@@ -368,6 +368,41 @@ const CONTRIBUTORS = [
       return { plugin: new DatasourceAdminServicePlugin({}) };
     },
   },
+  {
+    // `nav_settings_branding` (#24766). The plugin contributes it from its
+    // `kernel:ready` hook, and only where no organization wall stands, so this
+    // entry boots it through init → start → kernel:ready on a context of its
+    // own that captures `kernel:ready` — the shared context below fires no
+    // hooks — with no `tenancy` service, which is the `single` reading, and
+    // returns what it registered.
+    source: '@objectstack/service-settings (Setup entries of the single-posture namespaces)',
+    apps: ['setup'],
+    async load() {
+      const { SettingsServicePlugin } = await import('@objectstack/service-settings');
+      const manifests = [];
+      const ready = [];
+      const own = {
+        getService: (name) => {
+          if (name === 'manifest') return { register: (m) => manifests.push(m) };
+          throw new Error(`Service '${name}' not found`);
+        },
+        registerService: () => {},
+        registerServiceFactory: () => {},
+        replaceService: () => {},
+        getServiceScoped: async () => undefined,
+        getServices: () => new Map(),
+        hook: (name, fn) => { if (name === 'kernel:ready') ready.push(fn); },
+        trigger: async () => {},
+        logger: { info: () => {}, warn: () => {}, error: () => {}, debug: () => {} },
+        getKernel: () => undefined,
+      };
+      const plugin = new SettingsServicePlugin({ env: {}, registerRoutes: false });
+      await plugin.init(own);
+      await plugin.start(own);
+      for (const fn of ready) await fn();
+      return { manifests };
+    },
+  },
   {
     source: '@objectstack/mcp (CONNECT_AGENT_UI_BUNDLE)',
     // The one contributor that lands in BOTH apps: `CONNECT_AGENT_UI_BUNDLE`
 
@@ -127,7 +127,9 @@ export const SETUP_NAV_CONTRIBUTIONS: NavigationContribution[] = [
       // the app's base `setup.access`).
       { id: 'nav_settings_localization', type: 'url', label: 'Localization', url: '/apps/setup/system/settings/localization', icon: 'globe' },
       { id: 'nav_settings_company', type: 'url', label: 'Company', url: '/apps/setup/system/settings/company', icon: 'building-2' },
-      { id: 'nav_settings_branding', type: 'url', label: 'Branding', url: '/apps/setup/system/settings/branding', icon: 'palette' },
+      // `nav_settings_branding` is contributed by `@objectstack/service-settings`
+      // with the `branding` namespace, which is offered only where no
+      // organization wall stands (#24766) — so the entry lives and dies with it.
       { id: 'nav_settings_auth', type: 'url', label: 'Authentication', url: '/apps/setup/system/settings/auth', icon: 'lock-keyhole', requiredPermissions: ['manage_platform_settings'] },
       { id: 'nav_settings_mail', type: 'url', label: 'Email', url: '/apps/setup/system/settings/mail', icon: 'mail', requiredPermissions: ['manage_platform_settings'] },
       { id: 'nav_settings_storage', type: 'url', label: 'File Storage', url: '/apps/setup/system/settings/storage', icon: 'hard-drive', requiredPermissions: ['manage_platform_settings'] },
 
@@ -6,6 +6,7 @@ import { AuthManager } from './auth-manager';
 import type { PluginContext } from '@objectstack/core';
 import { assertEngineFindOnePredicate, assertEngineUpdateDispatch } from '@objectstack/objectql';
 import { bindCatalogFromTables } from './__tests__/security-catalog.testkit.js';
+import { SettingsService, brandingSettingsManifest } from '@objectstack/service-settings';
 
 describe('AuthPlugin', () => {
   let mockContext: PluginContext;
@@ -460,12 +461,21 @@ describe('AuthPlugin', () => {
     let hookCapture: ReturnType<typeof createHookCapture>;
     let setAppNameSpy: ReturnType<typeof vi.spyOn>;
 
