### Energy acquisition — the receipts wai-rs and wai-quantum seal can carry their class; meter windows open from rest

- [`extensions/energy-measurement.md`] §2.8: the world-session, film and reel,
  haptic, score, 4D-splat, audio-scene, ternary-reconstruction and
  provenance-step receipts, and every `wai-quantum` receipt, carry the
  acquisition class as an **optional signed label**. Absent, a receipt's signed
  bytes, identity hash and JSON are exactly the legacy ones, and the figure is
  unlabelled: accepted as legacy, never read as any class. Present, the signing
  domain's version byte becomes `0x02` and the class's §2.7 encoding follows
  the figure it labels, inside the signature. A label is refused as legacy
  `HwShunt`, beside a zero figure, or as a refined class without its evidence.
  Provenance labels each step, and a quantum bill of materials each entry.
- **Wire:** unlabelled receipts are unchanged; tests pin one receipt of every
  family to the bytes it had before the label existed, and every committed
  conformance corpus still verifies. JSON evidence fields are now
  `energy_`-prefixed (`energy_counter_filtering`, `energy_calibration_ref`) in
  every snake_case carrier, including the rendered `wai.video.int_motion`
  receipt: a quantum job receipt already renders `calibration_ref` for the
  calibration receipt it ran under. §2.7 now fixes every field name.
- §2.9: IOReport is classed `OnChipCounter` — the silicon's own reading, whose
  undisclosed derivation is part of the systematic error an `OnChipCounter`
  declaration already excludes. The section lists the documents elsewhere in
  the repository that class IOReport as `ModelBased` or `Estimator`, which this
  revision does not change.
- §2.3 and §3: the completion-count error depends on how the burst window
  opens. The reference meters read the count the moment their workers started,
  with no barrier, so the count read low by about `N/2` and every per-unit
  figure read **high** by about `N/(2C)` — the symmetric model did not describe
  it. Workers are now held at a start barrier and released as the window opens:
  the work lies in `[C, C + N)`, the figure divides by `C + N/2`, and the
  declared term is `N / (√3 · (2C + N))`. The window-opening mode is part of
  what a published figure reports.
- §2.3: a declaration describes the figure as sealed, and `joules_micro` is a
  whole number of microjoules, so the declaration includes the figure's own
  resolution: `0.5/√3` µJ for an estimate rounded to the nearest microjoule,
  `1/√6` µJ for the difference of two whole-microjoule register readings. The
  measurement's own terms are carried across in microjoules and the sum is
  divided by the figure sealed. A 0.563 µJ estimate measured to 1.54 % is
  sealed as `1` and declared 28.9 %. Every verifier refuses a hardware class
  with `joules_micro × relative_ppm < 288 676`, a declaration smaller than the
  integer's own rounding. The receipts built on `energy_class`, every
  optional-label family, the `wai-quantum` labels and the C2PA energy binding
  (bound or parsed) apply that check.
- §2.8: `quantum_energy::MaybeLabelled` parses and verifies a quantum receipt
  in whichever form it arrives. It takes the form from the JSON and refuses a
  malformed label rather than reading the receipt as unlabelled. The
  `wai-quantum verify` CLI and the HTTP handler's `POST /verify` use it, so the
  labelled receipt `wai_quantum_meter` emits for a measured figure verifies on
  both, and both restate the class. `MaybeLabelled::verify_against_calibration`
  checks a job's link to a calibration in either form, by the identity of the
  form the calibration is in; the `wai-web` job demo accepts a labelled
  calibration the same way.
- §2.2: the `OCMF` example now names what the regime rests on (a
  conformity-assessed, legally verified measuring system, not a calibration
  certificate); `OnChipCounter` is defined to cover any instrument whose
  uncertainty is not traceable, and the class is stated not to record where
  the sensor sits. §2.1 names the GREEN draft and its revision. §2 places the
  three-name mapping rule on producers. [`extensions/energy-binding.md`] and
  [`extensions/moq-streaming-format.md`] say "refined hardware class" where
  they meant it, so legacy `HwShunt` is not read as missing its evidence.
- Reference implementation: `energy_class` gains the label rules
  (`labelled_domain`, `write_label`, `check_label`, the JSON helpers) and the
  window-opening model (`CompletionCount`, `WindowOpening`). Each `wai-rs`
  family gains an `energy_provenance` field and `with_energy_class()`, which
  re-signs with the receipt's own key; `ProvStep` gains the same.
  `wai-quantum` adds `quantum_energy` without changing any existing type:
  `Labelled<R>` and `LabelledQbom` re-sign a sealed receipt over the labelled
  payload, and the inner receipt's own `verify()` refuses the result, so a
  reader unaware of labels fails closed. The new `energy_burst` module runs §3
  once for every meter; `wai_meter`, `wai_world_meter`, `wai_quantum_meter`,
  `wai_prov` and `wai_video_meter` now seal `OnChipCounter` with a declared
  uncertainty only when §4 and §2.3 allow, and seal unmetered otherwise. The
  world and quantum meters no longer count in batches, and the reported
  standard deviations are the sample ones the declared uncertainty uses. Each
  meter prints the resolution term and, when it seals unmetered, why.
