feat: surface pending iCloud provider indexing

.github/scripts/verify-release-artifacts.sh

@@ -23,17 +23,17 @@ require_exactly_one_path() {
 }
 
 require_exactly_one_file() {
-  local file_name="$1" count=0 matched_path=""
-  while IFS= read -r -d '' matched_path; do count=$((count + 1)); done < <(find "$artifact_root" -type f -name "$file_name" -print0)
+  local directory="$1" file_name="$2" count=0 matched_path=""
+  while IFS= read -r -d '' matched_path; do count=$((count + 1)); done < <(find "$artifact_root/$directory" -type f -name "$file_name" -print0)
   if [[ $count -ne 1 ]]; then
-    printf 'Expected exactly one release artifact named %s, found %s.\n' "$file_name" "$count" >&2
+    printf 'Expected exactly one release artifact named %s in %s, found %s.\n' "$file_name" "$directory" "$count" >&2
     exit 1
   fi
 }
 
 expected_dirs=(
   "release-disksage-ubuntu-22.04-${run_attempt}"
-  "release-disksage-windows-latest-${run_attempt}"
+  "release-disksage-windows-2022-${run_attempt}"
   "release-disksage-macos-latest-${run_attempt}"
 )
 
@@ -55,22 +55,24 @@ if [[ -n "$unexpected_entry" ]]; then
   exit 1
 fi
 
-require_exactly_one_path '*/bundle/deb/*.deb' 'Debian bundle'
-require_exactly_one_path '*/bundle/appimage/*.AppImage' 'AppImage bundle'
-require_exactly_one_path '*/bundle/msi/*.msi' 'Windows MSI bundle'
-require_exactly_one_path '*/bundle/nsis/*.exe' 'Windows NSIS bundle'
-require_exactly_one_path '*/bundle/dmg/*.dmg' 'macOS DMG bundle'
+require_exactly_one_path "$artifact_root/${expected_dirs[0]}/bundle/deb/*.deb" 'Debian bundle'
+require_exactly_one_path "$artifact_root/${expected_dirs[0]}/bundle/appimage/*.AppImage" 'AppImage bundle'
+require_exactly_one_path "$artifact_root/${expected_dirs[1]}/bundle/msi/*.msi" 'Windows MSI bundle'
+require_exactly_one_path "$artifact_root/${expected_dirs[1]}/bundle/nsis/*.exe" 'Windows NSIS bundle'
+require_exactly_one_path "$artifact_root/${expected_dirs[2]}/bundle/dmg/*.dmg" 'macOS DMG bundle'
 
-for required_name in \
-  disksage-cloud-plan-linux-x86_64 \
-  disksage-duplicate-audit-linux-x86_64 \
-  disksage-cloud-plan-windows-x86_64.exe \
-  disksage-duplicate-audit-windows-x86_64.exe \
-  disksage-cloud-plan-macos-arm64 \
-  disksage-duplicate-audit-macos-arm64; do
-  require_exactly_one_file "$required_name"
-  require_exactly_one_file "$required_name.sha256"
-done
+require_exactly_one_file "${expected_dirs[0]}" disksage-cloud-plan-linux-x86_64
+require_exactly_one_file "${expected_dirs[0]}" disksage-cloud-plan-linux-x86_64.sha256
+require_exactly_one_file "${expected_dirs[0]}" disksage-duplicate-audit-linux-x86_64
+require_exactly_one_file "${expected_dirs[0]}" disksage-duplicate-audit-linux-x86_64.sha256
+require_exactly_one_file "${expected_dirs[1]}" disksage-cloud-plan-windows-x86_64.exe
+require_exactly_one_file "${expected_dirs[1]}" disksage-cloud-plan-windows-x86_64.exe.sha256
+require_exactly_one_file "${expected_dirs[1]}" disksage-duplicate-audit-windows-x86_64.exe
+require_exactly_one_file "${expected_dirs[1]}" disksage-duplicate-audit-windows-x86_64.exe.sha256
+require_exactly_one_file "${expected_dirs[2]}" disksage-cloud-plan-macos-arm64
+require_exactly_one_file "${expected_dirs[2]}" disksage-cloud-plan-macos-arm64.sha256
+require_exactly_one_file "${expected_dirs[2]}" disksage-duplicate-audit-macos-arm64
+require_exactly_one_file "${expected_dirs[2]}" disksage-duplicate-audit-macos-arm64.sha256
 
 checksum_files=()
 checksum_file=""

