diff --git a/apps/ios/Shared/Model/AppAPITypes.swift b/apps/ios/Shared/Model/AppAPITypes.swift
index eadca9f71e..bf7ee67a7e 100644
--- a/apps/ios/Shared/Model/AppAPITypes.swift
+++ b/apps/ios/Shared/Model/AppAPITypes.swift
@@ -193,6 +193,8 @@ enum ChatCommand: ChatCmdProtocol {
     case apiStandaloneFileInfo(url: String)
     // badges
     case apiRedeemBadgeCode(userId: Int64, code: String)
+    case apiPurchaseBadge(userId: Int64, echoedInvoiceId: String?, payment: ServicePayment)
+    case apiCreateBadgeInvoice(userId: Int64)
     case apiGetBadgeState(userId: Int64)
     case apiGetBadgeLedger(userId: Int64, badgePurchaseId: Int64)
     case apiAckBadgeAlert(userId: Int64, badgePurchaseId: Int64, alertKind: BadgeAlertKind, snooze: Bool, episode: String)
@@ -419,6 +421,9 @@ enum ChatCommand: ChatCmdProtocol {
             case let .apiDownloadStandaloneFile(userId, link, file): return "/_download \(userId) \(link) \(file.filePath)"
             case let .apiStandaloneFileInfo(link): return "/_download info \(link)"
             case let .apiRedeemBadgeCode(userId, code): return "/_redeem_badge_code \(userId) \(code)"
+            case let .apiPurchaseBadge(userId, echoedInvoiceId, payment):
+                return "/_badge purchase \(userId)\(echoedInvoiceId.map { " invoice=\($0)" } ?? "") \(encodeJSON(payment))"
+            case let .apiCreateBadgeInvoice(userId): return "/_badge invoice \(userId)"
             case let .apiGetBadgeState(userId): return "/_badge state \(userId)"
             case let .apiGetBadgeLedger(userId, badgePurchaseId): return "/_badge ledger \(userId) \(badgePurchaseId)"
             case let .apiAckBadgeAlert(userId, badgePurchaseId, alertKind, snooze, episode):
@@ -611,6 +616,8 @@ enum ChatCommand: ChatCmdProtocol {
             case .apiDownloadStandaloneFile: return "apiDownloadStandaloneFile"
             case .apiStandaloneFileInfo: return "apiStandaloneFileInfo"
             case .apiRedeemBadgeCode: return "apiRedeemBadgeCode"
+            case .apiPurchaseBadge: return "apiPurchaseBadge"
+            case .apiCreateBadgeInvoice: return "apiCreateBadgeInvoice"
             case .apiGetBadgeState: return "apiGetBadgeState"
             case .apiGetBadgeLedger: return "apiGetBadgeLedger"
             case .apiAckBadgeAlert: return "apiAckBadgeAlert"
@@ -667,9 +674,11 @@ enum ChatCommand: ChatCmdProtocol {
             return .apiDeleteUser(userId: userId, delSMPQueues: delSMPQueues, viewPwd: obfuscate(viewPwd))
         case let .testStorageEncryption(key):
             return .testStorageEncryption(key: obfuscate(key))
-        // a code is a bearer secret until it is redeemed, and the terminal shows and copies cmdString
+        // a code or a store receipt is a bearer secret until it is redeemed, and the terminal shows and copies cmdString
         case let .apiRedeemBadgeCode(userId, code):
             return .apiRedeemBadgeCode(userId: userId, code: obfuscate(code))
+        case let .apiPurchaseBadge(userId, echoedInvoiceId, .apple(jws)):
+            return .apiPurchaseBadge(userId: userId, echoedInvoiceId: echoedInvoiceId, payment: .apple(jws: obfuscate(jws)))
         default: return self
         }
     }
@@ -719,6 +728,29 @@ enum ChatCommand: ChatCmdProtocol {
     }
 }
 
+enum ServicePayment: Encodable {
+    case apple(jws: String)
+
+    func encode(to encoder: Encoder) throws {
+        var container = encoder.container(keyedBy: CodingKeys.self)
+        switch self {
+        case let .apple(jws):
+            try container.encode("apple", forKey: .type)
+            try container.encode(jws, forKey: .jws)
+        }
+    }
+
+    private enum CodingKeys: String, CodingKey {
+        case type, jws
+    }
+}
+
+struct OpenStorePurchase: Decodable {
+    var invoiceId: String?
+    var transactionRef: String?
+    var creditError: BadgeIssueFailure?
+}
+
 // ChatResponse is split to three enums to reduce stack size used when parsing it, parsing large enums is very inefficient.
 // Spec: spec/api.md#ChatResponse0
 enum ChatResponse0: Decodable, ChatAPIResult {
@@ -1051,7 +1083,8 @@ enum ChatResponse2: Decodable, ChatAPIResult {
     // badges
     // the full user, not UserRef: its profile carries the badge that setUserBadge just stored
     case badgeRedeemed(user: User, redeemedBadge: LocalBadge, newBadge: Bool, badgeState: BadgeState?)
-    case badgeState(user: UserRef, badgeState: BadgeState?)
+    case badgeInvoice(user: UserRef, invoiceId: String)
+    case badgeState(user: UserRef, badgeState: BadgeState?, storePurchases: [OpenStorePurchase]?)
     case badgeLedger(user: UserRef, badgeLedger: [StatementEntry])
 
     var responseType: String {
@@ -1105,6 +1138,7 @@ enum ChatResponse2: Decodable, ChatAPIResult {
         case .archiveImported: "archiveImported"
         case .appSettings: "appSettings"
         case .badgeRedeemed: "badgeRedeemed"
+        case .badgeInvoice: "badgeInvoice"
         case .badgeState: "badgeState"
         case .badgeLedger: "badgeLedger"
         }
@@ -1161,7 +1195,8 @@ enum ChatResponse2: Decodable, ChatAPIResult {
         case let .archiveImported(archiveErrors): return String(describing: archiveErrors)
         case let .appSettings(appSettings): return String(describing: appSettings)
         case let .badgeRedeemed(u, redeemedBadge, newBadge, badgeState): return withUser(u, "redeemedBadge: \(String(describing: redeemedBadge))\nnewBadge: \(newBadge)\nbadgeState: \(String(describing: badgeState))")
-        case let .badgeState(u, badgeState): return withUser(u, String(describing: badgeState))
+        case let .badgeInvoice(u, invoiceId): return withUser(u, invoiceId)
+        case let .badgeState(u, badgeState, storePurchases): return withUser(u, "\(String(describing: badgeState))\nstorePurchases: \(String(describing: storePurchases ?? []))")
         case let .badgeLedger(u, badgeLedger): return withUser(u, String(describing: badgeLedger))
         }
     }
@@ -1248,6 +1283,7 @@ enum ChatEvent: Decodable, ChatAPIResult {
     // badges
     case badgeChanged(user: User, badgeState: BadgeState?)
     case badgeAlert(user: UserRef, badgeAlert: BadgeAlert)
+    case storePurchaseResolved(user: UserRef)
 
     var responseType: String {
         switch self {
@@ -1322,6 +1358,7 @@ enum ChatEvent: Decodable, ChatAPIResult {
         case .contactPQEnabled: "contactPQEnabled"
         case .badgeChanged: "badgeChanged"
         case .badgeAlert: "badgeAlert"
+        case .storePurchaseResolved: "storePurchaseResolved"
         }
     }
 
@@ -1406,6 +1443,7 @@ enum ChatEvent: Decodable, ChatAPIResult {
         case let .contactPQEnabled(u, contact, pqEnabled): return withUser(u, "contact: \(String(describing: contact))\npqEnabled: \(pqEnabled)")
         case let .badgeChanged(u, badgeState): return withUser(u, String(describing: badgeState))
         case let .badgeAlert(u, badgeAlert): return withUser(u, String(describing: badgeAlert))
+        case .storePurchaseResolved: return noDetails
         }
     }
 }
diff --git a/apps/ios/Shared/Model/SimpleXAPI.swift b/apps/ios/Shared/Model/SimpleXAPI.swift
index 742ef20688..dc7cfb059e 100644
--- a/apps/ios/Shared/Model/SimpleXAPI.swift
+++ b/apps/ios/Shared/Model/SimpleXAPI.swift
@@ -2196,13 +2196,42 @@ func apiRedeemBadgeCode(_ userId: Int64, _ code: String) async throws -> (user:
     throw r.unexpected
 }
 
+// a refusal is thrown, as BREServiceError with the code
+enum BadgePurchaseResult {
+    case held(user: UserRef, badgeState: BadgeState?, storePurchases: [OpenStorePurchase])
+    case credited(user: User, badgeState: BadgeState?)
+}
+
+// log: false because a store receipt is a bearer secret, like a badge code - it is in the command.
+func apiPurchaseBadge(_ userId: Int64, _ echoedInvoiceId: String?, _ payment: ServicePayment) async throws -> BadgePurchaseResult {
+    let r: ChatResponse2 = try await chatSendCmd(.apiPurchaseBadge(userId: userId, echoedInvoiceId: echoedInvoiceId, payment: payment), log: false)
+    switch r {
+    case let .badgeState(user, badgeState, storePurchases): return .held(user: user, badgeState: badgeState, storePurchases: storePurchases ?? [])
+    case let .badgeRedeemed(user, _, _, badgeState): return .credited(user: user, badgeState: badgeState)
+    default: throw r.unexpected
+    }
+}
+
+func apiCreateBadgeInvoice(_ userId: Int64) async throws -> String {
+    let r: ChatResponse2 = try await chatSendCmd(.apiCreateBadgeInvoice(userId: userId))
+    if case let .badgeInvoice(_, invoiceId) = r { return invoiceId }
+    throw r.unexpected
+}
+
 // localized where the user can act on it; otherwise the error itself, so a screenshot says what happened
-func redeemErrorText(_ error: Error) -> String {
+func redeemErrorText(_ error: Error, purchase: Bool) -> String {
     if case let .error(.badgeRedeemError(e)) = error as? ChatError {
         switch e {
         case .invalidCode: return NSLocalizedString("This code is not valid.", comment: "alert message")
-        case .serviceNotConfigured: return NSLocalizedString("This app version cannot redeem badge codes.", comment: "alert message")
-        case .badgeActive: return NSLocalizedString("This profile already has a badge. Redeem the code on another profile, or once this badge ends.", comment: "alert message")
+        case .invalidReceipt: break
+        case .serviceNotConfigured:
+            return purchase
+                ? NSLocalizedString("This app version cannot buy badges.", comment: "alert message")
+                : NSLocalizedString("This app version cannot redeem badge codes.", comment: "alert message")
+        case .badgeActive:
+            return purchase
+                ? NSLocalizedString("This profile already has a badge.", comment: "alert message")
+                : NSLocalizedString("This profile already has a badge. Redeem the code on another profile, or once this badge ends.", comment: "alert message")
         case let .serviceError(code): if let text = badgeServiceErrorText(code) { return text }
         case let .invalidResponse(message):
             return String.localizedStringWithFormat(NSLocalizedString("The badge service sent an unexpected response: %@", comment: "alert message"), message)
@@ -2212,15 +2241,15 @@ func redeemErrorText(_ error: Error) -> String {
     return String.localizedStringWithFormat(NSLocalizedString("Error: %@", comment: "alert message"), responseError(error))
 }
 
-func apiGetBadgeState(_ userId: Int64) async throws -> BadgeState? {
+func apiGetBadgeState(_ userId: Int64) async throws -> (badgeState: BadgeState?, storePurchases: [OpenStorePurchase]) {
     let r: ChatResponse2 = try await chatSendCmd(.apiGetBadgeState(userId: userId))
-    if case let .badgeState(_, badgeState) = r { return badgeState }
+    if case let .badgeState(_, badgeState, storePurchases) = r { return (badgeState, storePurchases ?? []) }
     throw r.unexpected
 }
 
-func apiGetBadgeStateSync(_ userId: Int64) throws -> BadgeState? {
+func apiGetBadgeStateSync(_ userId: Int64) throws -> (badgeState: BadgeState?, storePurchases: [OpenStorePurchase]) {
     let r: ChatResponse2 = try chatSendCmdSync(.apiGetBadgeState(userId: userId))
-    if case let .badgeState(_, badgeState) = r { return badgeState }
+    if case let .badgeState(_, badgeState, storePurchases) = r { return (badgeState, storePurchases ?? []) }
     throw r.unexpected
 }
 
@@ -2232,7 +2261,7 @@ func apiGetBadgeLedger(_ userId: Int64, _ badgePurchaseId: Int64) async throws -
 
 func apiAckBadgeAlert(_ userId: Int64, _ badgePurchaseId: Int64, _ alertKind: BadgeAlertKind, snooze: Bool, episode: String) async throws -> BadgeState? {
     let r: ChatResponse2 = try await chatSendCmd(.apiAckBadgeAlert(userId: userId, badgePurchaseId: badgePurchaseId, alertKind: alertKind, snooze: snooze, episode: episode))
-    if case let .badgeState(_, badgeState) = r { return badgeState }
+    if case let .badgeState(_, badgeState, _) = r { return badgeState }
     throw r.unexpected
 }
 
@@ -2361,6 +2390,7 @@ func startChat(refreshInvitations: Bool = true, onboarding: Bool = false) throws
     ChatReceiver.shared.start()
     m.chatRunning = true
     chatLastStartGroupDefault.set(Date.now)
+    Task { await BadgeStore.shared.presentUnfinished() }
 }
 
 func startChatWithTemporaryDatabase(ctrl: chat_ctrl) throws -> User? {
@@ -2385,6 +2415,7 @@ private func changeActiveUser_(_ userId: Int64, viewPwd: String?) throws {
     m.currentUser = try apiSetActiveUser(userId, viewPwd: viewPwd)
     m.users = try listUsers()
     try getUserChatData()
+    Task { await BadgeStore.shared.presentUnfinished() }
 }
 
 func changeActiveUserAsync_(_ userId: Int64?, viewPwd: String?, keepingChatId: String? = nil) async throws {
@@ -2400,6 +2431,7 @@ func changeActiveUserAsync_(_ userId: Int64?, viewPwd: String?, keepingChatId: S
         m.users = users
     }
     try await getUserChatDataAsync(keepingChatId: keepingChatId)
+    Task { await BadgeStore.shared.presentUnfinished() }
     await MainActor.run {
         if let currentUser = currentUser, var (_, invitation) = ChatModel.shared.callInvitations.first(where: { _, inv in inv.user.userId == userId }) {
             invitation.user = currentUser
@@ -2427,22 +2459,32 @@ func getUserChatData() throws {
 private func loadBadgeState() {
     do {
         let userId = try currentUserId("loadBadgeState")
-        let badgeState = try apiGetBadgeStateSync(userId)
+        let (badgeState, storePurchases) = try apiGetBadgeStateSync(userId)
         BadgeModel.shared.set(userId: userId, badgeState: badgeState)
+        BadgeStore.shared.setStorePurchases(userId, storePurchases)
     } catch let error {
         logger.error("loadBadgeState: \(responseError(error))")
     }
 }
 
-private func loadBadgeStateAsync(_ userId: Int64) async {
+func loadBadgeStateAsync(_ userId: Int64) async {
     do {
-        let badgeState = try await apiGetBadgeState(userId)
-        await MainActor.run { BadgeModel.shared.set(userId: userId, badgeState: badgeState) }
+        let (badgeState, storePurchases) = try await apiGetBadgeState(userId)
+        await MainActor.run {
+            BadgeModel.shared.set(userId: userId, badgeState: badgeState)
+            BadgeStore.shared.setStorePurchases(userId, storePurchases)
+        }
     } catch let error {
         logger.error("loadBadgeState: \(responseError(error))")
     }
 }
 
+func loadCurrentBadgeState() async {
+    if let userId = await MainActor.run(body: { ChatModel.shared.currentUser?.userId }) {
+        await loadBadgeStateAsync(userId)
+    }
+}
+
 private func getUserChatDataAsync(keepingChatId: String?) async throws {
     let m = ChatModel.shared
     let tm = ChatTagsModel.shared
@@ -3052,6 +3094,9 @@ func processReceivedMsg(_ res: ChatEvent) async {
                 BadgeModel.shared.setAlert(userId: user.userId, alert: badgeAlert)
             }
         }
+    case .storePurchaseResolved:
+        // whichever profile owns it: only the app can finish the store transaction
+        Task { await BadgeStore.shared.presentUnfinished() }
     default:
         logger.debug("unsupported event: \(res.responseType)")
     }
diff --git a/apps/ios/Shared/SimpleXApp.swift b/apps/ios/Shared/SimpleXApp.swift
index 28aa7e4002..654a31c001 100644
--- a/apps/ios/Shared/SimpleXApp.swift
+++ b/apps/ios/Shared/SimpleXApp.swift
@@ -101,6 +101,7 @@ struct SimpleXApp: App {
                                             if !chatModel.showCallView && !CallController.shared.hasActiveCalls() {
                                                 await updateCallInvitations()
                                             }
+                                            Task { await BadgeStore.shared.presentUnfinished() }
                                             if let url = chatModel.appOpenUrlLater {
                                                 await MainActor.run {
                                                     chatModel.appOpenUrlLater = nil
diff --git a/apps/ios/Shared/Views/Badges/BadgeStore.swift b/apps/ios/Shared/Views/Badges/BadgeStore.swift
index c31e45439a..0c338655cd 100644
--- a/apps/ios/Shared/Views/Badges/BadgeStore.swift
+++ b/apps/ios/Shared/Views/Badges/BadgeStore.swift
@@ -9,6 +9,7 @@
 import Foundation
 import Combine
 import StoreKit
+import SimpleXChat
 
 // TODO [badges] product ids will come from app config and prices from the badge service catalog;
 // hardcoded here so the App Store integration can be tested before the purchase API lands.
@@ -27,13 +28,26 @@ let badgeProductIds: [String] = BadgeLevel.allCases.flatMap { level in
     BadgePeriod.allCases.map { badgeProductId(level, $0) }
 }
 
-// TODO [badges] replaced by APIGetBadgeInvoice, which creates the invoice row and returns its id.
-// Apple requires a UUID - it is sent as appAccountToken and echoed back in the signed transaction,
-// which is how the service learns which invoice a store transaction settles.
+// the only products sent to the badge service: nothing delivers a subscription yet
+let badgeOneTimeProductIds: Set<String> = Set(BadgeLevel.allCases.map { badgeProductId($0, .oneMonth) })
+
+// subscriptions are for sale once renewals are delivered
+let badgePeriodsForSale: [BadgePeriod] = [.oneMonth]
+
+// A subscription's id only: core mints a one-time purchase's, and a subscription is never sent to core.
+// Apple requires a UUID - it is sent as appAccountToken and echoed back in the signed transaction.
 func newBadgeInvoiceId() -> UUID { UUID() }
 
 // the page's app flag rides in the fragment, which never reaches the service
-let badgePageUrl = "https://badges.simplex.chat/#/tier?app=true"
+// TEST ONLY: pointed at the dev deployment; restore the line below before merging
+let badgePageUrl = "https://smp7.simplex.im/#/tier?app=true"
+// let badgePageUrl = "https://badges.simplex.chat/#/tier?app=true"
+
+// where the store allows a link out to the badge page: the US for now, a set expected to widen.
+// An unknown storefront does not count, as this decides whether the store sees a link out of the app.
+var badgeBrowserAllowed: Bool {
+    SKPaymentQueue.default().storefront?.countryCode == "USA"
+}
 
 enum BadgePrice {
     case loading
@@ -52,21 +66,32 @@ struct BadgeStoreReceipt {
     // the signed token the badge service verifies - never transaction.jsonRepresentation
     let jws: String
     let productId: String
-    let transactionId: UInt64
     let invoiceId: UUID?
-    let environment: String?
     let signatureVerified: Bool
+    let transaction: Transaction
+
+    var echoedInvoiceId: String? { invoiceId.map(coreInvoiceId) }
 }
 
+// core mints the id in lower case, and UUID formats it in upper case
+func coreInvoiceId(_ invoiceId: UUID) -> String { invoiceId.uuidString.lowercased() }
+
 enum BadgePurchaseOutcome {
     case purchased(BadgeStoreReceipt)
-    case pending
+    case pending(invoiceId: String?)
     case cancelled
 }
 
+enum BadgePurchaseState {
+    case issuing
+    case waitingForApproval
+}
+
 enum BadgeStoreError: Error {
     case productUnavailable(productId: String)
     case unknownPurchaseResult
+    case noActiveProfile
+    case invalidInvoiceId(String)
 }
 
 final class BadgeStore: ObservableObject {
@@ -76,14 +101,52 @@ final class BadgeStore: ObservableObject {
 
     @Published private var state: LoadState = .notLoaded
     private var products: [String: Product] = [:]
+    // core's open store purchases for the profile they were read for: core knows whose a purchase is
+    @Published private var storePurchases: (userId: Int64, purchases: [OpenStorePurchase])? = nil
+    // whether a store sheet this run opened has not returned
+    @Published private var buying = false
+    // kept for this run only: StoreKit lists no deferred purchase, and a declined one delivers nothing
+    // by invoice id, so a pending purchase shows only under the profile whose record it names
+    @Published private var waitingForApproval: Set<String> = []
+    // set once presentUnfinished has read the store: until then, an Ask to Buy approved while the app was
+    // closed, or a purchase it died before handing over, are both unknown, so canBuy refuses to buy again
+    @Published private var reconciledOnce = false
+    let refusals = PassthroughSubject<Error, Never>()
+    private var transactionUpdates: Task<Void, Never>? = nil
 
     private init() {}
 
-    func price(_ level: BadgeLevel, _ period: BadgePeriod) -> BadgePrice {
+    func purchaseState(_ userId: Int64?) -> BadgePurchaseState? {
+        let purchases = openStorePurchases(userId)
+        if purchases.contains(where: { $0.transactionRef != nil }) { return .issuing }
+        if purchases.contains(where: { $0.invoiceId.map(waitingForApproval.contains) == true }) { return .waitingForApproval }
+        return nil
+    }
+
+    func creditError(_ userId: Int64?) -> BadgeIssueFailure? {
+        openStorePurchases(userId).compactMap(\.creditError).first
+    }
+
+    var checkingPurchases: Bool { !reconciledOnce }
+
+    func canBuy(_ userId: Int64?) -> Bool {
+        reconciledOnce && !buying && purchaseState(userId) == nil
+    }
+
+    func setStorePurchases(_ userId: Int64, _ purchases: [OpenStorePurchase]) {
+        storePurchases = (userId, purchases)
+    }
+
+    private func openStorePurchases(_ userId: Int64?) -> [OpenStorePurchase] {
+        guard let storePurchases, storePurchases.userId == userId else { return [] }
+        return storePurchases.purchases
+    }
+
+    func price(_ level: BadgeLevel, _ period: BadgePeriod, compact: Bool = true) -> BadgePrice {
         switch state {
         case .notLoaded, .loading: return .loading
         case .loaded, .failed:
-            if let p = products[badgeProductId(level, period)] { return .price(compactPrice(p)) }
+            if let p = products[badgeProductId(level, period)] { return .price(compact ? compactPrice(p) : p.displayPrice) }
             return .unavailable
         }
     }
@@ -122,33 +185,123 @@ final class BadgeStore: ObservableObject {
         }
     }
 
