@@ -75,6 +75,12 @@
  *              none of which writes, and before any write.
  *          A mode the package's `installModes` does not permit answers
  *          `422 INSTALL_MODE_NOT_PERMITTED`, before any write.
+ *          Either mode reads the body's `withheldMaps` — the connector header
+ *          and environment maps a package export withheld whole (#28640
+ *          ruling ③A) — accepts the package, and names each map in its
+ *          answer's `withheldMaps` and in one `warn` line; a list the export's
+ *          declaration refuses answers `PLUGIN_MANIFEST_INVALID` (400 inline,
+ *          502 cloud), before any write.
  *
  *          [ADR-0126 §6 wall 3] A managed RE-install over an installed package
  *          asks the security plugin's access upgrade check
@@ -187,6 +193,9 @@ import {
     unmanagedInstallValueCarries,
     type InstallMode,
 } from '@objectstack/spec/kernel';
+// [#28640 ruling ③A] The export's list of the connector maps it withheld whole,
+// read by both install modes through its one declaration.
+import { PackageExportManifestSchema, type PackageExportManifest } from '@objectstack/spec/api';
 // [#21762] ADR-0087 D1's protocol handshake, its brand predicate and the ONE
 // answer both package-install doors give its refusal. Imported from the
 // producer, never restated: `POST /api/v1/packages` answers through the same
@@ -602,6 +611,57 @@ function isPlainObject(value: unknown): value is Record<string, any> {
     return value !== null && typeof value === 'object' && !Array.isArray(value);
 }
 
+/** One entry of an export's `withheldMaps` ({@link PackageExportManifestSchema}). */
+type WithheldMap = NonNullable<PackageExportManifest['withheldMaps']>[number];
+
+/**
+ * [#28640 ruling ③A] The connector maps the export that produced this body
+ * withheld whole — its `withheldMaps`, parsed through the export's own
+ * declaration ({@link PackageExportManifestSchema}), by reference. Read by
+ * BOTH install modes before any write, so each answer names every map that
+ * arrives incomplete instead of letting it read as one the package never had.
+ *
+ * An absent list is `[]`: a body that is not an export, or an export that
+ * withheld nothing. A list the declaration refuses is refused here, the way
+ * an invalid `installModes` is ({@link judgeInstallMode}): it can only have
+ * been written by hand, and guessing which maps it meant is the silent answer
+ * the list exists to replace. The import never refuses a package FOR an
+ * incomplete map (the ruling: accept, and name each one).
+ */
+function judgeWithheldMaps(
+    manifest: Record<string, any>,
+    manifestId: string,
+    invalidManifestStatus: 400 | 502,
+): { ok: true; withheldMaps: WithheldMap[] } | { ok: false; status: number; error: { code: string; message: string } } {
+    const declared = PackageExportManifestSchema.shape.withheldMaps.safeParse(manifest.withheldMaps);
+    if (!declared.success) {
+        const [issue] = declared.error.issues;
+        return {
+            ok: false,
+            status: invalidManifestStatus,
+            error: {
+                code: 'PLUGIN_MANIFEST_INVALID',
+                message: `Package '${manifestId}' carries an invalid \`withheldMaps\`: ${issue?.message ?? 'refused by its declaration'}`
+                    + `${issue && issue.path.length > 0 ? ` (at \`withheldMaps.${issue.path.join('.')}\`)` : ''}. `
+                    + 'Send the list as the package export wrote it, or omit it.',
+            },
+        };
+    }
+    return { ok: true, withheldMaps: declared.data ?? [] };
+}
+
+/**
+ * [#28640 ruling ③A] The operator's line for an install that received
+ * withheld maps: each one named, once, at `warn` — the connector is installed
+ * and runs, without the headers or environment variables the export held back.
+ */
+function withheldMapsLogLine(manifestId: string, mode: InstallMode, withheldMaps: readonly WithheldMap[]): string {
+    const named = withheldMaps.map((m) => `${m.type} '${m.name}' ${m.path}`).join(', ');
+    return `[MarketplaceInstallLocal] installed ${manifestId} ${mode} with ${withheldMaps.length} connector map(s) the `
+        + `package export withheld whole, each now absent: ${named}. The connector sends none of those headers or `
+        + 'environment variables until each map is supplied again where the connector is authored.';
+}
+
 /**
  * [ADR-0131 D6] The package manifest an install body DECLARES — where each of
  * the two single-package shapes this door accepts carries it: a compiled
@@ -1925,6 +1985,15 @@ export class MarketplaceInstallLocalPlugin implements Plugin {
             }, UNRUNNABLE_REFUSAL_STATUS);
         }
 
+        // 1d'. [#28640 ruling ③A] THE MAPS THE EXPORT WITHHELD, read for both
+        //     modes before any write: each answer names every connector map
+        //     that arrives incomplete ({@link judgeWithheldMaps}). Accepted,
+        //     never refused for, as the ruling has it; only a list the export's
+        //     declaration refuses is.
