@principles/host-runtime 0.10.4 → 0.12.0

package/dist/prompt-injection-budget-observation.js

@@ -0,0 +1,449 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { PROMPT_BUDGET_POLICY_VERSION, RUNTIME_V2_PRINCIPLE_BUDGET, isValidContextWindowTokens, promptBudgetCharsForContextWindow, } from '@principles/core/runtime-v2';
+import { isPromptInjectionTargetHost, } from './prompt-injection-projection.js';
+/**
+ * PRI-1017: runtime budget OBSERVATION read model over the EXISTING
+ * injection-event JSONL (`<workspaceDir>/{.pd,.state}/logs/events_<date>.jsonl`,
+ * written by the OpenClaw EventLog and the Codex/WorkBuddy shared path via
+ * appendEventLogLine).
+ *
+ * Why this exists: SPEC-PD-MODEL-AWARE-PROMPT-BUDGET-001 §6.1 forbids the
+ * actual injection from running a dynamic budget while the Console forecasts
+ * under a different fixed 2000-char budget. The console holds no live host
+ * facts, but the RUNTIME persists the resolution it actually used —
+ * `runtime_v2_prompt_activations_injected` carries budgetChars, capacity
+ * provenance and hostKind. This module reads those facts back so console
+ * surfaces forecast under the same budget the last real injection used.
+ *
+ * Honesty rules this model enforces (SPEC §6.1/§7):
+ * - An observation is a FACT ABOUT THE PAST, never a live claim: callers must
+ *   surface `observedAt`; the console labels it "most recent runtime
+ *   observation", not a current confirmation.
+ * - No logs / no budget facts ⇒ absent, never a fabricated window; the caller
+ *   keeps the honest fixed-fallback policy.
+ * - A latest observation older than RUNTIME_BUDGET_OBSERVATION_MAX_AGE_MS is
+ *   `stale` — the caller must NOT present it as the current budget.
+ * - Observations bind to ONE host: OpenClaw's window is never used for a
+ *   Codex or WorkBuddy forecast.
+ * - Untrusted input discipline: every line is parsed as `unknown` and
+ *   narrowed with typeof guards + closed-set checks; structurally invalid
+ *   lines are counted in `parseFailures` and skipped loudly, never guessed.
+ * - Events predating the model-aware policy carry no provenance fields; they
+ *   are counted as `legacyEventsSkipped` and produce NO observation — a
+ *   missing provenance field is "policy unknown", never a capacity claim.
+ * - Bounded I/O: only the newest bytes of the most recent daily files are read
+ *   (tail window), the file cap applying PER candidate log directory, so a
+ *   runaway or crafted log cannot make a Console request read an unbounded
+ *   amount of data. Only bounded budget metadata is retained and returned;
+ *   other event payloads are not cached.
+ */
+/**
+ * Candidate directories for the runtime-v2 event log, in priority order.
+ * Shared with the RuleCode telemetry collector (ERR-031: both readers derive
+ * from one list — the v1 EventLog writer emits `.state/logs`, no production
+ * code ever created `.pd/logs`).
+ */
+export const RUNTIME_V2_EVENT_LOG_CANDIDATE_DIRS = ['.pd/logs', '.state/logs'];
+/**
+ * Bounded I/O: only the most recent daily files are scanned — PER candidate
+ * log directory (`RUNTIME_V2_EVENT_LOG_CANDIDATE_DIRS`), not globally. The
+ * cap is deliberately per directory: both directories describe the same
+ * workspace's log convention and either can hold the newest event for a given
+ * host (the reader takes latest-wins ACROSS them), so a global cap would let
+ * one directory's files starve the other and drop a live host observation.
+ * Worst case per read is therefore `RUNTIME_BUDGET_OBSERVATION_MAX_FILES ×
+ * RUNTIME_V2_EVENT_LOG_CANDIDATE_DIRS.length` files (14 today) and the same
+ * count × `RUNTIME_BUDGET_OBSERVATION_MAX_FILE_BYTES` bytes (56 MiB today).
