@wix/himalaya-cli 0.1564.0 → 0.1566.0

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/flows/screens/src/index.d.ts

@@ -35,12 +35,12 @@ export interface DetailedHeaderOptions {
     collapsedHeight?: number;
 }
 /**
- * Build the shared Detailed header used by One App migrations.
+ * Build an optional Detailed cover header for screens that explicitly request one.
  *
  * The header uses Himalaya's cross-platform `CollapsingHeader` and standard
- * components for the detail card, logo, member strip, and actions. A migration
- * calls this builder instead of copying header layout into each app. Himalaya's
- * hero accepts one image, so pass the first source cover image here.
+ * components for the detail card, logo, member strip, and actions. The One App
+ * migration workflow uses native navigation bars and does not call this builder.
+ * Himalaya's hero accepts one image.
  */
 export declare function detailedHeader(opts: DetailedHeaderOptions): Node;
 export interface ScreenEnvelope {

package/dist/cli.mjs

@@ -13604,6 +13604,7 @@ function webViewOriginAllowed(url, origins) {
 }
 var init_webview_origin = __esm({
   "../../core/ts/src/webview-origin.ts"() {
+    "use strict";
   }
 });
 
@@ -138915,6 +138916,7 @@ __export(build_exports2, {
   BAKE_OFFLINE_BASE: () => BAKE_OFFLINE_BASE,
   KNOWN_ICON_NAMES: () => KNOWN_ICON_NAMES,
   SOURCEMAP_ON_DEMAND_PATH: () => SOURCEMAP_ON_DEMAND_PATH,
+  SUPPORTED_COMPONENT_MIN_VERSION: () => SUPPORTED_COMPONENT_MIN_VERSION,
   bakeCatalogs: () => bakeCatalogs,
   bakeNeedsLiveOrigin: () => bakeNeedsLiveOrigin,
   bakeWidgets: () => bakeWidgets,
@@ -138927,6 +138929,7 @@ __export(build_exports2, {
   countingHostAnswers: () => countingHostAnswers,
   countingWixCall: () => countingWixCall,
   declaresHostProvidedIdentity: () => declaresHostProvidedIdentity,
+  explicitMinRuntimeVersion: () => explicitMinRuntimeVersion,
   gitSha: () => gitSha,
   isMonorepoCheckout: () => isMonorepoCheckout,
   l10nLintOptions: () => l10nLintOptions,
@@ -138936,6 +138939,7 @@ __export(build_exports2, {
   listBuildableApps: () => listBuildableApps,
   liveRenderServices: () => liveRenderServices,
   maximumBinaryVersion: () => maximumBinaryVersion,
+  navBundleMinBinaryVersion: () => navBundleMinBinaryVersion,
   navLogicBundleUrl: () => navLogicBundleUrl,
   pinBakedServerBaseUrl: () => pinBakedServerBaseUrl,
   pinnedReleaseFromEnv: () => pinnedReleaseFromEnv,
@@ -138946,6 +138950,7 @@ __export(build_exports2, {
   shellSha: () => shellSha,
   snapshotTokens: () => snapshotTokens,
   tokensSnapshotMessage: () => tokensSnapshotMessage,
+  unsupportedComponentMinVersions: () => unsupportedComponentMinVersions,
   withPinnedRelease: () => withPinnedRelease,
   withStoreNavBundle: () => withStoreNavBundle,
   withoutDevOnlyAppConfig: () => withoutDevOnlyAppConfig
@@ -139216,6 +139221,22 @@ function collectComponentTypes(value2, into = /* @__PURE__ */ new Set()) {
   for (const child of Object.values(obj7)) collectComponentTypes(child, into);
   return into;
 }
+function unsupportedComponentMinVersions(value2, into = []) {
+  if (!value2 || typeof value2 !== "object") return into;
+  const obj7 = value2;
+  const isComponent2 = typeof obj7.id === "string" && (obj7.body !== null && typeof obj7.body === "object" || typeof obj7.package === "string" && typeof obj7.type === "string");
+  if (isComponent2 && typeof obj7.minVersion === "number" && obj7.minVersion > SUPPORTED_COMPONENT_MIN_VERSION) {
+    into.push({ id: obj7.id, minVersion: obj7.minVersion });
+  }
+  for (const child of Object.values(obj7)) unsupportedComponentMinVersions(child, into);
+  return into;
+}
+function explicitMinRuntimeVersion(raw) {
+  if (raw === void 0 || raw.trim() === "") return null;
+  const v2 = raw.trim();
+  if (!/^\d+(?:\.\d+){0,2}$/.test(v2)) throw new Error(`invalid --min-runtime-version "${raw}": expected a numeric version like 1.7.0`);
+  return v2;
+}
 function collectNativeComponents(value2, into) {
   if (!value2 || typeof value2 !== "object") return;
   const obj7 = value2;
@@ -139238,6 +139259,21 @@ function maximumBinaryVersion(current, candidate) {
   }
   return current;
 }
+function navBundleMinBinaryVersion(text12) {
+  let cfg;
+  try {
+    cfg = JSON.parse(text12);
+  } catch {
+    return null;
+  }
+  let floor2 = null;
+  for (const ref of [cfg?.app?.logicBundle, cfg?.navigation?.navLogicBundle, cfg?.navLogicBundle]) {
