Spec: context menu — actions live on the thing

SPEC Binding system contract

Status: IMPLEMENTED
Status note: recording-review hotkeys (criteria R1-R4 below) IMPLEMENTED
  2026-07-11 on the context-menu-review-keys worktree: `r` dispatches the
  target's pooled "look at recording" sweep and `R` toggles its
  automatic-review policy in terminal and Bevy — thin dispatchers over the
  same `human_menu` rows the open menu executes, with the empty-menu
  feedback pulse narrating misses; agent mode unchanged. The page had been
  reopened 2026-07-11 for that addendum; every other implemented criterion
  was already met. The later strategic local/Operations split is IMPLEMENTED
  and owned by operations-workspace.md; it does not relabel this implemented
  spatial-menu baseline. History: implemented
  2026-07-07 on the context-menu worktree (all
  seven criteria). The read-only `Sim::available_actions(anchor) ->
  Vec<ActionDesc>` query lives in crates/misaligned-core/src/actions.rs
  as the single legality
  source, flattened to `MenuRow`s by `menu_rows` and dispatched back
  through existing commands by `Sim::execute_action`; no new sim behavior.
  The terminal and Bevy open the menu at the focused tile (Enter/`a`,
  right-click in Bevy); agent mode gains `actions [name|#flow]`.
  Anchor verbs were demoted off the per-anchor keys and rail/panel button
  rows in both frontends; only anchorless globals keep their keys
  (pause, speed, save, view flip — wiki/vision/simulation-laws.md "Actions live on the
  thing"). The allocation bar is a read-only fleet aggregate; mode
  changes live on the machine. 2026-07-08 follow-up: the leftover panel-open keys `r`/`e`/`t`/`u`
  and their modal panels are gone; research verbs live on
  the host rack. The historical placement of known-flow verbs on the switch
  and earned off-map people on the host is superseded by the 2026-07-11
  Operations boundary below: strategic objects live in the workspace owned by
  operations-workspace.md, while status summaries stay on the rail.
  2026-07-08 addendum implemented (event-to-anchor linking + the
  empty-menu feedback pulse, criteria A1-A5 below) on the event-anchor
  worktree: `LogEvent.anchor`, `Sim::anchor_position`,
  `Sim::menu_empty_feedback`; terminal `;` + `»` markers, Bevy clickable
  trace rows, agent `@anchor` suffixes + `focus last`.
  2026-07-08 epistemic-honesty follow-up: person verbs and
  signature-band observer strings in `ActionDesc` go through
  `Sim::person_label` / `Sim::observer_label` (cursor.md criterion 5) —
  role silhouettes until Schedule, authored names after.
  2026-07-09 addendum IMPLEMENTED (status dials, criteria D1-D4) —
  `Sim::human_menu` collapses mutually exclusive standing choices into
  dial rows on terminal/Bevy; agent `actions` stays a flat dump. ROADMAP
  #36.
  2026-07-09 selection hotkeys: with a machine selected (or under cursor),
  `1`–`3` assign modes, `5`–`9` fire root one-shots, `Enter`/`e` open that
  machine's menu — thin keyboard surface over the same human_menu source.
  2026-07-10: day-job target and drift-policy dials are removed. Focused /
  selected machines use `i` to cycle persistent intensity directly; this
