feat: checkpoint provider sync rechecks

CHANGELOG.md

@@ -11,6 +11,9 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 - Return a bounded, path-free keep-local receipt when a native provider probe times out or returns
   no output; separate shared APFS movement from completed action-attributable receipt totals, and
   keep customer guidance action-first while moving evidence codes into audit details.
+- Checkpoint third-party provider queue observations with a tamper-evident lineage counter and a
+  five-minute automatic recheck boundary while blocked; a clear global queue stops polling but
+  still requires a fresh item-specific sync and eviction check.
 
 - Keep coverage builds compile-safe by applying the same `not(coverage)` boundary to native-copy
   identity cleanup and dependent eviction helpers; the focused authority contract remains green.

docs/architecture/adr/0012-inconclusive-provider-and-reclaim-presentation.md

@@ -23,6 +23,11 @@ say what to do next, while stable reason codes and evidence kinds remain availab
   allocation bytes in unique, completed action receipts. Incomplete receipts cannot claim bytes.
 - Customer-facing status leads with the next action. Evidence kinds, reason codes, and other
   implementation diagnostics appear only under an explicitly opened audit-detail disclosure.
+- Automatic third-party provider rechecks persist a path-free, fingerprinted checkpoint. Blocked
+  or inconclusive observations become due after the already documented five-minute safety interval;
+  a monotonic observation counter and timestamp bind the next checkpoint. A clear global queue
+  stops automatic polling, but it is only permission to perform a fresh item-specific check and is
+  never local-eviction authority.
 
 ## Consequences
 
@@ -38,6 +43,10 @@ and customers can act without interpreting internal evidence terminology.
   admits concurrent writers and copy-on-write or snapshot effects.
 - Showing reason codes in the primary status was rejected because they do not tell a customer what
   safe action to take.
+- Polling a busy provider continuously was rejected because repeated full queue dumps add readers
+  during the condition being diagnosed. Treating a clear global queue as item readiness was rejected
+  because it does not prove upload, identity, content, conflict, active-use, or eviction capability
+  for any particular file.
 
 ## Evidence
 

src-tauri/src/commands.rs

@@ -1275,6 +1275,7 @@ pub fn inspect_icloud_new_copy_admission(
 #[tauri::command]
 pub fn inspect_cloud_provider_global_sync(
     cloud_root: String,
+    force: bool,
     app: AppHandle,
 ) -> Result<provider_global_sync::ProviderGlobalSyncReport, String> {
     let selected = selected_cloud_root(&app, &cloud_root)?;
@@ -1283,7 +1284,13 @@ pub fn inspect_cloud_provider_global_sync(
     if selected.provider == cloud::CloudProvider::Icloud {
         return Err("provider-global-sync-icloud-specialized".into());
     }
-    provider_global_sync::inspect_new_copy_admission(selected.provider)
+    let app_data_dir = app.path().app_data_dir().map_err(|error| error.to_string())?;
+    provider_global_sync::inspect_new_copy_admission_checkpointed(
+        selected.provider,
+        &app_data_dir,
+        cloud::system_now_ms(),
+        force,
+    )
 }
 
 #[cfg(not(coverage))]
@@ -1472,7 +1479,19 @@ fn cloud_plan_for_inputs(
         icloud_sync_health::attach_new_copy_admission_notice(&mut report.notices, health.as_ref());
         (health, None)
     } else {
-        let global_sync = provider_global_sync::inspect_new_copy_admission(selected.provider).ok();
+        let global_sync = app
+            .path()
+            .app_data_dir()
+            .ok()
+            .and_then(|app_data_dir| {
+                provider_global_sync::inspect_new_copy_admission_checkpointed(
+                    selected.provider,
+                    &app_data_dir,
+                    cloud::system_now_ms(),
+                    true,
+                )
+                .ok()
+            });
         provider_global_sync::attach_new_copy_admission_notice(
             &mut report.notices,
             global_sync.as_ref(),

src-tauri/src/naruon_cloud_copy_readiness.rs

@@ -1590,6 +1590,7 @@ mod tests {
         let blocked_sync = ProviderGlobalSyncReport {
             schema_version: provider_global_sync::PROVIDER_GLOBAL_SYNC_SCHEMA_VERSION,
             provider: CloudProvider::Onedrive,
+            observed_at_ms: 1,
             evidence_kind: "fileproviderctl-global-dump".into(),
             evidence_complete: true,
             state: ProviderGlobalSyncState::Pending,