@@ -24,6 +24,7 @@ import {
   GetPackageCustomizationsResponseSchema,
 } from './package-lifecycle.zod';
 import { PackagePublishResultSchema as SystemPackagePublishResultSchema } from '../system/metadata-persistence.zod';
+import { CONNECTOR_CREDENTIAL_MAP_PATHS, redactConnectorItem } from '../integration/connector-credential-redaction';
 
 describe('the ruled re-export of PackagePublishResultSchema into the `/api` namespace', () => {
   it('is the SAME declaration as the `/system` original — a re-export, never a second copy', () => {
@@ -195,7 +196,7 @@ describe('RollbackToPackageCommitResponseSchema declares the COMMIT-rollback bod
   });
 });
 
-describe('PackageExportManifestSchema declares the four fixed keys and stays open', () => {
+describe('PackageExportManifestSchema declares the five fixed keys and stays open', () => {
   /** A verbatim-shaped capture of a real `assemblePackageManifest` return. */
   const realResponse = {
     id: 'com.example.crm',
@@ -212,7 +213,7 @@ describe('PackageExportManifestSchema declares the four fixed keys and stays ope
     if (result.success) expect(result.data).toEqual(realResponse);
   });
 
-  it('requires exactly the four fixed keys — a manifest with no items still parses', () => {
+  it('requires only the three identity keys — a manifest with no items still parses', () => {
     const bare = { id: 'com.example.empty', name: 'empty', version: '1.0.0' };
     expect(PackageExportManifestSchema.safeParse(bare).success).toBe(true);
   });
@@ -222,6 +223,50 @@ describe('PackageExportManifestSchema declares the four fixed keys and stays ope
   });
 });
 
+describe('PackageExportManifestSchema.withheldMaps names each map the export withheld whole (#28640 ruling ③A)', () => {
+  const identity = { id: 'com.example.crm', name: 'example-crm', version: '2.1.0' };
+  /** The connector item as the export writes it: served, so its header map is already absent. */
+  const servedConnector = { name: 'stripe', label: 'Stripe', type: 'api', provider: 'rest', providerConfig: { baseUrl: 'https://api.stripe.example' } };
+
+  it('parses an export that lists a withheld map and PRESERVES it — the item body stays as served', () => {
+    const manifest = {
+      ...identity,
+      connectors: [servedConnector],
+      withheldMaps: [{ type: 'connector', name: 'stripe', path: 'providerConfig.headers' }],
+    };
+    const result = PackageExportManifestSchema.safeParse(manifest);
+    expect(result.success).toBe(true);
+    if (result.success) expect(result.data).toEqual(manifest);
+  });
+
+  it('is optional — an export that withheld nothing, or one from before the key, still parses', () => {
+    expect(PackageExportManifestSchema.safeParse(identity).success).toBe(true);
+  });
+
+  it('spells each position exactly as the connector redactor reports it — the same four maps, nothing else', () => {
+    const declared = [...PackageExportManifestSchema.shape.withheldMaps.unwrap().element.shape.path.options];
+    // The redactor's own list of the maps it withholds whole …
+    expect(declared).toEqual(CONNECTOR_CREDENTIAL_MAP_PATHS.map((p) => p.join('.')));
+    // … and the spelling its `redactedKeys` names them by, read off a real redaction.
+    const map = { Authorization: 'x' };
+    const { redactedKeys } = redactConnectorItem({
+      ...servedConnector,
+      providerConfig: { headers: map, defaultHeaders: map, transport: { headers: map, env: { TOKEN: 'x' } } },
+    });
+    expect([...redactedKeys].sort()).toEqual([...declared].sort());
+  });
+
+  it.each([
+    ['a position outside the four', { type: 'connector', name: 'stripe', path: 'auth.token' }],
+    ['a position spelled without its providerConfig root', { type: 'connector', name: 'stripe', path: 'defaultHeaders' }],
+    ['a type no export withholds a map of yet', { type: 'webhook', name: 'hook', path: 'providerConfig.headers' }],
+    ['a list of the withheld header names — maps are withheld whole', { type: 'connector', name: 'stripe', path: 'providerConfig.headers', keys: ['Authorization'] }],
+    ['an entry with no item name', { type: 'connector', path: 'providerConfig.headers' }],
+  ])('refuses %s', (_label, entry) => {
+    expect(PackageExportManifestSchema.safeParse({ ...identity, withheldMaps: [entry] }).success).toBe(false);
+  });
+});
+
 describe('ReassignOrphanedMetadataResponseSchema declares the adopt-orphans body', () => {
   /** A verbatim-shaped capture of a real `reassignOrphanedMetadata` return. */
   const realResponse = {
 