.github/workflows/release.yml

@@ -259,6 +259,10 @@ jobs:
           path: release-artifacts
           merge-multiple: false
 
+      - name: Verify downloaded release artifact contract
+        shell: bash
+        run: bash .github/scripts/verify-release-artifacts.sh release-artifacts "${{ github.run_attempt }}"
+
       - name: Generate and validate source-bound SBOM
         shell: bash
         run: |

CHANGELOG.md

@@ -39,6 +39,19 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 - Show the last read-only iCloud File Provider evidence timestamp beside the
   new-copy admission state, so a stalled `no progress`/`hard expired` queue has
   an actionable retry context without exposing provider paths.
+- Include the redacted iCloud File Provider `pending-indexable-count` in admission evidence and
+  surface `icloud-file-provider-indexing-pending` when Finder remains in “복사 준비 중”.
+- Record the redacted File Provider `disk import: yes` marker as
+  `icloud-file-provider-disk-import-active`, show it beside the iCloud admission evidence, and
+  keep Finder copy, attestation, and source cleanup blocked while macOS is importing a provider
+  disk.
+- Persist the earliest retained timestamp for an unchanged iCloud admission-blocker set, so a
+  restart cannot reset the stalled-copy duration; this diagnostic never grants copy, attestation,
+  or eviction authority.
+- Persist bounded, path-free OneDrive/Google Drive provider-global observations and return
+  `admission_blocked_since_ms` for an unchanged blocker cohort, so a Finder “복사 준비 중” stall
+  remains visible across DiskSage or system restarts; tampered evidence is ignored and the journal
+  never grants copy, attestation, or source-eviction authority.
 - Bind Tauri packaging to a fail-closed cross-manifest release-version verifier so `package.json`, `Cargo.toml`, `tauri.conf.json`, and any `v*` release tag must agree on one valid Semantic Version before a bundle is built.
 - Add retry-safe release concurrency: fresh first attempts may supersede stale runs, while explicit GitHub rerun attempts do not self-cancel inside the same concurrency group.
 - Replace generator-era Cargo package metadata with the DiskSage product description, MIT license expression, canonical source repository URL, and `publish = false` registry-publication boundary; deliberately omit Cargo's deprecated `authors` field, verify publication refusal through Cargo's versioned parsed metadata rather than substring matching, and regression-test commented/out-of-table decoys together with the retained acquisition metadata and doctoring evidence.
@@ -52,6 +65,9 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 
 ### Fixed
 
+- Consume the persisted iCloud `admission_blocked_since_ms` diagnostic in the UI stall clock, so a
+  system or application restart preserves the visible duration of an unchanged provider block;
+  durable evidence remains advisory and fail-closed.
 - Reject ontology organize destinations that are relative to the process working directory,
   named-user tilde paths, or parent-traversal paths; only an absolute destination or a home token
   (`~`/`~/`, plus native Windows `~\`) can produce a move plan, and literal tildes in absolute
@@ -64,6 +80,13 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 - Keep the shipped Naruon readiness verifier source includable by its integration boundary test;
   the terminal parser contract now compiles in both the binary and test-module contexts.
 
+- Bound numeric File Provider disk-full markers for `errno`, `odresult_errno`, and
+  `OSStatus -34`, so longer codes such as `errno 280` cannot be misclassified as
+  local-disk-full evidence.
+
+- Include `icloud-file-provider-indexing-pending` in the Naruon iCloud admission-blocker binding,
+  so a signed non-iCloud envelope cannot smuggle that provider blocker through validation.
+
 - Cover the `sensitive-config` archive-kind wire label in the generated cloud-plan implementation,
   so the macOS/Linux/Windows cloud-plan binaries compile after the sensitive-config safety
   boundary is enabled.