seal_settlement committed a bare `measured_uj: u64` into the coupling
record — "the measured joules" — with a doc rule that a host must not
pass an estimate there. Nothing enforced it, and the pay example passed
a literal 5_812, no meter and no compute.
The record now carries the grade with the figure: seal_settlement,
coupling_record and coupling_id take an Energy, and the record holds
joules_uj, energy_provenance and energy_coverage. A figure is committed
at the grade its meter gave it; one whose grade does not hold together
(HwShunt with no measured figure, Estimator with one) is committed as an
estimate. This makes the rule structural and lets a host with only an
estimate seal an honest settlement, where refusing would leave it none.
No conformance vector pins the record (none exists for x402), so no
vector changes; the receipt's own cost stays the Estimator zero.
pay now runs a small fixed workload as the paid compute, meters it with
jcp_energy::Meter::detect, and seals and prints the figure at its grade
(here: ProcessEnergy rung, 103,971 µJ [HwShunt]); the tx hash is labelled
illustrative.
Tests: the_coupling_record_carries_the_figures_grade (grades, coverage,
a forged HwShunt committed as Estimator); the settlement test now also
checks the same joules at another grade, or partial, give another id.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
3844e05974