You cannot hash an adjective.

Two honest inspectors, two different grades.

R2v3 is the certification serious refurbishing facilities actually hold. Its equipment categorization sorts cosmetic condition into nine bands using phrases like minor scratches, light scratches and scratches. The published analysis of the standard's own second draft says the quiet part out loud: those terms "do not have well-defined status."

So a commitment scheme built on "Used Good, I'd say" commits to nothing. Both parties can seal a grade, reveal it, and still be describing different machines. The cryptography is sound and the input is mush.

What this does not fix

It does not make grading objective. Someone still decides whether that mark is a scratch or a smudge, and whether it is 9mm or 11mm. What changes is that the remaining judgement calls become individually contestable instead of bundled into one unfalsifiable letter, and a dispute becomes answerable with a ruler instead of an argument. That is a real improvement and it is not the same thing as objectivity. Section 9 is the honest list of what is still unresolved.

66 fields, and nothing outside the registry.

The registry is hashed into rubric_hash, so the sheet in the inspector's hand is provably the sheet the grade was derived from. Two field classes, and the distinction is not cosmetic — it decides what happens when two parties disagree.

3.1 Measurement conditions

Counts are not reproducible unless the conditions are fixed.

Ambient

≈500 lux diffuse, no direct specular source

Distance

50 cm, unaided vision, corrective lenses permitted

Chassis

Unpowered; lid closed for the top surface, 90° for the interior

Display

Powered, full-white then full-black field

Dents

Widest dimension of the deformation, not the discoloration around it

Scratches

Longest continuous run; one crossing a seam counts once

Hinge play

Lid at 90°, deflection at the top edge under light pressure

A defect qualifying at more than one threshold is counted at every threshold it meets. A 30mm scratch increments both scratches_ge_10mm and scratches_ge_25mm.

3.2 Registry

The tol column is the largest difference between two independent observers the rubric will treat as two careful people looking at the same unit. It is not a claim that differences inside it are meaningless. Class M fields have no tolerance.

SMART indicators disqualify. They do not score.

Backblaze's analysis of its own drive fleet identifies five SMART attributes that actually correlate with impending failure: 5, 187, 188, 197 and 198. A non-zero value in any of the five caps the unit at F3.

Battery health is full_charge_mwh / design_mwh as an integer percentage, rounded half-up — the same rounding the price protocol uses, for the same reason. Below 90% the unit cannot hold F6. A unit with no battery is not penalised: the field reports null, which is not zero.

Hardware is matched to the workload. Protection is not.

That sentence is only true if it is enforced, so three conditions apply identically at Tier A and Tier D. Fail any one and the unit routes to recovery regardless of everything else. The test suite asserts this at every tier rather than asserting it in prose.

• sanitization verified
• full-disk encryption enabled
• a vendor-supported operating system available

What descends the cascade is the consequence of compromise, never the standard of defence. A child's homework machine has no corporate credentials and no lateral path into an enterprise network. It does not have weaker encryption.

Cosmetic condition does not choose a tier — C3 and C6 place identically. But C1 and C2 are not descriptions of appearance. C1 is a cracked housing; C2 has critical parts missing. Those are durability findings wearing cosmetic clothing, so they gate placement where ordinary wear does not.

7.1 Machine readings are not opinions

If two parties report different values for a Class M field, that is not a disagreement about judgement. It means the device was altered between readings, the wrong unit was read, or a reading is fabricated. The round voids. Values are not averaged, toleranced, or split. This check runs first, and it voids even when the two sheets happen to derive to the same grade — because the problem is not the grade, it is that one of the two readings is not real.

7.2 Materiality — the rule that makes this usable

Two inspectors will disagree about whether that is three scratches or five. Almost always it changes nothing. So the rubric does not reconcile observations. It reconciles grades.

1. Class M conflicts → void.
2. Derive a grade from each sheet independently.
3. Same grade → the divergence is immaterial and the round proceeds. However much the counts differ.
4. Different grades → escalate only the pivotal fields: those which, substituted alone, move the grade.

Re-inspection becomes a single measurement instead of a re-run of the whole sheet. Because the cosmetic bands are conjunctive, each field crossing its own threshold flips the grade on its own — so a material divergence usually returns several independently pivotal fields rather than one.

7.3 Unresolved divergence

If re-inspection does not settle it, the conservative merge takes the worse value for every differing field, producing the lowest grade consistent with both sheets. This is not a fair-value estimate and is not presented as one. It is a deliberate tie-break against the party proposing the unit, and its purpose is to make unresolved divergence unattractive rather than to be correct. Two parties who cannot agree on what is physically in front of them should find that expensive.

7.4 Ordering: grade before price

The grade must be agreed before the price commitment window opens. Otherwise a party who can see where the price is heading has a reason to shade their observations toward it.

1. 1observeboth parties fill the sheet independently
2. 2commitSHA-256 over each sheet plus a nonce
3. 3revealboth sheets open
4. 4reconcilevoid / immaterial / material
5. 5publishgrade_token fixed and published
6. 6price commitSCDA1 begins; policy_hash binds the grade_token
7. 7price revealsettlement per the protocol spec

Steps 1–5 are this document. Steps 6–7 are the Dual Attestation Protocol. The grade_token commits over the observations and the rubric, not the derived letters — because the derivation is deterministic and published, anyone holding the sheet can recompute the letters and check them.

What is unresolved.

Stated plainly rather than papered over.

1. The thresholds are not calibrated. 2mm, 10mm, 25mm, 90% battery, C3 as the placement floor — every one is a defensible starting point and none is an empirical finding. Until paired inspection data exists, the honest claim is "deterministic", not "accurate".
2. Inter-rater reliability is unmeasured. The entire value proposition is that two inspectors converge. That is a testable claim and it has not been tested.
3. Tolerances are guesses. ±1 dent, ±2 scratches. These should fall out of the calibration data, not out of a judgement call.
4. The rubber foot problem. R2v3 F4 requires "no missing or damaged components or parts" and draws no distinction between a rubber foot and a memory module. GV-4b drops three tiers over a piece of rubber. Inherited faithfully because diverging from the standard silently is worse than inheriting a known defect visibly. The fix breaks verbatim R2v3 compatibility, so it is a v1.1 decision.
5. Sovereign thresholds encode a point in time. "Vendor support active" and "firmware current" are true until they are not, so a unit's S grade decays without anyone touching it. There is no re-grading cadence, and a placed unit silently falling out of its tier is a real operational risk.
6. No adversarial testing. Could a sophisticated party construct a sheet that passes the materiality test while being materially wrong — diverging on many fields that are individually immaterial but jointly misleading?
7. Photographic evidence is unspecified. Nothing here says what must be photographed, at what resolution, with what scale reference, or how those images bind into the commitment.
8. S1 placement is a policy question. v1.0 refuses to place S1 units with households or children. That is the conservative call and it may be wrong — it may simply mean usable machines are destroyed. It deserves an explicit decision by someone accountable, not a default buried in a derivation function.