An item the hold covers whose stored record or content can't be read goes in exceptions.csv with the path it would have had and the reason, rather than being left out silently. The file is always in the ZIP, so a header-only one shows nothing was missed, and manifest.sha256 carries its hash beside the manifest's.