Also reproduces on StoreKit 1 — with daemon logs and server-side confirmation Same behaviour here through a different API. We use StoreKit 1 (SKPaymentQueue.finishTransaction:), not StoreKit 2, so the defect looks like it sits below both API surfaces. Device iPhone 17 Pro, iOS 27.0 from Aug 14, sandbox account, consumables. Transactions survive their own finish, are redelivered on every launch, and repeat buys replay the same transaction id with no sheet and no charge. We had a device log running, so here is where it fails — 8 finish attempts in the capture, 8 identical failures, 0 successes: storekitd [7ae43896_SK1] Starting request FinishTransactionRequest (accountRequirement: required(signIn: false, …), client: eu.nordeus.TopEleven Sandbox, destination: AMSBagKey(p2-in-app-transaction-done), …) storekitd [7ae43896_SK1] Account is required for request. error [7ae43896_SK1] Failed to encode request parameters (Never): Error Domain=NSCocoaErrorDomain Code=3840 "JSON text did not start with array or object and option to allow fragments not set" error [7ae43896_SK1] Error finishing transaction: requestEncodeFailed The request to p2-in-app-transaction-done is never sent, so the server side of the finish never happens. The parameter type is Never — nothing to encode — yet it fails with a JSON parse error on what looks like empty data. Possibly related: the same storekitd logged 22 × AMSErrorDomain Code=204 "Bag Value Missing" while adding mescal headers in the same 63-second window. An incomplete bag would explain both. Our purchases are validated server-to-server, which confirms from outside the device that nothing is charged. Transaction 2000001222597497 produced exactly one purchase notification to our backend at 12:14:21.920Z; the repeat completed on device at 12:14:36Z with the same id and produced none. The App Store does not treat the replay as a new purchase either. Negative control: same binary, same products, several iOS 26.x devices with different sandbox accounts — repeat purchase works every time, distinct transaction ids, separate server notification for each: account A, product X: 2000001222675678 (14:48:25.881Z), 2000001222675727 (14:48:41.310Z) account B, product Y: 2000001222675941 (14:49:07.446Z), 2000001222676023 (14:49:19.243Z) Only the OS version differs. Varying device and sandbox account changed nothing.