@@ -9,8 +9,8 @@ Metadata-protocol: added
 
 `GET /packages/:id/export` writes each item as a served read returns it, so a connector's header and environment-variable maps are already withheld whole by the connector redactor and the exported item simply lacks them. An import elsewhere could not tell such a map from one the package never had. The export contract now has a place to say so:
 
-- **`PackageExportManifestSchema` gains an optional fixed key `withheldMaps`**, a list of `{ type, name, path }`: `type` is `connector`, `name` is the connector item's name, and `path` is one of the four positions the redactor withholds whole, spelled as it reports them: `providerConfig.headers`, `providerConfig.defaultHeaders`, `providerConfig.transport.headers`, `providerConfig.transport.env`. Positions only: no header or variable name is listed, and an entry carrying any other key is refused. Absent when the export withheld nothing. The export does not write it yet; the runtime half follows.
-- **`UNMANAGED_INSTALL_KEY_DISPOSITIONS` classifies `withheldMaps` as `door`**, so an unmanaged import accepts an export that carries it instead of refusing the whole package for an unrecognised key. The door reads it; the new base never carries it.
+- **`PackageExportManifestSchema` gains an optional fixed key `withheldMaps`**, a list of `{ type, name, path }`: `type` is `connector`, `name` is the connector item's name, and `path` is one of the four positions the redactor withholds whole, spelled as it reports them: `providerConfig.headers`, `providerConfig.defaultHeaders`, `providerConfig.transport.headers`, `providerConfig.transport.env`. Positions only: no header or variable name is listed, and an entry carrying any other key is refused. It is declared ahead of its producer: no export writes it and no install door reads it yet, and its describe opens `[PLANNED — not yet served]` until the runtime half serves it. Until then, an export's lack of the key says nothing about what was withheld.
+- **`UNMANAGED_INSTALL_KEY_DISPOSITIONS` classifies `withheldMaps` as `door`**, so an unmanaged import accepts an export that carries it instead of refusing the whole package for an unrecognised key. The runtime half has the door read it to name each incomplete map; the new base never carries it.
 - **The export's `label` is classified `door` too.** The export contract has always declared it, but the table never classified it, so an unmanaged import refused any export that carried one. The base's install manifest declares no `label`, so the base is named by the request's `targetName` or the source `name`, as before.
 
 The table's totality test now reads the export's fixed keys as a third schema a package body is read with, beside `ManifestSchema` and the stack definition, so a fixed key the export gains reddens a spec test on the PR that adds it.
@@ -239,6 +239,13 @@ describe('PackageExportManifestSchema.withheldMaps names each map the export wit
     if (result.success) expect(result.data).toEqual(manifest);
   });
 
+  it('is declared ahead of its producer: the describe opens with the planned marker and names the ADR, never a tracker id', () => {
+    const description = PackageExportManifestSchema.shape.withheldMaps.description ?? '';
+    expect(description).toMatch(/^\[PLANNED — not yet served\] /);
+    expect(description).toContain('ADR-0049');
+    expect(description).not.toMatch(/#\d{3,}/);
+  });
+
   it('is optional — an export that withheld nothing, or one from before the key, still parses', () => {
     expect(PackageExportManifestSchema.safeParse(identity).success).toBe(true);
   });
 
@@ -37,6 +37,13 @@
  * declared a VERSION rollback against the live COMMIT-rollback path;
  * `RollbackToPackageCommitResponseSchema` below is the true contract,
  * authored after that retirement per the ruling's sequencing (3A).
+ *
+ * Two members are not transcriptions but DECLARED AHEAD OF THEIR PRODUCER
+ * (ADR-0049), each describe opening `[PLANNED — not yet served]` until the
+ * change that serves it drops the marker: the `nav` arm of
+ * `GetPackageCustomizationsResponseSchema.contributions` (#27928) and
+ * `PackageExportManifestSchema.withheldMaps` (#28640 ruling ③A, served by
+ * #29342). Their own docblocks say what is not served yet.
  */
 