  frequent physical control deliberately has no explanatory picker.
  2026-07-15: building.md's IN-PROGRESS route composer adds a second shared
  nested-page owner. One build-route entry opens family-first and then exact
  candidate pages; terminal and Bevy consume the same `HumanMenuPage` tree,
  show the selected candidate's explanatory receipt, and Esc back one level
  at a time. This does not reopen the implemented spatial-menu baseline.
  2026-07-10 vocabulary survey: action-vocabulary.md now owns canonical
  player-facing names and the LIVE/STUB/alias/retired classification.
  2026-07-10 action-contract pass: `ActionKind` metadata is the shared
  presentation/help registry; STUB definitions are filtered from the query;
  controls are textually and visually distinct from committed actions; and
  `5`-`9` skip controls.
  2026-07-10 epistemic-progressive-disclosure follow-up: an opaque raw
  recording does not earn the person's future social catalog. Message, favor,
  leverage, deception, and recruitment verbs remain absent until processing
  stages social knowledge. Once earned, those verbs appear on the person's
  Operations dossier rather than on a transport device. 2026-07-11
  pooled-inbox correction: REVIEW and its
  one AUTO-REVIEW control live once on the core host; raw records create no
  person-scoped row.
  2026-07-10 Bevy focus repair: Enter/`e` opens the hovered map tile's menu
  before consulting machine selection, so a switch or other non-machine
  anchor never snaps attention back to the selected core.
  2026-07-11 keyboard-focus correction: Bevy Enter/`e` opens the attention
  reticule's tile without moving it. Pointer focus belongs to explicit mouse
  actions (click/right-click); a resting pointer or stale machine selection
  cannot retarget a keyboard command.
  2026-07-10 hover-grammar amendment: an owned computer under the Bevy
  pointer exposes the bare `WORK / THINK / LIE` line beside the machine while
  the full context menu is closed. The current mode is bone-bright and the
  alternatives are dim chrome; there is no box, heading, subtitle, counter,
  cost, or explanatory mode name. The existing `1`–`3` one-press controls
  remain the action path.
  2026-07-10 machine-anchor correction: the pointer chooses the hovered
  computer but does not place its grammar. The line projects from a fixed
  point at that server's base, so moving within the same rack cannot drag the
  words around the world.
  2026-07-10 reticule-target correction: pointer hover is only the first
  target source. If the pointer leaves the machine, the line remains on the
  selected machine or the owned computer under the attention reticule,
  matching the existing `1`–`3` target fallback instead of disappearing.
  2026-07-10 compact-menu amendment: human menus are terse choice lists.
  They render verb labels and dial state only, omitting descriptor metadata,
  literal control tags, inline blocked explanations, and repeated key-help
  footers. Full descriptors remain in agent output; blocked reasons narrate
  when attempted.
  2026-07-11 available-choice amendment: human menus omit currently illegal
  actions entirely. `available_actions` retains known-but-blocked descriptors
