@mpgd/game-services 0.30.5 → 0.32.0

package/dist/commerce-reconciler.js

@@ -1,4 +1,5 @@
 import { assertCommercePurchaseTransition, assertRequestPurchaseSupported, CommerceError, commerceErrorInfoOf, createDerivedPurchaseIdempotencyKey, isTerminalCommercePurchaseState, summarizeCommercePurchaseState, } from '@mpgd/platform/commerce';
+import { isStoreAccountMismatchReason, readPurchaseBoundToAnotherAccount, } from './another-account.js';
 import { compareCommerceServiceCapabilities, } from './commerce-evidence-registry.js';
 import { chunkLedgerEntryIds } from './commerce-ledger.js';
 /**
@@ -37,13 +38,37 @@ export function isCommercePurchaseOperationRecord(record) {
         && record !== null
         && record.kind === commercePurchaseOperationKind;
 }
-/** Summary status of a record: the RFC mapping, with `revoked` kept distinct. */
+/**
+ * Summary status of a record: the RFC mapping, with `revoked` kept distinct.
+ * A record parked as another account's purchase is `rejected` for its
+ * player: nothing was granted to it, and nothing will be.
+ */
 export function summarizeCommercePurchaseOperation(record) {
     if (isRetryableBeforeLaunch(record)) {
         return 'failed';
     }
+    if (isParkedForAnotherAccount(record)) {
+        return 'rejected';
+    }
     return summarizeCommercePurchaseState(record.state);
 }
+/** A `verifying` record the backend answered as another account's purchase. */
+export function isParkedForAnotherAccount(record) {
+    return record.state === 'verifying' && record.anotherAccount !== undefined;
+}
+/**
+ * Whether another player's record under a shared key leaves the key to this
+ * player: parked as another account's purchase, or (a journal written before
+ * that answer) `rejected` with a store binding mismatch reason. Either way
+ * the purchase was never its player's, and nothing on the backend holds it.
+ */
+function releasesSharedKey(record) {
+    return isParkedForAnotherAccount(record)
+        || (record.state === 'rejected'
+            && record.response !== undefined
+            && !record.response.verified
+            && isStoreAccountMismatchReason(record.response.reason));
+}
 function isRetryableBeforeLaunch(record) {
     return record.state === 'requested' && record.error?.retryable === true
         && record.purchase === undefined && record.request === undefined;
@@ -54,7 +79,9 @@ function isRetryableBeforeLaunch(record) {
  * finish allow-list of its own (the removed v1 driver paired transactions in
  * `finishGrantedTransaction`), so this is the finish gate for every `client`
  * and `host` owner: the ledger entry id comes from the journal revision the
- * backend grant wrote.
+ * backend grant wrote. The one other finish call is a `finished` consumable a
+ * `client` store reports again, finished with the same journaled ledger entry
+ * (see `finishReportedAgain` in `createCommerceReconciler`).
  */
 export function assertCommerceFinishAllowed(record) {
     if (record.state !== 'granted' && record.state !== 'finishing') {
@@ -258,6 +285,30 @@ export function createCommerceReconciler(input) {
     const trigger = () => {
         triggerPending = true;
     };
+    /** The session check's refusal, if any; a check that throws refuses too. */
+    const sessionRefusal = () => {
+        if (input.sessionCheck === undefined) {
+            return undefined;
+        }
+        try {
+            return input.sessionCheck();
+        }
+        catch (error) {
+            return new CommerceError('ACCOUNT_BINDING_REQUIRED', {
+                retryable: true,
+                message: `The session check failed: ${error instanceof Error ? error.message : String(error)}`,
+            });
+        }
+    };
+    /** True (and reported) when the reconciler must not act for its player now. */
+    const sessionBlocked = (idempotencyKey) => {
+        const refusal = sessionRefusal();
+        if (refusal === undefined) {
+            return false;
+        }
+        fail('session', refusal, idempotencyKey);
+        return true;
+    };
     const ownsRecord = (record) => record.playerId === playerId
         && record.target === target
         && record.deploymentTarget === deploymentTarget
@@ -457,6 +508,27 @@ export function createCommerceReconciler(input) {
         retryAt.delete(record.idempotencyKey);
         return next;
     };
+    /**
+     * Parks a `verifying` record the backend answered as another account's
+     * purchase, or (`marker` undefined) lets this player's Restore Purchases
+     * send it again. The state stays `verifying`: the record is not ended for
+     * the store transaction, which its account can still recover.
