diff --git a/scripts/deploy-gitea.sh b/scripts/deploy-gitea.sh
index b11a6ab..7e09440 100755
--- a/scripts/deploy-gitea.sh
+++ b/scripts/deploy-gitea.sh
@@ -16,8 +16,6 @@ STAMP="$(date +%Y%m%d_%H%M%S)"
 BACKUP="$BACKUP_ROOT/GITEA_DEPLOY_${STAMP}"
 STAGE="/root/dhv2-gitea-stage-${STAMP}"
 LOG="/tmp/dhv2-gitea-deploy-${STAMP}.log"
-API_TEST_IMAGE="dhv2-api:gitea-${STAMP}"
-WEB_TEST_IMAGE="dhv2-web:gitea-${STAMP}"
 PHASE="bootstrap"
 PREV_SHA=""
 TARGET_SHA=""
@@ -32,7 +30,6 @@ cleanup() {
   set +e
   git worktree remove --force "$STAGE" >/dev/null 2>&1 || true
   rm -rf "$STAGE"
-  docker image rm "$API_TEST_IMAGE" "$WEB_TEST_IMAGE" >/dev/null 2>&1 || true
 }
 
 publish_status() {
@@ -159,11 +156,13 @@ fi
 
 PREV_SHA="$(git rev-parse HEAD)"
 PHASE="fetch"
-git fetch origin "$DEPLOY_REF"
+git fetch origin "$DEPLOY_REF" main
 TARGET_SHA="$(git rev-parse "origin/$DEPLOY_REF")"
+MAIN_SHA="$(git rev-parse origin/main)"
 
 echo "Actual:   $PREV_SHA"
 echo "Objetivo: $TARGET_SHA"
+echo "Main:     $MAIN_SHA"
 
 if [ "$TARGET_SHA" = "$PREV_SHA" ]; then
   echo "Producción ya está en el commit autorizado."
@@ -171,6 +170,13 @@ if [ "$TARGET_SHA" = "$PREV_SHA" ]; then
   exit 0
 fi
 
+if [ "$TARGET_SHA" != "$MAIN_SHA" ]; then
+  echo "ERROR: deploy no coincide con main; se rechaza una promoción manual o incompleta."
+  echo "deploy: $TARGET_SHA"
+  echo "main:   $MAIN_SHA"
+  false
+fi
+
 if ! git merge-base --is-ancestor "$PREV_SHA" "$TARGET_SHA"; then
   echo "ERROR: origin/$DEPLOY_REF no es fast-forward desde producción."
   false
@@ -193,19 +199,9 @@ while IFS= read -r -d '' script; do
 done < <(find "$STAGE/scripts" -type f -name '*.sh' -print0)
 
 echo
-echo "========== TEST API CANDIDATA =========="
-docker build --target builder -t "$API_TEST_IMAGE" "$STAGE/api-v3" </dev/null
-docker run --rm \
-  -v "$STAGE/api-v3/test:/app/test:ro" \
-  -v "$STAGE/api-v3/tsconfig.test.json:/app/tsconfig.test.json:ro" \
-  -v "$STAGE/docker-compose.yml:/docker-compose.yml:ro" \
-  -v "$STAGE/web-v2:/web-v2:ro" \
-  -v "$STAGE/android-app:/android-app:ro" \
-  "$API_TEST_IMAGE" npm test </dev/null
-
-echo
-echo "========== BUILD WEB CANDIDATA =========="
-docker build -t "$WEB_TEST_IMAGE" "$STAGE/web-v2" </dev/null
+echo "========== PREFLIGHT DE DEPLOY =========="
+echo "Gitea Actions ya validó tests, migraciones e imágenes de producción."
+echo "El VPS valida únicamente composición, scripts, backup, migraciones reales, recreación y health."
 
 PHASE="backup"
 echo