, head))
+    else:
+        pushed = bool(_git("branch", "-r", "--contains", head))
+        checks.append(
+            Check(
+                "commit on origin/main",
+                bool(allow_off_main) and pushed,
+                (
+                    f"{head} is not on origin/main"
+                    + (
+                        f"; allowed ({allow_off_main})"
+                        if allow_off_main and pushed
+                        else "; build from main, or pass --allow-off-main "
+                        "'<who agreed and why>' for a pushed commit"
+                    )
+                ),
+            )
+        )
+    return checks
+
+
+def environment_checks() -> list[Check]:
+    checks = []
+    import microcosm.build as build_package
+
+    location = Path(build_package.__file__).resolve()
+    checks.append(
+        Check(
+            "env built from this checkout",
+            REPO_ROOT in location.parents,
+            f"microcosm.build from {location}",
+        )
+    )
+    try:
+        from microcosm.build.uk_runtime.hmrc_uprating import (
+            assert_installed_engine_is_pinned,
+        )
+
+        version = assert_installed_engine_is_pinned()
+        checks.append(Check("policyengine-uk pinned", True, str(version)))
+    except Exception as error:
+        checks.append(Check("policyengine-uk pinned", False, str(error)))
+    return checks
+
+
+def cut_signed_reports(paths: CutPaths) -> list[Path]:
+    """The signed reports of the steps this cut has finished, in step order.
+
+    A step's report counts only once the step's done-check passes, so an
+    unfinished attempt about to be moved aside (``--retry-spine``,
+    ``--retry-national``) never binds the key. These are the reports the
+    assembler collects.
+    """
+
+    reports: list[Path] = []
+    if not spine_done(paths)[0]:
+        return reports
+    reports.append(paths.spine_h5.with_suffix(".spine_gates.json"))
+    if not national_done(paths)[0]:
+        return reports
+    reports.append(paths.run_dir / f"{CANDIDATE_NAME}.terminal_gates.json")
+    if certify_done(paths)[0]:
+        reports += [
+            paths.run_dir / f"{CANDIDATE_NAME}.release_cut_gates.json",
+            paths.run_dir / f"{CANDIDATE_NAME}.release_certification.json",
+        ]
+    return reports
+
+
+def signed_report_fingerprints(reports: Sequence[Path]) -> dict[str, str]:
+    """Each signed report's ``attestation.signing_key_sha256``, by file name.
+
+    An unsigned report (no attestation, or a null fingerprint) is left out.
+    """
+
+    found: dict[str, str] = {}
+    for report in reports:
+        payload = _read_json(report)
+        if payload is None:
+            raise CutError(f"{report} is not a readable JSON report.")
+        fingerprint = (payload.get("attestation") or {}).get("signing_key_sha256")
+        if fingerprint:
+            found[report.name] = str(fingerprint)
+    return found
+
+
+def reports_signing_key(reports: Sequence[Path]) -> str | None:
+    """The fingerprint of the one key that signed these reports, if any."""
+
+    fingerprints = signed_report_fingerprints(reports)
+    signers = set(fingerprints.values())
+    if len(signers) > 1:
+        raise CutError(
+            "this cut's reports were signed by more than one key "
+            f"({fingerprints}); certification verifies every part with one "
+            "key, so start a fresh cut with a new --label."
+        )
+    return signers.pop() if signers else None
+
+
+def cut_signing_key(paths: CutPaths) -> str | None:
+    """The fingerprint of the one key that signed this cut so far, if any."""
+
+    return reports_signing_key(cut_signed_reports(paths))
+
+
+def signing_key_check(
+    *, paths: CutPaths | None = None, environ: Mapping[str, str] | None = None
+) -> Check:
+    """The key in the environment is registered and is this cut's signer.
+
+    HMAC verification needs the secret that signed, and certification
+    verifies the spine and seam reports with the one key in the environment,
+    so a cut resumes only under the key its reports carry. Once certified,
+    the remaining steps only verify, so a signer retired since then still
+    finishes the cut.
