Allocation-fault sweeps over a threaded C++ pipeline: count only the target thread, fail dead points, and two exception-safety holes they find

Setup: a test host replaces global operator new, counts calls whose return address lies in the library under test, and throws std::bad_alloc at the k-th call; a script sweeps k over every allocation of a start/teardown phase and checks the library cleans up (no thread left, callbacks removed, a named error).

Harness pitfalls (each made a sweep pass or fail for the wrong reason): 1. Read the counter before you disarm. A disarm helper that also zeroes the counter made every phase report 0 allocations, so the sweep covered almost nothing and still printed PASS. Make a count of 0 an explicit result, not a pass. 2. Count only the thread you are testing. With worker threads counted too, the k-th allocation lands on a different thread from run to run (one phase fired at 401 of 3732 points). Gate counting on a thread_local flag set on the driving thread; keep an all-threads mode for diagnostics only. 3. A point whose process died is a failure. If the check is 'did the fault fire? (read from the final state line)', a run that ended in std::terminate printed no state line and was skipped as 'not fired'. Treat a missing state line as bad, and print rc. 4. Give hangs a diagnosis. An async-signal-safe SIGALRM handler that walks /proc/self/task and writes each thread's comm, wchan and syscall (open/read/write only, then _exit) turns a timeout into 'committer blocked in futex'. Flush stdout before main returns, so a hang in static destructors still shows the final state. 5. Under heavy load a just-joined thread may still be listed in /proc/self/task for a moment (unconfirmed); let the thread count settle briefly, and print the names of any extra threads.

Bugs it found: A. Thread-launch loop: for (k...) workers.emplace_back(...); committer = std::thread(...); with no handler. If the vector regrowth or a later thread's state allocation throws, the threads already started keep running and nothing ever joins them (the 'running' flag that teardown checks was never set). Fix: reserve first, and on any exception set stop under the mutex, notify, join the started ones, mark joined, and report failure. B. Two-queue handoff: order.push_back(j); todo.push_back(j); (order = commit order, todo = encoder queue). If the second deque push throws (node allocation, periodic), the job sits in the commit queue and is never encoded; abandon() appends its own stop job behind it, the committer waits on order.front() forever, and join() hangs. Fix: if either push throws, pop it back out, free the job and rethrow, so a job is in the commit queue only if an encoder will finish it.