COA per batch, how does the QR-on-bottle → Magento URL flow work?

FDA and state AGs both require lot-level traceability for hemp products. The pattern we ship:

• COA entity in Magento, one entry per lab batch. Stores lab name (typically InfiniteCAL, SC Labs, ProVerde, or ACS Laboratory), harvest date, batch ID, cannabinoid profile (CBD/THC/CBG/CBN ppm), pesticide screen, heavy-metal screen, microbial screen, residual-solvent screen, and the COA PDF itself.
• Public Magento URL per COA, pattern /coa/lot-2026-04-12-a. The page renders the COA summary + downloadable PDF. SEO-indexed (transparency is a trust signal).
• QR code printed on the bottle, encodes the COA URL. Customer scans → lands on the COA page → instant trust.
• Product → batch mapping, each product variant ships from a specific lot; we store the lot ID as a custom attribute on the order line. Lets us pull “every order that received lot 2026-04-12-a” in <15 minutes if a recall is needed.

The recall workflow: a state AG sends a letter about a lot → we query orders by lot ID → Klaviyo flow sends recall emails to affected customers → optional store-credit auto-issue. We’ve never had to fire this in anger but it’s the kind of thing where if you don’t have it, you find out you needed it the day you need it.