Generation-time quality controls: token masks, single-line, mid-word continuation

[FuJacob]

Summary

Wires generation-time quality controls into the app so unwanted tokens are stopped at the sampler instead of cleaned up after the fact. Builds on the engine changes in FuJacob/cotabbyinference#8. Second of two stacked PRs, based on the feat/output-safety-gates branch (#485).

• Nonprintable token mask (free on the pin bump): the engine masks control, chat-template, and unused tokens from sampling (EOG stays sampleable so natural stopping still works), so they can never appear as ghost text. No app code beyond the dependency bump.
• single_line: set from the focused field (LlamaGenerationOptions.singleLine = !request.isMultiLineEnabled). Single-line fields never receive a multi-line completion at the source.
• forceWordContinuation: MidWordContinuationPolicy fires only when the caret sits strictly inside a word, so the engine constrains the first sampled token to continue the current word. At a normal word end it does not fire, so ordinary next-word predictions are unchanged.
• Confidence suppression (off by default): the engine now reports a per-token log-probability. LlamaRuntimeCore averages it and, when LlamaGenerationOptions.confidenceFloor is raised above its default of -infinity, suppresses low-confidence completions via the pure ConfidenceSuppressionPolicy. Disabled by default, so no behavior change until a caller opts in.

Threading: singleLine / forceWordContinuation / confidenceFloor flow through LlamaGenerationOptions into LlamaRuntimeCore (sampling config, setForceWordContinuation before each decodePrompt, and the logprob accumulation in the sample loop).

Validation

swiftlint lint --strict --quiet <touched files>          # exit 0
xcodebuild ... build         -derivedDataPath ...         # ** BUILD SUCCEEDED **
xcodebuild ... build-for-testing -derivedDataPath ...     # ** TEST BUILD SUCCEEDED **
xcodebuild test ... CODE_SIGNING_ALLOWED=NO \
  -only-testing:CotabbyTests/ConfidenceSuppressionPolicyTests \
  -only-testing:CotabbyTests/MidWordContinuationPolicyTests \
  -only-testing:CotabbyTests/TrailingDuplicationFilterTests \
  -only-testing:CotabbyTests/InsertionSafetyGateTests \
  -only-testing:CotabbyTests/SentenceBoundaryClassifierTests
# ** TEST SUCCEEDED **  Executed 27 tests, with 0 failures

Package pin resolves to cotabbyinference @ feat/generation-quality-controls (be64365). The engine side was separately validated with swift test against a local gemma-3-1b model: 20 tests, 0 failures (see the engine PR).

Linked issues

Depends on FuJacob/cotabbyinference#8 (engine).

Risk / rollout notes

• Merge order: project.yml pins the engine feature branch. Merge the engine PR to cotabbyinference main first, then flip this PR's project.yml back to branch: main, re-resolve, and merge. Kept as a draft until then.
• Behavior: the nonprintable mask changes sampling for all local models but only removes never-visible tokens (greedy determinism preserved, verified by the engine's interleaved test). single_line only affects single-line fields. forceWordContinuation uses a narrow trigger. Confidence suppression is off by default.
• Follow-ups (deliberate): wiring a Settings control for confidenceFloor, full multi-candidate N-best ranking, and the base-model prompt path (covered by the in-flight Feed instruct models their own chat template; write both prompt paths as prose #438). These need on-device tuning that green CI cannot stand in for.
• Typo suppression is handled by Suppress completions on typo'd word and offer context-aware correction #353, not here.