+    """
+
+    from microcosm.data.gate_signing_keys import (
+        UK_GATE_SIGNING_KEY_ENV,
+        GateSigningKeyError,
+        decode_gate_signing_key,
+        gate_signing_key_fingerprint,
+        registered_gate_signing_key,
+        require_registered_gate_signing_key,
+    )
+
+    environ = os.environ if environ is None else environ
+    try:
+        reports = cut_signed_reports(paths) if paths is not None else []
+        signer = reports_signing_key(reports)
+    except CutError as error:
+        return Check("signing key registered", False, str(error))
+    certified = any(r.name.endswith(".release_certification.json") for r in reports)
+    try:
+        key = decode_gate_signing_key(
+            environ.get(UK_GATE_SIGNING_KEY_ENV), env=UK_GATE_SIGNING_KEY_ENV
+        )
+        require_registered_gate_signing_key(
+            "uk", key, purpose="verify" if certified else "sign"
+        )
+    except GateSigningKeyError as error:
+        return Check("signing key registered", False, str(error))
+    fingerprint = gate_signing_key_fingerprint(key)
+    if signer is not None and signer != fingerprint:
+        entry = registered_gate_signing_key("uk", signer)
+        holder = f"{entry.label}, held by {entry.custodian}" if entry else "a key"
+        return Check(
+            "signing key registered",
+            False,
+            f"this cut was signed by {holder} ({signer}), not the key in "
+            f"{UK_GATE_SIGNING_KEY_ENV} ({fingerprint}); resume it with that "
+            "key, or start a fresh cut with a new --label.",
+        )
+    detail = fingerprint + ("; this cut's signer" if signer else "")
+    return Check("signing key registered", True, detail)
+
+
+def hub_checks() -> list[Check]:
+    checks = []
+    if not os.environ.get("HF_TOKEN"):
+        return [
+            Check("HF_TOKEN", False, "export HF_TOKEN (write to the release repos)")
+        ]
+    try:
+        from huggingface_hub import HfApi
+
+        from microcosm.build.staging_storage import HuggingFaceDatasetStorage
+
+        api = HfApi()
+        for repo in (PUBLISH_REPO, TELEMETRY_REPO):
+            storage = HuggingFaceDatasetStorage(repo, api=api)
+            storage.head_revision()
+            can_write = storage.credential_can_write()
+            checks.append(
+                Check(
+                    f"write {repo}",
+                    can_write is not False,
+                    "write scope confirmed"
+                    if can_write
+                    else "scope unreadable; the upload will prove it",
+                )
+            )
+        refs = api.list_repo_refs(PUBLISH_REPO, repo_type="dataset")
+        stale = [b.name for b in refs.branches if b.name == STAGING_BRANCH]
+        checks.append(
+            Check(
+                "no leftover release-staging branch",
+                not stale,
+                f"delete {STAGING_BRANCH} after checking no publish is running"
+                if stale
+                else "none",
+            )
+        )
+    except Exception as error:
+        checks.append(Check("Hugging Face reachable", False, f"{type(error).__name__}"))
+    return checks
+
+
+def register_expiry_check(today: date, *, warn_days: int = 7) -> Check:
+    earliest: tuple[str, str] | None = None
+    for path in sorted(UK_DIR.glob("*.json")):
+        text = path.read_text()
+        if "expires_on" not in text:
+            continue
+        for match in _expiries(json.loads(text)):
+            if earliest is None or match < earliest[0]:
+                earliest = (match, path.name)
+    if earliest is None:
+        return Check("register expiries", True, "none")
+    days = (date.fromisoformat(earliest[0]) - today).days
+    detail = f"earliest {earliest[0]} in {earliest[1]} ({days} days)"
+    if days < 0:
+        return Check("register expiries", False, detail + ": expired")
+    # An entry expiring soon still builds today; say so without blocking.
+    return Check("register expiries", days >= warn_days, detail, blocking=False)
+
+
+def _expiries(node: object):
+    if isinstance(node, Mapping):
+        value = node.get("expires_on")
+        if isinstance(value, str) and len(value) == 10:
+            yield value
+        for child in node.values():
+            yield from _expiries(child)
+    elif isinstance(node, list):
+        for child in node:
+            yield from _expiries(child)
+
+
+def host_checks(
+    work_dir: Path,
+    *,
+    min_free_gb: float,
+    reservation_tool: Path | None = None,
+    reservation_caller: str | None = None,
+) -> list[Check]:
+    """Disk, power and load, and a host reservation only where one is configured.
+
+    A reservation tool belongs to one machine, so the check runs only when the
+    operator names the tool and the caller; a named tool that is missing fails
+    rather than being skipped.
+    """
+
+    if (reservation_tool is None) != (reservation_caller is None):
+        raise CutError("a host reservation needs both its tool and its caller.")
+    checks = []
+    probe = next(
+        (path for path in (work_dir, *work_dir.parents) if path.exists()), Path.home()
+    )
+    usage = shutil.disk_usage(probe)
+    free_gb = usage.free / 1e9
+    checks.append(
+        Check(
+            "free disk",
+            free_gb >= min_free_gb,
+            f"{free_gb:.1f} GB free; floor {min_free_gb:.0f} GB",
+        )
+    )
+    if platform.system() == "Darwin":
+        power = subprocess.run(
+            ["pmset", "-g", "batt"], capture_output=True, text=True, check=False
+        ).stdout
+        on_ac = "AC Power" in power.splitlines()[0] if power else True
+        checks.append(
+            Check(
+                "on AC power",
+                on_ac,
+                "AC" if on_ac else "on battery: a closed lid stops long runs",
+                blocking=False,
+            )
+        )
+    load5 = os.getloadavg()[1]
+    checks.append(
+        Check(
+            "load",
+            True,
+            f"load5 {load5:.1f} on {os.cpu_count()} CPUs",
+            blocking=False,
+        )
+    )
+    if reservation_tool is not None:
+        if not reservation_tool.is_file():
+            checks.append(
+                Check("host reservation", False, f"{reservation_tool} not found")
+            )
+            return checks
+        allowed = subprocess.run(
+            [sys.executable, str(reservation_tool), "allowed", reservation_caller],
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+        checks.append(
+            Check(
+                "host reservation",
+                allowed.returncode == 0,
+                (allowed.stdout or allowed.stderr).strip()[:200] or "allowed",
+            )
+        )
+    return checks
+
+
+def contract_pin_check(python: str) -> Check:
+    tests = [
+        "packages/microcosm-build/tests/engine_free/shared/test_gate_battery_contract_pins.py",
+        "packages/microcosm-data/tests/engine_free/shared/test_contract.py",
+    ]
+    run = subprocess.run(
+        [python, "-m", "pytest", "-q", "-p", "no:cacheprovider", "-x", *tests],
+        cwd=REPO_ROOT,
+        capture_output=True,
+        text=True,
+        env=step_environment("contract-pin-check"),
+        check=False,
+    )
+    return Check(
+        "contract pins agree with the gate spec",
+        run.returncode == 0,
+        _pytest_detail(run),
+    )
+
+
+def surfaces_check(python: str, chronicle_dir: Path) -> Check:
+    """The feed-gated surface tests that skip in CI (runbook: stale receipts)."""
+
+    env = {
+        **step_environment("surface-check"),
+        "CHRONICLE_UK_FACTS": str(chronicle_dir),
+    }
+    run = subprocess.run(
+        [
+            python, "-m", "pytest", "-q", "-p", "no:cacheprovider",
+            "packages/microcosm-build/tests/engine_free/uk/test_uk_target_references.py",
+        ],
+        cwd=REPO_ROOT,
+        capture_output=True,
+        text=True,
+        env=env,
+        check=False,
+    )  # fmt: skip
+    return Check(
+        "target surfaces current against the pinned feed",
+        run.returncode == 0,
+        _pytest_detail(run),
+    )
+
+
+def _pytest_detail(run: subprocess.CompletedProcess) -> str:
+    """The repo's addopts already pass -q, so the summary line may be absent:
+    report the exit code and any failing test ids instead."""
+
+    failed = [
+        line.split()[1]
+        for line in (run.stdout or "").splitlines()
+        if line.startswith(("FAILED ", "ERROR "))
+    ]
+    if run.returncode == 0:
+        return "passed"
+    return f"exit {run.returncode}" + (f": {', '.join(failed[:5])}" if failed else "")
+
+
+# --------------------------------------------------------------------------- #
+# Running steps                                                                 #
+# --------------------------------------------------------------------------- #
+
+
+@dataclass
+class Runner:
+    paths: CutPaths
+    sources: Mapping[str, InputSource]
+    python: str = sys.executable
+    execute: Callable[[list[str], Path, Path, dict[str, str]], int] | None = None
+    log: Callable[[str], None] = print
+
+    def __post_init__(self) -> None:
+        if self.execute is None:
+            self.execute = _execute
+
+    def state(self) -> dict[str, Any]:
+        return _read_json(self.paths.state) or {
+            "label": self.paths.label,
+            "commit": self.paths.commit,
+            "steps": {},
+        }
+
+    def record(self, step: str, **fields: Any) -> None:
+        state = self.state()
+        state["steps"].setdefault(step, {}).update(fields)
+        self.paths.cut.mkdir(parents=True, exist_ok=True)
+        tmp = self.paths.state.with_name("state.json.tmp")
+        tmp.write_text(json.dumps(state, indent=2, sort_keys=True))
+        tmp.replace(self.paths.state)
+
+    def run(self, step: str, argv: list[str], *, cwd: Path = REPO_ROOT) -> None:
+        self.paths.logs.mkdir(parents=True, exist_ok=True)
+        log_path = self.paths.logs / f"{step}.log"
+        started = time.monotonic()
+        self.record(step, status="running", started_at=_now(), argv=argv)
+        self.log(f"[{step}] {shlex.join(argv)}")
+        code = self.execute(argv, cwd, log_path, step_environment(step))
+        seconds = round(time.monotonic() - started, 1)
+        if code != 0:
+            self.record(step, status="failed", exit_code=code, seconds=seconds)
+            raise CutError(f"{step} exited {code}; see {log_path}")
+        self.record(step, status="done", finished_at=_now(), seconds=seconds)
+
+
+def _now() -> str:
+    return datetime.now(UTC).strftime("%Y-%m-%dT%H:%M:%SZ")
+
+
+def _execute(argv: list[str], cwd: Path, log_path: Path, env: dict[str, str]) -> int:
+    """Run one step, teeing its output to the console and its log."""
+
+    with log_path.open("a") as log:
+        log.write(f"\n# {_now()} $ {shlex.join(argv)}\n")
+        log.flush()
+        process = subprocess.Popen(
+            argv,
+            cwd=cwd,
+            env=env,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.STDOUT,
+            text=True,
+            bufsize=1,
+        )
+        assert process.stdout is not None
+        for line in process.stdout:
+            sys.stdout.write(line)
+            log.write(line)
+        return process.wait()
+
+
+def _superseded(path: Path) -> Path:
+    """Where a failed attempt's evidence goes when a step is retried."""
+
+    return path.with_name(
+        f"{path.name}.superseded-{datetime.now(UTC):%Y%m%dT%H%M%S%fZ}"
+    )
+
+
+def _set_aside(runner: Runner, step: str, *paths: Path) -> None:
+    """Keep a failed attempt's outputs, signed failure reports included."""
+
+    for path in paths:
+        if path.exists():
+            aside = _superseded(path)
+            path.rename(aside)
+            runner.log(
+                f"[{step}] kept the earlier attempt's {path.name} as {aside.name}"
+            )
+
+
+def run_spine(runner: Runner, *, staging_local_only: bool, retry: bool = False) -> None:
+    paths = runner.paths
+    done, detail = spine_done(paths)
+    if done:
+        runner.log(f"[spine] done: {detail}")
+        return
+    if paths.spine_dir.exists() and any(paths.spine_dir.iterdir()):
+        # A gate-blocked spine writes its signed .spine_gates.json before any
+        # H5, and the builder deletes its sidecars on start: never rerun over
+        # an attempt, move the whole attempt aside instead.
