[jbeda]

Summary

Closes #2598. Automatic/durable admission and replay are deferred to #2599. This fix is independent of the /reflections UI work in #2595.

Manual synchronous /reflect could select evidence under its selection budget but then reject it before a model call: retained-input accounting, serialized projection overhead, and reflector-specific byte/count limits did not agree. The client surfaced this as “reflection service is unavailable.”

• Preflight synchronous manual input against retained-input bounds, the serialized projection, and the real reflector's existing exact-request validation.
• Reselect complete evidence units with a smaller budget until the request fits; preserve tool-call/result pairing and source coordinates/digests.
• Add comparison memories only while they fit, without displacing evidence. Omit optional stored facts that are ineligible under learning's stricter content/size rules, without modifying the memory store; continue to later valid facts. Return the existing bounded abstention if no valid evidence selection fits; preserve genuine validation/provider/event-source failures.
• Keep automatic and durable/queued admission, coordinator behavior, model routing, and all configured limits unchanged. No blanket change to error wording or wire error mappings.

Regression coverage uses the real EvidenceReflector with offline mock providers: raw/escaped-JSON size failures, smaller-selection success, event/fact count limits, optional memory bytes, no-fit/no-provider abstention, source identity/pairing, genuine failures, and isolation from automatic/durable paths. Initial first-pass production candidates are explicitly demonstrated to fail before the smaller accepted request succeeds.

Verification

All passed on the final reviewed candidate:

• task lint
• task test
• task test:race
• go run ./cmd/mecademo — tool call, permission ask/approval, and final result verified
• task build
• Focused reflection regressions/integration and race checks
• git diff --check

Final qualification ran sequentially in the foreground using system temporary storage. Earlier managed-temp attempts encountered disappearing build files and overlong Unix-socket paths; those failed receipts were retained and are not counted as passes.

Review has no remaining findings within the explicitly agreed synchronous-only scope. Automatic/durable paths retain baseline behavior, including the separately tracked limitations in #2599.

API compatibility

Backward-compatible bug fix restoring bounded manual synchronous selection. Existing RPCs/fields, authorization, response/abstention vocabulary, wire error mappings, exported Go APIs, and stored evidence/data formats are unchanged. No API major or feature changes, dependency-pin changes, client migration, or coordinated upgrade is required.