Fix remaining issues from the v2 review

- pluginval test: --record-missing=<value> is an error rather than the value
  being taken as the config path.
- Message-thread helpers share one callOnMessageThreadAndWait() that rethrows
  an exception on the calling thread, so a throw can't leave the caller
  waiting forever. Used by the VST3 helpers, the editor helpers, the plugin
  scan, message-thread tests and the acceptance plugin teardown, which now
  can't throw out of its destructor.
- Child process output is decoded with ChildProcessOutputDecoder, so a UTF-8
  character split across two reads is no longer garbled.
- operator delete no longer throws (it's noexcept, so that terminated the
  process); operator new throws std::bad_alloc rather than returning null.
  Removed the unused violationError().
- Replaced the em/en dashes in CLAUDE.md and the acceptance design doc.

Author: drowaudio

CLAUDE.md

@@ -217,11 +217,11 @@ The command line is structured into subcommands, peeled off by a thin verb
 dispatcher in front of the settings pipeline (it does **not** use CLI11-native
 subcommands, so the env/config/CLI layering below is untouched):
 
-- `pluginval validate [options] <plugin>` — the default; `<plugin>` is a
+- `pluginval validate [options] <plugin>` - the default; `<plugin>` is a
   positional argument. `pluginval <plugin>` and `pluginval [options] <plugin>`
   (no verb) also resolve to validate.
-- `pluginval run-tests` — runs the internal unit tests.
-- `pluginval strictness-help [level]` — lists tests at a strictness level.
+- `pluginval run-tests` - runs the internal unit tests.
+- `pluginval strictness-help [level]` - lists tests at a strictness level.
 
 `settings_parser::dispatch()` (in `SettingsParser.cpp`) takes the `tokenise()`d
 command line and returns a `DispatchResult { command, validateTokens,
@@ -248,7 +248,7 @@ that CLI11 binds to directly. A single instance is filled by successive layers,
 **lowest to highest precedence: defaults → environment → `--config` → CLI**
 (in `SettingsParser::parseTokens`):
 
-1. **preprocess** the raw command line — rewrite the deprecated `strictnessLevel`,
+1. **preprocess** the raw command line - rewrite the deprecated `strictnessLevel`,
    strip the macOS `-NSDocumentRevisionsDebugMode YES` flag, and insert an
    implicit `--validate` when the last argument is a bare plugin path.
 2. **Environment layer.** Env-var names are *derived* from the registered
@@ -267,7 +267,7 @@ uses a `CheckedTransformer`, and the hex/int seed is a small callback.
 `PluginTests::Options` at the boundary.
 
 Adding a new option is three edits: a struct member, an entry in the nlohmann
-macro list, and one `add_option(...)` line — its environment variable then works
+macro list, and one `add_option(...)` line - its environment variable then works
 automatically. `SettingsSerializer` handles JSON load/save plus the two
 remaining conversions (hex seed, disabled-tests file).
 
@@ -279,7 +279,7 @@ are handled by CLI11 (auto usage + a footer with the env-var/commands notes).
 ### Acceptance Testing (`pluginval test`)
 
 A **parallel subsystem** to validate, in `source/acceptance/`. It answers "does
-this plugin produce the expected output for a known input + state?" — a
+this plugin produce the expected output for a known input + state?" - a
 deterministic *render + golden-file comparison*, not a unit-test pass/fail. Full
 spec: `tests/acceptance/Acceptance testing design.md`; end-user guide:
 `docs/Acceptance testing.md`.
@@ -295,7 +295,7 @@ spec: `tests/acceptance/Acceptance testing design.md`; end-user guide:
   `acceptance::TestRunner`, which renders on a **background thread** (message
   thread left free; plugin deleted on it), with a watchdog for the timeout, and
   quits via `callAsync` when done.
-- **Config**: `acceptance::TestConfig` (`TestConfig.cpp/h`) — std-typed struct,
+- **Config**: `acceptance::TestConfig` (`TestConfig.cpp/h`) - std-typed struct,
   **snake_case JSON keys** mapped via explicit `to_json`/`from_json` (members
   stay camelCase). It is **independent** of `PluginvalSettings` / the `--config`
   layering: the test config is a positional argument loaded standalone.
@@ -314,7 +314,7 @@ spec: `tests/acceptance/Acceptance testing design.md`; end-user guide:
   tolerance, default one 16-bit LSB = `1/32768`; `0` = bit-exact). Adding
   `spectrum`/`crosscorr`/etc. is one registry entry, no config/runner changes.
 - **Dogfood + self-tests**: three minimal deterministic `juce_add_plugin` targets
-  behind `PLUGINVAL_BUILD_TEST_PLUGINS` — `tests/test_plugins/tone_generator/`
+  behind `PLUGINVAL_BUILD_TEST_PLUGINS` - `tests/test_plugins/tone_generator/`
   (closed-form sine/square generator, phase resets on `prepareToPlay`),
   `tests/test_plugins/gain/` (a gain effect, dogfoods the `input.audio` path) and
   `tests/test_plugins/playhead_probe/` (writes the host transport to its output,
@@ -401,8 +401,8 @@ The VST3 validator (Steinberg's vstvalidator) is embedded into pluginval when bu
 5. When the `VST3validator` test runs, it spawns the extracted validator as a subprocess
 
