Do you know what protected $defer = true; means/does?

Yes. That's for the register() method, not boot(). I rearranged the providers in config/app. It seems that the last one listed gets lost in the mix.

Yes. That's for the register() method, not boot().

boot() only executed after register() is called. Which again relate to the $defer value.

There's two types of providers, eager and deferred. When Laravel is run through the console every package is marked as an eager package even if that package is marked as deferred. This means that the register method is called for every package and then when the application is booted the boot method is also called.

During a normal Laravel run only the eager providers are registered and booted initially. Deferred providers are stored away in their own array so that when one is requested it is registered and booted.

Then Config::get('package::variable') isn't getting the config from the web UI. And, perhaps more importantly, this happens even if $deferred is false.