-    func purchase(_ level: BadgeLevel, _ period: BadgePeriod, invoiceId: UUID) async throws -> BadgePurchaseOutcome {
+    // A one-time purchase has its core record before the store charges, and every store outcome reaches it.
+    func purchase(_ level: BadgeLevel, _ period: BadgePeriod) async throws -> BadgePurchaseOutcome {
         let productId = badgeProductId(level, period)
         guard let product = await MainActor.run(body: { products[productId] }) else {
             throw BadgeStoreError.productUnavailable(productId: productId)
         }
-        switch try await product.purchase(options: [.appAccountToken(invoiceId)]) {
-        case let .success(verification):
-            let transaction: Transaction
-            let signatureVerified: Bool
-            switch verification {
-            case let .verified(t):
-                transaction = t
-                signatureVerified = true
-            case let .unverified(t, _):
-                transaction = t
-                signatureVerified = false
+        // a subscription is never sent to core, so nothing would ever finish it later
+        guard badgeOneTimeProductIds.contains(productId) else {
+            let outcome = try await storePurchase(product, newBadgeInvoiceId())
+            if case let .purchased(receipt) = outcome { await receipt.transaction.finish() }
+            return outcome
+        }
+        guard let userId = await MainActor.run(body: { ChatModel.shared.currentUser?.userId }) else {
+            throw BadgeStoreError.noActiveProfile
+        }
+        let invoice = try await apiCreateBadgeInvoice(userId)
+        guard let invoiceId = UUID(uuidString: invoice) else { throw BadgeStoreError.invalidInvoiceId(invoice) }
+        await MainActor.run { buying = true }
+        await loadBadgeStateAsync(userId)
+        do {
+            let outcome = try await storePurchase(product, invoiceId)
+            if case let .purchased(receipt) = outcome, receipt.signatureVerified {
+                try await handOver(receipt)
             }
-            // nothing is delivered in this build, so the transaction is finished right away; once the
-            // service issues credentials it must only be finished after the credential is stored
-            await transaction.finish()
-            return .purchased(storeReceipt(verification.jwsRepresentation, transaction, signatureVerified))
-        case .pending: return .pending
+            await MainActor.run { buying = false }
+            return outcome
+        } catch let error {
+            await MainActor.run { buying = false }
+            throw error
+        }
+    }
+
+    private func storePurchase(_ product: Product, _ invoiceId: UUID) async throws -> BadgePurchaseOutcome {
+        switch try await product.purchase(options: [.appAccountToken(invoiceId)]) {
+        case let .success(verification): return .purchased(storeReceipt(verification))
+        case .pending:
+            let pending = coreInvoiceId(invoiceId)
+            await MainActor.run { _ = waitingForApproval.insert(pending) }
+            return .pending(invoiceId: pending)
         case .userCancelled: return .cancelled
         @unknown default: throw BadgeStoreError.unknownPurchaseResult
         }
     }
 
+    // Core holds the receipt and credits it; the transaction stays unfinished until core answers it credited
+    // or refused, as an unfinished transaction is what the store re-delivers if anything is lost on the way.
+    private func handOver(_ receipt: BadgeStoreReceipt) async throws {
+        guard let userId = await MainActor.run(body: { ChatModel.shared.currentUser?.userId }) else { return }
+        // a refusal is announced where it reads as its own, so only an unexpected answer reaches the buyer
+        do {
+            switch try await apiPurchaseBadge(userId, receipt.echoedInvoiceId, .apple(jws: receipt.jws)) {
+            case let .held(user, badgeState, storePurchases):
+                await MainActor.run {
+                    // the answer is the owner's, which may be another profile and a hidden one
+                    if active(user) {
+                        BadgeModel.shared.set(userId: user.userId, badgeState: badgeState)
+                        setStorePurchases(user.userId, storePurchases)
+                    }
+                }
+            case let .credited(user, badgeState):
+                await MainActor.run {
+                    if active(user) {
+                        BadgeModel.shared.set(userId: user.userId, badgeState: badgeState)
+                        ChatModel.shared.updateUser(user)
+                        if badgeState?.shown == true { UserDefaults.standard.set(true, forKey: DEFAULT_SUPPORTER_BANNER_SHOWN) }
+                    }
+                }
+                await resolve(receipt, refusal: nil)
+            }
+        } catch let error where badgeReceiptRefused(error) {
+            logger.error("BadgeStore.handOver: \(responseError(error))")
+            await resolve(receipt, refusal: error)
+        }
+    }
+
+    private func resolve(_ receipt: BadgeStoreReceipt, refusal: Error?) async {
+        await receipt.transaction.finish()
+        if let refusal {
+            await MainActor.run { refusals.send(refusal) }
+        }
+    }
+
+    // at launch, on return to the foreground, on a profile switch and when core resolves a purchase, never on a timer
+    func presentUnfinished() async {
+        await listenForTransactions()
+        for await verification in Transaction.unfinished {
+            await reconcile(verification)
+        }
+        await loadCurrentBadgeState()
+        await MainActor.run { reconciledOnce = true }
+    }
+
+    // transactions the store settles outside a purchase call, such as an approved Ask to Buy
+    @MainActor
+    private func listenForTransactions() {
+        if transactionUpdates == nil {
+            transactionUpdates = Task.detached {
+                for await verification in Transaction.updates {
+                    await BadgeStore.shared.reconcile(verification)
+                }
+            }
+        }
+    }
+
+    // an unverified one-time transaction is never sent, and left unfinished rather than lost
+    private func reconcile(_ verification: VerificationResult<Transaction>) async {
+        let receipt = storeReceipt(verification)
+        if !badgeOneTimeProductIds.contains(receipt.productId) {
+            await receipt.transaction.finish()
+        } else if receipt.signatureVerified {
+            // no buyer to tell: the receipt stays unfinished and the next sweep hands it over again
+            do { try await handOver(receipt) } catch let error {
+                logger.error("BadgeStore.reconcile: \(responseError(error))")
+            }
+        }
+    }
+
     @MainActor
     private func startLoading() -> Bool {
         switch state {
@@ -172,15 +325,24 @@ private func compactPrice(_ product: Product) -> String {
         : product.displayPrice
 }
 
-private func storeReceipt(_ jws: String, _ t: Transaction, _ signatureVerified: Bool) -> BadgeStoreReceipt {
-    var environment: String? = nil
-    if #available(iOS 16.0, *) { environment = t.environment.rawValue }
+private func storeReceipt(_ verification: VerificationResult<Transaction>) -> BadgeStoreReceipt {
+    let (t, signatureVerified) = switch verification {
+    case let .verified(t): (t, true)
+    case let .unverified(t, _): (t, false)
+    }
     return BadgeStoreReceipt(
-        jws: jws,
+        jws: verification.jwsRepresentation,
         productId: t.productID,
-        transactionId: t.id,
         invoiceId: t.appAccountToken,
-        environment: environment,
-        signatureVerified: signatureVerified
+        signatureVerified: signatureVerified,
+        transaction: t
     )
 }
+
+// the codes core refuses a receipt with for good, after which the store may stop re-delivering it
+private func badgeReceiptRefused(_ error: Error) -> Bool {
+    if case let .error(.badgeRedeemError(.serviceError(code))) = error as? ChatError {
+        return code == .receiptInvalid || code == .receiptUsed
+    }
+    return false
+}
diff --git a/apps/ios/Shared/Views/Badges/BadgeUserPreview.swift b/apps/ios/Shared/Views/Badges/BadgeUserPreview.swift
index 45d94c3ed6..10b68be473 100644
--- a/apps/ios/Shared/Views/Badges/BadgeUserPreview.swift
+++ b/apps/ios/Shared/Views/Badges/BadgeUserPreview.swift
@@ -9,15 +9,9 @@
 import SwiftUI
 import SimpleXChat
 
-struct BadgeUserPreview<Trailing: View>: View {
+struct BadgeUserPreview: View {
     @EnvironmentObject var chatModel: ChatModel
     let level: BadgeLevel
-    let trailing: () -> Trailing
-
-    init(level: BadgeLevel, @ViewBuilder trailing: @escaping () -> Trailing = { EmptyView() }) {
-        self.level = level
-        self.trailing = trailing
-    }
 
     var body: some View {
         let user = chatModel.currentUser
@@ -29,12 +23,9 @@ struct BadgeUserPreview<Trailing: View>: View {
         )
         return VStack(spacing: 12) {
             ProfileImage(imageStr: user?.image, size: 128)
-            HStack(alignment: .center, spacing: 6) {
-                NameWithBadge(Text(displayName).font(.largeTitle), previewBadge, .largeTitle)
-                    .lineLimit(1)
-                    .minimumScaleFactor(0.75)
-                trailing()
-            }
+            NameWithBadge(Text(displayName).font(.largeTitle), previewBadge, .largeTitle)
+                .lineLimit(1)
+                .minimumScaleFactor(0.75)
         }
     }
 }
diff --git a/apps/ios/Shared/Views/Badges/BadgesCheckOrderView.swift b/apps/ios/Shared/Views/Badges/BadgesCheckOrderView.swift
new file mode 100644
index 0000000000..2c0dd851ed
--- /dev/null
+++ b/apps/ios/Shared/Views/Badges/BadgesCheckOrderView.swift
@@ -0,0 +1,131 @@
+//
+//  BadgesCheckOrderView.swift
+//  SimpleX (iOS)
+//
+//  Created by spaced4ndy on 29.09.2026.
+//  Copyright © 2026 SimpleX Chat. All rights reserved.
+//
+
+import SwiftUI
+import SimpleXChat
+
+struct BadgesCheckOrderView: View {
+    @EnvironmentObject var theme: AppTheme
+    @EnvironmentObject var chatModel: ChatModel
+    @ObservedObject private var store = BadgeStore.shared
+    let level: BadgeLevel
+    let period: BadgePeriod
+    @State private var purchasing = false
+    // presented from this view, not AlertManager: its host is behind the sheet these views open in
+    @State private var alert: SomeAlert?
+
+    var body: some View {
+        GeometryReader { g in
+            ScrollView {
+                VStack(alignment: .center, spacing: 16) {
+                    Text("Check your order")
+                        .font(.largeTitle)
+                        .bold()
+                        .foregroundColor(theme.colors.primary)
+                        .multilineTextAlignment(.center)
+                        .fixedSize(horizontal: false, vertical: true)
+
+                    VStack(spacing: 0) {
+                        orderRow("Your badge", Text(level.title))
+                        orderRow("Duration", Text(period.label))
+                        Divider()
+                            .padding(.top, 8)
+                            .padding(.bottom, 6)
+                        orderRow("Total", period.priceText(store.price(level, period, compact: false)))
+                    }
+                    .padding(.horizontal, 24)
+                    .padding(.vertical, 12)
+                    .background(Color(uiColor: .secondarySystemGroupedBackground))
+                    .clipShape(RoundedRectangle(cornerRadius: 16))
+                    .padding(.top, 20)
+
+                    Spacer(minLength: 20)
+
+                    VStack(spacing: 10) {
+                        payButton()
+                            .padding(.vertical, 10)
+                        BadgeBillingFooter(period: period)
+                    }
+                    .padding(.bottom, g.safeAreaInsets.bottom == 0 ? 20 : 0)
+                }
+                .padding(.horizontal, 25)
+                .padding(.top, 0)
+                .padding(.bottom, 20)
+                .frame(minHeight: g.size.height)
+            }
+        }
+        .frame(maxHeight: .infinity)
+        .navigationBarTitleDisplayMode(.inline)
+        .task { await store.load() }
+        .alert(item: $alert) { $0.alert }
+    }
+
+    private func orderRow(_ title: LocalizedStringKey, _ value: Text) -> some View {
+        HStack {
+            Text(title)
+                .foregroundColor(theme.colors.secondary)
+            Spacer()
+            value
+                .fontWeight(.medium)
+        }
+        .font(.body)
+        .padding(.vertical, 8)
+    }
+
+    private func payButton() -> some View {
+        let price = store.price(level, period, compact: false)
+        let disabled = !price.canPurchase || purchasing || !store.canBuy(chatModel.currentUser?.userId)
+        return Button {
+            purchase()
+        } label: {
+            period.payText(price)
+        }
+        .buttonStyle(OnboardingButtonStyle(isDisabled: disabled))
+        .disabled(disabled)
+    }
+
+    private func purchase() {
+        purchasing = true
+        Task {
+            do {
+                if case let .purchased(receipt) = try await store.purchase(level, period), !receipt.signatureVerified {
+                    await MainActor.run {
+                        alert = SomeAlert(
+                            alert: mkAlert(
+                                title: "Cannot verify this purchase",
+                                message: "The store returned a transaction that Apple has not signed. SimpleX cannot verify this purchase with the App Store."
+                            ),
+                            id: "badgePurchaseUnverified"
+                        )
+                    }
+                }
+                await MainActor.run { purchasing = false }
+            } catch let error {
+                logger.error("BadgesCheckOrderView.purchase: \(String(describing: error))")
+                await MainActor.run {
+                    purchasing = false
+                    alert = SomeAlert(
+                        alert: Alert(
+                            title: Text("Purchase error"),
+                            message: Text(verbatim: redeemErrorText(error, purchase: true))
+                        ),
+                        id: "badgePurchaseError"
+                    )
+                }
+            }
+        }
+    }
+}
+
+struct BadgesCheckOrderView_Previews: PreviewProvider {
+    static var previews: some View {
+        NavigationView {
+            BadgesCheckOrderView(level: .supporter, period: .oneMonth)
+        }
+    }
+}
diff --git a/apps/ios/Shared/Views/Badges/BadgesChooseBadgeView.swift b/apps/ios/Shared/Views/Badges/BadgesChooseBadgeView.swift
index 077c9e5810..ba7b5b8613 100644
--- a/apps/ios/Shared/Views/Badges/BadgesChooseBadgeView.swift
+++ b/apps/ios/Shared/Views/Badges/BadgesChooseBadgeView.swift
@@ -23,10 +23,17 @@ enum BadgeLevel: String, CaseIterable, Identifiable {
         }
     }
 
-    var filesDescription: LocalizedStringKey {
+    var fileSize: LocalizedStringKey {
         switch self {
-        case .supporter: "Send 2GB files"
-        case .legend: "Send 5GB files"
+        case .supporter: "Files up to 2 GB"
+        case .legend: "Files up to 5 GB"
+        }
+    }
+
+    var fileStorage: LocalizedStringKey {
+        switch self {
+        case .supporter: "Stored for 7 days"
+        case .legend: "Stored for 21 days"
         }
     }
 
@@ -50,7 +57,6 @@ struct BadgesChooseBadgeView: View {
     @ObservedObject private var store = BadgeStore.shared
     @State private var selectedLevel: BadgeLevel = .supporter
     @State private var continueActive = false
-    @State private var howItWorksActive = false
 
     var body: some View {
         GeometryReader { g in
@@ -69,14 +75,10 @@ struct BadgesChooseBadgeView: View {
                         .multilineTextAlignment(.center)
                         .fixedSize(horizontal: false, vertical: true)
 
-                    BadgeUserPreview(level: selectedLevel) {
-                        Image(systemName: "chevron.down")
-                            .font(.body)
-                            .foregroundColor(theme.colors.primary)
-                    }
-                    .padding(.top, 4)
+                    BadgeUserPreview(level: selectedLevel)
+                        .padding(.top, 4)
 
-                    Spacer(minLength: 20)
+                    Spacer(minLength: 12)
 
                     // fixedSize + maxHeight on the cards so both match the taller one when a
                     // store price wraps in one of them
@@ -86,13 +88,20 @@ struct BadgesChooseBadgeView: View {
                     }
                     .fixedSize(horizontal: false, vertical: true)
 
-                    Spacer(minLength: 20)
+                    Spacer(minLength: 12)
 
                     VStack(spacing: 10) {
                         continueButton()
                             .padding(.vertical, 10)
-                        howItWorksButton()
-                            .frame(height: 22)
+                        // redeeming a code is here only when Support SimpleX offers the browser instead
+                        Group {
+                            if badgeBrowserAllowed {
+                                RedeemCodeButton()
+                            } else {
+                                Color.clear
+                            }
+                        }
+                        .frame(height: 22)
                     }
                     .padding(.bottom, g.safeAreaInsets.bottom == 0 ? 20 : 0)
                 }
@@ -116,17 +125,20 @@ struct BadgesChooseBadgeView: View {
                 Image(badgeImageName(level.badgeType))
                     .resizable()
                     .scaledToFit()
-                    .frame(width: 60, height: 60)
-                    .padding(.top, 20)
+                    .frame(width: 44, height: 44)
+                    .padding(.top, 16)
                 Text(level.title)
                     .font(.title3)
                     .fontWeight(.bold)
-                Text(level.filesDescription)
-                    .font(.subheadline)
-                    .foregroundColor(theme.colors.secondary)
                 BadgePeriod.monthly.priceText(store.price(level, .monthly))
                     .font(.body)
-                    .padding(.bottom, 20)
+                VStack(spacing: 2) {
+                    Text(level.fileSize)
+                    Text(level.fileStorage)
+                }
+                .font(.subheadline)
+                .foregroundColor(theme.colors.secondary)
+                .padding(.bottom, 16)
             }
             .multilineTextAlignment(.center)
             .padding(.horizontal, 12)
@@ -160,29 +172,6 @@ struct BadgesChooseBadgeView: View {
             .hidden()
         }
     }
-
-    private func howItWorksButton() -> some View {
-        ZStack {
-            Button {
-                howItWorksActive = true
-            } label: {
-                HStack(spacing: 4) {
-                    Image(systemName: "info.circle")
-                    Text("How badges protect your privacy").fontWeight(.medium)
-                }
-                .font(.body)
-            }
-
-            NavigationLink(isActive: $howItWorksActive) {
-                BadgesHowItWorksView()
-                    .modifier(ThemedBackground())
-            } label: {
-                EmptyView()
-            }
-            .frame(width: 1, height: 1)
-            .hidden()
-        }
-    }
 }
 
 struct BadgesChooseBadgeView_Previews: PreviewProvider {
diff --git a/apps/ios/Shared/Views/Badges/BadgesHowLongView.swift b/apps/ios/Shared/Views/Badges/BadgesHowLongView.swift
index d2783383de..2377a79a3b 100644
--- a/apps/ios/Shared/Views/Badges/BadgesHowLongView.swift
+++ b/apps/ios/Shared/Views/Badges/BadgesHowLongView.swift
@@ -33,6 +33,14 @@ enum BadgePeriod: String, CaseIterable, Identifiable {
         }
     }
 
+    var months: Int {
+        switch self {
+        case .oneMonth: 1
+        case .monthly: 1
+        case .annual: 12
+        }
+    }
+
     func priceText(_ price: BadgePrice) -> Text {
         switch price {
         case .loading: return Text(verbatim: "…")
@@ -64,10 +72,8 @@ struct BadgesHowLongView: View {
     @EnvironmentObject var theme: AppTheme
     @ObservedObject private var store = BadgeStore.shared
     let level: BadgeLevel
-    @State private var selectedPeriod: BadgePeriod = .monthly
-    @State private var purchasing = false
-    // presented from this view, not AlertManager: its host is behind the sheet these views open in
-    @State private var alert: SomeAlert?
+    @State private var selectedPeriod: BadgePeriod = badgePeriodsForSale.contains(.monthly) ? .monthly : .oneMonth
+    @State private var continueActive = false
 
     var body: some View {
         GeometryReader { g in
@@ -91,26 +97,19 @@ struct BadgesHowLongView: View {
 
                     Spacer(minLength: 20)
 
-                    // fixedSize + maxHeight on the cards so all three match the tallest one -
+                    // fixedSize + maxHeight on the cards so they all match the tallest one -
                     // only Annual carries a savings line, and prices wrap at large fonts
                     HStack(alignment: .top, spacing: 12) {
-                        periodCard(.oneMonth)
-                        periodCard(.monthly)
-                        periodCard(.annual)
+                        ForEach(BadgePeriod.allCases) { periodCard($0) }
                     }
                     .fixedSize(horizontal: false, vertical: true)
 
                     Spacer(minLength: 20)
 
                     VStack(spacing: 10) {
-                        payButton()
+                        continueButton()
                             .padding(.vertical, 10)
-                        Text(billingFooter)
-                            .font(.footnote)
-                            .foregroundColor(theme.colors.secondary)
-                            .multilineTextAlignment(.center)
-                            .fixedSize(horizontal: false, vertical: true)
-                            .frame(height: 22)
+                        BadgeBillingFooter(period: selectedPeriod)
                     }
                     .padding(.bottom, g.safeAreaInsets.bottom == 0 ? 20 : 0)
                 }
@@ -123,11 +122,11 @@ struct BadgesHowLongView: View {
         .frame(maxHeight: .infinity)
         .navigationBarTitleDisplayMode(.inline)
         .task { await store.load() }
-        .alert(item: $alert) { $0.alert }
     }
 
     private func periodCard(_ period: BadgePeriod) -> some View {
         let isSelected = period == selectedPeriod
+        let forSale = badgePeriodsForSale.contains(period)
         return Button {
             selectedPeriod = period
         } label: {
@@ -137,17 +136,18 @@ struct BadgesHowLongView: View {
                     .scaledToFit()
                     .frame(width: 32, height: 32)
                     .foregroundColor(isSelected ? theme.colors.primary : theme.colors.secondary)
+                    .opacity(forSale ? 1 : 0.4)
                 Text(period.label)
-                    .font(.title3)
-                    .fontWeight(.bold)
+                    .font(.subheadline)
                 period.priceText(store.price(level, period))
-                    .font(.body)
+                    .font(.headline)
                 if let percent = savingsPercent(period) {
-                    Text("Save \(percent)%")
+                    Text("\(percent)% off")
                         .font(.footnote)
                         .foregroundColor(isSelected ? theme.colors.primary : theme.colors.secondary)
                 }
             }
+            .foregroundColor(forSale ? nil : theme.colors.secondary)
             .multilineTextAlignment(.center)
             .padding(.vertical, 25)
             .padding(.horizontal, 12)
@@ -160,99 +160,53 @@ struct BadgesHowLongView: View {
             )
         }
         .buttonStyle(.plain)
+        .disabled(!forSale)
     }
 
     private func savingsPercent(_ period: BadgePeriod) -> Int? {
         period == .annual ? store.annualSavings(level) : nil
     }
 
-    private func payButton() -> some View {
-        let price = store.price(level, selectedPeriod)
-        let disabled = !price.canPurchase || purchasing
-        return Button {
-            purchase()
-        } label: {
-            selectedPeriod.payText(price)
-        }
-        .buttonStyle(OnboardingButtonStyle(isDisabled: disabled))
-        .disabled(disabled)
-    }
-
-    private func purchase() {
-        let period = selectedPeriod
-        let invoiceId = newBadgeInvoiceId()
-        purchasing = true
-        Task {
-            do {
-                let outcome = try await store.purchase(level, period, invoiceId: invoiceId)
-                await MainActor.run {
-                    purchasing = false
-                    switch outcome {
-                    case let .purchased(receipt): showPurchasedAlert(receipt, invoiceId)
-                    case .pending:
-                        alert = SomeAlert(
-                            alert: mkAlert(
-                                title: "Purchase pending",
-                                message: "The purchase is awaiting approval. This build does not deliver purchases approved later."
-                            ),
-                            id: "badgePurchasePending"
-                        )
-                    case .cancelled: break
-                    }
-                }
-            } catch let error {
-                logger.error("BadgesHowLongView.purchase: \(String(describing: error))")
-                await MainActor.run {
-                    purchasing = false
-                    alert = SomeAlert(
-                        alert: Alert(
-                            title: Text("Purchase error"),
-                            message: Text(verbatim: String(describing: error))
-                        ),
-                        id: "badgePurchaseError"
-                    )
-                }
+    private func continueButton() -> some View {
+        ZStack {
+            Button {
+                continueActive = true
+            } label: {
+                Text("Continue")
             }
+            .buttonStyle(OnboardingButtonStyle(isDisabled: false))
+
+            NavigationLink(isActive: $continueActive) {
+                BadgesCheckOrderView(level: level, period: selectedPeriod)
+                    .modifier(ThemedBackground(grouped: true))
+            } label: {
+                EmptyView()
+            }
+            .frame(width: 1, height: 1)
+            .hidden()
         }
     }
+}
 