-    const makeSettings = (resolved: { value: unknown; source: string } | Error) => ({
+    // `listManifests` lists `branding`, as the settings service does where no
+    // organization wall stands — the binding is gated on that listing (#24766).
+    const makeSettings = (
+      resolved: { value: unknown; source: string } | Error,
+      opts: { brandingListed?: boolean } = {},
+    ) => ({
       get: vi.fn(async () => {
         if (resolved instanceof Error) throw resolved;
         return resolved;
       }),
       subscribe: vi.fn(),
+      listManifests: vi.fn(() => [
+        { namespace: 'localization' },
+        ...(opts.brandingListed === false ? [] : [{ namespace: 'branding' }]),
+      ]),
     });
 
     const bootWithSettings = async (settings: unknown) => {
@@ -517,6 +527,41 @@ describe('AuthPlugin', () => {
         expect.stringContaining('failed to apply branding.workspace_name'),
       );
     });
+
+    // #24766 — under a walled tenancy posture service-settings does not offer
+    // the `branding` namespace. The binding then stays unbound: no read, no
+    // subscription, and no `warn` on a boot that is working as designed.
+    // The double's `get` would THROW for `branding` (as the real service does
+    // for an unregistered namespace), so a binding that skipped the listing
+    // check would log the warn this pins away.
+    it('a walled boot (branding not listed) neither reads it nor warns about it', async () => {
+      const settings = makeSettings(new Error("Unknown settings namespace: 'branding'"), { brandingListed: false });
+      await bootWithSettings(settings);
+
+      expect(settings.get).not.toHaveBeenCalledWith('branding', 'workspace_name', expect.anything());
+      expect(settings.subscribe).not.toHaveBeenCalledWith('branding', expect.any(Function));
+      const warns = (mockContext.logger.warn as ReturnType<typeof vi.fn>).mock.calls.map((c) => String(c[0]));
+      expect(warns.filter((w) => w.includes('branding'))).toEqual([]);
+      expect(setAppNameSpy).not.toHaveBeenCalled();
+    });
+
+    // The same two postures through the REAL settings service: withheld under a
+    // wall (the manifest never registered, so a read would throw
+    // UnknownNamespaceError), offered and saved under `single`.
+    it('real SettingsService: no branding registered → unbound and silent; registered and saved → applied', async () => {
+      const walled = new SettingsService({ env: {} });
+      await bootWithSettings(walled);
+      const warns = (mockContext.logger.warn as ReturnType<typeof vi.fn>).mock.calls.map((c) => String(c[0]));
+      expect(warns.filter((w) => w.includes('branding'))).toEqual([]);
+      expect(setAppNameSpy).not.toHaveBeenCalled();
+      setAppNameSpy.mockRestore();
+
+      const single = new SettingsService({ env: {} });
+      single.registerManifest(brandingSettingsManifest);
+      await single.set('branding', 'workspace_name', 'Acme Single');
+      await bootWithSettings(single);
+      expect(setAppNameSpy).toHaveBeenCalledWith('Acme Single');
+    });
   });
 
   /**
 
@@ -1112,12 +1112,36 @@ export class AuthPlugin implements Plugin {
                 );
               }
             };
-            await applyBrand();
-            if (typeof settings.subscribe === 'function') {
-              settings.subscribe('branding', () => {
-                void applyBrand();
-              });
-              ctx.logger.info('Auth: bound appName to settings namespace=branding');
+            // [#24766] Bound only where the settings service LISTS the
+            // `branding` namespace — the test the runtime-config door makes.
+            // Under a walled tenancy posture service-settings withholds it
+            // (`UNWALLED_ONLY_NAMESPACES`): there is no value to bind, and
+            // the read would fail into the warn above on every correct walled
+            // boot. The configured `appName` (e.g. `OS_APP_NAME`) stays in
+            // force, which is all a walled read of organization-less rows
+            // ever produced. A service with no listing is treated the same.
+            let brandingOffered = false;
+            try {
+              const listManifests = (settings as {
+                listManifests?: () => ReadonlyArray<{ namespace?: unknown } | undefined>;
+              }).listManifests;
+              brandingOffered = typeof listManifests === 'function'
+                && listManifests.call(settings).some((m) => m?.namespace === 'branding');
+            } catch (err: any) {
+              // Kept local so the locale bindings below still run.
+              ctx.logger.warn(
+                'Auth: could not list settings namespaces, branding.workspace_name not bound: ' +
+                  (err?.message ?? err),
+              );
+            }
+            if (brandingOffered) {
+              await applyBrand();
+              if (typeof settings.subscribe === 'function') {
+                settings.subscribe('branding', () => {
+                  void applyBrand();
+                });
+                ctx.logger.info('Auth: bound appName to settings namespace=branding');
+              }
             }
 
