Runtime::authorize and authorize_flow put Energy::measured(0) on every
decision they return. Nothing has run at authorization, and a refusal
never runs, so the zero is exact — but nothing read it. Sealed (the
gateway seals every refusal authorize returns), each refusal's receipt
claimed a 0 µJ hardware reading of a call that never happened, and a
ledger's "all readings" floor counted it as one (SPEC §5: a figure never
claims better provenance than how it was obtained).
Every zero authorize returns now comes from `nothing_ran()`,
Energy::estimator(0). decide/charge keep the caller's cost and grade.
No pinned vector seals an authorize decision: the jcp workspace suite
(440 tests, conformance vectors included) and the downstream crates that
use the runtime (sandbox-jcp, joule-code-jcp, jouleclaw-jcp,
joule-ui-interaction, jouledesk) pass unchanged.
Test: an_authorizations_zero_is_never_a_reading drives authorize and
authorize_flow through allow, untrusted control, an ungranted action and
a spent budget: every cost is 0, Estimator, with no measured figure.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
51341edae9