-    // TODO [badges] store integration diagnostics - replaced by the issued badge once the service lands.
-    private func showPurchasedAlert(_ receipt: BadgeStoreReceipt, _ invoiceId: UUID) {
-        let returnedInvoice: String
-        if let returned = receipt.invoiceId {
-            returnedInvoice = returned == invoiceId ? "yes" : "mismatch: \(returned.uuidString)"
-        } else {
-            returnedInvoice = "none"
-        }
-        var lines = [
-            "Product: \(receipt.productId)",
-            "Invoice: \(invoiceId.uuidString)",
-            "Invoice returned by Apple: \(returnedInvoice)",
-            "Transaction: \(receipt.transactionId)"
-        ]
-        if let environment = receipt.environment { lines.append("Environment: \(environment)") }
-        lines.append("Signature: \(receipt.signatureVerified ? "verified" : "unverified")")
-        lines.append("Token: \(receipt.jws.count) bytes")
-        let summary = lines.joined(separator: "\n")
-        // logged as well as shown: the alert races StoreKit's own sheets, the log always lands
-        logger.debug("badge purchase succeeded\n\(summary)")
-        alert = SomeAlert(
-            alert: Alert(
-                title: Text("Purchase successful"),
-                message: Text(verbatim: summary),
-                primaryButton: .default(Text(verbatim: "Copy token")) { UIPasteboard.general.string = receipt.jws },
-                secondaryButton: .cancel(Text("Ok"))
-            ),
-            id: "badgePurchased"
-        )
+struct BadgeBillingFooter: View {
+    @EnvironmentObject var theme: AppTheme
+    let period: BadgePeriod
+
+    var body: some View {
+        Text(billingFooter)
+            .font(.footnote)
+            .foregroundColor(theme.colors.secondary)
+            .multilineTextAlignment(.center)
+            .fixedSize(horizontal: false, vertical: true)
+            .frame(height: 22)
     }
 
     private var billingFooter: LocalizedStringKey {
-        // TODO [badges] source the actual date from the purchase state machine when wired.
-        var comps = DateComponents(); comps.year = 2026; comps.month = 7; comps.day = 22
-        let stubDate = Calendar.current.date(from: comps) ?? Date()
-        let date = DateFormatter.localizedString(from: stubDate, dateStyle: .long, timeStyle: .none)
-        switch selectedPeriod {
+        // TODO [badges] from now only because a purchase is refused while a badge is held (refuseWhileBadgeHeld);
+        // a top-up must count from the end of the existing balance
+        let endDate = Calendar.current.date(byAdding: .month, value: period.months, to: Date()) ?? Date()
+        let date = DateFormatter.localizedString(from: endDate, dateStyle: .long, timeStyle: .none)
+        switch period {
         case .monthly, .annual: return "Renews on \(date). Cancel anytime."
         case .oneMonth: return "Ends on \(date)."
         }
diff --git a/apps/ios/Shared/Views/Badges/BadgesPurchaseStateView.swift b/apps/ios/Shared/Views/Badges/BadgesPurchaseStateView.swift
new file mode 100644
index 0000000000..702304acd4
--- /dev/null
+++ b/apps/ios/Shared/Views/Badges/BadgesPurchaseStateView.swift
@@ -0,0 +1,100 @@
+//
+//  BadgesPurchaseStateView.swift
+//  SimpleX (iOS)
+//
+//  Created by spaced4ndy on 29.09.2026.
+//  Copyright © 2026 SimpleX Chat. All rights reserved.
+//
+
+import SwiftUI
+import SimpleXChat
+
+struct BadgesPurchaseStateView: View {
+    @EnvironmentObject var theme: AppTheme
+    @Environment(\.dismiss) private var dismiss
+    let title: LocalizedStringKey
+    var message: LocalizedStringKey? = nil
+    var failure: BadgeIssueFailure? = nil
+    var showsAsSheet: Bool = false
+
+    var body: some View {
+        GeometryReader { g in
+            ScrollView {
+                content
+                    .padding(.horizontal, 25)
+                    .padding(.top, showsAsSheet ? 48 : 0)
+                    .padding(.bottom, 20)
+                    .frame(minHeight: g.size.height)
+            }
+        }
+        .frame(maxHeight: .infinity)
+        .navigationBarTitleDisplayMode(.inline)
+    }
+
+    private var content: some View {
+        VStack(alignment: .center, spacing: 16) {
+            Text(title)
+                .font(.largeTitle)
+                .bold()
+                .foregroundColor(theme.colors.primary)
+                .multilineTextAlignment(.center)
+                .fixedSize(horizontal: false, vertical: true)
+
+            if let message {
+                Text(message)
+                    .font(.body)
+                    .multilineTextAlignment(.center)
+                    .fixedSize(horizontal: false, vertical: true)
+            }
+
+            if let failure {
+                VStack(spacing: 6) {
+                    Image(systemName: "exclamationmark.triangle")
+                        .foregroundColor(.red)
+                    Text(failure.purchaseText)
+                        .font(.body)
+                        .foregroundColor(theme.colors.secondary)
+                        .multilineTextAlignment(.center)
+                        .fixedSize(horizontal: false, vertical: true)
+                }
+            }
+
+            Spacer()
+
+            ProgressView().scaleEffect(2)
+
+            Spacer()
+
+            VStack(spacing: 10) {
+                Button {
+                    dismiss()
+                } label: {
+                    Text("Dismiss")
+                        .font(.body)
+                        .fontWeight(.medium)
+                        .foregroundColor(theme.colors.primary)
+                        .padding()
+                }
+                .padding(.vertical, 10)
+                Color.clear
+                    .frame(height: 22)
+            }
+        }
+    }
+}
+
+extension BadgePurchaseState {
+    var title: LocalizedStringKey {
+        switch self {
+        case .issuing: "Issuing your badge"
+        case .waitingForApproval: "Waiting for approval"
+        }
+    }
+
+    var message: LocalizedStringKey {
+        switch self {
+        case .issuing: "Your payment is complete. The badge will be added to this profile."
+        case .waitingForApproval: "Nothing has been charged."
+        }
+    }
+}
diff --git a/apps/ios/Shared/Views/Badges/BadgesRedeemCodeView.swift b/apps/ios/Shared/Views/Badges/BadgesRedeemCodeView.swift
index ed53b21173..322dbf1864 100644
--- a/apps/ios/Shared/Views/Badges/BadgesRedeemCodeView.swift
+++ b/apps/ios/Shared/Views/Badges/BadgesRedeemCodeView.swift
@@ -59,7 +59,7 @@ func redeemBadgeCode(_ user: User, _ code: String) async -> BadgeRedeemOutcome {
         }
     } catch let error {
         logger.error("apiRedeemBadgeCode: \(responseError(error))")
-        return .refused(message: redeemErrorText(error))
+        return .refused(message: redeemErrorText(error, purchase: false))
     }
 }
 
@@ -313,7 +313,8 @@ struct BadgesRedeemLinkView: View {
 
     // leaving does not cancel: the badge is still added after the screen closes
     private func beingIssued() -> some View {
-        linkStep("Badge is being issued", textButton: ("Dismiss", { closeIfShowing() })) {
+        linkStep("Issuing your badge", textButton: ("Dismiss", { closeIfShowing() })) {
+            linkText(NSLocalizedString("The badge will be added to this profile.", comment: "badge link, being issued"))
             Spacer()
             ProgressView().scaleEffect(2)
         }
diff --git a/apps/ios/Shared/Views/Badges/BadgesSupportSimplexView.swift b/apps/ios/Shared/Views/Badges/BadgesSupportSimplexView.swift
index 22cec4a4f4..df13abdc97 100644
--- a/apps/ios/Shared/Views/Badges/BadgesSupportSimplexView.swift
+++ b/apps/ios/Shared/Views/Badges/BadgesSupportSimplexView.swift
@@ -11,13 +11,14 @@ import SimpleXChat
 
 struct BadgesSupportSimplexView: View {
     @EnvironmentObject var theme: AppTheme
+    @EnvironmentObject var chatModel: ChatModel
+    @ObservedObject private var store = BadgeStore.shared
     // set true when presented as a sheet root (from the chat-list banner) — that path doesn't
     // reserve nav-bar space like a NavigationLink push does, so the title lands too close to the top
     var showsAsSheet: Bool = false
     @State private var whyBuiltActive = false
     @State private var howItWorksActive = false
     @State private var chooseLevelActive = false
-    @State private var redeemCodeActive = false
 
     var body: some View {
         GeometryReader { g in
@@ -34,8 +35,6 @@ struct BadgesSupportSimplexView: View {
                     .multilineTextAlignment(.center)
                     .fixedSize(horizontal: false, vertical: true)
 
-                // TODO [badges] restore whyBuiltButton() when in-app purchase lands: the level screen
-                // returns to the flow and howItWorksButton() moves there, leaving this one alone here.
                 howItWorksButton()
 
                 Spacer(minLength: 0)
@@ -47,10 +46,16 @@ struct BadgesSupportSimplexView: View {
                 Spacer(minLength: 0)
 
                 VStack(spacing: 10) {
-                    buyInBrowserButton()
+                    chooseLevelButton()
                         .padding(.vertical, 10)
-                    redeemCodeButton()
-                        .frame(height: 22)
+                    Group {
+                        if badgeBrowserAllowed {
+                            buyInBrowserButton()
+                        } else {
+                            RedeemCodeButton()
+                        }
+                    }
+                    .frame(height: 22)
                 }
                 .padding(.bottom, g.safeAreaInsets.bottom == 0 ? 20 : 0)
             }
@@ -65,15 +70,16 @@ struct BadgesSupportSimplexView: View {
         .navigationBarTitleDisplayMode(.inline)
     }
 
-    // the in-app purchase path, kept compiling and uncalled until payments return after the MVP
     private func chooseLevelButton() -> some View {
-        ZStack {
+        let disabled = !store.canBuy(chatModel.currentUser?.userId)
+        return ZStack {
             Button {
                 chooseLevelActive = true
             } label: {
-                Text("Choose your level")
+                Text("Choose your badge")
             }
-            .buttonStyle(OnboardingButtonStyle(isDisabled: false))
+            .buttonStyle(OnboardingButtonStyle(isDisabled: disabled))
+            .disabled(disabled)
 
             NavigationLink(isActive: $chooseLevelActive) {
                 BadgesChooseBadgeView()
@@ -125,7 +131,23 @@ struct BadgesSupportSimplexView: View {
         }
     }
 
-    private func redeemCodeButton() -> some View {
+    private func buyInBrowserButton() -> some View {
+        Button {
+            UIApplication.shared.open(URL(string: badgePageUrl)!)
+        } label: {
+            Text("Buy in browser")
+                .font(.body)
+                .fontWeight(.medium)
+                .foregroundColor(theme.colors.primary)
+        }
+    }
+}
+
+struct RedeemCodeButton: View {
+    @EnvironmentObject var theme: AppTheme
+    @State private var redeemCodeActive = false
+
+    var body: some View {
         ZStack {
             Button {
                 redeemCodeActive = true
@@ -146,15 +168,6 @@ struct BadgesSupportSimplexView: View {
             .hidden()
         }
     }
-
-    private func buyInBrowserButton() -> some View {
-        Button {
-            UIApplication.shared.open(URL(string: badgePageUrl)!)
-        } label: {
-            Text("Buy in browser")
-        }
-        .buttonStyle(OnboardingButtonStyle(isDisabled: false))
-    }
 }
 
 struct PhoneSupporterHero: View {
diff --git a/apps/ios/Shared/Views/Badges/BadgesView.swift b/apps/ios/Shared/Views/Badges/BadgesView.swift
index df12094a6b..28fa1a02e8 100644
--- a/apps/ios/Shared/Views/Badges/BadgesView.swift
+++ b/apps/ios/Shared/Views/Badges/BadgesView.swift
@@ -12,6 +12,7 @@ import SimpleXChat
 struct BadgesView: View {
     @EnvironmentObject var chatModel: ChatModel
     @ObservedObject private var badgeModel = BadgeModel.shared
+    @ObservedObject private var store = BadgeStore.shared
     var showsAsSheet: Bool = false
 
     private var shownBadge: BadgeState? {
@@ -25,12 +26,27 @@ struct BadgesView: View {
             if let badgeState = shownBadge {
                 BadgesYourBadgeView(badgeState: badgeState, showsAsSheet: showsAsSheet)
                     .transition(.opacity)
+            } else if let purchaseState = store.purchaseState(chatModel.currentUser?.userId) {
+                // holds the purchase screens' slot, so a consumable cannot be bought twice
+                BadgesPurchaseStateView(title: purchaseState.title, message: purchaseState.message, failure: store.creditError(chatModel.currentUser?.userId), showsAsSheet: showsAsSheet)
+                    .transition(.opacity)
+                    .onReceive(store.refusals) { refusal in
+                        // only the issuing screen belongs to the active profile's held purchase, so a refusal shown there reads as its own
+                        if purchaseState == .issuing {
+                            showAlert(NSLocalizedString("Purchase error", comment: "alert title"), message: redeemErrorText(refusal, purchase: true))
+                        }
+                    }
+            } else if store.checkingPurchases {
+                BadgesPurchaseStateView(title: "Checking your purchases", showsAsSheet: showsAsSheet)
+                    .transition(.opacity)
             } else {
                 BadgesSupportSimplexView(showsAsSheet: showsAsSheet)
                     .transition(.opacity)
             }
         }
         .animation(.default, value: shownBadge != nil)
+        .animation(.default, value: store.purchaseState(chatModel.currentUser?.userId))
+        .animation(.default, value: store.checkingPurchases)
     }
 }
 
diff --git a/apps/ios/Shared/Views/Badges/BadgesYourBadgeView.swift b/apps/ios/Shared/Views/Badges/BadgesYourBadgeView.swift
index 60c6a0ab77..6a67dad8c2 100644
--- a/apps/ios/Shared/Views/Badges/BadgesYourBadgeView.swift
+++ b/apps/ios/Shared/Views/Badges/BadgesYourBadgeView.swift
@@ -14,6 +14,7 @@ struct BadgesYourBadgeView: View {
     @EnvironmentObject var chatModel: ChatModel
     @Environment(\.dismiss) private var dismiss
     @AppStorage(DEFAULT_DEVELOPER_TOOLS) private var developerTools = false
+    @ObservedObject private var store = BadgeStore.shared
     let badgeState: BadgeState
     var showsAsSheet: Bool = false
 
@@ -78,6 +79,15 @@ struct BadgesYourBadgeView: View {
                         }
                     }
                 }
+                if store.purchaseState(chatModel.currentUser?.userId) != nil {
+                    Section {
+                        Text("A store purchase is being processed.")
+                            .foregroundColor(theme.colors.secondary)
+                    } header: {
+                        Text("Store purchase")
+                            .foregroundColor(theme.colors.secondary)
+                    }
+                }
                 if developerTools {
                     Section(header: Text("Credential").foregroundColor(theme.colors.secondary)) {
                         if let badge = chatModel.currentUser?.profile.localBadge {
diff --git a/apps/ios/SimpleX.xcodeproj/project.pbxproj b/apps/ios/SimpleX.xcodeproj/project.pbxproj
index d4171b89ae..05a28d21ce 100644
--- a/apps/ios/SimpleX.xcodeproj/project.pbxproj
+++ b/apps/ios/SimpleX.xcodeproj/project.pbxproj
@@ -168,6 +168,8 @@
 		647C9E293061362A0032110E /* GetStakeBanner.swift in Sources */ = {isa = PBXBuildFile; fileRef = 647C9E283061362A0032110E /* GetStakeBanner.swift */; };
 		647C9E2C30666C640032110E /* BadgesChooseBadgeView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 647C9E2A30666C640032110E /* BadgesChooseBadgeView.swift */; };
 		647C9E2D30666C640032110E /* BadgesHowLongView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 647C9E2B30666C640032110E /* BadgesHowLongView.swift */; };
+		64D1B0A23070AA0000C0DE01 /* BadgesCheckOrderView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 64D1B0A13070AA0000C0DE01 /* BadgesCheckOrderView.swift */; };
+		64D1B0A43070AA0000C0DE01 /* BadgesPurchaseStateView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 64D1B0A33070AA0000C0DE01 /* BadgesPurchaseStateView.swift */; };
 		647F090E288EA27B00644C40 /* GroupMemberInfoView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 647F090D288EA27B00644C40 /* GroupMemberInfoView.swift */; };
 		648010AB281ADD15009009B9 /* CIFileView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 648010AA281ADD15009009B9 /* CIFileView.swift */; };
 		648679AB2BC96A74006456E7 /* ChatItemForwardingView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 648679AA2BC96A74006456E7 /* ChatItemForwardingView.swift */; };
@@ -560,6 +562,8 @@
 		647C9E283061362A0032110E /* GetStakeBanner.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = GetStakeBanner.swift; sourceTree = "<group>"; };
 		647C9E2A30666C640032110E /* BadgesChooseBadgeView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = BadgesChooseBadgeView.swift; sourceTree = "<group>"; };
 		647C9E2B30666C640032110E /* BadgesHowLongView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = BadgesHowLongView.swift; sourceTree = "<group>"; };
+		64D1B0A13070AA0000C0DE01 /* BadgesCheckOrderView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = BadgesCheckOrderView.swift; sourceTree = "<group>"; };
+		64D1B0A33070AA0000C0DE01 /* BadgesPurchaseStateView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = BadgesPurchaseStateView.swift; sourceTree = "<group>"; };
 		647F090D288EA27B00644C40 /* GroupMemberInfoView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = GroupMemberInfoView.swift; sourceTree = "<group>"; };
 		648010AA281ADD15009009B9 /* CIFileView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = CIFileView.swift; sourceTree = "<group>"; };
 		648679AA2BC96A74006456E7 /* ChatItemForwardingView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ChatItemForwardingView.swift; sourceTree = "<group>"; };
@@ -1219,6 +1223,8 @@
 			children = (
 				647C9E2A30666C640032110E /* BadgesChooseBadgeView.swift */,
 				647C9E2B30666C640032110E /* BadgesHowLongView.swift */,
+				64D1B0A13070AA0000C0DE01 /* BadgesCheckOrderView.swift */,
+				64D1B0A33070AA0000C0DE01 /* BadgesPurchaseStateView.swift */,
 				644CC228305BFAE400D2A571 /* BadgesLedgerView.swift */,
 				64EB8A9A3054347A0089FFDF /* BadgesView.swift */,
 				64C03BF0302F423300072BDE /* BadgesHowItWorksView.swift */,
@@ -1672,6 +1678,8 @@
 				6442E0BA287F169300CEC0F9 /* AddGroupView.swift in Sources */,
 				647C9E2C30666C640032110E /* BadgesChooseBadgeView.swift in Sources */,
 				647C9E2D30666C640032110E /* BadgesHowLongView.swift in Sources */,
+				64D1B0A23070AA0000C0DE01 /* BadgesCheckOrderView.swift in Sources */,
+				64D1B0A43070AA0000C0DE01 /* BadgesPurchaseStateView.swift in Sources */,
 				5CF937232B2503D000E1D781 /* NSESubscriber.swift in Sources */,
 				6419EC582AB97507004A607A /* CIMemberCreatedContactView.swift in Sources */,
 				64D0C2C229FA57AB00B38D5F /* UserAddressLearnMore.swift in Sources */,
diff --git a/apps/ios/SimpleXChat/APITypes.swift b/apps/ios/SimpleXChat/APITypes.swift
index 75d66ebb6f..1815a53f4f 100644
--- a/apps/ios/SimpleXChat/APITypes.swift
+++ b/apps/ios/SimpleXChat/APITypes.swift
@@ -826,6 +826,7 @@ public enum ChatErrorType: Decodable, Hashable {
 
 public enum BadgeRedeemError: Decodable, Hashable {
     case invalidCode
+    case invalidReceipt
     case serviceNotConfigured
     case badgeActive
     case serviceError(serviceError: BadgeServiceErrorCode)
@@ -846,6 +847,7 @@ public enum BadgeServiceErrorCode: Decodable, Hashable {
     case paymentNotEntitled
     case paymentPending
     case providerUnavailable
+    case providerNotConfigured
     case rateLimited
     case codeInvalid
     case codeUsed
@@ -867,6 +869,7 @@ public enum BadgeServiceErrorCode: Decodable, Hashable {
         case .paymentNotEntitled: "payment_not_entitled"
         case .paymentPending: "payment_pending"
         case .providerUnavailable: "provider_unavailable"
+        case .providerNotConfigured: "provider_not_configured"
         case .rateLimited: "rate_limited"
         case .codeInvalid: "code_invalid"
         case .codeUsed: "code_used"
@@ -890,6 +893,7 @@ public enum BadgeServiceErrorCode: Decodable, Hashable {
         case "payment_not_entitled": self = .paymentNotEntitled
         case "payment_pending": self = .paymentPending
         case "provider_unavailable": self = .providerUnavailable
+        case "provider_not_configured": self = .providerNotConfigured
         case "rate_limited": self = .rateLimited
         case "code_invalid": self = .codeInvalid
         case "code_used": self = .codeUsed
@@ -911,8 +915,13 @@ public func badgeServiceErrorText(_ code: BadgeServiceErrorCode) -> String? {
     case .unsupportedVersion: NSLocalizedString("This app version is too old for the badge service. Please update the app.", comment: "alert message")
     case .unknownPurchaseKey: NSLocalizedString("The badge service does not recognize this badge.", comment: "alert message")
     case .internalError: NSLocalizedString("The badge service reported an internal error.", comment: "alert message")
-    case .badRequest, .unknownOfferId, .offerDisabled, .offerMismatch, .productUnavailable,
-         .paymentNotEntitled, .paymentPending, .providerUnavailable, .receiptInvalid, .receiptUsed, .unknown: nil
+    case .receiptInvalid: NSLocalizedString("The store did not confirm this purchase.", comment: "alert message")
+    case .receiptUsed: NSLocalizedString("This purchase was already credited to a badge on another device or profile.", comment: "alert message")
+    case .paymentPending: NSLocalizedString("The payment has not been confirmed yet.", comment: "alert message")
+    case .providerUnavailable: NSLocalizedString("The store could not be reached.", comment: "alert message")
+    case .providerNotConfigured: NSLocalizedString("Badges cannot be bought in the app yet.", comment: "alert message")
+    case .productUnavailable: NSLocalizedString("This badge is not on sale.", comment: "alert message")
+    case .badRequest, .unknownOfferId, .offerDisabled, .offerMismatch, .paymentNotEntitled, .unknown: nil
     }
 }
 
diff --git a/apps/ios/SimpleXChat/ChatTypes.swift b/apps/ios/SimpleXChat/ChatTypes.swift
index cf520a65c7..9e6ff84b96 100644
--- a/apps/ios/SimpleXChat/ChatTypes.swift
+++ b/apps/ios/SimpleXChat/ChatTypes.swift
@@ -368,6 +368,16 @@ public enum BadgeIssueFailure: Decodable, Hashable {
         }
     }
 
+    public var purchaseText: String {
+        switch self {
+        case let .serviceError(code, _):
+            badgeServiceErrorText(code)
+                ?? String.localizedStringWithFormat(NSLocalizedString("The badge service refused the purchase: %@", comment: "badge purchase error"), code.text)
+        case .invalidCredential: NSLocalizedString("This app version cannot verify this badge. Please update the app.", comment: "alert message")
+        case .serviceTimeout, .network, .unexpected: text
+        }
+    }
+
     // the stored form, for support
     public var tag: String {
         switch self {
diff --git a/apps/multiplatform/android/src/foss/java/chat/simplex/app/PlayStore.kt b/apps/multiplatform/android/src/foss/java/chat/simplex/app/PlayStore.kt
index 1d8fc5e151..0cad378da6 100644
--- a/apps/multiplatform/android/src/foss/java/chat/simplex/app/PlayStore.kt
+++ b/apps/multiplatform/android/src/foss/java/chat/simplex/app/PlayStore.kt
@@ -5,6 +5,7 @@ import chat.simplex.common.views.badges.BadgeProduct
 import chat.simplex.common.views.badges.BadgePurchaseOutcome
 import chat.simplex.common.views.badges.BadgeStoreError
 import chat.simplex.common.views.badges.BadgeStoreProductId
+import chat.simplex.common.views.badges.BadgeStoreReceipt
 
 // Play Billing is only in the google flavor, so the Play country stays unknown here
 fun loadPlayStoreCountry() {}
@@ -22,3 +23,11 @@ suspend fun loadBadgeProducts(oneTimeIds: List<BadgeStoreProductId>, subscriptio
 @Suppress("UNUSED_PARAMETER")
 suspend fun purchaseBadge(id: BadgeStoreProductId, invoiceId: String): BadgePurchaseOutcome =
   throw BadgeStoreError.StoreUnavailable
+
+@Suppress("UNUSED_PARAMETER")
+suspend fun acknowledgeBadgePurchase(receipt: BadgeStoreReceipt) {}
+
+@Suppress("UNUSED_PARAMETER")
+suspend fun finishBadgePurchase(receipt: BadgeStoreReceipt) {}
+
+suspend fun unfinishedBadgePurchases(): List<BadgePurchaseOutcome> = emptyList()
diff --git a/apps/multiplatform/android/src/google/java/chat/simplex/app/PlayStore.kt b/apps/multiplatform/android/src/google/java/chat/simplex/app/PlayStore.kt
index 4075421e52..85b9da1316 100644
--- a/apps/multiplatform/android/src/google/java/chat/simplex/app/PlayStore.kt
+++ b/apps/multiplatform/android/src/google/java/chat/simplex/app/PlayStore.kt
@@ -5,6 +5,7 @@ import chat.simplex.common.platform.androidAppContext
 import chat.simplex.common.platform.androidPlayStoreCountry
 import chat.simplex.common.platform.mainActivity
 import chat.simplex.common.views.badges.*
+import chat.simplex.common.views.helpers.withLongRunningApi
 import com.android.billingclient.api.*
 import kotlinx.coroutines.CompletableDeferred
 import kotlinx.coroutines.Dispatchers
@@ -40,7 +41,7 @@ fun loadPlayStoreCountry() {
 
