@@ -0,0 +1,20 @@
+---
+'@objectstack/objectql': patch
+'@objectstack/metadata-protocol': patch
+'@objectstack/runtime': patch
+---
+
+fix(objectql, metadata-protocol, runtime): a package's export carries the `objectExtensions` it was installed with, and the extended object's owner's export does not
+
+Clause-②: yes (widening)
+Metadata-protocol: none
+
+A package installed through `POST /api/v1/marketplace/install-local` (what `os package install` sends, and how every entry of a whole-deployment export is restored) that extends another package's object exported without its `objectExtensions`: `GET /api/v1/packages/<id>/export` answered the package's other items and no extension, while the extension's fields were folded into the owner's export instead, as if the owner had shipped them. So a deployment restored from an export lost those fields on its next export, with no error, and a `.custom` pair installed from its export no longer exported its extension.
+
+- **The extending package's export** (and its entry in `GET /api/v1/packages/export`) now carries every extension it contributes as `objectExtensions`, however it was installed: an extension published through `/api/v1/meta/object_extension` (as before) or a manifest's `objectExtensions` entry (install-local, or a code package). A published extension is exported as it is stored; a manifest entry as it was registered, with `priority` written only when it is not the default `200`.
+- **The extended object's owner's export** now carries the object as the owner declares it, without the fields, field patches or labels of ANY other package's extension. Until now only its own `.custom` pair's extension was left out; an extension from any other installed package was folded in.
+- **Every served read is unchanged**: `GET /api/v1/meta/object/<name>`, the object list, the console and the data API keep serving the object with every extension folded in.
+
+`SchemaRegistry` gains `getObjectExtensionsOf(packageId)`, which reads a package's `extend` contributions back as the `objectExtensions` entries they were registered from (the inverse of `registerObjectExtension`). `listItems`, `getAllObjects` and `foldObjectExtendersOnto` take an `onlyExtensionsOf` option beside `withoutExtensionsOf`: each object is resolved with only that package's `extend` contributions folded in. The metadata protocol's per-package layer (the package export) now passes `onlyExtensionsOf`, naming the listed package, and no longer passes `withoutExtensionsOf`, which keeps its meaning for any other caller.
+
+Supersedes, in the same release: the `.custom` pair note for #29903 says an extension contributed by any other installed package is still folded into the base's object in the base's export. After this change it is not: the base's export leaves out every other package's extension, and that package's own export carries it.
@@ -0,0 +1,15 @@
+---
+'@objectstack/plugin-security': patch
+---
+
+fix(plugin-security): a delegated administrator's refused assignment write answers the same for a row it cannot read as for a missing one
+
+Clause-②: no
+Metadata-protocol: none
+
+A delegated administrator — a caller holding an `adminScope`, an organization administrator who holds one included — updates or removes an assignment row (`sys_user_position` or `sys_user_permission_set`) by id. The delegated-administration gate (ADR-0090 D12) now asks first whether the caller itself reads that row, in its own context.
+
+- **A row the caller cannot read** is refused with exactly the answer an id that names no row gets: `403 PERMISSION_DENIED`, "the assignment row it addresses could not be read", with the same details. Both are answered by the gate; an id that names no row is no longer handed on, so a removal of one answers that refusal instead of `404 RECORD_NOT_FOUND`.
+- **A row the caller reads** keeps the verdict and the guidance it had: the gate judges the stored row, as before.
+- **A caller the read door refuses outright** (no read grant on the table) is answered as before: the read refusal, for every id the gate refuses, and the writes it was admitted are still admitted.
+- **Unchanged.** Inserts, tenant-level administrators, and organization administrators who hold no scope are judged as before.
@@ -89,19 +89,19 @@ export async function readFlattenedMetaItems(host: Pick<ProtocolHost, 'artifactL
     // and exports every package, enabled or not); the effective and the
     // execution reads hide them, at the registry and after the merges below.
     const keepDisabledPackages = layer === 'per-package';
-    // [#29903, ADR-0146 D8 item 3] …and it serves a package's objects as the
-    // package declares them: its `.custom` pair's extension of one is the
-    // pair's item, exported as the pair's `objectExtensions` entry, never
-    // folded into the base's object for the base's export (a field and its
-    // patches would travel twice, the second time as the base's). Every
-    // other contributor folds as on the effective read, and the effective
-    // and execution reads keep the pair's extension in the object they serve.
-    const pairOfLayer = layer === 'per-package' && packageId ? customizationPackageId(packageId) : undefined;
-    const withoutExtensionsOf = pairOfLayer?.ok ? pairOfLayer.value : undefined;
+    // [#29903, #29872, ADR-0146 D8 item 3] …and it serves a package's objects
+    // as the package declares them: another package's extension of one (the
+    // `.custom` pair's, or any other installed package's) is that package's,
+    // exported as its own `objectExtensions` entry, never folded into the
+    // owner's object for the owner's export (a field and its patches would
+    // travel twice, the second time as the owner's). Only the package's own
+    // extensions fold, and the effective and execution reads keep every
+    // extension in the object they serve.
+    const onlyExtensionsOf = layer === 'per-package' && packageId ? packageId : undefined;
     const listRegistry = (type: string): unknown[] => (keepDisabledPackages
         ? host.engine.registry.listItems(type, packageId, {
             includeDisabledPackages: true,
-            ...(withoutExtensionsOf !== undefined ? { withoutExtensionsOf } : {}),
+            ...(onlyExtensionsOf !== undefined ? { onlyExtensionsOf } : {}),
         })
         : host.engine.registry.listItems(type, packageId));
     // ── [ADR-0131 D6] The environment → code read ──────────────────────
@@ -263,10 +263,10 @@ export async function readFlattenedMetaItems(host: Pick<ProtocolHost, 'artifactL
                 // object disagree the moment a row exists. Both routes were
                 // wrong here together, which is why #7556's byName===listed
                 // pin stayed green through this defect.
-                // [#29903] …without the package's pair's extension on the
-                // per-package layer, as its registry items are listed.
+                // [#29903, #29872] …with only the package's own extensions on
+                // the per-package layer, as its registry items are listed.
                 return host.foldObjectExtendersFromRegistry(
-                    request.type, (data as { name?: unknown } | null)?.name, data, withoutExtensionsOf,
+                    request.type, (data as { name?: unknown } | null)?.name, data, onlyExtensionsOf,
                 );
             }, unseated, { servedOverride });
 
 
@@ -46,7 +46,7 @@ export function foldObjectExtendersFromRegistry(
     type: string,
     name: unknown,
     body: unknown,
-    withoutExtensionsOf?: string,
+    onlyExtensionsOf?: string,
 ): unknown {
     const singular = PLURAL_TO_SINGULAR[type] ?? type;
     if (singular !== 'object') return body;
@@ -60,11 +60,12 @@ export function foldObjectExtendersFromRegistry(
     // cannot fold answers exactly as it did before.
     if (!registry || typeof registry.foldObjectExtendersOnto !== 'function') return body;
     try {
-        // [#29903] `withoutExtensionsOf`: that package's `extend` contributions
-        // are left out of the fold (the per-package layer names a base's pair).
-        return withoutExtensionsOf === undefined
+        // [#29903, #29872] `onlyExtensionsOf`: every other package's `extend`
+        // contributions are left out of the fold (the per-package layer names
+        // the listed package).
+        return onlyExtensionsOf === undefined
             ? registry.foldObjectExtendersOnto(name, body)
-            : registry.foldObjectExtendersOnto(name, body, { withoutExtensionsOf });
+            : registry.foldObjectExtendersOnto(name, body, { onlyExtensionsOf });
     } catch {
         // The fold is a read over in-memory contributors; a failure here
         // must not turn a served schema into a 5xx.
 
@@ -3526,13 +3526,13 @@ export class ObjectStackProtocolImplementation implements
      * (see {@link SchemaRegistry.foldObjectExtendersOnto}), so applying it twice
      * would duplicate both.
      */
-    private foldObjectExtendersFromRegistry(type: string, name: unknown, body: unknown, withoutExtensionsOf?: string): unknown {
+    private foldObjectExtendersFromRegistry(type: string, name: unknown, body: unknown, onlyExtensionsOf?: string): unknown {
         // [#25467 cut 30] The body moved to `protocol-object-extender-fold.ts` (see `ObjectExtenderFoldHost`).
         const readEngine = () => this.engine;
         const host: ThisParameterType<typeof foldObjectExtendersFromRegistry> = {
             get engine() { return readEngine(); },
         };
-        return foldObjectExtendersFromRegistry.call(host, type, name, body, withoutExtensionsOf);
+        return foldObjectExtendersFromRegistry.call(host, type, name, body, onlyExtensionsOf);
     }
 
