spotbugs: flip pom to Max+Low at the gate; clear remaining 8 source-level findings

Pom now enforces effort=Max + threshold=Low (matches BAF, plugin, sb
that all already gate on it). With the gate flipped, the remaining 8
findings surface and are dispatched in one sweep:

Source fixes (2):
- LlamaModel.java — move OBJECT_MAPPER static field to the top of the
  class body so static fields precede instance fields
  (IMC_IMMATURE_CLASS_WRONG_FIELD_ORDER).
- ModelParameters.java — same reorder: statics before the instance
  serializer field.

Narrow <Match> suppressions added to spotbugs-exclude.xml with rationale (6):
- CancellationToken + ChatTranscript: IMC_NO_EQUALS — both are
  identity-managed lifecycle handles (cancellation flag observed across
  threads, append-only transcript owned by one Session). Documented in
  their Javadocs as intentionally non-value-shaped.
- TimingsLogger: LO_SUSPECT_LOG_CLASS — the documented public logger
  name "net.ladenthin.llama.timings" is the operator-visible contract
  (see README + CLAUDE.md System Properties Reference), NOT the FQN of
  the enclosing class.
- Java8CompatibilityHelper.formatted: FORMAT_STRING_MANIPULATION — the
  wrapper exists specifically to accept runtime format strings as a
  Java 8 backport of String#formatted().
- ToolHandler.invoke: THROWS_METHOD_THROWS_CLAUSE_BASIC_EXCEPTION —
  functional-interface contract for user-supplied handlers; the agent
  loop catches broad Exception and reports back as {"error":"..."}.
- ChatMessage.requireNonNull: WEM_WEAK_EXCEPTION_MESSAGING — precondition
  guard with no state-dependent context to add to the message.

Verification: mvn clean compile spotbugs:check -> BugInstance size is 0,
BUILD SUCCESS.

Author: claude

pom.xml

@@ -594,8 +594,8 @@ SPDX-License-Identifier: MIT
 				<groupId>com.github.spotbugs</groupId>
 				<artifactId>spotbugs-maven-plugin</artifactId>
 				<configuration>
-					<effort>Default</effort>
-					<threshold>Default</threshold>
+					<effort>Max</effort>
+					<threshold>Low</threshold>
 					<failOnError>true</failOnError>
 					<includeTests>false</includeTests>
 					<excludeFilterFile>spotbugs-exclude.xml</excludeFilterFile>

spotbugs-exclude.xml

@@ -286,4 +286,78 @@ SPDX-License-Identifier: MIT
         <Field name="ctx"/>
     </Match>
 
