The crack
Limited drops invite a buying frenzy. When demand spikes, the classic bug is overselling: two buyers read the same remaining count, both think there is stock, and both orders succeed. Real customers get a confirmation and then a cancellation.
Why it persists
The race lives in application logic that reads the count, decides, then writes. Under concurrency those steps interleave. Teams paper over it with locks and retries that are easy to get wrong and hard to reason about.
The fix on Cloudflare
Push the guard into the database, where it is enforced atomically. A single UPDATE that decrements only where the quantity is still above zero cannot double-decrement, because the check and the write happen as one operation. You decide bought versus sold-out by rows-changed, never by a prior read.
Cloudflare D1 serializes writes, so concurrent buyers can never push the count below zero.
How I built the demo
The demo runs the guarded UPDATE and reports whether the buy succeeded from the rows-changed result. Fire many buys at once and the count holds at exactly zero, with no oversell, which is the whole point.