QET Retirement: Irrevocable On-Chain Claim Substantiation

For corporate sustainability programs, ESG teams, auditors, and analyst readers researching how QET retirement works — how an environmental-attribute token is permanently removed from circulation, what the retirement record actually contains, and how it substantiates a specific reporting claim under GHG Protocol, SBTi, CSRD, IFRS S2, SB 253, or TCR — this is the lifecycle explainer for the final stage of the Quantified Emissions Token workflow. The headline: emissions token retirement on Greentruth is irrevocable on-chain, produces a machine-readable and human-readable retirement record, and structurally prevents the same token from being re-used or counted twice. And critically: it is not a carbon-credit offset retirement. The distinction matters more than any other concept on this page.

QET retirement, in one paragraph. QET retirement is the final stage of the Quantified Emissions Token lifecycle — an irrevocable on-chain transaction that anchors the token to a specific fuel- or electricity-attribute reporting claim and permanently removes it from active inventory. The retirement record is machine-readable and human-readable, stamped on the EarnDLT registry on Hedera Hashgraph with the full attribute schema, the verifier's ISO 14064-3 reasonable-assurance opinion reference, the buyer's claim identifier, and the framework-aligned export (GHG Protocol Scope 1/2/3, SBTi, CSRD ESRS E1, IFRS S2, SB 253, TCR). QET retirement is not a carbon-credit offset retirement; it is an environmental-attribute certificate retirement that substantiates a Scope 1, Scope 2 market-based, or Scope 3 Category 3 disclosure.

For the previous lifecycle stage

The closing event in the four-stage QET lifecycle (Mint → Discover → Acquire → Retire) is where the token, having been issued by a producer and acquired by a buyer, is anchored to a specific reporting claim and permanently consumed. Three properties define what makes a Greentruth-anchored closure different from a voluntary attestation or a producer-direct PDF:

• Irrevocable on-chain. Once a QET is closed, the state change is permanent. The Hedera ledger writes the event as a status transition that cannot be reversed, re-used, or rolled forward into a subsequent accounting period. No party — including the buyer, the producer, EarnDLT, or any platform administrator — can un-do it.
• Claim-anchored. The closure is not free-standing. It is bound to a specific buyer claim — a Scope 1 fossil-CO₂ reduction for a defined facility and reporting period, a Scope 2 market-based renewable-electricity disclosure, a Scope 3 Category 3 upstream-fuel disclosure under GHG Protocol's primary-data hierarchy, or an analogous framework-specific claim. The record carries the claim identifier as on-chain metadata.
• Framework-aligned at the same transaction. A single closure produces the framework-aligned exports the buyer's disclosure platform needs — GHG Protocol, SBTi, CSRD ESRS E1, IFRS S2, SB 253, TCR — as machine-readable payloads consumable by the buyer's ESG software (Watershed, Persefoni, Sweep, Workiva, or in-house GHG accounting systems).

The combination is what makes a Greentruth-anchored QET defensible under the kind of audit and regulator scrutiny that's becoming standard in 2026 and beyond. The closing event is the audit anchor; everything downstream in the buyer's disclosure flows from it.

For the full lifecycle context

The mechanical detail matters because “irrevocable” is doing real work in the integrity argument. Three layers enforce irrevocability:

Layer 1 — Hedera ledger state change. The closing transaction writes the token's status to RETIRED on the EarnDLT registry. Per the Governance Framework's status-code table, a RETIRED token is not trading-eligible and not closure-eligible (it has already been consumed). The state change is cryptographically signed and timestamped at the Hedera consensus layer; the transaction hash and timestamp are immutable.

Layer 2 — Single-mint enforcement at the registry layer. Because a specific physical unit produces exactly one token (the double-counting prevention discipline enforced at the registry layer), there is only one token to close. The closure does not “transfer” the attribute somewhere else; it consumes the only certificate that ever existed for the underlying physical unit, and consumes it against a specific buyer claim.

Layer 3 — Token ID and cohort accounting. Per Governance Framework Section 6.1.4, every closure certificate is assigned a Token ID in the format [Token type]-[Program]-[Original Batch ID]-[Number of Tokens in Original Minted Batch]/[Start Counter]-[End Counter]. For example, QET-RNG-b2605d2b-3581-4423-b6b7-da42610df62c-1000/1-300 denotes QET-RNG tokens 1 through 300 from the original 1000-token batch identified by the UUID. System-wide cohort accounting reconciles to ensure consumed counts can never exceed the verified physical input.

The combined effect: closure is not a database flag; it is a structural transition in the registry's state machine, enforced cryptographically at the ledger layer, with the cohort accounting preventing any attempt to close more than was minted.

