Review checkout code for defects and privacy

You are reviewing the implementation of a supermarket checkout. No code listing accompanies this question.

Identify and prioritize issues and fixes across the following areas:

• (a) Monetary correctness: avoiding floating point; tax and discount rounding rules; coupon stacking; price overrides; refunds and voids; currency, locale, and time-zone edge cases.
• (b) Transactional integrity: idempotent payments; exactly-once order creation; inventory race conditions; TOCTOU (time-of-check to time-of-use) issues on discounts.
• (c) Security and privacy: PCI scope reduction; tokenization; PII redaction in logs; least-privilege database access; input validation to prevent injection.
• (d) Resilience and observability: retry and backoff; dead-letter queues; audit trails.

Also:

• Propose concrete refactors, unit tests, and integration tests.
• Give a minimal threat model.
• Provide a short code review checklist you would use in a 30-minute review.
• Name the 3 high-risk bugs you would hunt for first.