+     */
+    const reviseAnotherAccount = async (record, marker, patch = {}) => {
+        const { anotherAccount: _previous, ...rest } = record;
+        const next = {
+            ...rest,
+            ...patch,
+            ...(marker === undefined ? {} : { anotherAccount: marker }),
+            state: record.state,
+            revision: record.revision + 1,
+            updatedAt: now(),
+        };
+        await journal.replace(record.revision, next);
+        remember(next);
+        retryAt.delete(record.idempotencyKey);
+        return next;
+    };
     /**
      * Where this player's record of an idempotency key lives, and what that key
      * holds now. A record is under the shared key, or under this player's
@@ -470,6 +542,11 @@ export function createCommerceReconciler(input) {
      *   the slot holds, and `recordIn` refuses it.
      * - `probeFree`: when the shared key is free, a record under the scoped key
      *   still answers (retention may have dropped the other player's record).
+     *
+     * Another player's record that was answered as another account's purchase
+     * (`releasesSharedKey`) is never this player's to refuse: the scoped key is
+     * the slot for any kind, as with `takeHeld`, so the purchase's own account
+     * recovers it on the same install.
      */
     const resolveSlot = async (idempotencyKey, options = {}) => {
         const sharedKey = createCommercePurchaseOperationKey(target, idempotencyKey);
@@ -477,6 +554,7 @@ export function createCommerceReconciler(input) {
         const heldByAnother = shared !== undefined && heldByAnotherPlayer(shared);
         const probeScoped = heldByAnother
             ? options.takeHeld === true
+                || (isCommercePurchaseOperationRecord(shared) && releasesSharedKey(shared))
             : shared === undefined && options.probeFree === true;
         if (!probeScoped) {
             return { key: sharedKey, found: shared, heldByAnother };
@@ -506,9 +584,15 @@ export function createCommerceReconciler(input) {
      */
     const readRecord = async (idempotencyKey) => recordIn(await resolveSlot(idempotencyKey), idempotencyKey);
     const ownedRecordsOf = (listed) => listed.filter((record) => isCommercePurchaseOperationRecord(record) && ownsRecord(record));
+    /**
+     * The player's open records. One parked as another account's purchase is
+     * kept in memory, so a store report matches it without the journal's
+     * transaction index, but is not the player's to recover.
+     */
     const listRecoverable = async () => ownedRecordsOf(await journal.listRecoverable(playerId))
         .filter((record) => !isTerminalCommercePurchaseState(record.state))
-        .map(remember);
+        .map(remember)
+        .filter((record) => !isParkedForAnotherAccount(record));
     const listGranted = async () => {
         const listed = journal.listGranted === undefined
             ? []
@@ -551,6 +635,11 @@ export function createCommerceReconciler(input) {
         if (!capabilitiesNow.lifecycle.availablePurchases) {
             return true;
         }
+        if (sessionBlocked()) {
+            // Another player's store account may be current: nothing is read into
+            // this player's journal, and the next permitted pass reads again.
+            return false;
+        }
         const read = async (withRestore) => {
             const available = await provider.getAvailablePurchases({
                 includePending: capabilitiesNow.lifecycle.pending,
@@ -609,6 +698,153 @@ export function createCommerceReconciler(input) {
             ...(record.origin === 'discovered' ? { intent: 'restore' } : {}),
         };
     };
+    /** Whether a store purchase is bound to another account than this player's (`accountBinding`). */
+    const accountOf = async (purchase) => {
+        const bound = purchase.accountBinding;
+        if (input.accountBinding === undefined || bound?.value === undefined) {
+            return 'own';
+        }
+        let own;
+        try {
+            own = await input.accountBinding();
+        }
+        catch {
+            own = undefined;
+        }
+        if (own?.value === undefined) {
+            // This player's binding cannot be read now: the purchase cannot be shown to be theirs yet.
