[wangtsiao]

Summary

Closes a narrow refinement loop: explicitly selected root-session evidence → local candidate memories → atomic undo history → real conflict-checked rollback.

• Add Native trajectoryItemIds for reviewed, idle-root selection. Freeze bounded/redacted text at admission. Automatic refinement and kernel/child requests cannot select additional history.
• Treat excerpts as untrusted data. Only bounded local memory Create edits are allowed; candidates retain source IDs, an unverified label, and escaped digest data. Ordinary consolidation cannot silently promote these candidates into skills/prompts.
• Bind model edits to the actual planning baseline. Commit entries and canonical before/after history in the same atomic state-file transaction; retain JSONL as a private, append-locked audit mirror.
• Implement rollbackId using committed inverse edits, with stale-version, duplicate, immutable-prompt and partial-write protection. Respect Plan Mode for manual requests too, and record failed application as a warning.
• Document the Prime Agent comparison, migration/retention limits and exact API contract in docs/trajectory-refinement.md. Existing refine tests were moved into separate files to keep implementation modules within the repository size limit.

Validation

• cargo test -p devo-harness: 30 passed
• cargo test -p devo-server --lib runtime::refine: 26 passed
• cargo test -p devo-server --lib refine_kernel: 1 passed
• Python test_harness_host.py: 8 passed
• cargo check -p devo-server --tests: passed
• cargo clippy -p devo-harness -p devo-server --lib --tests -- -D warnings: passed
• cargo fmt --all -- --check and git diff --check: passed
• Native schema regenerated with the repository generator

Limits

This adds the Native selection contract, not a UI picker. Redaction is best-effort and requires user review. Legacy JSONL-only records are not guessed into reversible history. Undo history is not pruned; an older binary can drop the optional history field. No live-model effectiveness benchmark, Windows crash test, or performance improvement is claimed. Full cross-platform CI is pending.