fix(desktop): macOS bug audit cycle 3 follow-up — Bee audio, conversation cache, installer atomicity, floating bar, WAL sync (#10047)

## macOS bug audit — cycle 3 follow-up (deferred low-severity set)

Follow-up to the merged cycle-3 audit (#10035). Cycle 3 fixed the
high-severity crash/data-loss/leak/security findings and consciously
deferred a set of lower-severity items. This PR completes the deferred
findings that have a clean, hermetically-testable seam — each
re-verified against current `main` before fixing.

### Fixes

1. **Bee audio frame drift (C6)** — `processAudioPacket` popped only the
first ADTS frame per BLE notification; a notification completing two
frames emitted the second one notification late (~64ms/frame,
cumulative) and discarded surplus complete frames on stop. Now drains
every complete frame per notification. Regression test feeds a two-frame
packet and asserts both drain in order.

2. **Conversation optimistic-edit revert (C24)** — the cache-first
`load()` published bare cached rows without overlaying pending
optimistic mutations, so a filter change mid-mutation visually reverted
an in-flight star/title/folder edit. Cache emit now overlays
`pendingMutations` (mirrors the server merge path). Hermetic test
suspends a star mutation and asserts the cache reload keeps it.

3. **Non-atomic app install (C14)** — the DMG install did `removeItem`
then `copyItem`; a copy failure after the remove destroyed the user's
working `/Applications/Omi.app`. `replaceInstalledApp` now stages then
`replaceItemAt`-swaps, leaving the existing install untouched on
failure. Real-FileManager temp-dir tests assert survival on copy failure
+ successful swap.

4. **Floating-bar pill drift (C10)** — `savePreChatCenterIfNeeded`
snapped the draggable pill's restore origin (computed for the
glow-inflated window) using the bare pill size, drifting the recorded
center ~22pt left / 18pt down per rapid re-open cycle. Now stores +
snaps the full restore frame; restore-origin math routes through pure
`FloatingControlBarGeometry` helpers with a round-trip identity test.

5. **WAL sync stuck on auth failure (C1)** — `fetchSyncJobStatus`
swallowed an auth-header failure with `try?` (sending an unauthenticated
GET) and mapped 401 → `.transient`, parking the WAL in a forever-retry.
Now returns a distinct `.unauthorized` (pure `forStatusCode` mapping)
without an unauthenticated request; the reconciler reverts to `.miss`
for re-upload via the authenticated path (poll stays session-preserving,
INV-AUTH-1).

6. **Unbounded WAL retention (C19)** — `cleanupOldWals` was dead code,
so synced audio + metadata grew without bound. Now invoked at the end of
each `syncToCloud`, selecting reclaimable entries via a pure
`WALCloudSyncLogic.cleanupCandidates` (synced-only, past the 7-day
window) using the injected clock.

### Verification

- Hermetic regression tests added for every fix (behavioral where a
production seam exists; pure-function tests for the
mapping/geometry/retention predicates).
- Swift compiles/tests only in CI (no Swift toolchain in this sandbox).
Local static gates green: `check_desktop_test_quality.py`, line-count
ratchet (FloatingControlBarWindow baseline raised with justification),
e2e flow-coverage (AppInstaller added to `desktop-update-relaunch`
covers).

### Product invariants affected

- INV-AUTH-1
- INV-CHAT-1

C1 names INV-AUTH-1 because the WAL status poll is a background,
session-preserving request: on an auth failure it throws `.unauthorized`
and reverts the WAL for re-upload through the authenticated path — it
does not invalidate the Firebase session (that ownership stays with
`AuthSessionCoordinator`). No session-death path changes.

INV-CHAT-1 is named because the C10 pill-drift fix touches
`FloatingControlBarWindow.swift` / `FloatingControlBarGeometry.swift`
(path globs). The change is presentation geometry only — it stores and
snaps the full restore *frame* instead of pairing an inflated origin
with the bare pill size. It does not touch any chat write-path surface:
no `ChatProvider`, kernel journal/projection, floating viewport cursor,
turn identity, or pill projection code changes. The floating bar's chat
continuity contract is unaffected — only where the collapsed pill window
comes to rest on screen.

### Failure class (fixes)

Failure-Class: none

Independent instance fixes across unrelated subsystems (Bluetooth audio,
conversations cache, installer, floating bar, WAL sync); none recurs
against a registered failure class.