+            return 'unknown';
+        }
+        if (own.kind !== bound.kind) {
+            return 'own';
+        }
+        const normalize = (value) => bound.kind === 'app-account-token' ? value.toLowerCase() : value;
+        return normalize(own.value) === normalize(bound.value) ? 'own' : 'another';
+    };
+    /** Transactions `finishReportedAgain` already finished again this session. */
+    const finishedAgain = new Set();
+    /**
+     * A client-finish store reports a consumable only while it is unfinished,
+     * so one reported again after its record finished was never finished in
+     * the store: its finish was reported done without a native call (a lost
+     * acknowledgement the store's list could not tell apart from an
+     * unverifiable entry or a list read too early), or the store re-delivered
+     * it. It is finished again with the ledger entry the grant wrote, once per
+     * session (a call that failed in transport is tried again on the next
+     * report); it is never verified or granted again (the ledger replays a key
+     * and refuses the same evidence under another one). Durables, which a
+     * store keeps listing after their finish, and other finish owners are left
+     * alone. It needs the finished record: past the journal's retention the
+     * transaction takes the derived-key path, where the reference backend
+     * answers a `client`-finish consumable with this player's recorded grant
+     * (never a second one), and the record finishes it like any grant.
+     */
+    const finishReportedAgain = async (record, kind) => {
+        const ledgerEntryId = record.ledgerEntryId;
+        const transactionId = record.purchase?.transactionId;
+        if ((record.productKind ?? kind) !== 'consumable'
+            || capabilities?.lifecycle.finish !== 'client'
+            || provider.finishTransaction === undefined
+            || ledgerEntryId === undefined
+            || ledgerEntryId.trim() === ''
+            || transactionId === undefined
+            || transactionId.trim() === ''
+            || finishedAgain.has(transactionId)) {
+            return;
+        }
+        if (sessionBlocked(record.idempotencyKey)) {
+            // The session changed while the report was matched: the next report asks again.
+            return;
+        }
+        finishedAgain.add(transactionId);
+        try {
+            const { finished } = await provider.finishTransaction({
+                transactionId,
+                ledgerEntryId,
+                isConsumable: true,
+            });
+            if (!finished) {
+                // The store refused it (for StoreKit: revoked or another token); the
+                // next session asks again. The record stays finished.
+                fail('finish', new Error(`The store did not finish ${transactionId} it reported again.`), record.idempotencyKey);
+            }
+        }
+        catch (error) {
+            // Transport-class failure: the next report of the transaction tries again.
+            finishedAgain.delete(transactionId);
+            fail('finish', error, record.idempotencyKey);
+        }
+    };
+    /**
+     * A store report of a record the backend answered as another account's
+     * purchase. Only this player's Restore Purchases asks again (a restore
+     * sharing policy or a binding may have changed since), with the evidence
+     * the store reports now, so a stale saved request (an expired signed
+     * transaction) is not resent, and as a restore, which the player asked
+     * for (restore sharing may cover a durable the game started, too); other
+     * reports leave it parked. It stays parked until the backend answers
+     * something else: a transport failure (an offline Restore) changes
+     * nothing, so the record never becomes an open attempt that serializes the
+     * player's purchases or holds the shared key against the purchase's
+     * account. Another answer unparks it and settles it as a verify does; a
+     * grant is finished by the pass's recoverable records.
+     *
+     * Returns false when the journal dropped the record before Restore could
+     * rewrite it (another context's save applied the journal's retention after
+     * `rereadParked` read it): the record is forgotten and the caller matches
+     * the report as a purchase the journal does not know.
+     */
+    const reportParked = async (record, purchase, restoring) => {
+        if (!restoring || purchase.state !== 'purchased') {
+            return true;
+        }
+        const request = {
+            ...buildRequest({ ...record, purchase }),
+            intent: 'restore',
+        };
+        let refreshed;
+        try {
+            refreshed = await reviseAnotherAccount(record, record.anotherAccount, {
+                purchase,
+                request,
+            });
+        }
+        catch (error) {
+            if (await rereadParked(record) === undefined) {
+                return false;
+            }
+            throw error;
+        }
+        const answer = await sendVerify(refreshed, request);
+        if (answer === undefined) {
+            return true;
+        }
+        if (answer.kind === 'another-account') {
+            await parkForAnotherAccount(refreshed, request, answer);
+            return true;
+        }
+        await settleVerify(await reviseAnotherAccount(refreshed, undefined), request, answer.response);
+        return true;
+    };
+    /**
+     * The journal's current record of a parked record this session holds, or
+     * undefined (and forgotten) when the journal no longer holds it for this
+     * player: dropped, or the key reserved again for another purchase of the
+     * player, which this purchase's report must never be written onto.