 **Key files:**
-- `cmake/GenerateBinaryHeader.cmake` — binary-to-C-header conversion script
-- `source/vst3validator/VST3ValidatorRunner.h/cpp` — extracts embedded binary, returns `juce::File`
+- `cmake/GenerateBinaryHeader.cmake` - binary-to-C-header conversion script
+- `source/vst3validator/VST3ValidatorRunner.h/cpp` - extracts embedded binary, returns `juce::File`
 
 **Disabling embedded validator:**
 ```bash
@@ -451,6 +451,8 @@ Located in `TestUtilities.h`:
 - `countNaNs()`, `countInfs()`, `countSubnormals()` - Audio validation
 - `ScopedEditorShower` - RAII editor creation/destruction
 - `callPrepareToPlayOnMessageThreadIfVST3()` - VST3-safe lifecycle
+- `callOnMessageThreadAndWait()` - Run code on the message thread and wait; rethrows its exceptions on the caller
+- `ChildProcessOutputDecoder` - Decode child-process output read in chunks without splitting UTF-8 characters
 - `ScopedAllocationDisabler` - Detect allocations in audio thread
 
 ### Real-time Safety Checking

source/CommandLineTests.cpp

@@ -605,6 +605,11 @@ struct CommandLineTests : public juce::UnitTest
                 const auto d = settings_parser::dispatch (settings_parser::tokenise ("test --output-dir=out config.json"));
                 expect (d.error.contains ("--output-dir"));
             }
+            {
+                // A flag doesn't take a value, so the value isn't taken as the config path
+                const auto d = settings_parser::dispatch (settings_parser::tokenise ("test --record-missing=1 config.json"));
+                expect (d.error.contains ("--record-missing"));
+            }
         }
 
         beginTest ("Report writer: JUnit XML");

source/PluginTests.cpp

@@ -117,13 +117,10 @@ void PluginTests::runTest()
     {
         beginTest ("Scan for plugins located in: " + fileOrID);
 
-        juce::WaitableEvent completionEvent;
-        juce::MessageManager::callAsync ([&, this]() mutable
-                                   {
-                                       knownPluginList.scanAndAddDragAndDroppedFiles (formatManager, juce::StringArray (fileOrID), typesFound);
-                                       completionEvent.signal();
-                                   });
-        completionEvent.wait();
+        callOnMessageThreadAndWait ([&]
+        {
+            knownPluginList.scanAndAddDragAndDroppedFiles (formatManager, juce::StringArray (fileOrID), typesFound);
+        });
 
         logMessage ("Num plugins found: " + juce::String (typesFound.size()));
         expect (! typesFound.isEmpty(),
@@ -212,13 +209,7 @@ void PluginTests::testType (const juce::PluginDescription& pd)
 
                     if (t->needsToRunOnMessageThread())
                     {
-                        juce::WaitableEvent completionEvent;
-                        juce::MessageManager::callAsync ([&, this]() mutable
-                                                          {
-                                                              t->runTest (*this, *instance);
-                                                              completionEvent.signal();
-                                                          });
-                        completionEvent.wait();
+                        callOnMessageThreadAndWait ([&] { t->runTest (*this, *instance); });
                     }
                     else
                     {

source/SettingsParser.cpp

@@ -400,6 +400,12 @@ Precedence (lowest to highest): defaults, environment variables, --config, comma
                 {
                     const auto& token = tokensIn.getReference (i);
 
+                    if (token.startsWith ("--record-missing="))
+                    {
+                        result.error = "--record-missing doesn't take a value (got \"" + token + "\")";
+                        return result;
+                    }
+
                     if (token.startsWith ("--") && token.contains ("="))
                     {
                         tokens.add (token.upToFirstOccurrenceOf ("=", false, false));

source/TestUtilities.cpp

@@ -28,22 +28,6 @@ inline bool logAllocationViolationIfNotAllowed()
     return true;
 }
 
-inline void violationError (const std::string& text)
-{
-    switch (AllocatorInterceptor::getViolationBehaviour())
-    {
-        case AllocatorInterceptor::ViolationBehaviour::logToCerr:
-            std::cerr << text;
-            break;
-        case AllocatorInterceptor::ViolationBehaviour::throwException:
-            throw;
-            break;
-        case AllocatorInterceptor::ViolationBehaviour::none:
-        default:
-            break;
-    }
-}
-
 inline bool throwIfRequiredAndReturnShouldLog()
 {
     switch (AllocatorInterceptor::getViolationBehaviour())
@@ -60,6 +44,14 @@ inline bool throwIfRequiredAndReturnShouldLog()
     return false;
 }
 
+/** The deallocation version: operator delete is noexcept, so a throw from it
+    would terminate the process. Violations are still counted, just not thrown.
+*/
+inline bool shouldLogDeallocationViolation()
+{
+    return AllocatorInterceptor::getViolationBehaviour() == AllocatorInterceptor::ViolationBehaviour::logToCerr;
+}
+
 //==============================================================================
 #if JUCE_CLANG
  #define ATTRIBUTE_USED __attribute__((used))
@@ -73,7 +65,11 @@ ATTRIBUTE_USED void* operator new (std::size_t sz)
         if (throwIfRequiredAndReturnShouldLog())
             std::cerr << "!!! WARNING: Illegal allocation of " << sz << " bytes\n";
 
-    return std::malloc (sz);
+    // operator new must never return null (malloc (0) may)
+    if (auto ptr = std::malloc (sz > 0 ? sz : 1))
+        return ptr;
+
+    throw std::bad_alloc();
 }
 
 ATTRIBUTE_USED void* operator new[] (std::size_t sz)
@@ -82,13 +78,17 @@ ATTRIBUTE_USED void* operator new[] (std::size_t sz)
         if (throwIfRequiredAndReturnShouldLog())
             std::cerr << "!!! WARNING: Illegal array allocation of " << sz << " bytes\n";
 
-    return std::malloc (sz);
+    // operator new must never return null (malloc (0) may)
+    if (auto ptr = std::malloc (sz > 0 ? sz : 1))
+        return ptr;
+
+    throw std::bad_alloc();
 }
 
 ATTRIBUTE_USED void operator delete (void* ptr) noexcept
 {
     if (! logAllocationViolationIfNotAllowed())
-        if (throwIfRequiredAndReturnShouldLog())
+        if (shouldLogDeallocationViolation())
             std::cerr << "!!! WARNING: Illegal deletion\n";
 
     std::free (ptr);
@@ -97,7 +97,7 @@ ATTRIBUTE_USED void operator delete (void* ptr) noexcept
 ATTRIBUTE_USED void operator delete[] (void* ptr) noexcept
 {
     if (! logAllocationViolationIfNotAllowed())
-        if (throwIfRequiredAndReturnShouldLog())
+        if (shouldLogDeallocationViolation())
             std::cerr << "!!! WARNING: Illegal array deletion\n";
 
     std::free (ptr);
@@ -107,7 +107,7 @@ ATTRIBUTE_USED void operator delete[] (void* ptr) noexcept
 void operator delete (void* ptr, size_t) noexcept
 {
     if (! logAllocationViolationIfNotAllowed())
-        if (throwIfRequiredAndReturnShouldLog())
+        if (shouldLogDeallocationViolation())
             std::cerr << "!!! WARNING: Illegal deletion\n";
 
     std::free (ptr);
@@ -116,7 +116,7 @@ void operator delete (void* ptr, size_t) noexcept
 void operator delete[] (void* ptr, size_t) noexcept
 {
     if (! logAllocationViolationIfNotAllowed())
-        if (throwIfRequiredAndReturnShouldLog())
+        if (shouldLogDeallocationViolation())
             std::cerr << "!!! WARNING: Illegal array deletion\n";
 
     std::free (ptr);
@@ -253,3 +253,45 @@ struct AllocatorInterceptorTests    : public juce::UnitTest,
 };
 
 static AllocatorInterceptorTests allocatorInterceptorTests;
+
+
+//==============================================================================
+struct ChildProcessOutputDecoderTests  : public juce::UnitTest
+{
+    ChildProcessOutputDecoderTests()
+        : juce::UnitTest ("ChildProcessOutputDecoder", "pluginval")
+    {
+    }
+
+    void runTest() override
+    {
+        beginTest ("Complete text passes straight through");
+        {
+            ChildProcessOutputDecoder decoder;
+            expectEquals (juce::String (decoder.decode ("abc", 3)), juce::String ("abc"));
+        }
+
+        beginTest ("A character split across reads is held back until complete");
+        {
+            const std::string text = "a\xe2\x82\xac" "b"; // "a€b", the euro sign is 3 bytes
+
+            for (size_t split = 1; split < text.size(); ++split)
+            {
+                ChildProcessOutputDecoder decoder;
+                const auto first = decoder.decode (text.data(), split);
+                const auto second = decoder.decode (text.data() + split, text.size() - split);
+
+                expect (first == text.substr (0, split < 4 ? 1 : split));
+                expect (first + second == text);
+            }
+        }
+
+        beginTest ("Invalid bytes aren't held back");
+        {
+            ChildProcessOutputDecoder decoder;
+            expect (decoder.decode ("a\xff", 2) == "a\xff");
+        }
+    }
+};
+
+static ChildProcessOutputDecoderTests childProcessOutputDecoderTests;