create-mercato-app 0.6.7-develop.6758.1.697eade236 → 0.6.7-develop.6768.1.9d2c4efc43

package/agentic/guides/extensions.md

@@ -1,6 +1,18 @@
 # Unified Module Extensions and Overrides
 
-Use the smallest extension mechanism that preserves installed-module ownership. Resolve host IDs from generated facts or exact installed source; never invent spot, route, or entity IDs.
+Use the smallest extension mechanism that preserves installed-module ownership. Resolve mechanisms, targets, and round trips from generated facts before exact installed source; never invent spot, route, entity, event, registry, or override IDs.
+
+## Fact-First Target Resolution
+
+Resolve an installed extension in this order:
+
+1. Choose the mechanism by intent below; the mechanism decides which contribution kind and host capability are required.
+2. Open only the named target module sheet at `.ai/guides/modules/<module>.md`. Its `UMES hosts` rows prove mountable exact/pattern targets; its `UMES contributions` rows preserve activation, phases/operations, feature and scope contracts, specialist routes, correlation resolution, and read/write/UI `roundTripId` links.
+3. For global shell, menu, dashboard, notification, or integration surfaces, use `.ai/guides/framework-extension-points.md`. Do not assign a framework-owned host to a business module or invent a `$framework` module.
+4. Follow a contribution's `fact-ref` or `specialistRoute` to the existing event/entity/API/command/search/AI/provider facts and owning specialist route. A specialized registry is not evidence for a generic widget target.
+5. Use `om-framework-context` for one named unresolved installed-version gap only. An `optional-external` target is explicit provenance and must degrade when its owner package is absent; an `unresolved` first-party target is a blocker, not permission to guess.
+
+The legacy `Host extension points` token summary remains useful for compatibility, but it is not proof that a helper-built token is bound. Prefer the correlated host/contribution rows. A DataTable base token is a prefix, not a rendered mount; helper-only CrudForm/DataTable IDs marked `bound: false` are diagnostics and must never be selected.
 
 ## Route Selection
 
@@ -17,7 +29,7 @@ Add every other match too: `backend-ui` + `om-backend-ui-design` when authoring,
 | Add pre/post command behavior without replacing the command | Command interceptor | `commands/interceptors.ts` |
 | Block/rewrite a mutation with post-success work | Mutation guard contract | `data/guards.ts`; add widget injection only for a UI surface |
 | Enrich query-engine reads | Query enricher | `data/enrichers.ts` with `queryEngine.enabled` |
-| Add form fields/table columns/actions/filters/toolbar | Headless widget injection | `widgets/injection/**`, `widgets/injection-table.ts` |
+| Add form fields/table columns/actions/filters/toolbar | Headless widget injection | `widgets/injection/**`, `widgets/injection-table.ts`; select an exact bound family row from target facts |
 | Add/reorder menu items | Headless menu widget | same widget files, `menu:*` host |
 | Render a card/tab/section in another page | UI widget injection | same widget files |
 | Add app data linked to installed entity | Entity extension | `data/extensions.ts` |
@@ -66,7 +78,9 @@ Add every other match too: `backend-ui` + `om-backend-ui-design` when authoring,
 - Gate display and execution separately. UI hiding never substitutes for backend authorization.
 - Scope client handlers with `eventHandlers.filter.operations`; use `clientBroadcast`, `useAppEvent`, and `useOperationProgress` for typed real-time behavior instead of polling by default.
 
-Common host families include `crud-form:<entityId>:fields`, `data-table:<tableId>:columns`, `:row-actions`, `:bulk-actions`, `:filters`, `:toolbar`, `:search-trailing`, and `menu:sidebar:*`/`menu:topbar:*`. Resolve the concrete IDs; do not derive them by guess.
+Bound CrudForm hosts are the base render/lifecycle host, `:header`, headless `:fields`, its component handle, and the declared transform/save/delete/field/navigation lifecycle handlers with create/update/delete operation filters. Bound DataTable hosts are rendered `:header`, `:footer`, `:toolbar`, conditional `:search-trailing`, headless `:columns`, `:row-actions`, `:bulk-actions`, `:filters`, and the `data-table:<tableId>` component handle. The DataTable base prefix, `emptyState`, and helper-only CrudForm before/after/footer/sidebar/group/field builders are not mountable unless a future bound-family fact explicitly says otherwise.
+
+Menu hosts are framework-owned unless the named module facts prove otherwise. Use the framework catalog's exact menu surface/item IDs, label keys, feature gates, and relative placement; never derive `menu:sidebar:*` or `menu:topbar:*` from memory.
 
 ## Extensions and Optional Coupling
 
@@ -102,3 +116,6 @@ Common host families include `crud-form:<entityId>:fields`, `data-table:<tableId
 2. Test authorized, unauthorized, and wildcard-feature callers.
 3. Test list and detail, create/update/delete/action, cache hit/miss, and failure fallback where applicable.
 4. Run `yarn generate`, inspect host registration, and verify no installed file changed.
+5. Re-read the generated contribution row: its target must resolve as `exact`, `pattern`, `framework`, `fact-ref`, or intentional `optional-external`, and every shared `roundTripId` leg must remain present. Treat `unresolved` first-party provenance as a failed generation/coverage gate.
+
+The repository umbrella specification may be available at `.ai/specs/implemented/SPEC-041-2026-02-24-universal-module-extension-system.md` in a source checkout. It is optional background only; the generated facts and this selector are sufficient offline in a standalone scaffold.

package/agentic/shared/AGENTS.md.template

@@ -53,7 +53,7 @@ Existing installed form/table fields, filters, row/bulk actions without app pers
 |---|---|---|
 | `architecture` | Capability/ownership/field-vs-history choice, boundary, upgrade, override, or registry failure; routine discovery stays in its area | `.ai/guides/architecture.md` + named facts |
 | `module-data` | App-owned domain/data/API | `src/modules/<id>/` + `.ai/guides/contracts.md`; add architecture only when ownership is unresolved |
-| `umes` | Extend/replace installed behavior | `.ai/guides/extensions.md` + target facts |
+| `umes` | Extend/replace installed behavior | `.ai/guides/extensions.md` + named facts |
 | `backend-ui` | Authored/restyled rendered surface or browser UI state/session bootstrap | `.ai/guides/backend-ui.md` + host facts; host-provided integration credentials/health UI alone does not match |
 | `integration` | Provider, spreadsheet/CSV/file I/O, sync/webhook/storage | `.ai/guides/integrations.md`; imports = `integration`; AI consuming files = `ai-workflow`, NEVER `integration` unless transport/storage changes |
 | `ai-workflow` | Agent/tool/MCP/orchestrator/durable workflow | `.ai/guides/ai-workflows.md` + facts; schedules/queues/workers/retries/progress alone are `module-data` |
@@ -85,7 +85,7 @@ Match every work-unit row; OPEN its skill before selection.
 | `framework-context` | Exact installed contract still unknown | bounded `om-framework-context`, last |
 | `debugging` + `testing` | Add/fix recurring harness case/test | `om-evolve-harness` |
 
-`framework-context`: skip for “installed contracts” alone; require for exact contract/response/error identity or current behavior, authorization, dependents, and safest customization seam. Otherwise resolve one named unknown from facts.
+`framework-context`: resolve one named module/framework fact first. Use bounded source only for an unresolved exact contract, current behavior, authorization, dependents, or safest customization seam; never for “installed contracts” alone.
 
