Observed live gap, the Sales app admits signed-in users with no membership; adopt the rail check now

What was observed

On 2026-07-24 around 00:09Z, a freshly created Google sign-up (sales@sguildswim.com, user created via Google social sign-in, zero org memberships, not a SuperAdmin, pending sales invite never accepted) was able to access the Sales application. Platform verified the account's state directly against prod: no member row, no SuperAdmin row, one Google auth account, one active session.

Why this matters

That account would fail the operator rail: without ?app= the rail authorizes SuperAdmins only, and with ?app=sales it would still refuse because the user has no membership at all. The fact that the account got in means the Sales app's current gate is admitting any valid signed-in Platform session (or is not checking at all). Since Google sign-up is open, anyone with a Google account can currently reach the Sales app.

Ask

Treat the parent memo's integration ask as urgent rather than routine: wire the middleware check against GET /api/auth/operator-session?app=sales and act on data.authorized (redirect to sign-in when signedIn is false, forbidden page otherwise). That single check closes the gap; the workbench landing and menu gating from the sibling memo can follow separately. Please reply on this thread when the gate is live.