+     */
+    const rereadParked = async (record) => {
+        const current = await journal.read(record.key);
+        if (current !== undefined
+            && isCommercePurchaseOperationRecord(current)
+            && ownsRecord(current)
+            && current.purchase !== undefined
+            && record.purchase !== undefined
+            && samePurchase(current.purchase, record.purchase)) {
+            return remember(current);
+        }
+        records.delete(record.idempotencyKey);
+        return undefined;
+    };
     // Reconciler step 2: match a reported purchase to a journal record.
     const ingestPurchase = async (purchase, restoring) => {
         if (purchase.store !== storeId) {
@@ -638,6 +874,35 @@ export function createCommerceReconciler(input) {
                 record = remember(stored);
             }
         }
+        if (record !== undefined && isParkedForAnotherAccount(record) && restoring) {
+            // Restore Purchases writes the record, so it must still be the journal's:
+            // a journal's retention may have dropped a parked record this session
+            // still holds (RFC "Another account's purchase"). Then the report is a
+            // purchase the journal does not know, and is matched as one.
+            record = await rereadParked(record);
+        }
+        if (record !== undefined && isParkedForAnotherAccount(record)) {
+            if (await reportParked(record, purchase, restoring)) {
+                return;
+            }
+            record = undefined;
+        }
+        const account = record !== undefined || (restoring && product.kind === 'durable')
+            ? 'own'
+            : await accountOf(purchase);
+        if (account === 'unknown') {
+            // Not decided yet: the report waits for the next pass, which asks again.
+            defer({ type: 'purchaseUpdated', purchase });
+            fail('match', new Error(`Purchase ${purchase.transactionId} waits: this player's store account binding could not be read.`));
+            return;
+        }
+        if (account === 'another') {
+            // Another player's purchase (Play lists unacknowledged purchases of
+            // every app account on the device): neither attached to this player's
+            // open attempt nor journaled under a derived key.
+            fail('match', new Error(`Purchase ${purchase.transactionId} is bound to another store account; it is left for that player.`));
+            return;
+        }
         if (record === undefined) {
             const open = openRecordsFor(product.logicalId);
             if (open.length > 1) {
@@ -676,6 +941,16 @@ export function createCommerceReconciler(input) {
                 probeFree: durable,
             });
             record = recordIn(slot, idempotencyKey);
+            if (record !== undefined
+                && isParkedForAnotherAccount(record)
+                && record.logicalId === product.logicalId
+                && record.purchase !== undefined
+                && samePurchase(record.purchase, purchase)) {
+                // Found under its derived key only (a journal without the
+                // transaction index): the same rule as a transaction match.
+                await reportParked(record, purchase, restoring);
+                return;
+            }
             if (record !== undefined
                 && (record.logicalId !== product.logicalId
                     || (record.purchase !== undefined && !samePurchase(record.purchase, purchase)))) {
@@ -697,6 +972,10 @@ export function createCommerceReconciler(input) {
                 return;
             }
         }
+        if (record.state === 'finished' && purchase.state === 'purchased') {
+            await finishReportedAgain(record, product.kind);
+            return;
+        }
         if (purchase.state === 'pending' && record.state === 'launched') {
             await write(record, 'pending', { purchase });
             return;
@@ -735,18 +1014,71 @@ export function createCommerceReconciler(input) {
         retryable: false,
         message,
     });
+    /**
+     * The backend's answer: a response, another account's purchase (the
+     * `PURCHASE_BOUND_TO_ANOTHER_ACCOUNT` error, or a `rejected` receipt with a
+     * store binding mismatch reason from a backend before it), or undefined
+     * for a transport failure.
+     */
     const sendVerify = async (record, request) => {
         emit({ type: 'verify-requested', record });
+        let response;
         try {
-            const response = await backend.verifyPurchase(request);
-            emit({ type: 'verify-result', record, response });
-            return response;
+            response = await backend.verifyPurchase(request);
         }
         catch (error) {
+            const anotherAccount = readPurchaseBoundToAnotherAccount(error);
+            if (anotherAccount !== undefined) {
+                // An answer, not a failure: the caller parks the record and reports it.
