Split the CoreAudio sink's liveness test from its feed test

A lost device does not stop the render callback -- the HAL keeps pulling until
the unit does. So clear() asking unit_alive_() took the ring_.drop() branch
while the callback was inside read(), writing both positions from the producer
side and leaving the next read a whole ring of stale audio to play.

clear() now asks callback_running_(), which is liveness alone. configure() and
write() keep unit_alive_(), which is the question they actually have.

Author: chrisuthe

src/coreaudio_sink.cpp

@@ -638,8 +638,9 @@ void CoreAudioSink::clear() {
 
     // Do not snap current_multiplier_: the callback keeps running through a flush.
 
-    if (this->unit_alive_()) {
-        // The consumer owns read_pos_, so it drains on its next read.
+    if (this->callback_running_()) {
+        // The consumer owns read_pos_, so it drains on its next read. Liveness, not unit_alive_():
+        // a lost device keeps being pulled, and drop() from this side would race that read.
         this->ring_.request_clear();
         return;
     }
@@ -1009,8 +1010,12 @@ void CoreAudioSink::discard_ring_tail_() {
         static_cast<uint32_t>(this->ring_.available() / this->bytes_per_frame_));
 }
 
+bool CoreAudioSink::callback_running_() const {
+    return this->unit_ != nullptr && this->running_;
+}
+
 bool CoreAudioSink::unit_alive_() const {
-    return this->unit_ != nullptr && this->running_ && !this->device_lost_.load();
+    return this->callback_running_() && !this->device_lost_.load();
 }
 
 size_t CoreAudioSink::ring_capacity_(double device_latency_s) const {

src/coreaudio_sink.h

@@ -93,14 +93,21 @@ class CoreAudioSink final : public AudioSink {
     /// lost unit recovery is about to close will never report them. Only for those closes --
     /// stop(), configure() and clear() end the stream the gap belonged to. Caller holds mutex_.
     void discard_ring_tail_();
-    /// True while the open unit is still being driven by CoreAudio. Caller holds mutex_.
+    /// True while the render callback is still being driven. Caller holds mutex_.
+    /// Liveness only: a lost device does not stop the callback, so this stays true until the
+    /// unit does. Anything touching the ring's consumer side must ask this, not unit_alive_().
+    bool callback_running_() const;
+    /// True while the open unit is still worth feeding: running, on a device that has not died.
+    /// Caller holds mutex_.
     bool unit_alive_() const;
     /// Ring size in bytes. Caller holds mutex_ and the format fields are set.
     size_t ring_capacity_(double device_latency_s) const;
     void update_target_multiplier_();
 
     /// Starts listening for the open device's death, and for default-output moves when following
     /// the default. Caller holds mutex_; listeners are removed by close_unit_().
+    /// Removal does not wait an in-flight listener out, unlike PortAudio's stream close, so a
+    /// notification can still land on the atomics just after the sink is destroyed.
     void add_listeners_(AudioDeviceID device);
     void remove_listeners_();