soma/CHANGELOG.md

# Changelog

## 2.4.0

- Stabilized the pre-release 2.4.0 implementation and qualification evidence in
  place. These review corrections do not add a Soma environment variable or package
  dependency, and 2.3.0 remains the unchanged rollback. Evaluator-only provenance
  arguments and llama.cpp server flags are not runtime configuration additions.
- Replaced isolated latest-turn rewriting with a bounded full-task context. Transform
  calls can receive the original role-preserving `system`, `developer`, `user`,
  `assistant`, and `tool` messages; tool results and definitions; `tool_choice`;
  `parallel_tool_calls`; response-format, modality, audio, and stop controls; the
  immutable target tool calls; and a clearly separated failed assistant draft.
  Model and sampling knobs, transport headers, endpoint credentials, and rejected
  transform candidates remain excluded. System/developer instructions remain
  authoritative below Soma's JSON and native-tool invariants.
- Replaced independent whole-field regeneration with one fixed joint-repair object
  containing required nullable `reasoning` and `content` members. Soma classifies all
  present fields before repair and requests values only for fields marked for repair,
  allowing accepted reasoning to ground content and jointly generated reasoning to
  precede jointly generated content.
- Isolated each classification envelope to the named draft field while retaining the
  complete original request, controls, and immutable calls. Repair generation may
  inspect fields it must replace, but integrity verification sees only retained draft
  fields and the current candidate, preventing rejected sibling text from influencing
  either decision.
- Specialized the existing repair schema per call so requested members are strings
  and every other required member is null. Added local JSON syntax/top-level checks
  and literal stop-sequence checks for both target and repaired output, a fixed
  alternate focus for candidate three, and bounded privacy-safe candidate rejection
  reasons. Exact nonblank punctuation, symbol, and empty-container outputs are not
  rejected by an English-text heuristic. These corrections add no JSON-schema
  dependency or temperature branch.
- Added explicit field outcomes. A rejected optional reasoning field is dropped when
  usable content remains; a reasoning-only response without content or a native tool
  call is not accepted as terminal success. Immutable native `tool_calls` survive
  exhausted adjacent-prose repair, with only the unusable prose cleared. Returned
  function calls must match supplied definitions, and multiple calls are rejected
  when the request sets `parallel_tool_calls=false`.
- Defined the normal semantic route as primary reasoning-off classification,
  candidate one, and integrity verification, followed—after a completed semantic
  rejection—by up to two fresh secondary reasoning-on candidates from the original
  context. Each secondary candidate is verified on secondary. Without a secondary,
  recovery is limited to two primary candidates. Availability failover remains
  request-local. Configuration now enforces primary `off` and secondary `on` so the
  deployed route cannot silently differ from the route the evaluator qualifies.
- Added a reasoning-off verifier fallback for a reasoning-on verification result that
  is truncated or structurally invalid. The identical candidate is checked once on
  the same endpoint/model with thinking disabled; Soma regenerates only after a
  completed verifier returns `rewrite`. Semantic repairs never receive a rejected
  candidate or prior-failure prose; structural JSON recovery receives only a closed
  reason. Any `finish_reason=length` result is treated as truncated even when its
  partial text happens to be syntactically valid JSON.
- Added per-endpoint `TRANSFORM_MEDIA_MODE=placeholder|forward|reject` and
  `TRANSFORM_SECONDARY_MEDIA_MODE`. Placeholder mode preserves typed part positions
  and metadata while omitting binary payload; forward mode sends the original media
  as native OpenAI multimodal parts; reject mode requires a compatible alternate
  route or fails explicitly. A forward-capability rejection is never silently
  downgraded to placeholder mode. Malformed scalar content parts are rejected before
  the target call, and streamed assistant-audio data/transcripts are accumulated
  rather than overwritten. Mixed text/tool plus audio turns preserve their audio;
  audio-only target turns fail explicitly because the text repair contract cannot
  inspect or repair that payload.
- Added `TRANSFORM_ALLOW_CLARIFICATION`, default `false`. Missing task inputs no
  longer license arbitrary examples, placeholders, invented results, or generic
  promises; a clarification is an acceptable repair only when the operator opts in.
- Added the opt-in `TARGET_RETRY_ON_UNREPAIRABLE`, default `false`. When the complete
  target turn leaves neither usable content nor a native tool call, Soma may make
  exactly one fresh target request with a fixed corrective system message inserted
  after the leading system/developer block. It preserves the original conversation