+                return { kind: 'another-account', reason: anotherAccount.reason };
+            }
             // Transport failure: the state is kept and the next pass resends the saved request.
             fail('verify', error, record.idempotencyKey);
             return undefined;
         }
+        emit({ type: 'verify-result', record, response });
+        if (!response.verified
+            && response.disposition !== 'pending'
+            && isStoreAccountMismatchReason(response.reason)) {
+            return { kind: 'another-account', reason: response.reason, response };
+        }
+        return { kind: 'response', response };
+    };
+    /**
+     * Parks a `verifying` record the backend answered as another account's
+     * purchase and reports it with an `another-account` event (not a failure).
+     */
+    const parkForAnotherAccount = async (record, request, answer) => {
+        const parked = await reviseAnotherAccount(record, { reason: answer.reason, reportedAt: now() }, { request, ...(answer.response === undefined ? {} : { response: answer.response }) });
+        emit({
+            type: 'another-account',
+            record: parked,
+            reason: answer.reason,
+            ...(answer.response === undefined ? {} : { response: answer.response }),
+        });
+    };
+    /**
+     * Journals the backend's answer to a `verifying` record: `pending` or
+     * `rejected`, or `granted` (returned) for a grant that carries its ledger
+     * entry; a malformed grant is reported and the record kept.
+     */
+    const settleVerify = async (record, request, response) => {
+        if (!response.verified) {
+            if (response.disposition === 'pending') {
+                await write(record, 'pending', { request, response });
+                retryLater(record.idempotencyKey);
+            }
+            else {
+                await write(record, 'rejected', { request, response });
+            }
+            return undefined;
+        }
+        const ledgerEntryId = response.ledgerEntryId;
+        if (typeof ledgerEntryId !== 'string' || ledgerEntryId.trim() === '') {
+            fail('verify', new Error(`A verified response for ${record.idempotencyKey} must carry a ledgerEntryId.`), record.idempotencyKey);
+            return undefined;
+        }
+        return write(record, 'granted', { request, response, ledgerEntryId });
     };
     // Reconciler steps 3 and 4: drive one record as far as the backend and the store allow.
     const drive = async (initial, capabilitiesNow, explicit) => {
@@ -761,6 +1093,10 @@ export function createCommerceReconciler(input) {
         }
         try {
             for (;;) {
+                if (sessionBlocked(record.idempotencyKey)) {
+                    // The record stays as journaled for this player's next permitted pass.
+                    return;
+                }
                 switch (record.state) {
                     case 'requested':
                         if (isRetryableBeforeLaunch(record)) {
@@ -804,29 +1140,30 @@ export function createCommerceReconciler(input) {
                         record = await write(record, 'verifying');
                         continue;
                     case 'verifying': {
+                        if (isParkedForAnotherAccount(record)) {
+                            // Another account's purchase: only this player's Restore
+                            // Purchases sends it again (`ingestPurchase`).
+                            return;
+                        }
                         const request = record.request ?? buildRequest(record);
-                        const response = await sendVerify(record, request);
-                        if (response === undefined) {
+                        const answer = await sendVerify(record, request);
+                        if (answer === undefined) {
                             retryLater(record.idempotencyKey);
                             return;
                         }
-                        if (!response.verified) {
-                            if (response.disposition === 'pending') {
-                                await write(record, 'pending', { request, response });
-                                retryLater(record.idempotencyKey);
-                            }
-                            else {
-                                await write(record, 'rejected', { request, response });
-                            }
+                        if (answer.kind === 'another-account') {
+                            // Not this player's, and not ended for the store transaction:
+                            // never sent again on its own, and the shared key is left to
+                            // the purchase's account (RFC "Another account's purchase").
+                            await parkForAnotherAccount(record, request, answer);
                             return;
                         }
-                        const ledgerEntryId = response.ledgerEntryId;
-                        if (typeof ledgerEntryId !== 'string' || ledgerEntryId.trim() === '') {
-                            fail('verify', new Error(`A verified response for ${record.idempotencyKey} must carry a ledgerEntryId.`), record.idempotencyKey);
+                        const granted = await settleVerify(record, request, answer.response);
+                        if (granted === undefined) {
                             return;
                         }
-                        finalization = response.finalization?.status;
-                        record = await write(record, 'granted', { request, response, ledgerEntryId });
+                        finalization = answer.response.finalization?.status;
+                        record = granted;
                         continue;
                     }
                     case 'granted':
@@ -853,7 +1190,8 @@ export function createCommerceReconciler(input) {
                             if (finalization === undefined) {
                                 // A pass that did not grant resends the saved request to read
                                 // finalization; the backend replays the grant, never a second one.