 // One long-lived client for badges: ProductDetails obtained from it are passed back to it when the
 // purchase is launched, and the purchase result arrives on its listener rather than as a return value.
-// volatile: the listener is called on the main thread, the purchase runs on a background dispatcher
+// volatile: written by the purchase on a background dispatcher, read by the listener on another thread
 @Volatile private var badgeBillingClient: BillingClient? = null
 @Volatile private var badgeOffers: Map<BadgeStoreProductId, BadgeOffer> = emptyMap()
 @Volatile private var badgePurchase: CompletableDeferred<BadgePurchaseOutcome>? = null
@@ -80,8 +81,7 @@ suspend fun purchaseBadge(id: BadgeStoreProductId, invoiceId: String): BadgePurc
   val activity = mainActivity.get() ?: throw BadgeStoreError.StoreUnavailable
   val client = connectedBadgeBillingClient()
   val offer = badgeOffers[id] ?: throw BadgeStoreError.ProductUnavailable(id.productId)
-  val details = offer.details
-  val productParams = BillingFlowParams.ProductDetailsParams.newBuilder().setProductDetails(details)
+  val productParams = BillingFlowParams.ProductDetailsParams.newBuilder().setProductDetails(offer.details)
   offer.offerToken?.let { productParams.setOfferToken(it) }
   val params = BillingFlowParams.newBuilder()
     .setProductDetailsParamsList(listOf(productParams.build()))
@@ -94,19 +94,42 @@ suspend fun purchaseBadge(id: BadgeStoreProductId, invoiceId: String): BadgePurc
     if (launched.responseCode != BillingClient.BillingResponseCode.OK) {
       throw BadgeStoreError.BillingError(launched.responseCode, launched.debugMessage)
     }
-    val outcome = purchase.await()
-    if (outcome is BadgePurchaseOutcome.Purchased) finishBadgePurchase(client, details, outcome.receipt)
-    return outcome
+    return purchase.await()
   } finally {
     badgePurchase = null
   }
 }
 
+// one-time purchases Play still holds: bought and not consumed, or awaiting a slow payment
+suspend fun unfinishedBadgePurchases(): List<BadgePurchaseOutcome> {
+  val client = connectedBadgeBillingClient()
+  val params = QueryPurchasesParams.newBuilder().setProductType(BillingClient.ProductType.INAPP).build()
+  val queried = CompletableDeferred<List<Purchase>>()
+  client.queryPurchasesAsync(params) { result, purchases ->
+    if (result.responseCode == BillingClient.BillingResponseCode.OK) {
+      queried.complete(purchases)
+    } else {
+      queried.completeExceptionally(BadgeStoreError.BillingError(result.responseCode, result.debugMessage))
+    }
+  }
+  return queried.await().mapNotNull(::badgePurchaseOutcome)
+}
+
 private val badgePurchasesUpdatedListener = PurchasesUpdatedListener { result, purchases ->
-  val pending = badgePurchase ?: return@PurchasesUpdatedListener
+  val pending = badgePurchase
+  if (pending == null) {
+    // settled outside a purchase call, such as a slow payment completing
+    if (result.responseCode == BillingClient.BillingResponseCode.OK && purchases != null) {
+      withLongRunningApi { purchases.mapNotNull(::badgePurchaseOutcome).forEach { BadgeStore.reconcile(it) } }
+    }
+    return@PurchasesUpdatedListener
+  }
   when {
-    result.responseCode == BillingClient.BillingResponseCode.OK && purchases != null ->
-      pending.complete(badgePurchaseOutcome(purchases))
+    result.responseCode == BillingClient.BillingResponseCode.OK && purchases != null -> {
+      val outcomes = purchases.mapNotNull(::badgePurchaseOutcome)
+      pending.complete(outcomes.firstOrNull() ?: BadgePurchaseOutcome.Cancelled)
+      withLongRunningApi { outcomes.drop(1).forEach { BadgeStore.reconcile(it) } }
+    }
     result.responseCode == BillingClient.BillingResponseCode.USER_CANCELED ->
       pending.complete(BadgePurchaseOutcome.Cancelled)
     else ->
@@ -114,17 +137,17 @@ private val badgePurchasesUpdatedListener = PurchasesUpdatedListener { result, p
   }
 }
 
-private fun badgePurchaseOutcome(purchases: List<Purchase>): BadgePurchaseOutcome {
-  val purchase = purchases.firstOrNull() ?: return BadgePurchaseOutcome.Cancelled
-  if (purchase.purchaseState == Purchase.PurchaseState.PENDING) return BadgePurchaseOutcome.Pending
-  return BadgePurchaseOutcome.Purchased(
+private fun badgePurchaseOutcome(purchase: Purchase): BadgePurchaseOutcome? = when (purchase.purchaseState) {
+  Purchase.PurchaseState.PENDING -> BadgePurchaseOutcome.Pending(purchase.accountIdentifiers?.obfuscatedAccountId)
+  Purchase.PurchaseState.PURCHASED -> BadgePurchaseOutcome.Purchased(
     BadgeStoreReceipt(
       token = purchase.purchaseToken,
       productId = purchase.products.firstOrNull() ?: "",
-      orderId = purchase.orderId,
-      invoiceId = purchase.accountIdentifiers?.obfuscatedAccountId
+      invoiceId = purchase.accountIdentifiers?.obfuscatedAccountId,
+      acknowledged = purchase.isAcknowledged
     )
   )
+  else -> null
 }
 
 private suspend fun connectedBadgeBillingClient(): BillingClient {
@@ -203,21 +226,34 @@ private fun ProductDetails.badgeOffer(id: BadgeStoreProductId): BadgeOffer? {
   return BadgeOffer(id, product, this, offer.offerToken)
 }
 
-// nothing is delivered in this build, so the purchase is finished right away; once the service issues
-// credentials it must only be finished after the credential is stored. One-time products are consumed
-// so they can be bought again, subscriptions are acknowledged - Play refunds an unacknowledged
-// purchase after 3 days.
-private suspend fun finishBadgePurchase(client: BillingClient, details: ProductDetails, receipt: BadgeStoreReceipt) {
-  val done = CompletableDeferred<BillingResult>()
-  if (details.productType == BillingClient.ProductType.SUBS) {
-    val params = AcknowledgePurchaseParams.newBuilder().setPurchaseToken(receipt.token).build()
-    client.acknowledgePurchase(params) { done.complete(it) }
-  } else {
+// acknowledged without consuming, so Play stops its 3-day refund clock and still lists the purchase until it is finished
+suspend fun acknowledgeBadgePurchase(receipt: BadgeStoreReceipt) {
+  if (!receipt.acknowledged) acknowledge(connectedBadgeBillingClient(), receipt.token)
+}
+
+// consumed if one-time so it can be bought again, else acknowledged, as Play refunds an unacknowledged purchase
+// after 3 days; decided by product id, as after a restart there is no ProductDetails for the purchase
+suspend fun finishBadgePurchase(receipt: BadgeStoreReceipt) {
+  val client = connectedBadgeBillingClient()
+  if (receipt.productId in badgeOneTimeProductIds) {
+    val done = CompletableDeferred<BillingResult>()
     val params = ConsumeParams.newBuilder().setPurchaseToken(receipt.token).build()
     client.consumeAsync(params) { result, _ -> done.complete(result) }
-  }
-  val result = done.await()
-  if (result.responseCode != BillingClient.BillingResponseCode.OK) {
-    Log.e(TAG, "finishBadgePurchase: ${result.responseCode} ${result.debugMessage}")
+    checkBillingResult(done.await())
+  } else {
+    acknowledge(client, receipt.token)
+  }
+}
+
+private suspend fun acknowledge(client: BillingClient, token: String) {
+  val done = CompletableDeferred<BillingResult>()
+  val params = AcknowledgePurchaseParams.newBuilder().setPurchaseToken(token).build()
+  client.acknowledgePurchase(params) { done.complete(it) }
+  checkBillingResult(done.await())
+}
+
+private fun checkBillingResult(result: BillingResult) {
+  if (result.responseCode != BillingClient.BillingResponseCode.OK) {
+    throw BadgeStoreError.BillingError(result.responseCode, result.debugMessage)
   }
 }
diff --git a/apps/multiplatform/android/src/main/java/chat/simplex/app/SimplexApp.kt b/apps/multiplatform/android/src/main/java/chat/simplex/app/SimplexApp.kt
index 1a4c836b2e..9093b1427b 100644
--- a/apps/multiplatform/android/src/main/java/chat/simplex/app/SimplexApp.kt
+++ b/apps/multiplatform/android/src/main/java/chat/simplex/app/SimplexApp.kt
@@ -28,7 +28,9 @@ import chat.simplex.common.platform.*
 import chat.simplex.common.ui.theme.*
 import chat.simplex.common.views.badges.BadgeProduct
 import chat.simplex.common.views.badges.BadgePurchaseOutcome
+import chat.simplex.common.views.badges.BadgeStore
 import chat.simplex.common.views.badges.BadgeStoreProductId
+import chat.simplex.common.views.badges.BadgeStoreReceipt
 import chat.simplex.common.views.call.*
 import chat.simplex.common.views.database.deleteOldChatArchive
 import chat.simplex.common.views.helpers.*
@@ -113,6 +115,7 @@ class SimplexApp: Application(), LifecycleEventObserver {
                 }
               }.onFailure { Log.e(TAG, it.stackTraceToString()) }
             }
+            BadgeStore.presentUnfinished()
           }
         }
         Lifecycle.Event.ON_RESUME -> {
@@ -352,6 +355,12 @@ class SimplexApp: Application(), LifecycleEventObserver {
 
       override suspend fun androidPurchaseBadge(id: BadgeStoreProductId, invoiceId: String): BadgePurchaseOutcome = purchaseBadge(id, invoiceId)
 
+      override suspend fun androidAcknowledgeBadgePurchase(receipt: BadgeStoreReceipt) = acknowledgeBadgePurchase(receipt)
+
+      override suspend fun androidFinishBadgePurchase(receipt: BadgeStoreReceipt) = finishBadgePurchase(receipt)
+
+      override suspend fun androidUnfinishedBadgePurchases(): List<BadgePurchaseOutcome> = unfinishedBadgePurchases()
+
       @SuppressLint("SourceLockedOrientationActivity")
       @Composable
       override fun androidLockPortraitOrientation() {
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/model/ChatModel.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/model/ChatModel.kt
index 9d65606a9c..6a345bb612 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/model/ChatModel.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/model/ChatModel.kt
@@ -2271,6 +2271,12 @@ sealed class BadgeIssueFailure {
     is Unexpected -> String.format(generalGetString(MR.strings.badges_error_unexpected), message)
   }
 
+  val purchaseText: String get() = when (this) {
+    is ServiceError -> badgeServiceErrorText(code) ?: String.format(generalGetString(MR.strings.badges_error_purchase_refused), code.text)
+    is InvalidCredential -> generalGetString(MR.strings.badges_error_credential_not_verified)
+    is ServiceTimeout, is Network, is Unexpected -> text
+  }
+
   // the stored form, for support
   val tag: String get() = when (this) {
     is ServiceError -> "serviceError ${if (retryable) "retry" else "final"} ${code.text}"
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/model/SimpleXAPI.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/model/SimpleXAPI.kt
index 9100b5ecea..cf453d7f88 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/model/SimpleXAPI.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/model/SimpleXAPI.kt
@@ -27,6 +27,8 @@ import chat.simplex.common.model.SMPProxyMode.Always
 import dev.icerock.moko.resources.compose.painterResource
 import chat.simplex.common.platform.*
 import chat.simplex.common.ui.theme.*
+import chat.simplex.common.views.badges.BadgeStore
+import chat.simplex.common.views.badges.BadgeStoreError
 import chat.simplex.common.views.call.*
 import chat.simplex.common.views.chat.item.contentModerationPostLink
 import chat.simplex.common.views.chat.item.showContentBlockedAlert
@@ -587,13 +589,38 @@ object ChatController {
     }
   }
 
+  // log = false because a store receipt is a bearer secret, like a badge code - it is in the command.
+  suspend fun apiPurchaseBadge(rh: Long?, userId: Long, echoedInvoiceId: String?, payment: ServicePayment): BadgePurchaseResult {
+    val r = sendCmd(rh, CC.ApiPurchaseBadge(userId, echoedInvoiceId, payment), log = false)
+    return when {
+      r is API.Result && r.res is CR.BadgeStateR -> BadgePurchaseResult.Held(r.res.user, r.res.badgeState, r.res.storePurchases)
+      r is API.Result && r.res is CR.BadgeRedeemed -> BadgePurchaseResult.Credited(r.res.user.updateRemoteHostId(rh), r.res.badgeState)
+      r is API.Error -> BadgePurchaseResult.Failed(r.err)
+      else -> {
+        // the response type alone - it names a case or a JSON key, never the service's message
+        Log.e(TAG, "apiPurchaseBadge: unexpected ${r.responseType}")
+        BadgePurchaseResult.Failed(null)
+      }
+    }
+  }
+
+  suspend fun apiCreateBadgeInvoice(rh: Long?, userId: Long): String {
+    val r = sendCmd(rh, CC.ApiCreateBadgeInvoice(userId))
+    if (r is API.Result && r.res is CR.BadgeInvoice) return r.res.invoiceId
+    if (r is API.Error) throw BadgeStoreError.ApiError(r.err)
+    throw Exception("apiCreateBadgeInvoice: unexpected ${r.responseType}")
+  }
+
   // localized where the user can act on it; otherwise the error itself, so a screenshot says what happened
-  fun redeemErrorText(err: ChatError?): String {
+  fun redeemErrorText(err: ChatError?, purchase: Boolean): String {
     if (err is ChatError.ChatErrorChat && err.errorType is ChatErrorType.CEBadgeRedeemError) {
       when (val e = err.errorType.badgeRedeemError) {
         is BadgeRedeemError.InvalidCode -> return generalGetString(MR.strings.badges_error_invalid_code)
-        is BadgeRedeemError.ServiceNotConfigured -> return generalGetString(MR.strings.badges_error_service_not_configured)
-        is BadgeRedeemError.BadgeActive -> return generalGetString(MR.strings.badges_error_already_active)
+        is BadgeRedeemError.InvalidReceipt -> {}
+        is BadgeRedeemError.ServiceNotConfigured ->
+          return generalGetString(if (purchase) MR.strings.badges_error_service_not_configured_purchase else MR.strings.badges_error_service_not_configured)
+        is BadgeRedeemError.BadgeActive ->
+          return generalGetString(if (purchase) MR.strings.badges_error_already_active_purchase else MR.strings.badges_error_already_active)
         is BadgeRedeemError.ServiceError -> badgeServiceErrorText(e.serviceError)?.let { return it }
         is BadgeRedeemError.InvalidResponse -> return String.format(generalGetString(MR.strings.badges_error_bad_service_response), e.message)
         is BadgeRedeemError.UnknownKeyIndex, is BadgeRedeemError.CredentialNotVerified -> return generalGetString(MR.strings.badges_error_credential_not_verified)
@@ -602,9 +629,9 @@ object ChatController {
     return "${generalGetString(MR.strings.error_prefix)}: ${err?.string ?: generalGetString(MR.strings.badges_error_unknown)}"
   }
 
-  suspend fun apiGetBadgeState(rh: Long?, userId: Long): BadgeState? {
+  suspend fun apiGetBadgeState(rh: Long?, userId: Long): Pair<BadgeState?, List<OpenStorePurchase>> {
     val r = sendCmd(rh, CC.ApiGetBadgeState(userId))
-    if (r is API.Result && r.res is CR.BadgeStateR) return r.res.badgeState
+    if (r is API.Result && r.res is CR.BadgeStateR) return r.res.badgeState to r.res.storePurchases
     throw Exception("apiGetBadgeState: unexpected ${r.responseType}")
   }
 
@@ -637,11 +664,14 @@ object ChatController {
 
   // Not thrown: a failed badge read must not stop the app starting, and the model is left alone
   // rather than set to nil, which would read as "no badge".
-  private suspend fun loadBadgeState(rhId: Long?) {
+  suspend fun loadBadgeState(rhId: Long?) {
     try {
       val userId = currentUserId("loadBadgeState")
-      val badgeState = apiGetBadgeState(rhId, userId)
-      withContext(Dispatchers.Main) { BadgeModel.set(rhId, userId, badgeState) }
+      val (badgeState, storePurchases) = apiGetBadgeState(rhId, userId)
+      withContext(Dispatchers.Main) {
+        BadgeModel.set(rhId, userId, badgeState)
+        BadgeStore.setStorePurchases(rhId, userId, storePurchases)
+      }
     } catch (e: Exception) {
       Log.e(TAG, "loadBadgeState: ${e.message}")
     }
@@ -686,6 +716,7 @@ object ChatController {
       }
       apiStartChat()
       appPrefs.chatStopped.set(false)
+      withLongRunningApi { BadgeStore.presentUnfinished() }
     } catch (e: Throwable) {
       Log.e(TAG, "failed starting chat $e")
       throw e
@@ -751,6 +782,7 @@ object ChatController {
     chatModel.users.clear()
     chatModel.users.addAll(users)
     getUserChatData(rhId, keepingChatId = keepingChatId)
+    withLongRunningApi { BadgeStore.presentUnfinished() }
     val invitation = chatModel.callInvitations.values.firstOrNull { inv -> inv.user.userId == toUserId }
     if (invitation != null && currentUser != null) {
       chatModel.callManager.reportNewIncomingCall(invitation.copy(user = currentUser))
@@ -3581,6 +3613,9 @@ object ChatController {
             BadgeModel.setAlert(rhId, r.user.userId, r.badgeAlert)
           }
         }
+      is CR.StorePurchaseResolved ->
+        // whichever profile owns it: only the app can finish the store purchase
+        withLongRunningApi { BadgeStore.presentUnfinished() }
       else ->
         Log.d(TAG , "unsupported event: ${msg.responseType}")
     }
@@ -3622,7 +3657,7 @@ object ChatController {
     getUserChatData(null)
   }
 
-  private fun activeUser(rhId: Long?, user: UserLike): Boolean =
+  fun activeUser(rhId: Long?, user: UserLike): Boolean =
     rhId == chatModel.remoteHostId() && user.userId == chatModel.currentUser.value?.userId
 
   private fun withCall(r: CR, contact: Contact, perform: (Call) -> Unit) {
@@ -3884,6 +3919,17 @@ sealed class BadgeRedeemResult {
   class Failed(val err: ChatError?): BadgeRedeemResult()
 }
 
+@Serializable
+data class OpenStorePurchase(val invoiceId: String? = null, val transactionRef: String? = null, val creditError: BadgeIssueFailure? = null)
+
+// a refusal is Failed, with the code in BREServiceError
+sealed class BadgePurchaseResult {
+  class Held(val user: UserRef, val badgeState: BadgeState?, val storePurchases: List<OpenStorePurchase>): BadgePurchaseResult()
+  class Credited(val user: User, val badgeState: BadgeState?): BadgePurchaseResult()
+  // err is null for a response of an unexpected type, which is logged where it is received
+  class Failed(val err: ChatError?): BadgePurchaseResult()
+}
+
 // ChatCommand
 // Spec: spec/api.md#CC
 sealed class CC {
@@ -4064,6 +4110,8 @@ sealed class CC {
   class ApiStandaloneFileInfo(val url: String): CC()
   // badges
   class ApiRedeemBadgeCode(val userId: Long, val code: String): CC()
+  class ApiPurchaseBadge(val userId: Long, val echoedInvoiceId: String?, val payment: ServicePayment): CC()
+  class ApiCreateBadgeInvoice(val userId: Long): CC()
   class ApiGetBadgeState(val userId: Long): CC()
   class ApiGetBadgeLedger(val userId: Long, val badgePurchaseId: Long): CC()
   class ApiAckBadgeAlert(val userId: Long, val badgePurchaseId: Long, val alertKind: BadgeAlertKind, val snooze: Boolean, val episode: String): CC()
@@ -4289,6 +4337,8 @@ sealed class CC {
     is ApiDownloadStandaloneFile -> "/_download $userId $url ${file.filePath}"
     is ApiStandaloneFileInfo -> "/_download info $url"
     is ApiRedeemBadgeCode -> "/_redeem_badge_code $userId $code"
+    is ApiPurchaseBadge -> "/_badge purchase $userId${echoedInvoiceId?.let { " invoice=$it" } ?: ""} ${json.encodeToString(payment)}"
+    is ApiCreateBadgeInvoice -> "/_badge invoice $userId"
     is ApiGetBadgeState -> "/_badge state $userId"
     is ApiGetBadgeLedger -> "/_badge ledger $userId $badgePurchaseId"
     is ApiAckBadgeAlert -> "/_badge ack $userId $badgePurchaseId ${badgeAlertKindParam(alertKind)} ${onOff(snooze)} $episode"
@@ -4473,6 +4523,8 @@ sealed class CC {
     is ApiDownloadStandaloneFile -> "apiDownloadStandaloneFile"
     is ApiStandaloneFileInfo -> "apiStandaloneFileInfo"
     is ApiRedeemBadgeCode -> "apiRedeemBadgeCode"
+    is ApiPurchaseBadge -> "apiPurchaseBadge"
+    is ApiCreateBadgeInvoice -> "apiCreateBadgeInvoice"
     is ApiGetBadgeState -> "apiGetBadgeState"
     is ApiGetBadgeLedger -> "apiGetBadgeLedger"
     is ApiAckBadgeAlert -> "apiAckBadgeAlert"
@@ -4497,8 +4549,11 @@ sealed class CC {
       is ApiUnhideUser -> ApiUnhideUser(userId, obfuscate(viewPwd))
       is ApiDeleteUser -> ApiDeleteUser(userId, delSMPQueues, obfuscateOrNull(viewPwd))
       is TestStorageEncryption -> TestStorageEncryption(obfuscate(key))
-      // a code is a bearer secret until it is redeemed, and the terminal shows and copies cmdString
+      // a code or a store receipt is a bearer secret until it is redeemed, and the terminal shows and copies cmdString
       is ApiRedeemBadgeCode -> ApiRedeemBadgeCode(userId, obfuscate(code))
+      is ApiPurchaseBadge -> ApiPurchaseBadge(userId, echoedInvoiceId, when (payment) {
+        is ServicePayment.Google -> ServicePayment.Google(payment.productId, obfuscate(payment.token))
+      })
       else -> this
     }
 
@@ -4532,6 +4587,12 @@ sealed class CC {
   }
 }
 
+// the field must stay typed as the sealed base, or kotlinx omits the "type" tag core parses by
+@Serializable
+sealed class ServicePayment {
+  @Serializable @SerialName("google") class Google(val productId: String, val token: String): ServicePayment()
+}
+
 fun onOff(b: Boolean): String = if (b) "on" else "off"
 
