diff --git a/CODEOWNERS b/CODEOWNERS
index 967fd62..aebef8f 100644
--- a/CODEOWNERS
+++ b/CODEOWNERS
@@ -13,3 +13,11 @@ prompts/cayce-identity.md     @pattern
 *cayce-auto-merge*            @pattern
 *act-runner*                  @pattern
 CODEOWNERS                    @pattern
+
+# r34 (directiva del operador): infra de despliegue/seguridad y sus units
+*cayce-autodeploy*          @pattern
+*cayce-urgent-watch*        @pattern
+*cayce-daily-report*        @pattern
+*cayce-promo.service        @pattern
+*cayce-promo.timer          @pattern
+*cayce-approval-watcher*    @pattern
diff --git a/deploy/usr-local-bin/README.md b/deploy/usr-local-bin/README.md
old mode 100644
new mode 100755
diff --git a/deploy/usr-local-bin/cayce-auto-merge b/deploy/usr-local-bin/cayce-auto-merge
index 4c0f7be..efd59ca 100755
--- a/deploy/usr-local-bin/cayce-auto-merge
+++ b/deploy/usr-local-bin/cayce-auto-merge
@@ -19,7 +19,7 @@ fi
 [ -z "$BOT" ] && { echo 'FATAL: sin token ci-bot'; exit 1; }
 G="http://127.0.0.1:3100/api/v1"
 # paths protegidos (grep -E contra la lista de ficheros modificados del PR)
-PROTECTED="SPEC.md|MANDATE.md|prompts/cayce-identity.md|guard[^/]*\.|relay-watcher|outbox\.mjs|guard-blocklist|check-single-outbox|\.gitea/workflows|\.github/workflows|cayce-auto-merge|act_runner|docker"
+PROTECTED="SPEC.md|MANDATE.md|prompts/cayce-identity.md|guard[^/]*\.|relay-watcher|outbox\.mjs|guard-blocklist|check-single-outbox|\.gitea/workflows|\.github/workflows|cayce-auto-merge|act_runner|docker|cayce-autodeploy|cayce-urgent-watch|cayce-daily-report|approvals\.mjs|approvals\.test\.mjs|approval-watcher\.mjs|cayce-approval-watcher|cayce-promo\.(service|timer)"
 for REPO in cayce-ops entity bitcoinhotels; do
   curl -s -H "Authorization: token $BOT" "$G/repos/cayce/$REPO/pulls?state=open&limit=20" | python3 -c "
 import json,sys
diff --git a/deploy/usr-local-bin/cayce-daily-report b/deploy/usr-local-bin/cayce-daily-report
index 4e7d8f8..ed855c6 100755
--- a/deploy/usr-local-bin/cayce-daily-report
+++ b/deploy/usr-local-bin/cayce-daily-report
@@ -42,11 +42,11 @@ EOF
 echo ""
 echo "== 2b. DMs urgentes (politica r33) =="
 NDM=$(journalctl -u cayce-nostr --since "-24 hours" --no-pager 2>/dev/null | grep -c "\[dm\] envio a")
-UCOUNT=$(python3 -c "import json; print(json.load(open('/srv/cayce-core/.dm-urgent-count.json')).get('$(date -u +%F)', 0))" 2>/dev/null || echo 0)
+UCOUNT=$(python3 -c "import json; print(json.load(open('/var/lib/cayce/dm/urgent-count.json')).get('$(date -u +%F)', 0))" 2>/dev/null || echo 0)
 echo "  DMs NIP-04 enviados (24h, todas las causas): $NDM · urgentes de hoy (tope 3): $UCOUNT"
-if [ -s /srv/cayce-core/.dm-deferred.log ]; then
+if [ -s /var/lib/cayce/dm/deferred.log ]; then
   echo "  diferidos por tope (van aqui en vez de DM):"
-  tail -5 /srv/cayce-core/.dm-deferred.log | sed "s/^/    /"
+  tail -5 /var/lib/cayce/dm/deferred.log | sed "s/^/    /"
 fi
 if [ -f /srv/cayce-core/PUBLISH_OFF ]; then
   echo "  kill switch: ACTIVO ($(head -c 20 /srv/cayce-core/PUBLISH_OFF 2>/dev/null))"
diff --git a/deploy/usr-local-bin/cayce-urgent-watch b/deploy/usr-local-bin/cayce-urgent-watch
old mode 100644
new mode 100755
index 2477b04..83bb454
--- a/deploy/usr-local-bin/cayce-urgent-watch
+++ b/deploy/usr-local-bin/cayce-urgent-watch
@@ -11,10 +11,10 @@
 #   Dedup por tipo de incidente + sujeto (24 h). Tope: 3 DMs urgentes/día;
 #   a partir de ahí, una línea en el resumen diario (.dm-deferred.log).
 # DRYRUN=1 imprime qué haría sin enviar ni contar.
-DEDUP=/srv/cayce-core/.dm-dedup.json
-DOWNST=/srv/cayce-core/.critical-down.json
-COUNTF=/srv/cayce-core/.dm-urgent-count.json
-DEFER=/srv/cayce-core/.dm-deferred.log
+DEDUP=/var/lib/cayce/dm/dedup.json
+DOWNST=/var/lib/cayce/dm/critical-down.json
+COUNTF=/var/lib/cayce/dm/urgent-count.json
+DEFER=/var/lib/cayce/dm/deferred.log
 USAGE=${LLM_USAGE_LOG:-/srv/cayce-core/.llm-usage.jsonl}
 GEMINI_MAX_USD=${GEMINI_MAX_USD:-1.0}
 export TTL_MS=$((24 * 3600 * 1000))