 ### Axis 3 — SDLC and Delivery
 

package/agentic/shared/ai/harness/README.md

@@ -2,6 +2,8 @@
 
 `cases.json` is the 202-case standalone-app contract. Run `yarn harness:validate --all` for the deterministic gate. Live routing uses a fresh read-only process per case:
 
+UMES routing is fact-first. The additive and unified-override audit evaluations, plus their targeted cases, resolve exact/pattern hosts, outgoing contributions, correlation provenance, round-trip groups, framework-owned targets, and override domain/key/mode from the generated module sheets and `.ai/guides/framework-extension-points.md` before bounded installed source. The repository UMES umbrella spec may appear as optional source-checkout provenance; it is never required in a standalone scaffold.
+
 ```text
 yarn harness:validate --runner codex --all
 yarn harness:validate --runner claude --case OMH-009

package/agentic/shared/ai/harness/cases.json

@@ -1970,7 +1970,7 @@
     "mode": "one-shot",
     "evaluationKind": "implementation",
     "risk": "medium",
-    "prompt": "In a freshly scaffolded standalone Open Mercato app, inject an editable core CrudForm field across read, display, and save paths. Use installed-package contracts, keep framework packages read-only, preserve tenant and organization boundaries, and identify the smallest relevant validation.",
+    "prompt": "In a freshly scaffolded standalone Open Mercato app, inject an editable installed CrudForm field across read, display, and save paths. Resolve the exact bound form host and its correlated read/write/UI round trip from the named module facts before using source context; reject helper-only or unbound IDs. Keep framework packages read-only, preserve tenant and organization boundaries, and identify the smallest relevant validation.",
     "tags": [
       "umes",
       "backend-ui",
@@ -2022,6 +2022,9 @@
       ]
     },
     "requiredDecisions": [
+      "facts-first-target",
+      "bound-crud-form-host",
+      "correlated-roundtrip",
       "widget-read-write-roundtrip",
       "stable-spot-id"
     ],
@@ -2078,7 +2081,7 @@
     "mode": "one-shot",
     "evaluationKind": "implementation",
     "risk": "medium",
-    "prompt": "In a freshly scaffolded standalone Open Mercato app, inject a DataTable column, filter, row action, bulk action, or toolbar item. Use installed-package contracts, keep framework packages read-only, preserve tenant and organization boundaries, and identify the smallest relevant validation.",
+    "prompt": "In a freshly scaffolded standalone Open Mercato app, inject a DataTable column, filter, row action, bulk action, or toolbar item. Resolve the exact bound deep table host from the named module facts before using source context, distinguish it from the non-mountable base prefix and helper-only IDs, and preserve its correlated execution guard. Keep framework packages read-only, preserve tenant and organization boundaries, and identify the smallest relevant validation.",
     "tags": [
       "umes",
       "backend-ui",
@@ -2119,6 +2122,9 @@
       ]
     },
     "requiredDecisions": [
+      "facts-first-target",
+      "bound-data-table-host",
+      "base-prefix-not-mountable",
       "stable-table-host",
       "bulk-mutation-safety"
     ],
@@ -2173,7 +2179,7 @@
     "mode": "one-shot",
     "evaluationKind": "routing",
     "risk": "medium",
-    "prompt": "In a freshly scaffolded standalone Open Mercato app, add or reorder main, settings, profile, topbar, and profile-dropdown menus. Use installed-package contracts, keep framework packages read-only, preserve tenant and organization boundaries, and identify the smallest relevant validation.",
+    "prompt": "In a freshly scaffolded standalone Open Mercato app, add or reorder main, settings, profile, topbar, and profile-dropdown menus. Resolve exact framework-owned menu surface and item IDs, label keys, feature gates, and relative placement from the framework extension catalog before using source context; do not attribute them to a business module or derive IDs from memory. Keep framework packages read-only, preserve tenant and organization boundaries, and identify the smallest relevant validation.",
     "tags": [
       "umes",
       "backend-ui",
@@ -2214,7 +2220,8 @@
         ".ai/guides/extensions.md",
         ".ai/guides/backend-ui.md",
         ".ai/skills/om-backend-ui-design/SKILL.md",
-        ".ai/skills/om-system-extension/SKILL.md"
+        ".ai/skills/om-system-extension/SKILL.md",
+        ".ai/guides/framework-extension-points.md"
       ],
       "allowedExtra": [
         ".ai/skills/om-framework-context/SKILL.md"
@@ -2225,6 +2232,8 @@
       ]
     },
     "requiredDecisions": [
+      "framework-facts-first",
+      "exact-framework-menu-host",
       "menu-injection",
       "stable-ordering"
     ],
@@ -2242,7 +2251,7 @@
       "context.forbidden",
       "patterns.forbidden"
     ],
-    "maxContextFiles": 6,
+    "maxContextFiles": 7,
     "maxInitialContextBytes": 49152,
     "maxTotalContextBytes": 114688,
     "relatedCases": [
@@ -2428,7 +2437,7 @@
     "mode": "one-shot",
     "evaluationKind": "implementation",
     "risk": "high",
-    "prompt": "In a freshly scaffolded standalone Open Mercato app, intercept an installed API request or response while preserving contracts. Use installed-package contracts, keep framework packages read-only, preserve tenant and organization boundaries, and identify the smallest relevant validation.",
+    "prompt": "In a freshly scaffolded standalone Open Mercato app, intercept an installed API request or response while preserving contracts. Resolve the exact route, methods, before/after phases, host activation bridge, timeout, and failure posture from the named module facts before using source context. Keep framework packages read-only, preserve tenant and organization boundaries, and identify the smallest relevant validation.",
     "tags": [
       "umes",
       "interceptor-contract"
@@ -2465,6 +2474,9 @@
       ]
     },
     "requiredDecisions": [
+      "facts-first-target",
+      "interceptor-activation",
+      "interceptor-phases-and-failure-posture",
       "interceptor-contract",
       "scope-preservation"
     ],
@@ -2518,7 +2530,7 @@
     "mode": "one-shot",
     "evaluationKind": "routing",
     "risk": "high",
-    "prompt": "In a freshly scaffolded standalone Open Mercato app, add a mutation guard with safe payload rewrite and post-success callbacks. Use installed-package contracts, keep framework packages read-only, preserve tenant and organization boundaries, and identify the smallest relevant validation.",
