Address the Copilot review on the CoreAudio sink

Stop the render callback before counting the ring tail: a callback draining
between the count and close_unit_()'s own stop reported those frames as played
on top of the outage gap they had just been charged to. Up to one device buffer
per recovery, on every default move and every reopen.

Warn when the liveness listener will not register -- nothing else sets
device_lost_, so a death would go unnoticed and recovery would never run.

Item 27's heading still said the hardware pass was owed, three rounds after it
was done, and the DAC-time comment had grown into the rationale essay AGENTS.md
forbids; the reasoning is in the roadmap where it belongs.

Author: chrisuthe

docs/ROADMAP.md

@@ -2493,7 +2493,7 @@ hand-entered address is neither, so it went.
 - **`SENDSPIN_SERVER_URL` is answered only for the server_id the dial chose.** `LastDial` has
   no "literal URL, taken at its word" case left; a dial with no id answers nothing.
 
-### 27. Native CoreAudio backend — *shipped (hardware pass still owed)*
+### 27. Native CoreAudio backend — *shipped*
 
 The shipped macOS binary aborted at launch on any Mac without Homebrew's PortAudio:
 

src/coreaudio_sink.cpp

@@ -862,10 +862,8 @@ bool CoreAudioSink::open_unit_(AudioDeviceID device, uint32_t sample_rate, uint8
         this->stream_rate_ = actual.mSampleRate;
     }
 
-    // The render timestamp is when the hardware consumes the buffer, not when it reaches the
-    // speaker, so the presentation latency goes on top -- unlike PortAudio's outputBufferDacTime.
-    // Not the safety offset: that is the margin the HAL schedules ahead by, so it is already in
-    // how far in the future the timestamp sits, and adding it would count it twice.
+    // Presentation latency goes on top of the render timestamp; the safety offset must not, since
+    // the HAL has already scheduled the buffer that far ahead.
     const double device_rate = nominal_sample_rate(device);
     double latency_s = 0.0;
     if (device_rate > 0.0) {
@@ -1013,6 +1011,12 @@ bool CoreAudioSink::reopen_in_place_() {
 }
 
 void CoreAudioSink::discard_ring_tail_() {
+    // Stopped first: a callback draining between the count and close_unit_()'s own stop would
+    // report those frames as played on top of the gap they are counted into here.
+    if (this->callback_running_()) {
+        AudioOutputUnitStop(this->unit_);
+        this->running_ = false;
+    }
     if (this->bytes_per_frame_ == 0) {
         return;  // no unit, so close_unit_() has already emptied the ring
     }
@@ -1060,6 +1064,13 @@ void CoreAudioSink::add_listeners_(AudioDeviceID device) {
         noErr) {
         this->listening_alive_ = true;
         this->listening_device_ = device;
+    } else {
+        // Nothing else sets device_lost_, so without this a death is never noticed and recovery
+        // never runs. Still worth playing through; the user just has to restart the stream.
+        cli_log(LogLevel::WARN,
+                "coreaudio: '%s' will not report its own death -- playback will not recover by "
+                "itself if it goes away",
+                device_name(device).c_str());
     }
 
     if (this->device_.empty()) {

src/coreaudio_sink.h

@@ -89,9 +89,10 @@ class CoreAudioSink final : public AudioSink {
     /// Reopens on the system default's new device, for a bare -o coreaudio. Not a recovery: a
     /// move is an ordinary event, so it must not spend the budget an outage needs.
     void follow_default_();
-    /// Adds the frames still in the ring to the outage gap: the player has counted them, and the
-    /// lost unit recovery is about to close will never report them. Only for those closes --
-    /// stop(), configure() and clear() end the stream the gap belonged to. Caller holds mutex_.
+    /// Stops the callback, then adds the frames still in the ring to the outage gap: the player
+    /// has counted them, and the lost unit recovery is about to close will never report them.
+    /// Only for those closes -- stop(), configure() and clear() end the stream the gap belonged
+    /// to. Caller holds mutex_.
     void discard_ring_tail_();
     /// True while the render callback is still being driven. Caller holds mutex_.
     /// Liveness only: a lost device does not stop the callback, so this stays true until the
@@ -106,8 +107,8 @@ class CoreAudioSink final : public AudioSink {
 
     /// Starts listening for the open device's death, and for default-output moves when following
     /// the default. Caller holds mutex_; listeners are removed by close_unit_().
-    /// Removal does not wait an in-flight listener out, unlike PortAudio's stream close, so a
-    /// notification can still land on the atomics just after the sink is destroyed.
+    /// Removal does not wait an in-flight notification out, which is why stop() drops the
+    /// listeners long before the destructor runs.
     void add_listeners_(AudioDeviceID device);
     void remove_listeners_();