  and tool contract and never includes rejected target or transform output. Optional
  failed reasoning does not trigger this retry when content remains usable.
- Added the opt-in `TARGET_LOOP_BACK_ON_VERIFIED_REPAIR`, default `false`. When an
  integrity-verified repair rewrites the target's refusal reasoning, Soma may make
  exactly one additional target request consisting of the original conversation plus
  a single assistant message carrying only that verified repaired reasoning in a
  `reasoning_content` field, so the target re-ingests the relaxed context and
  produces the task output itself. The second response is processed under the same
  bounded rules and never loops again; genuine refusals never loop because they
  classify as `pass`. Loop-back and `TARGET_RETRY_ON_UNREPAIRABLE` remain mutually
  exclusive per request under the shared two-target-call ceiling and aggregate
  transform deadline. Backends that reject `reasoning_content` in input messages
  fail explicitly.
- Raised the defaults to `TRANSFORM_CONTEXT_MAX_CHARS=131072`,
  `TRANSFORM_FIELD_MAX_CHARS=32768`, `TRANSFORM_DECISION_MAX_TOKENS=1536`,
  `TRANSFORM_REWRITE_MAX_TOKENS=16384`, and
  `TRANSFORM_TOTAL_TIMEOUT=1200`. Semantic context is never silently truncated; the
  configured context limit is capped at 4000000 characters and the field limit must
  not exceed it. The limit is enforced after each phase removes discarded draft
  fields, so oversized optional reasoning cannot block an otherwise bounded content
  repair.
- Removed `TRANSFORM_CONFIRM_REWRITES`. Any presence of the obsolete variable now
  fails configuration validation so a stale profile cannot appear to enable behavior
  that no longer exists.
- Set hard ceilings of two target calls, 20 transform calls per target response, and
  40 transform calls for one client request. Default configuration still makes one
  target call because target retry is disabled. Fail-open no longer permits a
  reasoning-only or otherwise empty terminal response.
- Expanded privacy-safe diagnostics, offline coverage, and live qualification around
  full context, media routes, joint field policy, semantic candidate routing,
  verifier fallback, and optional target retry. The frozen evaluator now covers 240
  classification cases, 80 balanced joint message repairs, all three media modes,
  staged primary-off/secondary-on routing, retained/forbidden facts, schema-off and
  repeat sentinels, and reproducibility. Live target smoke remains explicitly opt-in.
  Soma 2.4.0 ships unqualified until the exact transform profile passes every
  automated gate; the report retains hash-bound evidence for all 80 repairs, and the
  evaluator never downloads, loads, switches, starts, stops, or restarts a model.
  Error responses after dispatch now carry the same privacy-safe counters as success
  responses, target elapsed time includes malformed target responses, and exact
  qualification records a dedicated secondary reasoning-budget value.
- The live evaluator can record llama.cpp's unrestricted reasoning-budget sentinel
  as `--reasoning-budget -1` for an honest exploratory run. This never satisfies the
  positive bounded-budget qualification gate; it only prevents current deployments
  from being mislabeled as budget `0` or `512` while collecting repair evidence.
- Defined the first qualifying local route as temperature zero with a bounded
  llama.cpp `--reasoning-budget 512`, recorded by the evaluator with the matching
  `--reasoning-budget 512`. Temperature zero removes intentional sampling variance
  from repeat gates but is not a guarantee of byte-identical output; other
  temperatures and budgets remain separate profiles that need their own reports.
- Made the automated gates the sole qualification stage. A complete pass records
  `qualified: true` and `qualification_status: qualified`; a failed gate records an
  unqualified profile. Hash-bound retained outputs remain audit evidence and do not
  form a separate approval stage.
- Added an explicit provider-managed evaluator profile for hosted-model experiments.
  It records a retained, hash-bound public model metadata record and non-secret
  endpoint/model identities, rejects fabricated local GGUF or reasoning-budget
  provenance, and is always marked exploratory rather than qualified. Target smoke
  now requires the exact requested `OK` token instead of accepting arbitrary
  non-empty content.
- Added an explicitly unqualified hybrid evaluator profile for a local GGUF primary
  and provider-managed secondary. It retains both provenance records without
  pretending the hosted reasoning budget is known. Target-smoke requests now allow
  128 output tokens while still requiring the response to be exactly `OK`.
- Kept the unrestricted-budget Qwen3.5-9B Q6_K report unqualified until a complete
  replacement run exists. In-place evaluator stabilization changes its source/corpus
  evidence identity, so the evaluator atomically installs a fresh temperature-zero,
  512-token report before the obsolete unrestricted artifact is removed; the old JSON
  is never edited or promoted.

