fix(runtime): harden application service boundaries

macos/Runner/MpvPlayer/MpvPlayerCore.swift

@@ -9,7 +9,6 @@ class MpvPlayerCore: MpvPlayerCoreBase {
   private var playbackActivity: NSObjectProtocol?
   private var layerHiddenForOcclusion = false
   private var layerHiddenForScreenSleep = false
-  private var isDisposed = false
 
   /// True while any reason (occlusion, screen sleep) requires the layer hidden.
   private var hasLayerHideReason: Bool {
@@ -102,8 +101,7 @@ class MpvPlayerCore: MpvPlayerCoreBase {
     return true
   }
 
-  override func configurePlatformMpvOptions() {
-    guard let mpv else { return }
+  override func configurePlatformMpvOptions(mpv: OpaquePointer) {
     checkError(mpv_set_option_string(mpv, "ao", "avfoundation,coreaudio"))
   }
 
@@ -130,7 +128,7 @@ class MpvPlayerCore: MpvPlayerCoreBase {
     guard metalLayer != nil, !isPipActive else { return }
 
     if visible && isVisible && !shouldRestoreOnWindowVisible {
-      isBackgrounded = false
+      setBackgrounded(false)
       if metalLayer?.isHidden == true && !hasLayerHideReason {
         setMetalLayerHidden(false)
         redrawIfPausedAndVisible()
@@ -142,7 +140,7 @@ class MpvPlayerCore: MpvPlayerCoreBase {
 
     isVisible = visible
     shouldRestoreOnWindowVisible = !visible && restoreOnWindowVisible
-    isBackgrounded = !visible
+    setBackgrounded(!visible)
 
     if visible {
       shouldRestoreOnWindowVisible = false
@@ -212,9 +210,7 @@ class MpvPlayerCore: MpvPlayerCoreBase {
   }
 
   func dispose() {
-    if isDisposed { return }
-    isDisposed = true
-
+    guard beginDisposal() else { return }
     endPlaybackActivity()
     NotificationCenter.default.removeObserver(self)
     NSWorkspace.shared.notificationCenter.removeObserver(self)
@@ -241,14 +237,14 @@ class MpvPlayerCore: MpvPlayerCoreBase {
   }
 
   @objc private func windowOcclusionDidChange(_ notification: Notification) {
-    guard metalLayer != nil, mpv != nil, !isPipActive else { return }
+    guard metalLayer != nil, hasActiveMpv, !isPipActive else { return }
 
     let windowVisible = window?.occlusionState.contains(.visible) ?? true
     if !windowVisible && !layerHiddenForOcclusion {
       print("[MpvPlayerCore] Window occluded - hiding Metal layer")
       setMetalLayerHidden(true)
       layerHiddenForOcclusion = true
-      isBackgrounded = true
+      setBackgrounded(true)
       endPlaybackActivity()
     } else if windowVisible && layerHiddenForOcclusion {
       print("[MpvPlayerCore] Window visible - showing Metal layer")
@@ -261,7 +257,7 @@ class MpvPlayerCore: MpvPlayerCoreBase {
         }
         redrawIfPausedAndVisible()
       }
-      isBackgrounded = false
+      setBackgrounded(false)
       if !pausedState {
         beginPlaybackActivity()
       }
@@ -269,18 +265,18 @@ class MpvPlayerCore: MpvPlayerCoreBase {
   }
 
   @objc private func screensDidSleep(_ notification: Notification) {
-    guard metalLayer != nil, mpv != nil, !layerHiddenForScreenSleep else { return }
+    guard metalLayer != nil, hasActiveMpv, !layerHiddenForScreenSleep else { return }
     print("[MpvPlayerCore] Screens did sleep - hiding Metal layer")
     layerHiddenForScreenSleep = true
     // Hide even during PiP: nothing is visible while the displays are dark, and
     // the hidden layer is what gates libmpv presentation (MPVKit >= 1.0.10).
     setMetalLayerHidden(true)
-    isBackgrounded = true
+    setBackgrounded(true)
     endPlaybackActivity()
   }
 
   @objc private func screensDidWake(_ notification: Notification) {
-    guard metalLayer != nil, mpv != nil, layerHiddenForScreenSleep else { return }
+    guard metalLayer != nil, hasActiveMpv, layerHiddenForScreenSleep else { return }
     print("[MpvPlayerCore] Screens did wake - restoring Metal layer")
     layerHiddenForScreenSleep = false
 