+    if (!ref || typeof ref !== "object") continue;
+    floor2 = maximumBinaryVersion(floor2, ref.minBinaryVersion);
+    floor2 = maximumBinaryVersion(floor2, ref.min_binary_version);
+  }
+  return floor2;
+}
 async function withStoreNavBundle(text12, address) {
   let cfg;
   try {
@@ -139312,7 +139348,8 @@ async function buildRelease(app, dest, opts = {}) {
   return (await buildFromLoaded(loaded, dest, {
     ...tier5Dir ? { tier5Dir } : {},
     ...opts.fetchFace ? { fetchFace: opts.fetchFace } : {},
-    ...opts.keepDevOnlyAppConfig ? { keepDevOnlyAppConfig: true } : {}
+    ...opts.keepDevOnlyAppConfig ? { keepDevOnlyAppConfig: true } : {},
+    ...opts.minRuntimeVersion ? { minRuntimeVersion: opts.minRuntimeVersion } : {}
   })).manifest;
 }
 function countingWixCall(base) {
@@ -139443,6 +139480,13 @@ function readTokensForLint(preloaded) {
 }
 async function buildFromLoaded(preloaded, dest, opts = {}) {
   const app = preloaded.name;
+  const assertComponentMinVersions = (screenId, descriptor) => {
+    const bad2 = unsupportedComponentMinVersions(descriptor);
+    if (!bad2.length) return;
+    throw new Error(
+      `screen ${screenId}: component minVersion is not enforced by any runtime (supported: ${SUPPORTED_COMPONENT_MIN_VERSION}) \u2014 ` + bad2.map((c2) => `${c2.id} asks for ${c2.minVersion}`).join(", ") + `. Declare what the release needs from the runtime as its floor instead: min_binary_version on the logic bundle, or release:build --min-runtime-version.`
+    );
+  };
   const tier5Dir = opts.tier5Dir ?? TIER5_DIR;
   const bundlePath = (name) => {
     const own6 = join28(tier5Dir, `${name}.bundle.js`);
@@ -139629,7 +139673,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
     if (input && typeof input === "object" && !Array.isArray(input)) bundleInputs.set(bundleName, input);
   };
   let handlers;
-  let minBinaryVersion = null;
+  let minBinaryVersion = explicitMinRuntimeVersion(opts.minRuntimeVersion);
   const requiredCapabilities2 = new Set(config.capabilities ?? []);
   const capabilityUsage = {
     app: [...config.capabilities ?? []],
@@ -139868,6 +139912,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
         continue;
       }
       const descriptor = await res.json();
+      assertComponentMinVersions(screenId, descriptor);
       collectNativeComponents(descriptor, requiredNativeComponents);
       let bundleName = null;
       const lb = logicBundleOf(descriptor);
@@ -140038,6 +140083,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
             continue;
           }
           const descriptor = await res.json();
+          assertComponentMinVersions(screenId, descriptor);
           collectNativeComponents(descriptor, requiredNativeComponents);
           let bundleName = null;
           const lb = logicBundleOf(descriptor);
@@ -140163,6 +140209,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
       });
       await store.putAppConfig(app, text12);
       appConfigHash = sha2563(text12);
+      minBinaryVersion = maximumBinaryVersion(minBinaryVersion, navBundleMinBinaryVersion(text12));
       if (collect2?.descriptors) for (const id of linkableScreenIdsFrom(text12)) linkable.add(id);
     }
     const ahRes = await devFetch(`${base}/v1/action-handlers/${encodeURIComponent(app)}`, { headers: { "X-Himalaya-App": app } });
@@ -140368,7 +140415,7 @@ function declaresHostProvidedIdentity(auth) {
   const config = auth?.config;
   return typeof config === "object" && config !== null && config.hostProvided === true;
 }
-var BAKE_OFFLINE_BASE, KNOWN_ICON_NAMES, KNOWN_ICONS, APP_SERVICES_LINT_SCREEN, REPO_ROOT5, TIER5_DIR, requireFromHere, SOURCEMAP_ON_DEMAND_PATH, BAKED_SERVER_BASE_URL, SETTLE_TURNS;
+var BAKE_OFFLINE_BASE, KNOWN_ICON_NAMES, KNOWN_ICONS, APP_SERVICES_LINT_SCREEN, REPO_ROOT5, TIER5_DIR, requireFromHere, SOURCEMAP_ON_DEMAND_PATH, BAKED_SERVER_BASE_URL, SUPPORTED_COMPONENT_MIN_VERSION, SETTLE_TURNS;
 var init_build3 = __esm({
   "../release-build/build.ts"() {
     init_site_view_metadata();
@@ -140412,6 +140459,7 @@ var init_build3 = __esm({
     requireFromHere = createRequire3(import.meta.url);
     SOURCEMAP_ON_DEMAND_PATH = join28(REPO_ROOT5, "core/dev-server/tier5-bundles-src/sourcemap-on-demand.mjs");
     BAKED_SERVER_BASE_URL = "http://baked.himalaya.invalid";
+    SUPPORTED_COMPONENT_MIN_VERSION = 1;
     SETTLE_TURNS = 20;
   }
 });