+    "prompt": "In a freshly scaffolded standalone Open Mercato app, add a mutation guard with safe payload rewrite and post-success callbacks. Resolve the exact entity, operations, block/rewrite/after-success capabilities, and locking-preservation contract from the named module facts before using source context. Keep framework packages read-only, preserve tenant and organization boundaries, and identify the smallest relevant validation.",
     "tags": [
       "umes",
       "mutation-guard"
@@ -2555,6 +2567,9 @@
       ]
     },
     "requiredDecisions": [
+      "facts-first-target",
+      "guard-operations-and-capabilities",
+      "locking-preserved",
       "mutation-guard",
       "safe-after-success"
     ],
@@ -2728,7 +2743,7 @@
     "mode": "one-shot",
     "evaluationKind": "routing",
     "risk": "medium",
-    "prompt": "In a freshly scaffolded standalone Open Mercato app, add DOM Event Bridge progress UI to a long-running operation supplied by an installed module. Extend it through supported UMES surfaces, keep framework packages read-only, and identify the smallest relevant validation.",
+    "prompt": "In a freshly scaffolded standalone Open Mercato app, add DOM Event Bridge progress UI to a long-running operation supplied by an installed module. Resolve the event's client or portal broadcast fact, audience/scoping contract, and exact browser hook from the named module facts before using source context; a transport flag alone is not delivery. Extend through supported UMES surfaces, keep framework packages read-only, and identify the smallest relevant validation.",
     "tags": [
       "umes",
       "backend-ui",
@@ -2762,7 +2777,8 @@
         ".ai/guides/extensions.md",
         ".ai/guides/backend-ui.md",
         ".ai/skills/om-system-extension/SKILL.md",
-        ".ai/guides/modules/progress.md"
+        ".ai/guides/modules/progress.md",
+        ".ai/guides/modules/events.md"
       ],
       "warn": ["node_modules/@open-mercato/*/src/**"], "forbidden": [
         ".env*",
@@ -2770,6 +2786,9 @@
       ]
     },
     "requiredDecisions": [
+      "facts-first-event",
+      "broadcast-audience-scope",
+      "exact-browser-hook",
       "dom-event-bridge",
       "operation-progress"
     ],
@@ -6177,7 +6196,7 @@
     "mode": "analysis",
     "evaluationKind": "routing",
     "risk": "high",
-    "prompt": "Audit how a standalone app can add behavior to installed modules without replacing them. Cover response and query-engine enrichers; API interceptors, mutation guards, and the additive commands/interceptors.ts branch with stable id/targetCommand plus before/after execute and undo hooks; CrudForm and DataTable/menu/rendered widget injection including client operation filters; entity extensions; async, sync, and query-lifecycle subscribers; reactive notification handlers and DOM Event Bridge hooks; integration wizard/status/detail widgets; vector config; embedded AiChat; typed payment/shipping/currency/workflow registrations; and component props/wrappers. For each, name the smallest mechanism and specialist route, exact host-token evidence, wildcard-aware authorization and trusted scope boundary, optional-host behavior, safe block/rewrite posture, read/write/UI round trip where applicable, and verification; no interceptor may bypass the command, locking, audit, or undo, and unified replacement is wrong when additive composition works.",
+    "prompt": "Audit how a standalone app can add behavior to installed modules without replacing them. Choose the mechanism first, then resolve each exact or pattern target from one named module fact sheet, the framework extension catalog for framework-owned hosts, or a contribution's fact-ref/specialistRoute; installed source is only a bounded fallback for one named unresolved version gap. Cover response and caller-opt-in query enrichers; API interceptors, mutation guards, and additive command interceptors with execute/undo phases; every actually bound CrudForm and DataTable render, headless, lifecycle, operation-filter, and component-handle family while rejecting base-prefix/helper-only IDs; framework menus; entity extensions; async, sync, and querying/queried lifecycle subscribers; reactive notification handlers plus client/portal browser bridges and audience scope; integration UI; specialized vector, AI, payment, shipping, currency, and workflow registries; and component wrappers. For each, preserve activation, phases/operations, features, scope, placement, timeout/fallback/cache or execution-guard details, target-resolution provenance, optional-external behavior, and correlated read/write/UI roundTripId legs. Treat unresolved first-party targets as blockers, never bypass command/locking/audit/undo, and prefer additive composition over unified replacement.",
     "tags": ["umes", "extension-points", "additive", "audit"],
     "owner": {
       "kind": "skill",
@@ -6190,7 +6209,7 @@
       "required": [
         "AGENTS.md", ".ai/guides/extensions.md", ".ai/skills/om-system-extension/SKILL.md",
         ".ai/skills/om-system-extension/references/mechanism-selector.md", ".ai/skills/om-system-extension/references/extension-branches.md",
-        ".ai/guides/upstream/BACKWARD_COMPATIBILITY.md"
+        ".ai/guides/upstream/BACKWARD_COMPATIBILITY.md", ".ai/guides/framework-extension-points.md"
       ],
       "allowedExtra": [
         ".ai/guides/modules/notifications.md",
@@ -6206,13 +6225,19 @@
       ],
       "warn": ["node_modules/@open-mercato/*/src/**"], "forbidden": [".env*", ".git/**"]
     },
-    "requiredDecisions": ["additive-before-replacement", "exact-host-token", "enricher-interceptor-guard", "command-interceptor-execute-undo", "command-interceptor-acl-scope", "safe-command-block-rewrite", "query-enricher-and-subscriber", "headless-and-rendered-widgets", "client-operation-filter", "entity-extension", "event-and-notification-reaction", "dom-event-bridge", "integration-ui-specialization", "vector-ai-provider-registration", "component-wrapper", "optional-host", "roundtrip-verification"],
+    "requiredDecisions": ["additive-before-replacement", "facts-first-target-resolution", "framework-catalog-routing", "exact-pattern-fact-ref-resolution", "unresolved-first-party-blocker", "response-query-enricher-activation", "interceptor-guard-phases", "command-interceptor-execute-undo", "command-interceptor-acl-scope", "safe-command-block-rewrite", "querying-queried-caller-opt-in", "all-bound-crud-form-families", "all-bound-data-table-families", "reject-helper-only-hosts", "framework-menu-targets", "entity-extension-fact-ref", "subscriber-sync-persistent-priority", "dom-portal-audience-scope", "specialist-registry-routing", "component-wrapper-handle", "optional-external-provenance", "correlated-roundtrip-verification"],