 // /_badge ack takes the kind in core's text encoding, not the JSON tag
@@ -6865,10 +6926,12 @@ sealed class CR {
   // badges
   // the full user, not UserRef: its profile carries the badge that setUserBadge just stored
   @Serializable @SerialName("badgeRedeemed") class BadgeRedeemed(val user: User, val redeemedBadge: LocalBadge, val newBadge: Boolean, val badgeState: BadgeState?): CR()
-  @Serializable @SerialName("badgeState") class BadgeStateR(val user: UserRef, val badgeState: BadgeState?): CR()
+  @Serializable @SerialName("badgeInvoice") class BadgeInvoice(val user: UserRef, val invoiceId: String): CR()
+  @Serializable @SerialName("badgeState") class BadgeStateR(val user: UserRef, val badgeState: BadgeState?, val storePurchases: List<OpenStorePurchase> = emptyList()): CR()
   @Serializable @SerialName("badgeLedger") class BadgeLedger(val user: UserRef, val badgeLedger: List<StatementEntry>): CR()
   @Serializable @SerialName("badgeChanged") class BadgeChanged(val user: User, val badgeState: BadgeState?): CR()
   @Serializable @SerialName("badgeAlert") class BadgeAlertR(val user: UserRef, val badgeAlert: BadgeAlert): CR()
+  @Serializable @SerialName("storePurchaseResolved") class StorePurchaseResolved(val user: UserRef): CR()
   // general
   @Serializable class Response(val type: String, val json: String): CR()
   @Serializable class Invalid(val str: String): CR()
@@ -7056,10 +7119,12 @@ sealed class CR {
     is ArchiveImported -> "archiveImported"
     is AppSettingsR -> "appSettings"
     is BadgeRedeemed -> "badgeRedeemed"
+    is BadgeInvoice -> "badgeInvoice"
     is BadgeStateR -> "badgeState"
     is BadgeLedger -> "badgeLedger"
     is BadgeChanged -> "badgeChanged"
     is BadgeAlertR -> "badgeAlert"
+    is StorePurchaseResolved -> "storePurchaseResolved"
     is Response -> "* $type"
     is Invalid -> "* invalid json"
   }
@@ -7264,10 +7329,12 @@ sealed class CR {
     is ArchiveImported -> "${archiveErrors.map { it.string } }"
     is AppSettingsR -> json.encodeToString(appSettings)
     is BadgeRedeemed -> withUser(user, "redeemedBadge: ${json.encodeToString(redeemedBadge)}\nnewBadge: $newBadge\nbadgeState: ${json.encodeToString(badgeState)}")
-    is BadgeStateR -> withUser(user, json.encodeToString(badgeState))
+    is BadgeInvoice -> withUser(user, invoiceId)
+    is BadgeStateR -> withUser(user, "${json.encodeToString(badgeState)}\nstorePurchases: ${json.encodeToString(storePurchases)}")
     is BadgeLedger -> withUser(user, json.encodeToString(badgeLedger))
     is BadgeChanged -> withUser(user, json.encodeToString(badgeState))
     is BadgeAlertR -> withUser(user, json.encodeToString(badgeAlert))
+    is StorePurchaseResolved -> withUser(user, noDetails())
     is Response -> json
     is Invalid -> str
   }
@@ -7323,6 +7390,7 @@ sealed class SimplexDomainError {
 sealed class BadgeRedeemError {
   val string: String get() = when (this) {
     is InvalidCode -> "invalidCode"
+    is InvalidReceipt -> "invalidReceipt"
     is ServiceNotConfigured -> "serviceNotConfigured"
     is BadgeActive -> "badgeActive"
     is ServiceError -> "serviceError ${serviceError.text}"
@@ -7331,6 +7399,7 @@ sealed class BadgeRedeemError {
     is CredentialNotVerified -> "credentialNotVerified"
   }
   @Serializable @SerialName("invalidCode") object InvalidCode : BadgeRedeemError()
+  @Serializable @SerialName("invalidReceipt") object InvalidReceipt : BadgeRedeemError()
   @Serializable @SerialName("serviceNotConfigured") object ServiceNotConfigured : BadgeRedeemError()
   @Serializable @SerialName("badgeActive") object BadgeActive : BadgeRedeemError()
   @Serializable @SerialName("serviceError") class ServiceError(val serviceError: BadgeServiceErrorCode) : BadgeRedeemError()
@@ -7352,6 +7421,7 @@ sealed class BadgeServiceErrorCode {
   object PaymentNotEntitled: BadgeServiceErrorCode()
   object PaymentPending: BadgeServiceErrorCode()
   object ProviderUnavailable: BadgeServiceErrorCode()
+  object ProviderNotConfigured: BadgeServiceErrorCode()
   object RateLimited: BadgeServiceErrorCode()
   object CodeInvalid: BadgeServiceErrorCode()
   object CodeUsed: BadgeServiceErrorCode()
@@ -7373,6 +7443,7 @@ sealed class BadgeServiceErrorCode {
       is PaymentNotEntitled -> "payment_not_entitled"
       is PaymentPending -> "payment_pending"
       is ProviderUnavailable -> "provider_unavailable"
+      is ProviderNotConfigured -> "provider_not_configured"
       is RateLimited -> "rate_limited"
       is CodeInvalid -> "code_invalid"
       is CodeUsed -> "code_used"
@@ -7392,6 +7463,12 @@ fun badgeServiceErrorText(code: BadgeServiceErrorCode): String? = when (code) {
   is BadgeServiceErrorCode.UnsupportedVersion -> generalGetString(MR.strings.badges_error_unsupported_version)
   is BadgeServiceErrorCode.UnknownPurchaseKey -> generalGetString(MR.strings.badges_error_unknown_purchase)
   is BadgeServiceErrorCode.Internal -> generalGetString(MR.strings.badges_error_service_internal)
+  is BadgeServiceErrorCode.ReceiptInvalid -> generalGetString(MR.strings.badges_error_receipt_invalid)
+  is BadgeServiceErrorCode.ReceiptUsed -> generalGetString(MR.strings.badges_error_receipt_used)
+  is BadgeServiceErrorCode.PaymentPending -> generalGetString(MR.strings.badges_error_payment_pending)
+  is BadgeServiceErrorCode.ProviderUnavailable -> generalGetString(MR.strings.badges_error_provider_unavailable)
+  is BadgeServiceErrorCode.ProviderNotConfigured -> generalGetString(MR.strings.badges_error_provider_not_configured)
+  is BadgeServiceErrorCode.ProductUnavailable -> generalGetString(MR.strings.badges_error_product_unavailable)
   else -> null
 }
 
@@ -7409,6 +7486,7 @@ object BadgeServiceErrorCodeSerializer : KSerializer<BadgeServiceErrorCode> {
       "payment_not_entitled" -> BadgeServiceErrorCode.PaymentNotEntitled
       "payment_pending" -> BadgeServiceErrorCode.PaymentPending
       "provider_unavailable" -> BadgeServiceErrorCode.ProviderUnavailable
+      "provider_not_configured" -> BadgeServiceErrorCode.ProviderNotConfigured
       "rate_limited" -> BadgeServiceErrorCode.RateLimited
       "code_invalid" -> BadgeServiceErrorCode.CodeInvalid
       "code_used" -> BadgeServiceErrorCode.CodeUsed
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/platform/Platform.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/platform/Platform.kt
index 7d126096e8..f4e902b967 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/platform/Platform.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/platform/Platform.kt
@@ -13,6 +13,7 @@ import chat.simplex.common.views.badges.BadgeProduct
 import chat.simplex.common.views.badges.BadgePurchaseOutcome
 import chat.simplex.common.views.badges.BadgeStoreError
 import chat.simplex.common.views.badges.BadgeStoreProductId
+import chat.simplex.common.views.badges.BadgeStoreReceipt
 import kotlinx.coroutines.Job
 import java.io.Closeable
 
@@ -44,6 +45,9 @@ interface PlatformInterface {
     return emptyList()
   }
   suspend fun androidPurchaseBadge(id: BadgeStoreProductId, invoiceId: String): BadgePurchaseOutcome = throw BadgeStoreError.StoreUnavailable
+  suspend fun androidAcknowledgeBadgePurchase(receipt: BadgeStoreReceipt) {}
+  suspend fun androidFinishBadgePurchase(receipt: BadgeStoreReceipt) {}
+  suspend fun androidUnfinishedBadgePurchases(): List<BadgePurchaseOutcome> = emptyList()
   val androidApiLevel: Int? get() = null
   // The build distributed via Google Play, which has to follow its policies
   val androidIsPlayStoreBuild: Boolean get() = false
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgeStore.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgeStore.kt
index 2c7dfd05f6..ae6ecd3876 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgeStore.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgeStore.kt
@@ -1,7 +1,16 @@
 package chat.simplex.common.views.badges
 
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.mutableStateOf
+import chat.simplex.common.model.*
+import chat.simplex.common.model.ChatController.appPrefs
 import chat.simplex.common.platform.*
+import kotlinx.coroutines.CancellationException
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.NonCancellable
+import kotlinx.coroutines.flow.MutableSharedFlow
+import kotlinx.coroutines.withContext
 import java.text.NumberFormat
 import java.util.Currency
 import java.util.UUID
@@ -29,15 +38,33 @@ val badgeStoreProductIds: List<BadgeStoreProductId> = BadgeLevel.entries.flatMap
   BadgePeriod.entries.map { badgeStoreProductId(level, it) }
 }
 
-// TODO [badges] replaced by APIGetBadgeInvoice, which creates the invoice row and returns its id.
-// Sent to Play as obfuscatedAccountId and echoed back on the purchase, which is how the service
-// learns which invoice a store transaction settles.
+// the only products sent to the badge service: nothing delivers a subscription yet
+val badgeOneTimeProductIds: Set<String> = badgeStoreProductIds.filter { it.basePlanId == null }.map { it.productId }.toSet()
+
+// subscriptions are for sale once renewals are delivered
+val badgePeriodsForSale: List<BadgePeriod> = listOf(BadgePeriod.OneMonth)
+
+// A subscription's id only: core mints a one-time purchase's, and a subscription is never sent to core.
+// Sent to Play as obfuscatedAccountId and echoed back on the purchase.
 fun newBadgeInvoiceId(): String = UUID.randomUUID().toString()
 
 // the page's app flag rides in the fragment, which never reaches the service
+// TEST ONLY: pointed at the dev deployment; restore the two lines below before merging
 val badgePageUrl: String =
-  if (appPlatform.isAndroid) "https://badges.simplex.chat/#/tier?app=true"
-  else "https://badges.simplex.chat/#/tier?app=desktop"
+  if (appPlatform.isAndroid) "https://smp7.simplex.im/#/tier?app=true"
+  else "https://smp7.simplex.im/#/tier?app=desktop"
+// if (appPlatform.isAndroid) "https://badges.simplex.chat/#/tier?app=true"
+// else "https://badges.simplex.chat/#/tier?app=desktop"
+
+// where the store allows a link out to the badge page: the US for now, a set expected to widen.
+// An unknown country does not count, as this decides whether the store sees a link out of the app.
+@Composable
+fun badgeBrowserAllowed(): Boolean {
+  if (androidPlayStoreCountry.value == null) {
+    LaunchedEffect(Unit) { platform.androidLoadPlayStoreCountry() }
+  }
+  return androidPlayStoreCountry.value == "US"
+}
 
 // what the platform store knows about one product; ProductDetails cannot cross into commonMain
 data class BadgeProduct(
@@ -63,10 +90,8 @@ data class BadgeStoreReceipt(
   // the token the badge service verifies with the Publisher API
   val token: String,
   val productId: String,
-  val orderId: String?,
   val invoiceId: String?,
-  // only set for test products - a real Play purchase has no environment to report
-  val environment: String? = null
+  val acknowledged: Boolean = false
 )
 
 // TODO [badges] Play Billing has no offline product configuration. Set to true to price the screens
@@ -74,6 +99,9 @@ data class BadgeStoreReceipt(
 // receipt says so.
 const val useBadgeTestProducts = false
 
+// test products stand in for a store, so the lane is offered without one
+val badgeStoreAvailable: Boolean get() = useBadgeTestProducts || platform.androidHasPlatformStore
+
 private fun testProduct(level: BadgeLevel, period: BadgePeriod, priceMicros: Long) =
   BadgeProduct(badgeStoreProductId(level, period), "\$${priceMicros / 1_000_000}.00", priceMicros, "USD")
 
@@ -88,20 +116,29 @@ private val testBadgeProducts: List<BadgeProduct> = listOf(
 
 sealed class BadgePurchaseOutcome {
   class Purchased(val receipt: BadgeStoreReceipt): BadgePurchaseOutcome()
-  object Pending: BadgePurchaseOutcome()
+  class Pending(val invoiceId: String?): BadgePurchaseOutcome()
   object Cancelled: BadgePurchaseOutcome()
 }
 
+enum class BadgePurchaseState {
+  Issuing,
+  WaitingForApproval
+}
+
 sealed class BadgeStoreError: Exception() {
   class ProductUnavailable(val productId: String): BadgeStoreError()
   class BillingError(val responseCode: Int, val debugMessage: String): BadgeStoreError()
   object StoreUnavailable: BadgeStoreError()
+  object NoActiveProfile: BadgeStoreError()
+  class ApiError(val err: ChatError): BadgeStoreError()
 
   override val message: String
     get() = when (this) {
       is ProductUnavailable -> "productUnavailable(productId: $productId)"
       is BillingError -> "billingError(responseCode: $responseCode, $debugMessage)"
       is StoreUnavailable -> "storeUnavailable"
+      is NoActiveProfile -> "noActiveProfile"
+      is ApiError -> "apiError(${err.string})"
     }
 }
 
@@ -111,12 +148,49 @@ object BadgeStore {
   private val state = mutableStateOf(LoadState.NotLoaded)
   // snapshot state so a composable reading only the products still recomposes when they arrive
   private val products = mutableStateOf<Map<BadgeStoreProductId, BadgeProduct>>(emptyMap())
+  // core's open store purchases for the profile they were read for: core knows whose a purchase is
+  private val storePurchases = mutableStateOf<Triple<Long?, Long, List<OpenStorePurchase>>?>(null)
+  // whether a store sheet this run opened has not returned
+  private val buying = mutableStateOf(false)
+  // by invoice id, so a pending purchase shows only under the profile whose record it names
+  private val waitingForApproval = mutableStateOf<Set<String>>(emptySet())
+  // set once presentUnfinished has read the store, or failed to: until then, a slow payment completed while
+  // the app was closed, or a purchase it died before handing over, are both unknown, so canBuy refuses
+  private val reconciledOnce = mutableStateOf(false)
+  val refusals = MutableSharedFlow<ChatError>()
 
-  fun price(level: BadgeLevel, period: BadgePeriod): BadgePrice = when (state.value) {
+  fun purchaseState(userId: Long?): BadgePurchaseState? {
+    if (!badgeStoreAvailable) return null
+    val purchases = openStorePurchases(userId)
+    return when {
+      purchases.any { it.transactionRef != null } -> BadgePurchaseState.Issuing
+      purchases.any { it.invoiceId?.let(waitingForApproval.value::contains) == true } -> BadgePurchaseState.WaitingForApproval
+      else -> null
+    }
+  }
+
+  fun creditError(userId: Long?): BadgeIssueFailure? =
+    openStorePurchases(userId).firstNotNullOfOrNull { it.creditError }
+
+  val checkingPurchases: Boolean get() = badgeStoreAvailable && !reconciledOnce.value
+
+  fun canBuy(userId: Long?): Boolean =
+    badgeStoreAvailable && reconciledOnce.value && !buying.value && purchaseState(userId) == null
+
+  fun setStorePurchases(rhId: Long?, userId: Long, purchases: List<OpenStorePurchase>) {
+    storePurchases.value = Triple(rhId, userId, purchases)
+  }
+
+  private fun openStorePurchases(userId: Long?): List<OpenStorePurchase> {
+    val (rhId, readFor, purchases) = storePurchases.value ?: return emptyList()
+    return if (rhId == chatModel.remoteHostId() && readFor == userId) purchases else emptyList()
+  }
+
+  fun price(level: BadgeLevel, period: BadgePeriod, compact: Boolean = true): BadgePrice = when (state.value) {
     LoadState.NotLoaded, LoadState.Loading -> BadgePrice.Loading
     LoadState.Loaded, LoadState.Failed -> {
       val p = products.value[badgeStoreProductId(level, period)]
-      if (p != null) BadgePrice.Price(compactPrice(p)) else BadgePrice.Unavailable
+      if (p != null) BadgePrice.Price(if (compact) compactPrice(p) else p.displayPrice) else BadgePrice.Unavailable
     }
   }
 
@@ -151,21 +225,146 @@ object BadgeStore {
     }
   }
 
-  suspend fun purchase(level: BadgeLevel, period: BadgePeriod, invoiceId: String): BadgePurchaseOutcome {
+  // A one-time purchase has its core record before the store charges, and every store outcome reaches it.
+  suspend fun purchase(level: BadgeLevel, period: BadgePeriod): BadgePurchaseOutcome {
     val id = badgeStoreProductId(level, period)
     if (!products.value.containsKey(id)) throw BadgeStoreError.ProductUnavailable(id.productId)
-    if (useBadgeTestProducts) {
-      return BadgePurchaseOutcome.Purchased(
+    // a subscription is never sent to core, so nothing would ever finish it later
+    if (id.productId !in badgeOneTimeProductIds) {
+      val outcome = storePurchase(id, newBadgeInvoiceId())
+      if (outcome is BadgePurchaseOutcome.Purchased) finish(outcome.receipt)
+      return outcome
+    }
+    val rhId = chatModel.remoteHostId()
+    val userId = chatModel.currentUser.value?.userId ?: throw BadgeStoreError.NoActiveProfile
+    val invoiceId = chatModel.controller.apiCreateBadgeInvoice(rhId, userId)
+    withContext(Dispatchers.Main) { buying.value = true }
+    chatModel.controller.loadBadgeState(rhId)
+    try {
+      val outcome = storePurchase(id, invoiceId)
+      if (outcome is BadgePurchaseOutcome.Purchased) {
+        handOver(outcome.receipt)
+      }
+      return outcome
+    } finally {
+      withContext(Dispatchers.Main + NonCancellable) { buying.value = false }
+    }
+  }
+
+  private suspend fun storePurchase(id: BadgeStoreProductId, invoiceId: String): BadgePurchaseOutcome {
+    val outcome = if (useBadgeTestProducts) {
+      BadgePurchaseOutcome.Purchased(
         BadgeStoreReceipt(
           token = "test-${UUID.randomUUID()}",
           productId = id.productId,
-          orderId = null,
-          invoiceId = invoiceId,
-          environment = "test products"
+          invoiceId = invoiceId
         )
       )
+    } else {
+      platform.androidPurchaseBadge(id, invoiceId)
+    }
+    if (outcome is BadgePurchaseOutcome.Pending && outcome.invoiceId != null) withContext(Dispatchers.Main) { waitingForApproval.value += outcome.invoiceId }
+    return outcome
+  }
+
+  // Core holds the receipt and credits it; the purchase stays unfinished until core answers it credited
+  // or refused, as an unfinished purchase is what the store re-delivers if anything is lost on the way.
+  private suspend fun handOver(receipt: BadgeStoreReceipt) {
+    val rhId = chatModel.remoteHostId()
+    val userId = chatModel.currentUser.value?.userId ?: return
+    when (val r = chatModel.controller.apiPurchaseBadge(rhId, userId, receipt.invoiceId, ServicePayment.Google(receipt.productId, receipt.token))) {
+      is BadgePurchaseResult.Held -> {
+        // core holds it durably now, so Play must not refund it after three days unacknowledged
+        acknowledge(receipt)
+        withContext(Dispatchers.Main) {
+          // the answer is the owner's, which may be another profile and a hidden one
+          if (chatModel.controller.activeUser(rhId, r.user)) {
+            BadgeModel.set(rhId, r.user.userId, r.badgeState)
+            setStorePurchases(rhId, r.user.userId, r.storePurchases)
+          }
+        }
+      }
+      is BadgePurchaseResult.Credited -> {
+        withContext(Dispatchers.Main) {
+          if (chatModel.controller.activeUser(rhId, r.user)) {
+            BadgeModel.set(rhId, r.user.userId, r.badgeState)
+            chatModel.updateUser(r.user)
+            if (r.badgeState?.shown == true) appPrefs.supporterBannerShown.set(true)
+          }
+        }
+        resolve(receipt, refusal = null)
+      }
+      // a refusal is announced where it reads as its own, so only an unexpected answer reaches the buyer
+      is BadgePurchaseResult.Failed ->
+        if (badgeReceiptRefused(r.err)) {
+          Log.e(TAG, "BadgeStore.handOver: ${r.err?.string}")
+          resolve(receipt, refusal = r.err)
+        } else {
+          throw r.err?.let(BadgeStoreError::ApiError) ?: Exception("apiPurchaseBadge: unexpected response")
+        }
+    }
+  }
+
+  private suspend fun resolve(receipt: BadgeStoreReceipt, refusal: ChatError?) {
+    finish(receipt)
+    if (refusal != null) {
+      withContext(Dispatchers.Main) { refusals.emit(refusal) }
+    }
+  }
+
+  // at launch, on return to the foreground, on a profile switch and when core resolves a purchase, never on a timer
+  suspend fun presentUnfinished() {
+    try {
+      if (!useBadgeTestProducts && platform.androidHasPlatformStore) {
+        try {
+          val purchases = platform.androidUnfinishedBadgePurchases()
+          // Play lists a purchase awaiting payment, so unlike on iOS the waiting state is re-found here
+          withContext(Dispatchers.Main) { waitingForApproval.value = purchases.mapNotNull { (it as? BadgePurchaseOutcome.Pending)?.invoiceId }.toSet() }
+          purchases.forEach { reconcile(it) }
+        } catch (e: Exception) {
+          if (e is CancellationException) throw e
+          Log.e(TAG, "BadgeStore.presentUnfinished: ${e.message}")
+        }
+      }
+      chatModel.controller.loadBadgeState(chatModel.remoteHostId())
+    } finally {
+      withContext(Dispatchers.Main + NonCancellable) { reconciledOnce.value = true }
+    }
+  }
+
+  suspend fun reconcile(outcome: BadgePurchaseOutcome) {
+    when (outcome) {
+      is BadgePurchaseOutcome.Purchased ->
+        if (outcome.receipt.productId !in badgeOneTimeProductIds) finish(outcome.receipt)
+        // no buyer to tell: the purchase stays unfinished and the next sweep hands it over again
+        else try {
+          handOver(outcome.receipt)
+        } catch (e: Exception) {
+          if (e is CancellationException) throw e
+          Log.e(TAG, "BadgeStore.reconcile: ${e.stackTraceToString()}")
+        }
+      is BadgePurchaseOutcome.Pending ->
+        if (outcome.invoiceId != null) withContext(Dispatchers.Main) { waitingForApproval.value += outcome.invoiceId }
+      is BadgePurchaseOutcome.Cancelled -> {}
+    }
+  }
+
+  private suspend fun acknowledge(receipt: BadgeStoreReceipt) {
+    try {
+      if (!useBadgeTestProducts) platform.androidAcknowledgeBadgePurchase(receipt)
+    } catch (e: Exception) {
+      // the next sweep hands the purchase over again, and acknowledges it then
+      Log.e(TAG, "BadgeStore.acknowledge: ${e.message}")
+    }
+  }
+
+  private suspend fun finish(receipt: BadgeStoreReceipt) {
+    try {
+      if (!useBadgeTestProducts) platform.androidFinishBadgePurchase(receipt)
+    } catch (e: Exception) {
+      // still unfinished: the store re-delivers it, and the next answer for it finishes it
+      Log.e(TAG, "BadgeStore.finish: ${e.message}")
     }
-    return platform.androidPurchaseBadge(id, invoiceId)
   }
 
   private fun startLoading(): Boolean = when (state.value) {
@@ -190,3 +389,10 @@ private fun compactPrice(product: BadgeProduct): String {
     product.displayPrice
   }
 }
+
+// the codes core refuses a receipt with for good, after which the store may stop re-delivering it
+private fun badgeReceiptRefused(err: ChatError?): Boolean {
+  val redeemError = ((err as? ChatError.ChatErrorChat)?.errorType as? ChatErrorType.CEBadgeRedeemError)?.badgeRedeemError
+  val code = (redeemError as? BadgeRedeemError.ServiceError)?.serviceError
+  return code is BadgeServiceErrorCode.ReceiptInvalid || code is BadgeServiceErrorCode.ReceiptUsed
+}
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgeUserPreview.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgeUserPreview.kt
index 03fabf817e..53c9f98f60 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgeUserPreview.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgeUserPreview.kt
@@ -19,7 +19,7 @@ import chat.simplex.res.MR
 import kotlinx.datetime.Instant
 
