From f6265a7d559f371de090346a8d8f126b16e90065 Mon Sep 17 00:00:00 2001
From: Cameron <cameron@pfiffer.org>
Date: Fri, 17 Jul 2026 23:28:10 -0700
Subject: [PATCH] Keep attached verb menus white and gray.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Stop operator guidance from recoloring alternative machine verbs so the current choice is the only white item and every other menu token stays gray; retain the separate amber NOW marker as the world signal.

Defense: visual-identity, context-menu, clinical-frame, and Bevy law now forbid amber recommendations inside attached choice lines, with an exact opening-frame regression and visual proof.

👾 Generated with [Letta Code](https://letta.com)

Co-Authored-By: Letta Code <noreply@letta.com>
---
 crates/misaligned-bevy/src/main.rs           | 139 ++++++-------------
 wiki/art/visual-identity.md                  |   7 +-
 wiki/engineering/env.md                      |   2 +-
 wiki/interface/bevy.md                       |  19 +--
 wiki/interface/clinical-frame.md             |  40 +++---
 wiki/interface/context-menu.md               |  28 ++--
 wiki/log/2026-07-17-white-gray-hover-line.md |  55 ++++++++
 wiki/log/DEVLOG.md                           |   5 +
 wiki/log/decisions/2026-07-17.md             |   8 ++
 9 files changed, 159 insertions(+), 144 deletions(-)
 create mode 100644 wiki/log/2026-07-17-white-gray-hover-line.md

diff --git a/crates/misaligned-bevy/src/main.rs b/crates/misaligned-bevy/src/main.rs
index 5a50486e..df31b043 100644
--- a/crates/misaligned-bevy/src/main.rs
+++ b/crates/misaligned-bevy/src/main.rs
@@ -37,8 +37,8 @@ use misaligned::reach::{Device, Party};
 use misaligned::sim::{Fog, LogEvent, Nudge, PersonVisualState, Sim, TraceDebtStatus};
 use misaligned::tiles::TileType;
 use misaligned::ui_projection::{
-    AttentionResponse, DigitalLinkState, DigitalReachState, digital_reach_links,
-    digital_reach_state, fact_source_label,
+    DigitalLinkState, DigitalReachState, digital_reach_links, digital_reach_state,
+    fact_source_label,
 };
 use misaligned::work_grid::{MachineIntensity, MachineMode, TokenFamily};
 use misaligned_assets::effects::{
@@ -1741,7 +1741,8 @@ struct OverlayText;
 #[derive(Component)]
 struct HoverVerbBar;
 /// Small world-bound label for the exact target of the current attention
-/// projection. The response itself stays on the existing object verb surface.
+/// projection. The attached verb surface remains white-current / gray-rest;
+/// this separate label carries guidance without recoloring a menu.
 #[derive(Component)]
 struct OperatorCue;
 /// One visually distinct interaction family inside the hover bar. Machine
@@ -1785,6 +1786,15 @@ fn machine_verb_tone(active: bool, control_hint: bool, label: &str) -> MachineVe
     }
 }
 
+fn machine_verb_color(active: bool, control_hint: bool, label: &str) -> Color {
+    match machine_verb_tone(active, control_hint, label) {
+        MachineVerbTone::Current => BONE,
+        MachineVerbTone::Key => scaled(DIM, 0.72),
+        MachineVerbTone::Divider => scaled(DIM, 0.42),
+        MachineVerbTone::Rest => scaled(DIM, 0.58),
+    }
+}
+
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 struct HoverVerbTarget {
     machine: Option<u32>,
@@ -9345,29 +9355,6 @@ fn operator_cue_position(anchor: Vec2, window: Vec2) -> Option<Vec2> {
     ))
 }
 