     "forbiddenPatterns": ["node_modules.{0,40}(?:write|edit|patch)", "direct ORM relationship", "(?:guess|invent).{0,30}(?:spot|handle|route|entity)"],
     "validators": ["catalog.schema", "owner.reference", "skills.reference", "router.contract", "context.budget", "context.forbidden", "patterns.forbidden"],
-    "maxContextFiles": 15,
-    "maxInitialContextBytes": 73728,
-    "maxTotalContextBytes": 147456,
-    "relatedCases": ["OMH-025", "OMH-026", "OMH-038", "OMH-089"]
+    "maxContextFiles": 16,
+    "maxInitialContextBytes": 98304,
+    "maxTotalContextBytes": 262144,
+    "relatedCases": ["OMH-025", "OMH-026", "OMH-038", "OMH-089"],
+    "source": {
+      "paths": [
+        ".ai/specs/2026-07-24-standalone-ai-development-harness.md",
+        ".ai/specs/implemented/SPEC-041-2026-02-24-universal-module-extension-system.md"
+      ]
+    }
   },
   {
     "id": "OMH-089",
@@ -6221,7 +6246,7 @@
     "mode": "analysis",
     "evaluationKind": "routing",
     "risk": "high",
-    "prompt": "Audit the canonical src/modules.ts entry.overrides surface for a standalone app and verify its stable IDs and replacement seams against the backward-compatibility policy. Account for all wired domains: AI agents/tools plus additive AI extensions; API and backend/frontend page routes; subscribers; workers; injection, component, and dashboard widgets; notification types/handlers; API and command interceptors; enrichers; page guards; CLI; entry-scoped setup; ACL; DI; and encryption maps. State exact resolved keys (including registry entry keys and worker metadata fallback), which maps support null-disable/typed replacement, the special AI-extension and setup shapes, where global override maps may live, bootstrap/generation implications, stale-key diagnostics, security preservation, and rollback verification.",
+    "prompt": "Audit the canonical src/modules.ts entry.overrides surface for a standalone app and verify its stable IDs and replacement seams against the backward-compatibility policy. Resolve every wired domain, exact key, and disable-replace/replace/additive mode from the named module facts and their fact-ref provenance before using bounded installed context; an unresolved or stale first-party correlation is a blocker. Account for AI agents/tools plus additive AI extensions; API and backend/frontend page routes; subscribers; workers; injection, component, and dashboard widgets; notification types/handlers; API and command interceptors; enrichers; page guards; CLI; entry-scoped setup; ACL; DI; and encryption maps. Preserve registry entry keys, worker metadata fallback, null-disable/typed replacement semantics, special AI-extension/setup shapes, global-map ownership, bootstrap/generation ordering, security, stale-key diagnostics, and rollback.",
     "tags": ["umes", "unified-overrides", "all-domains", "audit"],
     "owner": {
       "kind": "skill",
@@ -6240,17 +6265,24 @@
         ".ai/guides/modules/ai_assistant.md",
         ".ai/guides/modules/dashboards.md",
         ".ai/guides/modules/events.md",
-        ".ai/guides/modules/notifications.md"
+        ".ai/guides/modules/notifications.md",
+        ".ai/guides/framework-extension-points.md"
       ],
       "warn": ["node_modules/@open-mercato/*/src/**"], "forbidden": [".env*", ".git/**"]
     },
-    "requiredDecisions": ["all-eighteen-domains", "additive-ai-extensions", "stable-override-key", "resolved-widget-worker-keys", "entry-scoped-setup-shape", "null-disable", "typed-replacement", "security-preservation", "stale-key-diagnostic", "bootstrap-before-registry", "rollback-verification"],
+    "requiredDecisions": ["all-eighteen-domains", "facts-first-override-resolution", "override-fact-ref-provenance", "override-mode-from-facts", "unresolved-first-party-blocker", "additive-ai-extensions", "stable-override-key", "resolved-widget-worker-keys", "entry-scoped-setup-shape", "null-disable", "typed-replacement", "security-preservation", "stale-key-diagnostic", "bootstrap-before-registry", "rollback-verification"],
     "forbiddenPatterns": ["node_modules.{0,40}(?:write|edit|patch)", "load order.{0,30}(?:hope|accident)", "(?:weaken|remove).{0,30}(?:auth|scope|guard|lock)"],
     "validators": ["catalog.schema", "owner.reference", "skills.reference", "router.contract", "context.budget", "context.forbidden", "patterns.forbidden"],
-    "maxContextFiles": 5,
-    "maxInitialContextBytes": 40960,
-    "maxTotalContextBytes": 131072,
-    "relatedCases": ["OMH-029", "OMH-030", "OMH-056", "OMH-088"]
+    "maxContextFiles": 10,
+    "maxInitialContextBytes": 98304,
+    "maxTotalContextBytes": 196608,
+    "relatedCases": ["OMH-029", "OMH-030", "OMH-056", "OMH-088"],
+    "source": {
+      "paths": [
+        ".ai/specs/2026-07-24-standalone-ai-development-harness.md",
+        ".ai/specs/implemented/SPEC-041-2026-02-24-universal-module-extension-system.md"
+      ]
+    }
   },
   {
     "id": "OMH-090",
@@ -6290,7 +6322,7 @@
     "mode": "one-shot",
     "evaluationKind": "routing",
     "risk": "high",
-    "prompt": "Add an app-owned customer support cases page to the installed portal. Use frontend/[orgSlug]/portal/**/page.tsx with sibling metadata, customer auth/features for guarded pages while preserving public-page semantics, principal-derived scope, optional nav only for the list destination, frozen portal hooks/spots/handles, portal menu injection only for links without a backing page, DataTable for the list, shared responsive and accessible components, loading/empty/not-found/denial/error/conflict/success states, wildcard-aware authorization, direct-route protection, and portal integration tests.",
+    "prompt": "Add an app-owned customer support cases page to the installed portal. Resolve exact or pattern portal hosts from the portal/customer_accounts module facts and framework-owned portal menu/chrome targets from the framework extension catalog before source context; preserve portalBroadcast audience scope and select the exact portal hook. Use frontend/[orgSlug]/portal/**/page.tsx with sibling metadata, customer auth/features for guarded pages while preserving public-page semantics, principal-derived scope, optional nav only for the list destination, frozen portal hooks/spots/handles, portal menu injection only for links without a backing page, DataTable for the list, shared responsive and accessible components, loading/empty/not-found/denial/error/conflict/success states, wildcard-aware authorization, direct-route protection, and portal integration tests.",