### Deferred (not in this PR)

- **C27** BYOK keys → Keychain migration: security-sensitive migration,
unverifiable without a macOS Keychain here; needs a dedicated PR +
on-device proof + sign-off.
- **C8** notch cursor-follow: the pure decision seam is testable, but
the state-desync side effect has a residual on-device gap (verified by
investigation); needs a notched Mac.
- **C5** dormant `AudioSourceManager`: unreachable dead code; the
correct resolution is delete + relocate the still-live `AudioSource`
enum across many files, which needs a local Swift compile.
- **S1** voice-turn watchdog: INV-VOICE-1 reducer logic; needs the macOS
live continuity/voice gauntlet.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---
_Generated by [Claude
Code](https://claude.ai/code/session_01RAxLsaxtwVNDTWAZFfJp9q)_

<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/BasedHardware/omi/pull/10047?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->

Author: eulicesl

.github/scripts/product_file_line_count_ratchet_baseline/desktop-swift-floatingcontrolbar.json

@@ -2,14 +2,14 @@
   "files": {
     "desktop/macos/Desktop/Sources/FloatingControlBar/AgentPill.swift": 2375,
     "desktop/macos/Desktop/Sources/FloatingControlBar/FloatingControlBarView.swift": 2832,
-    "desktop/macos/Desktop/Sources/FloatingControlBar/FloatingControlBarWindow.swift": 4797,
+    "desktop/macos/Desktop/Sources/FloatingControlBar/FloatingControlBarWindow.swift": 4806,
     "desktop/macos/Desktop/Sources/FloatingControlBar/PushToTalkManager.swift": 2423,
     "desktop/macos/Desktop/Sources/FloatingControlBar/RealtimeHubSession.swift": 1621
   },
   "raise_justifications": {
     "desktop/macos/Desktop/Sources/FloatingControlBar/AgentPill.swift": "Agent completion presentation now follows the canonical terminal lifecycle used by PTT and chat.",
     "desktop/macos/Desktop/Sources/FloatingControlBar/FloatingControlBarView.swift": "Notch hover and voice presentation now share a private surface-state boundary; extracting it would broaden view-local ownership.",
-    "desktop/macos/Desktop/Sources/FloatingControlBar/FloatingControlBarWindow.swift": "Strict concurrency annotations (Ticket 14) add Sendable conformances and isolation qualifiers without changing runtime behavior.",
+    "desktop/macos/Desktop/Sources/FloatingControlBar/FloatingControlBarWindow.swift": "savePreChatCenterIfNeeded now snaps to the full stored restore frame (origin + glow-inflated size) instead of pairing the inflated-origin with the bare pill size, so the draggable pill no longer drifts ~22pt left / 18pt down per rapid re-open cycle.",
     "desktop/macos/Desktop/Sources/FloatingControlBar/PushToTalkManager.swift": "Strict concurrency annotations (Ticket 14) add Sendable conformances and isolation qualifiers without changing runtime behavior.",
     "desktop/macos/Desktop/Sources/FloatingControlBar/RealtimeHubSession.swift": "Strict concurrency annotations (Ticket 14) add Sendable conformances and isolation qualifiers without changing runtime behavior."
   },

desktop/macos/Desktop/Sources/Bluetooth/Connections/BeeDeviceConnection.swift

@@ -105,7 +105,7 @@ final class BeeDeviceConnection: BaseDeviceConnection {
     audioSubscription = Task { [weak self] in
       do {
         for try await data in stream {
-          if let frame = self?.processAudioPacket(Array(data)) {
+          for frame in self?.processAudioPacket(Array(data)) ?? [] {
             self?.audioStreamController.yield(Data(frame))
           }
         }
@@ -148,12 +148,24 @@ final class BeeDeviceConnection: BaseDeviceConnection {
 
   // MARK: - Audio Processing
 
-  /// Process AAC audio packet with ADTS framing
-  func processAudioPacket(_ data: [UInt8]) -> [UInt8]? {
-    guard data.count >= 2 else { return nil }
+  /// Process AAC audio packet with ADTS framing.
+  ///
+  /// Drains **every** complete ADTS frame the notification completed, not just
+  /// the first. A single notification can carry (or complete, after resync)
+  /// more than one frame; returning only the first left the rest buffered until
+  /// the next notification arrived — shifting all subsequent audio ~64ms/frame
+  /// late and discarding any surplus complete frames on stop. A genuinely
+  /// partial trailing frame still stays buffered (nextADTSFrame returns nil),
+  /// so it is completed by the next notification as before.
+  func processAudioPacket(_ data: [UInt8]) -> [[UInt8]] {
+    guard data.count >= 2 else { return [] }
 
     audioBuffer.append(contentsOf: data.dropFirst(2))
-    return Self.nextADTSFrame(from: &audioBuffer)
+    var frames: [[UInt8]] = []
+    while let frame = Self.nextADTSFrame(from: &audioBuffer) {
+      frames.append(frame)
+    }
+    return frames
   }
 