+ */
+export const RUNTIME_BUDGET_OBSERVATION_MAX_FILES = 7;
+/**
+ * Bounded I/O: per file, only the newest bytes are read. The writer appends,
+ * so the latest observation per host lives at the TAIL; a file larger than
+ * this window is tail-read and its older prefix skipped (counted in
+ * `truncatedFiles`) instead of materialising an unbounded log in the console
+ * process. 4 MiB is ~3.4x the largest real day observed on 2026-10-21
+ * (WorkBuddy 1.17 MiB, Codex 0.87 MiB, OpenClaw 0.98 MiB across 7 files).
+ */
+export const RUNTIME_BUDGET_OBSERVATION_MAX_FILE_BYTES = 4 * 1024 * 1024;
+/**
+ * Maximum age of an observation that may be presented as a CURRENT runtime
+ * fact. The runtime refreshes the observation on every prompt build, so an
+ * active workspace holds minute-old facts; beyond a day the model may have
+ * been switched and the window is no longer evidence about the present.
+ */
+export const RUNTIME_BUDGET_OBSERVATION_MAX_AGE_MS = 24 * 60 * 60 * 1000;
+/**
+ * Clock-skew allowance for event timestamps. A writer clock ahead of ours is
+ * normal; an observation further in the future is not a fact about the
+ * present and must never be selected as the current budget.
+ */
+export const RUNTIME_BUDGET_OBSERVATION_MAX_FUTURE_SKEW_MS = 5 * 60 * 1000;
+/** Upper bound on the envelope `ts` string; anything longer is not a timestamp. */
+const OBSERVED_AT_MAX_LENGTH = 64;
+/** Console-side bounded reason: a runtime observation exists but is too old. */
+export const RUNTIME_BUDGET_OBSERVATION_STALE_REASON = 'runtime_budget_observation_stale';
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function nonEmptyString(value) {
+    return typeof value === 'string' && value.length > 0 ? value : undefined;
+}
+/** Windows paths are case-insensitive; compare them the way the OS does. */
+function sameWorkspacePath(left, right) {
+    const resolvedLeft = path.resolve(left);
+    const resolvedRight = path.resolve(right);
+    return process.platform === 'win32'
+        ? resolvedLeft.toLowerCase() === resolvedRight.toLowerCase()
+        : resolvedLeft === resolvedRight;
+}
+function parseObservedAt(value) {
+    if (value.length > OBSERVED_AT_MAX_LENGTH)
+        return null;
+    const parsed = Date.parse(value);
+    return Number.isFinite(parsed) ? parsed : null;
+}
+const BUDGET_CAPACITY_SOURCES = new Set([
+    'host_effective_window',
+    'pi_catalog_exact',
+    'legacy_fallback',
+]);
+const BUDGET_CAPACITY_STATUSES = new Set(['confirmed', 'unknown']);
+const BUDGET_FALLBACK_REASONS = new Set([
+    'host_capacity_absent',
+    'host_capacity_source_untrusted',
+    'host_capacity_invalid_value',
+    'catalog_unavailable',
+    'model_identity_absent',
+    'catalog_no_exact_match',
+    'catalog_no_match_for_model_id',
+    'catalog_ambiguous_model_id',
+    'catalog_provider_absent',
+    'catalog_metadata_invalid',
+]);
+function isBudgetFallbackReason(value) {
+    return typeof value === 'string' && BUDGET_FALLBACK_REASONS.has(value);
+}
+/**
+ * Narrow one untrusted event line into an observation, or null when it does
+ * not carry a trustworthy model-aware budget fact. rc-1/rc-2: every field is
+ * guarded; a structurally valid event missing provenance is NOT an
+ * observation (see `legacyEventsSkipped` at the report level).
+ */
+function narrowObservation(parsed, workspaceDir, nowMs) {
+    if (!isRecord(parsed))
+        return null;
+    if (nonEmptyString(parsed.type) !== 'runtime_v2_prompt_activations_injected')
+        return null;
+    const observedAt = nonEmptyString(parsed.ts);
+    const { data } = parsed;
+    if (observedAt === undefined || !isRecord(data))
+        return null;
+    const observedAtMs = parseObservedAt(observedAt);
+    if (observedAtMs === null)
+        return null;
+    // A timestamp beyond minor clock skew is not a fact about the present; it
+    // must not win the "latest observation" race or back a current forecast.
