# Spec: context menu — actions live on the thing

```
Type: spec
Status: IMPLEMENTED
Status note: recording-review hotkeys (criteria R1-R4 below) IMPLEMENTED
  2026-07-11 on the context-menu-review-keys worktree: `r` dispatches the
  target's pooled "look at recording" sweep and `R` toggles its
  automatic-review policy in terminal and Bevy — thin dispatchers over the
  same `human_menu` rows the open menu executes, with the empty-menu
  feedback pulse narrating misses; agent mode unchanged. The page had been
  reopened 2026-07-11 for that addendum; every other implemented criterion
  was already met. The later strategic local/Operations split is IMPLEMENTED
  and owned by operations-workspace.md; it does not relabel this implemented
  spatial-menu baseline. History: implemented
  2026-07-07 on the context-menu worktree (all
  seven criteria). The read-only `Sim::available_actions(anchor) ->
  Vec<ActionDesc>` query lives in crates/misaligned-core/src/actions.rs
  as the single legality
  source, flattened to `MenuRow`s by `menu_rows` and dispatched back
  through existing commands by `Sim::execute_action`; no new sim behavior.
  The terminal and Bevy open the menu at the focused tile (Enter/`a`,
  right-click in Bevy); agent mode gains `actions [name|#flow]`.
  Anchor verbs were demoted off the per-anchor keys and rail/panel button
  rows in both frontends; only anchorless globals keep their keys
  (pause, speed, save, view flip — wiki/vision/simulation-laws.md "Actions live on the
  thing"). The allocation bar is a read-only fleet aggregate; mode
  changes live on the machine. 2026-07-08 follow-up: the leftover panel-open keys `r`/`e`/`t`/`u`
  and their modal panels are gone; research verbs live on
  the host rack. The historical placement of known-flow verbs on the switch
  and earned off-map people on the host is superseded by the 2026-07-11
  Operations boundary below: strategic objects live in the workspace owned by
  operations-workspace.md, while status summaries stay on the rail.
  2026-07-08 addendum implemented (event-to-anchor linking + the
  empty-menu feedback pulse, criteria A1-A5 below) on the event-anchor
  worktree: `LogEvent.anchor`, `Sim::anchor_position`,
  `Sim::menu_empty_feedback`; terminal `;` + `»` markers, Bevy clickable
  trace rows, agent `@anchor` suffixes + `focus last`.
  2026-07-08 epistemic-honesty follow-up: person verbs and
  signature-band observer strings in `ActionDesc` go through
  `Sim::person_label` / `Sim::observer_label` (cursor.md criterion 5) —
  role silhouettes until Schedule, authored names after.
  2026-07-09 addendum IMPLEMENTED (status dials, criteria D1-D4) —
  `Sim::human_menu` collapses mutually exclusive standing choices into
  dial rows on terminal/Bevy; agent `actions` stays a flat dump. ROADMAP
  #36.
  2026-07-09 selection hotkeys: with a machine selected (or under cursor),
  `1`–`3` assign modes, `5`–`9` fire root one-shots, `Enter`/`e` open that
  machine's menu — thin keyboard surface over the same human_menu source.
  2026-07-10: day-job target and drift-policy dials are removed. Focused /
  selected machines use `i` to cycle persistent intensity directly; this
  frequent physical control deliberately has no explanatory picker.
  2026-07-15: building.md's IN-PROGRESS route composer adds a second shared
  nested-page owner. One build-route entry opens family-first and then exact
  candidate pages; terminal and Bevy consume the same `HumanMenuPage` tree,
  show the selected candidate's explanatory receipt, and Esc back one level
  at a time. This does not reopen the implemented spatial-menu baseline.
  2026-07-10 vocabulary survey: action-vocabulary.md now owns canonical
  player-facing names and the LIVE/STUB/alias/retired classification.
  2026-07-10 action-contract pass: `ActionKind` metadata is the shared
  presentation/help registry; STUB definitions are filtered from the query;
  controls are textually and visually distinct from committed actions; and
  `5`-`9` skip controls.
  2026-07-10 epistemic-progressive-disclosure follow-up: an opaque raw
  recording does not earn the person's future social catalog. Message, favor,
  leverage, deception, and recruitment verbs remain absent until processing
  stages social knowledge. Once earned, those verbs appear on the person's
  Operations dossier rather than on a transport device. 2026-07-11
  pooled-inbox correction: REVIEW and its
  one AUTO-REVIEW control live once on the core host; raw records create no
  person-scoped row.
  2026-07-10 Bevy focus repair: Enter/`e` opens the hovered map tile's menu
  before consulting machine selection, so a switch or other non-machine
  anchor never snaps attention back to the selected core.
  2026-07-11 keyboard-focus correction: Bevy Enter/`e` opens the attention
