Add read-only `desktop_menus` for an exact application target from `desktop_apps`. Signed native output and application inventories before and after the read must match the requested process generation. Optional literal `path` selects one uniquely observed menu/item subtree before returning content; missing or ambiguous ancestry is refused and complete title paths are preserved. No input authority or menu command is added.

Native cache possibility and unknown completeness remain separate from Ace truncation. Enabled/checked flags are omitted because native defaults can hide unavailable attributes. AX reads can populate lazy menus and trigger callbacks; synchronous traversal may delay cancellation or GUI responsiveness. Part of #8 and #73.

Live validation on signed head `1f8cde5d1a15f61023d52b22bce9bfdf5d4e0861`:

- Types, CI, Swift parse, independent source review, signed development build, strict signatures and GitHub CI passed. - Real signed native reads verified a literal `>`/Unicode submenu, missing and ambiguous ancestor refusals, an observed cached previous label followed by the updated label after expiry, and the isolated Ace application's `File` menu. - One real pi/OpenAI `gpt-6-sol` run read only the public `Proof` subtree. Exact stored result, usage and execution counts survived actual worker exit/reopen without another native read. - Menu population callbacks occurred; actual tracking begin/end, command, key and click counters remained zero and fixture focus stayed unchanged. All owned fixtures, workers, development processes, sockets and ports were closed; temporary channel/project/settings were removed. No clipboard access.

Final head `a8059a519976d8a78012f35cb34c8981a7c67f53` integrates landed app launch #136. The menu native implementation is byte-identical to the tested head; additive launch/menu unions and docs were independently reviewed. Final types/CI, signed rebuild, strict signatures and GitHub CI pass. Live checks were not repeated for this integration.

Earlier signed `c83b087` supplied the preserved stale-generation and pre-cancel refusal evidence. Original setup/counter-verifier failures remain recorded; passed native requests were not retried. Evidence: `/tmp/ace-menu-smoke.7GzFXu/result.json`, `/tmp/ace-menu-live.dXPqws/result.json`. In-flight cancellation, hosted routing, hung-menu responsiveness and second-machine behavior remain unverified.

### Built in Ace

Used Codex's direct file/terminal tools for implementation, review, builds and private fixture control under Nate's explicit direct-tool authorization for this dogfooding work. The real checks ran through Ace's source host, signed native bridge and pi channel. Ace-native development coverage remains tracked in #5, #9 and #22.