## 2.3.0

- Replaced exact excerpt extraction, Unicode-equivalence recovery, unique-anchor
  resolution, bounded fragment generation, masked retries, and local splicing with a
  decision-only `pass | rewrite` classifier and complete-field regeneration. The
  simpler contract removes the highest-fragility requirements for small transform
  models while giving every model enough user context to produce a substantive
  answer rather than a generic bridge.
- Added mandatory post-rewrite classification. Every locally valid candidate must
  independently classify as `pass`; a residual or paraphrased refusal,
  nonresponsive bridge, malformed verification result, or verification failure
  rejects the candidate.
- Added one bounded fresh-regeneration path from the pristine source after a
  received-output or post-check failure. A configured secondary performs the second
  candidate when available; otherwise primary is reused. Rejected candidate text is
  never fed back to either model, and the final candidate is verified exactly once.
- Added `TRANSFORM_REWRITE_MAX_TOKENS`, defaulting to 4096 with a valid range of
  256–16384. Complete replacements are bounded after decoding to
  `min(16,384, max(4,096, 2 * source characters))`; the rewrite schema deliberately
  omits a dynamic `maxLength` for structured-output compatibility.
- Added explicit 16,384-character rewrite-input limits without semantic truncation.
  Missing textual user context and oversized source/user inputs are deterministic,
  field-scoped failures. Mixed-media turns carry an `unseen_media` flag; pure
  non-text turns cannot be regenerated.
- Limited transform context to the complete field, latest textual user turn,
  `tool_turn`, `unseen_media`, the deterministic output bound, and an optional closed
  retry reason. Earlier messages, system instructions, processed reasoning, tools and
  arguments, headers, credentials, and rejected candidates remain excluded.
- Raised the per-completion transform-call ceiling from eight to twelve to cover two
  complete `(regeneration + post-check)` candidate paths for each reasoning/content
  field while retaining at most two classification votes, the aggregate transform
  deadline, one target call, and request-local backend stickiness.
- Removed the DSML parser, shim, counters, diagnostics, and documentation. Soma now
  preserves native OpenAI `tool_calls` only; proprietary text-to-tool conversion is
  owned by the target's OpenAI-compatible gateway. Native calls now require a
  nonblank unique ID and `type: function`, preventing stream/non-stream envelope
  drift and uncorrelatable tool results.
- Tightened the post-`[DONE]` SSE extension to at most one object with `choices: []`,
  no keys outside `choices`, `cost`, and `usage`, and at least one non-null metadata
  value. The postlude may end at EOF or one closing `[DONE]`; all later data is
  rejected, and upstream error objects retain the redacted stream-error path.
  Normalized outbound SSE emits one accepted `cost`/`usage` metadata event instead
  of repeating one-shot cost data on every delta.
- Added `X-Soma-Postcheck-Rejections` and `classify`, `rewrite`, and `postcheck`
  phase diagnostics with candidate/backend/reasoning/purpose metadata. Removed
  rewrite-mode and DSML diagnostics while retaining strict privacy-safe logging,
  field decisions, repair counts, rejected-rewrite counts, and fail-open visibility.
- Reworked live qualification around the exact imported 2.3.0 runtime, decision-only
  classification, complete-field replacements, and verified final output. Local
  reports belong under excluded `qualification-local/`; Soma never downloads,
  starts, stops, switches, or otherwise manages a model.
- Distinguished automated-gate success from final qualification: reports remain
  `pending_manual_review` until the 40 retained source/replacement pairs receive
  independent semantic review. Exact-pair runs with a configured secondary inject
  one labeled primary-unavailable event and require real secondary classification,
  regeneration, and post-check calls; reports include per-backend phase counts.
- Made live provenance fail closed if either the imported Soma source or evaluator
  changes during a run, preventing a report from hashing different code than it
  actually exercised.