     /**
 
@@ -21,6 +21,7 @@ import { describe, it, expect, vi, afterEach } from 'vitest';
 import { SchemaRegistry } from './registry.js';
 import { ObjectQL } from './engine.js';
 import { fieldPatchTargetRefusals } from '@objectstack/metadata-core';
+import { ObjectExtensionSchema } from '@objectstack/spec/data';
 
 const OWNER_PKG = 'com.vendor.crm';
 const EXT_PKG = 'com.acme.crm-display';
@@ -406,7 +407,7 @@ describe('ADR-0146 D10 — the manifest loop carries fieldPatches onto the exten
   });
 });
 
-describe('#29903 — a read can leave one package\'s extensions out of the fold', () => {
+describe('#29903, #29872 — a read can fold only one package\'s own extensions', () => {
   const PAIR_PKG = `${OWNER_PKG}.custom`;
   /** The vendor's object, a third package's patch, and the pair's field plus its patch. */
   function extended(): SchemaRegistry {
@@ -424,31 +425,80 @@ describe('#29903 — a read can leave one package\'s extensions out of the fold'
     industry: body?.fields?.industry?.label,
     name: body?.fields?.name?.label,
   });
-  const listed = (reg: SchemaRegistry, options?: { withoutExtensionsOf?: string }) =>
-    (reg.listItems<any>('object', OWNER_PKG, options)).find((o) => o?.name === OBJ);
+  const listed = (reg: SchemaRegistry, packageId: string, options?: { withoutExtensionsOf?: string; onlyExtensionsOf?: string }) =>
+    (reg.listItems<any>('object', packageId, options)).find((o) => o?.name === OBJ);
 
-  it('the listed object without the pair\'s extension is the object as no pair had extended it', () => {
+  it('[#29903] `withoutExtensionsOf` leaves that one package\'s extension out, and folds every other', () => {
     const reg = extended();
-    expect(shape(listed(reg, { withoutExtensionsOf: PAIR_PKG }))).toEqual({ region: false, industry: 'Industry', name: 'Account name' });
-    expect(listed(reg, { withoutExtensionsOf: PAIR_PKG })?._packageId).toBe(OWNER_PKG);
-    // CONTROL: every other read of the object still folds the pair in.
-    expect(shape(listed(reg))).toEqual({ region: true, industry: 'Sector (customized)', name: 'Account name' });
-    expect(shape(reg.getObject(OBJ))).toEqual({ region: true, industry: 'Sector (customized)', name: 'Account name' });
+    expect(shape(listed(reg, OWNER_PKG, { withoutExtensionsOf: PAIR_PKG }))).toEqual({ region: false, industry: 'Industry', name: 'Account name' });
+    expect(listed(reg, OWNER_PKG, { withoutExtensionsOf: PAIR_PKG })?._packageId).toBe(OWNER_PKG);
+    expect(shape(reg.foldObjectExtendersOnto(OBJ, vendorAccount(), { withoutExtensionsOf: PAIR_PKG })))
+      .toEqual({ region: false, industry: 'Industry', name: 'Account name' });
     // A package that extends nothing changes nothing: the cached merged object.
-    expect(listed(reg, { withoutExtensionsOf: 'com.nobody' })).toBe(reg.getObject(OBJ));
+    expect(listed(reg, OWNER_PKG, { withoutExtensionsOf: 'com.nobody' })).toBe(reg.getObject(OBJ));
+  });
+
+  it('the owner\'s listed object with only its own extensions is the object as no package had extended it', () => {
+    const reg = extended();
+    // Neither the pair's extension nor the third package's is folded in.
+    expect(shape(listed(reg, OWNER_PKG, { onlyExtensionsOf: OWNER_PKG }))).toEqual({ region: false, industry: 'Industry', name: 'Name' });
+    expect(listed(reg, OWNER_PKG, { onlyExtensionsOf: OWNER_PKG })?._packageId).toBe(OWNER_PKG);
+    // CONTROL: every other read of the object still folds both in.
+    expect(shape(listed(reg, OWNER_PKG))).toEqual({ region: true, industry: 'Sector (customized)', name: 'Account name' });
+    expect(shape(reg.getObject(OBJ))).toEqual({ region: true, industry: 'Sector (customized)', name: 'Account name' });
+  });
+
+  it('an extender\'s listed object folds that extender\'s own extension only', () => {
+    expect(shape(listed(extended(), EXT_PKG, { onlyExtensionsOf: EXT_PKG }))).toEqual({ region: false, industry: 'Industry', name: 'Account name' });
   });
 
