docs: record installed resource main promotion

.project-docs/30-worklog/tasks/20260903-promote-installed-resources-main-5c8e1a72.md

@@ -0,0 +1,87 @@
+# Task: Promote installed resource integration to main
+
+## Identity
+
+- Task ID: 20260903-promote-installed-resources-main-5c8e1a72
+- Mode: Integration
+- Branch: main
+- Worktree: D:\Datas\OthersProjects\makelore
+- Base commit: 28e1690038d61b9333a2f6ca77f0187ea4273676
+- Owner: codex
+- Status: Ready for Integration
+
+## Scope
+
+- Promote verified integration candidate `bd377c9` from
+  `codex/20260903-integrate-installed-resources-4b7e2c91-integrate-installed-resources`
+  onto the current local `main` with a strict fast-forward.
+- Preserve and restore the three pre-existing untracked task records exactly.
+- Record the promotion and verification without rebuilding, installing,
+  publishing, or pushing.
+
+## Intent And Constraints
+
+- Candidate `bd377c9` is already based on exact local `main` base
+  `28e1690038d61b9333a2f6ca77f0187ea4273676`; abort if ancestry or branch state
+  changes instead of creating a merge commit or resolving new conflicts.
+- Treat the candidate's implementation and canonical memory as read-only except
+  for replacing its source integration-task reference with this main-promotion
+  task. The source integration record remains intact on its source branch; this
+  task owns the only task record added to the final `main` tree.
+- The user explicitly authorized force-releasing the completed diagnostic task.
+  The three unrelated untracked records were moved to a unique temporary
+  directory solely to obtain clean ownership and must be restored byte-for-byte
+  after this promotion task is completed and released.
+- Do not modify the installed Makelore client, Device Package store, user
+  projects, remote refs, package artifacts, or unrelated repository state.
+
+## Promotion Plan
+
+1. Confirm `main` is still the candidate ancestor and fast-forward to
+   `bd377c9`.
+2. Verify both product commits and the integration commit are reachable from
+   `main`, and that only this promotion record differs from the verified
+   candidate after documentation.
+3. Run the task-aware drift check, commit this promotion record, mark the task
+   complete, release the clean worktree, and restore the protected files.
+
+## Outcome
+
+- Fast-forwarded local `main` from exact base
+  `28e1690038d61b9333a2f6ca77f0187ea4273676` to verified candidate
+  `bd377c9` with no merge commit or conflict.
+- Local `main` now contains packaged Device Package authority fix
+  `5a2f0eb6785b59d8b455ed5cb1d9773351ff895a` and complete installed/enabled
+  extension activation fix `17664c5fffcfe695653b4146503e645f54767c4b`.
+- Kept candidate product files and accepted canonical behavior unchanged. Only
+  the canonical source pointer was updated to this promotion task, and the
+  source integration record was excluded from the final main tree to satisfy
+  task-owned document boundaries; it remains intact on the candidate branch.
+- No remote push, package build, application installation/restart, Device
+  Package mutation, or user-project change occurred.
+
+## Verification
+
+- Before promotion, `main` was exactly `28e1690` and was an ancestor of
+  `bd377c9`; `git merge --ff-only bd377c9` succeeded.
+- Both product commits are ancestors of local `main`.
+- Immediately after the fast-forward, `git diff --exit-code bd377c9 --` passed,
+  proving the checked-out tracked tree exactly matched the fully verified
+  integration candidate before this task's documentation-only closeout.
+- Candidate verification: 5 focused files / 31 tests, 222 full test files /
+  1,815 passed / 2 conditional skips, pressure 1/1, typecheck, scoped lint,
+  production build, `git diff --check`, and task-aware document drift all passed.
+- The protected records' SHA-256 values were captured before restoration; they
+  will be compared after the task is completed and ownership released.
+
+## Follow-ups
+
+- Build and install a client from this exact `main`, then execute the live
+  npm/Git/loose-Skill prepare→confirm flow and activate a generation containing
+  at least two enabled extensions. The installed 1.2.6 client is unchanged.
+- Remote `origin/main` remains unchanged because no push was requested.
+
+## Promotion Candidates
+
+- None. The verified candidate and accepted canonical updates are now on local
+  `main`.