             // #2815 — bind the auth SMS locale to the deployment default
 
@@ -22,6 +22,8 @@
 
 import { describe, expect, it, vi } from 'vitest';
 import { ObjectKernel } from '@objectstack/core';
+import { ObjectQL } from '@objectstack/objectql';
+import { SETUP_APP, SETUP_NAV_CONTRIBUTIONS } from '@objectstack/platform-objects';
 import type { IHttpRequest, IHttpResponse, IHttpServer, RouteHandler } from '@objectstack/spec/contracts';
 import { SettingsServicePlugin } from './settings-service-plugin.js';
 import type { SettingsService } from './settings-service.js';
@@ -64,6 +66,10 @@ async function boot(tenancy: Tenancy) {
       throw new Error('tenancy backend unavailable');
     });
   }
+  // Every manifest the plugin registers — its own, and the Setup entries it
+  // contributes with an offered namespace.
+  const registered: unknown[] = [];
+  kernel.registerService('manifest', { register: (m: unknown) => { registered.push(m); } });
   const getService = kernel.getService.bind(kernel);
   const registerService = kernel.registerService.bind(kernel);
   const warnings: string[] = [];
@@ -109,7 +115,35 @@ async function boot(tenancy: Tenancy) {
   const getBranding = () =>
     call('GET /api/settings/:namespace', { method: 'GET', params: { namespace: 'branding' } as any });
 
-  return { service, listed, putBranding, getBranding, warnings };
+  return { service, listed, putBranding, getBranding, warnings, setupNavIds: () => mergedSetupNavIds(registered) };
+}
+
+/**
+ * The Setup app's navigation as the registry serves it: the shell and
+ * `@objectstack/platform-objects`' own contributions, plus whatever this boot
+ * registered, folded by the real `applyNavContributions`. So the static half
+ * (`SETUP_NAV_CONTRIBUTIONS` no longer carrying the entry) and the contributed
+ * half are judged together, on the merged tree the console reads.
+ */
+function mergedSetupNavIds(registered: unknown[]): { ids: string[]; configuration: string[] } {
+  const engine = new ObjectQL();
+  engine.registry.logLevel = 'silent';
+  engine.registerApp({
+    id: 'com.objectstack.test.setup-shell', namespace: 'sys', version: '0.0.0', type: 'plugin', scope: 'system',
+    name: 'Setup shell (fixture)', apps: [SETUP_APP], navigationContributions: SETUP_NAV_CONTRIBUTIONS,
+  });
+  for (const m of registered) engine.registerApp(m);
+  const ids: string[] = [];
+  const walk = (items: any[] | undefined) => {
+    for (const item of items ?? []) {
+      if (item?.id) ids.push(item.id);
+      walk(item?.children);
+    }
+  };
+  const navigation = (engine.registry.getApp('setup') as { navigation?: any[] } | undefined)?.navigation;
+  walk(navigation);
+  const group = (navigation ?? []).find((item) => item?.id === 'group_configuration');
+  return { ids, configuration: (group?.children ?? []).map((item: any) => item?.id) };
 }
 