+        if not retry:
+            raise CutError(
+                f"{paths.spine_dir} holds an unfinished spine attempt ({detail}); "
+                "pass --retry-spine to move it aside and build a fresh one."
+            )
+        aside = paths.spine_dir.with_name(
+            f"spine.failed-{datetime.now(UTC):%Y%m%dT%H%M%SZ}"
+        )
+        paths.spine_dir.rename(aside)
+        runner.log(f"[spine] moved the unfinished attempt to {aside}")
+    paths.spine_dir.mkdir(parents=True, exist_ok=True)
+    runner.run(
+        "spine",
+        spine_argv(paths, python=runner.python, staging_local_only=staging_local_only),
+    )
+    done, detail = spine_done(paths)
+    if not done:
+        raise CutError(f"the spine finished but is not usable: {detail}")
+
+
+def run_national(
+    runner: Runner, *, retry: bool, logbook_prev_row_digest: str | None
+) -> None:
+    paths = runner.paths
+    done, detail = national_done(paths)
+    if done:
+        runner.log(f"[national] done: {detail}")
+        return
+    spine = spine_sha256(paths)
+    if spine is None:
+        raise CutError("the national step needs a finished spine.")
+    if paths.run_dir.exists():
+        if not retry:
+            raise CutError(
+                f"{paths.run_dir} holds an unfinished national run ({detail}); "
+                "pass --retry-national to move it aside and start a fresh one."
+            )
+        aside = paths.run_dir.with_name(
+            f"national.failed-{datetime.now(UTC):%Y%m%dT%H%M%SZ}"
+        )
+        paths.run_dir.rename(aside)
+        runner.log(f"[national] moved the unfinished run to {aside}")
+    common = dict(
+        python=runner.python,
+        spine_sha256=spine,
+        sources=runner.sources,
+        logbook_prev_row_digest=logbook_prev_row_digest,
+    )
+    dry_run = runner.state()["steps"].get("national-dry-run", {})
+    if dry_run.get("status") != "done":
+        runner.run("national-dry-run", national_argv(paths, dry_run=True, **common))
+    runner.run("national", national_argv(paths, dry_run=False, **common))
+    done, detail = national_done(paths)
+    if not done:
+        raise CutError(f"the national run finished but is not usable: {detail}")
+
+
+def run_score(runner: Runner) -> None:
+    paths = runner.paths
+    done, detail = score_done(paths)
+    if done:
+        runner.log(f"[score] done: {detail}")
+        return
+    runner.log(f"[score] re-scoring the candidate ({detail})")
+    _set_aside(runner, "score", paths.run_dir / "score_vs_incumbent.json")
+    runner.run(
+        "score",
+        score_argv(
+            paths,
+            python=runner.python,
+            candidate_sha256=candidate_sha256(paths),
+            sources=runner.sources,
+        ),
+    )
+    done, detail = score_done(paths)
+    if not done:
+        raise CutError(f"the candidate does not pass the incumbent score: {detail}")
+
+
+def national_logbook_row(paths: CutPaths) -> str:
+    """The digest of the national build's own Logbook row.
+
+    The build spools exactly one row under ``logbook-spool/``, named by its
+    digest; the certification's row chains on it, as the hand-run launchers
+    chain it, so the two never share a predecessor.
+    """
+
+    rows = sorted((paths.run_dir / "logbook-spool").glob("*.json"))
+    if len(rows) != 1:
+        raise CutError(
+            f"{paths.run_dir / 'logbook-spool'} holds {len(rows)} Logbook rows; "
+            "certification chains on the national build's single row."
+        )
+    return rows[0].stem
+
+
+def run_certify(runner: Runner) -> None:
+    paths = runner.paths
+    done, detail = certify_done(paths)
+    if done:
+        runner.log(f"[certify] done: {detail}")
+        return
+    _set_aside(
+        runner,
+        "certify",
+        paths.run_dir / f"{CANDIDATE_NAME}.release_cut_gates.json",
+        paths.run_dir / f"{CANDIDATE_NAME}.release_certification.json",
+    )
+    runner.run(
+        "certify",
+        certify_argv(
+            paths,
+            python=runner.python,
+            candidate_sha256=candidate_sha256(paths),
+            spine_sha256=spine_sha256(paths),
+            sources=runner.sources,
+            logbook_prev_row_digest=national_logbook_row(paths),
+        ),
+    )
+    done, detail = certify_done(paths)
+    if not done:
+        raise CutError(f"the release cut is not certified: {detail}")
+
+
+def stage1_done(paths: CutPaths, previous_h5: Path) -> tuple[bool, str]:
+    """The comparison exists and measured exactly these two files."""