+    if (observedAtMs - nowMs > RUNTIME_BUDGET_OBSERVATION_MAX_FUTURE_SKEW_MS)
+        return null;
+    // Workspace binding: the console model is workspace-scoped, so an event
+    // recorded under a different workspaceDir is not this workspace's fact.
+    const eventWorkspaceDir = nonEmptyString(data.workspaceDir);
+    if (eventWorkspaceDir === undefined || !sameWorkspacePath(eventWorkspaceDir, workspaceDir))
+        return null;
+    const rawHostKind = data.hostKind;
+    if (!isPromptInjectionTargetHost(rawHostKind))
+        return null;
+    const { budget } = data;
+    if (typeof budget !== 'number' || !Number.isInteger(budget) || budget <= 0)
+        return null;
+    // A budget computed under another policy version is not evidence about the
+    // CURRENT formula. Absent provenance is pre-policy, not "current by
+    // default": both are skipped, never reinterpreted.
+    if (data.budgetPolicyVersion !== PROMPT_BUDGET_POLICY_VERSION)
+        return null;
+    const rawSource = data.budgetCapacitySource;
+    const rawStatus = data.budgetCapacityStatus;
+    if (typeof rawSource !== 'string' || !BUDGET_CAPACITY_SOURCES.has(rawSource))
+        return null;
+    if (typeof rawStatus !== 'string' || !BUDGET_CAPACITY_STATUSES.has(rawStatus))
+        return null;
+    const rawWindow = data.budgetContextWindowTokens;
+    const rawReason = data.budgetFallbackReason;
+    if (rawReason !== undefined && !isBudgetFallbackReason(rawReason))
+        return null;
+    // Source/status/window/budget must describe ONE coherent resolution: a
+    // confirmed source needs a real window and exactly the budget the shared
+    // formula derives from it; the legacy fallback needs the legacy budget, no
+    // window, and a bounded reason. Anything else is not a trustworthy fact.
+    if (rawStatus === 'confirmed') {
+        if (rawSource !== 'host_effective_window' && rawSource !== 'pi_catalog_exact')
+            return null;
+        if (!isValidContextWindowTokens(rawWindow))
+            return null;
+        if (budget !== promptBudgetCharsForContextWindow(rawWindow))
+            return null;
+        if (rawReason !== undefined)
+            return null;
+    }
+    else {
+        if (rawSource !== 'legacy_fallback')
+            return null;
+        if (rawWindow !== undefined)
+            return null;
+        if (!isBudgetFallbackReason(rawReason))
+            return null;
+        if (budget !== RUNTIME_V2_PRINCIPLE_BUDGET)
+            return null;
+    }
+    return {
+        workspaceDir,
+        hostKind: rawHostKind,
+        budgetChars: budget,
+        capacitySource: rawSource,
+        capacityStatus: rawStatus,
+        contextWindowTokens: rawWindow ?? null,
+        fallbackReason: rawReason ?? null,
+        policyVersion: PROMPT_BUDGET_POLICY_VERSION,
+        observedAt,
+    };
+}
+/**
+ * Read at most the newest `RUNTIME_BUDGET_OBSERVATION_MAX_FILE_BYTES` of a
+ * log file. When the prefix is skipped, the partial first line after the cut
+ * is dropped so a half-written JSON line can never be parsed. Returns null
+ * when the file cannot be opened/read (the caller skips it loudly elsewhere).
+ */
+function readBoundedLogText(filePath) {
+    let fd;
+    try {
+        fd = fs.openSync(filePath, 'r');
+    }
+    catch {
+        return null;
+    }
+    try {
+        const { size } = fs.fstatSync(fd);
+        const start = Math.max(0, size - RUNTIME_BUDGET_OBSERVATION_MAX_FILE_BYTES);
+        const length = size - start;
+        if (length <= 0)
+            return { text: '', truncated: false };
+        const buffer = Buffer.allocUnsafe(length);
+        let offset = 0;
+        while (offset < length) {
+            const read = fs.readSync(fd, buffer, offset, length - offset, start + offset);
+            if (read <= 0)
+                break;
+            offset += read;
+        }
+        let text = buffer.subarray(0, offset).toString('utf8');
+        if (start > 0) {
+            const newline = text.indexOf('\n');
+            text = newline === -1 ? '' : text.slice(newline + 1);
+        }
+        return { text, truncated: start > 0 };
+    }
+    catch {
+        return null;
+    }
+    finally {
+        try {
+            fs.closeSync(fd);
+        }
+        catch { /* fd already closed */ }
+    }
+}
+/**
+ * Read the most recent budget observation per host from the workspace's
+ * runtime-v2 event logs. Never throws: an unreadable log directory degrades
+ * to an empty report with an explicit note (absence is UNKNOWN, not zero).