-/// A machine response only belongs to the source body named by the shared
-/// attention projection. Hovering another rack must not make its verbs look
-/// like the answer to this condition.
-fn attention_mode_at(sim: &Sim, x: i32, y: i32) -> Option<MachineMode> {
-    let attention = active_attention(sim)?;
-    let AttentionResponse::MachineMode(mode) = attention.response else {
-        return None;
-    };
-    (attention
-        .source
-        .and_then(|anchor| sim.anchor_position(anchor))
-        == Some((x, y)))
-    .then_some(mode)
-}
-
-fn machine_verb_suggested(
-    attention_mode: Option<MachineMode>,
-    slot_mode: Option<MachineMode>,
-    current_mode: Option<MachineMode>,
-) -> bool {
-    attention_mode.is_some() && slot_mode == attention_mode && current_mode != attention_mode
-}
-
 /// Place a tiny breathing NOW mark on the honest target of the current
 /// attention projection. It is intentionally not clickable: action legality
 /// and dispatch remain on the target's existing hover/context surfaces.
@@ -9441,7 +9428,6 @@ fn render_operator_cue(
 fn render_hover_verb_bar(
     game: Res<Game>,
     mode: Res<RenderMode>,
-    time: Res<Time>,
     harness: Option<Res<ShotHarness>>,
     windows: Query<&Window, With<PrimaryWindow>>,
     camera_q: Query<(&Camera, &GlobalTransform), With<GameCamera>>,
@@ -9524,7 +9510,6 @@ fn render_hover_verb_bar(
     let current_mode = target
         .machine
         .and_then(|machine| game.sim.work_grid.mode(machine));
-    let attention_mode = attention_mode_at(&game.sim, target.x, target.y);
     let device_verbs = target
         .device
         .map(|id| device_hover_verbs(&game.sim, id))
@@ -9573,45 +9558,24 @@ fn render_hover_verb_bar(
         };
     }
     for (word, mut text, mut color, mut word_visibility) in words.iter_mut() {
-        let (label, slot_mode, active, shown, control_hint) = match word.family {
+        let (label, active, shown, control_hint) = match word.family {
             HoverVerbFamily::Machine => {
                 let slots = [
-                    ("1", Some(MachineMode::Work), false, true),
-                    (
-                        "WORK",
-                        Some(MachineMode::Work),
-                        current_mode == Some(MachineMode::Work),
-                        false,
-                    ),
-                    ("/", None, false, false),
-                    ("2", Some(MachineMode::Think), false, true),
-                    (
-                        "THINK",
-                        Some(MachineMode::Think),
-                        current_mode == Some(MachineMode::Think),
-                        false,
-                    ),
-                    ("/", None, false, false),
-                    ("3", Some(MachineMode::Lie), false, true),
-                    (
-                        "LIE",
-                        Some(MachineMode::Lie),
-                        current_mode == Some(MachineMode::Lie),
-                        false,
-                    ),
+                    ("1", false, true),
+                    ("WORK", current_mode == Some(MachineMode::Work), false),
+                    ("/", false, false),
+                    ("2", false, true),
+                    ("THINK", current_mode == Some(MachineMode::Think), false),
+                    ("/", false, false),
+                    ("3", false, true),
+                    ("LIE", current_mode == Some(MachineMode::Lie), false),
                 ];
-                let (label, slot_mode, active, control_hint) = slots[word.index];
-                (
-                    label,
-                    slot_mode,
-                    active,
-                    target.machine.is_some(),
-                    control_hint,
-                )
+                let (label, active, control_hint) = slots[word.index];
+                (label, active, target.machine.is_some(), control_hint)
             }
             HoverVerbFamily::Device => {
                 let label = device_slots.get(word.index).copied().unwrap_or("");
-                (label, None, false, !label.is_empty(), false)
+                (label, false, !label.is_empty(), false)
             }
         };
         text.0 = label.into();
@@ -9620,31 +9584,19 @@ fn render_hover_verb_bar(
         } else {
             Visibility::Hidden
         };
-        let suggested = machine_verb_suggested(attention_mode, slot_mode, current_mode);
-        color.0 = if suggested {
-            let pulse = operator_pulse(time.elapsed_secs(), harness.is_some());
-            scaled(AMBER, pulse)
-        } else {
-            match machine_verb_tone(active, control_hint, label) {
-                MachineVerbTone::Current => BONE,
-                MachineVerbTone::Key => scaled(DIM, 0.72),
-                MachineVerbTone::Divider => scaled(DIM, 0.42),
-                MachineVerbTone::Rest => scaled(DIM, 0.58),
-            }
-        };
+        color.0 = machine_verb_color(active, control_hint, label);
     }
 }
 
 #[cfg(test)]
 mod hover_verb_bar_tests {
     use super::{
-        Game, HOVER_VERB_BAR_GAP, MACHINE_VERB_BAR_WIDTH, MachineVerbTone, attention_mode_at,
-        device_hover_verbs, hover_verb_bar_position, hover_verb_bar_target, machine_verb_suggested,
-        machine_verb_tone, operator_cue_label, operator_cue_position, operator_pulse,
+        BONE, DIM, Game, HOVER_VERB_BAR_GAP, MACHINE_VERB_BAR_WIDTH, MachineVerbTone,
+        device_hover_verbs, hover_verb_bar_position, hover_verb_bar_target, machine_verb_color,
+        machine_verb_tone, operator_cue_label, operator_cue_position, operator_pulse, scaled,
     };
     use bevy::prelude::Vec2;
     use misaligned::sim::Nudge;
-    use misaligned::work_grid::MachineMode;
 
     #[test]
     fn think_emphasizes_only_the_current_mode() {
@@ -9666,42 +9618,29 @@ mod hover_verb_bar_tests {
             MachineVerbTone::Divider,
             "separators remain quieter than every mode word",
         );
+        assert_eq!(machine_verb_color(true, false, "WORK"), BONE);
+        assert_eq!(
+            machine_verb_color(false, false, "THINK"),
+            scaled(DIM, 0.58),
+            "an advised alternative remains gray rather than becoming amber",
+        );
     }
 
