Logging follow-up: serialize setLogger callers (JVM crash), pin the logging contracts with tests

[bernardladenthin]

Summary

Follow-up to #447 (merged before these three commits landed on the branch; rebased onto main).

• Fix: concurrent setLogger calls crashed the JVM. The sink swap introduced in Logging: route setLogger through a common_log sink (patch 0014); quiet agent console #447 pauses (joins) and resumes (assigns a fresh std::thread) llama.cpp's log worker. Two unserialized callers raced on that std::thread: one joined it while the other assigned over the still-joinable object, which is std::terminate (terminate called without an active exception, whole JVM gone). The old llama_log_set implementation held g_log_mutex for the whole swap; the sink swap cannot (the join needs that mutex on the worker), so a separate g_set_logger_mutex now serializes callers; the trampoline never takes it, so no deadlock with the join. LlamaLoggerTest#concurrentSetLoggerCallsDoNotRaceOnTheLogWorker (4 threads × 200 swaps) reproduced the crash before the fix and passes after it.
• Tests pinning the logging contracts, all model-free against the real libjllama: verbosityThresholdIsProcessWideAndEveryLoadSetsIt (-lv 1 hides the server's INFO line, keeps llama's ERROR line; a load without -lv resets the threshold to 3 — common_params_parse ends with common_log_set_verbosity_thold(params.verbosity), default 3, which a review had assumed the other way round), deliveryIsAsynchronousOnTheLogWorkerAndRemovingTheLoggerDrains (never on the caller's thread, always native-attached, setLogger(format, null) returns only after the drain; prints the distinct-Thread count: 13 lines → 13 objects today), and the agent's mavenJvmConfigPinsAUtf8ConsoleForExecJava (.mvn/jvm.config keeps both UTF-8 flags). The srv-line matcher is exact now; the loose contains("loading model") also matched llama's error loading model.
• Docs: setLogger Javadoc names the second deadlock rule (do not hold a lock the previous callback needs while the drain runs it on the worker); setLogVerbosity Javadoc states the measured every-load reset; the per-line attach/detach of the worker thread is documented as the simple, not the cheapest, choice, with the thread_local-guard optimisation and its caveats filed in TODO.md; CLAUDE.md patch-table row updated accordingly.

Test plan

• Affected unit / integration tests pass locally — fresh native build in the sandbox: LlamaLoggerTest 6/6 (incl. the race test, which crashed the JVM against the unfixed library), NativeLibraryLoadSmokeTest 4/4, agent LocalAgentTest 6/6 + AgentOptionsTest 8/8; javadoc and spotbugs clean; clang-format 23.1.1 applied.
• CI is green on this branch
• Docs / CHANGELOG updated where applicable (CHANGELOG unchanged on purpose: the race never shipped in a release, it was introduced and fixed within the unreleased Logging: route setLogger through a common_log sink (patch 0014); quiet agent console #447 line)

Related issues / PRs

Follow-up to #447. Refs #444 / #445 / #446 (the Atmosphere agent).

Checklist

• I have read CONTRIBUTING.md and CODE_OF_CONDUCT.md
• My commits follow Conventional Commits
• No security-sensitive changes (if there are, I have notified the maintainer privately per SECURITY.md)

🤖 Generated with Claude Code

https://claude.ai/code/session_01UVwj2UuMPybiK1bHyG9toH

---

Generated by Claude Code