+ */
+export function readRuntimePromptBudgetObservations(input) {
+    const { workspaceDir } = input;
+    const nowMs = (input.now ?? new Date()).getTime();
+    const filesRead = [];
+    const lines = { count: 0 };
+    const parseFailures = { count: 0 };
+    const legacyEventsSkipped = { count: 0 };
+    const foreignPolicyEventsSkipped = { count: 0 };
+    const truncatedFiles = { count: 0 };
+    const latest = new Map();
+    for (const candidate of RUNTIME_V2_EVENT_LOG_CANDIDATE_DIRS) {
+        const logsRoot = path.resolve(workspaceDir, ...candidate.split('/'));
+        if (!fs.existsSync(logsRoot))
+            continue;
+        let canonicalRoot;
+        try {
+            canonicalRoot = fs.realpathSync(logsRoot);
+        }
+        catch {
+            continue;
+        }
+        let names;
+        try {
+            names = fs.readdirSync(logsRoot)
+                .filter((name) => name.startsWith('events_') && name.endsWith('.jsonl'))
+                .sort()
+                .slice(-RUNTIME_BUDGET_OBSERVATION_MAX_FILES);
+        }
+        catch {
+            // Unreadable directory contributes nothing; the note stays explicit.
+            continue;
+        }
+        for (const name of names) {
+            // Containment guard: only bare event filenames inside the resolved
+            // logs root are ever read — a crafted name cannot escape the directory.
+            // Canonicalize BOTH sides so an in-logs symlink cannot redirect the
+            // read outside the workspace log directory (EP-08).
+            const filePath = path.resolve(logsRoot, name);
+            if (!filePath.startsWith(logsRoot + path.sep) || path.basename(name) !== name)
+                continue;
+            let canonicalFile;
+            try {
+                canonicalFile = fs.realpathSync(filePath);
+            }
+            catch {
+                continue;
+            }
+            if (!canonicalFile.startsWith(canonicalRoot + path.sep))
+                continue;
+            filesRead.push(canonicalFile);
+            const bounded = readBoundedLogText(canonicalFile);
+            if (bounded === null)
+                continue;
+            if (bounded.truncated)
+                truncatedFiles.count += 1;
+            for (const line of bounded.text.split('\n')) {
+                if (line.trim().length === 0)
+                    continue;
+                lines.count += 1;
+                let parsed;
+                try {
+                    parsed = JSON.parse(line);
+                }
+                catch {
+                    parseFailures.count += 1;
+                    continue;
+                }
+                if (isRecord(parsed) && parsed.type === 'runtime_v2_prompt_activations_injected' && isRecord(parsed.data)) {
+                    const { data } = parsed;
+                    const rawPolicyVersion = data.budgetPolicyVersion;
+                    if (rawPolicyVersion !== undefined && rawPolicyVersion !== PROMPT_BUDGET_POLICY_VERSION) {
+                        // A budget computed under a DIFFERENT policy version is not
+                        // evidence about the current formula — counted, not reinterpreted.
+                        foreignPolicyEventsSkipped.count += 1;
+                        continue;
+                    }
+                    const observation = narrowObservation(parsed, workspaceDir, nowMs);
+                    if (observation === null) {
+                        // A pre-policy event, a future/invalid timestamp, incoherent
+                        // provenance or an unusable binding — counted, never guessed.
+                        legacyEventsSkipped.count += 1;
+                        continue;
+                    }
+                    const previous = latest.get(observation.hostKind);
+                    // Compare PARSED instants, not strings: a longer/invalid timestamp
+                    // must not shadow a real observation lexicographically.
+                    if (previous === undefined || Date.parse(observation.observedAt) > Date.parse(previous.observedAt)) {
+                        latest.set(observation.hostKind, observation);
+                    }
+                    continue;
+                }
+                if (isRecord(parsed) && parsed.type === 'runtime_v2_prompt_activations_injected' && !isRecord(parsed.data)) {
+                    parseFailures.count += 1;
+                }
+            }
+        }
+    }
+    return {
+        observations: [...latest.values()],
+        filesRead,
+        lines: lines.count,
+        parseFailures: parseFailures.count,
+        legacyEventsSkipped: legacyEventsSkipped.count,
+        foreignPolicyEventsSkipped: foreignPolicyEventsSkipped.count,
+        truncatedFiles: truncatedFiles.count,
+        note: 'observations are PAST runtime facts bound to one host; absence means UNKNOWN (never a fabricated window); events without model-aware budget provenance, or computed under a different policy version, are skipped, not reinterpreted; the bounded read takes the newest daily files per candidate log directory and files larger than the tail window are counted in truncatedFiles (older prefix skipped, newest event per host still inside the window)',
+    };
+}
+/** Latest-wins ordering that treats unparseable timestamps as older, not newer. */
+function compareObservedAt(left, right) {
+    const leftMs = Date.parse(left);
+    const rightMs = Date.parse(right);
+    if (!Number.isFinite(leftMs))
+        return Number.isFinite(rightMs) ? -1 : 0;
+    if (!Number.isFinite(rightMs))
+        return 1;
+    return leftMs - rightMs;
+}
+/**
+ * Select the observation that may back a console forecast for `targetHost`.
+ * `absent` when the host has no observation at all; `stale` when the latest
+ * one is older than the freshness bound (the caller must fall back honestly).
+ */
+export function selectRuntimeBudgetObservation(input) {
+    const now = input.now ?? new Date();
+    const candidates = input.targetHost === undefined
+        ? [...input.observations]
+        : input.observations.filter((observation) => observation.hostKind === input.targetHost);
+    let latest;
+    for (const candidate of candidates) {
+        if (latest === undefined || compareObservedAt(candidate.observedAt, latest.observedAt) > 0)
+            latest = candidate;
+    }
+    if (latest === undefined)
+        return { kind: 'absent' };
+    const observedAt = Date.parse(latest.observedAt);
+    if (!Number.isFinite(observedAt)
+        || observedAt - now.getTime() > RUNTIME_BUDGET_OBSERVATION_MAX_FUTURE_SKEW_MS
+        || now.getTime() - observedAt > RUNTIME_BUDGET_OBSERVATION_MAX_AGE_MS) {
+        return { kind: 'stale', observation: latest };
+    }
+    return { kind: 'usable', observation: latest };
+}
+export function selectConsoleRuntimeBudgetFacts(input) {
+    const report = readRuntimePromptBudgetObservations({ workspaceDir: input.workspaceDir, now: input.now });
+    const perHost = new Map();
+    const stalePerHost = new Map();
+    for (const observation of report.observations) {
+        const selection = selectRuntimeBudgetObservation({
+            observations: report.observations,
+            targetHost: observation.hostKind,
+            now: input.now,
+        });
+        if (selection.kind === 'usable')
+            perHost.set(observation.hostKind, selection.observation);
+        else if (selection.kind === 'stale')
+            stalePerHost.set(observation.hostKind, selection.observation);
+    }
+    if (input.targetHost === undefined) {
+        return { perHost, stalePerHost };
+    }
+    const selection = selectRuntimeBudgetObservation({
+        observations: report.observations,
+        targetHost: input.targetHost,
+        now: input.now,
+    });
+    return {
+        ...(selection.kind === 'usable' ? { selected: selection.observation } : {}),
+        ...(selection.kind === 'stale' ? { stale: selection.observation } : {}),
+        perHost,
+        stalePerHost,
+    };
+}
+/**
+ * Rebuild the budget resolution an observation stands for, so console
+ * projections run under the SAME resolution shape the real injection used.
+ * `fallbackDetail` is deliberately dropped: it is log-only context and never
+ * rides events or console payloads.
+ */
+export function runtimeBudgetObservationToResolution(observation) {
+    return {
+        budgetChars: observation.budgetChars,
+        capacitySource: observation.capacitySource,
+        capacityStatus: observation.capacityStatus,
+        contextWindowTokens: observation.contextWindowTokens,
+        policyVersion: observation.policyVersion ?? PROMPT_BUDGET_POLICY_VERSION,
+        ...(observation.fallbackReason !== null ? { fallbackReason: observation.fallbackReason } : {}),
+    };
+}

package/dist/prompt-injection-projection.d.ts

@@ -1,4 +1,4 @@
-import { type PromptSelectionPolicy } from '@principles/core/runtime-v2';
+import { type PromptBudgetResolution, type PromptSelectionPolicy } from '@principles/core/runtime-v2';
 /** Hosts with a production prompt-injection path today (shared GovernanceHostKind boundary). */
 export type PromptInjectionTargetHost = 'openclaw' | 'codex' | 'workbuddy';
 /** Single host roster (review P2): every consumer derives from this list, so a
@@ -140,6 +140,20 @@ export interface PromptInjectionProjection {
      * route (where `usedChars` already IS the full render).
      */
     fullRenderChars?: number;
+    /**
+     * SPEC-PD-MODEL-AWARE-PROMPT-BUDGET-001 §6.1/§7: provenance of `budget` —
+     * the same policy/resolution the real injection runs, so consumers can
+     * tell "runtime capacity confirmed" apart from "fixed-budget fallback"
+     * instead of assuming the forecast matches every model.
+     */
+    budgetCapacitySource?: PromptBudgetResolution['capacitySource'];
+    budgetCapacityStatus?: PromptBudgetResolution['capacityStatus'];
+    budgetContextWindowTokens?: number | null;
+    budgetPolicyVersion?: PromptBudgetResolution['policyVersion'];
+    /** SPEC §7 v0.2: bounded fallback reason code; present only on legacy_fallback. */
+    budgetFallbackReason?: PromptBudgetResolution['fallbackReason'];
+    /** Non-sensitive log context; never emitted to events. */
+    budgetFallbackDetail?: string;
 }
 /**
  * PR #1844 follow-up: forecast the prompt-injection budget from the SAME
@@ -186,6 +200,14 @@ export declare function buildLivePromptInjectionProjection(input: {
     roundKey?: number;
     /** AC-01: explicit route binding — 'codex'/'workbuddy' always shared, 'openclaw' by flag. */
     targetHost?: PromptInjectionTargetHost;
+    /**
+     * SPEC-PD-MODEL-AWARE-PROMPT-BUDGET-001 §6.1: budget resolution this
+     * projection must run under. Absent → the fixed-fallback default (the
+     * honest "no runtime capacity confirmed" policy), NOT a silent second
+     * policy. Callers holding live model facts (the plugin hook) pass the
+     * SAME resolution the injection uses.
+     */
+    promptBudget?: PromptBudgetResolution;
 }): Promise<PromptInjectionProjection>;
 /**
  * AC-01/R-A1: the host-aware entry every console/CLI consumer should use.
@@ -210,4 +232,20 @@ export declare function resolveLivePromptInjectionProjection(input: {
     targetHost?: PromptInjectionTargetHost;
     excludePrincipleIds?: ReadonlySet<string>;
     roundKey?: number;
+    /**
+     * SPEC-PD-MODEL-AWARE-PROMPT-BUDGET-001 §6.1 / PRI-1017: budget resolution
+     * the confirmed projection must run under. Console callers pass the
+     * resolution rebuilt from the workspace's most recent runtime budget
+     * OBSERVATION (`runtimeBudgetObservationToResolution`) so the forecast uses
+     * the same budget the last real injection used. Absent → the fixed-fallback
+     * default (the honest "no runtime capacity confirmed" policy).
+     */
+    promptBudget?: PromptBudgetResolution;
+    /**
+     * PRI-1017: per-host budget resolutions for the unconfirmed per-host
+     * forecasts. Each host's projection runs under THAT host's observation —
+     * never another host's window. Absent per host → that host's honest
+     * fixed-fallback default.
+     */
+    perHostPromptBudget?: Partial<Record<PromptInjectionTargetHost, PromptBudgetResolution>>;
 }): Promise<LivePromptInjectionProjectionResolution>;

package/dist/prompt-injection-projection.js

@@ -1,4 +1,4 @@
-import { RUNTIME_V2_PRINCIPLE_BUDGET, computeFeatureFlagsFromConfig, renderPrinciplesToDirectives, trimToBudget, } from '@principles/core/runtime-v2';
+import { computeFeatureFlagsFromConfig, renderPrinciplesToDirectives, resolvePromptBudget, trimToBudget, } from '@principles/core/runtime-v2';
 import { escapeXml } from '@principles/core/prompt-builder';
 import { loadPdConfigForPlugin } from './pd-config.js';
 import { buildActivePrinciplePromptContext, readPromptActivationCandidates, MAX_SHARED_DIAGNOSTIC_IDS } from './active-principle-prompt.js';
@@ -223,6 +223,7 @@ function isDiagnosticCapHit(ids) {
  * `selectionPolicy` on the result.
  */
 export async function buildLivePromptInjectionProjection(input) {
+    const promptBudget = input.promptBudget ?? resolvePromptBudget();
     const flagEnabled = computeFeatureFlagsFromConfig(loadPdConfigForPlugin(input.workspaceDir).effective).flags.abstraction_layer_v1?.enabled === true;
     // Route face follows THE one route formula (review P2-2: a re-typed
     // codex-only ternary forecast WorkBuddy as legacy_trim while its adapter
@@ -232,7 +233,7 @@ export async function buildLivePromptInjectionProjection(input) {
         ? flagEnabled
         : promptRouteForHost(input.targetHost, flagEnabled) === 'shared_render';
     if (sharedRoute) {
-        const context = await buildActivePrinciplePromptContext(input);
+        const context = await buildActivePrinciplePromptContext({ ...input, promptBudget });
         const oversized = context.oversizedActivationIds ?? [];
         const dropped = context.droppedActivationIds ?? [];
         return {
@@ -256,6 +257,12 @@ export async function buildLivePromptInjectionProjection(input) {
             droppedActivationIds: dropped,
             oversizedDiagnosticTruncated: isDiagnosticCapHit(oversized),
             droppedDiagnosticTruncated: isDiagnosticCapHit(dropped),
+            budgetCapacitySource: context.budgetCapacitySource,
+            budgetCapacityStatus: context.budgetCapacityStatus,
+            budgetContextWindowTokens: context.budgetContextWindowTokens,
+            budgetPolicyVersion: context.budgetPolicyVersion,
+            ...(context.budgetFallbackReason !== undefined ? { budgetFallbackReason: context.budgetFallbackReason } : {}),
+            ...(context.budgetFallbackDetail !== undefined ? { budgetFallbackDetail: context.budgetFallbackDetail } : {}),
         };
     }
     const candidates = await readPromptActivationCandidates(input);
@@ -263,7 +270,7 @@ export async function buildLivePromptInjectionProjection(input) {
     if (candidates.aborted || principles.length === 0) {
         return {
             route: 'legacy_trim',
-            budget: RUNTIME_V2_PRINCIPLE_BUDGET,
+            budget: promptBudget.budgetChars,
             usedChars: 0,
             truncated: false,
             injectedPrincipleIds: [],
@@ -279,11 +286,17 @@ export async function buildLivePromptInjectionProjection(input) {
             droppedActivationIds: [],
             oversizedDiagnosticTruncated: false,
             droppedDiagnosticTruncated: false,
+            budgetCapacitySource: promptBudget.capacitySource,
+            budgetCapacityStatus: promptBudget.capacityStatus,
+            budgetContextWindowTokens: promptBudget.contextWindowTokens,
+            budgetPolicyVersion: promptBudget.policyVersion,
+            ...(promptBudget.fallbackReason !== undefined ? { budgetFallbackReason: promptBudget.fallbackReason } : {}),
+            ...(promptBudget.fallbackDetail !== undefined ? { budgetFallbackDetail: promptBudget.fallbackDetail } : {}),
         };
     }
     // PR-1894: pass the caller's round key so the forecast runs the SAME
     // packing policy production runs this turn.
