I.e. it means that only additional restrictions are added (in the case of segwit, that the witness must be valid in addition to the old-style signature). This means that old nodes accept all new blocks,
yep
(but before you said "old nodes will accept new rules", which is not the same, and self-evidently not possible)
Why do you say that's not possible? In the case of segwit (and a soft fork in general), old nodes
will accept transactions and blocks following the new rules - in your terms
because soft fork. They will simply see an "anyone can spend" signature. (This assumes that you do not send them witness data they do not understand, but that is part of the network protocol and not the consensus rules. You could also discuss a softfork of "reduce block size" to make it simpler to understand.)
but it also means that transactions that would be accepted by old nodes may be invalid according to the new rules.
nope, you're wrong
if nodes that observe a soft-fork's rules rejected blocks containing previously valid transactions, that would fork the chain. which isn't possible in this case, because the segwit soft-fork does not reject any rules that were valid before it's activation, that's the definition of a soft fork
Sorry, but that's just what a soft fork is. Segwit introduced new rules, namely that in addition to the pre-segwit signature validation,
also the witness needs to be valid. If you take a segwit transaction and remove its witness, it is perfectly valid under the old rules and will be accepted by old nodes. But it won't be accepted (without the witness) by nodes following segwit rules. In other words, if you were to build a block of segwit transactions without the witness data, then old nodes would accept the block while new nodes would reject it. That's exactly what a soft fork is.
The reason why that is useful (and thus why a soft fork is better than a hard fork) is because this allows nodes and wallets running according to the old rules to remain working, since they will accept anything that used to be valid before. (Just their security might be reduced to SPV level.) But if you do a soft fork and miners also do not upgrade, then yes, you get a chain fork. (Which is why there were things like BIP9 signalling required from a majority of nodes.