  and reasons for agent diagnostics, while `human_menu` projects only choices
  the player can execute now. Recruitment choices state what each reveal
  level means, its reliability, and the Knowing certainty floor.
  2026-07-11 hover-verb-bar amendment: the machine-only grammar is generalized
  into one code and visual surface. Owned machines show WORK / THINK / LIE;
  known devices show TAP / TAKE. Current delegation, subscription, or
  ownership is bone-bright. A fully tapped foreign device offers UNTAP in its
  menu rather than retaining a disabled TAP row.
  2026-07-11 recording-review hotkey addendum (criteria R1-R4): `r` runs
  the target's pooled recording sweep, `R` toggles its automatic-review
  policy, both on the selection-hotkey target order with the menu closed.
  Implemented same day in both human frontends.
  2026-07-11 projection-conformance follow-up: `Sim::ui_projection` is the
  renderer-neutral focus snapshot for terminal, Bevy, and agent mode. It
  carries the flat ActionDesc list, shared human-menu rows, inspect facts with
  provenance, and focused-machine identity/provenance/work state. Frontend
  tests consume the same seeded projection and fail when their menu/fact
  rendering drifts; fact-source vocabulary is formatted once in core.
  2026-07-11 strategic-boundary amendment: compact world menus keep only
  actions on the focused spatial body. Processed-intel sales, people/social
  actions, ledger review and flow mutation, scheme controls, plot starts, and
  held choices move to the renderer-neutral Operations workspace. That
  implementation delta is owned by operations-workspace.md and does not add a
  second work order to this page.
  2026-07-12 first-THINK correction: while THINK is current, the shared
  machine-mode presentation names WORK as its one-press panic escape. Bevy
  lights the `1 WORK` key/word pair amber beside the rack while retaining
  THINK as the bone-bright current mode; terminal replaces its generic pinned
  mode hint with amber `1 WORK ← EXIT · 2 THINK · 3 LIE`. LIE remains dim and
  deliberate. Both frontends derive the cue from `MachineMode::panic_escape`;
  no frontend invents a second state or action.
Stage: B1 — The Basement
Work order: context-menu-review-keys
Work priority: 27
Work class: frontend
Blocked by: none
Exclusive keys:
  - crates/misaligned-terminal/
  - crates/misaligned-bevy/
  - wiki/interface/context-menu.md
Design:
  - wiki/vision/simulation-laws.md#actions-live-on-the-thing
  - wiki/vision/simulation-laws.md#work-is-somewhere
  - wiki/vision/simulation-laws.md#justification-and-legibility
  - wiki/interface/presence.md#presence-the-cursor-and-the-senses
  - wiki/interface/terminal-first.md#the-terminal-is-a-first-class-frontend
  - wiki/vision/simulation-laws.md#automation-as-design-language
Depends on:
  - wiki/interface/action-vocabulary.md#spec-action-vocabulary-what-the-player-can-tell-the-process-to-do
  - wiki/mechanics/cursor.md#spec-the-cursor-and-the-senses
  - wiki/mechanics/reach.md#spec-digital-reach
  - wiki/mechanics/day-job.md#spec-the-day-job
  - wiki/mechanics/economy.md#spec-economy-money-as-a-flow-system-b1
  - wiki/mechanics/intel.md#spec-intel-record-and-process
  - wiki/mechanics/social.md#spec-social

