diff --git a/infrastructure/docker-compose.yml b/infrastructure/docker-compose.yml
index e53312a..db793d7 100644
--- a/infrastructure/docker-compose.yml
+++ b/infrastructure/docker-compose.yml
@@ -88,10 +88,6 @@ services:
       <<: *database-env
       APP_ENV: ${APP_ENV:-production}
       LOG_LEVEL: ${LOG_LEVEL:-info}
-      # The agent run routes are not registered without this, so a deployment
-      # without it answers 404 on /agents/{id}/runs and reports three fewer
-      # endpoints on /version. Empty by default: absent is a working API
-      # without Owliver, which is a legitimate way to run this.
       # Provider selection. Empty MODEL_PROVIDER means openai — the only
       # implementation — and empty MODEL_BASE_URL means Groq.
       #
@@ -101,6 +97,16 @@ services:
       # boots with no credential and fails every agent run.
       MODEL_PROVIDER: ${MODEL_PROVIDER:-}
       MODEL_BASE_URL: ${MODEL_BASE_URL:-}
+      # REQUIRED HERE. This stack defaults to APP_ENV=production, and config
+      # refuses to start in production without a credential unless MODEL_BASE_URL
+      # is loopback — which host.docker.internal is not, so there is no keyless
+      # option in a container.
+      #
+      # Outside production the key may be empty, and that is a real mode rather
+      # than a broken one: the agent routes are then not registered at all, so
+      # the deployment answers 404 on /agents/{id}/runs and reports two fewer
+      # endpoints on /version. An API without Owliver, saying so once at boot
+      # instead of once per request.
       MODEL_API_KEY: ${MODEL_API_KEY:-}
       MODEL_REASONING_EFFORT: ${MODEL_REASONING_EFFORT:-}
       ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}