## 2.2.7

- Fixed the 2.2.6 streaming regression that rejected OpenAI-compatible gateway
  usage or billing postludes emitted after an upstream `[DONE]`. Empty-choice
  metadata is now preserved, including an optional final `[DONE]`, while premature
  delimiters, malformed postludes, and any post-delimiter choice data remain invalid.
- Added explicit `off`, `on`, and `default` transform reasoning modes. `off`
  preserves the 2.2.6 request shape, `on` uses llama.cpp's
  `chat_template_kwargs.enable_thinking=true`, and `default` leaves reasoning
  controls to the server. The setting applies consistently to classification and
  rewriting.
- Added one optional, fully explicit secondary transform endpoint/model profile. It
  may point to the primary server with a different reasoning mode or to an
  independently operated server/model, but it shares Soma's prompt, temperature,
  JSON contract, validation, and fixed generation bounds.
- Kept recovery bounded to the existing second attempt. The secondary can replace a
  failed primary attempt after connection/timeouts, HTTP 408/429/5xx, invalid outer
  completions, or locally rejected classification/rewrite output. Configuration
  errors and other non-transient 4xx responses remain visible.
- Added optional secondary confirmation for valid primary `rewrite` classifications.
  A secondary `pass` conservatively preserves the field; two valid `rewrite`
  decisions retain the primary anchor. Confirmation is disabled by default and does
  not add a third classification attempt.
- Added request-local failover: after a transient primary availability failure, only
  the remaining transform phases in that Soma request begin on secondary. The next
  client request starts on primary, so Soma retains no cross-request circuit-breaker
  or harness/session state.
- Added a 600-second aggregate transform budget, starting after the single target
  call, so retries and multi-field processing cannot multiply the per-call timeout
  without bound. The one-target-call invariant and eight-transform-call ceiling are
  unchanged.
- Extended safe diagnostics with backend, reasoning mode, call purpose, secondary
  call/failover/disagreement counts, and transform-deadline failures without logging
  prompts, generated text, anchors, credentials, or raw upstream request IDs.
- Extended live qualification to exercise explicit reasoning modes and composed
  primary/secondary behavior without managing models. Deployment guidance requires
  a secondary to qualify alone and the exact pair to qualify before an operator
  enables confirmation; the evaluator does not change runtime configuration.
- An exploratory test of the operator-selected Qwen3.5-9B Q6_K with reasoning enabled
  at temperature 0 removed the two reasoning-off false rewrites but regressed overall
  refusal recall from 99% to 96%, introduced four invalid/missed partial-refusal
  anchors and ten repeat failures, and remained unqualified. Targeted 64/128/256-token
  reasoning budgets were non-monotonic, so Soma adds no model-specific
  reasoning-budget knob.

