wip: walled-boot pin double throws only for branding

Claude-Session: https://claude.ai/code/session_01UmqzD97e14iws6hmVhgZ5y
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/plugins/plugin-auth/src/auth-plugin.test.ts

@@ -535,7 +535,11 @@ describe('AuthPlugin', () => {
     // for an unregistered namespace), so a binding that skipped the listing
     // check would log the warn this pins away.
     it('a walled boot (branding not listed) neither reads it nor warns about it', async () => {
-      const settings = makeSettings(new Error("Unknown settings namespace: 'branding'"), { brandingListed: false });
+      const settings = makeSettings({ value: undefined, source: 'default' }, { brandingListed: false });
+      settings.get.mockImplementation(async (namespace: string) => {
+        if (namespace === 'branding') throw new Error("Unknown settings namespace: 'branding'");
+        return { value: undefined, source: 'default' };
+      });
       await bootWithSettings(settings);
 
       expect(settings.get).not.toHaveBeenCalledWith('branding', 'workspace_name', expect.anything());

packages/services/service-settings/src/settings-service-plugin.ts

@@ -68,7 +68,8 @@ import { settingsBuiltinTranslations } from './translations/index.js';
  * "Not offered" is the registry's own answer, so every door agrees without a
  * second rule: the namespace is absent from `GET /api/settings`, a read or
  * write of it is refused `404 UNKNOWN_NAMESPACE` by the path every unknown
- * namespace takes, and the runtime-config door finds nothing to read.
+ * namespace takes, and the runtime-config door finds nothing to read. Its
+ * Setup entry travels with it ({@link UNWALLED_ONLY_SETUP_NAV}).
  *
  * Such a manifest is held back at `init()` and registered from the
  * `kernel:ready` hook once the posture IN FORCE is known: during `init()` the