Two audit findings on the boundary:
- The thrown value doubled as the failure sentinel, so `throw
  undefined`/`null`/`""` rendered no fallback. Failure now lives in a
  dedicated flag in a pure, testable state model; falsy throws fail the
  boundary.
- A cold-launch crash on the only route had no previous route to pop to and
  Settings lived inside the failed subtree. The screen fallback now offers
  Open settings (outside the boundary, leading to the Diagnostics tab) when
  navigation cannot go back.