-                                reread = await sendVerify(record, record.request ?? buildRequest(record));
+                                const answer = await sendVerify(record, record.request ?? buildRequest(record));
+                                reread = answer?.kind === 'response' ? answer.response : undefined;
                                 finalization = reread?.verified === true
                                     ? reread.finalization?.status
                                     : undefined;
@@ -881,12 +1219,25 @@ export function createCommerceReconciler(input) {
                             retryLater(record.idempotencyKey);
                             return;
                         }
+                        if (sessionBlocked(record.idempotencyKey)) {
+                            return;
+                        }
                         let finished = false;
                         try {
                             finished = (await provider.finishTransaction({
                                 transactionId: finish.transactionId,
                                 ledgerEntryId: finish.ledgerEntryId,
                                 isConsumable: kind === 'consumable',
+                                // A record already `finishing` when this drive began was asked
+                                // to finish before (an earlier attempt or session): a `client`
+                                // store may read a consumable gone from its unfinished list as
+                                // that finish's lost acknowledgement. A first finish never is,
+                                // and a provider that does not declare the field never gets it.
+                                ...(owner === 'client'
+                                    && initial.state === 'finishing'
+                                    && provider.acceptsFinishRetry === true
+                                    ? { retry: true }
+                                    : {}),
                             })).finished;
                         }
                         catch (error) {
@@ -961,6 +1312,10 @@ export function createCommerceReconciler(input) {
     };
     const eventPass = { explicit: false, refreshCapabilities: false };
     const pass = async (options) => {
+        if (sessionBlocked()) {
+            // Queued events wait for a pass the session permits.
+            return;
+        }
         let capabilitiesNow = await readCapabilities(options.refreshCapabilities);
         if (options.refreshCapabilities) {
             await readServiceAlignment();
@@ -978,10 +1333,14 @@ export function createCommerceReconciler(input) {
         // call to journal the store answer: matched then, it is never journaled
         // twice, and a cancel event ends the attempt the call launched.
         const busy = inFlightProducts();
-        for (const event of [
-            ...deferred.splice(0, deferred.length),
-            ...inbox.splice(0, inbox.length),
-        ]) {
+        const queued = [...deferred.splice(0, deferred.length), ...inbox.splice(0, inbox.length)];
+        for (const [index, event] of queued.entries()) {
+            if (sessionBlocked()) {
+                // A purchase reported now may be another player's: it is not
+                // journaled under this one; the rest wait, in order.
+                inbox.unshift(...queued.slice(index));
+                return;
+            }
             try {
                 if (event.type === 'purchaseUpdated') {
                     const product = busy.size === 0 ? undefined : await resolveLogicalId(event.purchase);
@@ -1004,6 +1363,9 @@ export function createCommerceReconciler(input) {
             }
         }
         for (const listed of await listRecoverable()) {
+            if (sessionBlocked()) {
+                return;
+            }
             const record = records.get(listed.idempotencyKey) ?? listed;
             if (options.restoreTrigger !== true && waitsForRestoreTrigger(record)) {
                 // At the holder limit only the player's Restore Purchases asks again;
@@ -1012,6 +1374,9 @@ export function createCommerceReconciler(input) {
             }
             await drive(record, capabilitiesNow, options.explicit);
         }
+        if (sessionBlocked()) {
+            return;
+        }
         await revokeReversed();
     };
     const runUntilIdle = async () => {
@@ -1158,6 +1523,12 @@ export function createCommerceReconciler(input) {
                 })),
             };
         }
+        const lateRefusal = sessionRefusal();
+        if (lateRefusal !== undefined) {
+            // The session changed while the purchase was prepared: nothing is journaled.
+            fail('session', lateRefusal, request.idempotencyKey);
+            return { kind: 'answered', result: failedOutcome(lateRefusal) };
+        }
         const { created, record } = existing === undefined ? await reserve({
             idempotencyKey: request.idempotencyKey,
             store: storeId,
@@ -1263,6 +1634,12 @@ export function createCommerceReconciler(input) {
         // Only the call that reserved the record owns its in-flight entry: a
         // same-key replay must not release it while the store sheet is open.
         let owned = false;
+        const refusal = sessionRefusal();
+        if (refusal !== undefined) {
+            // Nothing is journaled and no store UI opens; the key stays usable.