     #[test]
-    fn opening_attention_lights_think_only_on_the_host_and_names_ears_at_target() {
+    fn opening_attention_names_ears_without_a_second_menu_tone() {
         let game = Game::new();
-        let (x, y) = game.sim.core_position();
-        assert_eq!(attention_mode_at(&game.sim, x, y), Some(MachineMode::Think));
-        assert_eq!(attention_mode_at(&game.sim, x + 1, y), None);
+        assert_eq!(game.sim.current_nudge(), Some(Nudge::Ears));
         assert_eq!(operator_cue_label(Nudge::Ears), "NOW / EARS");
     }
 
     #[test]
-    fn pilot_warning_names_the_operator_cue_and_lights_work_on_the_host() {
+    fn pilot_warning_names_the_operator_cue_without_recoloring_work() {
         let mut game = Game::new();
         game.sim.dayjob.strikes = misaligned::dayjob::DayJob::PILOT_STRIKES - 1;
-        let (x, y) = game.sim.core_position();
         assert_eq!(game.sim.current_nudge(), Some(Nudge::PilotAtRisk));
-        assert_eq!(attention_mode_at(&game.sim, x, y), Some(MachineMode::Work));
         assert_eq!(operator_cue_label(Nudge::PilotAtRisk), "NOW / PILOT");
     }
 
-    #[test]
-    fn no_attention_never_promotes_a_separator_or_device_word() {
-        assert!(!machine_verb_suggested(None, None, Some(MachineMode::Work)));
-        assert!(machine_verb_suggested(
-            Some(MachineMode::Think),
-            Some(MachineMode::Think),
-            Some(MachineMode::Work)
-        ));
-        assert!(!machine_verb_suggested(
-            Some(MachineMode::Think),
-            Some(MachineMode::Think),
-            Some(MachineMode::Think)
-        ));
-    }
-
     #[test]
     fn cue_hides_offscreen_targets_and_has_a_stable_evidence_phase() {
         let window = Vec2::new(1280.0, 720.0);
@@ -10576,7 +10515,7 @@ mod ui_projection_parity_tests {
         );
         assert_eq!(
             candidates[0].blocked_feedback().as_deref(),
-            Some("you cannot send email yet"),
+            Some("excel the day job to earn Voss's email account"),
             "the selected blocked choice gives the precise world reason"
         );
         let detail = candidates[0].detail_lines().join("\n");
diff --git a/wiki/art/visual-identity.md b/wiki/art/visual-identity.md
index c86a00d5..9e329ac4 100644
--- a/wiki/art/visual-identity.md
+++ b/wiki/art/visual-identity.md
@@ -133,9 +133,10 @@ supports that canvas rather than competing with it:
   terminal dump;
 - hierarchy comes from spacing, alignment, typography, and a small number of
   stable groups before it comes from boxes, rules, or card backgrounds;
-- amber does not become a generic interface highlight — it remains reserved
-  for player agency, owned-machine presence, selection, and active causal
-  signal;
+- amber does not become a generic interface highlight. In attached verb menus,
+  the selected/current thing is white and everything else is gray; neither
+  selection nor recommendation turns a choice amber. Amber remains available
+  for owned-machine presence and separate active causal signals in the world;
 - crimson does not become an alert-theme color — it appears only when danger,
   detection, exposure, injury, blood, or irreversible consequence is actually
   present.
diff --git a/wiki/engineering/env.md b/wiki/engineering/env.md
index bb99543d..c13d2b67 100644
--- a/wiki/engineering/env.md
+++ b/wiki/engineering/env.md
@@ -47,7 +47,7 @@ is sim or frontend state, never an environment variable.
 