+
+    report = _read_json(paths.diagnostics / "stage1_comparison.json")
+    if report is None:
+        return False, "no stage-1 comparison"
+    measured = report.get("artifacts") or {}
+    expected = {
+        "candidate": candidate_sha256(paths),
+        "previous": _sha256_file(previous_h5),
+    }
+    for label, sha256 in expected.items():
+        if (measured.get(label) or {}).get("sha256") != sha256:
+            return False, f"the comparison measured another {label} file"
+    return True, "stage-1 comparison current"
+
+
+def run_stage1(runner: Runner, previous_h5: Path | None) -> None:
+    paths = runner.paths
+    output = paths.diagnostics / "stage1_comparison.json"
+    if previous_h5 is not None:
+        done, detail = stage1_done(paths, previous_h5)
+        if done:
+            runner.log(f"[stage1] done: {detail}")
+            return
+        _set_aside(runner, "stage1", output)
+    if previous_h5 is None:
+        runner.record("stage1", status="skipped", reason="no --previous-h5")
+        runner.log(
+            "[stage1] skipped: pass --previous-h5 <promoted cut's H5> for the "
+            "interim stage-1 comparison (diagnostic; microcosm#1276)"
+        )
+        return
+    paths.diagnostics.mkdir(parents=True, exist_ok=True)
+    runner.run(
+        "stage1",
+        [
+            runner.python,
+            str(REPO_ROOT / "tools/measure_uk_weighted_integrity_baselines.py"),
+            "--h5", f"candidate={paths.candidate_h5}",
+            "--h5", f"previous={previous_h5}",
+            "--output", str(output),
+        ],
+    )  # fmt: skip
+
+
+def run_assemble(runner: Runner) -> dict[str, Any]:
+    paths = runner.paths
+    done, detail = assemble_done(paths)
+    if done:
+        runner.log(f"[assemble] done: {detail}")
+        return _read_json(paths.cut / "assemble_summary.json") or {}
+    if paths.release_dir.exists():
+        raise CutError(
+            f"{paths.release_dir} exists without an assembly summary; inspect it. "
+            "Assembly refuses an existing release directory."
+        )
+    paths.release_parent.mkdir(parents=True, exist_ok=True)
+    runner.run(
+        "assemble", assemble_argv(paths, python=runner.python), cwd=paths.release_parent
+    )
+    summary = _last_json_object((paths.logs / "assemble.log").read_text())
+    tag = summary.get("tag") or summary.get("cut_tag") or summary.get("tag_name")
+    if not tag:
+        raise CutError("assembly printed no cut tag; see logs/assemble.log")
+    summary["tag"] = tag
+    (paths.cut / "assemble_summary.json").write_text(
+        json.dumps(summary, indent=2, sort_keys=True)
+    )
+    return summary
+
+
+def _last_json_object(text: str) -> dict[str, Any]:
+    """The last top-level JSON object a tool printed (its summary)."""
+
+    decoder = json.JSONDecoder()
+    found: dict[str, Any] = {}
+    index = 0
+    while (start := text.find("{", index)) != -1:
+        try:
+            value, end = decoder.raw_decode(text, start)
+        except json.JSONDecodeError:
+            index = start + 1
+            continue
+        if isinstance(value, dict):
+            found = value
+        index = end
+    return found
+
+
+def tag_published(tag: str) -> bool:
+    from huggingface_hub import HfApi
+
+    refs = HfApi().list_repo_refs(PUBLISH_REPO, repo_type="dataset")
+    return any(ref.name == tag for ref in refs.tags)
+
+
+def run_publish(runner: Runner, tag: str, *, publish: bool) -> None:
+    paths = runner.paths
+    runner.run(
+        "publish-preflight",
+        publish_argv(paths, python=runner.python, tag=tag, preflight_only=True),
+        cwd=paths.release_parent,
+    )
+    if not publish:
+        runner.log(
+            "[publish] not published: pass --publish to publish this cut for "
+            "inspection (tag only; main and latest-*.json do not move)"
+        )
+        return
+    if tag_published(tag):
+        runner.log(f"[publish] done: tag {tag} exists")
+        return
+    runner.run(
+        "publish",
+        publish_argv(paths, python=runner.python, tag=tag, preflight_only=False),
+        cwd=paths.release_parent,
+    )
+
+
+def write_receipt(runner: Runner, extra: Mapping[str, Any]) -> None:
+    paths = runner.paths
+    receipt = {
+        "schema_version": 1,
+        "kind": "microcosm.uk_cut_receipt",
+        "release_id": RELEASE_ID,
+        "label": paths.label,
+        "code": {"repository": "PolicyEngine/microcosm", "commit": paths.commit},
+        "engine": _engine_version(),
+        # The key that signed the cut's reports, whoever resumed it.
