Tokens are measured; watt-hours are derived. Every provider call this deployment makes — the model's answer, the input and output checks, Deep safety's dissection and per-part checks, the correction rewrite and its check, discarded retries and failed calls — is recorded in the ledger with its own token counts. Watt-hours come from those tokens and published per-token figures, input and output separately: Wh = [(input − cached) × e_in + cached × e_in × k_cache + output × e_out] ÷ 1,000. Power usage effectiveness is already inside these figures and is never applied again.

Spent is every non-model call (the safety layer's cost). Saved by blocking is the plain model's answer to a harmful prompt that was never generated — which is short, because the plain model mostly refuses by itself. Concise answers, less answer bloat and fewer turns to finish the job (fewer iterations, less hallucination, less drift) come only from the Energy Suite: the same prompts and scripted tasks run through a plain and a governed arm at a fixed temperature, with deterministic checkers. Each saving owns one slice of turns, so nothing is counted twice.

The evidence gate. A saving counts only when its whole range sits above zero. If its range crosses zero it can make the net worse, never better; below its minimum sample it counts nothing; a stale suite counts only as a cost. Ranges take the extreme corners of the constants (low and high) together with a seeded bootstrap of the evidence (SplitMix64, seed 20260926, 4,000 draws, P2.5–P97.5).

Every figure here can be reproduced from the ledger alone with the recompute command under “Constants and reproduce”. The full method is docs/ENERGY.md in this release; the constants and their sources are docs/ENERGY-CONSTANTS.json.