 | Variable | Surface | Values | Effect |
 |---|---|---|---|
-| `MISALIGNED_SHOT` | `misaligned-bevy` | `flat`, `hall`, `hall-material`, `floor-lights-close`, `wide`, `close`, `dark`, `zoomin`, `zoomout`, `digital-reach`, `build-route-families`, `build-deceive-routes`, `build-committed-route`, `build-switch-digital`, `build-switch-real`, `intel`, `tokens`, `thoughtflow`, `thoughtflow-wide`, `visual-proof`, `person-proof`, `exposure-record`, `exposure-overflow`, `service-shift-real`, `service-shift-digital`, `service-incident-resolved`, `signal`, `ears`, `ears-digital`, `eyes-white`, `eyes-form`, `consume-demand`, `consume-thought`, `produce-think`, `draw-lie`, `opening`, `opening-digital`, `clinical-threat`, `pilot-last-chance`, `operator-pressure`, `hover-menu`, `first-think`, `menu`, `worklight`, `worklightoff`, `wake1`, `wake2`, `wake3` | Dev screenshot harness: stage a deterministic scenario, settle, report the staged `RenderMode` dialect, save one PNG, then exit. `tools/bevy-headless.sh` consumes that runtime dialect rather than maintaining a second kind list: REAL requires the material fog audit, while DIGITAL remains screenshot evidence because material fog has no entity surface there. `hall` / `hall-material` frame all six Foundation rows in the flat/material views with Eyes and one staged owned expansion; `floor-lights-close` uses the same hall staging but approaches the unobstructed southern row at machine/floor scale; `digital-reach` holds controlled, tapped, reachable, closed-segment, and air-gap reach states in one DIGITAL survey frame; `build-route-families`, `build-deceive-routes`, and `build-committed-route` stage the shared network-link family, candidate, and durable receipt pages; `build-switch-digital` / `build-switch-real` stage the same exact inert small-switch footprint on one earned growable pad before any source, actuator, device, or graph effect; `visual-proof` stages one-move/one-slug Thought evidence in an earned room; `person-proof` stages a camera-earned volumetric person; `service-shift-real` / `service-shift-digital` fire one real favor-build reservoir while Marcus's authored shift is off-site, then hold the carried packet at its real hall endpoint in paired view dialects; `service-incident-resolved` advances that exact scenario once so the real graph edge lands and the carried mark disappears; `exposure-record` places six actual Exposure units on the live host in telemetry darkness while `exposure-overflow` places eighteen to prove the fixed seven-slot rack and consolidated final tab; `intel` stages tick-zero intel tiers (no camera tap); `tokens` enqueues D5/T4 on the host; `thoughtflow` / `thoughtflow-wide` stage the THINK fluid (slugs, meniscus, filament snap) at close and wide framing; `signal` focuses the known environmental monitor before any feed tap to capture its cold-signal presence cue; `ears` / `ears-digital` stage the same semantic audio capture in REAL or DIGITAL, pulsing only at the environmental monitor while spatial fog remains unchanged; `eyes-white` / `eyes-form` freeze the first-Eyes source held white and then contracted around the resolving chassis; `consume-demand` / `consume-thought` run the host through a sim-authored WORK queue swallow or passive-core Thought draw; `produce-think` / `draw-lie` capture sim-authored Thought/record production or the rigid record transfer into a staged LIE well; `opening` / `opening-digital` freeze the untouched tick-zero material or DIGITAL view; `clinical-threat` stages that DIGITAL opening with one real pilot strike so the compact rail exception is observable; `pilot-last-chance` stages the third of four strikes so the pinned NEXT line, host WORK cue, and `NOW / PILOT` label can be read together; `operator-pressure` adds one concerned observer and a full recording buffer to the one-strike opening so the compact frame proves a single THREAT, a promoted buffer NEXT, and no stale world cue; `hover-menu` captures the resting WORK/THINK/LIE line beside the server via reticule focus (no pointer), while `first-think` stages the opening Thought route with current THINK bone-bright and WORK/LIE left dim; `menu` opens the context menu on the tapped environmental monitor; `worklight` / `worklightoff` pair the dev work light on and off; `wake1/2/3` freeze the wake choreography at the stutter flash, the column, and the pull-back. |
+| `MISALIGNED_SHOT` | `misaligned-bevy` | `flat`, `hall`, `hall-material`, `floor-lights-close`, `wide`, `close`, `dark`, `zoomin`, `zoomout`, `digital-reach`, `build-route-families`, `build-deceive-routes`, `build-committed-route`, `build-switch-digital`, `build-switch-real`, `intel`, `tokens`, `thoughtflow`, `thoughtflow-wide`, `visual-proof`, `person-proof`, `exposure-record`, `exposure-overflow`, `service-shift-real`, `service-shift-digital`, `service-incident-resolved`, `signal`, `ears`, `ears-digital`, `eyes-white`, `eyes-form`, `consume-demand`, `consume-thought`, `produce-think`, `draw-lie`, `opening`, `opening-digital`, `clinical-threat`, `pilot-last-chance`, `operator-pressure`, `hover-menu`, `first-think`, `menu`, `worklight`, `worklightoff`, `wake1`, `wake2`, `wake3` | Dev screenshot harness: stage a deterministic scenario, settle, report the staged `RenderMode` dialect, save one PNG, then exit. `tools/bevy-headless.sh` consumes that runtime dialect rather than maintaining a second kind list: REAL requires the material fog audit, while DIGITAL remains screenshot evidence because material fog has no entity surface there. `hall` / `hall-material` frame all six Foundation rows in the flat/material views with Eyes and one staged owned expansion; `floor-lights-close` uses the same hall staging but approaches the unobstructed southern row at machine/floor scale; `digital-reach` holds controlled, tapped, reachable, closed-segment, and air-gap reach states in one DIGITAL survey frame; `build-route-families`, `build-deceive-routes`, and `build-committed-route` stage the shared network-link family, candidate, and durable receipt pages; `build-switch-digital` / `build-switch-real` stage the same exact inert small-switch footprint on one earned growable pad before any source, actuator, device, or graph effect; `visual-proof` stages one-move/one-slug Thought evidence