+        "signing_key_sha256": cut_signing_key(paths),
+        "inputs": {
+            source.key: {
+                "repo_id": source.repo_id,
+                "revision": source.revision,
+                "archive": source.filename,
+                "url": source.url,
+                "files": {pin.name: pin.sha256 for pin in source.files},
+            }
+            for source in runner.sources.values()
+        },
+        "spine_sha256": spine_sha256(paths),
+        "candidate_sha256": candidate_sha256(paths)
+        if (paths.run_dir / "build_record.json").exists()
+        else None,
+        "steps": runner.state()["steps"],
+        **extra,
+    }
+    paths.receipt.write_text(json.dumps(receipt, indent=2, sort_keys=True))
+
+
+def _engine_version() -> str | None:
+    try:
+        from importlib.metadata import version
+
+        return version("policyengine-uk")
+    except Exception:
+        return None
+
+
+# --------------------------------------------------------------------------- #
+# Command line                                                                  #
+# --------------------------------------------------------------------------- #
+
+
+def _parse(argv: Sequence[str] | None) -> argparse.Namespace:
+    parser = argparse.ArgumentParser(
+        prog="run_uk_cut.py", description=__doc__.split("\n\n")[0]
+    )
+    parser.add_argument(
+        "command",
+        choices=("status", "fetch", "preflight", "all", "inputs"),
+        help=(
+            "status: where each step stands; fetch: install and verify every "
+            "input; preflight: every check, nothing built; all: fetch, "
+            "preflight, then each step not already done; inputs: print the "
+            "resolved input pins"
+        ),
+    )
+    parser.add_argument("--label", help="names the cut's directory, e.g. sat24")
+    parser.add_argument("--work-dir", type=Path, default=DEFAULT_WORK_DIR)
+    parser.add_argument("--min-free-gb", type=float, default=60.0)
+    parser.add_argument(
+        "--reservation-tool",
+        type=Path,
+        help=(
+            "a host reservation tool to ask before building (run as "
+            "`<tool> allowed <caller>`; exit 0 means allowed); off by default"
+        ),
+    )
+    parser.add_argument(
+        "--reservation-caller",
+        help="the caller name the reservation tool is asked about",
+    )
+    parser.add_argument(
+        "--allow-off-main",
+        metavar="REASON",
+        help="build a pushed commit that is not on origin/main (say who agreed)",
+    )
+    parser.add_argument("--only", action="append", help="fetch only these sources")
+    parser.add_argument("--reverify", action="store_true", help="re-hash every input")
+    parser.add_argument("--skip-surface-check", action="store_true")
+    parser.add_argument(
+        "--retry-spine",
+        action="store_true",
+        help="move an unfinished spine attempt aside and build a fresh one",
+    )
+    parser.add_argument("--retry-national", action="store_true")
+    parser.add_argument("--previous-h5", type=Path, help="for the stage-1 comparison")
+    parser.add_argument(
+        "--logbook-prev-row-digest",
+        help=(
+            "the national build's Logbook predecessor (default: a new chain); "
+            "the certification always chains on the build's own row"
+        ),
+    )
+    parser.add_argument(
+        "--spine-telemetry",
+        action="store_true",
+        help="send the spine's telemetry to the staging repo (default: local only)",
+    )
+    parser.add_argument(
+        "--publish",
+        action="store_true",
+        help="publish for inspection (--no-latest --tag-only); outward-facing",
+    )
+    args = parser.parse_args(argv)
+    if (args.reservation_tool is None) != (args.reservation_caller is None):
+        parser.error("--reservation-tool and --reservation-caller go together.")
+    # Steps run from different working directories (assembly and publication
+    # from the release directory), so every path must be absolute.
+    args.work_dir = args.work_dir.expanduser().resolve()
+    if args.reservation_tool is not None:
+        args.reservation_tool = args.reservation_tool.expanduser().resolve()
+    if args.previous_h5 is not None:
+        args.previous_h5 = args.previous_h5.expanduser().resolve()
+    return args
+
+
+def _cut_paths(args: argparse.Namespace) -> CutPaths:
+    if not args.label:
+        raise CutError("--label is required for this command.")
+    return CutPaths(args.work_dir, args.label, _git("rev-parse", "HEAD"))
+
+
+def _print_checks(checks: Sequence[Check]) -> bool:
+    ok = True
+    for check in checks:
+        mark = "ok  " if check.ok else ("FAIL" if check.blocking else "warn")
+        print(f"  {mark} {check.name}: {check.detail}")
+        ok = ok and (check.ok or not check.blocking)
+    return ok
+
+
+def _print_fetch(results: Sequence[FetchResult]) -> bool:
+    ok = True
+    for result in results:
+        good = result.status in {"present", "fetched"}
+        ok = ok and good
+        print(
+            f"  {'ok  ' if good else 'FAIL'} {result.key}: {result.status} {result.detail}"
+        )
+    return ok
+
+
+def preflight(args: argparse.Namespace, paths: CutPaths) -> list[Check]:
+    checks = git_checks(allow_off_main=args.allow_off_main)
+    checks += environment_checks()
+    checks.append(signing_key_check(paths=paths))
+    checks += hub_checks()
+    checks.append(register_expiry_check(date.today()))
+    checks += host_checks(
+        paths.work_dir,
+        min_free_gb=args.min_free_gb,
+        reservation_tool=args.reservation_tool,
+        reservation_caller=args.reservation_caller,
+    )
+    checks.append(contract_pin_check(sys.executable))
+    if not args.skip_surface_check:
+        chronicle = paths.inputs / "chronicle_uk"
+        if (chronicle / "consumer_facts.jsonl").exists():
+            checks.append(surfaces_check(sys.executable, chronicle))
+        else:
+            checks.append(
+                Check("target surfaces", False, "fetch the Chronicle artifact first")
+            )
+    return checks
+
+
+def status(paths: CutPaths) -> None:
+    print(f"cut {paths.cut}")
+    for name, check in (
+        ("spine", spine_done),
+        ("national", national_done),
+        ("score", score_done),
+        ("certify", certify_done),
+        ("assemble", assemble_done),
+    ):
+        try:
+            done, detail = check(paths)
+        except Exception as error:  # an earlier step is missing
+            done, detail = False, f"not reached ({type(error).__name__})"
+        print(f"  {'done' if done else 'todo'} {name}: {detail}")
+
+
+def main(argv: Sequence[str] | None = None) -> int:
+    args = _parse(argv)
+    try:
+        sources = {source.key: source for source in load_input_sources()}
+        if args.command == "inputs":
+            print(
+                json.dumps(
+                    {
+                        key: {
+                            "kind": s.kind,
+                            "repo_id": s.repo_id,
+                            "revision": s.revision,
+                            "files": {p.name: p.sha256 for p in s.files},
+                        }
+                        for key, s in sources.items()
+                    },
+                    indent=2,
+                )
+            )
+            return 0
+        work = args.work_dir
+        if args.command in {"fetch", "all"}:
+            print("inputs:")
+            results = fetch_inputs(
+                list(sources.values()),
+                work / "inputs",
+                downloader=HubDownloader(work / "cache" / "hf"),
+                reverify=args.reverify,
+                only=set(args.only) if args.only else None,
+            )
+            if not _print_fetch(results):
+                print("Some inputs are not available; see docs/uk-cut-anyone.md.")
