@@ -544,6 +544,60 @@ describe('CreditNativeIapOwner', () => {
     expect(handle.value?.errorMessageKey).toBeNull();
   });
 
+  it('gives up on a lookup that never answers and retries the next already-owned attempt', async () => {
+    // The store accepts the first `AlreadyOwned` lookup and never answers it.
+    // The pass must time out, release its single-flight slot, and let the next
+    // attempt run a fresh lookup instead of pinning recovery for the life of
+    // the mount.
+    const hungLookup = Promise.withResolvers<Purchase[]>();
+    mockedIap.getAvailablePurchases.mockReturnValueOnce(hungLookup.promise);
+    mockedQuery.serverProductsData = {
+      appAccountToken: APP_ACCOUNT_TOKEN,
+      products: [{ appleProductId: APPLE_PRODUCT_ID, googleProductId: 'credits_usd10' }],
+    };
+    const alreadyOwned = { code: 'already-owned', message: 'Item already owned' };
+    mockedIap.requestPurchase.mockRejectedValue(alreadyOwned);
+
+    // Only the deadline is faked: the mount helpers await real microtasks.
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] });
+    try {
+      const { handle } = await mountOwner();
+
+      const firstAttempt = handle.value?.purchase(creditPack);
+      await flushPromises();
+      expect(mockedIap.getAvailablePurchases).toHaveBeenCalledTimes(1);
+
+      await vi.advanceTimersByTimeAsync(16_000);
+      await flushPromises();
+
+      // The deadline gives up on the hung lookup: the attempt falls back to the
+      // existing purchase-failure copy and completes nothing.
+      expect(await firstAttempt).toBe(false);
+      expect(mockedQuery.completePurchase).not.toHaveBeenCalled();
+      expect(handle.value?.errorMessageKey).toBe('kiloPass.purchaseFailed');
+
+      // The slot is free, so the next attempt runs a fresh lookup, which answers.
+      mockedIap.getAvailablePurchases.mockResolvedValue([createPurchase()]);
+      const secondAttempt = handle.value?.purchase(creditPack);
+      await flushPromises();
+
+      expect(await secondAttempt).toBe(false);
+      expect(mockedIap.getAvailablePurchases).toHaveBeenCalledTimes(2);
+      expect(mockedQuery.completePurchase).toHaveBeenCalledTimes(1);
+      expect(handle.value?.completedPurchaseCount).toBe(1);
+      expect(handle.value?.errorMessageKey).toBeNull();
+
+      // The timed-out lookup answers late: a settled pass must ignore it, so no
+      // completion lands for the transaction it carried.
+      hungLookup.resolve([createPurchase({ transactionId: 'tx-late' })]);
+      await flushPromises();
+      expect(mockedQuery.completePurchase).toHaveBeenCalledTimes(1);
+      expect(handle.value?.completedPurchaseCount).toBe(1);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
   it('keeps the backend ownership refusal when both triggers recover one already-owned failure', async () => {
     mockedIap.getAvailablePurchases.mockResolvedValue([createPurchase()]);
     mockedQuery.serverProductsData = {
 
@@ -27,6 +27,7 @@ import {
 } from '@/lib/credits/store-products';
 import { getCreditStorefront } from '@/lib/credits/storefront';
 import { fetchPendingStorePurchases } from '@/lib/iap/pending-store-purchases';
+import { withStoreDeadline } from '@/lib/iap/store-call-deadline';
 import {
   createStoreCreditPurchaseActions,
   getPurchaseCompletionId,
@@ -366,7 +367,13 @@ export function CreditNativeIapOwner({ children }: { children: ReactNode }) {
         // changes while the store answers, the new account's own pass recovers.
         let pendingPurchases: Purchase[] = [];
         try {
-          pendingPurchases = await fetchPendingStorePurchases(storefront);
+          // Bounded: a store that never answers must not hold this epoch's
+          // single-flight slot open. The pass gives up, releases the slot, and
+          // the next `AlreadyOwned` attempt retries the lookup.
+          pendingPurchases = await withStoreDeadline(
+            fetchPendingStorePurchases(storefront),
+            'the pending purchase lookup'
+          );
         } catch {
           // The store cannot answer; the retry re-runs this.
           return false;
 
@@ -714,6 +714,38 @@ describe('createStoreCreditPurchaseActions.recoverPurchases', () => {
     }
   );
 