-    const trimmed = trimToBudget(principles, RUNTIME_V2_PRINCIPLE_BUDGET, escapeXml, input.roundKey);
+    const trimmed = trimToBudget(principles, promptBudget.budgetChars, escapeXml, input.roundKey);
     const injected = principles.filter((p) => trimmed.injectedIds.has(p.principleId));
     // PR-1894: the legacy_trim route IS the OpenClaw plugin-local route, which
     // rotates on every recorded user turn (PRI-904). Reachability is therefore
@@ -291,11 +304,11 @@ export async function buildLivePromptInjectionProjection(input) {
     // round key — a console without a session key must still be able to tell
     // "queued behind rotation" apart from "structurally starved", otherwise it
     // keeps telling the Owner to deactivate healthy principles.
-    const eventuallyInjectedActivationIds = collectReachableActivationIds(principles, RUNTIME_V2_PRINCIPLE_BUDGET);
+    const eventuallyInjectedActivationIds = collectReachableActivationIds(principles, promptBudget.budgetChars);
     const fullRenderChars = renderPrinciplesToDirectives(injected, trimmed.injectedIds, { escapeFn: escapeXml, selfReportInstruction: candidates.selfReportEnabled }).length;
     return {
         route: 'legacy_trim',
-        budget: RUNTIME_V2_PRINCIPLE_BUDGET,
+        budget: promptBudget.budgetChars,
         usedChars: trimmed.lines.join('\n').length,
         truncated: trimmed.truncated,
         injectedPrincipleIds: [...trimmed.injectedIds],
@@ -312,23 +325,44 @@ export async function buildLivePromptInjectionProjection(input) {
         oversizedDiagnosticTruncated: isDiagnosticCapHit(trimmed.oversizedActivationIds),
         droppedDiagnosticTruncated: isDiagnosticCapHit(trimmed.droppedActivationIds),
         ...(injected.length > 0 ? { fullRenderChars } : {}),
+        budgetCapacitySource: promptBudget.capacitySource,
+        budgetCapacityStatus: promptBudget.capacityStatus,
+        budgetContextWindowTokens: promptBudget.contextWindowTokens,
+        budgetPolicyVersion: promptBudget.policyVersion,
+        ...(promptBudget.fallbackReason !== undefined ? { budgetFallbackReason: promptBudget.fallbackReason } : {}),
+        ...(promptBudget.fallbackDetail !== undefined ? { budgetFallbackDetail: promptBudget.fallbackDetail } : {}),
     };
 }
 export async function resolveLivePromptInjectionProjection(input) {
-    const decision = resolvePromptInjectionRouteDecision(input);
+    const { promptBudget, perHostPromptBudget, ...projectionInput } = input;
+    const decision = resolvePromptInjectionRouteDecision(projectionInput);
     if (decision.status === 'confirmed') {
+        // PRI-1017: the route can be confirmed by WORKSPACE FACTS without any
+        // request-level targetHost (a single-host workspace). The caller then has
+        // no `promptBudget`, but it does have that host's own observation in the
+        // per-host map — use it. A flag-shared route with no hostKind stays on
+        // the honest fallback: no host was identified, so no host's window may
+        // be borrowed.
+        const decidedBudget = promptBudget
+            ?? (decision.hostKind !== undefined ? perHostPromptBudget?.[decision.hostKind] : undefined);
         const projection = await buildLivePromptInjectionProjection({
-            ...input,
+            ...projectionInput,
             targetHost: decision.hostKind,
+            ...(decidedBudget !== undefined ? { promptBudget: decidedBudget } : {}),
         });
         return { status: 'confirmed', decision, projection };
     }
     const hosts = decision.perHost?.map((entry) => entry.hostKind) ?? [...PROMPT_INJECTION_TARGET_HOSTS];
     const perHost = [];
     for (const hostKind of hosts) {
+        const hostBudget = perHostPromptBudget?.[hostKind];
         perHost.push({
             hostKind,
-            projection: await buildLivePromptInjectionProjection({ ...input, targetHost: hostKind }),
+            projection: await buildLivePromptInjectionProjection({
+                ...projectionInput,
+                targetHost: hostKind,
+                ...(hostBudget !== undefined ? { promptBudget: hostBudget } : {}),
+            }),
         });
     }
     return { status: 'unconfirmed', decision, perHost };