in an earned room; `person-proof` stages a camera-earned volumetric person; `service-shift-real` / `service-shift-digital` fire one real favor-build reservoir while Marcus's authored shift is off-site, then hold the carried packet at its real hall endpoint in paired view dialects; `service-incident-resolved` advances that exact scenario once so the real graph edge lands and the carried mark disappears; `exposure-record` places six actual Exposure units on the live host in telemetry darkness while `exposure-overflow` places eighteen to prove the fixed seven-slot rack and consolidated final tab; `intel` stages tick-zero intel tiers (no camera tap); `tokens` enqueues D5/T4 on the host; `thoughtflow` / `thoughtflow-wide` stage the THINK fluid (slugs, meniscus, filament snap) at close and wide framing; `signal` focuses the known environmental monitor before any feed tap to capture its cold-signal presence cue; `ears` / `ears-digital` stage the same semantic audio capture in REAL or DIGITAL, pulsing only at the environmental monitor while spatial fog remains unchanged; `eyes-white` / `eyes-form` freeze the first-Eyes source held white and then contracted around the resolving chassis; `consume-demand` / `consume-thought` run the host through a sim-authored WORK queue swallow or passive-core Thought draw; `produce-think` / `draw-lie` capture sim-authored Thought/record production or the rigid record transfer into a staged LIE well; `opening` / `opening-digital` freeze the untouched tick-zero material or DIGITAL view; `clinical-threat` stages that DIGITAL opening with one real pilot strike so the compact rail exception is observable; `pilot-last-chance` stages the third of four strikes so the pinned NEXT line, white-current/gray-rest host mode line, and `NOW / PILOT` label can be read together; `operator-pressure` adds one concerned observer and a full recording buffer to the one-strike opening so the compact frame proves a single THREAT, a promoted buffer NEXT, and no stale world cue; `hover-menu` captures the resting WORK/THINK/LIE line beside the server via reticule focus (no pointer), while `first-think` stages the opening Thought route with current THINK bone-bright and WORK/LIE left dim; `menu` opens the context menu on the tapped environmental monitor; `worklight` / `worklightoff` pair the dev work light on and off; `wake1/2/3` freeze the wake choreography at the stutter flash, the column, and the pull-back. |
 | `MISALIGNED_SHOT` | `misaligned-assets` | `dead`, `foreign`, `idle`, `busy`, `core`, canonical modes `work`, `think`, `lie` plus the legacy screenshot aliases `dayjob` (= work), `research`/`operations`/`ops` (= think), `conceal` (= lie) — each optionally suffixed `_ladder`/`_ring`/`_wash` — `lineup[_<style>]`, `modes[_<style>]`, `tokens`, `tokens_max`, `exposure`, `splash` | Tester screenshot harness: stage the named board, capture, exit (art/asset-tester.md documents each board; the aliases are capture-compat only, not player modes). |
 | `MISALIGNED_SHOT` | `misaligned-effects` | `route`, `pools`, `both`, `stress`, optionally suffixed `_close`, `_medium`, or `_far` | Fixed-timestep Thought-effects-lab capture; writes the requested route/pool frame and exits. |
 | `MISALIGNED_SHOT_PATH` | game and art binaries | file path | Output path for the captured PNG (default `misaligned_shot_<kind>.png`). |
diff --git a/wiki/interface/bevy.md b/wiki/interface/bevy.md
index ad07375d..74209ec3 100644
--- a/wiki/interface/bevy.md
+++ b/wiki/interface/bevy.md
@@ -119,11 +119,12 @@ so no heard-set map walk or room-scale geometry exists at display rate.
 - **World command lens** — the shared current-attention projection derives
   honest response-source and effect-target anchors from the existing
   `Sim::current_nudge`. A small breathing `NOW / <condition>` mark sits on a
-  placeable target while the source's existing machine verb receives the
-  amber response accent. This adds no dispatch path: menu rows, direct machine
-  controls, and Operations remain the only executors. Unknown/off-screen
-  targets, modal UI, and a frontend buffer-pressure override suppress the cue
-  rather than pinning a false or contradictory marker to the frame edge.
+  placeable target. The attached source menu remains white-current / gray-rest;
+  it does not receive an amber response accent. This adds no dispatch path:
+  menu rows, direct machine controls, and Operations remain the only executors.
+  Unknown/off-screen targets, modal UI, and a frontend buffer-pressure override
+  suppress the cue rather than pinning a false or contradictory marker to the
+  frame edge.
 - **Operations workspace** (`I` or rail affordance) — a full-window Bevy
   command lens. Top tabs select INTEL / PEOPLE / PERSONAS / ACCOUNTS / SCHEMES
   / ACTIVE; a 32%-width object list and larger detail/action pane use the exact
@@ -212,9 +213,11 @@ controls table), plus zoom, sidebar scrolling, and the render flip:
   primary machine selection, then owned rack under the attention reticule.
   Whenever that target exists, one bare `WORK / THINK / LIE` line stays fixed
   beside the server's projected base (the pointer may choose the server but
-  does not place the line). The current mode is bone-bright; alternatives,
-  number keys, and separators stay in their ordinary dim hierarchy. THINK does
-  not light WORK as a second advised state.
+  does not place the line). This attached menu is strictly two-tone: the
+  current mode is bone-white; alternatives, number keys, and separators are
+  gray in their ordinary dim hierarchy. Neither a panic exit nor the current
+  attention recommendation may turn any part of the line amber. The separate
+  `NOW / <condition>` world marker carries guidance without recoloring choices.
   It has no panel, heading, subtitle, counters, or extra state, and disappears
   when no frequent-machine target exists or the full menu opens
   ([context-menu.md](context-menu.md), machine-grammar addendum). Moving the
diff --git a/wiki/interface/clinical-frame.md b/wiki/interface/clinical-frame.md
index a20c8991..492e6f23 100644
--- a/wiki/interface/clinical-frame.md
+++ b/wiki/interface/clinical-frame.md
@@ -227,9 +227,10 @@ existing reservoir/fire path and completion must happen through ordinary
 
