| User taps “Restore purchases” in settings | restorePurchases() | Explicit user action; may reconcile store ownership. |
| User signs into the same account on a new device | getCustomerInfo() then syncPurchases() if needed | Prefer stable identity first, quiet reconciliation second. |
| App starts after flaky network or queued receipt work | drainReceiptQueueAndRefreshCustomer() only when intentionally recovering queue state | Avoid turning normal startup into a support recovery flow. |
| Paywall CTA purchase | purchase(package:), purchase(activity, appActorPackage), or purchasePackage(...) | Purchase the package the user selected. |
| High-value backend feature | Server-side AppActor access check | Client state is UX; backend resources need backend enforcement. |