- Split run_name on "/" and "\" and reject empty, "." and ".." parts, so a Windows-style "..\foo" can no longer resolve outside model_compare and let the index-0 archive step rename an unrelated output folder - Reject drive-letter names and require the resolved directory to sit strictly below output/model_compare after symlinks are followed - Nested run names such as project/date/sweep still work