- POST /auth/demo/fresh + «Демо: войти как Андрей» on the welcome screen: every sign-in gets a fresh private
copy of veteran Andrey (consent, prescription, ЕМИАС record) and lands in the chat — no codes, nobody's
crisis or half-done questionnaire leaks into another viewer.
- Initial screening switch: SCREENING_ENABLED env default + /demo/settings + a toggle in the demo console;
off → after consent straight to the chat.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Two DeclarativeBases on two engines (ADR-003): identity holds direct
identifiers, clinical holds token-keyed pseudonymised data plus audit_log.
Portable types (JSONB variant, tz-aware UTC timestamps rejecting naive
values) so tests run on SQLite. init_db() runs create_all at startup.
Guardrail #5 checked by AST and import-graph tests.
Refs #6
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>