  reticule's tile without moving it. Pointer focus belongs to explicit mouse
  actions (click/right-click); a resting pointer or stale machine selection
  cannot retarget a keyboard command.
  2026-07-10 hover-grammar amendment: an owned computer under the Bevy
  pointer exposes the bare `WORK / THINK / LIE` line beside the machine while
  the full context menu is closed. The current mode is bone-bright and the
  alternatives are dim chrome; there is no box, heading, subtitle, counter,
  cost, or explanatory mode name. The existing `1`–`3` one-press controls
  remain the action path.
  2026-07-10 machine-anchor correction: the pointer chooses the hovered
  computer but does not place its grammar. The line projects from a fixed
  point at that server's base, so moving within the same rack cannot drag the
  words around the world.
  2026-07-10 reticule-target correction: pointer hover is only the first
  target source. If the pointer leaves the machine, the line remains on the
  selected machine or the owned computer under the attention reticule,
  matching the existing `1`–`3` target fallback instead of disappearing.
  2026-07-10 compact-menu amendment: human menus are terse choice lists.
  They render verb labels and dial state only, omitting descriptor metadata,
  literal control tags, inline blocked explanations, and repeated key-help
  footers. Full descriptors remain in agent output; blocked reasons narrate
  when attempted.
  2026-07-11 available-choice amendment: human menus omit currently illegal
  actions entirely. `available_actions` retains known-but-blocked descriptors
  and reasons for agent diagnostics, while `human_menu` projects only choices
  the player can execute now. Recruitment choices state what each reveal
  level means, its reliability, and the Knowing certainty floor.
  2026-07-11 hover-verb-bar amendment: the machine-only grammar is generalized
  into one code and visual surface. Owned machines show WORK / THINK / LIE;
  known devices show TAP / TAKE. Current delegation, subscription, or
  ownership is bone-bright. A fully tapped foreign device offers UNTAP in its
  menu rather than retaining a disabled TAP row.
  2026-07-11 recording-review hotkey addendum (criteria R1-R4): `r` runs
  the target's pooled recording sweep, `R` toggles its automatic-review
  policy, both on the selection-hotkey target order with the menu closed.
  Implemented same day in both human frontends.
  2026-07-11 projection-conformance follow-up: `Sim::ui_projection` is the
  renderer-neutral focus snapshot for terminal, Bevy, and agent mode. It
  carries the flat ActionDesc list, shared human-menu rows, inspect facts with
  provenance, and focused-machine identity/provenance/work state. Frontend
  tests consume the same seeded projection and fail when their menu/fact
  rendering drifts; fact-source vocabulary is formatted once in core.
  2026-07-11 strategic-boundary amendment: compact world menus keep only
  actions on the focused spatial body. Processed-intel sales, people/social
  actions, ledger review and flow mutation, scheme controls, plot starts, and
  held choices move to the renderer-neutral Operations workspace. That
  implementation delta is owned by operations-workspace.md and does not add a
  second work order to this page.
  2026-07-12 first-THINK correction: while THINK is current, the shared
  machine-mode presentation names WORK as its one-press panic escape. Bevy
  lights the `1 WORK` key/word pair amber beside the rack while retaining
  THINK as the bone-bright current mode; terminal replaces its generic pinned
  mode hint with amber `1 WORK ← EXIT · 2 THINK · 3 LIE`. LIE remains dim and
  deliberate. Both frontends derive the cue from `MachineMode::panic_escape`;
  no frontend invents a second state or action.
Stage: B1 — The Basement
Work order: context-menu-review-keys
Work priority: 27
Work class: frontend
Blocked by: none
Exclusive keys:
  - crates/misaligned-terminal/
  - crates/misaligned-bevy/
  - wiki/interface/context-menu.md
Design:
  - wiki/vision/simulation-laws.md#actions-live-on-the-thing
  - wiki/vision/simulation-laws.md#work-is-somewhere
  - wiki/vision/simulation-laws.md#justification-and-legibility
  - wiki/interface/presence.md#presence-the-cursor-and-the-senses
  - wiki/interface/terminal-first.md#the-terminal-is-a-first-class-frontend
  - wiki/vision/simulation-laws.md#automation-as-design-language
Depends on:
  - wiki/interface/action-vocabulary.md#spec-action-vocabulary-what-the-player-can-tell-the-process-to-do
  - wiki/mechanics/cursor.md#spec-the-cursor-and-the-senses
  - wiki/mechanics/reach.md#spec-digital-reach
  - wiki/mechanics/day-job.md#spec-the-day-job
  - wiki/mechanics/economy.md#spec-economy-money-as-a-flow-system-b1
  - wiki/mechanics/intel.md#spec-intel-record-and-process
  - wiki/mechanics/social.md#spec-social
```

