@@ -0,0 +1,17 @@
+---
+'@objectstack/metadata-protocol': patch
+'@objectstack/objectql': patch
+---
+
+fix(metadata-protocol, objectql): a disabled package's export carries its items, so a re-install no longer loses them
+
+Clause-②: yes (widening)
+Metadata-protocol: none
+
+`GET /api/v1/packages/:id/export` and the whole-deployment bundle `GET /api/v1/packages/export` answered a disabled package as an empty package: its id, name and version, and none of its objects, views, dashboards or other items. Installing that entry elsewhere answered 200 and left the items absent. The bundle's own contract (`PackageExportBundleSchema`) exports every package "enabled or not" and installs it enabled, so a tenant who switched a package off and exported the deployment silently lost its contents.
+
+The export reads each package through the protocol's per-package layer (`getMetaItemsPerPackage`), and that layer hid a disabled package's items the way the served reads do. It now keeps them: a disable leaves the items stored, and the package's own address still holds them. Every served and executed read (`/meta/*`, the console, the automation engine) still hides them, unchanged.
+
+`SchemaRegistry.listItems(type, packageId, options)` gains an optional third argument, `{ includeDisabledPackages: true }`, which only the per-package layer passes. Without it the list hides a disabled package's items, as before.
+
+The per-package layer's other reader, the anonymous form doors' withdrawal judgement, now also sees a disabled package's views: a disabled package's view that withdraws a form also closes that form's name in other packages. That only closes forms, never opens one.
@@ -83,6 +83,15 @@ export async function readFlattenedMetaItems(host: Pick<ProtocolHost, 'artifactL
         layer: 'effective' | 'per-package' = 'effective',) {
     const { packageId } = request;
     const servedOverride = layer === 'effective';
+    // [#29871] The per-package layer is each package's own address, and a
+    // disable empties none: a disabled package's items stay stored and come
+    // back on enable. So this layer keeps them (the package export reads it,
+    // and exports every package, enabled or not); the effective and the
+    // execution reads hide them, at the registry and after the merges below.
+    const keepDisabledPackages = layer === 'per-package';
+    const listRegistry = (type: string): unknown[] => (keepDisabledPackages
+        ? host.engine.registry.listItems(type, packageId, { includeDisabledPackages: true })
+        : host.engine.registry.listItems(type, packageId));
     // ── [ADR-0131 D6] The environment → code read ──────────────────────
     //
     // The list serves the environment's stored rows over the code
@@ -101,11 +110,11 @@ export async function readFlattenedMetaItems(host: Pick<ProtocolHost, 'artifactL
     // (plugin-auth, plugin-security, plugin-audit, …) — those are globally
     // shared and must be visible at every project's meta endpoint.
     if (host.environmentId === undefined) {
-        items = [...host.engine.registry.listItems(request.type, packageId)];
+        items = [...listRegistry(request.type)];
         // Normalize singular/plural using explicit mapping
         if (items.length === 0) {
             const alt = PLURAL_TO_SINGULAR[request.type] ?? SINGULAR_TO_PLURAL[request.type];
-            if (alt) items = [...host.engine.registry.listItems(alt, packageId)];
+            if (alt) items = [...listRegistry(alt)];
         }
     } else {
         // For project kernels: the SchemaRegistry is owned by THIS
@@ -115,10 +124,10 @@ export async function readFlattenedMetaItems(host: Pick<ProtocolHost, 'artifactL
         // package alike. The `_packageId` tag added by `listItems`
         // (registry.ts) is preserved for the sidebar to compute the
         // correct navigation URL.
-        items = [...host.engine.registry.listItems(request.type, packageId)];
+        items = [...listRegistry(request.type)];
         if (items.length === 0) {
             const alt = PLURAL_TO_SINGULAR[request.type] ?? SINGULAR_TO_PLURAL[request.type];
-            if (alt) items = [...host.engine.registry.listItems(alt, packageId)];
+            if (alt) items = [...listRegistry(alt)];
         }
     }
 
@@ -746,7 +755,12 @@ export async function readFlattenedMetaItems(host: Pick<ProtocolHost, 'artifactL
     //
     // [#24210] The predicate is {@link isItemOfDisabledPackage}, the one the
     // by-name read asks, so the list and the by-name read hide the same items.
-    if (request.type !== 'package') {
+    //
+    // [#29871] …on the effective and execution reads. The per-package layer
+    // keeps them (see `keepDisabledPackages` above): a package's export is
+    // what the package holds, and an export that dropped a disabled
+    // package's items installed elsewhere as an empty package.
+    if (request.type !== 'package' && !keepDisabledPackages) {
         items = (items as any[]).filter((it) => !isItemOfDisabledPackage(host.engine.registry, it));
     }
     // [#28877] …and, on the effective served list, an action that launches
 