+  it('reports a remembered terminal refusal on explicit recovery without reposting it', async () => {
+    const purchase = createPurchase();
+    const completeAppStorePurchase = vi.fn().mockRejectedValue({
+      data: { code: 'BAD_REQUEST', message: STORE_PURCHASE_VERIFICATION_FAILED_MESSAGE },
+    });
+    const showError = vi.fn();
+    const actions = createActions({
+      completeAppStorePurchase,
+      showError: message => {
+        showError(message);
+      },
+    });
+
+    // The first automatic pass posts the receipt once and learns it is terminal.
+    expect(await actions.recoverPurchases([purchase])).toEqual([]);
+    expect(completeAppStorePurchase).toHaveBeenCalledTimes(1);
+    // Background recovery stays silent.
+    expect(showError).not.toHaveBeenCalled();
+
+    // The next automatic pass skips the remembered refusal silently.
+    expect(await actions.recoverPurchases([purchase])).toEqual([]);
+    expect(completeAppStorePurchase).toHaveBeenCalledTimes(1);
+    expect(showError).not.toHaveBeenCalled();
+
+    // An explicit recovery surfaces the remembered refusal — never a silent
+    // no-op — and still does not post the refused receipt again.
+    expect(await actions.recoverPurchases([purchase], { notifyErrors: true })).toEqual([]);
+    expect(completeAppStorePurchase).toHaveBeenCalledTimes(1);
+    expect(showError).toHaveBeenCalledTimes(1);
+    expect(showError).toHaveBeenCalledWith(CREDIT_PURCHASE_FAILED_KEY);
+  });
+
   it('retries after a session error, which is not about the receipt', async () => {
     const purchase = createPurchase();
     const completeAppStorePurchase = vi
 
@@ -193,17 +193,22 @@ const TERMINAL_PURCHASE_MESSAGES = {
 };
 
 /**
- * Purchases the backend terminally refused in this process. The store keeps an
- * unfinished transaction until the app finishes it, so without this memory every
- * later recovery pass posts a payload the backend already rejected. Deliberately
- * in-memory: the next app launch retries once, so a server-side change is never
- * ignored forever.
+ * Purchases the backend terminally refused in this process, with the catalog key
+ * their refusal maps to. The store keeps an unfinished transaction until the app
+ * finishes it, so without this memory every later recovery pass posts a payload
+ * the backend already rejected. Deliberately in-memory: the next app launch
+ * retries once, so a server-side change is never ignored forever.
+ *
+ * The key is kept, not just the id, because the silent background pass must skip
+ * a remembered refusal without a word, while an explicit recovery (the store
+ * reported the pack as already owned) must still surface why it can never
+ * succeed — without posting the refused receipt again.
  */
-const terminallyRejectedPurchaseIds = new Set<string>();
+const terminallyRejectedPurchases = new Map<string, string>();
 
 /** Test seam: forget the recorded rejections, so a test starts the process over. */
 export function resetTerminalPurchaseRejections(): void {
-  terminallyRejectedPurchaseIds.clear();
+  terminallyRejectedPurchases.clear();
 }
 
 let lastPurchaseErrorToast: { message: string; shownAt: number } | null = null;
@@ -353,13 +358,13 @@ export function createStoreCreditPurchaseActions(deps: StoreCreditPurchaseAction
       // remembering: an account or session refusal is payable after the user acts,
       // so it stays in the store queue and is posted again.
       const refusalMessage = readTrpcErrorField(error, 'message') ?? '';
-      if (Object.hasOwn(TERMINAL_PURCHASE_MESSAGES, refusalMessage)) {
-        terminallyRejectedPurchaseIds.add(getPurchaseCompletionId(purchase));
+      const errorMessageKey = getStoreCreditPurchaseErrorMessageKey(error, deps.storefront);
+      if (Object.hasOwn(TERMINAL_PURCHASE_MESSAGES, refusalMessage) && errorMessageKey) {
+        // Remember the key the refusal maps to, so a later explicit recovery can
+        // show it without posting this receipt again.
+        terminallyRejectedPurchases.set(getPurchaseCompletionId(purchase), errorMessageKey);
       }
-      return {
-        completed: false,
-        errorMessageKey: getStoreCreditPurchaseErrorMessageKey(error, deps.storefront),
-      };
+      return { completed: false, errorMessageKey };
     }
 