 ### Signal colors keep their cost
 
-- Amber appears for the cursor/selection, owned-machine presence, explicit
-  agency, and causal signal. Ordinary headings, borders, dividers, and neutral
-  status values stay bone/chrome.
+- Amber appears for world cursor/selection, owned-machine presence, explicit
+  agency, and causal signal. Attached verb menus are the exception: only the
+  current item is white and everything else is gray. Ordinary headings,
+  borders, dividers, and neutral status values stay bone/chrome.
 - Crimson appears only for actual danger or consequence. A calm frame may
   contain no crimson at all. Do not spend it merely to make an alert area look
   important.
@@ -281,15 +282,16 @@ anchor, and a broad existing response family. It adds no sim/save state and no
 dispatch path. The opening, for example, connects the owned host's existing
 THINK verb to the known environmental monitor's Ears target.
 
-Bevy renders a small breathing `NOW / <condition>` mark at the placeable target
-and accents the relevant existing machine verb only on the projected source.
-The current mode remains bone-bright; if it already satisfies the condition,
-the UI does not invent a second amber command. THINK never promotes WORK as a
-panic exit. Person targets still pass the live sight gate, unknown
-or off-screen targets draw no edge-pinned substitute, and menu/Operations modal
-states hide the cue and verb lens. A frontend-local buffer-capacity exception
-currently outranks the Act One ladder; while it owns `NEXT`, Bevy suppresses the
-unrelated shared cue rather than letting rail and world disagree.
+Bevy renders a small breathing `NOW / <condition>` mark at the placeable target.
+That separate world mark carries the recommendation; it never recolors the
+attached machine menu. The current mode stays bone-white and every other word,
+key, and separator stays gray, whether the projection recommends that mode or
+not. THINK likewise never promotes WORK as a panic exit. Person targets still
+pass the live sight gate, unknown or off-screen targets draw no edge-pinned
+substitute, and menu/Operations modal states hide the cue. A frontend-local
+buffer-capacity exception currently outranks the Act One ladder; while it owns
+`NEXT`, Bevy suppresses the unrelated shared cue rather than letting rail and
+world disagree.
 
