what thecertificates say

the corpus

What we are actually holding

Three separate bodies of certificates, built at different times and by different methods, because the stores publish in wildly different ways.

That last row is worth pausing on. Sixty-four of those certificates are scans or photographs with no text layer, no machine-readable text to parse at all. There was no optical character recognition available on the machine doing the work, so they were rendered as images and read by eye, one at a time, and typed in.

Which sounds like exactly the kind of process you should not trust. And it would be, except that every single one still had to satisfy the checksum in chapter I before it was allowed to exist. A mis-read digit does not close the sum. Of those 64, the transcriptions closed to a median deviation of 0.0014 and a worst case of 0.0117. The arithmetic is what makes hand-read numbers publishable; the care is not sufficient on its own.

Those records are flagged on the card as read from a scan, and carry a lower confidence score, because how a number was obtained is part of what the number means.

the big one

One sheet, forty-two products, thirty-seven different strains

This is the finding that changed how the whole site works.

A single certificate was attached to 42 products spanning 37 distinct strains, John Truffolta, Royal Gorilla, Skywalker OG, Sour Tangie, and thirty-three others. Every one of them carrying the same sample name, the same date, and the same potency: 30.84% THCA.

That is not a lab result. Thirty-seven different cultivars do not test identically. It is a store-level compliance document, one sheet the vendor hangs on many listings, which is a perfectly normal thing for a vendor to hold and a completely invalid basis for a potency claim about any individual strain.

And before we caught it, our own site was making that claim. The card said lab verified. The number fed the strength sorting and the minimum-THC filter. All of it wrong, and wrong in the direction of a specific, measured-sounding assertion about potency, which is the worst direction to be wrong in.

A number with a lab's name on it is not a measurement.
It is a measurement of something. The question is what.

The fix is mechanical rather than editorial. We group every record by the sheet it came from, and if one sheet backs more than one distinct strain, it is a store document and no product gets a potency figure from it. Several pack sizes of the same strain sharing a sheet is legitimate and stays, which is why the test keys on the strain name and not on the raw product count.

Across the live catalogue that currently demotes about 136 products. They lose the badge, the figure and their place in the sorting, and their panel says plainly that no report has been tied to that listing. The certificate link stays, because the document is real; it just is not about that flower.

three kinds of document

"Has a COA" is not one fact

When a shop says a product has a certificate, that can mean three genuinely different things, and we found all three in quantity:

Before we separated these, the card printed "lab-tested" whenever a certificate link was merely present. On 404 products that produced a card face claiming lab verification directly above a panel that truthfully said no report had been published for that item. The page contradicted itself, and the flattering half was in the bigger type.

Now the card says which of the three it is: view COA, store COA, or lab results. Three words of honesty, and it cost nothing.

The one exception we allow

A shop that publishes a certificate for every product, and where we have successfully parsed hundreds of them, has demonstrably tested its range. If we then fail to match one particular strain to its sheet, that is a gap in our matching rather than evidence the batch was never tested, so the badge stays, on the strength of the store's record, while the numbers still do not. Three shops currently meet that bar. Several conspicuously do not, including one with 107 certificate links from which we have never once managed to parse a result.

the smaller landmines

Things a lab report will do to you

A list, because each of these was a real bug that produced a real wrong number, and each was caught by the checksum rather than by anybody being clever.

• The same analyte printed twice. One lab repeats its analyte table on a later quality-control page with different figures. Reading the document front-to-back returned a THCA of 3.72% for flower. Reading only the pages before the quality-control heading moved the median from 1.54% to 26.90%.
• Four numbers in a row, and the first one is not the answer. Cannabinoid rows often run limit-of-detection, limit-of-quantitation, percent, milligrams per gram. Taking the first number gave a THCA of 0.0024% on sixteen reports.
• Terpene tables have one fewer column than cannabinoid tables. Which published a limonene figure of 5.9% on a sample whose total terpenes were 1.97%, a number that would be remarkable if it were real. The robust fix is to take the last two numbers on the row and require that the milligrams-per-gram figure is ten times the percentage. If it is not, the row has been misread.
• Two-column layouts flattened into one line. One lab's PDF interleaves two columns, so an analyte name ends up glued to the summary figure from the other side of the page. This one passed the ten-times check, because the pair it produced was a genuine pair, from the wrong row.
• An optional letter in a pattern. Searching for "THCa" with an optional final letter also matches a bare "THC", so on a line reading Delta9 THC 0.26% THCa 27.76% it returned 0.26 as the THCA. Fifty-nine records failed the checksum on that one, which is exactly what the checksum is for.

Every one of those is a way to publish a confident, specific, entirely wrong potency. None of them was caught by looking at the output and thinking it seemed plausible, because all of them did seem plausible. They were caught by a sum.

the one that is not a bug

Two strains, one analysis

And then there is the finding that no amount of better parsing fixes.

Two entirely different strains from one shop, different names, different listings, carry certificates with the same sample identifier and byte-for-byte identical values. Same THCA, same delta-9, same total, same date. One analysis, filed twice under two names.

One of those two products is described by a lab result that was not taken from it. We have no way to determine which, so neither of them gets lab data. Both were dropped.

Notably, our own shared-sheet detection from chapter III would have missed this, because that test fingerprints partly on the sample name, and here the names differ. It took a separate check, fingerprinting on the values alone, to see it. Five matching numbers across two unrelated cultivars does not happen by chance.

We are not naming the strains or the lab here. The point is not to pillory one laboratory over what may well be a clerical error; the point is that if you read enough certificates you will find this, and that a shop's job is to drop the record rather than pick the more flattering half.