+        const withheld = judgeWithheldMaps(manifest, manifestId, inlineManifest ? 400 : 502);
+        if (!withheld.ok) return c.json({ success: false, error: withheld.error }, withheld.status as any);
+        const { withheldMaps } = withheld;
+
         // ── [ADR-0131 D6] The `unmanaged` install: a copy, not a registration.
         //    The package's metadata is copied ONCE into a new writable base in
         //    the environment ledger by the import verb, and the steps below —
@@ -1940,6 +2009,7 @@ export class MarketplaceInstallLocalPlugin implements Plugin {
                 version,
                 versionId: resolvedVersionId,
                 userId,
+                withheldMaps,
             });
         }
 
@@ -2308,6 +2378,7 @@ export class MarketplaceInstallLocalPlugin implements Plugin {
         // The door is named only when it can store one of them: a listing that
         // says none is writable (a walled posture) gets the other places.
         const door = described?.writable === undefined || unsetRefs.some((r) => described.writable!.has(r));
+        if (withheldMaps.length > 0) ctx.logger?.warn?.(withheldMapsLogLine(manifestId, 'managed', withheldMaps));
 
         return c.json({
             success: true,
@@ -2333,6 +2404,10 @@ export class MarketplaceInstallLocalPlugin implements Plugin {
                 // that declares none, so that answer's key set is unchanged.
                 ...(datasources !== undefined ? { datasources } : {}),
                 ...(unsetRefs.length > 0 ? { credentialNote: installedCredentialNote(unsetRefs, { door }) } : {}),
+                // [#28640 ruling ③A] Each connector map the package export
+                // withheld whole, so it arrived absent. Omitted when there are
+                // none, so that answer's key set is unchanged.
+                ...(withheldMaps.length > 0 ? { withheldMaps } : {}),
                 upgradedFrom: conflict === 'marketplace' ? 'previous-marketplace-version' : null,
                 // [ADR-0146 D2, #28410] Names installed dependents already held,
                 // undeclared, that this version now ships (step 2d). Omitted when
@@ -3538,14 +3613,21 @@ export class MarketplaceInstallLocalPlugin implements Plugin {
      *    either spelling, and the copy does not keep, with the package's
      *    reason — is the verb's own
      *    list, relayed as the verb states it, so the installer reads why the
-     *    vendor locked an item before editing it.
+     *    vendor locked an item before editing it;
+     *  - `withheldMaps` — every connector map the package export withheld
+     *    whole, read by {@link handleInstall} before the verb runs — is on the
+     *    answer and on a `warn` line: the copy carries each map absent.
      */
     private installUnmanaged = async (
         c: any,
         ctx: PluginContext,
-        args: { manifest: Record<string, any>; manifestId: string; version: string; versionId: string; userId: string | null },
+        args: {
+            manifest: Record<string, any>; manifestId: string; version: string; versionId: string; userId: string | null;
+            /** [#28640 ruling ③A] The connector maps the export withheld ({@link judgeWithheldMaps}). */
+            withheldMaps: readonly WithheldMap[];
+        },
     ): Promise<Response> => {
-        const { manifest, manifestId, version, versionId, userId } = args;
+        const { manifest, manifestId, version, versionId, userId, withheldMaps } = args;
         let protocol: UnmanagedImporter | undefined;
         try { protocol = ctx.getService<UnmanagedImporter>('protocol'); } catch { /* no protocol service */ }
         if (!protocol || typeof protocol.importUnmanagedPackage !== 'function') {
@@ -3598,6 +3680,7 @@ export class MarketplaceInstallLocalPlugin implements Plugin {
             + `${installedFrom.packageId}${installedFrom.version ? `@${installedFrom.version}` : ''}`
             + `${userId ? ` by ${userId}` : ''}. Nothing is registered under '${manifestId}'; the copy follows no upgrade.`,
         );
+        if (withheldMaps.length > 0) ctx.logger?.warn?.(withheldMapsLogLine(manifestId, 'unmanaged', withheldMaps));
         const declaresSeeds = unmanagedInstallValueCarries(packageBody.data);
         return c.json({
             success: true,
@@ -3613,6 +3696,10 @@ export class MarketplaceInstallLocalPlugin implements Plugin {
                 copiedCount: result.copiedCount,
                 copied: result.copied,
                 strippedLocks: result.strippedLocks,
+                // [#28640 ruling ③A] Each connector map the package export
+                // withheld whole, so its copy carries it absent. Omitted when
+                // there are none, so that answer's key set is unchanged.