 describe('the Branding namespace under a walled posture (#24766)', () => {
@@ -137,6 +171,13 @@ describe('the Branding namespace under a walled posture (#24766)', () => {
         expect(state.status).toBe(404);
         expect(state.body.error.code).toBe('UNKNOWN_NAMESPACE');
       });
+
+      it('Setup serves no Branding entry, while its sibling settings entries stay', async () => {
+        const { ids } = (await boot({ kind: 'service', posture })).setupNavIds();
+        expect(ids).not.toContain('nav_settings_branding');
+        // Control: the fold is real and the Configuration group is populated.
+        expect(ids).toEqual(expect.arrayContaining(['nav_settings_company', 'nav_settings_localization']));
+      });
     });
   }
 });
@@ -158,6 +199,14 @@ describe('the Branding namespace where no wall stands (#24766)', () => {
       expect(read.status).toBe(200);
       expect(read.body.data.values.workspace_name).toMatchObject({ value: 'Acme', source: 'tenant' });
     });
+
+    it(`${label}: Setup serves the Branding entry exactly once, in Configuration`, async () => {
+      const { ids, configuration } = (await boot(tenancy)).setupNavIds();
+      expect(ids.filter((id) => id === 'nav_settings_branding')).toHaveLength(1);
+      // In the Configuration group, after the platform-objects entries.
+      expect(configuration).toContain('nav_settings_branding');
+      expect(configuration.indexOf('nav_settings_branding')).toBeGreaterThan(configuration.indexOf('nav_settings_feature_flags'));
+    });
   }
 });
 
 
@@ -78,6 +78,35 @@ import { settingsBuiltinTranslations } from './translations/index.js';
  */
 const UNWALLED_ONLY_NAMESPACES: ReadonlySet<string> = new Set(['branding']);
 
+/**
+ * The Setup entry of each {@link UNWALLED_ONLY_NAMESPACES} member, contributed
+ * WITH the namespace (#24766, the amendment's "no Setup entry" half).
+ *
+ * It used to be a static item of `@objectstack/platform-objects`'
+ * `SETUP_NAV_CONTRIBUTIONS`, so a walled deployment listed a page the server
+ * does not serve. It now lives and dies with the capability — the
+ * `@objectstack/mcp` `connect-ui.ts` pattern (cloud ADR-0009): registered
+ * through the `manifest` service from the same `kernel:ready` step that offers
+ * the namespace, and never where the namespace is withheld. The labels stay
+ * keyed `apps.setup.navigation.<id>` in platform-objects' bundles, which is
+ * where the console resolves every Setup entry, contributed or static.
+ *
+ * A factory, not a shared literal: the nav fold pushes contributed items into
+ * the merged tree by reference.
+ */
+const UNWALLED_ONLY_SETUP_NAV: Readonly<Record<string, () => Record<string, unknown>>> = {
+  branding: () => ({
+    id: 'nav_settings_branding',
+    type: 'url',
+    label: 'Branding',
+    url: '/apps/setup/system/settings/branding',
+    icon: 'palette',
+  }),
+};
+
+/** The bundle id the Setup entries register under — distinct from the plugin's own manifest. */
+const UNWALLED_ONLY_SETUP_NAV_BUNDLE_ID = `${SETTINGS_PLUGIN_ID}.setup-nav`;
+
 /** Configuration options for the SettingsServicePlugin. */
 export interface SettingsServicePluginOptions {
   /**
@@ -574,6 +603,32 @@ export class SettingsServicePlugin implements Plugin {
       this.service!.registerManifest(m);
       this.registerActionHandlers(m.namespace);
     }
+    // The Setup entries travel with the namespaces just offered — and only then.
+    const items = this.heldUntilPostureKnown
+      .map((m) => UNWALLED_ONLY_SETUP_NAV[m.namespace]?.())
+      .filter((item): item is Record<string, unknown> => item !== undefined);
+    if (items.length === 0) return;
+    let manifestService: { register(m: unknown): void } | undefined;
+    try {
+      manifestService = ctx.getService<{ register(m: unknown): void }>('manifest');
+    } catch {
+      // No manifest service (lean kernels, tests): no app registry to contribute to.
+      return;
+    }
+    manifestService?.register?.({
+      id: UNWALLED_ONLY_SETUP_NAV_BUNDLE_ID,
+      namespace: 'sys',
+      version: SETTINGS_PLUGIN_VERSION,
+      type: 'plugin',
+      scope: 'system',
+      name: 'Settings Service — Setup entries',
+      description: 'Setup navigation for the settings namespaces offered only where no organization wall stands.',
+      navigationContributions: [
+        // After platform-objects' Configuration entries (priority 100), before
+        // later contributors' (service-messaging, 120).
+        { app: 'setup', group: 'group_configuration', priority: 110, items },
+      ],
+    });
   }
 
   /**