How double counting is structurally prevented

Every closure produces a retirement record that travels with the token for the life of the buyer's disclosure cycle. The record is designed to serve two audiences with one artifact:

The machine-readable form is a structured JSON payload consumable through the Machine-Ready API. ESG software, in-house GHG accounting systems, ERP platforms, and increasingly autonomous procurement and compliance agents consume this form directly. The schema is published, versioned, and DID-compliant — so a downstream system in 2028 can re-parse a record created in 2026 without translation.

The human-readable form is a retirement certificate — a downloadable, print-ready document with the same underlying attributes formatted for human review. The certificate is the artifact an auditor opens during a SBTi target validation, a CSRD assurance engagement, a SB 253 disclosure review, or a TCR submission. It carries the same metadata as the machine form but renders it in a way that a human reviewer can verify against the buyer's claim.

The two forms reference the same underlying on-chain artifact. There is no risk of divergence between what the machine-readable export says and what the human-readable certificate says — both render the same immutable Hedera transaction. For the buyer, the practical implication is that the closing event satisfies both the structured-data needs of automated disclosure systems and the document-of-record needs of human audit review, without requiring separate workflows for each.

For the full Machine-Ready API surface

The record carries the full chain of custody — every attribute that traveled with the token from mint, plus the specific claim and disclosure metadata that closure adds. Seven elements are stamped on-chain at the closing transaction:

• The token's full attribute schema. Unit (MMBtu, MWh, kg, tonne), verified carbon intensity in kgCO₂e per unit (with CH₄ and N₂O converted via IPCC AR5 GWP100), methodology version, R&D GREET 2025 reference dataset version (for QET-NG closures), MRV tier, geography, pathway, and the verifier of record.
• The verifier's ISO 14064-3 opinion reference. The accredited ISO 14065:2020 verifier whose reasonable-assurance opinion underwrote the mint, the opinion date, the materiality threshold applied, and the lead verifier's credentials.
• The full chain of custody. Pointers to the mint event, every transfer event, and the underlying producer primary MRV data — preserved per the Governance Framework's seven-year retention requirement.
• The buyer's claim identifier. Which entity is closing the token, against which reporting period, for which facility or operational scope, under which framework (GHG Protocol, SBTi, CSRD, IFRS S2, SB 253, TCR). The claim is what makes the closure not free-standing — it binds the consumed certificate to a specific disclosure.
• The framework-aligned exports. Pre-formatted disclosure payloads ready for ingestion by the buyer's ESG software. The same closure produces every framework's export simultaneously, so the buyer is not running parallel workflows for each disclosure regime.
• The closing timestamp and registry transaction hash. The Hedera ledger transaction that recorded the event, with cryptographic signing linking the certificate to the underlying data.
• The reason for closure. A structured field documenting why the buyer is anchoring against this claim — Scope 1 fossil-CO₂ reduction, Scope 2 market-based renewable-electricity match, Scope 3 Category 3 upstream-fuel substantiation, residual neutralization at long-term net-zero target year (for QET-CCS), or analogous.

For an auditor or regulator opening the record years downstream, the document is self-contained. The provenance, the verification, the attribute claim, the disclosure framework, and the closing event itself are all preserved together as one immutable artifact.

For how retirement fits the cross-framework alignment

The substantiation logic varies by what the buyer is claiming. The major patterns:

Scope 1 fossil-CO₂ reduction (QET-RNG). When a buyer closes a QET-RNG against Scope 1 fossil-CO₂ reduction for a defined facility and reporting period, the record carries the Compliance Passport's five-point verification status (injection point, delivery point, pipeline connectivity, volumetric equivalence, temporal matching). A Fuel Attribute Documentation Certificate closure substantiates the Scope 1 reduction under SBTi Criterion C11 biogenic exclusion and GHG Protocol biogenic-reporting rules; the biogenic CO₂ from combustion is reported outside Scope 1 in the separate biogenic disclosure line.

Scope 2 market-based renewable-electricity (QET-ELEC). A QET-ELEC closure substantiates a Scope 2 market-based disclosure under the GHG Protocol Scope 2 Quality Criteria — the certificate must meet the temporal matching, geographic deliverability, and unique-instrument tests that the Scope 2 Guidance requires. The record carries the hourly-granularity attribute structure consistent with the consumption patterns major hyperscaler procurement programs contemplate.

Scope 3 Category 3 upstream-fuel disclosure (QET-NG with optional Physical Flow Certificate). A QET-NG closure substantiates a primary-data Scope 3 Category 3 disclosure for the purchased natural gas — the producer-level methane intensity travels onto the buyer's Scope 3 line, replacing default upstream factors with verified primary data. Where the QET-NG carries a Physical Flow Certificate, the closing event also substantiates EU Methane Regulation Article 28 chain-of-custody assertion.