   /// Pop the next complete ADTS/AAC frame from `buffer`, skipping leading

desktop/macos/Desktop/Sources/FloatingControlBar/FloatingControlBarGeometry.swift

@@ -26,6 +26,20 @@ enum FloatingControlBarGeometry {
     case preservingCurrentCenter
   }
 
+  /// Bottom-left origin that centers a window of `size` on `center`.
+  static func restoreOrigin(center: NSPoint, size: NSSize) -> NSPoint {
+    NSPoint(x: center.x - size.width / 2, y: center.y - size.height / 2)
+  }
+
+  /// The center a window ends up reporting (`frame.midX/midY`) after it is
+  /// snapped to `origin` with `size`. Round-trips with `restoreOrigin` ONLY when
+  /// the same `size` is used for both: computing the origin with a glow-inflated
+  /// size but snapping with the bare pill size shifts the recorded center by half
+  /// the size difference — the pill-drift bug.
+  static func recordedCenter(afterSnapOrigin origin: NSPoint, size: NSSize) -> NSPoint {
+    NSPoint(x: origin.x + size.width / 2, y: origin.y + size.height / 2)
+  }
+
   static func centerAnchoredFrame(currentFrame: NSRect, targetSize: NSSize) -> NSRect {
     NSRect(
       x: currentFrame.midX - targetSize.width / 2,

desktop/macos/Desktop/Sources/FloatingControlBar/FloatingControlBarWindow.swift

@@ -202,7 +202,11 @@ class FloatingControlBarWindow: NSPanel, NSWindowDelegate {
   /// closeAIConversation() and cleared when the animation settles.
   /// Used by savePreChatCenterIfNeeded() to snap to the correct pill position
   /// if a new PTT query fires while the restore animation is still running.
-  private var pendingRestoreOrigin: NSPoint?
+  // Stores the FULL pending restore frame (origin AND size), not just the origin.
+  // The restore origin is computed for the glow-inflated window size; snapping to
+  // it with the bare collapsed size instead drifted the recorded center by one
+  // glow outset (~22pt left / 18pt down) on every rapid re-open cycle.
+  private var pendingRestoreFrame: NSRect?
   /// The idle pill frame captured just before morphing into the active island
   /// on a non-notch display, so the pill returns to the exact same spot.
   private var savedPillFrame: NSRect?
@@ -1301,9 +1305,10 @@ class FloatingControlBarWindow: NSPanel, NSWindowDelegate {
     if !ShortcutSettings.shared.draggableBarEnabled || notchModeEnabled {
       restoreOrigin = defaultTopCenteredFrame(for: size).origin
     } else if let center = preChatCenter {
-      restoreOrigin = NSPoint(x: center.x - size.width / 2, y: center.y - size.height / 2)
+      restoreOrigin = FloatingControlBarGeometry.restoreOrigin(center: center, size: size)
     } else {
-      restoreOrigin = NSPoint(x: frame.midX - size.width / 2, y: frame.midY - size.height / 2)
+      restoreOrigin = FloatingControlBarGeometry.restoreOrigin(
+        center: NSPoint(x: frame.midX, y: frame.midY), size: size)
     }
 