@@ -175,16 +175,43 @@ export const RollbackToPackageCommitResponseSchema = lazySchema(() => z.object({
  * (`runtime/src/domains/packages.ts`) builds the key set DYNAMICALLY from the
  * metadata type registry — one plural key per type present
  * (`manifest[plural] = items.map(clean)`), partitioning `views` per #5320 —
- * plus the four fixed keys below. Only the fixed keys are pinnable;
+ * plus the five fixed keys below. Only the fixed keys are pinnable;
  * enumerating the registry here would freeze this contract against future
  * metadata types, so everything else deliberately falls to the open
  * catch-all. Freezes nothing.
+ *
+ * `withheldMaps` (#28640 ruling ③A) names each map position the export
+ * withheld whole. The export reads SERVED items, so the connector redactor
+ * (`CONNECTOR_CREDENTIAL_MAP_PATHS`, `integration/connector-credential-redaction.ts`)
+ * has already dropped each of its four header / env maps, and the item is
+ * written with the map simply absent; this list is how an import tells an
+ * incomplete map from one that was never written. Positions only — never a
+ * header or variable name — so the credential heuristic stays the
+ * redactor's, not a contract of the export. The path vocabulary is the
+ * redactor's own `redactedKeys` spelling of those four positions, and
+ * `package-lifecycle.test.ts` holds the two equal.
  */
 export const PackageExportManifestSchema = lazySchema(() => z.object({
   id: z.string().describe('The exported package\'s id.'),
   name: z.string().describe('The exported package\'s machine name.'),
   version: z.string().describe('The exported package\'s version.'),
   label: z.string().optional().describe('Display label, when the package declares one.'),
+  withheldMaps: z.array(z.object({
+    type: z.literal('connector').describe('Metadata type of the item whose map was withheld.'),
+    name: z.string().describe('Name of the item whose map was withheld.'),
+    path: z.enum([
+      'providerConfig.headers',
+      'providerConfig.defaultHeaders',
+      'providerConfig.transport.headers',
+      'providerConfig.transport.env',
+    ]).describe('Dot path of the withheld map inside the item.'),
+  }).strict()).optional().describe(
+    'Every map the export withheld WHOLE because a served read never carries it: a connector\'s '
+    + 'header and environment-variable maps. The item is written with that map absent, so an import '
+    + 'reads this list to tell an incomplete map from one the package never had, and names each one '
+    + 'for an operator to re-enter. Positions only: no header or variable name is listed. Absent '
+    + 'when the export withheld nothing.',
+  ),
 }).catchall(z.unknown().describe(
   'One key per metadata type present in the package (plural spelling, e.g. '
   + '`objects`, `views`), each an array of cleaned item bodies. The key set '
 
@@ -6,13 +6,15 @@
  * authoring refusal and by the install door's import planner
  * (`@objectstack/metadata-protocol`).
  *
- * Held TOTAL here, beside both schemas a package body is read with, so the PR
- * that adds a key to `ManifestSchema` or to the stack definition is the PR that
- * reddens — not a later install that refuses the key with no reason on record.
+ * Held TOTAL here, beside the three schemas a package body is read with, so the
+ * PR that adds a key to `ManifestSchema`, to the stack definition or to the
+ * package export's fixed keys is the PR that reddens — not a later install that
+ * refuses the key with no reason on record.
  */
 import { describe, expect, it } from 'vitest';
 import { ManifestSchema } from './manifest.zod';
 import { ObjectStackDefinitionSchema } from '../stack.zod';
+import { PackageExportManifestSchema } from '../api/package-lifecycle.zod';
 import { PLURAL_TO_SINGULAR } from '../meta-spelling/manifest-collection-spelling';
 import { ASSEMBLED_VIEW_ITEMS_KEY } from '../ui/assembled-views.zod';
 import {
@@ -27,8 +29,10 @@ const collections = new Set([...Object.keys(PLURAL_TO_SINGULAR), ASSEMBLED_VIEW_
 const tombstoned = (schema: unknown) =>
   /^\[REMOVED\]/.test(String((schema as { description?: unknown } | undefined)?.description ?? ''));
 const stackShape = (ObjectStackDefinitionSchema as unknown as { shape: Record<string, unknown> }).shape;
+/** The export's FIXED keys — its open catch-all carries the collections, judged by the registry. */
+const exportShape = PackageExportManifestSchema.shape;
 
-describe('the unmanaged-install key classification is total against both schemas a package body is read with', () => {
+describe('the unmanaged-install key classification is total against the three schemas a package body is read with', () => {
   it('classifies every live ManifestSchema key', () => {
     const missing = Object.entries(ManifestSchema.shape)
       .filter(([key, schema]) => !collections.has(key) && !tombstoned(schema) && !(key in UNMANAGED_INSTALL_KEY_DISPOSITIONS))
@@ -41,8 +45,13 @@ describe('the unmanaged-install key classification is total against both schemas
     expect(missing).toEqual([]);
   });
 