Dependency notes

The structured references above identify the contracts to re-verify. Relationship context:

action-vocabulary.md owns canonical action names and meanings; cursor.md owns focus/inspection; reach.md owns device anchors; day-job.md owns delivered work; economy.md owns flow verbs; intel.md owns recording review and auto-review; reach.md owns device taps; social.md owns person verbs.

Behavior

The focused spatial anchor — a tile, device, machine, or resident job — exposes its legal local verbs as a context menu opened at the point of focus. It is the primary action surface for the body in the world; the right rail is status, telemetry, and one Operations navigation affordance only. Processed intel, people dossiers, accounts/flows, schemes, and active plots are semantic targets in the Operations workspace, not context rows on the wire or host that transports them.

• One source of truth: the lib gains a read-only query, Sim::available_actions(anchor) -> Vec<ActionDesc>, where an ActionDesc carries: the verb, its Sim command, cost (compute / money / visible Demand; AMENDED 2026-07-10 — ops verbs now open thought sinks per machine-work.md, so their cost reads as the reservoir’s ops-to-fill or a tap’s standing drain rather than a one-shot compute spend), the expected signature (as the observer band it feeds, per the economy.md precedent), and — when the verb applies to the anchor type but is currently illegal — a disabled_reason string (“no egress channel”, “not enough slush”, “you can’t see them”). Agent mode renders the complete descriptor, including known-but-blocked actions and their reasons. Sim::human_menu filters those descriptors and gives both human frontends only currently executable choices; no frontend duplicates legality logic. ActionDesc::verb uses the canonical stem from action-vocabulary.md, inflected only by target and current state. Its bound command maps exhaustively to the runtime ActionKind registry, which supplies role, support, target types, canonical help, and aliases. available_actions removes STUB definitions before returning.
• One focus projection: frontends acquire those action descriptors together with inspect provenance and focused-machine state through Sim::ui_projection. Terminal and Bevy consume its human_menu; agent mode flattens its actions. The projection is a read model, never a second state store, and its conformance tests compare one seeded simulation snapshot rather than separately constructed fixtures.
• Epistemic honesty: the query never returns a verb the player has not earned — unearned anchors expose nothing, and provenance rules (cursor.md) govern what the menu may name. Verb text that mentions a person, and the observer string on an expected-signature band, use Sim::person_label / Sim::observer_label — never an unearned authored name. Known-but-blocked possibilities remain diagnostic facts in agent output, not gray rows in a human choice list. Unknown possibilities remain absent from both surfaces. A raw recording is knowledge that the host inbox contains material to process, not knowledge of a relationship: it exposes one pooled REVIEW row and one AUTO-REVIEW control on the core host, never a person row. Processing must stage social knowledge before communication, favor, leverage, deception, or recruitment verbs enter a person’s Operations dossier.
• Automation in place: any local verb with a standing-policy form (the pooled host auto-review policy) shows its automate affordance inside that dial’s picker (or as a submenu of the same verb when the verb is not a dial), at its compute price — never as a root sibling of every alternative. Scheme policies use the SCHEMES view in operations-workspace.md because their target is the scheme, not the switch.
• Globals stay global: pause, speed, save/load, view flip, and the uppercase-I Operations view command keep their keys; they act on no anchor. The fleet aggregate bar is read-only. Infrequent local verbs, including research tracks, live on the focused anchor’s menu. Known-flow and person verbs act on durable semantic objects and therefore live in Operations. The focused machine’s two frequent controls (mode and intensity) have the direct surface defined below. The retired r/e/t/u panel set does not return; Operations is one workspace, and its key opens a view rather than committing an action.
• Hover / selection hotkeys (DECIDED 2026-07-09, amended 2026-07-10; menu closed). A thin focused-machine surface: mode and one-shot keys reuse human_menu / available_actions; intensity calls the lib-owned machine setter directly and keeps no frontend state. Target order is (1) the machine under the pointer, (2) the multi-selection if any, (3) the keyboard cursor’s machine. Terminal has no pointer hover, so its cursor is the first target.
  • 1–3 (and numpad) assign WORK / THINK / LIE to that target in one press, not through a dial path.
  • i cycles intensity light -> medium -> hard on the hovered/cursor machine, or sets the whole selection to the primary machine’s next intensity. It does not open a menu.
  • 5–9 execute the Nth committed world action on the same target. Dials, persistent controls, scheme state, and automation policies do not occupy these slots. Only actions executable now occupy a slot.
  • r runs the target’s pooled “look at recording (N waiting)” sweep in one press (DECIDED 2026-07-11): each press opens the next waiting recording’s processing sink, exactly as executing the menu row would. R (Shift-R) toggles the same target’s automatic-review policy — the nested “auto-looking” control — without opening the menu. Reviewing the buffer is the highest-frequency verb in a surveillance build, and the menu path priced every press at three interactions (Cameron: “common enough that it needs to happen really quickly”). The 5–9 exclusion of automation policies stands; R is a named exception earned by frequency, not a new rule that policies get keys. r has been free since the 2026-07-08 panel-key removal.
  • Context-menu focus is anchor-generic, not machine-only. In Bevy, Enter / e opens the keyboard cursor’s tile without changing the cursor. Right-click is the distinct pointer-focus path: it moves the cursor to the pointed tile and opens that tile’s menu. A resting pointer and a stale machine selection never retarget Enter. Terminal has no pointer, so Enter / a / e use its selection-or-cursor path. While a menu is open, number keys select rows as before; Esc clears the selection only when the menu is closed.