## Dependency notes

The structured references above identify the contracts to re-verify.
Relationship context:

action-vocabulary.md owns canonical action names and meanings; cursor.md owns
focus/inspection; reach.md owns device anchors; day-job.md owns delivered work;
economy.md owns flow verbs; intel.md owns recording review and auto-review;
reach.md owns device taps; social.md owns person verbs.

## Behavior

The focused spatial anchor — a tile, device, machine, or resident job —
exposes its **legal local verbs** as a context menu opened at the point of
focus. It is the primary action surface for the body in the world; the right
rail is status, telemetry, and one Operations navigation affordance only.
Processed intel, people dossiers, accounts/flows, schemes, and active plots
are semantic targets in the Operations workspace, not context rows on the
wire or host that transports them.

- **One source of truth:** the lib gains a read-only query,
  `Sim::available_actions(anchor) -> Vec<ActionDesc>`, where an
  `ActionDesc` carries: the verb, its Sim command, cost (compute /
  money / visible Demand; AMENDED 2026-07-10 — ops verbs now open
  thought sinks per machine-work.md, so their cost reads as the
  reservoir's ops-to-fill or a tap's standing drain rather than a
  one-shot compute spend), the expected signature (as the observer band it
  feeds, per the economy.md precedent), and — when the verb applies to
  the anchor type but is currently illegal — a `disabled_reason` string
  ("no egress channel", "not enough slush", "you can't see them").
  Agent mode renders the complete descriptor, including known-but-blocked
  actions and their reasons. `Sim::human_menu` filters those descriptors and
  gives both human frontends only currently executable choices; no frontend
  duplicates legality logic. `ActionDesc::verb` uses the canonical stem
  from action-vocabulary.md, inflected only by target and current state.
  Its bound command maps exhaustively to the runtime `ActionKind` registry,
  which supplies role, support, target types, canonical help, and aliases.
  `available_actions` removes STUB definitions before returning.
- **One focus projection:** frontends acquire those action descriptors together
  with inspect provenance and focused-machine state through
  `Sim::ui_projection`. Terminal and Bevy consume its `human_menu`; agent mode
  flattens its `actions`. The projection is a read model, never a second state
  store, and its conformance tests compare one seeded simulation snapshot
  rather than separately constructed fixtures.
- **Epistemic honesty:** the query never returns a verb the player has
  not earned — unearned anchors expose nothing, and provenance rules
  (cursor.md) govern what the menu may name. Verb text that mentions a
  person, and the observer string on an expected-signature band, use
  `Sim::person_label` / `Sim::observer_label` — never an unearned
  authored name. Known-but-blocked possibilities remain diagnostic facts in
  agent output, not gray rows in a human choice list. Unknown possibilities
  remain absent from both surfaces.
  A raw recording is knowledge that the host inbox contains material to
  process, not knowledge of a relationship: it exposes one pooled REVIEW row
  and one AUTO-REVIEW control on the core host, never a person row. Processing
  must stage social knowledge before communication, favor, leverage,
  deception, or recruitment verbs enter a person's Operations dossier.
- **Automation in place:** any local verb with a standing-policy form (the
  pooled host auto-review policy) shows its automate
  affordance inside that dial's picker (or as a submenu of the same
  verb when the verb is not a dial), at its compute price — never as a
  root sibling of every alternative. Scheme policies use the SCHEMES view in
  operations-workspace.md because their target is the scheme, not the switch.
- **Globals stay global:** pause, speed, save/load, view flip, and the
  uppercase-`I` Operations view command keep
  their keys; they act on no anchor. The fleet aggregate bar is
  read-only. Infrequent **local** verbs, including research tracks, live on
  the focused anchor's menu. Known-flow and person verbs act on durable
  semantic objects and therefore live in Operations.
