diff --git a/scripts/build-aiui.sh b/scripts/build-aiui.sh
index ae417eca..67a74a76 100755
--- a/scripts/build-aiui.sh
+++ b/scripts/build-aiui.sh
@@ -94,6 +94,22 @@ verify_dist() {
         return 1
     fi
 
+    # Mock quarantine (operator decision 2026-08-07, enforced 8329b826):
+    # production bundles must carry NO mock content hosts. The demo site's
+    # content pack builds with VITE_DEMO_CONTENT=true and legitimately
+    # contains them — skip this check for that build.
+    if [ "${VITE_DEMO_CONTENT:-false}" != "true" ]; then
+        local mock_hits
+        mock_hits=$(grep -rl -e 'spotify\.com/track/example' -e 'cloud\.example\.com' \
+            -e 'plex://play' -e 'image\.tmdb\.org' "$AIUI_DIST" 2>/dev/null || true)
+        if [ -n "$mock_hits" ]; then
+            echo "FATAL: production bundle contains mock content hosts" >&2
+            echo "       (mocks are demo-site-only per the 2026-08-07 operator decision):" >&2
+            echo "$mock_hits" | sed 's/^/       /' >&2
+            return 1
+        fi
+    fi
+
     # Attribute this build to THIS repo's own current commit (D-19: no
     # second-repo pin file — this repo's own commit IS the answer now).
     local commit_sha