package/guides/iap-screen-adoption.md

@@ -103,9 +103,12 @@ support." (Wix refused it, so it stays held), `restoreUpToDateText` "Your purcha
 "Couldn't reach the App Store. Try again." (also shown when the host cannot sell). A message belongs
 to the session it ran for: after a sign-in or sign-out the control shows none.
 
-**Not covered yet.** After a reinstall the native managed ledger is gone and its tenant filter hides
-the unfinished transactions, so restore finds none of them until that is fixed; it still re-reads
-access. On iOS `AppStore.sync()` errors are swallowed natively, so a failed sync currently reads as
+**Reinstall.** A reinstall deletes the native managed ledger. In an app's own bound build, an
+unfinished transaction under the app's bundle id is still the app's own, so restore resubmits it.
+In Player or an explicit host, the tenant filter hides those transactions and restore finds none;
+it still re-reads access ([transaction contract](iap-transaction-contract.md#activation-limits-and-compatibility)).
+
+**Not covered yet.** On iOS `AppStore.sync()` errors are swallowed natively, so a failed sync currently reads as
 up to date rather than the error copy.
 
 ## Migrating an existing app copy

package/guides/one-app-to-himi-app.md

@@ -147,7 +147,7 @@ Apply these interpretation rules:
   only when the resolved source top-bar settings show a title and Structure supplies
   its value; leave it empty when the source does not show a title or has no title.
   Do not create a title from the app name, business name, route ID, tab label or
-  section content. Keep a custom page header separate from the shell top bar.
+  section content. Apply the native-navigation policy below to source custom headers.
 - Keep navigation visibility, reachability and data access separate. Reevaluate
   membership/plan/badge gates at runtime; an operator's successful read is not an
   end-user access policy. Never expose protected content beneath a visual gate.
@@ -205,30 +205,34 @@ Apply these interpretation rules:
   explicitly rather than treating a pass as full design parity. A deliberate difference
   is waived only by a `design` coverage row with status `adapted` that cites the user's
   instruction and explains the change. This check compares values, not rendered screens.
-- For each configured Detailed header, import and call the shared
-  `detailedHeader` builder from `@wix/himalaya/screens`. Do not recreate its
-  component tree in the app. Resolve the source fallback and visibility rules
-  first, then pass the title, subtitle, first cover image, logo, permitted member
-  data, location label and configured actions. Set `collapsible: false` when the
-  source header is not collapsible. The shared hero supports one cover image; list
-  additional source carousel images as an adaptation gap.
-
-```ts
-import { detailedHeader } from "@wix/himalaya/screens";
-
-const header = detailedHeader({
-  id: "home.header",
-  title: "Studio name",
-  subtitle: "Source subtitle",
-  imageUrl: "https://example.test/cover.jpg",
-  primaryAction: {
-    label: "Join",
-    action: { actionId: "himi.open", params: { screenId: "membership" } },
-  },
-});
-```
-
-Add this returned component to the screen tree at the source header position.
+- **Native navigation is the migration target.** Use the shell's native top bar
+  and, for bottom-tab navigation, `navigation.tabBar.presentation: "native"`.
+  Do not recreate the source Detailed header, call `detailedHeader`, or insert a
+  `CollapsingHeader` hero/card above the page. This target adaptation supersedes
+  the older instruction to reproduce the source cover header; the source
+  research still explains how to interpret its settings.
+- Emit resolved native actions in `navigation.topBarDefault` or a complete
+  per-screen `topBar` override. The shell owns back/menu controls. Per-screen
+  actions support `hiddenPath` when `navigation.topBarDefault.actions` declares
+  the same action ID and binding, evaluated by `navigation.navLogicBundle`.
+  Keep that registration for screen overrides: screen-only paths are not
+  subscribed, and an unresolved path leaves the action visible. Do not invent
+  visibility fields. These bindings control presentation only and must not
+  authorize data or actions. Preserve runtime access checks, and report any source visibility
+  rule that the target cannot represent as a gap. Preserve the title rule above:
+  a source cover title does not by itself authorize a native top-bar title.
+- Account for source header content in `.himi/one-app/migration-report.md`.
+  Record the custom cover, carousel and overlapping card as an intentional
+  native-navigation adaptation there; do not invent header-presentation rows in
+  the derived coverage ledger. Preserve meaningful subtitle, location and configured CTA content
+  as ordinary page content or supported native actions, with the same runtime
+  access rules. Report unsupported avatar/logo/action behavior as a gap; do not
+  invent member data, drop a configured CTA silently, or add an in-page toolbar
+  to imitate a missing native control.
+- Verify the migrated app's native top bar, bottom tabs, back navigation and
+  configured actions on the affected devices, including RTL. A web screenshot
+  alone does not prove native navigation or control availability. Record any
+  unavailable device check as unverified.
 - Business context contains only `phoneNumber`, `website`, and `services`, with
   their permitted nested values. Structure wins on authored phone/URL/design.
   Installed services do not add features. Installation IDs are not record IDs.
@@ -257,8 +261,11 @@ reference's top-tabs row in R04 and its top-tabs acceptance case:
   in-screen top tabs.
 - `target.hiddenPages` become screens without a tab entry. Keep their routes for
   actions and links.
-- The first tab takes the source screen's header. The other tabs take a compact
-  default top bar, as the editor gives each new screen a default header.
+- The plan attaches the source screen's header settings to the first tab as
+  interpretation evidence; it does not require a custom header in the target.
+  Apply the native-navigation policy above to that tab too. Resolve every tab's
+  effective native top bar, with compact defaults for the other tabs as in the
+  editor conversion.
 - `target.initialTabId` is the first tab; the editor drops the source
   `initialTabId`. `initial_tab_changed` names the page that used to open first.
 - `target.showLabels` is the source label setting. Pilates hides labels when it

package/guides/one-app-viewer.md

@@ -127,11 +127,11 @@ Translate the resolved result to Himi. Its inspected schema says a per-screen `t
 - Resolve the effective source bar for every target screen, including screens created by a navigation conversion. Do not assume that a shared source header means every screen has the same effective bar.
 - When screens have the same effective actions and style, use one shared `TopBarConfig` value or builder for them. Use it as `top_bar_default` when it is the app-wide bar. Use a complete per-screen `top_bar` only when a screen differs.
 - Himi reads the bar title from `ScreenDescriptor.title`. Set this field only when the resolved source top-bar settings show a title and Structure supplies that title. For a dynamic source title, use the title resolved by the viewer rules. If the source does not show a title or has no title value, leave the target title empty. Do not invent a title from the app name, business name, route ID, tab label, or section content.
-- A source custom header is page content. It is not the shell's top bar. Keep the two surfaces separate. Reuse a page-header component only when multiple screens share that configured header content.
+- A source custom header is page content in the original viewer. It is not the shell's top bar. Apply the current migration's native-navigation adaptation in R09 rather than duplicating the source header above the native bar.
 
 ### R09. Treat header content as conditional, configured behavior
 
-Use supplied header inputs within the agreed shared-header scope. If the source config requires content beyond that scope, describe it and the needed target adaptation before expanding the implementation.
+The source rules below describe the original viewer. **For the current One App migration target, use native navigation bars, bottom tabs and the top bar; do not reproduce a custom Detailed cover header.** This target policy supersedes this reference's older shared-header recommendation. Keep the source facts as interpretation evidence and record the target adaptation explicitly.
 
 Relevant source behavior to preserve when applicable:
 
@@ -142,7 +142,9 @@ Relevant source behavior to preserve when applicable:
 - Logo, invite button, CTA, member count/avatars, and business-profile entry point have separate controls. A CTA needs both its configuration and its show flag.
 - Member visibility and restaurant/location behavior depend on runtime services and permissions. Structure does not contain the member records needed to populate them; the restricted business export is not a member directory.
 
-For a configured Detailed header, use `detailedHeader` from `@wix/himalaya/screens`. This shared builder uses Himalaya's cross-platform `CollapsingHeader`, a rounded detail card, and standard logo, member, and button components. Every migration must call this builder. Do not copy its component tree into an app. Pass the resolved title, subtitle, first cover image, logo, allowed member data, location label, configured actions, and the page nodes in `content`. Put the remaining screen content in `content` so it scrolls beneath the hero and the hero collapses with the page. Do not place those nodes as siblings of the returned header. Keep member data hidden when the source permissions or runtime services do not allow it. The current hero supports one cover image; keep the source order and record extra carousel images as an adaptation gap. If `isCollapsible` is false, pass `collapsible: false` so the hero keeps one height. [Header domain](https://github.com/wix-private/mobile-modules/blob/3a9713cf8bbb014ce4d3006d356a82a0f02db007/packages/libraries/pilates/src/domain/Header.ts) · [Header view model](https://github.com/wix-private/mobile-modules/blob/3a9713cf8bbb014ce4d3006d356a82a0f02db007/packages/libraries/pilates/src/elements/PilatesHeader/useViewModel.ts) · [Detailed header presenter](https://github.com/wix-private/mobile-modules/blob/3a9713cf8bbb014ce4d3006d356a82a0f02db007/packages/modules/wix-one-app-member-view/src/newStructure/elements/headers/detailedHeader/usePresenter.ts) · [Himi schema](https://github.com/wix-private/himalaya/blob/d3bc68c77151b678d337323615eb9889fa8e38c3/core/schema/core.proto)
+Do not call `detailedHeader` or add a `CollapsingHeader` hero/card in the migrated screen. Configure the shell through `navigation.topBarDefault`, complete per-screen `topBar` overrides, and `navigation.tabBar.presentation: "native"` for bottom tabs. Keep R08a's title and action-resolution rules; the shell owns back/menu controls. The `navigation-plan.json` first-tab source-header reference is evidence, not an instruction to render the old header.
+
+Record the omitted custom cover, carousel and overlapping card as an adaptation in `.himi/one-app/migration-report.md`; do not invent header-presentation rows in the derived coverage ledger. Preserve meaningful subtitle, location and configured CTA content as ordinary page content or supported native actions, subject to the original runtime access rules. Per-screen `topBar.actions` support `hiddenPath` when `navigation.topBarDefault.actions` declares the same action ID and binding, evaluated by `navigation.navLogicBundle`. Keep that registration for screen overrides: screen-only paths are not subscribed, and an unresolved path leaves the action visible. Preserve representable source visibility rules through these supported bindings; do not invent visibility fields. These bindings control presentation only, not authorization. Keep runtime access checks and report source visibility rules the target cannot represent as gaps. Unsupported leading avatars, logos or actions remain explicit gaps; do not invent member data or an in-page toolbar. Verify top bars, bottom tabs, back navigation and configured actions on affected native devices, including RTL; report unavailable checks as unverified. [Header domain](https://github.com/wix-private/mobile-modules/blob/3a9713cf8bbb014ce4d3006d356a82a0f02db007/packages/libraries/pilates/src/domain/Header.ts) · [Header view model](https://github.com/wix-private/mobile-modules/blob/3a9713cf8bbb014ce4d3006d356a82a0f02db007/packages/libraries/pilates/src/elements/PilatesHeader/useViewModel.ts) · [Detailed header presenter](https://github.com/wix-private/mobile-modules/blob/3a9713cf8bbb014ce4d3006d356a82a0f02db007/packages/modules/wix-one-app-member-view/src/newStructure/elements/headers/detailedHeader/usePresenter.ts) · [Himi schema](https://github.com/wix-private/himalaya/blob/d3bc68c77151b678d337323615eb9889fa8e38c3/core/schema/core.proto)
 
 ## Step 4 — Recreate each section envelope before its content
 

package/guides/sdk-reference.json

@@ -4117,7 +4117,7 @@
       {
         "name": "detailedHeader",
         "kind": "function",
-        "jsdoc": "/**\n * Build the shared Detailed header used by One App migrations.\n *\n * The header uses Himalaya's cross-platform `CollapsingHeader` and standard\n * components for the detail card, logo, member strip, and actions. A migration\n * calls this builder instead of copying header layout into each app. Himalaya's\n * hero accepts one image, so pass the first source cover image here.\n */",
+        "jsdoc": "/**\n * Build an optional Detailed cover header for screens that explicitly request one.\n *\n * The header uses Himalaya's cross-platform `CollapsingHeader` and standard\n * components for the detail card, logo, member strip, and actions. The One App\n * migration workflow uses native navigation bars and does not call this builder.\n * Himalaya's hero accepts one image.\n */",
         "decl": "export function detailedHeader(opts: DetailedHeaderOptions): Node;"
       },
       {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1564.0",
+  "version": "0.1566.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -71,5 +71,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "71c5eb27bff3ea0c176e99091c8c457b4d2a6bc36fea244505eb12f9"
+  "falconPackageHash": "59d9f7c34824b26777859c276927fa1bde614c8f64c26db04c10bfb3"
 }

package/templates/beauty-salon/tier5-src/himi-store-account/index.ts

@@ -234,6 +234,9 @@ let signInPresentationRequested: "" | "sheet" | "full_screen" = "";
 let signInReturnTabRequested = "";
 let standaloneRequested = false;
 let pollIdentityRequested = false;
+// iOS can start the arg-less boot load after the appear refresh that asks for the row; the
+// newer boot probe must not land, or be kept, without it.
+let restorePurchasesRequested = false;
 // Bumped by every mode switch, so a dropped probe never puts back a mode the visitor left.
 let modeSwitches = 0;
 
@@ -246,6 +249,7 @@ function appearBase(): Partial<S> {
     signInScreen: signInScreenRequested,
     standalone: standaloneRequested,
     pollIdentity: pollIdentityRequested,
+    restorePurchases: restorePurchasesRequested,
     ...(pollIdentityRequested ? { _poll: { ...IDENTITY_POLL } } : {}),
   };
 }
@@ -268,6 +272,7 @@ function appearConfig(s: S, arg: unknown): AppearConfig {
   // Only the sign-in screen's route carries `mode`, so it marks the form from the boot load on.
   standaloneRequested ||= s.standalone || appearing || (!routeInputConsumed && !!routeInput().mode);
   pollIdentityRequested ||= s.pollIdentity || strField(arg, "pollIdentity") === "1";
+  restorePurchasesRequested ||= s.restorePurchases || strField(arg, "restorePurchases") === "1";
   // The form opens on the mode its route asked for each time it appears, sign-in by
   // default: a pooled worker reopened with the same params must not open on the mode the
   // last visit toggled to.
@@ -652,8 +657,7 @@ async function probe(s: S, arg?: unknown, config: AppearConfig = appearConfig(s,
   // Not the boot load: it never carries the copy, and the appear refresh that does is coming.
   if (strField(arg, "boot") !== "1") headingReady = true;
   const memberAccountLinks = memberAccountLinksRequested;
-  const restorePurchases = s.restorePurchases || strField(arg, "restorePurchases") === "1";
-  if (restorePurchases) enterCommerce();
+  if (restorePurchasesRequested) enterCommerce();
   const routes = memberAccountLinks ? await memberAccountRoutes() : { addresses: false, wallet: false };
   let activityRows: AccountActivityRow[] = [];
   if (profile.isMember) {
@@ -681,7 +685,6 @@ async function probe(s: S, arg?: unknown, config: AppearConfig = appearConfig(s,
     email: profile.memberEmail || s.email,
     message: "",
     memberAccountLinks,
-    restorePurchases,
     ...appearBase(),
     ...config.mode,
     ...config.visit,

package/templates/branded-lite/tier5-src/himi-store-account/index.ts

@@ -234,6 +234,9 @@ let signInPresentationRequested: "" | "sheet" | "full_screen" = "";
 let signInReturnTabRequested = "";
 let standaloneRequested = false;
 let pollIdentityRequested = false;
+// iOS can start the arg-less boot load after the appear refresh that asks for the row; the
+// newer boot probe must not land, or be kept, without it.
+let restorePurchasesRequested = false;
 // Bumped by every mode switch, so a dropped probe never puts back a mode the visitor left.
 let modeSwitches = 0;
 
@@ -246,6 +249,7 @@ function appearBase(): Partial<S> {
     signInScreen: signInScreenRequested,
     standalone: standaloneRequested,
     pollIdentity: pollIdentityRequested,
+    restorePurchases: restorePurchasesRequested,
     ...(pollIdentityRequested ? { _poll: { ...IDENTITY_POLL } } : {}),
   };
 }
@@ -268,6 +272,7 @@ function appearConfig(s: S, arg: unknown): AppearConfig {
   // Only the sign-in screen's route carries `mode`, so it marks the form from the boot load on.
   standaloneRequested ||= s.standalone || appearing || (!routeInputConsumed && !!routeInput().mode);
   pollIdentityRequested ||= s.pollIdentity || strField(arg, "pollIdentity") === "1";
+  restorePurchasesRequested ||= s.restorePurchases || strField(arg, "restorePurchases") === "1";
   // The form opens on the mode its route asked for each time it appears, sign-in by
   // default: a pooled worker reopened with the same params must not open on the mode the
   // last visit toggled to.
@@ -652,8 +657,7 @@ async function probe(s: S, arg?: unknown, config: AppearConfig = appearConfig(s,
   // Not the boot load: it never carries the copy, and the appear refresh that does is coming.
   if (strField(arg, "boot") !== "1") headingReady = true;
   const memberAccountLinks = memberAccountLinksRequested;
-  const restorePurchases = s.restorePurchases || strField(arg, "restorePurchases") === "1";
-  if (restorePurchases) enterCommerce();
+  if (restorePurchasesRequested) enterCommerce();
   const routes = memberAccountLinks ? await memberAccountRoutes() : { addresses: false, wallet: false };
   let activityRows: AccountActivityRow[] = [];
   if (profile.isMember) {
@@ -681,7 +685,6 @@ async function probe(s: S, arg?: unknown, config: AppearConfig = appearConfig(s,
     email: profile.memberEmail || s.email,
     message: "",
     memberAccountLinks,
-    restorePurchases,
     ...appearBase(),
     ...config.mode,
     ...config.visit,

package/templates/community-club/tier5-src/himi-store-account/index.ts

@@ -234,6 +234,9 @@ let signInPresentationRequested: "" | "sheet" | "full_screen" = "";
 let signInReturnTabRequested = "";
 let standaloneRequested = false;
 let pollIdentityRequested = false;
+// iOS can start the arg-less boot load after the appear refresh that asks for the row; the
+// newer boot probe must not land, or be kept, without it.
+let restorePurchasesRequested = false;
 // Bumped by every mode switch, so a dropped probe never puts back a mode the visitor left.
 let modeSwitches = 0;
 
@@ -246,6 +249,7 @@ function appearBase(): Partial<S> {
     signInScreen: signInScreenRequested,
     standalone: standaloneRequested,
     pollIdentity: pollIdentityRequested,
+    restorePurchases: restorePurchasesRequested,
     ...(pollIdentityRequested ? { _poll: { ...IDENTITY_POLL } } : {}),
   };
 }
@@ -268,6 +272,7 @@ function appearConfig(s: S, arg: unknown): AppearConfig {
   // Only the sign-in screen's route carries `mode`, so it marks the form from the boot load on.
   standaloneRequested ||= s.standalone || appearing || (!routeInputConsumed && !!routeInput().mode);
   pollIdentityRequested ||= s.pollIdentity || strField(arg, "pollIdentity") === "1";
+  restorePurchasesRequested ||= s.restorePurchases || strField(arg, "restorePurchases") === "1";
   // The form opens on the mode its route asked for each time it appears, sign-in by
   // default: a pooled worker reopened with the same params must not open on the mode the
   // last visit toggled to.
@@ -652,8 +657,7 @@ async function probe(s: S, arg?: unknown, config: AppearConfig = appearConfig(s,
   // Not the boot load: it never carries the copy, and the appear refresh that does is coming.
   if (strField(arg, "boot") !== "1") headingReady = true;
   const memberAccountLinks = memberAccountLinksRequested;
-  const restorePurchases = s.restorePurchases || strField(arg, "restorePurchases") === "1";
-  if (restorePurchases) enterCommerce();
+  if (restorePurchasesRequested) enterCommerce();
   const routes = memberAccountLinks ? await memberAccountRoutes() : { addresses: false, wallet: false };
   let activityRows: AccountActivityRow[] = [];
   if (profile.isMember) {
@@ -681,7 +685,6 @@ async function probe(s: S, arg?: unknown, config: AppearConfig = appearConfig(s,
     email: profile.memberEmail || s.email,
     message: "",
     memberAccountLinks,
-    restorePurchases,
     ...appearBase(),
     ...config.mode,
     ...config.visit,

package/templates/events-meetups/tier5-src/himi-store-account/index.ts

@@ -234,6 +234,9 @@ let signInPresentationRequested: "" | "sheet" | "full_screen" = "";
 let signInReturnTabRequested = "";
 let standaloneRequested = false;
 let pollIdentityRequested = false;
+// iOS can start the arg-less boot load after the appear refresh that asks for the row; the
+// newer boot probe must not land, or be kept, without it.
+let restorePurchasesRequested = false;
 // Bumped by every mode switch, so a dropped probe never puts back a mode the visitor left.
 let modeSwitches = 0;
 
@@ -246,6 +249,7 @@ function appearBase(): Partial<S> {
     signInScreen: signInScreenRequested,
     standalone: standaloneRequested,
     pollIdentity: pollIdentityRequested,
+    restorePurchases: restorePurchasesRequested,
     ...(pollIdentityRequested ? { _poll: { ...IDENTITY_POLL } } : {}),
   };
 }
@@ -268,6 +272,7 @@ function appearConfig(s: S, arg: unknown): AppearConfig {
   // Only the sign-in screen's route carries `mode`, so it marks the form from the boot load on.
   standaloneRequested ||= s.standalone || appearing || (!routeInputConsumed && !!routeInput().mode);
   pollIdentityRequested ||= s.pollIdentity || strField(arg, "pollIdentity") === "1";
+  restorePurchasesRequested ||= s.restorePurchases || strField(arg, "restorePurchases") === "1";
   // The form opens on the mode its route asked for each time it appears, sign-in by
   // default: a pooled worker reopened with the same params must not open on the mode the
   // last visit toggled to.
@@ -652,8 +657,7 @@ async function probe(s: S, arg?: unknown, config: AppearConfig = appearConfig(s,
   // Not the boot load: it never carries the copy, and the appear refresh that does is coming.
   if (strField(arg, "boot") !== "1") headingReady = true;
   const memberAccountLinks = memberAccountLinksRequested;
-  const restorePurchases = s.restorePurchases || strField(arg, "restorePurchases") === "1";
-  if (restorePurchases) enterCommerce();
+  if (restorePurchasesRequested) enterCommerce();
   const routes = memberAccountLinks ? await memberAccountRoutes() : { addresses: false, wallet: false };
   let activityRows: AccountActivityRow[] = [];
   if (profile.isMember) {
@@ -681,7 +685,6 @@ async function probe(s: S, arg?: unknown, config: AppearConfig = appearConfig(s,
     email: profile.memberEmail || s.email,
     message: "",
     memberAccountLinks,
-    restorePurchases,
     ...appearBase(),
     ...config.mode,
     ...config.visit,

package/templates/gym-fitness/tier5-src/himi-store-account/index.ts

@@ -234,6 +234,9 @@ let signInPresentationRequested: "" | "sheet" | "full_screen" = "";
 let signInReturnTabRequested = "";
 let standaloneRequested = false;
 let pollIdentityRequested = false;
+// iOS can start the arg-less boot load after the appear refresh that asks for the row; the
+// newer boot probe must not land, or be kept, without it.
+let restorePurchasesRequested = false;
 // Bumped by every mode switch, so a dropped probe never puts back a mode the visitor left.
 let modeSwitches = 0;
 
@@ -246,6 +249,7 @@ function appearBase(): Partial<S> {
     signInScreen: signInScreenRequested,
     standalone: standaloneRequested,
     pollIdentity: pollIdentityRequested,
+    restorePurchases: restorePurchasesRequested,
     ...(pollIdentityRequested ? { _poll: { ...IDENTITY_POLL } } : {}),
   };
 }
@@ -268,6 +272,7 @@ function appearConfig(s: S, arg: unknown): AppearConfig {
   // Only the sign-in screen's route carries `mode`, so it marks the form from the boot load on.
   standaloneRequested ||= s.standalone || appearing || (!routeInputConsumed && !!routeInput().mode);
   pollIdentityRequested ||= s.pollIdentity || strField(arg, "pollIdentity") === "1";
+  restorePurchasesRequested ||= s.restorePurchases || strField(arg, "restorePurchases") === "1";
   // The form opens on the mode its route asked for each time it appears, sign-in by
   // default: a pooled worker reopened with the same params must not open on the mode the
   // last visit toggled to.
@@ -652,8 +657,7 @@ async function probe(s: S, arg?: unknown, config: AppearConfig = appearConfig(s,
   // Not the boot load: it never carries the copy, and the appear refresh that does is coming.
   if (strField(arg, "boot") !== "1") headingReady = true;
   const memberAccountLinks = memberAccountLinksRequested;
-  const restorePurchases = s.restorePurchases || strField(arg, "restorePurchases") === "1";
-  if (restorePurchases) enterCommerce();
+  if (restorePurchasesRequested) enterCommerce();
   const routes = memberAccountLinks ? await memberAccountRoutes() : { addresses: false, wallet: false };
   let activityRows: AccountActivityRow[] = [];
   if (profile.isMember) {
@@ -681,7 +685,6 @@ async function probe(s: S, arg?: unknown, config: AppearConfig = appearConfig(s,
     email: profile.memberEmail || s.email,
     message: "",
     memberAccountLinks,
-    restorePurchases,
     ...appearBase(),
     ...config.mode,
     ...config.visit,

package/templates/nonprofit-cause/tier5-src/himi-store-account/index.ts

@@ -234,6 +234,9 @@ let signInPresentationRequested: "" | "sheet" | "full_screen" = "";
 let signInReturnTabRequested = "";
 let standaloneRequested = false;
 let pollIdentityRequested = false;
+// iOS can start the arg-less boot load after the appear refresh that asks for the row; the
+// newer boot probe must not land, or be kept, without it.
+let restorePurchasesRequested = false;
 // Bumped by every mode switch, so a dropped probe never puts back a mode the visitor left.
 let modeSwitches = 0;
 
@@ -246,6 +249,7 @@ function appearBase(): Partial<S> {
     signInScreen: signInScreenRequested,
     standalone: standaloneRequested,
     pollIdentity: pollIdentityRequested,
+    restorePurchases: restorePurchasesRequested,
     ...(pollIdentityRequested ? { _poll: { ...IDENTITY_POLL } } : {}),
   };
 }
@@ -268,6 +272,7 @@ function appearConfig(s: S, arg: unknown): AppearConfig {
   // Only the sign-in screen's route carries `mode`, so it marks the form from the boot load on.
   standaloneRequested ||= s.standalone || appearing || (!routeInputConsumed && !!routeInput().mode);
   pollIdentityRequested ||= s.pollIdentity || strField(arg, "pollIdentity") === "1";
+  restorePurchasesRequested ||= s.restorePurchases || strField(arg, "restorePurchases") === "1";
   // The form opens on the mode its route asked for each time it appears, sign-in by
   // default: a pooled worker reopened with the same params must not open on the mode the
   // last visit toggled to.
@@ -652,8 +657,7 @@ async function probe(s: S, arg?: unknown, config: AppearConfig = appearConfig(s,
   // Not the boot load: it never carries the copy, and the appear refresh that does is coming.
   if (strField(arg, "boot") !== "1") headingReady = true;
   const memberAccountLinks = memberAccountLinksRequested;
-  const restorePurchases = s.restorePurchases || strField(arg, "restorePurchases") === "1";
-  if (restorePurchases) enterCommerce();
+  if (restorePurchasesRequested) enterCommerce();
   const routes = memberAccountLinks ? await memberAccountRoutes() : { addresses: false, wallet: false };
   let activityRows: AccountActivityRow[] = [];
   if (profile.isMember) {
@@ -681,7 +685,6 @@ async function probe(s: S, arg?: unknown, config: AppearConfig = appearConfig(s,
     email: profile.memberEmail || s.email,
     message: "",
     memberAccountLinks,
-    restorePurchases,
     ...appearBase(),
     ...config.mode,
     ...config.visit,

package/templates/podcast-creator/tier5-src/himi-store-account/index.ts

@@ -234,6 +234,9 @@ let signInPresentationRequested: "" | "sheet" | "full_screen" = "";
 let signInReturnTabRequested = "";
 let standaloneRequested = false;
 let pollIdentityRequested = false;
+// iOS can start the arg-less boot load after the appear refresh that asks for the row; the
+// newer boot probe must not land, or be kept, without it.
+let restorePurchasesRequested = false;
 // Bumped by every mode switch, so a dropped probe never puts back a mode the visitor left.
 let modeSwitches = 0;
 
@@ -246,6 +249,7 @@ function appearBase(): Partial<S> {
     signInScreen: signInScreenRequested,
     standalone: standaloneRequested,
     pollIdentity: pollIdentityRequested,
+    restorePurchases: restorePurchasesRequested,
     ...(pollIdentityRequested ? { _poll: { ...IDENTITY_POLL } } : {}),
   };
 }
@@ -268,6 +272,7 @@ function appearConfig(s: S, arg: unknown): AppearConfig {
   // Only the sign-in screen's route carries `mode`, so it marks the form from the boot load on.
   standaloneRequested ||= s.standalone || appearing || (!routeInputConsumed && !!routeInput().mode);
   pollIdentityRequested ||= s.pollIdentity || strField(arg, "pollIdentity") === "1";
+  restorePurchasesRequested ||= s.restorePurchases || strField(arg, "restorePurchases") === "1";
   // The form opens on the mode its route asked for each time it appears, sign-in by
   // default: a pooled worker reopened with the same params must not open on the mode the
   // last visit toggled to.
@@ -652,8 +657,7 @@ async function probe(s: S, arg?: unknown, config: AppearConfig = appearConfig(s,
   // Not the boot load: it never carries the copy, and the appear refresh that does is coming.
   if (strField(arg, "boot") !== "1") headingReady = true;
   const memberAccountLinks = memberAccountLinksRequested;
-  const restorePurchases = s.restorePurchases || strField(arg, "restorePurchases") === "1";
-  if (restorePurchases) enterCommerce();
+  if (restorePurchasesRequested) enterCommerce();
   const routes = memberAccountLinks ? await memberAccountRoutes() : { addresses: false, wallet: false };
   let activityRows: AccountActivityRow[] = [];
   if (profile.isMember) {
@@ -681,7 +685,6 @@ async function probe(s: S, arg?: unknown, config: AppearConfig = appearConfig(s,
     email: profile.memberEmail || s.email,
     message: "",
     memberAccountLinks,
-    restorePurchases,
     ...appearBase(),
     ...config.mode,
     ...config.visit,

package/templates/portfolio-creative/tier5-src/himi-store-account/index.ts

@@ -234,6 +234,9 @@ let signInPresentationRequested: "" | "sheet" | "full_screen" = "";
 let signInReturnTabRequested = "";
 let standaloneRequested = false;
 let pollIdentityRequested = false;
+// iOS can start the arg-less boot load after the appear refresh that asks for the row; the
+// newer boot probe must not land, or be kept, without it.
+let restorePurchasesRequested = false;
 // Bumped by every mode switch, so a dropped probe never puts back a mode the visitor left.
 let modeSwitches = 0;
 
@@ -246,6 +249,7 @@ function appearBase(): Partial<S> {
     signInScreen: signInScreenRequested,
     standalone: standaloneRequested,
     pollIdentity: pollIdentityRequested,
+    restorePurchases: restorePurchasesRequested,
     ...(pollIdentityRequested ? { _poll: { ...IDENTITY_POLL } } : {}),
   };
 }
@@ -268,6 +272,7 @@ function appearConfig(s: S, arg: unknown): AppearConfig {
   // Only the sign-in screen's route carries `mode`, so it marks the form from the boot load on.
   standaloneRequested ||= s.standalone || appearing || (!routeInputConsumed && !!routeInput().mode);
   pollIdentityRequested ||= s.pollIdentity || strField(arg, "pollIdentity") === "1";
+  restorePurchasesRequested ||= s.restorePurchases || strField(arg, "restorePurchases") === "1";
   // The form opens on the mode its route asked for each time it appears, sign-in by
   // default: a pooled worker reopened with the same params must not open on the mode the
   // last visit toggled to.
@@ -652,8 +657,7 @@ async function probe(s: S, arg?: unknown, config: AppearConfig = appearConfig(s,
   // Not the boot load: it never carries the copy, and the appear refresh that does is coming.
   if (strField(arg, "boot") !== "1") headingReady = true;
   const memberAccountLinks = memberAccountLinksRequested;
-  const restorePurchases = s.restorePurchases || strField(arg, "restorePurchases") === "1";
-  if (restorePurchases) enterCommerce();
+  if (restorePurchasesRequested) enterCommerce();
   const routes = memberAccountLinks ? await memberAccountRoutes() : { addresses: false, wallet: false };
   let activityRows: AccountActivityRow[] = [];
   if (profile.isMember) {
@@ -681,7 +685,6 @@ async function probe(s: S, arg?: unknown, config: AppearConfig = appearConfig(s,
     email: profile.memberEmail || s.email,
     message: "",
     memberAccountLinks,
-    restorePurchases,
     ...appearBase(),
     ...config.mode,
     ...config.visit,

package/templates/restaurant/tier5-src/himi-store-account/index.ts

@@ -234,6 +234,9 @@ let signInPresentationRequested: "" | "sheet" | "full_screen" = "";
 let signInReturnTabRequested = "";
 let standaloneRequested = false;
 let pollIdentityRequested = false;
+// iOS can start the arg-less boot load after the appear refresh that asks for the row; the
+// newer boot probe must not land, or be kept, without it.
+let restorePurchasesRequested = false;
 // Bumped by every mode switch, so a dropped probe never puts back a mode the visitor left.
 let modeSwitches = 0;
 
@@ -246,6 +249,7 @@ function appearBase(): Partial<S> {
     signInScreen: signInScreenRequested,
     standalone: standaloneRequested,
     pollIdentity: pollIdentityRequested,
+    restorePurchases: restorePurchasesRequested,
     ...(pollIdentityRequested ? { _poll: { ...IDENTITY_POLL } } : {}),
   };
 }
@@ -268,6 +272,7 @@ function appearConfig(s: S, arg: unknown): AppearConfig {
   // Only the sign-in screen's route carries `mode`, so it marks the form from the boot load on.
   standaloneRequested ||= s.standalone || appearing || (!routeInputConsumed && !!routeInput().mode);
   pollIdentityRequested ||= s.pollIdentity || strField(arg, "pollIdentity") === "1";
+  restorePurchasesRequested ||= s.restorePurchases || strField(arg, "restorePurchases") === "1";
   // The form opens on the mode its route asked for each time it appears, sign-in by
   // default: a pooled worker reopened with the same params must not open on the mode the
   // last visit toggled to.
@@ -652,8 +657,7 @@ async function probe(s: S, arg?: unknown, config: AppearConfig = appearConfig(s,
   // Not the boot load: it never carries the copy, and the appear refresh that does is coming.
   if (strField(arg, "boot") !== "1") headingReady = true;
   const memberAccountLinks = memberAccountLinksRequested;
-  const restorePurchases = s.restorePurchases || strField(arg, "restorePurchases") === "1";
-  if (restorePurchases) enterCommerce();
+  if (restorePurchasesRequested) enterCommerce();
   const routes = memberAccountLinks ? await memberAccountRoutes() : { addresses: false, wallet: false };
   let activityRows: AccountActivityRow[] = [];
   if (profile.isMember) {
@@ -681,7 +685,6 @@ async function probe(s: S, arg?: unknown, config: AppearConfig = appearConfig(s,
     email: profile.memberEmail || s.email,
     message: "",
     memberAccountLinks,
-    restorePurchases,
     ...appearBase(),
     ...config.mode,
     ...config.visit,

package/templates/retail-store/tier5-src/himi-store-account/index.ts

@@ -234,6 +234,9 @@ let signInPresentationRequested: "" | "sheet" | "full_screen" = "";
 let signInReturnTabRequested = "";
 let standaloneRequested = false;
 let pollIdentityRequested = false;
+// iOS can start the arg-less boot load after the appear refresh that asks for the row; the
+// newer boot probe must not land, or be kept, without it.
+let restorePurchasesRequested = false;
 // Bumped by every mode switch, so a dropped probe never puts back a mode the visitor left.
 let modeSwitches = 0;
 
@@ -246,6 +249,7 @@ function appearBase(): Partial<S> {
     signInScreen: signInScreenRequested,
     standalone: standaloneRequested,
     pollIdentity: pollIdentityRequested,
+    restorePurchases: restorePurchasesRequested,
     ...(pollIdentityRequested ? { _poll: { ...IDENTITY_POLL } } : {}),
   };
 }
@@ -268,6 +272,7 @@ function appearConfig(s: S, arg: unknown): AppearConfig {
   // Only the sign-in screen's route carries `mode`, so it marks the form from the boot load on.
   standaloneRequested ||= s.standalone || appearing || (!routeInputConsumed && !!routeInput().mode);
   pollIdentityRequested ||= s.pollIdentity || strField(arg, "pollIdentity") === "1";
+  restorePurchasesRequested ||= s.restorePurchases || strField(arg, "restorePurchases") === "1";
   // The form opens on the mode its route asked for each time it appears, sign-in by
   // default: a pooled worker reopened with the same params must not open on the mode the
   // last visit toggled to.
@@ -652,8 +657,7 @@ async function probe(s: S, arg?: unknown, config: AppearConfig = appearConfig(s,
   // Not the boot load: it never carries the copy, and the appear refresh that does is coming.
   if (strField(arg, "boot") !== "1") headingReady = true;
   const memberAccountLinks = memberAccountLinksRequested;
-  const restorePurchases = s.restorePurchases || strField(arg, "restorePurchases") === "1";
-  if (restorePurchases) enterCommerce();
+  if (restorePurchasesRequested) enterCommerce();
   const routes = memberAccountLinks ? await memberAccountRoutes() : { addresses: false, wallet: false };
   let activityRows: AccountActivityRow[] = [];
   if (profile.isMember) {
@@ -681,7 +685,6 @@ async function probe(s: S, arg?: unknown, config: AppearConfig = appearConfig(s,
     email: profile.memberEmail || s.email,
     message: "",
     memberAccountLinks,
-    restorePurchases,
     ...appearBase(),
     ...config.mode,
     ...config.visit,

package/templates/yoga-studio/tier5-src/himi-store-account/index.ts

@@ -234,6 +234,9 @@ let signInPresentationRequested: "" | "sheet" | "full_screen" = "";
 let signInReturnTabRequested = "";
 let standaloneRequested = false;
 let pollIdentityRequested = false;
+// iOS can start the arg-less boot load after the appear refresh that asks for the row; the
+// newer boot probe must not land, or be kept, without it.
+let restorePurchasesRequested = false;
 // Bumped by every mode switch, so a dropped probe never puts back a mode the visitor left.
 let modeSwitches = 0;
 
@@ -246,6 +249,7 @@ function appearBase(): Partial<S> {
     signInScreen: signInScreenRequested,
     standalone: standaloneRequested,
     pollIdentity: pollIdentityRequested,
+    restorePurchases: restorePurchasesRequested,
     ...(pollIdentityRequested ? { _poll: { ...IDENTITY_POLL } } : {}),
   };
 }
@@ -268,6 +272,7 @@ function appearConfig(s: S, arg: unknown): AppearConfig {
   // Only the sign-in screen's route carries `mode`, so it marks the form from the boot load on.
   standaloneRequested ||= s.standalone || appearing || (!routeInputConsumed && !!routeInput().mode);
   pollIdentityRequested ||= s.pollIdentity || strField(arg, "pollIdentity") === "1";
+  restorePurchasesRequested ||= s.restorePurchases || strField(arg, "restorePurchases") === "1";
   // The form opens on the mode its route asked for each time it appears, sign-in by
   // default: a pooled worker reopened with the same params must not open on the mode the
   // last visit toggled to.
@@ -652,8 +657,7 @@ async function probe(s: S, arg?: unknown, config: AppearConfig = appearConfig(s,
   // Not the boot load: it never carries the copy, and the appear refresh that does is coming.
   if (strField(arg, "boot") !== "1") headingReady = true;
   const memberAccountLinks = memberAccountLinksRequested;
-  const restorePurchases = s.restorePurchases || strField(arg, "restorePurchases") === "1";
-  if (restorePurchases) enterCommerce();
+  if (restorePurchasesRequested) enterCommerce();
   const routes = memberAccountLinks ? await memberAccountRoutes() : { addresses: false, wallet: false };
   let activityRows: AccountActivityRow[] = [];
   if (profile.isMember) {
@@ -681,7 +685,6 @@ async function probe(s: S, arg?: unknown, config: AppearConfig = appearConfig(s,
     email: profile.memberEmail || s.email,
     message: "",
     memberAccountLinks,
-    restorePurchases,
     ...appearBase(),
     ...config.mode,
     ...config.visit,