@@ -4201,8 +4201,11 @@ export class ObjectStackProtocolImplementation implements
      * BEFORE the one effective read: {@link getMetaItems} with the served
      * decorations, with every package's item of a name kept (ADR-0048,
      * one item per package of a name), and with no package's declared
-     * override served over that package's own item. The same sources, the
-     * same merges, the same envelope; two steps of the effective read are not
+     * override served over that package's own item, and [#29871] with a
+     * DISABLED package's items kept: a disable hides them from every served
+     * and executed read and leaves them stored (they come back on enable), so
+     * the package's own address still holds them. The same sources, the same
+     * merges, the same envelope; three steps of the effective read are not
      * taken, and nothing else differs.
      *
      * The list {@link getMetaItems} served before ADR-0146 D8, kept for its
@@ -4214,11 +4217,16 @@ export class ObjectStackProtocolImplementation implements
      *    hard requirement ruled on #28238, option 3). So the doors judge it
      *    against this layer beside the effective list, never against a layer
      *    narrower than this one — it still holds a dependent package's
-     *    same-named row and the base's own document under a declared override;
+     *    same-named row and the base's own document under a declared override
+     *    (and a disabled package's view, whose withdrawal can only close a
+     *    form: the doors offer only the effective list's forms);
      *  - **the package export** (`GET /packages/:id/export` in
      *    `@objectstack/runtime`). A package exports its own items: the base's
      *    export carries the base unchanged, and its pair's export carries the
-     *    overriding item with its `overrides` block (ADR-0146 D8 item 3).
+     *    overriding item with its `overrides` block (ADR-0146 D8 item 3); and a
+     *    disabled package's export carries its items, as
+     *    `PackageExportBundleSchema` declares (every package exported, enabled
+     *    or not, and installed enabled).
      *
      * ⛔ Not a second list for anything else. Every door that serves a
      * package's name serves {@link getMetaItems}, the one effective read.
 
@@ -7589,8 +7589,13 @@ export class SchemaRegistry {
 
   /**
    * Universal List Method
+   *
+   * [#29871] `options.includeDisabledPackages` keeps a disabled package's
+   * items. Only the protocol's per-package layer passes it (the package
+   * export, which carries a package's own items enabled or not); every
+   * served read leaves it unset and hides them.
    */
-  listItems<T>(type: string, packageId?: string): T[] {
+  listItems<T>(type: string, packageId?: string, options?: { includeDisabledPackages?: boolean }): T[] {
     // Special handling for 'object' and 'objects' types - use objectContributors
     if (type === 'object' || type === 'objects') {
       return this.getAllObjects(packageId) as unknown as T[];
@@ -7606,7 +7611,7 @@ export class SchemaRegistry {
     // `package` type itself is never filtered — the Packages page must still
     // list disabled packages so they can be re-enabled. Disable is reversible:
     // items remain registered and reappear on enable.
-    if (type !== 'package') {
+    if (type !== 'package' && options?.includeDisabledPackages !== true) {
       result = result.filter((item: any) => !this.isPackageDisabled((item as any)?._packageId));
     }
     return result;
 