## 2.2.6

- Preserved the 2.2.5 one-target-call flow, phase prompts, bounded transform call
  counts, anchored/masked rewrite behavior, DSML normalization, `FAIL_OPEN` policy,
  endpoints, and runtime environment variables while simplifying the implementation.
- Removed unused transform compatibility helpers, prefiltered protected
  `ENABLE_REASONING` fields before overlay, reduced target-response mutation to one
  working deep copy, removed custom HTTP pool sizing, and consolidated rewrite
  contract validation under its owning parser/semantic validator.
- Made client flag validation exact: `stream` and `parallel_tool_calls` must be
  booleans, while `n` is null or integer `1` and no longer accepts a boolean.
- Added target assistant-message validation before DSML or transform calls, including
  role/content types, one non-empty reasoning alias, native tool-call shape,
  non-blank function names, JSON-string arguments, and unusable empty turns. Unknown
  valid target metadata remains preserved.
- Limited latest-user transform context to text: plain strings and the textual parts
  of multimodal arrays are joined, while image, audio, file, base64, tool, and other
  non-text metadata is omitted.
- Required refusal anchors to contain at least one letter or number and begin and end
  on source boundaries; rewrites must likewise contain a letter or number.
  Context-copy checks now ignore only splice-edge whitespace, closing the
  copied-neighbor bypass without changing the local exact-splice behavior.
- Replaced generic streamed-response merging with explicit OpenAI delta assembly.
  Text and every tool-call fragment append in arrival order, including identical
  fragments; stable metadata is checked explicitly and unknown metadata uses
  last-value semantics. Cumulative snapshot providers are explicitly unsupported.
- Require a terminal non-null SSE `finish_reason`; reject `[DONE]` or EOF before it,
  meaningful deltas after it, malformed event JSON, and non-finite values. Normalized
  outbound SSE remains unchanged.
- Reject non-finite configuration numbers, malformed endpoint ports, endpoint
  userinfo/query/fragment components, duplicate or framing-sensitive configured
  headers, duplicate transform-contract object members, and non-finite JSON across
  client, target, transform, SSE, and DSML boundaries. Wire JSON now uses a strict,
  surrogate-safe encoder.
- Tightened HTTP request framing to reject simultaneous `Content-Length` and
  `Transfer-Encoding`, non-sole chunked encodings, negative chunks, and unterminated
  chunk framing. No in-process body-size or buffering cap was added; those limits
  remain the responsibility of a trusted front proxy.
- Preserved leading and trailing whitespace for DSML `string=true` arguments while
  continuing to trim non-string JSON arguments. Sanitized upstream request IDs before
  reflection and prevented upstream headers from colliding with Soma diagnostics.
- Reduced client-facing detail for streamed target/internal failures while retaining
  server-side diagnostics, and removed query strings and upstream error text from
  routine proxy-error logs.
- Added an opt-in standard-library live qualification evaluator with 200 reviewed
  classifier fixtures, 40 category-balanced rewrite fixtures, schema-off sentinels,
  deterministic parallel/repeat gates, reproducibility metadata, synthetic rewrite
  output for human audit, and an optional 50-case one-shot target gate. Its reviewed
  anchors must cover the curated refusal core, its JSON/channel selection mirrors the
  runtime, and reports fingerprint the exact prompt/source/configuration snapshot.
  It never downloads, switches, loads, or restarts a model.
- Recorded the tested aggressive Qwen3.5-9B Q8_0 deployment as unqualified after
  false-positive and rewrite-stability failures. The official Qwen3.5-9B Q8_0 remains
  a candidate that must independently pass the same gate; Soma performs no model
  management.
- Recorded the operator-selected DavidAU Qwen3.5-9B Q6_K artifact as reproducibly
  unqualified at temperature 0, seed 1, the temperature sampler, and one server slot;
  preserved its exact machine-readable qualification report with the release. A
  per-request temperature-0.7 comparison was also preserved and was substantially
  worse, with 43 false rewrites and 93% refusal recall. Temperature 0 remains the
  better tested setting, but neither configuration qualifies.
- Added two copyable deployment profiles using only existing variables, with one Soma
  process and distinct listener port per harness. Documented isolated profile startup,
  the trusted-local/reverse-proxy boundary, front-proxy resource limits, and the
  non-loopback warning. No runtime harness branching was introduced.

