### Energy acquisition — on-chip counters and calibrated instruments are separate classes

- [`extensions/energy-measurement.md`] §2 refines the hardware class. `HwShunt`
  covered both a counter the measured silicon keeps about itself (RAPL, NVML,
  SMC, IOReport) and an external meter, although only the second can carry an
  uncertainty traceable to a calibration. It is now two classes:
  `OnChipCounter` and `CalibratedInstrument`. Each **must** carry a declared
  uncertainty: a standard (k = 1) relative uncertainty in ppm plus the
  integration window it holds over. The counter records whether its output
  was filtered (`On` / `Off` / `Unknown`; RAPL energy filtering per
  INTEL-SA-00389), and the instrument records a reference to its calibration
  certificate. For an on-chip counter the declaration covers only what the
  implementation could evaluate, never the counter's own systematic error, so
  it is not a total-error statement.
- §2.1 keeps the declared uncertainty and the GREEN `data-source-accuracy`
  graded bands apart. A band bounds one device reading, while a declared
  uncertainty is a standard uncertainty about a per-object marginal figure. A
  band is never declared as a figure's uncertainty, and a declared uncertainty
  is never used to select a band.
- §2.3 and §3: a per-unit figure from the bracketed protocol declares the
  bracket's statistical term combined with a completion-count term,
  `N / (√3 · C)` for `N` workers and `C` counted completions. Up to `N`
  reconstructions are part-done at each edge of the window, and the count
  cannot see them. The thread count is now part of what a published figure
  must report.
- **Wire:** new signing tags `4` (`OnChipCounter`) and `5`
  (`CalibratedInstrument`), each followed by its evidence (§2.7). Tags `0`–`3`
  are unchanged and followed by nothing, so every receipt sealed with `HwShunt`,
  `ModelBased` or `Estimator` keeps its exact signed bytes and verifies as
  before. Tests pin those bytes. `HwShunt` is accepted when read, means
  "hardware, sub-class unspecified, no declared uncertainty", ranks below both
  refinements, and must not be emitted. JSON carriers (the C2PA companion
  assertion, the rendered int_motion receipt) add evidence fields only for the
  refined classes, so legacy bodies are byte-identical.
- Reference implementation: the new `energy_class` module is the one definition
  shared by `energy_binding`, `c2pa_emit`, `video_receipt` and the
  `wai.video.*` receipts. `verify()` and C2PA `recover()` reject a hardware
  class that lacks its uncertainty. `CounterMeter` emits `OnChipCounter` with
  the window it measured, declaring its configured relative uncertainty
  combined with the register delta's resolution term, `1/√6` µJ, so a short span declares
  more than the configured figure. `wai_video_meter` declares the bracket's statistical
  (Type A) term combined with the completion-count term, and emits an
  unmetered receipt when no decode completed in the window, where it used to
  count one.
- The receipt families that sealed `joules_micro` before the class existed now
  carry it as an optional label; see the next section.

