Demo mode is incapable of live email and charges
Context
Demo tenants share the same codebase as live email and charge paths. Training UI must not be able to fire real money or mail.
What went wrong
A campaign path could send real email with no demo guard. An early gate accepted any is_demo mention in a huge function, so unguarded sends still shipped green.
What we changed
I added derived deploy guards that require a real short-circuit demo check in the same route block before send or charge, not a nearby token.
Result
On guarded paths, demo is structurally incapable of live-fire. A new path that forgets the gate fails deploy.