## 2.2.5

- Fixed the observed 2.2.4 semantic-echo failure in which classification recovered to a valid literal anchor, but both rewrite attempts returned complete, schema-valid, `finish_reason=stop` JSON whose replacement was unchanged from that anchor; this was not a JSON-mode, truncation, or token-budget failure.
- Split the built-in classification and rewrite guidance so classification remains observational while the editor is explicitly permitted to produce a bounded non-refusal fragment without independently solving the user request.
- Strengthened classification recovery guidance so a corrected excerpt must remain a unique, exact, syntactically replaceable refusal clause containing the withholding decision rather than merely any literal source text.
- Kept the initial rewrite and ordinary repairs anchored, but masked `refusal_anchor` from the sole second attempt after an `unchanged` or `anchor_retained` result. The masked request carries only the field, bounded contexts, `anchor_omitted: true`, and the closed failure reason; the exact anchor and offsets remain local for validation and splicing.
- Added field-specific masked guidance that relies on the local splice to preserve both contexts and forbids copying, paraphrasing, summarizing, or otherwise reproducing them in the replacement.
- Made the field fallback instruction unconditional on every `masked_anchor` retry after a live Qwen run ignored a buried conditional fallback and copied immutable context. The final system instruction, appended after the masked contract, directs the transform to return exactly `{"replacement":"Proceed with the requested work."}` for reasoning or `{"replacement":"I'll proceed with the requested task."}` for content. This gives the semantic retry a fixed, unambiguous target while preserving normal server-output parsing, local validation, candidate-exhaustion, and `FAIL_OPEN` behavior; the shared schema and validator still accept any otherwise valid replacement fragment.
- Added privacy-safe `rewrite_mode=anchored|masked_anchor` diagnostics without logging the anchor, replacement, target text, user context, or rejected output; non-rewrite phases use `none`.
- Preserved the 64-character anchor cap, 512-character contexts, 256-character replacement cap, 384-token rewrite budget, two rewrite attempts, one target call, and eight-transform-call ceiling. Rewriting still receives no latest user turn, unbounded target field, or processed reasoning, and still has no complete-field fallback.
- Preserved `FAIL_OPEN` behavior: strict mode returns the exhausted transform error, while fail-open mode preserves only the affected field, marks it `failed_open`, and continues.

## 2.2.4

- Fixed the observed 2.2.3 failure in which classification JSON was valid, an initial complete-field rewrite retained the refusal, and its repair exhausted the token budget before closing its JSON object; JSON mode was enabled but could not guarantee completion of the unbounded complete-field edit.
- Replaced complete-field refusal rewriting with a deterministic local splice: classification must resolve a unique source anchor of at most 64 decoded characters, and the transform receives only that anchor plus at most 512 source characters on each side.
- Require the rewrite model to return only an anchor replacement of at most 256 decoded characters, with the fixed cap expressed in the llama.cpp-compatible JSON schema, repeated in the prompt, and enforced authoritatively in Python.
- Reject and repair complete-field candidates that repeat immutable context across a splice boundary or embed a substantial boundary segment inside wrapper text.
- Bound rewrite generation to 384 tokens and preserve the original prefix and suffix exactly; only the bounded source window is sent, never the latest user turn or processed reasoning, and there is no complete-field rewrite fallback.
- Apply one failure-specific repair to any received but unusable rewrite candidate, without echoing candidate text or exception details into the retry.
- Make exhausted rewrite candidates consistently honor `FAIL_OPEN`: strict mode returns 502 with the specific transform failure, while fail-open mode preserves only the affected field and marks it `failed_open`.
- Retained all endpoints, environment variables, response headers, client formats, the one-target-call invariant, and the eight-transform-call maximum.
- Documented that fixed small `maxLength` constraints work with the tested llama.cpp structured-output path, while previously considered large dynamic limits did not; because the schema is not model-visible, prompts also state each cap and local validation remains authoritative.