     resizeWorkItem?.cancel()
@@ -1312,15 +1317,15 @@ class FloatingControlBarWindow: NSPanel, NSWindowDelegate {
     isResizingProgrammatically = true
     // Record the animation target so savePreChatCenterIfNeeded() can snap to it
     // if a new PTT query fires while this restore animation is still running.
-    pendingRestoreOrigin = restoreOrigin
-    animateFrame(to: NSRect(origin: restoreOrigin, size: size), duration: Self.askOmiAnimationDuration)
     let targetFrame = NSRect(origin: restoreOrigin, size: size)
+    pendingRestoreFrame = targetFrame
+    animateFrame(to: targetFrame, duration: Self.askOmiAnimationDuration)
     preChatCenter = nil
     DispatchQueue.main.asyncAfter(deadline: .now() + Self.askOmiSettleDelay) { [weak self] in
       guard let self = self else { return }
       guard self.resignKeyAnimationToken == closeAnimationToken else { return }
       self.isResizingProgrammatically = false
-      self.pendingRestoreOrigin = nil
+      self.pendingRestoreFrame = nil
       // Safety net: only snap if no new AI session was opened while the close settled.
       // Without this guard, a rapid PTT query that fires while close settles gets collapsed
       // back to the pill position by this stale completion block.
@@ -2160,7 +2165,7 @@ class FloatingControlBarWindow: NSPanel, NSWindowDelegate {
     )
     return !state.showingAIConversation
       && !suppressHoverResize
-      && pendingRestoreOrigin == nil
+      && pendingRestoreFrame == nil
       && NSEqualSizes(frame.size, settledSize)
   }
 
@@ -4738,7 +4743,7 @@ extension FloatingControlBarWindow {
 
   /// Save the current center point so closeAIConversation can restore position.
   /// Only saves if preChatCenter is not already set (avoids overwriting during follow-ups).
-  /// If a close/restore animation is in flight (pendingRestoreOrigin is set), snaps the
+  /// If a close/restore animation is in flight (pendingRestoreFrame is set), snaps the
   /// window to that target first so the saved center reflects the true pill position,
   /// not an intermediate animation frame.
   /// In non-draggable mode, always snaps to the fixed default position so the saved
@@ -4763,14 +4768,18 @@ extension FloatingControlBarWindow {
       isResizingProgrammatically = true
       setFrame(snapFrame, display: true, animate: false)
       isResizingProgrammatically = false
-      pendingRestoreOrigin = nil
-    } else if let restoreOrigin = pendingRestoreOrigin {
-      // Draggable: if a restore animation is running, snap to its target immediately
-      // so we record the correct pill position rather than a mid-animation frame.
+      pendingRestoreFrame = nil
+    } else if let restoreFrame = pendingRestoreFrame {
+      // Draggable: if a restore animation is running, snap to its target frame
+      // immediately so we record the correct pill center rather than a
+      // mid-animation frame. Snap to the STORED frame (origin + the glow-inflated
+      // size the origin was computed for) — reconstructing it with the bare
+      // collapsedBarSize is exactly what drifted preChatCenter one glow outset
+      // per cycle.
       isResizingProgrammatically = true
-      setFrame(NSRect(origin: restoreOrigin, size: size), display: true, animate: false)
+      setFrame(restoreFrame, display: true, animate: false)
       isResizingProgrammatically = false
-      pendingRestoreOrigin = nil
+      pendingRestoreFrame = nil
     }
     if !notchModeEnabled, state.isNotchHoverMenuVisible {
       // Chat is opening from the taller pill agent list. The pill's true
@@ -4789,7 +4798,7 @@ extension FloatingControlBarWindow {
     resignKeyAnimationToken += 1
     frameAnimationToken += 1
     if !ShortcutSettings.shared.draggableBarEnabled {
-      pendingRestoreOrigin = nil
+      pendingRestoreFrame = nil
     }
     suppressHoverResize = false
     isResizingProgrammatically = false

desktop/macos/Desktop/Sources/MainWindow/Conversations/ConversationRepository.swift

@@ -311,7 +311,14 @@ final class ConversationRepository {
         if !cached.isEmpty {
           let cachedCount = try? await local.count(query: query)
           guard generation == requestGeneration else { return }
-          conversations = cached
+          // Overlay in-flight optimistic mutations before publishing, mirroring
+          // the server merge path (mergeList → apply). Without this, a load()
+          // that races a pending star/title/folder edit (e.g. the user toggles a
+          // filter mid-mutation) paints the bare cached rows and visually reverts
+          // the edit until the remote call lands.
+          conversations = cached.map {
+            ConversationReconciliationPolicy.apply(mutation: pendingMutations[$0.id], to: $0)
+          }
           count = cachedCount
           emit(.cache)
         }