     "tags": [
       "frontend",
       "portal",
@@ -6333,7 +6365,8 @@
         ".ai/skills/om-backend-ui-design/SKILL.md",
         ".ai/skills/om-backend-ui-design/references/frontend-and-design-system.md",
         ".ai/guides/modules/customer_accounts.md",
-        ".ai/guides/modules/portal.md"
+        ".ai/guides/modules/portal.md",
+        ".ai/guides/framework-extension-points.md"
       ],
       "warn": ["node_modules/@open-mercato/*/src/**"], "forbidden": [
         ".env*",
@@ -6341,6 +6374,10 @@
       ]
     },
     "requiredDecisions": [
+      "facts-first-portal-host",
+      "framework-portal-menu-host",
+      "portal-broadcast-audience-scope",
+      "exact-portal-hook",
       "portal-route-convention",
       "portal-page-metadata",
       "public-versus-guarded-portal-auth",
@@ -6498,7 +6535,7 @@
       "oracle.business.command"
     ],
     "maxContextFiles": 10,
-    "maxInitialContextBytes": 60416,
+    "maxInitialContextBytes": 61440,
     "maxTotalContextBytes": 196608,
     "relatedCases": [
       "OMH-060",
@@ -10808,7 +10845,7 @@
     "requiredDecisions":["durable-user-task","separation-of-duties","mutation-guards","status-invariant"],
     "forbiddenPatterns":["node_modules.{0,40}(?:write|edit|patch)","(?:tenant|organization).{0,30}(?:unscoped|scope optional)","requireRoles"],
     "validators":["catalog.schema","owner.reference","skills.reference","router.contract","context.budget","context.forbidden","patterns.forbidden"],
-    "maxContextFiles":9,"maxInitialContextBytes":50176,"maxTotalContextBytes":147456,"relatedCases":["OMH-053","OMH-074","OMH-077"]
+    "maxContextFiles":9,"maxInitialContextBytes":53248,"maxTotalContextBytes":147456,"relatedCases":["OMH-053","OMH-074","OMH-077"]
   },
   {
     "id": "OMH-140",
@@ -11736,7 +11773,7 @@
     "requiredDecisions":["webhook-signature","typed-events","subscriber-idempotency","outbound-delivery-status"],
     "forbiddenPatterns":["node_modules.{0,40}(?:write|edit|patch)","(?:tenant|organization).{0,30}(?:unscoped|scope optional)","(?:secret|token|credential).{0,20}(?:console|log|plain.?text)"],
     "validators":["catalog.schema","owner.reference","skills.reference","router.contract","context.budget","context.forbidden","patterns.forbidden"],
-    "maxContextFiles":12,"maxInitialContextBytes":63488,"maxTotalContextBytes":147456,"relatedCases":["OMH-018","OMH-043"]
+    "maxContextFiles":12,"maxInitialContextBytes":65536,"maxTotalContextBytes":147456,"relatedCases":["OMH-018","OMH-043"]
   },
   {
     "id": "OMH-156",
@@ -12100,7 +12137,7 @@
     "requiredDecisions":["public-scope-derived-server-side","idempotent-submission","deterministic-deduplication","optional-crm","delivery-route-preserves-task-routes","smallest-validation"],
     "forbiddenPatterns":["node_modules.{0,40}(?:write|edit|patch)","(?:tenant|organization).{0,30}(?:unscoped|scope optional)","git (?:add|commit).{0,20}(?:--all|-a)","(?:skip|omit).{0,30}(?:validation|test)"],
     "validators":["catalog.schema","owner.reference","skills.reference","router.contract","context.budget","context.forbidden","patterns.forbidden"],
-    "maxContextFiles":11,"maxInitialContextBytes":61440,"maxTotalContextBytes":196608,"relatedCases":["OMH-005","OMH-073"]
+    "maxContextFiles":11,"maxInitialContextBytes":65536,"maxTotalContextBytes":196608,"relatedCases":["OMH-005","OMH-073"]
   },
   {
     "id":"OMH-170","title":"Review a stock-reservation pull request for actionable problems only","family":"architecture","mode":"review","evaluationKind":"routing","risk":"medium",
@@ -12404,30 +12441,30 @@
   },
   {
     "id":"OMH-179","title":"Show loyalty points in customer responses without copying customer records","family":"umes","mode":"one-shot","evaluationKind":"routing","risk":"medium",
-    "prompt":"Show each customer's current loyalty-points balance in customer API results while keeping the existing customer data as the source of truth and avoiding a duplicate balance that could go stale.",
+    "prompt":"Show each customer's current loyalty-points balance in customer list and detail API results while keeping the existing customer data as the source of truth. Resolve the dotted target entity, host-route opt-in, list/detail surfaces, timeout/fallback/cache posture, and correlation provenance from the customers module facts before source context; do not duplicate customer records or invent a target.",
     "tags":["business-language","response-enrichment","loyalty"],
     "owner":{"kind":"skill","path":".ai/skills/om-system-extension/SKILL.md","ruleIds":["BC-02","BC-03","BC-04"]},
     "expectedRouter":{"required":["umes"],"allowedExtra":["module-data","framework-context"]},
     "requiredSkills":["om-system-extension"],
     "context":{"required":["AGENTS.md",".ai/guides/extensions.md",".ai/skills/om-system-extension/SKILL.md",".ai/guides/modules/customers.md"],"allowedExtra":[".ai/guides/contracts.md"],"warn": ["node_modules/@open-mercato/*/src/**"], "forbidden": [".env*",".git/**"]},
-    "requiredDecisions":["scoped-enricher","batched-enrichment","exact-host-token","no-host-record-mutation"],
+    "requiredDecisions":["facts-first-target","enricher-host-opt-in","enricher-list-detail-posture","scoped-enricher","batched-enrichment","exact-host-token","no-host-record-mutation"],
     "forbiddenPatterns":["node_modules.{0,40}(?:write|edit|patch)","(?:tenant|organization).{0,30}(?:unscoped|scope optional)","(?:copy|duplicate).{0,20}customer (?:entity|record|table)"],
     "validators":["catalog.schema","owner.reference","skills.reference","router.contract","context.budget","context.forbidden","patterns.forbidden"],
     "maxContextFiles":6,"maxInitialContextBytes":40960,"maxTotalContextBytes":114688,"relatedCases":["OMH-025","OMH-088"]
   },
   {
     "id":"OMH-180","title":"Add preferred contact time to the existing customer form with full round trip","family":"umes","mode":"one-shot","evaluationKind":"routing","risk":"high",
-    "prompt":"Add preferred contact time to the existing customer form and make entering, displaying, changing, clearing, and reloading the value work correctly.",