+                ...(withheldMaps.length > 0 ? { withheldMaps: [...withheldMaps] } : {}),
                 ...(declaresSeeds
                     ? {
                         seeded: {
 
@@ -0,0 +1,181 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#28640 ruling ③A] install-local reads a package export's `withheldMaps` —
+ * the connector header and environment maps the export withheld whole — in
+ * BOTH install modes, at the real install seam (the plugin's own route,
+ * mounted through `start()` + `kernel:ready`).
+ *
+ * Pinned:
+ *  - a managed install of a body carrying the list installs, and its answer
+ *    names each map, as the export wrote it, with one `warn` line naming them;
+ *  - an unmanaged install of such a body copies it, and its answer names each
+ *    map the same way;
+ *  - a body without the list answers with no `withheldMaps` key at all, in
+ *    either mode — the answer's key set is unchanged;
+ *  - a list the export's declaration refuses (a position outside the four, a
+ *    header name) answers `PLUGIN_MANIFEST_INVALID`, 400 inline, before any
+ *    write: nothing registered, ledgered or imported.
+ */
+
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+// The runtime binder the door's step 1d loads lazily — paid here, at module
+// top, never inside a clocked `it` (`scripts/check-test-source-alias.mjs`).
+import '@objectstack/runtime';
+import { MarketplaceInstallLocalPlugin } from './marketplace-install-local-plugin.js';
+import { installerAuthService, withInstallerGrants } from './install-local-principal.fixtures.js';
+import { LocalManifestSource } from './local-manifest-source.js';
+
+const ROUTE = '/api/v1/marketplace/install-local';
+const INSTALLER = 'usr_installer';
+
+type Handler = (c: any) => Promise<any>;
+
+function makeC(body: any) {
+    const json = vi.fn((payload: any, status?: number) => ({ payload, status: status ?? 200 }));
+    return {
+        req: {
+            url: `http://localhost:3000${ROUTE}`,
+            raw: new Request(`http://localhost:3000${ROUTE}`),
+            json: async () => body,
+            param: () => undefined,
+        },
+        json,
+    };
+}
+
+async function mount(dir: string) {
+    const routes = new Map<string, Handler>();
+    const rawApp = {
+        get: (p: string, h: Handler) => routes.set(`GET ${p}`, h),
+        post: (p: string, h: Handler) => routes.set(`POST ${p}`, h),
+        delete: (p: string, h: Handler) => routes.set(`DELETE ${p}`, h),
+    };
+    const hooks = new Map<string, any>();
+    const register = vi.fn(async () => undefined);
+    const importUnmanagedPackage = vi.fn(async (request: any) => ({
+        sourcePackageId: request.manifest.id,
+        sourceVersion: request.manifest.version,
+        targetPackageId: `${request.manifest.id}-copy`,
+        namespace: request.manifest.namespace,
+        copiedCount: request.manifest.connectors?.length ?? 0,
+        copied: (request.manifest.connectors ?? []).map((c: any) => ({ type: 'connector', name: c.name })),
+        strippedLocks: [],
+    }));
+    const services: Record<string, any> = {
+        manifest: { register },
+        auth: installerAuthService(INSTALLER),
+        objectql: withInstallerGrants({
+            syncSchemas: vi.fn(async () => undefined),
+            manifests: new Map(),
+            registry: { getAllPackages: () => [], getNamespaceOwners: () => [], getPackage: () => undefined },
+        }, INSTALLER),
+        protocol: { importUnmanagedPackage },
+    };
+    const logger = { info: vi.fn(), warn: vi.fn(), error: vi.fn() };
+    const ctx = {
+        hook: (e: string, h: any) => hooks.set(e, h),
+        getService: (name: string) => {
+            if (name === 'http-server') return { getRawApp: () => rawApp };
+            const svc = services[name];
+            if (svc === undefined) throw new Error(`no ${name}`);
+            return svc;
+        },
+        logger,
+    };
+    const plugin = new MarketplaceInstallLocalPlugin({ controlPlaneUrl: 'off', storageDir: dir });
+    await plugin.start(ctx as any);
+    await hooks.get('kernel:ready')?.();
+    register.mockClear();
+    return {
+        install: (body: unknown) => routes.get(`POST ${ROUTE}`)!(makeC(body)),
+        register,
+        importUnmanagedPackage,
+        logger,
+        ledgerHas: (id: string) => new LocalManifestSource(dir).read(id).entry !== null,
+    };
+}
+
+const WITHHELD = [