desktop/macos/Desktop/Sources/Services/APIClient/APIClient+Messages.swift

@@ -126,35 +126,40 @@ extension APIClient {
     }
     var request = URLRequest(url: url)
     request.httpMethod = "GET"
-    request.allHTTPHeaderFields = try? await buildHeaders(requireAuth: true)
+
+    // Build the auth header explicitly. If token minting throws (e.g. an account
+    // transition races the reconciler, or the Keychain is locked right after
+    // login), do NOT fall through and send an UNAUTHENTICATED GET — that returns
+    // 401, was misread as `.transient`, and parked the WAL in a forever-retry.
+    // Surface `.unauthorized` so the reconciler reverts the WAL for re-upload via
+    // the authenticated upload path, which owns the forced refresh. Per
+    // INV-AUTH-1 the background poll is session-preserving: it never invalidates
+    // the Firebase session itself.
+    do {
+      request.allHTTPHeaderFields = try await buildHeaders(requireAuth: true)
+    } catch {
+      return SyncJobFetch(outcome: .unauthorized)
+    }
 
     guard let (data, response) = try? await session.data(for: request),
       let http = response as? HTTPURLResponse
     else {
       return SyncJobFetch(outcome: .transient)
     }
 
-    if http.statusCode == 404 {
-      return SyncJobFetch(outcome: .notFound)
-    }
-    // 403 means the caller is not permitted to access this sync job. Unlike a
-    // transient transport failure, re-polling will not resolve it — the upload
-    // path already refreshed auth on 401, so a 403 here is a durable permission
-    // failure. Surface it as `.forbidden` so the reconciler reverts the WAL to
-    // `.miss` for re-upload (the backend dedupes by conversation/timestamp)
-    // instead of polling forever.
-    if http.statusCode == 403 {
-      return SyncJobFetch(outcome: .forbidden)
-    }
-    guard http.statusCode == 200 else {
-      return SyncJobFetch(outcome: .transient)
-    }
-
-    do {
-      let status = try decoder.decode(SyncJobStatusResponse.self, from: data)
-      return SyncJobFetch(outcome: .ok, status: status)
-    } catch {
-      return SyncJobFetch(outcome: .transient)
+    // 401/403/404 are durable for this fetch: re-polling won't resolve them, so
+    // the reconciler reverts the WAL to `.miss` for re-upload (the backend
+    // dedupes by conversation/timestamp) instead of polling forever.
+    switch SyncJobFetchOutcome.forStatusCode(http.statusCode) {
+    case .ok:
+      do {
+        let status = try decoder.decode(SyncJobStatusResponse.self, from: data)
+        return SyncJobFetch(outcome: .ok, status: status)
+      } catch {
+        return SyncJobFetch(outcome: .transient)
+      }
+    case let outcome:
+      return SyncJobFetch(outcome: outcome)
     }
   }
 
@@ -331,7 +336,22 @@ enum SyncJobFetchOutcome: Equatable {
   case ok
   case notFound
   case forbidden
+  case unauthorized
   case transient
+
+  /// Pure HTTP-status → outcome mapping for a sync-job status GET. `.ok` means
+  /// the 200 body still must be decoded by the caller (a decode failure is
+  /// `.transient`); every other case is terminal for this fetch. Extracted so
+  /// the mapping is unit-testable without a URLSession.
+  static func forStatusCode(_ statusCode: Int) -> SyncJobFetchOutcome {
+    switch statusCode {
+    case 200: return .ok
+    case 401: return .unauthorized
+    case 403: return .forbidden
+    case 404: return .notFound
+    default: return .transient
+    }
+  }
 }
 
 struct SyncJobFetch: Equatable {

desktop/macos/Desktop/Sources/Startup/AppInstaller.swift

@@ -84,19 +84,12 @@ enum AppInstaller {
         removeQuarantine(at: destination)
         return relaunch(destination)
       }
-      do {
-        try fileManager.removeItem(at: destination)
-      } catch {
-        logError("AppInstaller: could not remove existing installed copy", error: error)
-        showManualInstallHint()
-        return false
-      }
     }
 
     do {
-      try fileManager.copyItem(at: bundleURL, to: destination)
+      try replaceInstalledApp(source: bundleURL, destination: destination, fileManager: fileManager)
     } catch {
-      logError("AppInstaller: copy to /Applications failed", error: error)
+      logError("AppInstaller: install to /Applications failed (existing copy preserved)", error: error)
       showManualInstallHint()
       return false
     }
@@ -110,6 +103,36 @@ enum AppInstaller {
     return relaunch(destination)
   }
 