@@ -288,14 +284,14 @@ class MpvPlayerCore: MpvPlayerCoreBase {
       // Layer is hosted by the PiP window; just unhide it there. Attach/frame
       // logic is owned by the PiP controller.
       setMetalLayerHidden(false)
-      isBackgrounded = false
+      setBackgrounded(false)
     } else if !layerHiddenForOcclusion {
       if shouldRestoreOnWindowVisible {
         restoreMetalLayerAfterOcclusion()
       } else {
         setMetalLayerHidden(!isVisible)
       }
-      isBackgrounded = !isVisible
+      setBackgrounded(!isVisible)
     }
     // else: window still occluded; windowOcclusionDidChange owns the restore.
 

macos/Runner/MpvPlayer/MpvPlayerPlugin.swift

@@ -350,7 +350,8 @@ extension MpvPlayerPlugin: MpvPipDelegate {
 
   func pipSetPlaying(_ playing: Bool) {
     guard let playerCore else { return }
-    playerCore.setPropertyAsync("pause", value: playing ? "no" : "yes") { [weak self] _ in
+    playerCore.setPropertyAsync("pause", value: playing ? "no" : "yes") { [weak self] propertyResult in
+      guard case .success = propertyResult else { return }
       self?.pipController?.setPlaying(playing)
       playerCore.setPaused(!playing)
     }