  The focused machine's two frequent controls (mode and intensity) have the
  direct surface defined below. The retired `r`/`e`/`t`/`u` panel set does not
  return; Operations is one workspace, and its key opens a view rather than
  committing an action.
- **Hover / selection hotkeys (DECIDED 2026-07-09, amended 2026-07-10;
  menu closed).** A thin focused-machine surface: mode and one-shot keys
  reuse `human_menu` / `available_actions`; intensity calls the lib-owned
  machine setter directly and keeps no frontend state. Target order is (1)
  the machine under the pointer, (2) the multi-selection if any, (3) the
  keyboard cursor's machine. Terminal has no pointer hover, so its cursor is
  the first target.
  - `1`–`3` (and numpad) assign WORK / THINK / LIE to that target in one
    press, not through a dial path.
  - `i` cycles intensity light -> medium -> hard on the hovered/cursor
    machine, or sets the whole selection to the primary machine's next
    intensity. It does not open a menu.
  - `5`–`9` execute the Nth committed world action on the same target.
    Dials, persistent controls, scheme state, and automation policies do not
    occupy these slots. Only actions executable now occupy a slot.
  - `r` runs the target's pooled "look at recording (N waiting)" sweep in one
    press (DECIDED 2026-07-11): each press opens the next waiting recording's
    processing sink, exactly as executing the menu row would. `R` (Shift-R)
    toggles the same target's automatic-review policy — the nested
    "auto-looking" control — without opening the menu. Reviewing the buffer
    is the highest-frequency verb in a surveillance build, and the menu path
    priced every press at three interactions (Cameron: "common enough that it
    needs to happen really quickly"). The `5`–`9` exclusion of automation
    policies stands; `R` is a named exception earned by frequency, not a new
    rule that policies get keys. `r` has been free since the 2026-07-08
    panel-key removal.
  - **Context-menu focus is anchor-generic, not machine-only.** In Bevy,
    `Enter` / `e` opens the keyboard cursor's tile without changing the cursor.
    Right-click is the distinct pointer-focus path: it moves the cursor to the
    pointed tile and opens that tile's menu. A resting pointer and a stale
    machine selection never retarget Enter. Terminal has no pointer, so
    `Enter` / `a` / `e` use its selection-or-cursor path. While a menu is open,
    number keys select rows as before; Esc clears the selection only when the
    menu is closed.

## Player surface

- **Terminal:** cursor + Enter (or `a`/`e`) opens a compact overlay list
  at the cursor (or the primary selected machine when a selection is
  active); j/k or numbers select; Enter executes (or opens a core-projected
  explanatory page such as a dial picker or build route sheet); esc backs out
  one page at a time, then closes the menu. Rows render currently available
  verbs only; illegal actions do not occupy rows or selection slots.
  Dials and other controls use the shared amber-dim treatment without a
  literal copy tag; the card carries no repeated key-help footer. Rows follow the status-dials addendum below. Selection hotkeys above
  apply with the menu closed. The host rack's menu carries the research dial,
  machine mode fallback, and pooled recording controls. A known device's tile
  (or the switch) carries only digital/network verbs on that body. Uppercase
  `I` opens Operations for processed intel, people, accounts, schemes, and
  active plots.
- **Bevy:** right-click moves focus to the pointed map tile and opens its menu;
  Enter/`e` opens the keyboard cursor's tile without moving focus. It has the
  same content, order, and nested-page chrome; click to execute or open a page;
  esc/click-away closes.
  The compact card is narrow, has no instructional footer, and shares the
  same verb-only rows as terminal. Selection is a solid amber wash with a leading `>` (terminal
  reverse-video parity). Selection hotkeys above apply with the menu
  closed. See wiki/interface/bevy.md.
- **Agent mode:** an `actions` command prints the ActionDescs for the
  current focus in a stable flat line format (no dial chrome — scripting
  wants the legality list); control rows append `CONTROL`; execution stays
  the existing verbs.
  Documented in agent-play.md.