+    <!--
+        CancellationToken and ChatTranscript are lifecycle handles managed by
+        identity, not value: a CancellationToken owns a mutable cancellation
+        flag observed across threads, and ChatTranscript is an append-only
+        transcript owned by a single Session and never compared by value.
+        Both classes deliberately do NOT generate Lombok @EqualsAndHashCode
+        (documented in their Javadocs) — fb-contrib's IMC_NO_EQUALS check
+        is therefore a false positive for both.
+    -->
+    <Match>
+        <Or>
+            <Class name="net.ladenthin.llama.CancellationToken"/>
+            <Class name="net.ladenthin.llama.ChatTranscript"/>
+        </Or>
+        <Bug pattern="IMC_IMMATURE_CLASS_NO_EQUALS"/>
+    </Match>
+
+    <!--
+        TimingsLogger emits its events under the documented public logger name
+        "net.ladenthin.llama.timings" (see CLAUDE.md > System Properties Reference
+        and the README), NOT the FQN of the TimingsLogger class. That separation
+        lets operators raise/lower the per-run-timing line independently of
+        application logs. fb-contrib's LO_SUSPECT_LOG_CLASS detector flags any
+        logger whose name does not match the enclosing class FQN; here the
+        mismatch is the public contract.
+    -->
+    <Match>
+        <Class name="net.ladenthin.llama.TimingsLogger"/>
+        <Bug pattern="LO_SUSPECT_LOG_CLASS"/>
+    </Match>
+
+    <!--
+        Java8CompatibilityHelper.formatted is a thin wrapper around
+        String.format that intentionally accepts runtime-supplied format
+        strings — the helper exists precisely so that Java 11+'s
+        String#formatted() can be used uniformly on the Java 8 baseline.
+        fb-contrib's FORMAT_STRING_MANIPULATION fires on any non-literal
+        format argument; the wrapper is the documented escape hatch.
+    -->
+    <Match>
+        <Class name="net.ladenthin.llama.Java8CompatibilityHelper"/>
+        <Bug pattern="FORMAT_STRING_MANIPULATION"/>
+        <Method name="formatted"/>
+    </Match>
+
+    <!--
+        ToolHandler.invoke is the functional-interface contract for caller-
+        supplied tool handlers. `throws Exception` is the right shape because
+        the handler body is user code that can throw anything; LlamaModel's
+        chatWithTools agent loop catches the broad Exception and reports it
+        back to the model as a {"error":"..."} tool result rather than
+        aborting the request. Narrowing the throws clause would force every
+        handler implementation to wrap arbitrary checked exceptions for
+        no behavioural benefit.
+    -->
+    <Match>
+        <Class name="net.ladenthin.llama.ToolHandler"/>
+        <Bug pattern="THROWS_METHOD_THROWS_CLAUSE_BASIC_EXCEPTION"/>
+        <Method name="invoke"/>
+    </Match>
+
+    <!--
+        ChatMessage.requireNonNull is a precondition guard whose only
+        meaningful state to report is the parameter name itself (the value
+        is null by definition at the throw point). fb-contrib's WEM detector
+        recognises the static-string IllegalArgumentException as "weak", but
+        there is no additional state-dependent context to add at this guard.
+    -->
+    <Match>
+        <Class name="net.ladenthin.llama.ChatMessage"/>
+        <Bug pattern="WEM_WEAK_EXCEPTION_MESSAGING"/>
+        <Method name="requireNonNull"/>
+    </Match>
+
 </FindBugsFilter>

src/main/java/net/ladenthin/llama/LlamaModel.java

@@ -42,6 +42,9 @@
 @ToString
 public class LlamaModel implements AutoCloseable {
 
+    private static final com.fasterxml.jackson.databind.ObjectMapper OBJECT_MAPPER =
+            new com.fasterxml.jackson.databind.ObjectMapper();
+
     static {
         LlamaLoader.initialize();
     }
@@ -697,9 +700,6 @@ public String getMetrics() {
         return handleSlotAction(0, 0, null);
     }
 
-    private static final com.fasterxml.jackson.databind.ObjectMapper OBJECT_MAPPER =
-            new com.fasterxml.jackson.databind.ObjectMapper();
-
     /**
      * Run {@link #complete(InferenceParameters)} constrained to the supplied JSON Schema
      * and deserialize the result into an instance of {@code type}. The schema is applied

src/main/java/net/ladenthin/llama/ModelParameters.java

@@ -23,9 +23,6 @@
 @EqualsAndHashCode(callSuper = true)
 public final class ModelParameters extends CliParameters {
 
-    @EqualsAndHashCode.Exclude
-    private final ParameterJsonSerializer serializer = new ParameterJsonSerializer();
-
     private static final String ARG_FIT = "--fit";
     static final String ARG_POOLING = "--pooling";
     /** CLI value enabling {@code --fit} (automatic device-memory fitting). */
@@ -35,6 +32,9 @@ public final class ModelParameters extends CliParameters {
     /** Mirrors the llama.cpp default: {@code fit_params = true}. */
     public static final String DEFAULT_FIT_VALUE = FIT_ON;
 
+    @EqualsAndHashCode.Exclude
+    private final ParameterJsonSerializer serializer = new ParameterJsonSerializer();
+
     /** Creates a new {@link ModelParameters} with {@code --fit=on} preset. */
     public ModelParameters() {
         parameters.put(ARG_FIT, DEFAULT_FIT_VALUE);