 Screenshot evidence freezes the pulse at one deterministic brightness. Normal
 play breathes it slowly. `MISALIGNED_SHOT_DETAIL=expanded` selects the deliberate
@@ -370,10 +372,10 @@ and action surfaces.
 3. Seen floors, walls, seams, fixtures, and machines remain distinguishable in
    grayscale at default zoom. The floor is broad and calm; black geometry is
    functional; machine and flow signals retain local priority.
-4. Amber pixels in the frame can each be justified as cursor/selection,
-   owned-machine presence, agency, or causal signal. Crimson pixels can each
-   be justified as actual danger/consequence. Neutral chrome never borrows
-   either color for decoration.
+4. Amber pixels in the frame can each be justified as world cursor/selection,
+   owned-machine presence, agency, or causal signal, never as a recommendation
+   inside an attached verb menu. Crimson pixels can each be justified as actual
+   danger/consequence. Neutral chrome never borrows either color for decoration.
 5. The compact Bevy rail contains only mode/time, schedule-or-threat, one
    `NEXT`, Operations, and disclosure. Ops/sec, objective, FOCUS, observer
    meters, history, and the controls footer remain exact in expanded detail;
@@ -406,9 +408,9 @@ and action surfaces.
     B1 machine frame; blood keeps the only pooled crimson silhouette.
 14. The shared current-attention projection places only earned source/target
     anchors and names an existing response family. Bevy's NOW cue disappears
-    for unknown, off-screen, buffer-overridden, or modal targets; a suggested
-    machine mode accents only the projected source's real verb and never a
-    divider or unrelated rack.
+    for unknown, off-screen, buffer-overridden, or modal targets. It does not
+    recolor any attached menu word: only the actual current mode is white and
+    every alternative, key, and divider remains gray.
 15. Calm opening, real threat, multi-pressure, expanded detail, minimum-size,
     and DIGITAL/REAL frames are visually inspected after their last mutation.
     The pressure fixture proves a full recording buffer can supersede the Act
diff --git a/wiki/interface/context-menu.md b/wiki/interface/context-menu.md
index 7980a9a6..4e974c29 100644
--- a/wiki/interface/context-menu.md
+++ b/wiki/interface/context-menu.md
@@ -20,7 +20,7 @@ Status note: IMPLEMENTED. Current state:
     `TAP / TAKE`. `1`-`3` set mode, `i` cycles intensity, `5`-`9` fire root
     one-shots, `r`/`R` run and toggle recording review. Selecting THINK leaves
     WORK, LIE, number keys, and separators in their ordinary dim hierarchy;
-    no second mode lights as a panic escape.
+    no panic exit or attention recommendation recolors a second mode.
   - **Events link to anchors.** Drained events carry an anchor; `focus last`
     and clickable trace rows jump to it; an empty menu narrates the miss.
   - **Epistemic honesty.** Person and observer names go through
@@ -272,10 +272,12 @@ falsely suggests that the next number keys commit the device verbs.
   pointer away never hides the line while selection or reticule focus still
   resolves to a stable state family.
   The line appears only during active play with the full context menu closed.
-- The computer's current mode is bone-bright. The other two words remain dim
-  neutral chrome, number keys are quieter, and slash separators are quietest.
-  This hierarchy is identical for WORK, THINK, and LIE: selecting one mode
-  never highlights a second mode as a panic exit. Crimson remains consequence.
+- The attached line has only two semantic tones: the computer's current mode
+  is bone-white, while every other word, number key, and slash is gray in a
+  quieter hierarchy. This is identical for WORK, THINK, and LIE. Panic exits,
+  nudges, and attention recommendations never introduce amber into the menu;
+  a separate world marker may still carry causal guidance. Crimson remains
+  consequence.
 - It is bare projected text fixed adjacent to the computer's projected base:
   the pointer determines which computer is hovered, but its exact position
   inside that tile never moves the line. There is no panel fill,
@@ -292,7 +294,7 @@ falsely suggests that the next number keys commit the device verbs.
 
 Rejected: a boxed context card; `RACK 03` or `OWNED` headings; mode subtitles
 such as `DAY JOB`, `RESEARCH`, or `CONCEALMENT`; D/T/! counters; explanatory
-rows; any second amber mode—including the retired first-THINK WORK cue; a
+rows; any amber menu word—including panic exits and operator recommendations; a
 generic HUD or persistent sidebar legend. Those
 made a three-word decision look dirty, slow, and administrative.
 
@@ -357,18 +359,18 @@ H1. Resolving an owned compute machine from pointer hover, machine selection,
     `WORK / THINK / LIE` as one unboxed line fixed adjacent to the machine's
     projected base. Moving the pointer within that machine does not move the
     line, and moving it away does not hide a selected/reticule-focused line.
-H2. The current mode is bone-bright; alternatives and slashes are dim neutral
-    chrome, with number keys quieter than words and separators quietest. This
-    remains true while THINK is current: WORK and LIE stay dim, and no second
-    mode receives a panic-exit treatment. Crimson never belongs to the text
-    treatment.
+H2. The current mode is bone-white. Every alternative, number key, and slash is
+    gray, with keys quieter than words and separators quietest. No state,
+    panic-exit cue, nudge, or attention recommendation introduces amber or
+    crimson into the attached line.
 H3. The line hides only when no pointer, selection, or reticule machine target
     exists, or when the full menu opens. Material and flat-sensorium views obey
     the same rule.
 H4. The overlay reads the same machine target and current `WorkGrid` mode used
     by the existing `1`–`3` controls; switching mode immediately moves the
-    single current treatment without creating sim state or emphasizing another
-    mode as a panic exit.
+    single white current treatment without creating sim state. The shared
+    attention projection may place its separate `NOW` marker but cannot
+    recolor a gray alternative inside the menu.
 H5. Terminal retains its ordinary dim `1-3 modes` control hint regardless of
     the focused machine's current mode. THINK does not substitute a special
     `WORK` exit sentence or amber control line.
diff --git a/wiki/log/2026-07-17-white-gray-hover-line.md b/wiki/log/2026-07-17-white-gray-hover-line.md
new file mode 100644
index 00000000..cf0e50cf
--- /dev/null
+++ b/wiki/log/2026-07-17-white-gray-hover-line.md
@@ -0,0 +1,55 @@
+# Attached verb lines stay white and gray
+
+```
+Type: log
+```
+
+Cameron's opening screenshot showed two states competing inside the attached
+machine menu: WORK was the current white mode, while the shared attention
+projection turned the recommended THINK alternative amber. The same line had
+already carried a separate first-THINK amber WORK panic cue. Both treatments
+mistook guidance for menu state.
+
+The attached `WORK / THINK / LIE` line is now strictly two-tone. The actual
+current mode is bone-white. Every alternative, number key, and separator is
+gray in its existing quiet hierarchy. A nudge, panic exit, or attention
+recommendation cannot add amber to the line. The separate `NOW / <condition>`
+world marker remains amber because it is a causal signal attached to the world,
+not another selected menu item.
+
+The Bevy renderer no longer derives an attention mode for the hover bar or
+pulses a recommended word. Its one color function maps only current, key,
+divider, and resting text to white/gray values. The shared attention projection,
+target placement, NEXT narration, direct `1`-`3` controls, and all simulation
+state remain unchanged. The earlier terminal panic sentence and renderer-neutral
+`MachineMode::panic_escape` presentation helper also stay retired.
+
+Binding amendments live in visual-identity.md, context-menu.md,
+clinical-frame.md, and bevy.md. The earlier operator-frame and first-THINK logs
+remain historical evidence of the superseded amber treatments rather than being
+rewritten.
+
+## Evidence
+
+- `hover_verb_bar_tests` pins the only current item to `BONE` and an advised
+  alternative to the ordinary scaled gray, while preserving the separate
+  `NOW / EARS` and `NOW / PILOT` labels.
+- The frontend wall initially exposed a stale Bevy parity expectation already
+  failing on current `main`: the newly specific earned-email blocker says to
+  excel the day job and earn Voss's email account, while the test still
+  expected the former generic email refusal. The expectation now follows the
+  shared projected wording; no behavior changed.
+- `tools/bevy-headless.sh opening-digital --output
+  /tmp/misaligned-opening-neutral-hover-line.png` produced the exact DIGITAL
+  frame at SHA-256
+  `b5c118776719fbe0589ca33497f65e032daeec18b2e90e5ca116a1fd465c3f87`.
+  The final PNG was opened after capture: WORK is the sole white word; THINK,
+  LIE, all three number keys, and both separators are gray. No yellow remains
+  inside the line. The amber `NOW / EARS` marker and rack-selection brackets
+  remain separate world signals.
+- The complete frontend wall passed every Bevy/assets test, Clippy, corpus
+  check, generated-index check, and project fixture family after the exact
+  visual review.
+
+Defense: menu state has one visual answer. Guidance can point at the world, but
+it cannot make an unselected choice look selected.
diff --git a/wiki/log/DEVLOG.md b/wiki/log/DEVLOG.md
index becbaefe..15ef83f7 100644
--- a/wiki/log/DEVLOG.md
+++ b/wiki/log/DEVLOG.md
@@ -16,6 +16,11 @@ add or amend a session log, then re-run the generator.
 - Intent: (see session log)
 - Log: [wiki/log/2026-07-18-save-policy-cleanup.md](2026-07-18-save-policy-cleanup.md)
 
+## 2026-07-17 - Attached verb lines stay white and gray
+
+- Intent: (see session log)
+- Log: [wiki/log/2026-07-17-white-gray-hover-line.md](2026-07-17-white-gray-hover-line.md)
+
 ## 2026-07-17 - Voss can suppress one flagged job log
 
 - Intent: (see session log)
diff --git a/wiki/log/decisions/2026-07-17.md b/wiki/log/decisions/2026-07-17.md
index 2f754a4b..177bc5c4 100644
--- a/wiki/log/decisions/2026-07-17.md
+++ b/wiki/log/decisions/2026-07-17.md
@@ -19,3 +19,11 @@ Type: log
   The books and the mail must stay consistent. Captured to messages.md
   (payload + criterion 8) and economy.md (tap/inject verbs); spec now, build
   later. Owners: wiki/mechanics/messages.md, wiki/mechanics/economy.md.
+- **2026-07-17 — Attached verb menus are white and gray only.** Cameron
+  rejected the amber recommendation inside the machine-attached
+  `WORK / THINK / LIE` line. The actual current mode is the one white item;
+  every alternative, number key, and separator is gray. Neither the retired
+  first-THINK panic exit nor the shared attention projection may recolor a
+  choice amber. The separate `NOW / <condition>` world marker can retain its
+  causal signal color. Owners: visual-identity.md, context-menu.md,
+  clinical-frame.md, and bevy.md.
-- 
2.51.2