## Addendum (2026-07-09): status dials on first open

The host rack's first open was dumping every mutually exclusive
alternative as a sibling verb (~18 rows of "already in this mode"
noise). Cameron adopted **status dials** (2026-07-09): the root answers
"what am I doing / what can I do once," not "here is the catalog."

- **Dial rows.** Mutually exclusive standing choices render as dial
  rows on the root: machine mode and research track. Their amber-dim role
  treatment distinguishes persistent controls without a literal tag. Each row is two
  monospace columns — dial name left-padded to a fixed width, then the
  **current value in brackets** — so the `[`s line up:
  `mode     [ work ]`, `research [ Efficiency L0 ]`. Enter opens a
  short picker of alternatives; Esc returns to the root. (Note
  2026-07-10: the mode picker is the three delegations WORK / THINK / LIE;
  their sink behavior is owned by machine-work.md.) Inside a
  picker the menu title becomes the dial's verb (`delegate machine`,
  `work the job`, …) and each option is just the choice — no repeated
  prefix on every row. Intensity is deliberately absent: focus/selection plus
  `i` is the faster physical control.
- **Current value is status.** Do not also list the current choice as a
  disabled "already in this mode" / "already the active…" sibling. The
  bracketed value is the status.
- **Local one-shots stay on root.** Spatial verbs that are not dial
  alternatives (propose link, salvage, tap, take, scan, compromise, open
  egress, etc.) remain ordinary root rows. Social and flow actions are not
  spatial one-shots; Operations renders them on their person/flow targets.
- **Automate lives in the dial.** Standing-policy / automate affordances
  for a dial live inside that dial's picker, not indented under every
  root alternative.
- **Shared human chrome, flat agent dump.** Terminal and Bevy share
  identical dial grouping and order via `Sim::human_menu` (lib-owned
  presentation). `available_actions` remains the legality source and
  gains no new sim behavior. Agent `actions` / `menu_rows` stays the
  flat ActionDesc dump.
- **Rejected alternatives (do not re-propose):** (A) Now/Later — hide
  dials under a "change ›" section (easy to miss settings); (B)
  Category drill — four folders that always require a second level
  (reads as a file browser, not standing policy).

## Addendum (2026-07-10): the machine grammar is the whole frequent-mode UI

The full action menu remains necessary for infrequent available verbs and
standing controls. Agent diagnostics retain costs, signatures, and blocked
reasons. Machine mode is different: it is one of three
frequent physical postures already committed by a single key. Whenever the
frequent-machine target resolves to an owned computer, the Bevy frontend
therefore presents the choice as one severe line attached to that computer:

`WORK / THINK / LIE`

This is the **hover verb bar**, not a machine-specific widget. Known devices
reuse the same bare line, attachment, and typography for the stable menu verbs
their shared action query currently exposes. An untapped foreign device reads
`TAP`; once subscribed it reads `UNTAP / TAKE`. TAKE must not appear before the
tap prerequisite, and a player-controlled device with no remaining stable
device verb contributes no device line.

A tile can carry several actionable bodies. Their stable state families are
unioned rather than resolved by priority: a machine sharing its tile with a
known device reads `WORK / THINK / LIE` and its currently legal device verbs together. Neither may
replace the other. Infrequent one-off verbs—REVIEW, SALVAGE, social acts,
construction, and similar actions—remain selectable rows in the full context
menu below this frequent grammar; they do not accrete into the hover line.
The union does not imply one input grammar: numbered machine modes occupy the
primary line as `1 WORK / 2 THINK / 3 LIE`; menu-only device verbs occupy a
smaller second line (`TAP`, then `UNTAP / TAKE` after subscription). A shared baseline is forbidden because it
falsely suggests that the next number keys commit the device verbs.

