The private app shell mounts only after a valid portal session and active membership are confirmed.