macos/RunnerTests/RunnerTests.swift

@@ -0,0 +1,206 @@
+import FlutterMacOS
+import XCTest
+
+@testable import Plezy
+
+final class ControllablePropertyCore: MpvPlayerCoreBase {
+  var nextResult: Result<Void, Error>?
+  private(set) var propertyCalls: [(String, String)] = []
+  private var pendingCompletion: ((Result<Void, Error>) -> Void)?
+
+  override func setPropertyAsync(
+    _ name: String,
+    value: String,
+    completion: @escaping (Result<Void, Error>) -> Void
+  ) {
+    propertyCalls.append((name, value))
+    if let nextResult {
+      self.nextResult = nil
+      completion(nextResult)
+    } else {
+      pendingCompletion = completion
+    }
+  }
+
+  func finish(_ result: Result<Void, Error>) {
+    let completion = pendingCompletion
+    pendingCompletion = nil
+    completion?(result)
+  }
+}
+
+final class RecordingMpvPlugin: MpvPluginShared {
+  var coreBase: MpvPlayerCoreBase?
+  var eventSink: FlutterEventSink?
+  var nameToId: [String: Int] = [:]
+  private(set) var pauseHookValues: [String] = []
+
+  init(core: MpvPlayerCoreBase?) {
+    coreBase = core
+  }
+
+  func setPlayerVisible(_ visible: Bool, restoreOnWindowVisible: Bool) {}
+  func updatePlayerFrame() {}
+
+  func didSetPauseProperty(value: String) {
+    pauseHookValues.append(value)
+  }
+}
+
+final class MpvPlayerContractTests: XCTestCase {
+  private let failure = NSError(
+    domain: "MpvPlayerContractTests",
+    code: 1,
+    userInfo: [NSLocalizedDescriptionKey: "controlled failure"]
+  )
+
+  func testSharedSetPropertyMapsSuccessFailureMissingCoreAndInvalidArguments() {
+    let core = ControllablePropertyCore()
+    let plugin = RecordingMpvPlugin(core: core)
+
+    core.nextResult = .success(())
+    let success = invokeSetProperty(plugin, name: "pause", value: "no")
+    XCTAssertEqual(success.count, 1)
+    XCTAssertNil(success[0])
+    XCTAssertEqual(plugin.pauseHookValues, ["no"])
+
+    core.nextResult = .failure(failure)
+    let rejected = invokeSetProperty(plugin, name: "pause", value: "yes")
+    XCTAssertEqual(rejected.count, 1)
+    XCTAssertEqual((rejected[0] as? FlutterError)?.code, "SET_PROPERTY_FAILED")
+    XCTAssertEqual(plugin.pauseHookValues, ["no"])
+
+    plugin.coreBase = nil
+    let missing = invokeSetProperty(plugin, name: "volume", value: "50")
+    XCTAssertEqual(missing.count, 1)
+    XCTAssertEqual((missing[0] as? FlutterError)?.code, "NOT_INITIALIZED")
+
+    var invalidResults: [Any?] = []
+    plugin.handleSetProperty(
+      call: FlutterMethodCall(methodName: "setProperty", arguments: ["name": "pause"])
+    ) {
+      invalidResults.append($0)
+    }
+    XCTAssertEqual(invalidResults.count, 1)
+    XCTAssertEqual((invalidResults[0] as? FlutterError)?.code, "INVALID_ARGS")
+  }
+
+  func testRealSetPropertyValidInvalidNonexistentAndPauseCache() {
+    let core = MpvAudioPlayerCore()
+    XCTAssertTrue(core.initialize())
+    defer {
+      core.dispose()
+      core.queue.sync {}
+    }
+
+    XCTAssertSuccess(awaitProperty(core, name: "volume", value: "50"))
+    XCTAssertTrue(core.isPaused)
+
+    XCTAssertFailure(awaitProperty(core, name: "pause", value: "not-a-flag"))
+    XCTAssertTrue(core.isPaused, "A rejected raw pause write must not change the cache")
+
+    XCTAssertFailure(
+      awaitProperty(core, name: "plezy-property-does-not-exist", value: "ignored")
+    )
+    XCTAssertTrue(core.isPaused)
+
+    XCTAssertSuccess(awaitProperty(core, name: "pause", value: "no"))
+    XCTAssertFalse(core.isPaused, "The accepted pause write must commit before completion")
+  }
+
+  func testPendingSetPropertyIsCancelledExactlyOnceOnDispose() {
+    let core = MpvAudioPlayerCore()
+    XCTAssertTrue(core.initialize())
+
+    let queueEntered = expectation(description: "mpv queue blocked")
+    let releaseQueue = DispatchSemaphore(value: 0)
+    core.queue.async {
+      queueEntered.fulfill()
+      releaseQueue.wait()
+    }
+    wait(for: [queueEntered], timeout: 2)
+
+    let completion = expectation(description: "cancelled property completion")
+    completion.assertForOverFulfill = true
+    var completionCount = 0
+    core.setPropertyAsync("volume", value: "51") { result in
+      completionCount += 1
+      if case .success = result {
+        XCTFail("Disposal must fail an accepted-but-pending property request")
+      }
+      completion.fulfill()
+    }
+
+    core.dispose()
+    releaseQueue.signal()
+    wait(for: [completion], timeout: 2)
+    core.queue.sync {}
+    XCTAssertEqual(completionCount, 1)
+    XCTAssertFailure(awaitProperty(core, name: "volume", value: "52"))
+  }
+
+  func testRapidAudioCoreReplacementOwnsLifecycleOnce() {
+    for _ in 0..<5 {
+      autoreleasepool {
+        let core = MpvAudioPlayerCore()
+        XCTAssertTrue(core.initialize())
+        core.dispose()
+        core.dispose()
+        core.queue.sync {}
+        XCTAssertFalse(core.hasActiveMpv)
+      }
+    }
+  }
+
+  private func invokeSetProperty(
+    _ plugin: RecordingMpvPlugin,
+    name: String,
+    value: String
+  ) -> [Any?] {
+    var results: [Any?] = []
+    plugin.handleSetProperty(
+      call: FlutterMethodCall(
+        methodName: "setProperty",
+        arguments: ["name": name, "value": value]
+      )
+    ) {
+      results.append($0)
+    }
+    return results
+  }
+
+  private func awaitProperty(
+    _ core: MpvPlayerCoreBase,
+    name: String,
+    value: String
+  ) -> Result<Void, Error> {
+    let completion = expectation(description: "set \(name)")
+    var propertyResult: Result<Void, Error>?
+    core.setPropertyAsync(name, value: value) {
+      propertyResult = $0
+      completion.fulfill()
+    }
+    wait(for: [completion], timeout: 2)
+    return propertyResult ?? .failure(failure)
+  }
+
+  private func XCTAssertSuccess(
+    _ result: Result<Void, Error>,
+    file: StaticString = #filePath,
+    line: UInt = #line
+  ) {
+    if case .failure(let error) = result {
+      XCTFail("Expected success, received \(error)", file: file, line: line)
+    }
+  }
+
+  private func XCTAssertFailure(
+    _ result: Result<Void, Error>,
+    file: StaticString = #filePath,
+    line: UInt = #line
+  ) {
+    if case .success = result {
+      XCTFail("Expected failure", file: file, line: line)
+    }
+  }
+}