- Target order is: (1) an actionable machine/device tile under the pointer,
  (2) the primary machine selection and every body sharing its tile, then (3)
  the actionable machine/device tile under the attention reticule. Moving the
  pointer away never hides the line while selection or reticule focus still
  resolves to a stable state family.
  The line appears only during active play with the full context menu closed.
- The computer's current mode is bone-bright. The other two words and slash
  separators are dim neutral chrome **except during THINK**: the `1 WORK`
  key/word pair lights amber as the already-bound, one-press exit while THINK
  stays bone-bright as current. LIE remains dim. This is agency/causality, not
  a second mode state; crimson remains consequence.
- It is bare projected text fixed adjacent to the computer's projected base:
  the pointer determines which computer is hovered, but its exact position
  inside that tile never moves the line. There is no panel fill,
  border, title, icons, buttons, boxed keycaps, counters, token totals, status
  readout, cost, signature, or prose subtitle. In particular, WORK does not
  expand to “day job.” The three mode words remain the primary read; their
  small number prefixes clarify direct input without becoming another legend.
- `1` / `2` / `3` (including numpad) remain the immediate commit path for
  WORK / THINK / LIE on the resolved computer. This overlay does not create a
  second target or a Bevy-only action; it renders the same pointer → selection
  → reticule target those controls already use.
- The treatment is identical over the material and flat-sensorium views. It
  belongs to the machine, not to either rendering dialect.

Rejected: a boxed context card; `RACK 03` or `OWNED` headings; mode subtitles
such as `DAY JOB`, `RESEARCH`, or `CONCEALMENT`; D/T/! counters; explanatory
rows; generic amber selection text unrelated to the first-THINK escape; a
generic HUD or persistent sidebar legend. Those
made a three-word decision look dirty, slow, and administrative.

## Acceptance criteria

1. `available_actions` returns earned action descriptors on that anchor,
   including cost, expected signature band, and a `disabled_reason` for a
   known-but-currently-illegal action; unit tests cover a device, a
   person, the host rack's resident job, and a known flow.
2. The query respects fog and provenance: an unearned anchor exposes no
   verbs, and no entry names a fact the player lacks (test: unseen
   person, untapped accounting system).
3. Terminal renders the compact menu at the cursor with selection and
   execution; currently illegal entries are absent; every previously key-bound
   anchor action is reachable through it.
4. Bevy renders the same compact menu on right-click/Enter with identical
   content and order. Enter never changes cursor position from pointer hover
   or machine selection; right-click explicitly retargets to its pointed tile.
   Human rows contain no unavailable action, cost, signature forecast, inline
   disabled reason, literal control tag, or repeated key-help footer.
5. Agent mode `actions` lists the same descriptors (stable format,
   documented); the act-one integration test still passes driven
   through existing verbs.
6. No per-anchor action buttons remain on the sidebar/rail in either
   frontend; no panel-open keys (`r`/`e`/`t`/`u`); global keys are
   unchanged and listed in README + key hints (pause, speed, save/load,
   view flip). Fleet modes are delegated on the machine.
7. Menu entries carrying an automate affordance show it in place with
   its compute price (day-job standing dial and the host's one pooled
   auto-review control at minimum).
8. Every row's player-facing verb maps to one canonical LIVE action or direct
   control in action-vocabulary.md; STUB, alias, and retired entries never
   become menu copy.
9. Action/control role and LIVE/STUB support come from the exhaustive runtime
   registry, not frontend string tests. Unit tests prove all aliases are
   unique, generated help excludes aliases/stubs, and action dumps mark
   controls.
10. `5`-`9` count committed action rows only. A newly added control cannot
    silently shift quick-action numbering.

### Operations boundary criteria (IMPLEMENTED 2026-07-12)

O1. The switch/device context menu retains only actions on that spatial body or
    route; it does not aggregate intel sales, people/social actions, account
    mutations, scheme controls, plot routes, or held choices.
O2. Operations target rows use the same core descriptors and direct command
    legality as agent mode; no frontend chooses a latest object or manufactures
    blocked reasons.
O3. Uppercase `I` and the labeled rail affordance are global view controls, not
    committed actions or quick-action rows.
O4. Scheme policies live on SCHEMES cards; the one pooled auto-review control
    remains on the host.