Residual neutralization at net-zero target year (QET-CCS). A QET-CCS closure substantiates a CDR neutralization claim against the residual ≤10% of baseline at a long-term net-zero target year. The neutralization claim is reserved for the residual; it does not substitute for the abatement that should have happened upstream of the target year per SBTi CNZS.

In every case, the closing event is the audit anchor. The buyer's disclosure refers back to the on-chain record; the record refers back to the mint; the mint refers back to the verifier's ISO 14064-3 opinion and the producer's primary data. The full chain is on-chain.

GHG Protocol Scope 3 Standard

GHG Protocol Scope 2 Quality Criteria

Double-counting prevention operates at three points in the lifecycle, and the closing event is the third and most consequential. The earlier two — single-mint enforcement at issuance, and unique cohort accounting on every transfer — keep the inventory honest while the token is active. Closure shuts the loop.

Three properties enforce non-duplication:

• Closed tokens cannot be re-closed. The Hedera state machine rejects any subsequent attempt against a RETIRED token. The token's status is the gate; once RETIRED, no further closing transactions can execute against it.
• Closed tokens cannot be re-traded. A buyer who has anchored a QET against a 2026 Scope 1 claim cannot then transfer the same token to another buyer for a 2027 claim. The state change is a permanent exit from active inventory, not a temporary hold.
• Cross-registry deduplication. Per Governance Framework Section 4.1.7 (Avoidance of Double-Counting), cross-registry checks and interoperability frameworks prevent the same underlying physical unit from being represented in active inventory across multiple registries simultaneously. Migration into Greentruth requires permanent cancellation in the origin registry first; migration out requires permanent cancellation on Greentruth first.

The practical implication for buyers and auditors: a closed QET's status — RETIRED, with the specific claim identifier and timestamp — is publicly queryable on the registry. An auditor in 2028 reviewing a 2026 closure can confirm directly that the token has not been re-used in any subsequent disclosure cycle, anywhere in the system.

For double-counting prevention in detail

A closure is not just a registry event; it is the trigger for downstream disclosure flows. At the closing transaction, framework-aligned exports are generated automatically and pushed to the buyer's integrated ESG software via webhook:

• GHG Protocol Scope 1, 2, and 3 lines populated with the verified carbon intensity, biogenic carve-out (where applicable), and Scope 3 Category 3 primary-data substitution.
• SBTi target progress updated with the retired volume, methodology version, and Criterion C11 biogenic-exclusion status (for QET-RNG).
• CSRD ESRS E1 disclosure payload generated with the transition-plan alignment, target-trajectory progress, and abatement-action documentation.
• IFRS S2 climate-related disclosures payload generated with the verified attribute and chain-of-custody references.
• SB 253 (California Climate Corporate Data Accountability Act) disclosure payload generated for companies above the $1B revenue threshold, with the assurance-level metadata required at the applicable disclosure phase.
• TCR (The Climate Registry) GRP disclosure payload generated for participating reporters.

The webhook integration with ESG software platforms (Watershed, Persefoni, Sweep, Workiva, and in-house GHG accounting systems) means the buyer's disclosure cycle updates without manual data transfer, PDF stitching, or reconciliation. The same on-chain event populates every framework's disclosure line simultaneously.

For the cross-framework alignment in detail

For the downstream Scope 3 Cat 3 product specifically

The timing of closure matters because the event is bound to a specific accounting period and reporting cycle. The dimensions to get right:

• The accounting period the QET represents. Every QET carries a vintage — the production period in which the underlying physical unit was generated and the methodology was applied. For QET-NG and QET-RNG, vintages typically align to monthly or quarterly production cycles. A QET with a 2026-Q3 vintage represents physical production that occurred in Q3 2026.
• The reporting period the buyer is claiming against. A buyer's disclosure typically aligns to their fiscal-year reporting cycle. The buyer chooses which closure maps to which reporting period — typically closing vintages from the same fiscal year against that year's disclosure, consistent with framework-specific vintage-matching rules (for example, GHG Protocol Scope 2 Quality Criteria temporal-matching expectations for QET-ELEC, which increasingly tighten toward hourly matching at the procurement level).
• The closure window. Most frameworks expect the event before the disclosure submission deadline for the relevant reporting period. CSRD's annual reporting cycle, SBTi's annual progress monitoring, SB 253's phased assurance schedules, and TCR's ongoing reporting all create operational deadlines that the buyer's calendar should anticipate.

For buyers managing portfolios across multiple vintages, multiple frameworks, and multiple reporting periods, the Machine-Ready API surfaces scheduling, batch workflows, and audit-trail export so the calendar can be operated programmatically rather than as a manual workflow.