 import { z } from 'zod';
@@ -190,12 +197,23 @@ export const RollbackToPackageCommitResponseSchema = lazySchema(() => z.object({
  * redactor's, not a contract of the export. The path vocabulary is the
  * redactor's own `redactedKeys` spelling of those four positions, and
  * `package-lifecycle.test.ts` holds the two equal.
+ *
+ * DECLARED AHEAD OF ITS PRODUCER (ADR-0049): `withheldMaps` is declared
+ * before any export writes it and before any install door reads it. Until the
+ * server half (#29342) makes `assemblePackageManifest` write the list and both
+ * install doors name each incomplete map, no export carries it; its describe
+ * opens `[PLANNED — not yet served]`, and #29342 drops the marker in the change
+ * that serves it (the pin is in `package-lifecycle.test.ts`). Its `door` row in
+ * `UNMANAGED_INSTALL_KEY_DISPOSITIONS` is live today: it keeps the unmanaged
+ * import from refusing an export that carries the key.
  */
 export const PackageExportManifestSchema = lazySchema(() => z.object({
   id: z.string().describe('The exported package\'s id.'),
   name: z.string().describe('The exported package\'s machine name.'),
   version: z.string().describe('The exported package\'s version.'),
   label: z.string().optional().describe('Display label, when the package declares one.'),
+  // Declared ahead of its producer: #29342 writes and reads it, and drops the
+  // `[PLANNED — not yet served]` marker in that change.
   withheldMaps: z.array(z.object({
     type: z.literal('connector').describe('Metadata type of the item whose map was withheld.'),
     name: z.string().describe('Name of the item whose map was withheld.'),
@@ -206,11 +224,13 @@ export const PackageExportManifestSchema = lazySchema(() => z.object({
       'providerConfig.transport.env',
     ]).describe('Dot path of the withheld map inside the item.'),
   }).strict()).optional().describe(
-    'Every map the export withheld WHOLE because a served read never carries it: a connector\'s '
-    + 'header and environment-variable maps. The item is written with that map absent, so an import '
-    + 'reads this list to tell an incomplete map from one the package never had, and names each one '
-    + 'for an operator to re-enter. Positions only: no header or variable name is listed. Absent '
-    + 'when the export withheld nothing.',
+    '[PLANNED — not yet served] Declared ahead of its producer (ADR-0049): no export writes this list '
+    + 'yet and no install door reads it yet. Every map the export withheld WHOLE because a served read '
+    + 'never carries it: a connector\'s header and environment-variable maps. The item is written with '
+    + 'that map absent, so once served an import reads this list to tell an incomplete map from one the '
+    + 'package never had, and names each one for an operator to re-enter. Positions only: no header or '
+    + 'variable name is listed. Absence says nothing about what was withheld when the exporter predates '
+    + 'this key; from an exporter that writes it, absence means nothing was withheld.',
   ),
 }).catchall(z.unknown().describe(
   'One key per metadata type present in the package (plural spelling, e.g. '
 
@@ -115,9 +115,11 @@ export const UNMANAGED_INSTALL_KEY_DISPOSITIONS: Readonly<Record<string, Unmanag
   // Read by the door to judge the requested mode; the base is the
   // environment's own package and makes no promise about how it installs.
   installModes: 'door',
-  // [#28640 ruling ③A] The export's list of the maps it withheld whole: the
-  // door reads it to name each incomplete map in its answer. It describes the
-  // exchange, not the package, so the base never carries it.
+  // [#28640 ruling ③A] The export's list of the maps it withheld whole,
+  // declared ahead of its producer: the server half (#29342) has the door read
+  // it to name each incomplete map in its answer. This row is live today — it
+  // keeps the import from refusing an export that carries the key. It
+  // describes the exchange, not the package, so the base never carries it.
   withheldMaps: 'door',
   // The export's display label. No manifest the base is installed with
   // declares one (`PackageInstallManifestSchema` is closed and has no