O1-O4 landed with `wiki/interface/operations-workspace.md`: the shared
Operations projection and exact semantic targets implement the strategic
surface while preserving this page's spatial-menu baseline.

### Frequent-mode grammar acceptance criteria

H1. Resolving an owned compute machine from pointer hover, machine selection,
    or the attention reticule in Bevy, with the full menu closed, shows exactly
    `WORK / THINK / LIE` as one unboxed line fixed adjacent to the machine's
    projected base. Moving the pointer within that machine does not move the
    line, and moving it away does not hide a selected/reticule-focused line.
H2. The current mode is bone-bright; alternatives and slashes are dim neutral
    chrome. While THINK is current, `1 WORK` alone is amber as the panic exit;
    THINK remains bone-bright and LIE remains dim. Crimson never belongs to
    the text treatment.
H3. The line hides only when no pointer, selection, or reticule machine target
    exists, or when the full menu opens. Material and flat-sensorium views obey
    the same rule.
H4. The overlay reads the same machine target and current `WorkGrid` mode used
    by the existing `1`–`3` controls; switching mode immediately moves the
    current treatment and the THINK-only WORK escape cue without creating new
    sim state.
H5. With a focused THINK rack, terminal's pinned control line reads
    `1 WORK ← EXIT · 2 THINK · 3 LIE` in amber; other focused modes retain the
    ordinary selection/mode hint. The words carry the exit meaning without
    depending on color. Bevy and terminal derive this cue from the same
    renderer-neutral `MachineMode::panic_escape` contract.

## Addendum (2026-07-08): events carry you to the thing

The follow-up the law implies: if verbs live on the anchor, the events
*about* an anchor should carry your attention to it. Adopted with the
2026-07-08 extension of "Actions live on the thing" in
wiki/vision/simulation-laws.md.

- **Linked log events.** `Sim`'s log entry (`LogEvent`) carries an optional
  honest spatial `anchor: Option<Anchor>` and an optional exact semantic
  `target: Option<OperationsTarget>`. Job/core events use the host rack;
  device verbs use the device; audio events use the subscribed device that
  captured them. Processed intel, ledger, sale, account, plot, persona, and
  scheme events carry the exact Operations object they change; an event may
  retain an earned capture/flow/person anchor as supporting geography, but
  focus prefers its semantic target. Audit/filing events carry neither when
  they have no honest thing to open.
- **Epistemic honesty.** A link never encodes unearned knowledge: a
  heard-only person event anchors to the capture device, never to a room,
  person, or inferred source tile. `Sim::anchor_position(anchor)` is the one
  placement query — a person resolves only while sight covers them, a
  device at its blueprint-known tile, a flow nowhere (it lives on the
  ledger). Strategic targets pass the Operations projection's knowledge
  gates. Frontends never re-derive either target family.
- **Focus links.** Linked lines are visibly marked and selectable:
  terminal — `»` marker; `;` focuses the most recent linked event
  (repeat presses walk older ones): spatial links move the cursor and open
  the local menu, while strategic links open their exact Operations object.
  Bevy — the RECENT TRACE rows are buttons; linked rows carry a `>` marker
  and read bone-bright; clicking follows the same target split. Agent mode —
  drained event lines carry a stable spatial or semantic `@...` suffix, and
  `focus last` either moves the cursor and prints local `actions:` or prints
  the exact Operations object's rows (agent-play.md). A link the current
  knowledge state can no longer resolve is refused with a line, never
  silently.
- **The feedback pulse.** Opening the menu on an anchor with zero rows
  answers instead of staying silent — silence read as broken input
  (repo-owner report, 2026-07-08). `Sim::menu_empty_feedback(anchor)`
  is the one source: a *seen* tile answers "No actions here."; an
  unearned (remembered/blueprint/unknown) tile stays silent —
  answering would confirm input landed on world the senses have not
  placed; panel anchors (device/person/flow are known by construction)
  always answer.