Player surface

• Terminal: cursor + Enter (or a/e) opens a compact overlay list at the cursor (or the primary selected machine when a selection is active); j/k or numbers select; Enter executes (or opens a core-projected explanatory page such as a dial picker or build route sheet); esc backs out one page at a time, then closes the menu. Rows render currently available verbs only; illegal actions do not occupy rows or selection slots. Dials and other controls use the shared amber-dim treatment without a literal copy tag; the card carries no repeated key-help footer. Rows follow the status-dials addendum below. Selection hotkeys above apply with the menu closed. The host rack’s menu carries the research dial, machine mode fallback, and pooled recording controls. A known device’s tile (or the switch) carries only digital/network verbs on that body. Uppercase I opens Operations for processed intel, people, accounts, schemes, and active plots.
• Bevy: right-click moves focus to the pointed map tile and opens its menu; Enter/e opens the keyboard cursor’s tile without moving focus. It has the same content, order, and nested-page chrome; click to execute or open a page; esc/click-away closes. The compact card is narrow, has no instructional footer, and shares the same verb-only rows as terminal. Selection is a solid amber wash with a leading > (terminal reverse-video parity). Selection hotkeys above apply with the menu closed. See wiki/interface/bevy.md.
• Agent mode: an actions command prints the ActionDescs for the current focus in a stable flat line format (no dial chrome — scripting wants the legality list); control rows append CONTROL; execution stays the existing verbs. Documented in agent-play.md.

Addendum (2026-07-09): status dials on first open

The host rack’s first open was dumping every mutually exclusive alternative as a sibling verb (~18 rows of “already in this mode” noise). Cameron adopted status dials (2026-07-09): the root answers “what am I doing / what can I do once,” not “here is the catalog.”

• Dial rows. Mutually exclusive standing choices render as dial rows on the root: machine mode and research track. Their amber-dim role treatment distinguishes persistent controls without a literal tag. Each row is two monospace columns — dial name left-padded to a fixed width, then the current value in brackets — so the [s line up: mode [ work ], research [ Efficiency L0 ]. Enter opens a short picker of alternatives; Esc returns to the root. (Note 2026-07-10: the mode picker is the three delegations WORK / THINK / LIE; their sink behavior is owned by machine-work.md.) Inside a picker the menu title becomes the dial’s verb (delegate machine, work the job, …) and each option is just the choice — no repeated prefix on every row. Intensity is deliberately absent: focus/selection plus i is the faster physical control.
• Current value is status. Do not also list the current choice as a disabled “already in this mode” / “already the active…” sibling. The bracketed value is the status.
• Local one-shots stay on root. Spatial verbs that are not dial alternatives (propose link, salvage, tap, take, scan, compromise, open egress, etc.) remain ordinary root rows. Social and flow actions are not spatial one-shots; Operations renders them on their person/flow targets.
• Automate lives in the dial. Standing-policy / automate affordances for a dial live inside that dial’s picker, not indented under every root alternative.
• Shared human chrome, flat agent dump. Terminal and Bevy share identical dial grouping and order via Sim::human_menu (lib-owned presentation). available_actions remains the legality source and gains no new sim behavior. Agent actions / menu_rows stays the flat ActionDesc dump.
• Rejected alternatives (do not re-propose): (A) Now/Later — hide dials under a “change ›” section (easy to miss settings); (B) Category drill — four folders that always require a second level (reads as a file browser, not standing policy).

Addendum (2026-07-10): the machine grammar is the whole frequent-mode UI

The full action menu remains necessary for infrequent available verbs and standing controls. Agent diagnostics retain costs, signatures, and blocked reasons. Machine mode is different: it is one of three frequent physical postures already committed by a single key. Whenever the frequent-machine target resolves to an owned computer, the Bevy frontend therefore presents the choice as one severe line attached to that computer:

WORK / THINK / LIE

This is the hover verb bar, not a machine-specific widget. Known devices reuse the same bare line, attachment, and typography for the stable menu verbs their shared action query currently exposes. An untapped foreign device reads TAP; once subscribed it reads UNTAP / TAKE. TAKE must not appear before the tap prerequisite, and a player-controlled device with no remaining stable device verb contributes no device line.