     // The account can also change while the backend answers. The grant is the
@@ -489,28 +494,47 @@ export function createStoreCreditPurchaseActions(deps: StoreCreditPurchaseAction
       options.creditPackGoogleProductIds ?? deps.creditPackGoogleProductIds;
     // One completion per store transaction: a store that lists the same
     // transaction twice must not be completed twice. A payload the backend named
-    // as defective is skipped too: posting it again can never succeed, and the
+    // as defective is never posted again: posting it can never succeed, and the
     // store keeps re-delivering it. The next app launch retries it once.
     const seenCompletionIds = new Set<string>();
-    const eligiblePurchases = purchases
-      .filter(purchase => !terminallyRejectedPurchaseIds.has(getPurchaseCompletionId(purchase)))
-      .filter(purchase => {
-        if (
-          !isRecoverableCreditPurchase(
-            purchase,
-            creditPackAppleProductIds,
-            creditPackGoogleProductIds
-          )
-        ) {
-          return false;
-        }
-        const id = getPurchaseCompletionId(purchase);
-        if (seenCompletionIds.has(id)) {
-          return false;
+    const rememberedRejections: string[] = [];
+    const eligiblePurchases = purchases.filter(purchase => {
+      const id = getPurchaseCompletionId(purchase);
+      const rememberedErrorMessageKey = terminallyRejectedPurchases.get(id);
+      if (rememberedErrorMessageKey !== undefined) {
+        // The silent background pass skips a remembered refusal without a word.
+        // An explicit recovery must still say why this purchase can never
+        // complete, once per pass, without posting the refused receipt again.
+        if ((options.notifyErrors ?? false) && !seenCompletionIds.has(id)) {
+          seenCompletionIds.add(id);
+          rememberedRejections.push(rememberedErrorMessageKey);
         }
-        seenCompletionIds.add(id);
-        return true;
-      });
+        return false;
+      }
+      if (
+        !isRecoverableCreditPurchase(
+          purchase,
+          creditPackAppleProductIds,
+          creditPackGoogleProductIds
+        )
+      ) {
+        return false;
+      }
+      if (seenCompletionIds.has(id)) {
+        return false;
+      }
+      seenCompletionIds.add(id);
+      return true;
+    });
+
+    // A remembered refusal belongs to the account that asked for it: a session
+    // change while this pass ran must not report the old account's refusal onto
+    // the new one.
+    if (deps.isAccountCurrent()) {
+      for (const errorMessageKey of rememberedRejections) {
+        deps.showError(errorMessageKey);
+      }
+    }
 
     const recoveryResults = await Promise.all(
       eligiblePurchases.map(async purchase => ({
 
@@ -0,0 +1,30 @@
+/**
+ * A store call must answer inside this window or the pass gives up.
+ *
+ * StoreKit and Play Billing both answer slowly on a cold connection, and a call
+ * that never answers is worse than one that fails: the pass holds its in-flight
+ * guard, so recovery is dead for the rest of the process and silent about it.
+ * Measured on a simulator on 2026-09-29: the pass entered with 14 known product
+ * ids, then `initConnection` never settled — no result, no failure, no further
+ * recovery for the life of that app process.
+ */
+const STORE_CALL_DEADLINE_MS = 15_000;
+
+/**
+ * Bounds a store call so a hung SDK never holds a recovery pass open.
+ *
+ * The underlying call keeps running — the store SDK has no cancellation — but
+ * the race settles on the deadline and a late answer is ignored, so the caller
+ * can release its in-flight guard and the next attempt may retry.
+ */
+export async function withStoreDeadline<T>(work: Promise<T>, label: string): Promise<T> {
+  const { promise: deadline, reject: failDeadline } = Promise.withResolvers<never>();
+  const timer = setTimeout(() => {
+    failDeadline(new Error(`${label} did not answer within ${STORE_CALL_DEADLINE_MS} ms`));
+  }, STORE_CALL_DEADLINE_MS);
+  try {
+    return await Promise.race([work, deadline]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
@@ -13,6 +13,7 @@ import { useAppLifecycle } from '@/lib/hooks/use-app-lifecycle';
 import { getCreditStorefront } from '@/lib/credits/storefront';
 import { createStoreCreditPurchaseActions } from '@/lib/credits/use-store-credit-purchase';
 import { fetchPendingStorePurchases } from '@/lib/iap/pending-store-purchases';
+import { withStoreDeadline } from '@/lib/iap/store-call-deadline';
 import { createAppStoreKiloPassPurchaseActions } from '@/lib/kilo-pass/use-store-kilo-pass-purchase';
 import { useTRPC } from '@/lib/trpc';
 
@@ -28,30 +29,6 @@ function logRecoveryError(message: string | null): void {
   }
 }
 
-/**
- * A store call must answer inside this window or the pass gives up.
- *
- * StoreKit and Play Billing both answer slowly on a cold connection, and a call
- * that never answers is worse than one that fails: the pass holds its in-flight
- * guard, so recovery is dead for the rest of the process and silent about it.
- * Measured on a simulator on 2026-09-29: the pass entered with 14 known product
- * ids, then `initConnection` never settled — no result, no failure, no further
- * recovery for the life of that app process.
- */
-const STORE_CALL_DEADLINE_MS = 15_000;
-
-async function withStoreDeadline<T>(work: Promise<T>, label: string): Promise<T> {
-  const { promise: deadline, reject: failDeadline } = Promise.withResolvers<never>();
-  const timer = setTimeout(() => {
-    failDeadline(new Error(`${label} did not answer within ${STORE_CALL_DEADLINE_MS} ms`));
-  }, STORE_CALL_DEADLINE_MS);
-  try {
-    return await Promise.race([work, deadline]);
-  } finally {
-    clearTimeout(timer);
-  }
-}
-
 /** Purchase screens close the global connection on unmount; each pass reconnects. */
 async function connectStore(): Promise<void> {
   await withStoreDeadline(initConnection(), 'the store connection');