-  it('classifies nothing neither schema declares — a stale row is a lie about a key', () => {
-    const declared = new Set([...Object.keys(ManifestSchema.shape), ...Object.keys(stackShape)]);
+  it('classifies every fixed key of the package export — the body an import elsewhere is handed', () => {
+    const missing = Object.keys(exportShape).filter((key) => !(key in UNMANAGED_INSTALL_KEY_DISPOSITIONS));
+    expect(missing).toEqual([]);
+  });
+
+  it('classifies nothing no schema declares — a stale row is a lie about a key', () => {
+    const declared = new Set([...Object.keys(ManifestSchema.shape), ...Object.keys(stackShape), ...Object.keys(exportShape)]);
     expect(Object.keys(UNMANAGED_INSTALL_KEY_DISPOSITIONS).filter((key) => !declared.has(key))).toEqual([]);
   });
 
@@ -55,6 +64,14 @@ describe('the unmanaged-install key classification is total against both schemas
     expect(UNMANAGED_INSTALL_KEY_DISPOSITIONS.data).toBe('door');
   });
 
+  it('leaves the export\'s `withheldMaps` and `label` to the door — an export is importable as written', () => {
+    // `withheldMaps` (#28640 ruling ③A) is read by the door to name each incomplete map; the
+    // export's `label` has no slot on the base's closed install manifest. Either one left
+    // unclassified refuses every export that carries it as an unrecognised key.
+    expect(UNMANAGED_INSTALL_KEY_DISPOSITIONS.withheldMaps).toBe('door');
+    expect(UNMANAGED_INSTALL_KEY_DISPOSITIONS.label).toBe('door');
+  });
+
   it('refuses exactly code, uncopyable content and an artifact envelope', () => {
     expect([...UNMANAGED_INSTALL_REFUSING_DISPOSITIONS].sort()).toEqual(['code', 'envelope', 'uncopyable']);
   });
 
@@ -17,10 +17,12 @@
  * metadata type's own `allowRuntimeCreate` flag in
  * `DEFAULT_METADATA_TYPE_REGISTRY`, the flag the save door reads.
  *
- * `unmanaged-install.test.ts` holds the table TOTAL against both schemas a
- * package body is read with — `ManifestSchema` and `ObjectStackDefinitionSchema`
- * — so a key either schema gains reddens a spec test on the PR that adds it,
- * instead of being refused at an install door with no reason on record.
+ * `unmanaged-install.test.ts` holds the table TOTAL against the three schemas a
+ * package body is read with — `ManifestSchema`, `ObjectStackDefinitionSchema`
+ * and the fixed keys of `PackageExportManifestSchema` (`@objectstack/spec/api`),
+ * the body `GET /packages/:id/export` writes for an import elsewhere — so a key
+ * any of them gains reddens a spec test on the PR that adds it, instead of
+ * being refused at an install door with no reason on record.
  */
 
 /**
@@ -39,7 +41,8 @@
  *  - `code`       — refused: code, or a descriptor of a code-bearing artifact.
  *  - `uncopyable` — refused: package content the environment ledger has no row for.
  *  - `envelope`   — refused: it describes an artifact, not one package.
- *  - `door`       — not the copy's: read or applied by the install door, and
+ *  - `door`       — not the copy's: read or applied by the install door (or,
+ *                   for an export's display `label`, set aside by it), and
  *                   never written onto the base.
  *  - `deployment` — not the copy's: deployment configuration no install applies.
  */
@@ -62,8 +65,8 @@ export const UNMANAGED_INSTALL_REFUSING_DISPOSITIONS: ReadonlySet<UnmanagedInsta
 
 /**
  * Every non-collection key a package body may carry — the union of
- * `ManifestSchema`'s live keys and the stack definition's non-collection keys —
- * classified for an unmanaged install.
+ * `ManifestSchema`'s live keys, the stack definition's non-collection keys and
+ * the package export's fixed keys — classified for an unmanaged install.
  */
 export const UNMANAGED_INSTALL_KEY_DISPOSITIONS: Readonly<Record<string, UnmanagedInstallKeyDisposition>> = {
   // ── The package's identity ──
@@ -112,6 +115,15 @@ export const UNMANAGED_INSTALL_KEY_DISPOSITIONS: Readonly<Record<string, Unmanag
   // Read by the door to judge the requested mode; the base is the
   // environment's own package and makes no promise about how it installs.
   installModes: 'door',
+  // [#28640 ruling ③A] The export's list of the maps it withheld whole: the
+  // door reads it to name each incomplete map in its answer. It describes the
+  // exchange, not the package, so the base never carries it.
+  withheldMaps: 'door',
+  // The export's display label. No manifest the base is installed with
+  // declares one (`PackageInstallManifestSchema` is closed and has no
+  // `label`), so carrying it would refuse the base; the base is named by the
+  // request's `targetName` or the source `name`.
+  label: 'door',
 
   // ── Deployment configuration: read by a stack's boot, by no install ──
   i18n: 'deployment',