+                return 1
+            if args.command == "fetch":
+                return 0
+        paths = _cut_paths(args)
+        if args.command == "status":
+            status(paths)
+            return 0
+        print("preflight:")
+        if not _print_checks(preflight(args, paths)):
+            print("Preflight failed; nothing was built.")
+            return 1
+        if args.command == "preflight":
+            return 0
+        runner = Runner(paths=paths, sources=sources)
+        run_spine(
+            runner, staging_local_only=not args.spine_telemetry, retry=args.retry_spine
+        )
+        run_national(
+            runner,
+            retry=args.retry_national,
+            logbook_prev_row_digest=args.logbook_prev_row_digest,
+        )
+        run_score(runner)
+        run_certify(runner)
+        run_stage1(runner, args.previous_h5)
+        summary = run_assemble(runner)
+        tag = summary["tag"]
+        run_publish(runner, tag, publish=args.publish)
+        write_receipt(runner, {"tag": tag, "published": args.publish})
+        print(f"\ncut {tag} assembled; receipt {paths.receipt}")
+        print(
+            "Next (each a separate, deliberate call):\n"
+            f"  promote: {promote_command(paths, tag)}\n"
+            "  certify in policyengine.py: tools/certify_uk_cut_in_policyengine_py.py "
+            f"--national-tag {tag} ..."
+        )
+        return 0
+    except CutError as error:
+        print(f"REFUSED: {error}", file=sys.stderr)
+        return 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/tools/uk_cut_inputs.json b/tools/uk_cut_inputs.json
new file mode 100644
index 0000000000..85b4d5a2a2
--- /dev/null
+++ b/tools/uk_cut_inputs.json
@@ -0,0 +1,159 @@
+{
+  "version": 1,
+  "about": "Where tools/run_uk_cut.py fetches each input of a Microcosm UK national cut. This file says only where; every expected sha256 and size is read from the committed pins (uk/source_stages.json, uk/frs_release.json, uk/chronicle_feed.json, uk/gates.json, weighted_integrity.py), so a file is accepted only if it is byte-identical to what the build itself will check. A *_pin field reads its value from those pins instead: path_in_repo_pin chronicle_feed puts the Chronicle artifact under chronicle-uk/<the feed's source commit>, so it follows every re-pin. revision null reads the repository's main branch, and every file is still verified against its pin (docs/uk-cut-anyone.md).",
+  "sources": [
+    {
+      "key": "frs_2024_25",
+      "kind": "hf_zip_members",
+      "repo_id": "policyengine/policyengine-uk-data-private",
+      "repo_type": "model",
+      "revision": "a2039519d3b92aecc06c66dfd175cb46ac24cada",
+      "filename": "frs_2024_25.zip",
+      "archive_sha256_pin": "frs_release",
+      "directory": "frs_2024_25",
+      "members": [
+        "accounts.tab",
+        "adult.tab",
+        "benefits.tab",
+        "benunit.tab",
+        "child.tab",
+        "chldcare.tab",
+        "extchild.tab",
+        "househol.tab",
+        "job.tab",
+        "maint.tab",
+        "mortgage.tab",
+        "oddjob.tab",
+        "penprov.tab",
+        "pension.tab"
+      ]
+    },
+    {
+      "key": "spi_2022_23",
+      "kind": "hf_zip_members",
+      "repo_id": "policyengine/policyengine-uk-data-private",
+      "repo_type": "model",
+      "revision": "a2039519d3b92aecc06c66dfd175cb46ac24cada",
+      "filename": "spi_2022_23.zip",
+      "archive_sha256": "2c7a779797ed3accfc04d2c6401867665af216f810141f7639f3e2164edc4517",
+      "directory": "spi_2022_23",
+      "members": [
+        "put2223uk.tab"
+      ]
+    },
+    {
+      "key": "was_round_8",
+      "kind": "hf_zip_members",
+      "repo_id": "policyengine/policyengine-uk-data-private",
+      "repo_type": "model",
+      "revision": "a2039519d3b92aecc06c66dfd175cb46ac24cada",
+      "filename": "was_2006_22.zip",
+      "archive_sha256": "df5e8be49e51aa70f4bf686b98ab44ef11ee1eb260cbaf51308f89dc62449ae1",
+      "directory": "was_round_8",
+      "members": [
+        "was_round_8_hhold_eul_may_2025_230525.tab",
+        "was_round_8_person_eul_may_2025_230525.tab"
