The initial authorization probe called the nonexistent /api/v1/children and treated every non-403 outcome as success, so a 404 rendered the admin shell. Probe the admin plane's GET /api/v1/admin/ping instead and enter the shell only on a 2xx: 403 shows the refusal, 401 keeps the login flow, and any other status or network failure shows a new probe-error screen with Retry and Sign out. Task: f50338c8-8b48-4e3d-9064-e20d9b32fe34 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>