[baron]

Fixes #1326

Root cause

Completed tool cards retain full raw results in a session-owned, in-memory map after their source rows become sanitized summaries. Rebuilding that map from the summary rows loses the full result.

The original save-time repair and retention-reconciliation setters did that rebuild. Adversarial review also identified earlier in-place commits: mutateItemsBatch at assistant/reasoning tool boundaries and terminal finalization, plus Codex command-status reconciliation. Those could discard the payload before save ever ran.

Fix

• Centralize a diff-preserving payload mode in commitSourceItems: unchanged rows keep their payloads/revisions; changed or new rows are re-inspected under the existing policy before notifying consumers.
• Use that mode for batch commits, source-ID repair, pending-tool finalization repair, and Codex command-status reconciliation.
• Derive silent-setter behavior from its reason, so ordinary and specialized retention/repair entry points agree. Hydration, activation, clears, and test replacements still rebuild.
• Keep pruning against repaired live IDs unchanged; rekeyed duplicates cannot inherit another row's raw payload. Use Dictionary(_:uniquingKeysWith:) defensively rather than trapping on a broken uniqueness invariant.
• Retain the save-time compaction fix and assert that both the existing summary-only card and the row compacted by save retain their full payload and revision.

No unbounded retention or persistence-format change is introduced. Raw payloads remain memory-only; reload behavior is unchanged.

Regression evidence and validation

• Original fail-first save regressions: both branches failed only their final payload/revision assertions before the save-path fix (2 tests, 4 failures).
• Review fail-first: make dev-test FILTER='AgentRetentionCompactionTests/testAssistantToolBoundary|AgentRetentionCompactionTests/testTerminalCommitBarrier|AgentRetentionCompactionTests/testSilentRepairReasons' — all 3 tests failed only on lost payloads/revisions (10 failures). The terminal test runs the real commit barrier and verifies its ownership, terminal revision, streaming finalization, and pending-tool repair.
• make dev-test FILTER='AgentRetentionCompactionTests|AgentToolCorrelationIndexTests|AgentSessionLinkLocalInputTests' — 46 tests passed: 11 retention, 3 tool-correlation, and 32 local-input tests. Includes changed-running-result refresh, removed-row pruning, silent repair reasons, mid-run/terminal preservation, both save branches, duplicate ownership, and ordinary replacement behavior.
• make dev-swift-build PRODUCT=RepoPrompt — passed.
• Changed-files-only SwiftFormat 0.61.1 — passed.
• make dev-lint — passed.
• Mandatory preflight.sh commit and preflight.sh push safety gates — passed.
• Static Oracle review of the expanded fix — no findings.

Not run: full root suite / PR-ready lane, provider suite, release packaging, live CE MCP/UI smoke, or real-provider timing. No visible app was launched or stopped. Hosted checks are not claimed as complete.