+      ]
+    },
+    {
+      "key": "etb_1977_2024",
+      "kind": "hf_zip_members",
+      "repo_id": "policyengine/policyengine-uk-data-private",
+      "repo_type": "model",
+      "revision": "a2039519d3b92aecc06c66dfd175cb46ac24cada",
+      "filename": "etb_1977_24.zip",
+      "archive_sha256": "96fff4868745a2a9bb1169dcecdaf9958c1179d81f9ef67494c1f29622c7d405",
+      "directory": "etb_1977_2024",
+      "members": [
+        "householdv2_1977-2024.tab"
+      ]
+    },
+    {
+      "key": "nts_2002_2024",
+      "kind": "hf_zip_members",
+      "repo_id": "policyengine/policyengine-uk-data-private",
+      "repo_type": "model",
+      "revision": "559b69e94f0e03e696c5b7a55feffc54b7423717",
+      "filename": "nts_2002_24.zip",
+      "archive_sha256": "bc9955021d12ca82230c75626d393574dc6a44d9cbd13f412af76c5af93bf136",
+      "directory": "nts_2002_2024",
+      "members": [
+        "household_eul_2002-2024.tab",
+        "individual_eul_2002-2024.tab",
+        "trip_eul_2002-2024.tab",
+        "stage_eul_2002-2024.tab",
+        "ticket_eul_2002-2024.tab"
+      ],
+      "upload_note": "UKDS SN 5340, 19th edition, TAB format: the UKDS download zip, unchanged (its sha256 is the one UKDS puts in the download's file name). The members are found by file name and checked against their pins; if the file is ever lost, a UKDS licence holder re-uploads the same download."
+    },
+    {
+      "key": "lcfs_2024_25",
+      "kind": "hf_zip_members",
+      "repo_id": "policyengine/policyengine-uk-data-private",
+      "repo_type": "model",
+      "revision": "1105105276991902d28e5fa3973d654ab09327bc",
+      "filename": "lcfs_2024_25.zip",
+      "archive_sha256": "66b5993b2b791874ab712bf03dca4688044857f24a357fc6d2d308037e3f2896",
+      "directory": "lcfs_2024_25",
+      "members": [
+        "dvhh_uk_anon_v3_2024.tab",
+        "dvper_uk_anon_2024.tab"
+      ],
+      "upload_note": "UKDS SN 9603, 2nd edition, TAB format: a repack of the extracted files (all seven tabs and the two mrdoc workbooks, under lcfs_2024_25/), because the original download zip was no longer available. The members are found by file name and checked against their pins."
+    },
+    {
+      "key": "hmrc_personal_incomes_ods",
+      "kind": "url",
+      "url_pin": "source_stages:Collated_Tables_3_1_to_3_11_2324.ods",
+      "directory": "hmrc",
+      "members": [
+        "Collated_Tables_3_1_to_3_11_2324.ods"
+      ]
+    },
+    {
+      "key": "chronicle_uk",
+      "kind": "hf_files",
+      "repo_id": "policyengine/microcosm-uk-build-inputs",
+      "repo_type": "dataset",
+      "revision": null,
+      "path_in_repo": "chronicle-uk",
+      "path_in_repo_pin": "chronicle_feed",
+      "directory": "chronicle_uk",
+      "members": [
+        "manifest.json",
+        "consumer_facts.jsonl"
+      ]
+    },
+    {
+      "key": "input_mass_reference",
+      "kind": "hf_files",
+      "repo_id": "policyengine/microcosm-uk-build-inputs",
+      "repo_type": "dataset",
+      "revision": "95e0cb20fb37811c3f9009854d882a7415194926",
+      "path_in_repo": "input-mass-reference/fd41cb5f6cf6c4ef812320f21d1942173d49ce6f8725b21fbc9d9ca5423d298c",
+      "directory": "input_mass_reference",
+      "members": [
+        "uk_input_mass_reference.json"
+      ]
+    },
+    {
+      "key": "incumbent_efrs",
+      "kind": "hf_files",
+      "repo_id": "policyengine/policyengine-uk-data-private",
+      "repo_type": "model",
+      "revision_pin": "gates:input_mass_parity",
+      "path_in_repo": "",
+      "directory": "incumbent",
+      "members": [
+        "enhanced_frs_2024_25.h5"
+      ]
+    }
+  ],
+  "file_pins": {
+    "uk_input_mass_reference.json": {
+      "sha256": "b3490f5bbc46581f2b5f81560a249b8983e37f80c67f00988cd3ed960a7f81c4",
+      "canonical_evidence_sha256": "fd41cb5f6cf6c4ef812320f21d1942173d49ce6f8725b21fbc9d9ca5423d298c",
+      "note": "Byte pin of the hosted file; the build's own loader checks the canonical evidence digest. Regenerated at microcosm 0eac9bbbd (policyengine-uk 2.89.0); see the receipt beside it."
+    }
+  }
+}