FUJISANSAKE

Stock is reserved when the customer goes to pay and taken off the shelf once payment is confirmed. Taking it off only at confirmation leaves the few minutes on the payment page open, and in them several people can buy the same last bottle. Not overselling rests on one UPDATE that only succeeds while on-hand minus reserved still covers the quantity; D1 has no interactive transactions, so when one line of a multi-line order comes up short, the lines already reserved are put back. Checkout sessions expire after 30 minutes, Stripe's minimum, so an abandoned payment does not hold stock for a day.

Registering as a business is self-declared, so it shows nothing on its own. What opens wholesale pricing is an approved stockist review, and an account with no review on record counts as unapproved. If the review cannot be read, the prices stay hidden: a price once shown cannot be taken back. A liquor licence number is required only of retailers and wholesalers — a restaurant or inn pouring on the premises is not selling alcohol and needs none, and a required field that does not match the business turns away the right customers and invites made-up answers.

Stripe may deliver the same event more than once. The order is confirmed by an UPDATE that only moves a pending order to confirmed, and only the delivery that actually made that change takes the stock and sends the emails. A failed email does not fail the webhook — the order is confirmed either way, so it is logged instead; Stripe is only asked to retry when the confirmation itself could not be written. Refunds and chargebacks raised from the Stripe dashboard come back the same way, with full and partial refunds recorded against the order.

Sakes, sizes and descriptions live in code; price and stock are overrides in the database, in two separate tables. In one table, correcting a price would create a row with zero stock and sell the item out on the spot. Staff move stock at every count; only the owner can change a price. With no row, the code's value stands, and if the database cannot be read the shop keeps selling at the code's prices. Checkout, the admin and the wholesale price list all read the merged catalogue, so no path is left where a price changed in the admin does not apply.

Age is confirmed when a visitor arrives and again just before payment. The second check does not rest on the checkbox: the server action that starts checkout refuses a request without it, because a server action can be called without the page. The legal disclosures come from a single file, and a value not yet confirmed is left empty rather than filled with a plausible placeholder, which can go live looking like the real thing.