+  /// Atomically install `source` at `destination`, replacing any existing bundle.
+  ///
+  /// The old code did `removeItem(destination)` then `copyItem(source →
+  /// destination)`: a copy failure after the remove (e.g. ENOSPC copying off a
+  /// nearly-full DMG) destroyed the user's working `/Applications` copy. Here the
+  /// fresh bundle is copied to a staging path FIRST and only swapped in via
+  /// `replaceItemAt` after the copy succeeds, so the existing install survives any
+  /// copy failure untouched. Staging lives beside `destination` (same volume) so
+  /// the swap is a rename, not a second cross-volume copy.
+  static func replaceInstalledApp(
+    source: URL,
+    destination: URL,
+    fileManager: FileManager = .default
+  ) throws {
+    let staging = destination.deletingLastPathComponent()
+      .appendingPathComponent(".\(destination.lastPathComponent).staging-\(getpid())")
+    do {
+      try? fileManager.removeItem(at: staging)  // clear any stale staging from a prior crash
+      try fileManager.copyItem(at: source, to: staging)
+      if fileManager.fileExists(atPath: destination.path) {
+        _ = try fileManager.replaceItemAt(destination, withItemAt: staging)
+      } else {
+        try fileManager.moveItem(at: staging, to: destination)
+      }
+    } catch {
+      try? fileManager.removeItem(at: staging)
+      throw error
+    }
+  }
+
   private static func build(atBundleURL url: URL) -> String? {
     Bundle(url: url)?.object(forInfoDictionaryKey: "CFBundleVersion") as? String
   }

desktop/macos/Desktop/Sources/WAL/WALCloudSyncLogic.swift

@@ -77,7 +77,11 @@ enum WALCloudSyncLogic {
     case .transient:
       return false
 
-    case .notFound, .forbidden:
+    case .notFound, .forbidden, .unauthorized:
+      // `.unauthorized` = the status poll could not be authenticated (token mint
+      // failed, or a stale 401). Revert to `.miss` like the other durable
+      // failures so the authenticated upload path re-uploads and refreshes auth;
+      // the poll itself must not invalidate the session (INV-AUTH-1).
       var changed = false
       for walId in memberWalIds {
         guard let index = wals.firstIndex(where: { $0.id == walId }) else { continue }
@@ -124,4 +128,13 @@ enum WALCloudSyncLogic {
       return changed
     }
   }
+
+  /// Synced WALs whose recording start predates the retention cutoff — safe to
+  /// delete. Gated on `.synced` (a confirmed backend ack; never `.miss`/
+  /// `.uploaded`/`.corrupted`, which still need upload) AND older than the
+  /// cutoff, so local audio is only reclaimed after the cloud has it and a
+  /// retention buffer has elapsed. Pure so the delete/keep boundary is testable.
+  static func cleanupCandidates(wals: [WALEntry], cutoffTimestamp: Int) -> [WALEntry] {
+    wals.filter { $0.status == .synced && $0.timerStart < cutoffTimestamp }
+  }
 }

desktop/macos/Desktop/Sources/WAL/WALService.swift

@@ -1085,6 +1085,11 @@ final class WALService: ObservableObject {
       saveWals()
     }
 
+    // Reclaim already-synced audio past the retention window. Runs every sync
+    // pass (not just launch) so the wals directory + metadata don't grow without
+    // bound — cleanupOldWals was previously never invoked.
+    cleanupOldWals()
+
     // If jobs are still in-flight (.uploaded) after the immediate reconcile,
     // schedule a follow-up poll so queued/processing jobs eventually resolve.
     // Without this, a 202 + still-queued GET leaves WALs stuck in .uploaded.
@@ -1171,12 +1176,14 @@ final class WALService: ObservableObject {
 
   // MARK: - Cleanup
 
-  /// Remove synced WALs older than specified days
+  /// Remove synced WALs older than `olderThanDays` and delete their on-disk audio.
+  /// Runs at the end of each `syncToCloud` pass; uses the injected clock so the
+  /// retention window is deterministic in tests.
   func cleanupOldWals(olderThanDays: Int = 7) {
-    let cutoff = Date().addingTimeInterval(-Double(olderThanDays * 24 * 60 * 60))
-    let cutoffTimestamp = Int(cutoff.timeIntervalSince1970)
+    let cutoffTimestamp = timestampProvider() - olderThanDays * 24 * 60 * 60
 
-    let toRemove = wals.filter { $0.status == .synced && $0.timerStart < cutoffTimestamp }
+    let toRemove = WALCloudSyncLogic.cleanupCandidates(wals: wals, cutoffTimestamp: cutoffTimestamp)
+    guard !toRemove.isEmpty else { return }
 
     for wal in toRemove {
       // Delete file