-  it('leaving the pair out is the answer a registry with no pair gives, byte for byte', () => {
+  it('an object no other package extends is the cached merged object', () => {
     const reg = withVendor();
-    extend(reg, { name: { label: 'Account name' } });
-    expect(JSON.stringify(listed(extended(), { withoutExtensionsOf: PAIR_PKG }))).toBe(JSON.stringify(listed(reg)));
+    expect(listed(reg, OWNER_PKG, { onlyExtensionsOf: OWNER_PKG })).toBe(reg.getObject(OBJ));
+  });
+
+  it('leaving every other package out is the answer a registry with no extender gives, byte for byte', () => {
+    expect(JSON.stringify(listed(extended(), OWNER_PKG, { onlyExtensionsOf: OWNER_PKG })))
+      .toBe(JSON.stringify(listed(withVendor(), OWNER_PKG)));
   });
 
-  it('the fold onto a stored body leaves the pair\'s extension out the same way', () => {
+  it('the fold onto a stored body leaves the other packages\' extensions out the same way', () => {
     const reg = extended();
-    expect(shape(reg.foldObjectExtendersOnto(OBJ, vendorAccount(), { withoutExtensionsOf: PAIR_PKG })))
-      .toEqual({ region: false, industry: 'Industry', name: 'Account name' });
+    expect(shape(reg.foldObjectExtendersOnto(OBJ, vendorAccount(), { onlyExtensionsOf: OWNER_PKG })))
+      .toEqual({ region: false, industry: 'Industry', name: 'Name' });
+    expect(shape(reg.foldObjectExtendersOnto(OBJ, vendorAccount(), { onlyExtensionsOf: PAIR_PKG })))
+      .toEqual({ region: true, industry: 'Sector (customized)', name: 'Name' });
     expect(shape(reg.foldObjectExtendersOnto(OBJ, vendorAccount())))
       .toEqual({ region: true, industry: 'Sector (customized)', name: 'Account name' });
   });
 });
+
+describe('#29872 — getObjectExtensionsOf reads a package\'s extensions back as the entries it registered from', () => {
+  const MANIFEST_EXTENSION = { extend: OBJ, fields: { acme_code: { type: 'text', label: 'Billing code' } } };
+  const STORED_EXTENSION = { extend: OBJ, fieldPatches: { industry: { label: 'Sector' } }, priority: 250 };
+
+  it('a manifest `objectExtensions` entry (registerApp, no item) comes back as written, its default priority omitted', () => {
+    const ql = new ObjectQL();
+    (ql.registry as SchemaRegistry).logLevel = 'silent';
+    ql.registerApp({ id: OWNER_PKG, name: 'CRM', version: '1.0.0', objects: [vendorAccount()] });
+    ql.registerApp({ id: EXT_PKG, name: 'CRM ext', version: '1.0.0', objectExtensions: [{ ...MANIFEST_EXTENSION }] });
+
+    const entries = (ql.registry as SchemaRegistry).getObjectExtensionsOf(EXT_PKG);
+    expect(entries).toEqual([MANIFEST_EXTENSION]);
+    expect(ObjectExtensionSchema.safeParse(entries[0]).success).toBe(true);
+    // The owner contributes no extension, and a package that extends nothing reads none.
+    expect((ql.registry as SchemaRegistry).getObjectExtensionsOf(OWNER_PKG)).toEqual([]);
+    expect((ql.registry as SchemaRegistry).getObjectExtensionsOf('com.nobody')).toEqual([]);
+  });
+
+  it('a stored item\'s extension (registerObjectExtension) comes back with its own priority, and re-registers to the same object', () => {
+    const reg = withVendor();
+    reg.registerObjectExtension({ ...STORED_EXTENSION }, EXT_PKG);
+    const entries = reg.getObjectExtensionsOf(EXT_PKG);
+    expect(entries).toEqual([STORED_EXTENSION]);
+    // The inverse of registerObjectExtension: a fresh registry fed the entries serves the same object.
+    const fresh = withVendor();
+    for (const entry of entries) fresh.registerObjectExtension(entry, EXT_PKG);
+    expect(JSON.stringify(fresh.getObject(OBJ))).toBe(JSON.stringify(reg.getObject(OBJ)));
+  });
+});