diff --git a/backend/tests/unit/composeEnvironment.test.ts b/backend/tests/unit/composeEnvironment.test.ts
index 6b998e8..946a381 100644
--- a/backend/tests/unit/composeEnvironment.test.ts
+++ b/backend/tests/unit/composeEnvironment.test.ts
@@ -56,7 +56,13 @@ const DEPLOYMENTS = [
   },
   {
     file: 'docker-compose.prod.yml',
-    demoMode: 'false',
+    // TEMPORARY, and #191 restores it to 'false'. Production is in demo mode
+    // since 2026-08-25 — the stack was brought up during the cutover to this
+    // file before the live PayPal credentials were available, and demo mode is
+    // the sanctioned interim for that. This assertion is what keeps the state
+    // honest: it fails the moment the compose file and this expectation
+    // disagree, so neither can be changed quietly, in either direction.
+    demoMode: 'true',
     // Deliberately unrestricted. Production has to be able to reach real
     // customers, and it is the one environment where that is correct.
     requiresMailAllowlist: false
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 49342e2..896f347 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -104,15 +104,32 @@ services:
       - PGPASSWORD=${DB_PASSWORD}
       - PGDATABASE=redefined
 
+      # ===================================================================
+      # PRODUCTION IS IN DEMO MODE. IT IS TAKING NO MONEY.
+      #
+      # The whole cart and checkout flow works end to end and NOBODY IS EVER
+      # CHARGED. This is the deliberate interim the note below describes, taken
+      # on 2026-08-25 to bring the stack up during the cutover to this file
+      # before the live PayPal credentials were to hand.
+      #
+      # Restoring it is #191. Set this back to `false`, fill the three stack
+      # variables below, and redeploy. Until then every order placed is a
+      # pretend one.
+      # ===================================================================
+      #
       # Real payments. This is the difference between production and QA, and it
       # is why the three PayPal secrets are required rather than optional — the
       # app refuses to start without them when this is false.
       #
-      # To bring the stack up before PayPal is configured, set this to `true`
-      # and the three PAYPAL_ lines can be removed. The full cart and checkout
-      # flow then works end to end and NOBODY IS EVER CHARGED. That is a
-      # deliberate interim state and a quiet disaster if it is left on.
-      - DEMO_MODE=false
+      # HARDCODED, AND NOT INTERPOLATED, ON PURPOSE. Portainer substitutes stack
+      # variables into this file; it does not hand them to the container. A
+      # `DEMO_MODE` stack variable therefore does NOTHING — there is no `${...}`
+      # here for it to substitute into, and the value below wins silently. That
+      # is deliberate: the one value that decides whether the shop takes money
+      # should not be flippable from a web UI without a commit anybody can read.
+      # It is also exactly what wasted an hour during the cutover, so it is
+      # written down rather than left to be rediscovered.
+      - DEMO_MODE=true
       - PAYPAL_ENV=live
       - PAYPAL_CLIENT_ID=${PAYPAL_CLIENT_ID}
       - PAYPAL_CLIENT_SECRET=${PAYPAL_CLIENT_SECRET}