 @Composable
-fun BadgeUserPreview(level: BadgeLevel, modifier: Modifier = Modifier, trailing: @Composable () -> Unit = {}) {
+fun BadgeUserPreview(level: BadgeLevel, modifier: Modifier = Modifier) {
   val user = chatModel.currentUser.value
   val displayName = user?.displayName ?: stringResource(MR.strings.badges_preview_my_nickname)
   val previewBadge = LocalBadge(
@@ -29,15 +29,12 @@ fun BadgeUserPreview(level: BadgeLevel, modifier: Modifier = Modifier, trailing:
   )
   Column(modifier, horizontalAlignment = Alignment.CenterHorizontally, verticalArrangement = Arrangement.spacedBy(12.dp)) {
     ProfileImage(size = 128.dp, image = user?.image)
-    Row(verticalAlignment = Alignment.CenterVertically, horizontalArrangement = Arrangement.spacedBy(6.dp)) {
-      NameWithBadge(
-        name = displayName,
-        badge = previewBadge,
-        style = MaterialTheme.typography.h1.copy(fontWeight = FontWeight.Normal),
-        maxLines = 1,
-        overflow = TextOverflow.Ellipsis
-      )
-      trailing()
-    }
+    NameWithBadge(
+      name = displayName,
+      badge = previewBadge,
+      style = MaterialTheme.typography.h1.copy(fontWeight = FontWeight.Normal),
+      maxLines = 1,
+      overflow = TextOverflow.Ellipsis
+    )
   }
 }
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgesCheckOrderView.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgesCheckOrderView.kt
new file mode 100644
index 0000000000..90f459a520
--- /dev/null
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgesCheckOrderView.kt
@@ -0,0 +1,107 @@
+package chat.simplex.common.views.badges
+
+import androidx.compose.foundation.background
+import androidx.compose.foundation.layout.*
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.material.*
+import androidx.compose.runtime.*
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
+import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.text.style.TextAlign
+import androidx.compose.ui.unit.dp
+import dev.icerock.moko.resources.StringResource
+import dev.icerock.moko.resources.compose.stringResource
+import chat.simplex.common.platform.*
+import chat.simplex.common.ui.theme.*
+import chat.simplex.common.views.helpers.*
+import chat.simplex.common.views.onboarding.OnboardingActionButton
+import chat.simplex.res.MR
+
+@Composable
+fun BadgesCheckOrderView(level: BadgeLevel, period: BadgePeriod, modalManager: ModalManager, unwindToDepth: Int) {
+  val purchasing = remember { mutableStateOf(false) }
+
+  LaunchedEffect(Unit) { BadgeStore.load() }
+  CloseWhenSupportGivesWay(modalManager, unwindToDepth)
+
+  ColumnWithScrollBar(
+    Modifier.padding(horizontal = 25.dp).padding(top = 8.dp, bottom = 20.dp),
+    verticalArrangement = Arrangement.spacedBy(16.dp),
+    horizontalAlignment = Alignment.CenterHorizontally,
+    maxIntrinsicSize = true,
+  ) {
+    Text(
+      stringResource(MR.strings.badges_check_your_order_title),
+      style = MaterialTheme.typography.h1,
+      fontWeight = FontWeight.Bold,
+      color = MaterialTheme.colors.primary,
+      textAlign = TextAlign.Center,
+      modifier = Modifier.fillMaxWidth()
+    )
+
+    Column(
+      Modifier
+        .fillMaxWidth()
+        .padding(top = 20.dp)
+        .clip(RoundedCornerShape(16.dp))
+        .background(sectionCardColor())
+        .padding(horizontal = 24.dp, vertical = 12.dp)
+    ) {
+      OrderRow(MR.strings.badges_your_badge, stringResource(level.title))
+      OrderRow(MR.strings.badges_order_duration, stringResource(period.label))
+      Divider(Modifier.padding(top = 8.dp, bottom = 6.dp))
+      OrderRow(MR.strings.badges_order_total, period.priceText(BadgeStore.price(level, period, compact = false)))
+    }
+
+    Spacer(Modifier.weight(1f).heightIn(min = 20.dp))
+
+    Column(horizontalAlignment = Alignment.CenterHorizontally) {
+      PayButton(level, period, purchasing)
+      BadgeBillingFooter(period)
+    }
+  }
+}
+
+@Composable
+private fun OrderRow(title: StringResource, value: String) {
+  Row(Modifier.fillMaxWidth().padding(vertical = 8.dp)) {
+    Text(stringResource(title), style = MaterialTheme.typography.body1, color = MaterialTheme.colors.secondary)
+    Spacer(Modifier.weight(1f))
+    Text(value, style = MaterialTheme.typography.body1, fontWeight = FontWeight.Medium)
+  }
+}
+
+@Composable
+private fun PayButton(level: BadgeLevel, period: BadgePeriod, purchasing: MutableState<Boolean>) {
+  val price = BadgeStore.price(level, period, compact = false)
+  val (labelId, labelArg) = period.payLabel(price)
+  OnboardingActionButton(
+    modifier = if (appPlatform.isAndroid) Modifier.padding(horizontal = DEFAULT_ONBOARDING_HORIZONTAL_PADDING).fillMaxWidth() else Modifier.widthIn(min = 300.dp),
+    labelId = labelId,
+    labelArg = labelArg,
+    onboarding = null,
+    enabled = price.canPurchase && !purchasing.value && BadgeStore.canBuy(chatModel.currentUser.value?.userId),
+    onclick = { purchase(level, period, purchasing) }
+  )
+}
+
+private fun purchase(level: BadgeLevel, period: BadgePeriod, purchasing: MutableState<Boolean>) {
+  purchasing.value = true
+  // not withBGApi: the purchase waits for the user in the Play sheet and would block chat API calls
+  withLongRunningApi {
+    try {
+      BadgeStore.purchase(level, period)
+      purchasing.value = false
+    } catch (e: Exception) {
+      Log.e(TAG, "BadgesCheckOrderView.purchase: ${e.stackTraceToString()}")
+      purchasing.value = false
+      AlertManager.shared.showAlertMsg(
+        title = generalGetString(MR.strings.badges_purchase_error),
+        text = if (e is BadgeStoreError.ApiError) chatModel.controller.redeemErrorText(e.err, purchase = true)
+          else "${generalGetString(MR.strings.error_prefix)}: ${e.message ?: e}"
+      )
+    }
+  }
+}
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgesChooseBadgeView.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgesChooseBadgeView.kt
index b8324cc9c9..0fac45ac81 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgesChooseBadgeView.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgesChooseBadgeView.kt
@@ -34,10 +34,16 @@ enum class BadgeLevel {
       Legend -> MR.strings.badges_level_legend
     }
 
-  val filesDescription: StringResource
+  val fileSize: StringResource
     get() = when (this) {
-      Supporter -> MR.strings.badges_level_supporter_files
-      Legend -> MR.strings.badges_level_legend_files
+      Supporter -> MR.strings.badges_level_supporter_file_size
+      Legend -> MR.strings.badges_level_legend_file_size
+    }
+
+  val fileStorage: StringResource
+    get() = when (this) {
+      Supporter -> MR.strings.badges_level_supporter_file_storage
+      Legend -> MR.strings.badges_level_legend_file_storage
     }
 
   val summary: StringResource
@@ -54,10 +60,11 @@ enum class BadgeLevel {
 }
 
 @Composable
-fun BadgesChooseBadgeView(modalManager: ModalManager) {
+fun BadgesChooseBadgeView(modalManager: ModalManager, unwindToDepth: Int) {
   var selectedLevel by remember { mutableStateOf(BadgeLevel.Supporter) }
 
   LaunchedEffect(Unit) { BadgeStore.load() }
+  CloseWhenSupportGivesWay(modalManager, unwindToDepth)
 
   ColumnWithScrollBar(
     Modifier.background(MaterialTheme.colors.background).padding(horizontal = 25.dp).padding(top = 8.dp, bottom = 20.dp),
@@ -82,15 +89,9 @@ fun BadgesChooseBadgeView(modalManager: ModalManager) {
       modifier = Modifier.fillMaxWidth()
     )
 
-    BadgeUserPreview(level = selectedLevel, modifier = Modifier.padding(top = 4.dp)) {
-      Icon(
-        painterResource(MR.images.ic_keyboard_arrow_down),
-        contentDescription = null,
-        tint = MaterialTheme.colors.primary
-      )
-    }
+    BadgeUserPreview(level = selectedLevel, modifier = Modifier.padding(top = 4.dp))
 
-    Spacer(Modifier.weight(1f).heightIn(min = 20.dp))
+    Spacer(Modifier.weight(1f).heightIn(min = 12.dp))
 
     // IntrinsicSize.Max + fillMaxHeight on children so both cards match the taller card's height
     // when 2-line labels at large fonts would otherwise size them differently.
@@ -102,17 +103,18 @@ fun BadgesChooseBadgeView(modalManager: ModalManager) {
       LevelCard(BadgeLevel.Legend, selectedLevel, Modifier.weight(1f).fillMaxHeight()) { selectedLevel = it }
     }
 
-    Spacer(Modifier.weight(1f).heightIn(min = 20.dp))
+    Spacer(Modifier.weight(1f).heightIn(min = 12.dp))
 
     // Nested Column with no spacing so the TextButtonBelowOnboardingButton sits directly under
     // the action button (matches onboarding pattern where its own 7.5dp top padding is the gap).
     Column(horizontalAlignment = Alignment.CenterHorizontally) {
-      ContinueButton(selectedLevel, modalManager)
-      TextButtonBelowOnboardingButton(
-        text = stringResource(MR.strings.badges_how_it_works_button),
-        icon = painterResource(MR.images.ic_info),
-        onClick = { modalManager.showModal { BadgesHowItWorksView() } }
-      )
+      ContinueButton(selectedLevel, modalManager, unwindToDepth)
+      // redeeming a code is here only when Support SimpleX offers the browser instead
+      if (badgeBrowserAllowed()) {
+        RedeemCodeButton(modalManager, unwindToDepth)
+      } else {
+        TextButtonBelowOnboardingButton("", null)
+      }
     }
   }
 }
@@ -131,7 +133,7 @@ private fun LevelCard(level: BadgeLevel, selectedLevel: BadgeLevel, modifier: Mo
       .background(cardBackground, shape)
       .border(2.dp, borderColor, shape)
       .clickable { onSelect(level) }
-      .padding(vertical = 20.dp, horizontal = 12.dp),
+      .padding(vertical = 16.dp, horizontal = 12.dp),
     horizontalAlignment = Alignment.CenterHorizontally,
     verticalArrangement = Arrangement.spacedBy(10.dp)
   ) {
@@ -139,22 +141,25 @@ private fun LevelCard(level: BadgeLevel, selectedLevel: BadgeLevel, modifier: Mo
       painterResource(badgeImage(level.badgeType)),
       contentDescription = null,
       contentScale = ContentScale.Fit,
-      modifier = Modifier.size(60.dp)
+      modifier = Modifier.size(44.dp)
     )
     Text(stringResource(level.title), style = MaterialTheme.typography.h3, fontWeight = FontWeight.Bold, textAlign = TextAlign.Center)
-    Text(stringResource(level.filesDescription), style = MaterialTheme.typography.body2, color = MaterialTheme.colors.secondary, textAlign = TextAlign.Center)
     Text(BadgePeriod.Monthly.priceText(BadgeStore.price(level, BadgePeriod.Monthly)), style = MaterialTheme.typography.body1, textAlign = TextAlign.Center)
+    Column(horizontalAlignment = Alignment.CenterHorizontally, verticalArrangement = Arrangement.spacedBy(2.dp)) {
+      Text(stringResource(level.fileSize), style = MaterialTheme.typography.body2, color = MaterialTheme.colors.secondary, textAlign = TextAlign.Center)
+      Text(stringResource(level.fileStorage), style = MaterialTheme.typography.body2, color = MaterialTheme.colors.secondary, textAlign = TextAlign.Center)
+    }
   }
 }
 
 @Composable
-private fun ContinueButton(selectedLevel: BadgeLevel, modalManager: ModalManager) {
+private fun ContinueButton(selectedLevel: BadgeLevel, modalManager: ModalManager, unwindToDepth: Int) {
   OnboardingActionButton(
     modifier = if (appPlatform.isAndroid) Modifier.padding(horizontal = DEFAULT_ONBOARDING_HORIZONTAL_PADDING).fillMaxWidth() else Modifier.widthIn(min = 300.dp),
     labelId = MR.strings.badges_continue,
     onboarding = null,
     onclick = {
-      modalManager.showModal { BadgesHowLongView(selectedLevel) }
+      modalManager.showModal { BadgesHowLongView(selectedLevel, modalManager, unwindToDepth) }
     }
   )
 }
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgesHowLongView.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgesHowLongView.kt
index 2845e3986a..0dfc3ac742 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgesHowLongView.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgesHowLongView.kt
@@ -9,10 +9,9 @@ import androidx.compose.material.*
 import androidx.compose.runtime.*
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.alpha
 import androidx.compose.ui.draw.clip
-import androidx.compose.ui.platform.ClipboardManager
-import androidx.compose.ui.platform.LocalClipboardManager
-import androidx.compose.ui.text.AnnotatedString
+import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.text.font.FontWeight
 import androidx.compose.ui.text.style.TextAlign
 import androidx.compose.ui.unit.dp
@@ -45,6 +44,13 @@ enum class BadgePeriod {
       Annual -> MR.strings.badges_period_annual
     }
 
+  val months: Int
+    get() = when (this) {
+      OneMonth -> 1
+      Monthly -> 1
+      Annual -> 12
+    }
+
   @Composable
   fun priceText(price: BadgePrice): String = when (price) {
     is BadgePrice.Loading -> "…"
@@ -68,12 +74,11 @@ enum class BadgePeriod {
 }
 
 @Composable
-fun BadgesHowLongView(level: BadgeLevel) {
-  var selectedPeriod by remember { mutableStateOf(BadgePeriod.Monthly) }
-  val purchasing = remember { mutableStateOf(false) }
-  val clipboard = LocalClipboardManager.current
+fun BadgesHowLongView(level: BadgeLevel, modalManager: ModalManager, unwindToDepth: Int) {
+  var selectedPeriod by remember { mutableStateOf(if (BadgePeriod.Monthly in badgePeriodsForSale) BadgePeriod.Monthly else BadgePeriod.OneMonth) }
 
   LaunchedEffect(Unit) { BadgeStore.load() }
+  CloseWhenSupportGivesWay(modalManager, unwindToDepth)
 
   ColumnWithScrollBar(
     Modifier.background(MaterialTheme.colors.background).padding(horizontal = 25.dp).padding(top = 8.dp, bottom = 20.dp),
@@ -102,39 +107,46 @@ fun BadgesHowLongView(level: BadgeLevel) {
 
     Spacer(Modifier.weight(1f).heightIn(min = 8.dp))
 
-    // IntrinsicSize.Max + fillMaxHeight on children so all three cards match the tallest one -
+    // IntrinsicSize.Max + fillMaxHeight on children so the cards all match the tallest one -
     // only Annual carries a savings line, and prices wrap at large fonts.
     Row(
       Modifier.fillMaxWidth().height(IntrinsicSize.Max),
       horizontalArrangement = Arrangement.spacedBy(12.dp)
     ) {
-      PeriodCard(level, BadgePeriod.OneMonth, selectedPeriod, Modifier.weight(1f).fillMaxHeight()) { selectedPeriod = it }
-      PeriodCard(level, BadgePeriod.Monthly, selectedPeriod, Modifier.weight(1f).fillMaxHeight()) { selectedPeriod = it }
-      PeriodCard(level, BadgePeriod.Annual, selectedPeriod, Modifier.weight(1f).fillMaxHeight()) { selectedPeriod = it }
+      BadgePeriod.entries.forEach { period ->
+        PeriodCard(level, period, selectedPeriod, Modifier.weight(1f).fillMaxHeight()) { selectedPeriod = it }
+      }
     }
 
     Spacer(Modifier.weight(1f).heightIn(min = 8.dp))
 
-    // Replicates TextButtonBelowOnboardingButton spacing (7.5dp outer + 5dp inner) without a
-    // TextButton so the footer has no hover/click affordance.
     Column(horizontalAlignment = Alignment.CenterHorizontally) {
-      PayButton(level, selectedPeriod, purchasing, clipboard)
-      Box(Modifier.padding(top = 7.5.dp, bottom = 7.5.dp).padding(horizontal = 16.dp, vertical = 8.dp)) {
-        Text(
-          stringResource(billingFooter(selectedPeriod)).format(stubBillingDate()),
-          Modifier.padding(vertical = 5.dp),
-          style = MaterialTheme.typography.body2,
-          color = MaterialTheme.colors.secondary,
-          textAlign = TextAlign.Center
-        )
-      }
+      ContinueButton(level, selectedPeriod, modalManager, unwindToDepth)
+      BadgeBillingFooter(selectedPeriod)
     }
   }
 }
 
+// Replicates TextButtonBelowOnboardingButton spacing (7.5dp outer + 5dp inner) without a
+// TextButton so the footer has no hover/click affordance.
+@Composable
+fun BadgeBillingFooter(period: BadgePeriod) {
+  Box(Modifier.padding(top = 7.5.dp, bottom = 7.5.dp).padding(horizontal = 16.dp, vertical = 8.dp)) {
+    Text(
+      stringResource(billingFooter(period)).format(billingDate(period)),
+      Modifier.padding(vertical = 5.dp),
+      style = MaterialTheme.typography.body2,
+      color = MaterialTheme.colors.secondary,
+      textAlign = TextAlign.Center
+    )
+  }
+}
+
 @Composable
 private fun PeriodCard(level: BadgeLevel, period: BadgePeriod, selectedPeriod: BadgePeriod, modifier: Modifier, onSelect: (BadgePeriod) -> Unit) {
   val isSelected = period == selectedPeriod
+  val forSale = period in badgePeriodsForSale
+  val textColor = if (forSale) Color.Unspecified else MaterialTheme.colors.secondary
   val borderColor = if (isSelected) MaterialTheme.colors.primary else MaterialTheme.colors.background.mixWith(MaterialTheme.colors.onBackground, 0.92f)
   // Light: transparent so card matches page background. Dark: subtle gray tint for visible contrast.
   val cardBackground = if (isInDarkTheme()) MaterialTheme.colors.background.mixWith(MaterialTheme.colors.onBackground, 0.97f)
@@ -145,7 +157,7 @@ private fun PeriodCard(level: BadgeLevel, period: BadgePeriod, selectedPeriod: B
       .clip(shape)
       .background(cardBackground, shape)
       .border(2.dp, borderColor, shape)
-      .clickable { onSelect(period) }
+      .clickable(enabled = forSale) { onSelect(period) }
       .padding(vertical = 20.dp, horizontal = 12.dp),
     horizontalAlignment = Alignment.CenterHorizontally,
     verticalArrangement = Arrangement.spacedBy(12.dp)
@@ -154,10 +166,10 @@ private fun PeriodCard(level: BadgeLevel, period: BadgePeriod, selectedPeriod: B
       painterResource(period.icon),
       contentDescription = null,
       tint = if (isSelected) MaterialTheme.colors.primary else MaterialTheme.colors.secondary,
-      modifier = Modifier.size(32.dp)
+      modifier = Modifier.size(32.dp).alpha(if (forSale) 1f else 0.4f)
     )
-    Text(stringResource(period.label), style = MaterialTheme.typography.h3, fontWeight = FontWeight.Bold, textAlign = TextAlign.Center)
-    Text(period.priceText(BadgeStore.price(level, period)), style = MaterialTheme.typography.body1, textAlign = TextAlign.Center)
+    Text(stringResource(period.label), style = MaterialTheme.typography.body2, color = textColor, textAlign = TextAlign.Center)
+    Text(period.priceText(BadgeStore.price(level, period)), style = MaterialTheme.typography.body1, fontWeight = FontWeight.SemiBold, color = textColor, textAlign = TextAlign.Center)
     val percent = savingsPercent(level, period)
     if (percent != null) {
       Text(
@@ -173,76 +185,15 @@ private fun PeriodCard(level: BadgeLevel, period: BadgePeriod, selectedPeriod: B
 private fun savingsPercent(level: BadgeLevel, period: BadgePeriod): Int? =
   if (period == BadgePeriod.Annual) BadgeStore.annualSavings(level) else null
 
-// TODO [badges] on desktop and the foss build there is no store, so every price is Unavailable and
-// this button stays disabled - it will offer Stripe/crypto payment instead
 @Composable
-private fun PayButton(level: BadgeLevel, selectedPeriod: BadgePeriod, purchasing: MutableState<Boolean>, clipboard: ClipboardManager) {
-  val price = BadgeStore.price(level, selectedPeriod)
-  val (labelId, labelArg) = selectedPeriod.payLabel(price)
+private fun ContinueButton(level: BadgeLevel, selectedPeriod: BadgePeriod, modalManager: ModalManager, unwindToDepth: Int) {
   OnboardingActionButton(
     modifier = if (appPlatform.isAndroid) Modifier.padding(horizontal = DEFAULT_ONBOARDING_HORIZONTAL_PADDING).fillMaxWidth() else Modifier.widthIn(min = 300.dp),
-    labelId = labelId,
-    labelArg = labelArg,
+    labelId = MR.strings.badges_continue,
     onboarding = null,
-    enabled = price.canPurchase && !purchasing.value,
-    onclick = { purchase(level, selectedPeriod, purchasing, clipboard) }
-  )
-}
-
-private fun purchase(level: BadgeLevel, period: BadgePeriod, purchasing: MutableState<Boolean>, clipboard: ClipboardManager) {
-  val invoiceId = newBadgeInvoiceId()
-  purchasing.value = true
-  // not withBGApi: the purchase waits for the user in the Play sheet and would block chat API calls
-  withLongRunningApi {
-    try {
-      val outcome = BadgeStore.purchase(level, period, invoiceId)
-      purchasing.value = false
-      when (outcome) {
-        is BadgePurchaseOutcome.Purchased -> showPurchasedAlert(outcome.receipt, invoiceId, clipboard)
-        is BadgePurchaseOutcome.Pending -> AlertManager.shared.showAlertMsg(
-          title = generalGetString(MR.strings.badges_purchase_pending),
-          text = generalGetString(MR.strings.badges_purchase_pending_desc)
-        )
-        is BadgePurchaseOutcome.Cancelled -> {}
-      }
-    } catch (e: Exception) {
-      Log.e(TAG, "BadgesHowLongView.purchase: ${e.stackTraceToString()}")
-      purchasing.value = false
-      AlertManager.shared.showAlertMsg(
-        title = generalGetString(MR.strings.badges_purchase_error),
-        text = e.toString()
-      )
+    onclick = {
+      modalManager.showModal(cardScreen = true) { BadgesCheckOrderView(level, selectedPeriod, modalManager, unwindToDepth) }
     }
-  }
-}
-
-// TODO [badges] store integration diagnostics - replaced by the issued badge once the service lands.
-private fun showPurchasedAlert(receipt: BadgeStoreReceipt, invoiceId: String, clipboard: ClipboardManager) {
-  val returnedInvoice = when (receipt.invoiceId) {
-    null -> "none"
-    invoiceId -> "yes"
-    else -> "mismatch: ${receipt.invoiceId}"
-  }
-  val lines = mutableListOf(
-    "Product: ${receipt.productId}",
-    "Invoice: $invoiceId",
-    "Invoice returned by Google: $returnedInvoice",
-    "Order: ${receipt.orderId ?: "none"}"
-  )
-  if (receipt.environment != null) lines.add("Environment: ${receipt.environment}")
-  lines.add("Token: ${receipt.token.length} bytes")
-  val summary = lines.joinToString("\n")
-  Log.d(TAG, "badge purchase succeeded\n$summary")
-  AlertManager.shared.showAlertDialog(
-    title = generalGetString(MR.strings.badges_purchase_successful),
-    text = summary,
-    confirmText = "Copy token",
-    onConfirm = {
-      clipboard.setText(AnnotatedString(receipt.token))
-      showToast(generalGetString(MR.strings.copied))
-    },
-    dismissText = generalGetString(MR.strings.ok),
-    parseHtml = false
   )
 }
 
@@ -251,9 +202,10 @@ private fun billingFooter(period: BadgePeriod): StringResource = when (period) {
   BadgePeriod.OneMonth -> MR.strings.badges_billing_footer_one_month
 }
 