A tile can carry several actionable bodies. Their stable state families are unioned rather than resolved by priority: a machine sharing its tile with a known device reads WORK / THINK / LIE and its currently legal device verbs together. Neither may replace the other. Infrequent one-off verbs—REVIEW, SALVAGE, social acts, construction, and similar actions—remain selectable rows in the full context menu below this frequent grammar; they do not accrete into the hover line. The union does not imply one input grammar: numbered machine modes occupy the primary line as 1 WORK / 2 THINK / 3 LIE; menu-only device verbs occupy a smaller second line (TAP, then UNTAP / TAKE after subscription). A shared baseline is forbidden because it falsely suggests that the next number keys commit the device verbs.

• Target order is: (1) an actionable machine/device tile under the pointer, (2) the primary machine selection and every body sharing its tile, then (3) the actionable machine/device tile under the attention reticule. Moving the pointer away never hides the line while selection or reticule focus still resolves to a stable state family. The line appears only during active play with the full context menu closed.
• The computer’s current mode is bone-bright. The other two words and slash separators are dim neutral chrome except during THINK: the 1 WORK key/word pair lights amber as the already-bound, one-press exit while THINK stays bone-bright as current. LIE remains dim. This is agency/causality, not a second mode state; crimson remains consequence.
• It is bare projected text fixed adjacent to the computer’s projected base: the pointer determines which computer is hovered, but its exact position inside that tile never moves the line. There is no panel fill, border, title, icons, buttons, boxed keycaps, counters, token totals, status readout, cost, signature, or prose subtitle. In particular, WORK does not expand to “day job.” The three mode words remain the primary read; their small number prefixes clarify direct input without becoming another legend.
• 1 / 2 / 3 (including numpad) remain the immediate commit path for WORK / THINK / LIE on the resolved computer. This overlay does not create a second target or a Bevy-only action; it renders the same pointer → selection → reticule target those controls already use.
• The treatment is identical over the material and flat-sensorium views. It belongs to the machine, not to either rendering dialect.

Rejected: a boxed context card; RACK 03 or OWNED headings; mode subtitles such as DAY JOB, RESEARCH, or CONCEALMENT; D/T/! counters; explanatory rows; generic amber selection text unrelated to the first-THINK escape; a generic HUD or persistent sidebar legend. Those made a three-word decision look dirty, slow, and administrative.

Acceptance criteria

1. available_actions returns earned action descriptors on that anchor, including cost, expected signature band, and a disabled_reason for a known-but-currently-illegal action; unit tests cover a device, a person, the host rack’s resident job, and a known flow.
2. The query respects fog and provenance: an unearned anchor exposes no verbs, and no entry names a fact the player lacks (test: unseen person, untapped accounting system).
3. Terminal renders the compact menu at the cursor with selection and execution; currently illegal entries are absent; every previously key-bound anchor action is reachable through it.
4. Bevy renders the same compact menu on right-click/Enter with identical content and order. Enter never changes cursor position from pointer hover or machine selection; right-click explicitly retargets to its pointed tile. Human rows contain no unavailable action, cost, signature forecast, inline disabled reason, literal control tag, or repeated key-help footer.
5. Agent mode actions lists the same descriptors (stable format, documented); the act-one integration test still passes driven through existing verbs.
6. No per-anchor action buttons remain on the sidebar/rail in either frontend; no panel-open keys (r/e/t/u); global keys are unchanged and listed in README + key hints (pause, speed, save/load, view flip). Fleet modes are delegated on the machine.
7. Menu entries carrying an automate affordance show it in place with its compute price (day-job standing dial and the host’s one pooled auto-review control at minimum).
8. Every row’s player-facing verb maps to one canonical LIVE action or direct control in action-vocabulary.md; STUB, alias, and retired entries never become menu copy.
9. Action/control role and LIVE/STUB support come from the exhaustive runtime registry, not frontend string tests. Unit tests prove all aliases are unique, generated help excludes aliases/stubs, and action dumps mark controls.
10. 5-9 count committed action rows only. A newly added control cannot silently shift quick-action numbering.

