The layering
Settings writes to the same keys you can poke in regedit, then performs validation, policy-aware no-ops, and Explorer reload choreography. Regedit accepts the exact byte you typed, and makes the consequences your own. Same hive; different error model.
Decision table for mortals
Changing a built-in option
Settings — validation, policy arbitration, shell-reload done for you
Confirming what is set
read-only whichever you like; PowerShell one-liners survive screenshots
Undocumented-by-UI value (rare, documented-in-codebase)
regedit/API with provenance notes — log the before value, known default, and restore path
Anything in HKLM
admin; stop and prove the scope argument first
The privileged app-operational angle: a good tool can still write HKCU directly, provided it documents every value — the restore semantics don't get worse because the write had a UI; they get worse when provenance was never recorded. Values with behavior contracts deserve a mechanic who writes them down.
ProofTune ProjectEngineering notes — every claim here names the bytes a real tool touches. Verify first, install second.