fix(desktop): macOS bug audit cycle 3 follow-up — Bee audio, conversation cache, installer atomicity, floating bar, WAL sync

[eulicesl]

macOS bug audit — cycle 3 follow-up (deferred low-severity set)

Follow-up to the merged cycle-3 audit (#10035). Cycle 3 fixed the high-severity crash/data-loss/leak/security findings and consciously deferred a set of lower-severity items. This PR completes the deferred findings that have a clean, hermetically-testable seam — each re-verified against current main before fixing.

Fixes

1. Bee audio frame drift (C6) — processAudioPacket popped only the first ADTS frame per BLE notification; a notification completing two frames emitted the second one notification late (~64ms/frame, cumulative) and discarded surplus complete frames on stop. Now drains every complete frame per notification. Regression test feeds a two-frame packet and asserts both drain in order.

2. Conversation optimistic-edit revert (C24) — the cache-first load() published bare cached rows without overlaying pending optimistic mutations, so a filter change mid-mutation visually reverted an in-flight star/title/folder edit. Cache emit now overlays pendingMutations (mirrors the server merge path). Hermetic test suspends a star mutation and asserts the cache reload keeps it.

3. Non-atomic app install (C14) — the DMG install did removeItem then copyItem; a copy failure after the remove destroyed the user's working /Applications/Omi.app. replaceInstalledApp now stages then replaceItemAt-swaps, leaving the existing install untouched on failure. Real-FileManager temp-dir tests assert survival on copy failure + successful swap.

4. Floating-bar pill drift (C10) — savePreChatCenterIfNeeded snapped the draggable pill's restore origin (computed for the glow-inflated window) using the bare pill size, drifting the recorded center ~22pt left / 18pt down per rapid re-open cycle. Now stores + snaps the full restore frame; restore-origin math routes through pure FloatingControlBarGeometry helpers with a round-trip identity test.

5. WAL sync stuck on auth failure (C1) — fetchSyncJobStatus swallowed an auth-header failure with try? (sending an unauthenticated GET) and mapped 401 → .transient, parking the WAL in a forever-retry. Now returns a distinct .unauthorized (pure forStatusCode mapping) without an unauthenticated request; the reconciler reverts to .miss for re-upload via the authenticated path (poll stays session-preserving, INV-AUTH-1).

6. Unbounded WAL retention (C19) — cleanupOldWals was dead code, so synced audio + metadata grew without bound. Now invoked at the end of each syncToCloud, selecting reclaimable entries via a pure WALCloudSyncLogic.cleanupCandidates (synced-only, past the 7-day window) using the injected clock.

Verification

• Hermetic regression tests added for every fix (behavioral where a production seam exists; pure-function tests for the mapping/geometry/retention predicates).
• Swift compiles/tests only in CI (no Swift toolchain in this sandbox). Local static gates green: check_desktop_test_quality.py, line-count ratchet (FloatingControlBarWindow baseline raised with justification), e2e flow-coverage (AppInstaller added to desktop-update-relaunch covers).

Product invariants affected

• INV-AUTH-1
• INV-CHAT-1

C1 names INV-AUTH-1 because the WAL status poll is a background, session-preserving request: on an auth failure it throws .unauthorized and reverts the WAL for re-upload through the authenticated path — it does not invalidate the Firebase session (that ownership stays with AuthSessionCoordinator). No session-death path changes.

INV-CHAT-1 is named because the C10 pill-drift fix touches FloatingControlBarWindow.swift / FloatingControlBarGeometry.swift (path globs). The change is presentation geometry only — it stores and snaps the full restore frame instead of pairing an inflated origin with the bare pill size. It does not touch any chat write-path surface: no ChatProvider, kernel journal/projection, floating viewport cursor, turn identity, or pill projection code changes. The floating bar's chat continuity contract is unaffected — only where the collapsed pill window comes to rest on screen.

Failure class (fixes)

Failure-Class: none

Independent instance fixes across unrelated subsystems (Bluetooth audio, conversations cache, installer, floating bar, WAL sync); none recurs against a registered failure class.

Deferred (not in this PR)

• C27 BYOK keys → Keychain migration: security-sensitive migration, unverifiable without a macOS Keychain here; needs a dedicated PR + on-device proof + sign-off.
• C8 notch cursor-follow: the pure decision seam is testable, but the state-desync side effect has a residual on-device gap (verified by investigation); needs a notched Mac.
• C5 dormant AudioSourceManager: unreachable dead code; the correct resolution is delete + relocate the still-live AudioSource enum across many files, which needs a local Swift compile.
• S1 voice-turn watchdog: INV-VOICE-1 reducer logic; needs the macOS live continuity/voice gauntlet.

🤖 Generated with Claude Code

---

Generated by Claude Code

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.