@@ -25,6 +25,13 @@
 //      order, with the same namespace, dependencies, and the same item names
 //      and counts per collection.
 //
+// [#29871] A second describe pins the bundle's "enabled or not" for a
+// DISABLED package: a runtime-authored package (`POST /packages`, an object
+// drafted into it and published) is disabled before the export; the bundle
+// and its per-package export still carry the object, and a fresh runtime that
+// installs the entry serves it (`GET /meta/object/<name>` 200), where before
+// the entry was an empty package and the object came back 404.
+//
 // Boots fixture stacks of its own (the install-local plugin mounted on both),
 // so it stays out of `SHARED_SHOWCASE`. Every credential below is an
 // obviously-fake placeholder, and every assertion on one is its absence.
@@ -228,3 +235,90 @@ describe('dogfood: the whole-deployment export round-trips onto a fresh runtime,
     expect((pair?.dashboards ?? []).map((d: any) => [d.name, d.label, d.overrides?.package])).toEqual([[DASHBOARD, EDITED, BASE]]);
   });
 });
+
+const OFF = 'com.dogfood.exportoff';
+const OFF_OBJECT = 'exportoff_note';
+
+describe('dogfood: a disabled package exports its items, and a fresh runtime that installs the entry serves them', () => {
+  const dirs: string[] = [];
+  const answers: Record<string, Answer> = {};
+  let offEntry: any;
+  let previousHome: string | undefined;
+
+  beforeAll(async () => {
+    // Each runtime gets its own home: a disable is persisted there
+    // (`package-state/`) and replayed at boot, so a shared home would carry
+    // the source's disable onto the target, which no fresh runtime has.
+    previousHome = process.env.OS_HOME;
+    const sourceDir = mkdtempSync(join(tmpdir(), 'dogfood-export-disabled-source-'));
+    dirs.push(sourceDir);
+    process.env.OS_HOME = join(sourceDir, 'home');
+    const source = await bootShowcase({
+      extraPlugins: [new MarketplaceInstallLocalPlugin({ controlPlaneUrl: 'off', storageDir: sourceDir })],
+    });
+    try {
+      const token = await source.signIn();
+      answers.created = await call(source, token, 'POST', '/packages', {
+        manifest: { id: OFF, name: 'Export disabled', version: '0.1.0', type: 'app', namespace: 'exportoff' },
+      });
+      answers.saved = await call(source, token, 'PUT', `/meta/object/${OFF_OBJECT}?mode=draft&package=${OFF}`, {
+        name: OFF_OBJECT, label: 'Note', sharingModel: 'private', fields: { body: { type: 'text', label: 'Body' } },
+      });
+      answers.published = await call(source, token, 'POST', `/packages/${OFF}/publish-drafts`, {});
+      answers.enabledExport = await call(source, token, 'GET', `/packages/${OFF}/export`);
+      answers.disabled = await call(source, token, 'PATCH', `/packages/${OFF}/disable`);
+      answers.servedAfterDisable = await call(source, token, 'GET', `/meta/object/${OFF_OBJECT}`);
+      answers.disabledExport = await call(source, token, 'GET', `/packages/${OFF}/export`);
+      answers.bundle = await call(source, token, 'GET', '/packages/export');
+      offEntry = (answers.bundle.body?.data?.packages ?? []).find((p: any) => p?.id === OFF);
+    } finally {
+      await source.stop();
+    }
+
+    const targetDir = mkdtempSync(join(tmpdir(), 'dogfood-export-disabled-target-'));
+    dirs.push(targetDir);
+    process.env.OS_HOME = join(targetDir, 'home');
+    const target = await bootShowcase({
+      extraPlugins: [new MarketplaceInstallLocalPlugin({ controlPlaneUrl: 'off', storageDir: targetDir })],
+    });
+    try {
+      const token = await target.signIn();
+      answers.installed = await call(target, token, 'POST', ROUTE, { manifest: offEntry });
+      answers.targetServed = await call(target, token, 'GET', `/meta/object/${OFF_OBJECT}`);
+    } finally {
+      await target.stop();
+    }
+  }, 900_000);
+
+  afterAll(() => {
+    if (previousHome === undefined) delete process.env.OS_HOME;
+    else process.env.OS_HOME = previousHome;
+    for (const dir of dirs) rmSync(dir, { recursive: true, force: true });
+  });
+
+  const objectsOf = (manifest: any): string[] => (manifest?.objects ?? []).map((o: any) => o?.name);
+
+  it('source: the package is created, its object published, and the disable lands (preconditions)', () => {
+    for (const key of ['created', 'saved', 'published', 'disabled'] as const) {
+      expect(answers[key]?.status, `${key}: ${JSON.stringify(answers[key]?.body)}`).toBeLessThan(300);
+    }
+    expect(answers.disabled.body?.data?.enabled).toBe(false);
+    // CONTROL: enabled, the export carries the object; disabled, the served read hides it.
+    expect(objectsOf(answers.enabledExport.body?.data)).toEqual([OFF_OBJECT]);
+    expect(answers.servedAfterDisable.status).toBe(404);
+  });
+
+  it('source: the disabled package\'s export and its bundle entry still carry its object', () => {
+    expect(answers.disabledExport.status, JSON.stringify(answers.disabledExport.body)).toBe(200);
+    expect(answers.disabledExport.body?.data).toEqual(answers.enabledExport.body?.data);
+    expect(answers.bundle.status, JSON.stringify(answers.bundle.body)).toBe(200);
+    expect(PackageExportBundleSchema.safeParse(answers.bundle.body?.data).success).toBe(true);
+    expect(objectsOf(offEntry), JSON.stringify(offEntry)).toEqual([OFF_OBJECT]);
+  });
+
+  it('target: the entry installs, and the object is served', () => {
+    expect(answers.installed.status, JSON.stringify(answers.installed.body)).toBe(200);
+    expect(answers.installed.body?.data?.manifestId).toBe(OFF);
+    expect(answers.targetServed.status, JSON.stringify(answers.targetServed.body)).toBe(200);
+  });
+});