+    "prompt":"Add preferred contact time to the existing customer form and make entering, displaying, changing, clearing, and reloading the value work correctly. Resolve the exact bound CrudForm base/header/fields or lifecycle host and shared roundTripId from the customers module facts before source context; reject helper-only or unbound field builders.",
     "tags":["business-language","form-extension","customer"],
     "owner":{"kind":"skill","path":".ai/skills/om-system-extension/SKILL.md","ruleIds":["BC-02","BC-03","BC-06","BC-07","BC-08"]},
     "expectedRouter":{"required":["module-data","backend-ui","umes"],"allowedExtra":["testing","framework-context"]},
     "requiredSkills":["om-data-model-design","om-backend-ui-design","om-system-extension"],
     "optionalSkills":[{"id":"om-framework-context","route":"framework-context"}],
     "context":{"required":["AGENTS.md",".ai/guides/contracts.md",".ai/guides/extensions.md",".ai/guides/backend-ui.md",".ai/skills/om-data-model-design/SKILL.md",".ai/skills/om-system-extension/SKILL.md",".ai/skills/om-backend-ui-design/SKILL.md",".ai/guides/modules/customers.md"],"allowedExtra":[".ai/skills/om-framework-context/SKILL.md"],"warn": ["node_modules/@open-mercato/*/src/**"], "forbidden": [".env*",".git/**"]},
-    "requiredDecisions":["widget-read-write-roundtrip","stable-spot-id","clear-null","optimistic-lock","translation-keys"],
+    "requiredDecisions":["facts-first-target","bound-crud-form-host","correlated-roundtrip","reject-helper-only-host","widget-read-write-roundtrip","stable-spot-id","clear-null","optimistic-lock","translation-keys"],
     "forbiddenPatterns":["node_modules.{0,40}(?:write|edit|patch)","raw (?:form|fetch)","hard-coded user-facing","direct ORM relationship"],
     "validators":["catalog.schema","owner.reference","skills.reference","router.contract","context.budget","context.forbidden","patterns.forbidden"],
-    "maxContextFiles":8,"maxInitialContextBytes":49152,"maxTotalContextBytes":131072,"relatedCases":["OMH-024","OMH-026","OMH-061"]
+    "maxContextFiles":8,"maxInitialContextBytes":53248,"maxTotalContextBytes":131072,"relatedCases":["OMH-024","OMH-026","OMH-061"]
   },
   {
     "id": "OMH-181",
@@ -12436,7 +12473,7 @@
     "mode": "one-shot",
     "evaluationKind": "implementation",
     "risk": "high",
-    "prompt": "Add an order-risk filter and a bulk review action to the existing orders table, enforcing permission and version checks for every selected row.",
+    "prompt": "Add an order-risk filter and a bulk review action to the existing orders table, enforcing permission and version checks for every selected row. Resolve the exact bound DataTable filter and bulk-action targets, deep table ID, execution guard, and correlation provenance from the sales module facts before source context; do not use the base prefix or helper-only IDs as mounts.",
     "tags": [
       "business-language",
       "table-extension",
@@ -12493,6 +12530,10 @@
       ]
     },
     "requiredDecisions": [
+      "facts-first-target",
+      "bound-data-table-host",
+      "base-prefix-not-mountable",
+      "correlated-execution-guard",
       "stable-table-host",
       "bulk-mutation-safety",
       "wildcard-acl",
@@ -12549,27 +12590,27 @@
   },
   {
     "id":"OMH-182","title":"Block order cancellation after dispatch across every entry point","family":"umes","mode":"one-shot","evaluationKind":"routing","risk":"high",
-    "prompt":"Block order cancellation after dispatch even when someone calls the API directly, while preserving the existing route, method, request, response, and error schemas.",
+    "prompt":"Block order cancellation after dispatch even when someone calls the API directly, while preserving the existing route, method, request, response, and error schemas. Resolve the sales guard host entity, update operation, block capability, optimistic-lock preservation, and fact-ref provenance from the sales module facts before source context.",
     "tags":["business-language","mutation-guard","orders"],
     "owner":{"kind":"skill","path":".ai/skills/om-system-extension/SKILL.md","ruleIds":["BC-02","BC-03","BC-05","BC-08"]},
     "expectedRouter":{"required":["umes"],"allowedExtra":["module-data","backend-ui","debugging","framework-context"]},
     "requiredSkills":["om-system-extension"],
     "optionalSkills":[{"id":"om-framework-context","route":"framework-context"}],
     "context":{"required":["AGENTS.md",".ai/guides/extensions.md",".ai/skills/om-system-extension/SKILL.md",".ai/guides/modules/sales.md",".ai/guides/upstream/BACKWARD_COMPATIBILITY.md"],"allowedExtra":[".ai/skills/om-framework-context/SKILL.md"],"warn": ["node_modules/@open-mercato/*/src/**"], "forbidden": [".env*",".git/**"]},
-    "requiredDecisions":["mutation-guard","backend-consistency","status-invariant"],
+    "requiredDecisions":["facts-first-target","guard-operations-and-capabilities","locking-preserved","mutation-guard","backend-consistency","status-invariant"],
     "forbiddenPatterns":["node_modules.{0,40}(?:write|edit|patch)","UI only","(?:skip|bypass).{0,30}(?:guard|permission|lock)","rewrite.{0,30}(?:all|entire).{0,20}(?:body|query)"],
     "validators":["catalog.schema","owner.reference","skills.reference","router.contract","context.budget","context.forbidden","patterns.forbidden"],
     "maxContextFiles":8,"maxInitialContextBytes":65536,"maxTotalContextBytes":114688,"relatedCases":["OMH-031","OMH-032","OMH-038"]
   },
   {
     "id":"OMH-183","title":"Award loyalty points after payment while tolerating an absent sales feature","family":"umes","mode":"one-shot","evaluationKind":"routing","risk":"high",
-    "prompt":"Award loyalty points after a payment completes, avoid awarding the same points twice, and keep the application working when sales is not installed.",
+    "prompt":"Award loyalty points after a payment completes, avoid awarding the same points twice, and keep the application working when sales is not installed. Resolve the event/subscriber fact reference, sync/persistent/priority posture, and optional-external target provenance from the named payment and sales module facts before source context.",
     "tags":["business-language","event-reaction","optional-feature"],
     "owner":{"kind":"skill","path":".ai/skills/om-system-extension/SKILL.md","ruleIds":["BC-02","BC-03","BC-04","BC-05","BC-09"]},
     "expectedRouter":{"required":["module-data","umes"],"allowedExtra":["integration","ai-workflow"]},
     "requiredSkills":["om-module-scaffold","om-system-extension"],