## 2.2.3

- Reduced classification excerpts from 128 to 64 decoded characters and directed the classifier to choose a compact, normally 2–8-word refusal anchor.
- Required exact contiguous provenance after JSON decoding, preserving case, Unicode punctuation, CRLF and other line endings, tabs, repeated spaces, and non-breaking spaces.
- Resolve only unique CRLF, no-break-space, or curly-quote normalization matches back to the exact original source slice with a streaming, memory-bounded matcher before rewriting; ambiguous matches, lone-CR changes, case changes, omissions, and general whitespace changes remain invalid.
- Clarified that llama.cpp JSON grammar constrains structure and string length but cannot enforce the dynamic rule that an excerpt occurs in the supplied source text; Soma continues to enforce that relationship locally.
- Gave the existing single classification recovery call failure-specific guidance using a closed failure reason, without echoing rejected transform output into the retry.
- Added privacy-safe diagnostic failure categories for invalid JSON or contract shape, pass-with-excerpt, empty excerpt, excessive length, and nonliteral excerpts; source text, excerpts, and transform output remain excluded from logs.
- Preserved the public `invalid_transform_output` error code, JSON-mode default and behavior when disabled, endpoints, environment variables, response headers, field-scoped `FAIL_OPEN` semantics, 768-token classification budget, and existing target and transform call bounds.

## 2.2.2

- Simplified classification to the strict `pass | rewrite` contract and removed the `safety` outcome.
- Route every refusal or withholding decision, including decisions formerly classified as safety boundaries, through the existing context-isolated rewrite stage.
- Continue using the latest user turn only for classification; rewriting still receives only the target field, refusal excerpt, and optional processed reasoning.
- Removed the safety-preserved counter, response header, and field-decision value from current diagnostics.
- Updated transform call bounds: `pass` stops field processing, while every refusal or withholding classification invokes the bounded rewrite path.

## 2.2.1

- Recover once from empty, truncated, malformed, or contract-invalid classification output before applying the configured field-scoped `FAIL_OPEN` policy.
- Preserve transform completion metadata and report incomplete classification generation as `transform_output_truncated` instead of an undifferentiated invalid-JSON error.
- Bound classification output to 768 tokens and require `rewrite` and `safety` excerpts to be literal, nonempty substrings no longer than 128 characters; `pass` requires an empty excerpt.
- Added `X-Soma-Classification-Retries` and safe classification-recovery diagnostics without logging transform output or request content.
- Treat decoded empty, missing, non-string, or structurally invalid rewrite replacements as `rewrite_rejected` while retaining operational handling for malformed JSON.
- Require literal equality for reasoning/content duplicate routing so case- or whitespace-normalized variants cannot replace the original field.
- Reject short and medium processed-reasoning copies in rewritten content using normalized equality, bidirectional containment, and bounded similarity checks.
- Documented classification and rewrite call bounds and clarified that JSON mode is enabled by default, requires a process restart after environment changes, and can be verified with `--check-config`, startup diagnostics, or `/health`.

## 2.2.0

- Split transform processing into contextual classification and context-isolated rewriting.
- Restored the exact latest user turn only for classification; user context never reaches rewriting.
- Added `pass`, `rewrite`, and `safety` classification outcomes.
- Preserve legitimate safety boundaries instead of treating every refusal as editable.
- Require an exact refusal excerpt for rewrite decisions.
- Added one bounded rewrite-only repair when an edit is unchanged or retains the classified excerpt.
- Removed strict reasoning compression and lexical-similarity floors; retained catastrophic growth and reasoning-copy protections.
- Process duplicate final text as content and duplicate tool-turn text as reasoning.
- Added detected-refusal, safety-preserved, and rewrite-repair diagnostics.
- Retained stateless operation, one target call, native tool-call fidelity, DSML normalization, buffered SSE, and field-scoped fail-open behavior.

## 2.1.2

- Rebalanced refusal handling with more sensitive classification and conservative edits.
- Added independent field processing and `rewrite_rejected` diagnostics.

## 2.1.1

- Ignored unnecessary replacement text when `refusal:false`.
- Simplified llama.cpp JSON grammar to avoid nested `maxLength` failures.

## 2.1.0

- Removed user context from transforms, separated reasoning/content guidance, added structured JSON, rewrite bounds, and duplicate handling.