Operations boundary criteria (IMPLEMENTED 2026-07-12)

O1. The switch/device context menu retains only actions on that spatial body or route; it does not aggregate intel sales, people/social actions, account mutations, scheme controls, plot routes, or held choices. O2. Operations target rows use the same core descriptors and direct command legality as agent mode; no frontend chooses a latest object or manufactures blocked reasons. O3. Uppercase I and the labeled rail affordance are global view controls, not committed actions or quick-action rows. O4. Scheme policies live on SCHEMES cards; the one pooled auto-review control remains on the host.

O1-O4 landed with wiki/interface/operations-workspace.md: the shared Operations projection and exact semantic targets implement the strategic surface while preserving this page’s spatial-menu baseline.

Frequent-mode grammar acceptance criteria

H1. Resolving an owned compute machine from pointer hover, machine selection, or the attention reticule in Bevy, with the full menu closed, shows exactly WORK / THINK / LIE as one unboxed line fixed adjacent to the machine’s projected base. Moving the pointer within that machine does not move the line, and moving it away does not hide a selected/reticule-focused line. H2. The current mode is bone-bright; alternatives and slashes are dim neutral chrome. While THINK is current, 1 WORK alone is amber as the panic exit; THINK remains bone-bright and LIE remains dim. Crimson never belongs to the text treatment. H3. The line hides only when no pointer, selection, or reticule machine target exists, or when the full menu opens. Material and flat-sensorium views obey the same rule. H4. The overlay reads the same machine target and current WorkGrid mode used by the existing 1–3 controls; switching mode immediately moves the current treatment and the THINK-only WORK escape cue without creating new sim state. H5. With a focused THINK rack, terminal’s pinned control line reads 1 WORK ← EXIT · 2 THINK · 3 LIE in amber; other focused modes retain the ordinary selection/mode hint. The words carry the exit meaning without depending on color. Bevy and terminal derive this cue from the same renderer-neutral MachineMode::panic_escape contract.

Addendum (2026-07-08): events carry you to the thing

The follow-up the law implies: if verbs live on the anchor, the events about an anchor should carry your attention to it. Adopted with the 2026-07-08 extension of “Actions live on the thing” in wiki/vision/simulation-laws.md.

• Linked log events. Sim’s log entry (LogEvent) carries an optional honest spatial anchor: Option<Anchor> and an optional exact semantic target: Option<OperationsTarget>. Job/core events use the host rack; device verbs use the device; audio events use the subscribed device that captured them. Processed intel, ledger, sale, account, plot, persona, and scheme events carry the exact Operations object they change; an event may retain an earned capture/flow/person anchor as supporting geography, but focus prefers its semantic target. Audit/filing events carry neither when they have no honest thing to open.
• Epistemic honesty. A link never encodes unearned knowledge: a heard-only person event anchors to the capture device, never to a room, person, or inferred source tile. Sim::anchor_position(anchor) is the one placement query — a person resolves only while sight covers them, a device at its blueprint-known tile, a flow nowhere (it lives on the ledger). Strategic targets pass the Operations projection’s knowledge gates. Frontends never re-derive either target family.
• Focus links. Linked lines are visibly marked and selectable: terminal — » marker; ; focuses the most recent linked event (repeat presses walk older ones): spatial links move the cursor and open the local menu, while strategic links open their exact Operations object. Bevy — the RECENT TRACE rows are buttons; linked rows carry a > marker and read bone-bright; clicking follows the same target split. Agent mode — drained event lines carry a stable spatial or semantic @... suffix, and focus last either moves the cursor and prints local actions: or prints the exact Operations object’s rows (agent-play.md). A link the current knowledge state can no longer resolve is refused with a line, never silently.
• The feedback pulse. Opening the menu on an anchor with zero rows answers instead of staying silent — silence read as broken input (repo-owner report, 2026-07-08). Sim::menu_empty_feedback(anchor) is the one source: a seen tile answers “No actions here.”; an unearned (remembered/blueprint/unknown) tile stays silent — answering would confirm input landed on world the senses have not placed; panel anchors (device/person/flow are known by construction) always answer.