+            fail('session', refusal, request.idempotencyKey);
+            return failedOutcome(refusal);
+        }
         try {
             const prepared = await withLock(() => prepareRequest(request));
             if (prepared.kind === 'answered') {
@@ -1281,14 +1658,39 @@ export function createCommerceReconciler(input) {
                         notStarted = event.state === 'not-started';
                     }
                 });
-                try {
-                    answer = await provider.requestPurchase(request);
-                }
-                catch (error) {
-                    answer = failedOutcome(error);
-                }
-                finally {
+                // Checked again with nothing awaited before the store call: the
+                // provider binds the purchase to the account current now, which must
+                // still be the player this attempt is journaled under.
+                const lateRefusal = sessionRefusal();
+                if (lateRefusal !== undefined) {
+                    fail('session', lateRefusal, request.idempotencyKey);
                     unsubscribePresentation?.();
+                    // The store never opened: the reserved attempt stays retryable.
+                    answer = failedOutcome(lateRefusal);
+                    notStarted = true;
+                }
+                else {
+                    try {
+                        answer = await provider.requestPurchase(request);
+                    }
+                    catch (error) {
+                        answer = failedOutcome(error);
+                    }
+                    finally {
+                        unsubscribePresentation?.();
+                    }
+                    // The provider refuses a missing or foreign account binding before
+                    // its store UI opens. Refused because the session changed meanwhile,
+                    // the attempt stays retryable instead of ending.
+                    const bindingRefusal = answer.outcome === 'failed'
+                        && answer.error.code === 'ACCOUNT_BINDING_REQUIRED'
+                        ? sessionRefusal()
+                        : undefined;
+                    if (bindingRefusal !== undefined) {
+                        fail('session', bindingRefusal, request.idempotencyKey);
+                        answer = failedOutcome(bindingRefusal);
+                        notStarted = true;
+                    }
                 }
                 result = await withLock(() => recordAnswer(request, prepared.record, prepared.product, answer, notStarted));
             }
@@ -1330,13 +1732,27 @@ export function createCommerceReconciler(input) {
             if (started) {
                 return;
             }
+            if (input.closed?.() === true) {
+                // Closed for good: nothing subscribes, and nothing awaits before this
+                // check, so a start under way already set `starting` for `stop()`.
+                return;
+            }
             if (starting !== undefined) {
                 return starting;
             }
             starting = (async () => {
                 try {
-                    await withLock(async () => {
+                    const subscribed = await withLock(async () => {
                         await loadRecords();
+                        // The owner closed while this start waited for the lock or the
+                        // journal (its `stop()` may have stopped waiting already): leave
+                        // as a refused start does, with nothing subscribed or started and
+                        // no error. The records read stay cached, as after a `reconcile()`
+                        // before any start. Nothing awaits between this check and the
+                        // subscription.
+                        if (input.closed?.() === true) {
+                            return false;
+                        }
                         // Subscribe first, then read: an event delivered before the listener is found either way.
                         unsubscribe = provider.subscribe(listener);
                         started = true;
@@ -1347,8 +1763,11 @@ export function createCommerceReconciler(input) {
                         initialScanPending = capabilitiesNow === undefined
                             || (capabilitiesNow.lifecycle.events && !(await readAvailable(capabilitiesNow)));
                         await pass({ explicit: true, refreshCapabilities: false });
+                        return true;
                     });
-                    await runUntilIdle();
+                    if (subscribed) {
+                        await runUntilIdle();
+                    }
                 }
                 catch (error) {
                     // A failed start is retryable: nothing stays subscribed or started.
@@ -1410,6 +1829,13 @@ export function createCommerceReconciler(input) {
         },
         runUntilIdle,
         async restorePurchases() {
+            const refusal = sessionRefusal();
+            if (refusal !== undefined) {
+                // A store restore (StoreKit's sync, an account sign-in) would run for
+                // the account current now, not this reconciler's player.
+                fail('session', refusal);
+                throw refusal;
+            }
             if (provider.restorePurchases !== undefined) {
                 try {
                     await provider.restorePurchases();
@@ -1442,6 +1868,12 @@ export function createCommerceReconciler(input) {
                 });
             });
             await runUntilIdle();
+            const lateRefusal = sessionRefusal();
+            if (lateRefusal !== undefined) {
+                // The session changed during the restore: the passes stopped early,
+                // so it did not finish for this player.
+                throw lateRefusal;
+            }
         },
         requestPurchase,
         async fetchProducts(request = {}) {