runtime: outbox UNICO (imports absolutos) + relay-watcher con kill switch + guard R1-R8

- outbox.mjs solo en /srv/cayce-core; daemon/social/mail/ops lo importan por ruta absoluta. deploy.sh ya no instala copias.
- relay-watcher.mjs: cada 5 min cruza eventos de la pubkey en 5 relays con outbound_drafts; sin aprobacion => PUBLISH_OFF + DM + audit. Probado: detecto 2 kind0 bypass reales (post-hoc registrados).
- guard R1-R8 (18 tests) + blocklist + check-single-outbox al check diario.
- stale duplicados archivados en forensics/scripts-archive-20261102 (nostr-daemon.mjs, dm-debug, publish-10050, dm-test2, find-followers).

runtime/daemon.mjs

@@ -13,7 +13,7 @@ import { SimplePool } from 'nostr-tools/pool'
 import { nip04, nip44 } from 'nostr-tools'
 import pg from 'pg'
 import { writeFileSync, unlinkSync, readdirSync } from 'node:fs'
-import { publishMode, gateOutbound, ensureOutboxTable } from './outbox.mjs'
+import { publishMode, gateOutbound, ensureOutboxTable } from '/srv/cayce-core/outbox.mjs'
 
 const PORT = process.env.PORT || 3011
 const NSEC_HEX = process.env.NSEC_HEX
@@ -424,9 +424,17 @@ const server = http.createServer(async (req, res) => {
           tags: [...new Set(pubkeys)].slice(0, 400).map(p => ['p', p]),
           content: '',
         }, sk)
-        await pool.publish(RELAYS, ev)
-        console.log(`[follows] kind 3 actualizado: ${pubkeys.length} cuentas`)
-        return json(200, { id: ev.id, follows: pubkeys.length })
+        // fix fuga (2026-11-01): el kind 3 publicaba directo sin pasar por el
+        // gate — fue la VIOLACION kind 3 del 2026-11-01T00:00:04Z vista por [silence]
+        const g = await gateOutbound(poolPg, {
+          channel: 'nostr', type: 'contact_list', content: '', meta: { kind: 3, follows: pubkeys.length },
+          publishFn: async () => {
+            await pool.publish(RELAYS, ev)
+            console.log(`[follows] kind 3 actualizado: ${pubkeys.length} cuentas`)
+            return { id: ev.id }
+          },
+        })
+        return json(200, { id: ev.id, follows: pubkeys.length, guarded: true, ...g })
       } catch (err) { return json(500, { error: String(err).slice(0, 200) }) }
     })
     return