Encrypted ZIP members and unsupported ZIP compression methods raised bare RuntimeError / NotImplementedError out of the canonical manifest reader, escaping the publisher's DriverError handling and surfacing a traceback instead of a structured refusal. They are now translated into the rail's refusal shape. Tar member paths are now validated before retained-manifest limits, so an unsafe path refuses for the unsafe path rather than for size, matching the ZIP reader's order. The non-model artifact set is named train throughout, and the fetched archive is named published rather than candidate, which in this rail means the retained release candidate. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>