- **Rust API (`wai`):** the receipt structs of the families above gain a
  public field, and `per_unit_relative_uncertainty` takes a `CompletionCount`.
  `wai_meter`, `wai_world_meter` and `wai_prov` now emit an unmetered receipt
  instead of exiting when no power reader is present.
- CI: a new `wai-energy-receipts.yml` runs the video/energy features, the
  label and pin tests of every family, `wai-quantum`'s own tests and the HTTP
  handler's verify test, on x86_64 and arm64. It builds four of the five
  reference meters (`wai_video_meter`, `wai_meter`, `wai_world_meter`,
  `wai_quantum_meter`). It does not build `wai_prov`, which needs the `codecs`
  feature (system libjxl); no workflow enables that feature. `wai-conformance.yml` now
  also triggers on `wai-quantum` changes, which its quantum corpora depend on.
- §2 and §2.8 now say what is enforced. The verifier rules are: a label is
  checked wherever one is present, and a receipt defined with a class from the
  start is refused when it carries a non-zero figure without one. Labelling a
  new figure in an optional-label family is a **SHOULD**, where it was a
  **MUST** that nothing checked and the reference implementation did not
  meet. An unlabelled figure sealed today has the bytes of an issued one, so
  no verifier can tell them apart. The reference implementation does not hold
  its producers to the rule either: in these families no constructor takes
  the class, and a label is added afterwards, by re-signing, or for a
  provenance step before its receipt is built. §2.8 says how a library could
  hold its callers to it: a labelled constructor, with the unlabelled path
  kept only for recreating issued receipts and deprecated, as `HwShunt` is.
  The reference implementation has not done that.
  The reference meters label every non-zero figure they seal. §2.8 names the
  two producers that do not: `world_model::frame_receipt`, which is not told
  its caller's classes, and the `wai-web` demos, which seal illustrative
  figures. It also says why a corpus generator that recreates a committed
  corpus, such as `wai_quantum_ops_vectors gen`, is not counted: every
  committed corpus predates the label.
- [`extensions/energy-measurement.md`] §1 states its scope: every receipt
  profile WAI defines that carries an energy figure, a list that is not
  closed. An OER/2 receipt is outside it. Its members are fixed, it has no
  member for the class, and its evidential axis is the grade. No rule of the
  extension binds an OER receipt or its producers and verifiers, so an OER
  receipt with a non-zero figure and no class breaks none, and the §4
  publication gate and §6 reporting contract do not reach it either. Only §2's
  rule for carrying a WAI figure into a three-name vocabulary reaches past the
  governed receipts. §1 also records that two receipts WAI defines fall short
  of §2: the JWP group receipt, which signs a non-zero `joules_total`, and the
  JWP object receipt, which carries `joules_micro`. Neither has a member for
  the class. Where a `WAI_RECEIPT` property accompanies an object over MoQ,
  the object's class travels in it, but no signature covers that property, so
  it falls short too. Nothing carries a class for a group total, and §2.8's
  rule that a total carries no class of its own does not cover it, because a
  group's parts are labelled outside the group receipt, if at all. Giving
  these a signed place for the class remains open.
  [`extensions/jwp-receipts.md`] §2.4.1 points to this from `joules_total`.
  [`extensions/interactive-worlds.md`] §8 now names the session receipt's own
  signing domain, `wai:world-receipt\x01`, which the reference engine already
  used.
- §2.6 says that the `wai.video.int_motion` and `wai.video.*` OTT constructors
  accept `HwShunt`, so that issued receipts can be recreated, and that nothing
  in them refuses it. The variant's deprecation warning reaches only code that
  names it; a class parsed from its label can be `HwShunt` without one. No
  producer in the reference implementation emits it.
- The resolution floor is stated as enforced: a declaration must reach the
  `0.5/√3` µJ (≈ 0.289 µJ) that rounding the figure to whole microjoules adds,
  `joules_micro × relative_ppm ≥ 288 676`. `SPEC.md`, the `wai-quantum`
  README, both crates' `BelowResolution` messages and several doc comments
  called it a 1 µJ floor, which is stricter than the rule verified.
  [`extensions/energy-binding.md`] §4 now states the floor, which `bind()`,
  `from_json()` and C2PA `recover()` already applied. The `energy_class` and
  `quantum_energy` docs say what the floor is: the rounding term every
  whole-microjoule figure carries. A figure read as a register delta carries
  the larger `1/√6` µJ, which its producer must declare and no verifier
  checks.
- [`extensions/oer-receipts.md`] §2 maps the evidential grade onto the refined
  classes: `CalibratedInstrument` and `OnChipCounter` support `measured`, and
  so does legacy `HwShunt`, for a figure sealed before the refinement or a
  refined figure mapped into the three-name vocabulary. Neither an OER/2
  receipt's `provenance.device` nor its `energy.method` names a class. The OER
  wire format, vectors and verifiers are unchanged.
- Not yet covered: the in-browser demos of `wai-web` that seal into an
  optional-label family seal illustrative figures, fixed in code or passed in
  by the page, without a label, and the OTT manifest demo labels a
  page-supplied figure `ModelBased`. The honest class of an illustrative
  constant is `Estimator`. The `ModelBased` and
  `Estimator` classes still carry no declared uncertainty.