-// TODO [badges] source the actual date from the purchase state machine when wired.
-private fun stubBillingDate(): String {
-  val date = java.time.LocalDate.of(2026, 7, 22)
+// TODO [badges] from now only because a purchase is refused while a badge is held (refuseWhileBadgeHeld);
+// a top-up must count from the end of the existing balance
+private fun billingDate(period: BadgePeriod): String {
+  val date = java.time.LocalDate.now().plusMonths(period.months.toLong())
   val formatter = java.time.format.DateTimeFormatter.ofLocalizedDate(java.time.format.FormatStyle.LONG)
   return date.format(formatter)
 }
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgesPurchaseStateView.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgesPurchaseStateView.kt
new file mode 100644
index 0000000000..4c808d60a6
--- /dev/null
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgesPurchaseStateView.kt
@@ -0,0 +1,87 @@
+package chat.simplex.common.views.badges
+
+import androidx.compose.foundation.background
+import androidx.compose.foundation.layout.*
+import androidx.compose.material.*
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.text.style.TextAlign
+import androidx.compose.ui.unit.dp
+import dev.icerock.moko.resources.StringResource
+import dev.icerock.moko.resources.compose.painterResource
+import dev.icerock.moko.resources.compose.stringResource
+import chat.simplex.common.model.BadgeIssueFailure
+import chat.simplex.common.platform.ColumnWithScrollBar
+import chat.simplex.common.views.onboarding.TextButtonBelowOnboardingButton
+import chat.simplex.res.MR
+
+@Composable
+fun BadgesPurchaseStateView(title: StringResource, message: StringResource?, failure: BadgeIssueFailure? = null, onDismiss: () -> Unit) {
+  ColumnWithScrollBar(
+    Modifier.background(MaterialTheme.colors.background).padding(horizontal = 25.dp).padding(top = 8.dp, bottom = 20.dp),
+    verticalArrangement = Arrangement.spacedBy(16.dp),
+    horizontalAlignment = Alignment.CenterHorizontally,
+    maxIntrinsicSize = true,
+  ) {
+    Text(
+      stringResource(title),
+      style = MaterialTheme.typography.h1,
+      fontWeight = FontWeight.Bold,
+      color = MaterialTheme.colors.primary,
+      textAlign = TextAlign.Center,
+      modifier = Modifier.fillMaxWidth()
+    )
+
+    if (message != null) {
+      Text(
+        stringResource(message),
+        style = MaterialTheme.typography.body1,
+        textAlign = TextAlign.Center,
+        modifier = Modifier.fillMaxWidth()
+      )
+    }
+
+    if (failure != null) {
+      Column(horizontalAlignment = Alignment.CenterHorizontally, verticalArrangement = Arrangement.spacedBy(6.dp)) {
+        Icon(painterResource(MR.images.ic_warning), contentDescription = null, tint = Color.Red)
+        Text(
+          failure.purchaseText,
+          style = MaterialTheme.typography.body1,
+          color = MaterialTheme.colors.secondary,
+          textAlign = TextAlign.Center,
+          modifier = Modifier.fillMaxWidth()
+        )
+      }
+    }
+
+    Spacer(Modifier.weight(1f))
+
+    CircularProgressIndicator(
+      Modifier.size(30.dp),
+      color = MaterialTheme.colors.secondary,
+      strokeWidth = 3.dp
+    )
+
+    Spacer(Modifier.weight(1f))
+
+    Column(horizontalAlignment = Alignment.CenterHorizontally) {
+      TextButtonBelowOnboardingButton(stringResource(MR.strings.badges_dismiss), onDismiss)
+      TextButtonBelowOnboardingButton("", null)
+    }
+  }
+}
+
+val BadgePurchaseState.title: StringResource
+  get() = when (this) {
+    BadgePurchaseState.Issuing -> MR.strings.badges_issuing_title
+    BadgePurchaseState.WaitingForApproval -> MR.strings.badges_waiting_for_approval_title
+  }
+
+val BadgePurchaseState.message: StringResource
+  get() = when (this) {
+    BadgePurchaseState.Issuing -> MR.strings.badges_issuing_body
+    BadgePurchaseState.WaitingForApproval -> MR.strings.badges_waiting_for_approval_body
+  }
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgesRedeemCodeView.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgesRedeemCodeView.kt
index 7494229aaa..11367134f7 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgesRedeemCodeView.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgesRedeemCodeView.kt
@@ -85,7 +85,7 @@ suspend fun redeemBadgeCode(rhId: Long?, user: User, code: String): BadgeRedeemO
     }
     is BadgeRedeemResult.Failed -> {
       Log.e(TAG, "apiRedeemBadgeCode: ${result.err?.string}")
-      BadgeRedeemOutcome.Refused(chatModel.controller.redeemErrorText(result.err))
+      BadgeRedeemOutcome.Refused(chatModel.controller.redeemErrorText(result.err, purchase = false))
     }
   }
 
@@ -94,11 +94,12 @@ fun showCannotRedeemAlert(message: String) {
 }
 
 @Composable
-fun BadgesRedeemCodeView(modalManager: ModalManager) {
+fun BadgesRedeemCodeView(modalManager: ModalManager, unwindToDepth: Int) {
   val rhId = remember { chatModel.remoteHostId() }
   val code = remember { mutableStateOf(TextFieldValue("")) }
   val canonicalCode = remember { mutableStateOf<String?>(null) }
   val submitting = remember { mutableStateOf(false) }
+  CloseWhenSupportGivesWay(modalManager, unwindToDepth)
 
   // when the text is unchanged, the field's own value is kept: it carries the cursor position and the
   // keyboard's composition state, which BasicTextField loses unless they are passed back to it
@@ -117,7 +118,8 @@ fun BadgesRedeemCodeView(modalManager: ModalManager) {
       withContext(Dispatchers.Main) {
         submitting.value = false
         when (outcome) {
-          is BadgeRedeemOutcome.Redeemed -> modalManager.closeModal()
+          // a shown badge closes this screen itself, and a second close would take the screen beneath
+          is BadgeRedeemOutcome.Redeemed -> if (currentShownBadge() == null) modalManager.closeModal()
           is BadgeRedeemOutcome.Refused -> showCannotRedeemAlert(outcome.message)
           is BadgeRedeemOutcome.Cancelled -> {}
         }
@@ -382,7 +384,8 @@ private fun Confirming(onConfirm: () -> Unit, onCancel: () -> Unit) {
 // leaving does not cancel: the badge is still added after the screen closes
 @Composable
 private fun BeingIssued(onDismiss: () -> Unit) {
-  LinkStep(MR.strings.badges_being_issued, textButton = MR.strings.badges_dismiss to onDismiss) {
+  LinkStep(MR.strings.badges_issuing_title, textButton = MR.strings.badges_dismiss to onDismiss) {
+    LinkText(stringResource(MR.strings.badges_link_issuing_profile))
     Spacer(Modifier.weight(1f))
     CircularProgressIndicator(
       Modifier.size(30.dp),
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgesSupportSimplexView.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgesSupportSimplexView.kt
index dc65897547..aa2144ff59 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgesSupportSimplexView.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgesSupportSimplexView.kt
@@ -32,7 +32,7 @@ import chat.simplex.common.views.onboarding.TextButtonBelowOnboardingButton
 import chat.simplex.res.MR
 
 @Composable
-fun BadgesSupportSimplexView(modalManager: ModalManager) {
+fun BadgesSupportSimplexView(modalManager: ModalManager, unwindToDepth: Int) {
   ColumnWithScrollBar(
     Modifier.background(MaterialTheme.colors.background).padding(horizontal = 25.dp).padding(top = 8.dp, bottom = 20.dp),
     verticalArrangement = Arrangement.spacedBy(16.dp),
@@ -55,8 +55,6 @@ fun BadgesSupportSimplexView(modalManager: ModalManager) {
       modifier = Modifier.fillMaxWidth()
     )
 
-    // TODO [badges] restore WhyBuiltButton() when in-app purchase lands: the level screen
-    // returns to the flow and HowItWorksButton() moves there, leaving this one alone here.
     HowItWorksButton(modalManager)
 
     Spacer(Modifier.weight(1f))
@@ -66,21 +64,30 @@ fun BadgesSupportSimplexView(modalManager: ModalManager) {
     Spacer(Modifier.weight(1f))
 
     Column(horizontalAlignment = Alignment.CenterHorizontally) {
-      BuyInBrowserButton(modalManager)
-      RedeemCodeButton(modalManager)
+      if (badgeStoreAvailable) {
+        ChooseLevelButton(modalManager, unwindToDepth)
+        if (badgeBrowserAllowed()) {
+          BuyInBrowserTextButton()
+        } else {
+          RedeemCodeButton(modalManager, unwindToDepth)
+        }
+      } else {
+        BuyInBrowserButton(modalManager, unwindToDepth)
+        RedeemCodeButton(modalManager, unwindToDepth)
+      }
     }
   }
 }
 
-// the in-app purchase path, kept compiling and uncalled until payments return after the MVP
 @Composable
-private fun ChooseLevelButton(modalManager: ModalManager) {
+private fun ChooseLevelButton(modalManager: ModalManager, unwindToDepth: Int) {
   OnboardingActionButton(
     modifier = if (appPlatform.isAndroid) Modifier.padding(horizontal = DEFAULT_ONBOARDING_HORIZONTAL_PADDING).fillMaxWidth() else Modifier.widthIn(min = 300.dp),
-    labelId = MR.strings.badges_choose_your_level,
+    labelId = MR.strings.badges_choose_your_badge_title,
     onboarding = null,
+    enabled = BadgeStore.canBuy(chatModel.currentUser.value?.userId),
     onclick = {
-      modalManager.showModal { BadgesChooseBadgeView(modalManager) }
+      modalManager.showModal { BadgesChooseBadgeView(modalManager, unwindToDepth) }
     }
   )
 }
@@ -111,15 +118,24 @@ private fun HowItWorksButton(modalManager: ModalManager) {
 }
 
 @Composable
-private fun RedeemCodeButton(modalManager: ModalManager) {
+fun RedeemCodeButton(modalManager: ModalManager, unwindToDepth: Int) {
   TextButtonBelowOnboardingButton(
     text = stringResource(MR.strings.badges_redeem_code_button),
-    onClick = { modalManager.showModal { BadgesRedeemCodeView(modalManager) } }
+    onClick = { modalManager.showModal { BadgesRedeemCodeView(modalManager, unwindToDepth) } }
   )
 }
 
 @Composable
-private fun BuyInBrowserButton(modalManager: ModalManager) {
+private fun BuyInBrowserTextButton() {
+  val uriHandler = LocalUriHandler.current
+  TextButtonBelowOnboardingButton(
+    text = stringResource(MR.strings.badges_buy_in_browser),
+    onClick = { uriHandler.openUriCatching(badgePageUrl) }
+  )
+}
+
+@Composable
+private fun BuyInBrowserButton(modalManager: ModalManager, unwindToDepth: Int) {
   val uriHandler = LocalUriHandler.current
   OnboardingActionButton(
     modifier = if (appPlatform.isAndroid) Modifier.padding(horizontal = DEFAULT_ONBOARDING_HORIZONTAL_PADDING).fillMaxWidth() else Modifier.widthIn(min = 300.dp),
@@ -129,7 +145,7 @@ private fun BuyInBrowserButton(modalManager: ModalManager) {
       uriHandler.openUriCatching(badgePageUrl)
       // desktop has no scheme to bring the code back, so the code is pasted into this screen, opened beside the browser
       if (appPlatform.isDesktop && !modalManager.hasModalOpen(ModalViewId.BADGE_REDEEM_CODE)) {
-        modalManager.showModal(id = ModalViewId.BADGE_REDEEM_CODE) { BadgesRedeemCodeView(modalManager) }
+        modalManager.showModal(id = ModalViewId.BADGE_REDEEM_CODE) { BadgesRedeemCodeView(modalManager, unwindToDepth) }
       }
     }
   )
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgesView.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgesView.kt
index ff2660497e..d631735e3e 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgesView.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgesView.kt
@@ -2,33 +2,70 @@ package chat.simplex.common.views.badges
 
 import androidx.compose.animation.*
 import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.remember
 import chat.simplex.common.model.BadgeModel
 import chat.simplex.common.model.BadgeState
 import chat.simplex.common.platform.chatModel
+import chat.simplex.common.views.helpers.AlertManager
 import chat.simplex.common.views.helpers.ModalManager
 import chat.simplex.common.views.helpers.ModalView
+import chat.simplex.common.views.helpers.generalGetString
+import chat.simplex.res.MR
 
 @OptIn(ExperimentalAnimationApi::class)
 @Composable
 fun BadgesView(modalManager: ModalManager, close: () -> Unit) {
-  val shownBadge: BadgeState? = run {
-    if (!BadgeModel.isCurrent(chatModel.remoteHostId(), chatModel.currentUser.value?.userId)) return@run null
-    val badgeState = BadgeModel.badgeState.value
-    if (badgeState != null && badgeState.shown) badgeState else null
-  }
+  val shownBadge = currentShownBadge()
+  val unwindToDepth = remember { modalManager.openModalCount() }
 
   // the card look is a modal setting, so the modal is composed here to follow the screen shown
   ModalView(close, cardScreen = shownBadge != null) {
-    AnimatedContent(targetState = shownBadge, transitionSpec = { fadeIn() with fadeOut() }, contentKey = { it != null }) { badgeState ->
+    AnimatedContent(
+      targetState = Triple(shownBadge, BadgeStore.purchaseState(chatModel.currentUser.value?.userId), BadgeStore.checkingPurchases),
+      transitionSpec = { fadeIn() with fadeOut() },
+      contentKey = { (badgeState, purchaseState, checkingPurchases) -> Triple(badgeState != null, purchaseState, checkingPurchases) }
+    ) { (badgeState, purchaseState, checkingPurchases) ->
       if (badgeState != null) {
         BadgesYourBadgeView(badgeState, modalManager)
+      } else if (purchaseState != null) {
+        // holds the purchase screens' slot, so a consumable cannot be bought twice
+        BadgesPurchaseStateView(purchaseState.title, purchaseState.message, BadgeStore.creditError(chatModel.currentUser.value?.userId), onDismiss = close)
+        LaunchedEffect(purchaseState) {
+          BadgeStore.refusals.collect { refusal ->
+            // only the issuing screen belongs to the active profile's held purchase, so a refusal shown there reads as its own
+            if (purchaseState == BadgePurchaseState.Issuing) {
+              AlertManager.shared.showAlertMsg(title = generalGetString(MR.strings.badges_purchase_error), text = chatModel.controller.redeemErrorText(refusal, purchase = true))
+            }
+          }
+        }
+      } else if (checkingPurchases) {
+        BadgesPurchaseStateView(MR.strings.badges_checking_purchases_title, null, onDismiss = close)
       } else {
-        BadgesSupportSimplexView(modalManager)
+        BadgesSupportSimplexView(modalManager, unwindToDepth)
       }
     }
   }
 }
 
+fun currentShownBadge(): BadgeState? {
+  if (!BadgeModel.isCurrent(chatModel.remoteHostId(), chatModel.currentUser.value?.userId)) return null
+  val badgeState = BadgeModel.badgeState.value
+  return if (badgeState != null && badgeState.shown) badgeState else null
+}
+
+// The badges modal shows the purchase state itself, so screens pushed over it have to go once a purchase
+// appears. Only the top one is composed, so this runs there, closing them in one effect because a close per
+// recomposition restarts showInView's transition, and stopping on a depth because closeModal defers removal.
+// TODO [badges] ModalManager has no close-above and records no parentage; with either, the depth goes away.
+@Composable
+fun CloseWhenSupportGivesWay(modalManager: ModalManager, unwindToDepth: Int) {
+  val gaveWay = BadgeStore.purchaseState(chatModel.currentUser.value?.userId) != null || currentShownBadge() != null
+  LaunchedEffect(gaveWay) {
+    if (gaveWay) while (modalManager.openModalCount() > unwindToDepth) modalManager.closeModal()
+  }
+}
+
 // ModalManager.end, not start: every caller is in the chat, which on desktop is the right pane
 fun openBadgesView() {
   ModalManager.end.showCustomModal { close -> BadgesView(ModalManager.end, close) }
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgesYourBadgeView.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgesYourBadgeView.kt
index c2ca7d7f10..6be88831a4 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgesYourBadgeView.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/badges/BadgesYourBadgeView.kt
@@ -78,6 +78,14 @@ fun BadgesYourBadgeView(badgeState: BadgeState, modalManager: ModalManager) {
       }
       SectionSpacer()
     }
+    if (BadgeStore.purchaseState(chatModel.currentUser.value?.userId) != null) {
+      SectionView(stringResource(MR.strings.badges_store_purchase_title)) {
+        SectionItemView {
+          Text(stringResource(MR.strings.badges_store_purchase_processing), color = MaterialTheme.colors.secondary)
+        }
+      }
+      SectionSpacer()
+    }
     if (appPrefs.developerTools.get()) {
       val clipboard = LocalClipboardManager.current
       SectionView(stringResource(MR.strings.badges_credential)) {
diff --git a/apps/multiplatform/common/src/commonMain/resources/MR/base/strings.xml b/apps/multiplatform/common/src/commonMain/resources/MR/base/strings.xml
index 957160041b..deaf291138 100644
--- a/apps/multiplatform/common/src/commonMain/resources/MR/base/strings.xml
+++ b/apps/multiplatform/common/src/commonMain/resources/MR/base/strings.xml
@@ -3142,8 +3142,10 @@
   <string name="badge_unknown_key_desc">The badge is signed with a key that this version of the app does not recognize. Update the app to verify this badge.</string>
   <string name="badges_level_supporter">Supporter</string>
   <string name="badges_level_legend">Legend</string>
-  <string name="badges_level_supporter_files">Send 2GB files</string>
-  <string name="badges_level_legend_files">Send 5GB files</string>
+  <string name="badges_level_supporter_file_size">Files up to 2 GB</string>
+  <string name="badges_level_supporter_file_storage">Stored for 7 days</string>
+  <string name="badges_level_legend_file_size">Files up to 5 GB</string>
+  <string name="badges_level_legend_file_storage">Stored for 21 days</string>
   <string name="badges_price_monthly">%1$s/month</string>
   <string name="badges_price_annual">%1$s/year</string>
   <string name="badges_pay_monthly">Pay %1$s/month</string>
@@ -3151,7 +3153,7 @@
   <string name="badges_pay_once">Pay %1$s</string>
   <string name="badges_price_loading">Loading…</string>
   <string name="badges_price_unavailable">Not available</string>
-  <string name="badges_savings">Save %1$s</string>
+  <string name="badges_savings">%1$s off</string>
   <string name="badges_level_supporter_summary">Supporter: 2 GB files available for 7 days.</string>
   <string name="badges_level_legend_summary">Legend: 5 GB files available for 21 days.</string>
   <string name="badges_period_one_month">1 month</string>
@@ -3165,7 +3167,6 @@
   <string name="badges_support_simplex_title">Support SimpleX</string>
   <string name="badges_support_simplex_body">Get a badge to send larger files (2-5GB) that stay available longer (7-21 days), and to show it on your profile.</string>
   <string name="badges_why_simplex_is_built">Why SimpleX is built.</string>
-  <string name="badges_choose_your_level">Choose your level</string>
   <string name="badges_redeem_code_button">Redeem badge code</string>
   <string name="badges_continue">Continue</string>
   <string name="badges_how_it_works_button">How badges protect your privacy</string>
@@ -3179,10 +3180,17 @@
   <string name="badges_banner_subtitle">Get badge + better files</string>
   <string name="badges_banner_dismiss_message">You can support SimpleX later in Settings.</string>
   <string name="badges_larger_files_longer">Support SimpleX to send larger files that stay available longer</string>
-  <string name="badges_purchase_successful">Purchase successful</string>
-  <string name="badges_purchase_pending">Purchase pending</string>
-  <string name="badges_purchase_pending_desc">The purchase is awaiting approval. This build does not deliver purchases approved later.</string>
   <string name="badges_purchase_error">Purchase error</string>
+  <string name="badges_check_your_order_title">Check your order</string>
+  <string name="badges_order_duration">Duration</string>
+  <string name="badges_order_total">Total</string>
+  <string name="badges_issuing_title">Issuing your badge</string>
+  <string name="badges_issuing_body">Your payment is complete. The badge will be added to this profile.</string>
+  <string name="badges_waiting_for_approval_title">Waiting for approval</string>
+  <string name="badges_waiting_for_approval_body">Nothing has been charged.</string>
+  <string name="badges_checking_purchases_title">Checking your purchases</string>
+  <string name="badges_store_purchase_title">Store purchase</string>
+  <string name="badges_store_purchase_processing">A store purchase is being processed.</string>
   <string name="badges_buy_in_browser">Buy in browser</string>
   <string name="badges_redeem_code_title">Redeem code</string>
   <string name="badges_link_confirm_title">Add badge to your profile?</string>
@@ -3192,7 +3200,7 @@
   <string name="badges_link_held_other_profile">A badge can be added to another profile, or here once this badge ends.</string>
   <string name="badges_link_held_page">Its code is on the page you bought it on, under Show code.</string>
   <string name="badges_link_view_badge">View your badge</string>
-  <string name="badges_being_issued">Badge is being issued</string>
+  <string name="badges_link_issuing_profile">The badge will be added to this profile.</string>
   <string name="badges_link_added_title">Badge added</string>
   <string name="badges_link_added_profile">The badge was added to the profile %1$s.</string>
   <string name="badges_redeem_code_body">Paste the code you received.</string>
@@ -3201,7 +3209,9 @@
   <string name="badges_error_title">Cannot redeem code</string>
   <string name="badges_error_invalid_code">This code is not valid.</string>
   <string name="badges_error_service_not_configured">This app version cannot redeem badge codes.</string>
+  <string name="badges_error_service_not_configured_purchase">This app version cannot buy badges.</string>
   <string name="badges_error_already_active">This profile already has a badge. Redeem the code on another profile, or once this badge ends.</string>
+  <string name="badges_error_already_active_purchase">This profile already has a badge.</string>
   <string name="badges_error_code_invalid">This code was not recognized.</string>
   <string name="badges_error_code_used">This code has already been used.</string>
   <string name="badges_error_code_expired">This code has expired.</string>
@@ -3211,6 +3221,12 @@
   <string name="badges_error_unsupported_version">This app version is too old for the badge service. Please update the app.</string>
   <string name="badges_error_unknown_purchase">The badge service does not recognize this badge.</string>
   <string name="badges_error_service_internal">The badge service reported an internal error.</string>
+  <string name="badges_error_receipt_invalid">The store did not confirm this purchase.</string>
+  <string name="badges_error_receipt_used">This purchase was already credited to a badge on another device or profile.</string>
+  <string name="badges_error_payment_pending">The payment has not been confirmed yet.</string>
+  <string name="badges_error_provider_unavailable">The store could not be reached.</string>
+  <string name="badges_error_provider_not_configured">Badges cannot be bought in the app yet.</string>
+  <string name="badges_error_product_unavailable">This badge is not on sale.</string>
   <string name="badges_error_badge_ended">The code was accepted, but the badge it grants has already ended.</string>
   <string name="badges_error_unknown">The code could not be redeemed.</string>
   <string name="badges_code_you_scanned_is_not_badge_code">The code you scanned is not a badge code.</string>
@@ -3245,6 +3261,7 @@
   <string name="badges_renewal_failed">Badge renewal failed</string>
   <string name="badges_tap_for_details">Tap for details</string>
   <string name="badges_error_service_refused">The badge service refused the renewal: %1$s</string>
+  <string name="badges_error_purchase_refused">The badge service refused the purchase: %1$s</string>
   <string name="badges_error_no_response">The badge service did not respond.</string>
   <string name="badges_error_unreachable">The badge service could not be reached.</string>
   <string name="badges_error_credential_invalid">The badge issued by the service cannot be verified.</string>
diff --git a/apps/simplex-badge-service/README.md b/apps/simplex-badge-service/README.md
index 945256f814..538d75c7a0 100644
--- a/apps/simplex-badge-service/README.md
+++ b/apps/simplex-badge-service/README.md
@@ -48,7 +48,7 @@ simplex-badge-service --help
 - `--run-cli`: interactive CLI that also processes service requests (mirrors
   `simplex-directory-service --run-cli`). This mode is the chat/RPC side and the `//` commands
   below: it starts no web listener and no poller, and `[dev] chat_redeem` does not apply to it,
-  whatever `--service-config` says.
+  whatever `--service-config` says. `[dev] accept_unverified_store_receipts` does.
 - `--no-address`: skip address creation on start-up (for operators who provision the address themselves).
 The service cannot sign credentials without an issuer key and refuses to start without one:
 
@@ -81,7 +81,8 @@ Other options:
 - `--service-config INI_FILE`: path to `badge_service.ini`. Omit it to run the chat/RPC side
   only; the process never starts a web listener without it, and never starts one under
   `--run-cli`, which parses and validates the whole file (`[listener] static_dir` included) but
-  uses only its `[issuer]` section. An issuer key is still required either way.
+  uses only its `[issuer]` section and `[dev] accept_unverified_store_receipts`. An issuer key is
+  still required either way.
 - `--service-name NAME`: the bot's display name, without `*`s or spaces (default `SimpleX Badges`).
 - `--client-service`: use the client service certificate.
 - also accepts the standard SimpleX Chat core options — database path, SMP/XFTP servers,
@@ -216,6 +217,24 @@ there is no client key, so the service generates one and hands it over with the
 means it can link every badge it issues this way. `simplex-chat badge sign` has the same property
 and is the offline equivalent.
 
