diff --git a/docker-compose.yml b/docker-compose.yml
index 7b8bca6..63ea1ec 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -38,7 +38,7 @@ services:
       # Optional: allow Google / Microsoft ID-token bearer auth (sign-in, not mail access)
       - Auth__GoogleClientId=${AUTH_GOOGLE_CLIENT_ID}
       - Auth__MicrosoftClientId=${AUTH_MICROSOFT_CLIENT_ID}
-      - Auth__MicrosoftTenant=${AUTH_MICROSOFT_TENANT}
+      - Auth__MicrosoftTenant=${AUTH_MICROSOFT_TENANT:-}
       - Google__GmailClientSecret=${GOOGLE_GMAIL_CLIENT_SECRET}
       # Optional: Outlook / Microsoft 365 mail linking via Microsoft Graph
       - Microsoft__ClientId=${MICROSOFT_CLIENT_ID}
@@ -124,9 +124,9 @@ services:
       args:
         - NEXT_PUBLIC_GOOGLE_CLIENT_ID=${AUTH_GOOGLE_CLIENT_ID}
         - NEXT_PUBLIC_MICROSOFT_CLIENT_ID=${AUTH_MICROSOFT_CLIENT_ID}
-        - NEXT_PUBLIC_MICROSOFT_TENANT=${AUTH_MICROSOFT_TENANT}
+        - NEXT_PUBLIC_MICROSOFT_TENANT=${AUTH_MICROSOFT_TENANT:-}
         # Optional override; default in production is `/api`
-        - NEXT_PUBLIC_API_BASE_URL=${NEXT_PUBLIC_API_BASE_URL}
+        - NEXT_PUBLIC_API_BASE_URL=${NEXT_PUBLIC_API_BASE_URL:-}
     expose:
       - "80"
     # Compatibility ingress for the current production reverse proxy, which
diff --git a/docs/work-programmes/master-progress.md b/docs/work-programmes/master-progress.md
index f0b11ca..80eb0fb 100644
--- a/docs/work-programmes/master-progress.md
+++ b/docs/work-programmes/master-progress.md
@@ -8,6 +8,7 @@ Updated: 2026-09-01
 
 - Restored visibly distinct CV templates by clearing stale structural overrides when a template changes while preserving CV content and deliberate colour, typography, spacing and document settings. The live A4/Letter preview now fits its pane automatically and responds to pane and viewport resizing; manual zoom remains available.
 - Consolidated both template choosers into one ATS-first gallery backed by real rendered sample documents. ATS-safe designs are prioritised and explained, decorative sidebar layouts are not falsely labelled ATS-friendly, existing non-ATS selections remain visible, and all designs remain one click away.
+- Removed Docker Compose warnings for deliberately optional Microsoft-tenant and production-relative frontend API variables; missing required provider configuration remains enforced by deployment preflight.
 - Diagnosed Gitea Actions run 696 from its authenticated job log: application tests passed, but repeated truncated npm/Playwright downloads were followed by a native exit 139 before browser assertions ran. CI now invokes the lockfile-installed Playwright CLI directly, extends the bounded download timeout, retries only SIGSEGV, and does not redownload the same dependency tree after a transient runner crash.
 - Removed the unreachable legacy `JobDetailsDialog`, its duplicate insight tabs/panels, and tests coupled only to that retired surface. Live correspondence and routed-workspace contracts retain focused coverage; the cleanup removed 2,239 lines without changing the active Job Workspace.
 - Began the controller-responsibility split by moving job statistics, monthly analytics, tag counts, overview analytics, and tag trends into one dedicated authenticated analytics controller. Existing `api/jobapplications/*` routes and response contracts are unchanged; the shared tag parser replaces a byte-for-byte duplicate local parser.
@@ -75,11 +76,11 @@ Updated: 2026-09-01
 
 ### In progress
 
-- Verify the already-authorised main-branch production deployment and health probes, then continue the next safe backlog package. The newer saved-search/calendar/browser-extension/CV-template feature branch remains separately gated from production.
+- Continue the next safe maintainability and UX backlog package. The newer saved-search/calendar/browser-extension/CV-template feature branch remains separately gated from production.
 
 ### Remaining
 
-- Finish production deployment/health verification and revalidate the production-only blockers.
+- Revalidate the remaining production-only blockers; the authorised main-branch deployment completed successfully as version 286 with public liveness and database-readiness checks passing.
 - Obtain explicit production approval before merging and deploying the newer scheduled-search, calendar, browser-extension and CV-template feature branch.
 - Continue visual hierarchy/responsive polish only when a concrete browser regression or reviewed design target identifies a remaining defect; the current automated desktop/mobile journeys pass.
 - Continue maintainability packages, accessibility automation, mobile regression coverage, and the prioritized product-value roadmap after the foundations are stable.