feat: upgrade llama.cpp to b10988

[bernardladenthin]

Summary

• Upgrades llama.cpp b10976 → b10988, walked in three chunks. The range is 323 KiB, over the runbook's 100 KiB threshold, so the chunking decision is recorded rather than quietly bent: the middle step (b10980 → b10981, 191 KiB) is a single upstream commit (#28638, OpenVINO) with no intermediate tag inside it, so no smaller step exists to take. 91% of the whole range (293 KiB) is ggml/src backends.
• Zero files on the API-compatibility review surface — nothing under common/, include/, tools/server/ or tools/mtmd/ moved at all, so every row of the priority table is vacuously satisfied and the three mechanical tools/server contract greps have no input. Zero patch targets touched, so all nine patches are untouched and all three standing drop-checks report still required.
• Fixes a defect this bump surfaced in .github/verify-patches-applied.sh (shipped to main in feat: upgrade llama.cpp to b10976, guard the JNI exception boundary, smoke the aarch64 fat jars #437): it counted the stamp's patch lines as "total lines minus one", which went stale when the applier's content oracle added a second metadata line in the next commit of that same session. The guard has been failing on every correct tree since, and would have redded C++ Tests on the next pipeline run.

The three chunks

Step	Size	Contents
b10976 → b10980	54 KiB, 4 commits	#28599 Metal FA kernels (HSK=96/HSV=64, MiniCPM3), #28881 generic OpenCL ssm_scan, 2 upstream-CI commits
b10980 → b10981	191 KiB, 1 commit	#28638 OpenVINO stateful decode + GPU MoE — irreducible; 35 of 37 files are ggml/src/ggml-openvino/**, the other two are ci/run.sh and docs/backend/OPENVINO.md
b10981 → b10988	78 KiB, 7 commits	#28105 Vulkan sparse FA, #26308 CUDA row-contiguous SUM_ROWS, #28789 RPC weight-only hash caching, #27637 OpenCL MoE matmul selection, #28934 code motion, 2 CI/docs

The blast radius of the 191 KiB step is narrow: llama/CMakeLists.txt routes GGML_OPENVINO to the resources_{linux,windows}_openvino classifier trees only — not the default JAR — and both openvino-* jobs are build-only on GPU-less runners, so "must still compile" is the whole of it.

The one non-backend change is #28934, pure code motion: build_arch_graph() moves below the graph() template specializations in src/models/{dflash,eagle3,t5}.cpp. No signature moves.

One "safe to skip" header does move and was checked rather than waved past: ggml/include/ggml-rpc.h bumps RPC_PROTO_MAJOR_VERSION 6 → 7. Inert here — GGML_RPC appears nowhere in llama/CMakeLists.txt, publish.yml, build.sh or build.bat, so ggml-rpc is never built and the protocol it versions is never spoken.

Test plan

• Affected unit / integration tests pass locally
• CI is green on this branch — see the note below; the full matrix cannot run automatically here
• Docs / CHANGELOG updated where applicable — two rows appended to docs/history/llama-cpp-breaking-changes.md

Verified at the target tag from a fresh configure (rm -rf build, real FetchContent path):

Check	Result
Configure	clean; stamp head 9f31776c3773cf03f98535c19b7e6d394af374b4 (= b10988) with nine SHA-256 lines
Wire-name extraction	138 CLI / 57 request / 15 trainer — unchanged
Release build	clean, 0 errors, 0 warnings
ctest	551/551
nm -D	40 Java_* exports, 0 C++-mangled
NativeLibraryLoadSmokeTest	4/4, 0 skipped after a clean — cross-validates LLAMA_CPP_VERSION against the linked build-info
mvn test	1763 tests, 0 failures
SpotBugs / spotless / javadoc:jar	0 bugs, clean, clean

Standing drop-checks, run against the pristine tag (the fail-loud applier detects "does not apply" but never "upstream already fixed this") — all three still required:

• 0001 — common_params_parse_main 0 occurrences in b10988:common/arg.h; WIN32 override still at common/arg.cpp:1282
• 0010 — {"vocab_type", meta.model_vocab_type} still uncast at b10988:tools/server/server-context.cpp:4554
• 0012 — bare splits[i] /= split_sum; still at b10988:src/llama-model.cpp:1493, no zero-sum guard

The verify-patches-applied.sh fix was falsified in both directions rather than assumed: a stamp naming a tenth patch not on disk still fails with the stale-build-dir message, a patch on disk missing from the stamp still fails by name, an injected extra metadata line now passes instead of failing, and the intact tree exits 0. It counts patch lines by their own shape now, so a future metadata line cannot repeat this.

Note

The full Publish matrix will not run on this PR automatically. It is dispatch-only in practice on this repo — 10/10 recent push-to-main runs and 9/11 pull_request runs are cancelled in the startgate abort window. Validating this branch end-to-end needs a workflow_dispatch with publish_to_central left at its default false.

Four checks will be red and none is from this diff — all four are inherited and were triaged in detail on #437: claude-review (account-side credentials, no successful run since #556 on 2026-09-09), both Verify GPG signing key jobs (environment: maven-central secrets are not delivered on a pull_request event — publish.yml documents this as an expected red), and analyze/CodeQL (KotlinVersionTooRecentError on Kotlin 2.4.20, red on main for 10+ runs).

Related issues / PRs

Follows #437. No upstream issue — nothing in this range required a report.

Checklist

• I have read CONTRIBUTING.md and CODE_OF_CONDUCT.md
• My commits follow Conventional Commits
• No security-sensitive changes

🤖 Generated with Claude Code

https://claude.ai/code/session_01Cft7guQngfyKycdJfBEfJP

---

Generated by Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud