Every PKI team has the story: a change typed into production by someone certain they were looking at test. The consoles were identical. That is the failure this frame prevents, and it costs one minute.
The goca console shows a configurable heatline: a colored bar with a label (PROD, TEST, ROOT CA, …) above every screen — including login, where it matters most — plus a matching badge and an optional page tint. To configure it, click the heatline or the top-bar badge while signed in; a fresh instance shows a muted "Set environment…" badge that opens the same editor. Presets cover the common convention — red for production, blue for root, amber for staging, green for test — and any #rrggbb works.
It is an ordinary versioned config resource (UiBranding/console), so changes are audited like everything else. Set it on day one, for every environment: it is the cheapest wrong-instance protection you will ever deploy.
Now I can make every instance announce what it is on every screen — before anyone types into the wrong one.