---
id: SCR-PFM-CSH-002
title: Start-up screens
route: (any console address before the security context answers)
surface: console
product_area: platform
module: console-shell
revision: 1
status: draft
design_intent: confirmed
origin: >-
  services-platform:docs/security/console-authentication.md#Console
  initialisation (final acceptance 2026-10-10)
implementation_evidence: observed
source_sha:
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
purpose: Start-up screens explain the wait or failure before console pages mount.
supports:
  - JNY-PFM-CSH-001
  - CAP-PFM-CSH-001
permission: none (shown before any permission is known)
entry_from:
  - Any console address
  - Sign-in return
exits_to:
  - Console frame (on an answer)
  - Sign-in (no session)
  - Sign-out page
inference: []
displays:
  - field: Neutral boot wait
    source: DOM-PFM-CSH-001 start-up phase
  - field: Signed-in email on access refusal
    source: getMySecurityContext refusal; the session's identity
  - field: Context-read failure explanation
    source: getMySecurityContext failure
  - field: Missing sign-in settings
    source: The console's own sign-in configuration
actions:
  - label: Retry
    operation_id: getMySecurityContext
    permission: platform.security-self.read
    confirm: false
  - label: Sign out
    operation_id: 'none: Security session end, then the sign-out page'
    permission: none
    confirm: false
states:
  - loading
  - access refused
  - request failed
  - setup missing
validation:
  - BR-CAP-PFM-CSH-001-03
  - BR-CAP-PFM-CSH-001-04
patterns:
  - 'Full-page state screen (icon, title, body, actions) outside the frame'
component: >-
  components/console/console-boot-screens.tsx; lib/security-context/provider.tsx
  (phases)
evidence:
  - >-
    react-console at baf6dae: components/console/console-boot-screens.tsx;
    lib/security-context/provider.tsx; lib/auth/messages.ts.
controls: [TC-AVL-001, TC-AVL-004, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-CRY-001, TC-CRY-002, TC-CRY-003, TC-CRY-004, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-IAM-001, TC-IAM-002, TC-IAM-004, TC-IAM-005, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-MON-002, TC-MON-003, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-004, TC-PI-005, TC-PRV-001, TC-PRV-002, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003]
---
# Start-up screens

## What the Screen Is For

Start-up screens explain the wait or failure before console pages mount. They give the person a next step without exposing workspace navigation early.

## What It Shows and Lets People Do

Loading is neutral. Missing sign-in settings produce a configuration screen; a context refusal names the signed-in email and offers sign-out. Other failures offer Retry and sign-out. Missing or expired sessions navigate to sign-in with a safe return address.

## States and Errors

Retry runs boot again while the failure screen remains visible until the phase changes. The refusal and failure states do not provide permissions or mount the frame.

## Patterns It Must Respect

The full-page state component sits outside the console frame. Its title, explanation and actions distinguish setup problems, access refusal and a request failure.