php-fpm: warn to logs when debug is enabled

README.md

@@ -44,7 +44,7 @@ The CI workflow is configured to build with the repository root as the Docker bu
 
   - PHP-FPM streams master/worker logs plus PHP fatals to stderr, so `docker compose logs php-fpm` (or your platform equivalent) will always contain the messages you need for incident response.
   - The auto-prepend bootstrap additionally installs shutdown/exception hooks that write uncaught throwables and fatal errors to stderr even if WordPress or a plugin tampers with `ini_set()`.
-  - When you need full stack traces in the browser, set `FORCE_DEBUG_ERRORS=1` on the `php-fpm` service. The bootstrap enables verbose output and logs a single notice so you remember to remove it later.
+  - When you need full stack traces in the browser, set `FORCE_DEBUG_ERRORS=1` on the `php-fpm` service. The bootstrap enables verbose output and emits a warning in the container logs reminding you to turn it back off (leaving it on in production leaks stack traces to clients).
   - Remove or unset `FORCE_DEBUG_ERRORS` after troubleshooting so production responses stay clean.
 
 ## Local Testing & Development

shared/php-fpm/force-debug.php

@@ -76,5 +76,5 @@ if ($forceDebugEnabled) {
 	error_reporting(E_ALL);
 	ini_set('display_errors', '1');
 	ini_set('display_startup_errors', '1');
-	$forceDebugLog('[force-debug] Verbose error reporting enabled via FORCE_DEBUG_ERRORS');
+	$forceDebugLog('[force-debug] FORCE_DEBUG_ERRORS is enabled — stack traces will be sent to clients. Disable this in production.');
 }