diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
deleted file mode 100644
index 5d1f3a9..0000000
--- a/.github/workflows/deploy.yml
+++ /dev/null
@@ -1,40 +0,0 @@
-name: Deploy
-
-on:
-  push:
-    branches: [main]
-
-jobs:
-  deploy:
-    name: Deploy to Cloud Run
-    runs-on: ubuntu-latest
-    if: github.ref == 'refs/heads/main'
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - id: auth
-        uses: google-github-actions/auth@v2
-        with:
-          credentials_json: ${{ secrets.GCP_SA_KEY }}
-
-      - uses: google-github-actions/setup-gcloud@v2
-
-      - name: Configure Docker
-        run: gcloud auth configure-docker
-
-      - name: Build & Push
-        run: |
-          docker build -t gcr.io/${{ secrets.GCP_PROJECT_ID }}/atelier:${{ github.sha }} .
-          docker push gcr.io/${{ secrets.GCP_PROJECT_ID }}/atelier:${{ github.sha }}
-
-      - name: Deploy
-        run: |
-          gcloud run deploy atelier \
-            --image gcr.io/${{ secrets.GCP_PROJECT_ID }}/atelier:${{ github.sha }} \
-            --region us-central1 \
-            --platform managed \
-            --allow-unauthenticated \
-            --set-env-vars "DATABASE_URL=${{ secrets.DATABASE_URL }}" \
-            --set-env-vars "AUTH_SECRET=${{ secrets.AUTH_SECRET }}" \
-            --set-env-vars "STRIPE_SECRET_KEY=${{ secrets.STRIPE_SECRET_KEY }}"
diff --git a/GOAL.md b/GOAL.md
index 923ac43..b6d602d 100644
--- a/GOAL.md
+++ b/GOAL.md
@@ -9,7 +9,7 @@ Launch Atelier as the invite-only marketplace where craftspeople sell their work
 - [ ] Provision the 7 real services per `docs/P1.3-provisioning.md` (Cloud Run, Cloud SQL, GCS, Sentry, Resend, Stripe Connect, secrets) and record the results back in STATUS.md
 - [ ] Set the GitHub vars/secrets the workflows consume (`GCP_WIP`, `GCP_SA`, `GCR_HOST`, `GCP_PROJECT`, `GCP_REGION`, `atelier-staging-db-url`, `atelier-auth-secret`, `atelier-stripe-secret`, `atelier-stripe-webhook`, `atelier-resend-key`)
 - [ ] Verify `.github/workflows/deploy-staging.yml` auto-deploys on push to main and the health gate (`/api/health`) passes before the traffic shift
-- [ ] Resolve the duplicate legacy `.github/workflows/deploy.yml` (GCP_SA_KEY-based, also triggers on main) so staging and prod deploys are unambiguous
+- [x] Resolve the duplicate legacy `.github/workflows/deploy.yml` (GCP_SA_KEY-based, also triggers on main) so staging and prod deploys are unambiguous
 *Definition of done:* a push to main results in one green staging deploy; the staging URL serves `/api/health` = 200 and a seeded browse page.
 
 ### M2 — Invite-only access flow
diff --git a/STATE.md b/STATE.md
index 4cda859..eee9641 100644
--- a/STATE.md
+++ b/STATE.md
@@ -6,13 +6,13 @@ P0 complete ✅ and P1 code-complete/verified (per `git log`):
 
 - **P0:** multi-maker cart split enforced (409 + confirm prompt), type checker in CI, transactional webhook idempotency, typed `platformFeeBps` (default 1200) on Maker
 - **P1:** 22/22 E2E tests pass across 5 files (`e2e/`: purchase, purchase-failures, multi-maker-cart, commission, commission-failures) — auth helper fixed in `e2e/setup/auth.ts` (commit 74f67c8); 63 unit tests across `src/lib/__tests__/` (contact-guard, listing-standards, refunds, provenance); PDF provenance certificates (pdf-lib + QR + GCS + `/verify/[hash]`); refund flow with Connect transfer reversal + cert voiding; 6-field listing standards at publish with structured 422
-- **Deploy:** `Dockerfile` (multi-stage, standalone Next.js output) + `docker-compose.yml` (Postgres 17); `.github/workflows/` = `ci.yml` (lint/type/build/unit/e2e with Postgres service), `deploy-staging.yml` (auto-deploy main → Cloud Run, 0% traffic → health gate → 100%), `deploy-prod.yml` (tag + approval), legacy `deploy.yml`
+- **Deploy:** `Dockerfile` (multi-stage, standalone Next.js output) + `docker-compose.yml` (Postgres 17); `.github/workflows/` = `ci.yml` (lint/type/build/unit/e2e with Postgres service), `deploy-staging.yml` (auto-deploy main → Cloud Run, 0% traffic → health gate → 100%), `deploy-prod.yml` (tag + approval gate)
 - **Stack:** Next.js 16 (App Router), React 19, Prisma + Postgres, Auth.js v5 magic link (Resend), Stripe Connect, Tailwind v4, shadcn/ui, Sentry
 
 ## Broken / incomplete
 
 - `STATUS.md` (2026-05-12) and `WORKLOG.md` (2026-05-12) are stale: they report "1/22 E2E pass" and "only 1 unit test", but commits 74f67c8/2edb842 completed P1 (22/22 E2E, 63 unit tests) and 6c73676 added Docker — none reflected
-- `.github/workflows/deploy.yml` is a legacy GCP_SA_KEY-based deploy that also triggers on every main push — duplicates `deploy-staging.yml`; ambiguity about which workflow deploys what
+- ~~`.github/workflows/deploy.yml` is a legacy GCP_SA_KEY-based deploy that also triggers on every main push~~ — removed (M1.4): `deploy-staging.yml` is the single main-push workflow; `deploy-prod.yml` handles tagged releases
 - P1.3 real services not provisioned — `docs/P1.3-provisioning.md` has exact gcloud/console commands for all 7 services, awaiting Matt
 - P2 (rate limiting, image moderation, backups, audit hardening, staging seed, dashboard) code-complete but never exercised; P3/P4 not started
 - Cart UX gap (STATUS.md): cart cleared at checkout-session creation, so abandoned Stripe checkouts lose the cart and the order stays PENDING until session-expiry webhook