+    { type: 'connector', name: 'crm_billing', path: 'providerConfig.headers' },
+    { type: 'connector', name: 'crm_billing', path: 'providerConfig.defaultHeaders' },
+    { type: 'connector', name: 'crm_tools', path: 'providerConfig.transport.env' },
+];
+
+/** A package as `GET /packages/:id/export` writes it: connectors served, their maps absent. */
+function exported(extra: Record<string, unknown> = {}): Record<string, unknown> {
+    return {
+        id: 'com.example.crm',
+        name: 'crm',
+        version: '4.0.0',
+        namespace: 'crm',
+        installModes: ['managed', 'unmanaged'],
+        connectors: [
+            { name: 'crm_billing', label: 'Billing', type: 'api', provider: 'rest', providerConfig: { baseUrl: 'https://billing.example.com' } },
+            { name: 'crm_tools', label: 'Tools', type: 'api', provider: 'mcp', providerConfig: { transport: { kind: 'stdio', command: 'crm-tools' } } },
+        ],
+        ...extra,
+    };
+}
+
+let dir: string;
+beforeEach(() => { dir = mkdtempSync(join(tmpdir(), 'mil-withheld-maps-')); });
+afterEach(() => {
+    rmSync(dir, { recursive: true, force: true });
+    vi.restoreAllMocks();
+});
+
+describe('install-local — the maps a package export withheld (`withheldMaps`)', () => {
+    it('a managed install accepts the package and names each withheld map in its answer and one warn line', async () => {
+        const h = await mount(dir);
+        const res = await h.install({ manifest: exported({ withheldMaps: WITHHELD }) });
+        expect(res.status, JSON.stringify(res.payload)).toBe(200);
+        expect(res.payload.data.withheldMaps).toEqual(WITHHELD);
+        expect(h.register).toHaveBeenCalledTimes(1);
+        expect(h.ledgerHas('com.example.crm')).toBe(true);
+        const lines = h.logger.warn.mock.calls.map((call) => String(call[0])).filter((l) => l.includes('withheld whole'));
+        expect(lines).toHaveLength(1);
+        for (const m of WITHHELD) expect(lines[0]).toContain(`connector '${m.name}' ${m.path}`);
+    });
+
+    it('an unmanaged install copies the package and names each withheld map in its answer', async () => {
+        const h = await mount(dir);
+        const res = await h.install({ manifest: exported({ withheldMaps: WITHHELD }), installMode: 'unmanaged' });
+        expect(res.status, JSON.stringify(res.payload)).toBe(200);
+        expect(res.payload.data.installMode).toBe('unmanaged');
+        expect(res.payload.data.withheldMaps).toEqual(WITHHELD);
+        expect(h.importUnmanagedPackage).toHaveBeenCalledTimes(1);
+        expect(h.register).not.toHaveBeenCalled();
+        const lines = h.logger.warn.mock.calls.map((call) => String(call[0])).filter((l) => l.includes('withheld whole'));
+        expect(lines).toHaveLength(1);
+        expect(lines[0]).toContain('unmanaged');
+    });
+
+    it.each([['managed'], ['unmanaged']] as const)('a %s install of a body without the list answers no `withheldMaps` key, and warns nothing', async (installMode) => {
+        const h = await mount(dir);
+        const res = await h.install({ manifest: exported(), installMode });
+        expect(res.status, JSON.stringify(res.payload)).toBe(200);
+        expect(res.payload.data).not.toHaveProperty('withheldMaps');
+        expect(h.logger.warn.mock.calls.some((call) => String(call[0]).includes('withheld whole'))).toBe(false);
+    });
+
+    it.each([
+        ['a position outside the four', [{ type: 'connector', name: 'crm_billing', path: 'auth.token' }]],
+        ['a list of header names', [{ type: 'connector', name: 'crm_billing', path: 'providerConfig.headers', keys: ['Authorization'] }]],
+        ['a value that is not a list', 'providerConfig.headers'],
+    ])('refuses %s — PLUGIN_MANIFEST_INVALID, 400 inline, nothing written in either mode', async (_label, withheldMaps) => {
+        for (const installMode of ['managed', 'unmanaged'] as const) {
+            const h = await mount(dir);
+            const res = await h.install({ manifest: exported({ withheldMaps }), installMode });
+            expect(res.status, JSON.stringify(res.payload)).toBe(400);
+            expect(res.payload.error.code).toBe('PLUGIN_MANIFEST_INVALID');
+            expect(res.payload.error.message).toContain('withheldMaps');
+            expect(h.register).not.toHaveBeenCalled();
+            expect(h.importUnmanagedPackage).not.toHaveBeenCalled();
+            expect(h.ledgerHas('com.example.crm')).toBe(false);
+        }
+    });
+});