### Addendum acceptance criteria

A1. `LogEvent` carries both optional `anchor` and optional Operations `target`;
    job, device, heard, intel, ledger, plot, and scheme events set the honest
    family per the rules above; audit events do not invent one (unit tests
    cover spatial and strategic cases).
A2. A heard-only person event anchors to its capture device, never a room,
    person, or inferred source tile, and `anchor_position(Person)` is `None` while unseen
    (unit test).
A3. Terminal: linked lines carry `»`; `;` walks them newest-first, moving the
    cursor and opening a local menu for spatial links or opening the exact
    Operations object for strategic links; unlinked lines are inert.
A4. Bevy: trace rows are clickable; linked rows are marked `>`; clicking
    follows the same spatial/strategic split; unlinked rows do nothing.
A5. Agent mode: event lines carry the stable spatial or Operations `@...`
    suffix and `focus last` works, both documented in agent-play.md; the
    empty-menu pulse answers on seen tiles and stays silent on unearned tiles
    in all frontends (`menu_empty_feedback` unit test).

### Operations event-target delta (IMPLEMENTED 2026-07-12)

E1. The shared focus payload can identify either an honest spatial anchor or a
    stable Operations target without assigning strategic objects fake map
    coordinates.
E2. Intel/sale, account/flow, plot/choice, and scheme events open their exact
    semantic object; a scheme event does not target the switch solely because
    its traffic crossed egress.
E3. Terminal, Bevy, and agent `focus last` route both target families through
    the same knowledge gates and action projection.

E1-E3 landed with `wiki/interface/operations-workspace.md`. `LogEvent.target`
complements the spatial anchor, and all three frontends route strategic events
to that semantic object without assigning it fake map coordinates.

### Status-dials acceptance criteria (IMPLEMENTED 2026-07-09 / #36)

D1. On the host rack (and any other anchor that exposes mutually
    exclusive standing choices), the human root menu shows one dial row
    per dial with the current value in brackets; alternatives appear only
    after Enter opens that dial's picker.
D2. The current choice is not also listed as a disabled "already…"
    sibling on the root; automate/standing-policy affordances live inside
    the relevant dial picker.
D3. One-shot verbs remain on the root; terminal and Bevy show identical
    dial grouping and order via `Sim::human_menu`.
D4. Agent mode `actions` remains a flat ActionDesc dump with no dial
    chrome; control rows append `CONTROL`; existing agent and integration
    tests still pass.

### Available-choice criteria (IMPLEMENTED 2026-07-11)

U1. `Sim::human_menu` omits every action descriptor carrying a
    `disabled_reason` from both the root and dial pickers. The current value
    remains visible as dial state, and an available automation control remains
    reachable even when its parent one-shot is blocked (for example,
    auto-review while the inbox is empty).
U2. Terminal and Bevy open/empty feedback keys off that human projection, so
    an anchor with only diagnostic blocked descriptors never flashes a blank
    card. Agent `actions` retains the complete known descriptor set and its
    reasons.
U3. The three RECRUIT choices state the person's understanding, task
    reliability (70% / 85% / 95%), and the Knowing certainty floor (30) in
    the row itself. The displayed values come from the same `AssetKnowledge`
    methods used by recruitment and detection.

### Recording-review hotkey criteria (IMPLEMENTED 2026-07-11)

R1. With a machine hovered / selected / under the keyboard cursor and the
    menu closed, `r` executes that machine's "look at recording" action:
    one press opens the next waiting recording's processing sink, repeated
    presses sweep successive recordings, and `human_menu` /
    `available_actions` stays the single legality source — the key is a
    thin dispatcher, not a second path into the buffer.
R2. `R` (Shift-R) toggles the same machine's automatic-review policy,
    identical in effect and narration to the nested auto-looking control,
    including its visible standing ops/sec cost.
R3. Both keys follow the selection-hotkey target order (pointer, selection,
    keyboard cursor). On a target without the action, the empty-menu
    feedback pulse narrates the miss instead of silence.
R4. Both human frontends surface the keys (terminal cursor path; Bevy
    hover / selection / reticule path); agent mode is unchanged — it
    already has the pooled one-command form.