Implement wiki/interface/context-menu.md to all seven acceptance criteria. The action surface moves off the global-key and per-panel button pile onto a menu on the focused anchor, answering Cameron's 2026-07-07 playtest ("hard to play; a context menu rather than a bunch of buttons"). New read-only lib query as the single legality source: src/actions.rs adds `Sim::available_actions(anchor) -> Vec<ActionDesc>` over tile/device/person/ flow anchors, `menu_rows` (flattens automate affordances into indented child rows), and `Sim::execute_action` (dispatches a chosen command back through the existing command methods). Every descriptor carries verb, bound command, cost, expected signature as the observer band it feeds, and — for a known but illegal verb — a disabled_reason. The query respects fog and provenance: unearned anchors expose nothing and no entry names an unearned fact. Added `Sim::set_standing_policy` and `Leverage::bribe_cost`. Terminal: Enter/`a` opens the menu at the cursor or a panel selection; j/k or 1-9 select, Enter runs (blocked entries narrate why), esc closes. Bevy: right-click/Enter opens a menu card at the pointer with click + keyboard drive. Agent mode: `actions [name|#flow]` prints the descriptors in a stable line format. Anchor verbs demoted off the keys/rail/panel button rows in both frontends; globals (pause, speed, save/load, panel keys, allocation bar) keep their keys. README and in-game hints updated. Defense: DESIGN.md "Actions live on the thing" (adopted 2026-07-07) is the governing law and mandates exactly this surface — one read-only query as the single source of action legality for terminal, Bevy, and agent mode, verbs on the focused anchor with cost and expected signature shown before commit, and the rail reduced to status. "Justification and legibility" is served by each entry carrying its cost and observer band and each blocked entry its reason; "Automation as design language" by the standing-policy and watch automate affordances rendered in place at their compute price; "Presence: the cursor and the senses" by the menu opening where attention is and exposing only earned, provenance-legal facts. No new sim behavior: execution routes through existing commands, so the act-one integration test passes unchanged. Spec Status set to IMPLEMENTED in this commit. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>