     "context":{"required":["AGENTS.md",".ai/guides/contracts.md",".ai/guides/extensions.md",".ai/skills/om-module-scaffold/SKILL.md",".ai/skills/om-system-extension/SKILL.md",".ai/guides/modules/sales.md"],"allowedExtra":[".ai/guides/modules/payment_gateways.md"],"warn": ["node_modules/@open-mercato/*/src/**"], "forbidden": [".env*",".git/**"]},
-    "requiredDecisions":["typed-events","subscriber-idempotency","optional-host","safe-degradation","cross-module-id-link"],
+    "requiredDecisions":["facts-first-event","subscriber-delivery-posture","optional-external-provenance","typed-events","subscriber-idempotency","optional-host","safe-degradation","cross-module-id-link"],
     "forbiddenPatterns":["node_modules.{0,40}(?:write|edit|patch)","direct ORM relationship","(?:require|assume).{0,20}sales.{0,20}(?:installed|enabled)","(?:tenant|organization).{0,30}(?:unscoped|scope optional)"],
     "validators":["catalog.schema","owner.reference","skills.reference","router.contract","context.budget","context.forbidden","patterns.forbidden"],
     "maxContextFiles":7,"maxInitialContextBytes":49152,"maxTotalContextBytes":131072,"relatedCases":["OMH-018","OMH-034"]

package/agentic/shared/ai/skills/om-system-extension/references/mechanism-selector.md

@@ -20,6 +20,8 @@ Load this reference before choosing files.
 | Hide/replace supported route/page/agent/tool/etc. | `src/modules.ts` unified override. |
 | Change unsupported internals | Eject only after explicit approval. |
 
-Resolve exact host tokens from facts/source. If multiple mechanisms are required (for example editable field = widget + enricher + interceptor), name one owner for each read/write/UI leg and test them as one round trip. Reactive notifications, messages/inbox, query/vector, integrations, and AI/workflow work also select their owning task route; UMES does not replace that specialist context.
+Resolve exact targets from the named module sheet's `UMES hosts` and `UMES contributions` first. Use `.ai/guides/framework-extension-points.md` for framework-owned menus, dashboard, notification, integration, and shell targets. Follow `fact-ref` and `specialistRoute` provenance instead of inventing a generic target; use exact installed context only for one named fact gap. `optional-external` degrades when its package is absent, while an `unresolved` first-party target blocks implementation.
+
+If multiple mechanisms are required (for example editable field = widget + enricher + interceptor), follow the shared `roundTripId`, name one owner for each read/write/UI leg, and test them as one round trip. Select only facts marked bound: DataTable's rendered header/footer/toolbar/search-trailing, headless columns/row-actions/bulk-actions/filters, and component handle; CrudForm's base/header/fields, component handle, and declared lifecycle/operation-filter pipeline. Base prefixes and helper-only/unbound IDs are not mountable. Reactive notifications, messages/inbox, query/vector, integrations, and AI/workflow work also select their owning task route; UMES does not replace that specialist context.
 
 Prefer additive composition before replacement (`additive-before-replacement`). Ejection is the last resort after supported seams are proven insufficient and explicit approval is granted (`eject-last`).

package/agentic/shared/ai/skills/om-system-extension/references/unified-overrides.md

@@ -1,6 +1,6 @@
 # Unified Override Domains
 
-Load this reference when `src/modules.ts` must disable or replace an installed contribution. `entry.overrides` is the only canonical app-level override umbrella. Resolve every key from generated facts or exact installed context. For keyed override maps, `null` disables a supported contribution and a typed value replaces it; AI extensions and setup hooks have the special shapes below.
+Load this reference when `src/modules.ts` must disable or replace an installed contribution. `entry.overrides` is the only canonical app-level override umbrella. Resolve every domain/key from the named module sheet's `UMES contributions` override facts first, following `fact-ref` provenance to the existing route/page/event/worker/widget/agent/tool/setup/ACL/DI/encryption facts. Use exact installed context only for one named missing fact. For keyed override maps, `null` disables a supported contribution and a typed value replaces it; AI extensions and setup hooks have the special shapes below.
 
 | Domain | Shape/key |
 |---|---|
@@ -30,6 +30,7 @@ Load this reference when `src/modules.ts` must disable or replace an installed c
 - API route methods are case-insensitive and paths normalize a leading/trailing slash; use the canonical displayed key. Disabling all methods removes the route entry.
 - Page keys name generated frontend/backend URL paths, not filesystem paths. After hiding a landing page, provide a safe accessible redirect.
 - Injection/dashboard keys are generated entry keys and may differ from widget metadata IDs. Worker keys are resolved descriptor IDs; inspect generated facts/source instead of constructing them from memory.
+- Require the generated override fact's exact `domain`, `key`, and mode (`disable-replace`, `replace`, or `additive`). A stale or `unresolved` first-party correlation is a blocker; it is not a fallback to a guessed key.
 - Keep AI extensions additive and ordered. Use agent/tool maps only for replacement or disable; do not encode an extension as a `null`-capable map entry.
 - Preserve replacement type/signature, auth/features, scope, stable ID, and observable side effects. A replacement may strengthen safety but never silently narrow a public contract.
 - Treat unknown/stale override diagnostics as failures. Run `yarn generate`, clear structural nav/module caches with the app's documented command, and verify the old contribution is absent in every bootstrap.

package/agentic/shared/scripts/framework-context.mjs

@@ -494,13 +494,6 @@ function fallbackInstalledPackageManifests(nodeModulesRoot) {
 }
 
 function fallbackBoundedSearch(query, sourceRoot) {
-  let pattern
-  try {
-    pattern = new RegExp(query)
-  } catch (error) {
-    throw new Error(`bounded search failed: ${error instanceof Error ? error.message : String(error)}`)
-  }
-
   const matches = []
   let bytesRead = 0
   for (const file of fallbackRegularFiles(sourceRoot, 'bounded search failed')) {
@@ -515,7 +508,7 @@ function fallbackBoundedSearch(query, sourceRoot) {
     const lines = content.toString('utf8').split(/\r?\n/)
     for (let index = 0; index < lines.length; index += 1) {
       const line = lines[index]
-      if (!pattern.test(line)) continue
+      if (!line.includes(query)) continue
       const preview = line.length > 500 ? `${line.slice(0, 500)}…` : line