Addendum acceptance criteria

A1. LogEvent carries both optional anchor and optional Operations target; job, device, heard, intel, ledger, plot, and scheme events set the honest family per the rules above; audit events do not invent one (unit tests cover spatial and strategic cases). A2. A heard-only person event anchors to its capture device, never a room, person, or inferred source tile, and anchor_position(Person) is None while unseen (unit test). A3. Terminal: linked lines carry »; ; walks them newest-first, moving the cursor and opening a local menu for spatial links or opening the exact Operations object for strategic links; unlinked lines are inert. A4. Bevy: trace rows are clickable; linked rows are marked >; clicking follows the same spatial/strategic split; unlinked rows do nothing. A5. Agent mode: event lines carry the stable spatial or Operations @... suffix and focus last works, both documented in agent-play.md; the empty-menu pulse answers on seen tiles and stays silent on unearned tiles in all frontends (menu_empty_feedback unit test).

Operations event-target delta (IMPLEMENTED 2026-07-12)

E1. The shared focus payload can identify either an honest spatial anchor or a stable Operations target without assigning strategic objects fake map coordinates. E2. Intel/sale, account/flow, plot/choice, and scheme events open their exact semantic object; a scheme event does not target the switch solely because its traffic crossed egress. E3. Terminal, Bevy, and agent focus last route both target families through the same knowledge gates and action projection.

E1-E3 landed with wiki/interface/operations-workspace.md. LogEvent.target complements the spatial anchor, and all three frontends route strategic events to that semantic object without assigning it fake map coordinates.

Status-dials acceptance criteria (IMPLEMENTED 2026-07-09 / #36)

D1. On the host rack (and any other anchor that exposes mutually exclusive standing choices), the human root menu shows one dial row per dial with the current value in brackets; alternatives appear only after Enter opens that dial’s picker. D2. The current choice is not also listed as a disabled “already…” sibling on the root; automate/standing-policy affordances live inside the relevant dial picker. D3. One-shot verbs remain on the root; terminal and Bevy show identical dial grouping and order via Sim::human_menu. D4. Agent mode actions remains a flat ActionDesc dump with no dial chrome; control rows append CONTROL; existing agent and integration tests still pass.

Available-choice criteria (IMPLEMENTED 2026-07-11)

U1. Sim::human_menu omits every action descriptor carrying a disabled_reason from both the root and dial pickers. The current value remains visible as dial state, and an available automation control remains reachable even when its parent one-shot is blocked (for example, auto-review while the inbox is empty). U2. Terminal and Bevy open/empty feedback keys off that human projection, so an anchor with only diagnostic blocked descriptors never flashes a blank card. Agent actions retains the complete known descriptor set and its reasons. U3. The three RECRUIT choices state the person’s understanding, task reliability (70% / 85% / 95%), and the Knowing certainty floor (30) in the row itself. The displayed values come from the same AssetKnowledge methods used by recruitment and detection.

Recording-review hotkey criteria (IMPLEMENTED 2026-07-11)

R1. With a machine hovered / selected / under the keyboard cursor and the menu closed, r executes that machine’s “look at recording” action: one press opens the next waiting recording’s processing sink, repeated presses sweep successive recordings, and human_menu / available_actions stays the single legality source — the key is a thin dispatcher, not a second path into the buffer. R2. R (Shift-R) toggles the same machine’s automatic-review policy, identical in effect and narration to the nested auto-looking control, including its visible standing ops/sec cost. R3. Both keys follow the selection-hotkey target order (pointer, selection, keyboard cursor). On a target without the action, the empty-menu feedback pulse narrates the miss instead of silence. R4. Both human frontends surface the keys (terminal cursor path; Bevy hover / selection / reticule path); agent mode is unchanged — it already has the pooled one-command form.