diff --git a/Makefile b/Makefile
index 430744f..4bffde1 100644
--- a/Makefile
+++ b/Makefile
@@ -37,7 +37,7 @@ SEARCH_Q     ?= computer
         prometheus-trigger-probe bench-5f-threshold-calibration \
         bench-5f-selfmodel-snapshot bench-5f-finetuning-shardchain \
         bench-5f-falsification-hard bench-fork-baseline-hard bench-5f-formulate-hard \
-        bootstrap-math bootstrap-nli bootstrap-nli-only bench-nli-shadow export-nli-onnx bench-nli-backends judge-self-test control-ab control-sweep clean clean-db clean-data help \
+        bootstrap-math bootstrap-nli bootstrap-nli-only bench-nli-shadow export-nli-onnx bench-nli-backends judge-self-test control-ab control-sweep rapl-access rapl-access-revoke clean clean-db clean-data help \
         textbooks-summary textbooks-urls fetch-textbooks textbooks-stats textbooks-verify \
         crawl-textbooks crawl-textbooks-stats textbook textbook-list
 
@@ -1215,6 +1215,39 @@ BENCH_DIR  := /tmp/arborist-bench
 bench: bootstrap fetch-cur ## benchmark serial vs parallel-shared vs attached at $(BENCH_DOCS) docs
 	@bash bench/run.sh $(BENCH_DOCS)
 
+# --- GPU/CPU wattage benchmark (#000057 cost axis) ---------------------------
+# RAPL CPU-energy counters (/sys/class/powercap/intel-rapl:*/energy_uj) are
+# root-only by default (the PLATYPUS side-channel mitigation, CVE-2020-8694),
+# so bench/watt_bench.py reads null CPU watts without this. GPU watts via
+# nvidia-smi need no special perm. Run ONCE per GPU box AS ROOT:
+#     sudo make rapl-access
+# Installs a udev rule that makes energy_uj world-readable on every powercap
+# add event (survives reboot), and applies it immediately so no reboot is
+# needed. Idempotent. Reverse with `sudo make rapl-access-revoke`.
+RAPL_UDEV_RULE := /etc/udev/rules.d/99-rapl-readable.rules
+rapl-access: ## [root] make Intel RAPL energy_uj readable for watt_bench CPU power
+	@test "$$(id -u)" = "0" || { echo "run as root: sudo make rapl-access"; exit 1; }
+	@printf '%s\n' \
+	  '# arborist #000057 — let bench/watt_bench.py read CPU package energy.' \
+	  '# RAPL energy_uj is root-only by default (PLATYPUS/CVE-2020-8694).' \
+	  'SUBSYSTEM=="powercap", ACTION=="add", RUN+="/bin/sh -c '\''chmod a+r /sys/class/powercap/%k/energy_uj 2>/dev/null || true'\''"' \
+	  > $(RAPL_UDEV_RULE)
+	udevadm control --reload-rules
+	@# apply now so a reboot isn't required
+	@for f in /sys/class/powercap/intel-rapl:*/energy_uj; do \
+	  [ -e "$$f" ] && chmod a+r "$$f" && echo "readable: $$f"; \
+	done
+	@echo "RAPL access installed. Verify: cat /sys/class/powercap/intel-rapl:0/energy_uj"
+
+rapl-access-revoke: ## [root] remove the RAPL read-access udev rule
+	@test "$$(id -u)" = "0" || { echo "run as root: sudo make rapl-access-revoke"; exit 1; }
+	rm -f $(RAPL_UDEV_RULE)
+	udevadm control --reload-rules
+	@for f in /sys/class/powercap/intel-rapl:*/energy_uj; do \
+	  [ -e "$$f" ] && chmod 400 "$$f"; \
+	done
+	@echo "RAPL access revoked (energy_uj back to root-only on next add; reset to 400 now)."
+
 clean: ## remove venv + caches (keeps fetched data and db)
 	rm -rf $(VENV) .pytest_cache **/__pycache__ arborist.egg-info
 	find . -type d -name __pycache__ -prune -exec rm -rf {} +