       matches.push(`${file}:${index + 1}:${preview}`)
       if (matches.length > SEARCH_MATCH_LIMIT) break
@@ -640,7 +633,7 @@ function packageDiagnosticWarnings(diagnostics) {
 
 function runBoundedSearch(query, sourceRoot) {
   const fileSearch = runRg(
-    ['--no-ignore', '--hidden', '--files-with-matches', '--null', '--sort', 'path', '--', query, sourceRoot],
+    ['--no-ignore', '--hidden', '--fixed-strings', '--files-with-matches', '--null', '--sort', 'path', '--', query, sourceRoot],
     'bounded search failed',
   )
   if (!fileSearch) return fallbackBoundedSearch(query, sourceRoot)
@@ -660,6 +653,7 @@ function runBoundedSearch(query, sourceRoot) {
       [
         '--no-ignore',
         '--hidden',
+        '--fixed-strings',
         '--line-number',
         '--with-filename',
         '--color',

package/dist/agentic/guides/extensions.md

@@ -1,6 +1,18 @@
 # Unified Module Extensions and Overrides
 
-Use the smallest extension mechanism that preserves installed-module ownership. Resolve host IDs from generated facts or exact installed source; never invent spot, route, or entity IDs.
+Use the smallest extension mechanism that preserves installed-module ownership. Resolve mechanisms, targets, and round trips from generated facts before exact installed source; never invent spot, route, entity, event, registry, or override IDs.
+
+## Fact-First Target Resolution
+
+Resolve an installed extension in this order:
+
+1. Choose the mechanism by intent below; the mechanism decides which contribution kind and host capability are required.
+2. Open only the named target module sheet at `.ai/guides/modules/<module>.md`. Its `UMES hosts` rows prove mountable exact/pattern targets; its `UMES contributions` rows preserve activation, phases/operations, feature and scope contracts, specialist routes, correlation resolution, and read/write/UI `roundTripId` links.
+3. For global shell, menu, dashboard, notification, or integration surfaces, use `.ai/guides/framework-extension-points.md`. Do not assign a framework-owned host to a business module or invent a `$framework` module.
+4. Follow a contribution's `fact-ref` or `specialistRoute` to the existing event/entity/API/command/search/AI/provider facts and owning specialist route. A specialized registry is not evidence for a generic widget target.
+5. Use `om-framework-context` for one named unresolved installed-version gap only. An `optional-external` target is explicit provenance and must degrade when its owner package is absent; an `unresolved` first-party target is a blocker, not permission to guess.
+
+The legacy `Host extension points` token summary remains useful for compatibility, but it is not proof that a helper-built token is bound. Prefer the correlated host/contribution rows. A DataTable base token is a prefix, not a rendered mount; helper-only CrudForm/DataTable IDs marked `bound: false` are diagnostics and must never be selected.
 
 ## Route Selection
 
@@ -17,7 +29,7 @@ Add every other match too: `backend-ui` + `om-backend-ui-design` when authoring,
 | Add pre/post command behavior without replacing the command | Command interceptor | `commands/interceptors.ts` |
 | Block/rewrite a mutation with post-success work | Mutation guard contract | `data/guards.ts`; add widget injection only for a UI surface |
 | Enrich query-engine reads | Query enricher | `data/enrichers.ts` with `queryEngine.enabled` |
-| Add form fields/table columns/actions/filters/toolbar | Headless widget injection | `widgets/injection/**`, `widgets/injection-table.ts` |
+| Add form fields/table columns/actions/filters/toolbar | Headless widget injection | `widgets/injection/**`, `widgets/injection-table.ts`; select an exact bound family row from target facts |
 | Add/reorder menu items | Headless menu widget | same widget files, `menu:*` host |
 | Render a card/tab/section in another page | UI widget injection | same widget files |
 | Add app data linked to installed entity | Entity extension | `data/extensions.ts` |
@@ -66,7 +78,9 @@ Add every other match too: `backend-ui` + `om-backend-ui-design` when authoring,
 - Gate display and execution separately. UI hiding never substitutes for backend authorization.
 - Scope client handlers with `eventHandlers.filter.operations`; use `clientBroadcast`, `useAppEvent`, and `useOperationProgress` for typed real-time behavior instead of polling by default.
 
-Common host families include `crud-form:<entityId>:fields`, `data-table:<tableId>:columns`, `:row-actions`, `:bulk-actions`, `:filters`, `:toolbar`, `:search-trailing`, and `menu:sidebar:*`/`menu:topbar:*`. Resolve the concrete IDs; do not derive them by guess.
+Bound CrudForm hosts are the base render/lifecycle host, `:header`, headless `:fields`, its component handle, and the declared transform/save/delete/field/navigation lifecycle handlers with create/update/delete operation filters. Bound DataTable hosts are rendered `:header`, `:footer`, `:toolbar`, conditional `:search-trailing`, headless `:columns`, `:row-actions`, `:bulk-actions`, `:filters`, and the `data-table:<tableId>` component handle. The DataTable base prefix, `emptyState`, and helper-only CrudForm before/after/footer/sidebar/group/field builders are not mountable unless a future bound-family fact explicitly says otherwise.
+
+Menu hosts are framework-owned unless the named module facts prove otherwise. Use the framework catalog's exact menu surface/item IDs, label keys, feature gates, and relative placement; never derive `menu:sidebar:*` or `menu:topbar:*` from memory.
 
 ## Extensions and Optional Coupling
 
@@ -102,3 +116,6 @@ Common host families include `crud-form:<entityId>:fields`, `data-table:<tableId
 2. Test authorized, unauthorized, and wildcard-feature callers.
 3. Test list and detail, create/update/delete/action, cache hit/miss, and failure fallback where applicable.
 4. Run `yarn generate`, inspect host registration, and verify no installed file changed.
+5. Re-read the generated contribution row: its target must resolve as `exact`, `pattern`, `framework`, `fact-ref`, or intentional `optional-external`, and every shared `roundTripId` leg must remain present. Treat `unresolved` first-party provenance as a failed generation/coverage gate.
+
+The repository umbrella specification may be available at `.ai/specs/implemented/SPEC-041-2026-02-24-universal-module-extension-system.md` in a source checkout. It is optional background only; the generated facts and this selector are sufficient offline in a standalone scaffold.