+### Accepting store receipts unverified, for local testing
+
+```ini
+[dev]
+accept_unverified_store_receipts = on
+```
+
+Without a store verifier every store purchase is answered `provider_not_configured`. With this on,
+the service accepts any well-formed receipt without asking or verifying anything: an Apple JWS for
+the `transactionId` and `productId` its payload names, unsigned or not, and a Play product id and
+token as given. It applies to both run modes, since `--run-cli` answers service requests too, and
+the service logs a warning at every start while it is on. Off by default, and only `on`/`off`
+parse.
+
+With it on, anyone who can reach the service address can mint badges by sending a made-up receipt.
+That is harmless only while this deployment signs with an issuer key released apps do not carry, so
+they refuse what it signs — never turn it on where the key is one those apps trust.
+
 ## Issuing codes
 
 Issuing a code is an operator command sent to the running service in `--run-cli` mode, not a way
diff --git a/apps/simplex-badge-service/badge_service.ini.example b/apps/simplex-badge-service/badge_service.ini.example
index b1f5f4b1c1..3d02951fdc 100644
--- a/apps/simplex-badge-service/badge_service.ini.example
+++ b/apps/simplex-badge-service/badge_service.ini.example
@@ -54,3 +54,6 @@ idle_seconds = 60
 ; with a master key this service generates and can therefore link
 [dev]
 chat_redeem = off
+; local testing only, in both run modes: accepts any well-formed App Store or Play receipt without
+; verifying it, so anyone who can reach this service can mint badges
+accept_unverified_store_receipts = off
diff --git a/apps/simplex-badge-service/src/BadgeService/Catalog.hs b/apps/simplex-badge-service/src/BadgeService/Catalog.hs
index b15185da68..85b678d8d5 100644
--- a/apps/simplex-badge-service/src/BadgeService/Catalog.hs
+++ b/apps/simplex-badge-service/src/BadgeService/Catalog.hs
@@ -11,6 +11,8 @@ module BadgeService.Catalog
     priceOffer,
     catalogCurrency,
     defaultCatalog,
+    StoreProduct (..),
+    storeProduct,
   )
 where
 
@@ -21,7 +23,7 @@ import Data.Word (Word32, Word64, Word8)
 import Simplex.Chat.Badges (BadgeType (..))
 import Simplex.Chat.Badges.Service (BadgeOffer (..), BadgePrice (..))
 import Simplex.Chat.Badges.Types (BadgeItemStatus (..), BadgeOfferId (..), BadgePriceId (..), OfferDiscount (..))
-import Simplex.Chat.PaymentService.Types (CurrencyAmount (..))
+import Simplex.Chat.PaymentService.Types (CurrencyAmount (..), PaymentProvider (..))
 
 data OfferInvalid = OIZeroMonths | OIFreeMonthsExceedTerm | OIDiscountTooLarge | OIAmountUnsellable
   deriving (Eq, Show)
@@ -133,3 +135,20 @@ defaultCatalog seededAt = (prices, offers)
           status = BISActive,
           createdAt = seededAt
         }
+
+data StoreProduct = StoreProduct
+  { badgeType :: BadgeType,
+    months :: Int
+  }
+  deriving (Eq, Show)
+
+-- | A receipt proves only the product paid for, so the badge comes from here, never from the client.
+-- Mirrors the one-time SKUs of BadgeStore.swift and .kt; subscriptions wait until renewals add months.
+-- Not part of the seeded catalog above, which exists to pin prices this service sets: a store sets its own.
+storeProduct :: PaymentProvider -> Text -> Maybe StoreProduct
+storeProduct provider productId = case (provider, productId) of
+  (PPApple, "BADGE_SUPPORTER_01") -> Just $ StoreProduct BTSupporter 1
+  (PPApple, "BADGE_LEGEND_01") -> Just $ StoreProduct BTLegend 1
+  (PPGoogle, "badge_supporter_01") -> Just $ StoreProduct BTSupporter 1
+  (PPGoogle, "badge_legend_01") -> Just $ StoreProduct BTLegend 1
+  _ -> Nothing
diff --git a/apps/simplex-badge-service/src/BadgeService/Config.hs b/apps/simplex-badge-service/src/BadgeService/Config.hs
index 10d55d7da7..fd11647a36 100644
--- a/apps/simplex-badge-service/src/BadgeService/Config.hs
+++ b/apps/simplex-badge-service/src/BadgeService/Config.hs
@@ -104,7 +104,9 @@ data ServiceConfig = ServiceConfig
     poll :: PollConfig,
     issuer :: Maybe BadgeIssuerKey,
     -- Local testing only; signs credentials with a master key this service can link.
-    devChatRedeem :: Bool
+    devChatRedeem :: Bool,
+    -- Local testing only; anyone who can reach the service can mint badges with any well-formed receipt.
+    devAcceptUnverifiedStoreReceipts :: Bool
   }
   deriving (Eq, Show)
 
@@ -155,7 +157,7 @@ knownSettings =
     ("btcpay", ["host", "api_key", "store_id", "webhook_secret", "expiry_minutes", "speed_policy", "payment_tolerance"]),
     ("stripe", ["secret_key", "publishable_key", "webhook_secret", "session_minutes"]),
     ("poll", ["waiting_seconds", "idle_seconds"]),
-    ("dev", ["chat_redeem"]),
+    ("dev", ["chat_redeem", "accept_unverified_store_receipts"]),
     ("issuer", ["index", "private_key"])
   ]
 
@@ -189,6 +191,7 @@ parseConfig ini = do
   pWaitingSeconds <- cadence "waiting_seconds" 3
   pIdleSeconds <- cadence "idle_seconds" 60
   devRedeem <- bool "dev" "chat_redeem" False
+  devUnverifiedReceipts <- bool "dev" "accept_unverified_store_receipts" False
   pure
     ServiceConfig
       { listener = ListenerConfig {lHost, lPort, lStaticDir, lServeWebapp, lWebappExportDir, lTrustForwardedFor},
@@ -196,7 +199,8 @@ parseConfig ini = do
         stripe = str,
         poll = PollConfig {pWaitingSeconds, pIdleSeconds},
         issuer = iss,
-        devChatRedeem = devRedeem
+        devChatRedeem = devRedeem,
+        devAcceptUnverifiedStoreReceipts = devUnverifiedReceipts
       }
   where
     hasSection s = s `elem` sections ini
diff --git a/apps/simplex-badge-service/src/BadgeService/Poller.hs b/apps/simplex-badge-service/src/BadgeService/Poller.hs
index c91ffcd22f..f066ed5d0c 100644
--- a/apps/simplex-badge-service/src/BadgeService/Poller.hs
+++ b/apps/simplex-badge-service/src/BadgeService/Poller.hs
@@ -30,7 +30,7 @@ where
 import BadgeService.Config (PollConfig (..))
 import BadgeService.Orders (decide, settleOrder)
 import BadgeService.Providers (ListPass (..), PaymentSignal (..), Provider (..), ProviderError (..), Received (..), expiresItself, settleWindow)
-import BadgeService.Store.Invoices (InvoiceRow (..), OverdueInvoice (..), expireOverdue, getInvoiceByProviderRef, overdueInvoices, providerText, unpaidRefs)
+import BadgeService.Store.Invoices (InvoiceRow (..), OverdueInvoice (..), expireOverdue, getInvoiceByProviderRef, overdueInvoices, unpaidRefs)
 import BadgeService.Waiters (Waiters, publish, waitingCount, waitingCountSTM)
 import Control.Concurrent.STM
 import Control.Exception (SomeAsyncException, SomeException, fromException, throwIO, try)
@@ -47,6 +47,7 @@ import Data.Time.Clock (NominalDiffTime, UTCTime, addUTCTime, diffUTCTime, getCu
 import Numeric.Natural (Natural)
 import Simplex.Chat.PaymentService.Types (InvoiceStatus (..), PaymentProvider)
 import Simplex.Messaging.Agent.Store.Common (DBStore)
+import Simplex.Messaging.Encoding.String (textEncode)
 import Simplex.Messaging.Util (tshow)
 
 -- | Allows for our clock running ahead of the provider's; an expired invoice can still be marked paid.
@@ -145,7 +146,7 @@ readsPerPass = 25
 
 coveringProvider :: PollerEnv -> UTCTime -> (Text, Text) -> IO (Maybe Provider)
 coveringProvider env@PollerEnv {peProviders} now (provider, ref) =
-  case find ((== provider) . providerText . pProvider) peProviders of
+  case find ((== provider) . textEncode . pProvider) peProviders of
     Just p -> pure (Just p)
     Nothing -> do
       due <- dueToWarn env now ("no provider for " <> provider)
diff --git a/apps/simplex-badge-service/src/BadgeService/Service.hs b/apps/simplex-badge-service/src/BadgeService/Service.hs
index 9a3a3f4236..02519095de 100644
--- a/apps/simplex-badge-service/src/BadgeService/Service.hs
+++ b/apps/simplex-badge-service/src/BadgeService/Service.hs
@@ -15,13 +15,16 @@ module BadgeService.Service
     badgeServiceCLI,
     badgeServiceResponse,
     badgeErrorRetryAfter,
+    shownServiceRequest,
+    survive,
     IssueCodeOpts (..),
     issueBadgeCode,
   )
 where
 
-import BadgeService.Catalog (defaultCatalog)
+import BadgeService.Catalog (StoreProduct (..), defaultCatalog, storeProduct)
 import BadgeService.Config (BadgeIssuerKey (..), ServiceConfig (..), readServiceConfig)
+import BadgeService.Log (logError, logInfo, logWarn)
 import BadgeService.Options
 import BadgeService.Poller (newPollerEnv, newReadHints, runPoller)
 import BadgeService.Providers.BTCPay (btcpayProvider)
@@ -29,11 +32,12 @@ import BadgeService.Providers.Stripe (stripeProvider)
 import BadgeService.Store
 import BadgeService.Store.Invoices (seedCatalog, truncateToSecond)
 import BadgeService.Store.Migrate (runBadgeServiceMigrations)
+import BadgeService.StoreReceipts
+import BadgeService.StoreReceipts.Mock (mockStoreVerifier)
 import BadgeService.Waiters (Waiters, newWaiters)
 import BadgeService.Web.Server (exportWebapp, newWebEnv, runWebListener)
 import Control.Applicative (optional)
 import Control.Concurrent.STM
-import BadgeService.Log (logError, logInfo, logWarn)
 import Control.Monad
 import Control.Monad.IO.Class (liftIO)
 import qualified Data.Aeson as J
@@ -43,7 +47,8 @@ import Data.ByteString.Char8 (ByteString)
 import qualified Data.ByteString.Lazy.Char8 as LB
 import Data.Char (isSpace)
 import Data.Either (fromRight)
-import Data.Functor (($>))
+import Data.Functor (($>), (<&>))
+import Data.Int (Int64)
 import qualified Data.Map.Strict as M
 import Data.Maybe (fromMaybe, maybeToList)
 import qualified Data.Text as T
@@ -61,14 +66,16 @@ import Simplex.Chat.Core (sendChatCmd, simplexChatCore)
 import Simplex.Chat.Messages
 import Simplex.Chat.Messages.CIContent (CIContent (..), SMsgDirection (..), ciContentToText)
 import Simplex.Chat.Options (printDbOpts)
+import Simplex.Chat.PaymentService.Types (StoreTransactionRef (..))
 import Simplex.Chat.Terminal (terminalChatConfig)
 import Simplex.Chat.Terminal.Main (simplexChatCLI')
 import Simplex.Chat.Types (AgentInvId (..), Contact, User (..))
 import Simplex.Messaging.Agent.Store.Common (DBStore)
+import qualified Simplex.Messaging.Agent.Store.DB as DB
 import qualified Simplex.Messaging.Crypto as C
 import Simplex.Messaging.Crypto.BBS (bbsPublicKey)
 import Simplex.Messaging.Encoding.String (TextEncoding, strEncode, textDecode, textEncode)
-import Simplex.Messaging.Util (raceAny_, safeDecodeUtf8, tshow)
+import Simplex.Messaging.Util (catchOwn', raceAny_, safeDecodeUtf8, tshow)
 import Simplex.Messaging.Version (isCompatible)
 import System.Directory (getAppUserDataDirectory)
 import System.Exit (exitFailure)
@@ -76,15 +83,18 @@ import System.Exit (exitFailure)
 data ServiceState = ServiceState
   { serviceCC :: TMVar ChatController,
     serviceRequestQ :: TQueue (User, AgentInvId, Maybe C.PublicKeyEd25519, J.Object),
-    chatRedeemQ :: TQueue (Contact, T.Text)
+    chatRedeemQ :: TQueue (Contact, T.Text),
+    storeVerifier :: StoreVerifier
   }
 
+-- | No store verifier exists yet, so every store receipt not already credited is answered
+-- provider_not_configured, terminal for the request: retrying cannot deploy one.
 newServiceState :: IO ServiceState
 newServiceState = do
   serviceCC <- newEmptyTMVarIO
   serviceRequestQ <- newTQueueIO
   chatRedeemQ <- newTQueueIO
-  pure ServiceState {serviceCC, serviceRequestQ, chatRedeemQ}
+  pure ServiceState {serviceCC, serviceRequestQ, chatRedeemQ, storeVerifier = noStoreVerifier}
 
 welcomeGetOpts :: IO BadgeServiceOpts
 welcomeGetOpts = do
@@ -123,6 +133,13 @@ readConfigOrExit path =
     Left e -> putStrLn (path <> ": " <> e) >> exitFailure
     Right sc -> pure sc
 
+devStoreVerifier :: Maybe ServiceConfig -> ServiceState -> IO ServiceState
+devStoreVerifier serviceCfg env
+  | maybe False devAcceptUnverifiedStoreReceipts serviceCfg = do
+      logWarn "[dev] accept_unverified_store_receipts is on: any store receipt is accepted without verification"
+      pure env {storeVerifier = mockStoreVerifier}
+  | otherwise = pure env
+
 badgeService :: BadgeServiceOpts -> ChatConfig -> ServiceState -> IO ()
 badgeService opts@BadgeServiceOpts {serviceConfigFile} cfg env = do
   serviceCfg <- traverse readConfigOrExit serviceConfigFile
@@ -136,6 +153,7 @@ badgeService opts@BadgeServiceOpts {serviceConfigFile} cfg env = do
             preCmdHook = Just badgeCmdHook
           }
   when devRedeem $ logWarn "[dev] chat_redeem is on: /redeem over chat hands out credentials this service can link"
+  requestEnv <- devStoreVerifier serviceCfg env
   -- The reader must not block, since outputQ carries every chat event.
   simplexChatCore cfg {chatHooks} (mkChatOpts opts) $ \_ cc -> do
     lanes <- maybe (pure []) (serviceLanes waiters cc) serviceCfg
@@ -147,7 +165,7 @@ badgeService opts@BadgeServiceOpts {serviceConfigFile} cfg env = do
             (_, Right CEvtNewChatItems {chatItems = AChatItem _ SMDRcv (DirectChat ct) ChatItem {content = mc@CIRcvMsgContent {}} : _})
               | devRedeem -> atomically $ writeTQueue (chatRedeemQ env) (ct, ciContentToText mc)
             _ -> pure (),
-        processQueuedRequests key env
+        processQueuedRequests key requestEnv
       ]
         <> [processChatRedeems key env | devRedeem]
         <> lanes
@@ -178,13 +196,12 @@ badgeServiceCLI :: BadgeServiceOpts -> IO ()
 badgeServiceCLI opts@BadgeServiceOpts {serviceConfigFile} = do
   serviceCfg <- traverse readConfigOrExit serviceConfigFile
   key <- requireIssuerKey opts serviceCfg terminalChatConfig
-  env <- newServiceState
-  let eventHook _cc ev = do
-        case ev of
-          Right (CEvtServiceRequest u reqId sigKey reqData) ->
-            atomically $ writeTQueue (serviceRequestQ env) (u, reqId, sigKey, reqData)
-          _ -> pure ()
-        pure ev
+  env <- newServiceState >>= devStoreVerifier serviceCfg
+  let eventHook _cc = \case
+        Right (CEvtServiceRequest u reqId sigKey reqData) -> do
+          atomically $ writeTQueue (serviceRequestQ env) (u, reqId, sigKey, reqData)
+          pure $ Right $ CEvtServiceRequest u reqId sigKey (shownServiceRequest reqData)
+        ev -> pure ev
       chatHooks =
         defaultChatHooks
           { preStartHook = Just $ badgePreStartHook opts,
@@ -197,6 +214,12 @@ badgeServiceCLI opts@BadgeServiceOpts {serviceConfigFile} = do
       processQueuedRequests key env
     ]
 
+-- | The terminal prints each request, and requests carry codes and store receipts, which are bearer secrets.
+shownServiceRequest :: J.Object -> J.Object
+shownServiceRequest reqData = case KM.lookup "request" reqData of
+  Just (J.Object cmd) | Just t <- KM.lookup "type" cmd -> KM.singleton "request" $ J.object ["type" J..= t]
+  _ -> KM.empty
+
 badgeCmdHook :: ChatController -> ChatCommand -> IO (Either (Either ChatError ChatResponse) ChatCommand)
 badgeCmdHook cc = \case
   CustomChatCommand cmd -> Left <$> runBadgeCmd cc cmd
@@ -272,14 +295,19 @@ processQueuedRequests key env = do
   cc <- atomically $ readTMVar $ serviceCC env
   forever $ do
     (u, reqId, sigKey, reqData) <- atomically $ readTQueue $ serviceRequestQ env
-    handleServiceRequest key cc u reqId sigKey reqData
+    survive ("request " <> safeDecodeUtf8 (strEncode reqId)) $ handleServiceRequest key (storeVerifier env) cc u reqId sigKey reqData
 
 processChatRedeems :: BadgeIssuerKey -> ServiceState -> IO ()
 processChatRedeems key env = do
   cc <- atomically $ readTMVar $ serviceCC env
   forever $ do
     (ct, msg) <- atomically $ readTQueue $ chatRedeemQ env
-    chatRedeem key cc ct msg
+    survive "a chat redemption" $ chatRedeem key cc ct msg
+
+-- | Cancellation is rethrown, since that is how the race stops this thread. The
+-- exception itself is not logged: it can quote the request, which carries codes and store receipts.
+survive :: T.Text -> IO () -> IO ()
+survive what action = action `catchOwn'` \_ -> logError $ "badge service: " <> what <> " failed; the next one will be handled"
 
 -- | Here the service generates the master key and can link the badge, so [dev] chat_redeem gates this.
 chatRedeem :: BadgeIssuerKey -> ChatController -> Contact -> T.Text -> IO ()
@@ -308,11 +336,13 @@ badgePostStartHook BadgeServiceOpts {noAddress, testing} devRedeem env cc = do
       unless noAddress $ initializeBotAddress' (not testing) (Just True) devRedeem cc
       void $ atomically $ tryPutTMVar (serviceCC env) cc
 
-handleServiceRequest :: BadgeIssuerKey -> ChatController -> User -> AgentInvId -> Maybe C.PublicKeyEd25519 -> J.Object -> IO ()
-handleServiceRequest key cc User {userId} reqId sigKey reqData = do
+handleServiceRequest :: BadgeIssuerKey -> StoreVerifier -> ChatController -> User -> AgentInvId -> Maybe C.PublicKeyEd25519 -> J.Object -> IO ()
+handleServiceRequest key verifier cc User {userId} reqId sigKey reqData = do
   let reqIdT = safeDecodeUtf8 (strEncode reqId)
   logInfo $ "badge service request " <> reqIdT
-  resp <- badgeServiceResponse key cc sigKey reqData
+  resp <-
+    badgeServiceResponse key verifier cc sigKey reqData `catchOwn'` \_ ->
+      logError ("badge service request " <> reqIdT <> " failed") $> errorResponse BSEInternal
   sendChatCmd cc (APISendServiceResponse userId reqId (responseObject resp)) >>= \case
     Right _ -> pure ()
     Left e -> logError $ "badge service response failed for " <> reqIdT <> ": " <> tshow e
@@ -334,8 +364,8 @@ badgeErrorRetryAfter = \case
 
 
 -- | The agent verified the signature, so sigKey is a key the sender holds; a differing purchaseKey would let a client claim a purchase it cannot sign for.
-badgeServiceResponse :: BadgeIssuerKey -> ChatController -> Maybe C.PublicKeyEd25519 -> J.Object -> IO BadgeServiceResponse
-badgeServiceResponse key cc sigKey reqData = case J.fromJSON (J.Object reqData) of
+badgeServiceResponse :: BadgeIssuerKey -> StoreVerifier -> ChatController -> Maybe C.PublicKeyEd25519 -> J.Object -> IO BadgeServiceResponse
+badgeServiceResponse key verifier cc sigKey reqData = case J.fromJSON (J.Object reqData) of
   J.Error _ -> pure $ errorResponse BSEBadRequest
   J.Success BadgeServiceRequest {version, purchaseKey, request}
     | not (version `isCompatible` supportedBadgeServiceVRange) -> pure $ errorResponse BSEUnsupportedVersion
@@ -344,10 +374,16 @@ badgeServiceResponse key cc sigKey reqData = case J.fromJSON (J.Object reqData)
         BSCRedeemBadgeCode {masterKey, code} -> case purchaseKey of
           Just k -> redeemCode key cc k masterKey code
           Nothing -> pure $ errorResponse BSEBadRequest
+        BSCPurchaseBadge {masterKey, payment, upgrade}
+          | Just receipt_ <- toStoreReceipt verifier payment -> case (purchaseKey, upgrade) of
+              (Just k, Nothing) -> either storeRefusalResponse (purchaseWithReceipt key cc k masterKey) receipt_
+              -- store upgrades are not built, and ignoring one would credit its months at the discounted price
+              (Just _, Just _) -> pure $ errorResponse BSEBadRequest
+              (Nothing, _) -> pure $ errorResponse BSEBadRequest
         BSCIssueBadge {balance} -> case purchaseKey of
           Just k -> issueBadgeCmd key cc k balance
           Nothing -> pure $ errorResponse BSEBadRequest
-        -- Every command but redeemBadgeCode needs a key the service already knows; that one creates the purchase, so its key is unknown on a first redemption.
+        -- Every command but redeemBadgeCode and purchaseBadge from a store needs a key the service already knows; those two create the purchase, so their key is unknown on a first purchase.
         _ -> case purchaseKey of
           Nothing -> pure $ errorResponse BSEUnsupportedVersion
           Just k ->
@@ -384,29 +420,19 @@ redeemCode key cc purchaseKey masterKey codeText = case parseBadgeCode codeText
     withDB "getBadgeCode" cc (readCode now code) >>= \case
       Left _ -> pure $ errorResponse BSEInternal
       Right (Left resp) -> pure resp
-      Right (Right IssuedCode {badgeCodeId, badgeType, months}) -> do
-        (grantUuid, issueUuid) <- (,) <$> randomId cc <*> randomId cc
-        -- TODO [badges] a top-up grants onto an existing ledger, and must lapse before it or the
-        -- months it adds are counted from a start already in the past
-        let granted = grantEntry now grantUuid months SCCode $ emptyEntry now badgeType
-        -- A grant of at least one month starting now always has a month to issue.
-        case issueEntry now issueUuid granted of
-          Nothing -> pure $ errorResponse BSEInternal
-          Just issued -> credentialForEntry key masterKey issued >>= \case
-            Left e -> logError ("badge service signing failed: " <> T.pack e) $> errorResponse BSEInternal
-            Right signed -> do
-              -- If the code was revoked or redeemed while signing, the claim fails. Read the code again to tell the client why.
-              r <- withDB "writeCodeRedemption" cc $ \db ->
-                liftIO (createCodePurchase db NewCodePurchase {badgeCodeId, purchaseKey, masterKey, badgeType} now) >>= \case
-                  Nothing ->
-                    readCode now code db >>= \case
-                      Left resp -> pure resp
-                      Right _ -> logError "badge service: redeeming a code failed, but the code is neither redeemed nor revoked" $> errorResponse BSEInternal
-                  Just purchaseId -> liftIO $ do
-                    appendLedgerPlan db purchaseId [granted] $ Just $ issuanceAfter granted signed
-                    entries_ <- getLedgerEntries db purchaseId 0
-                    pure $ maybe (errorResponse BSEInternal) (credentialResponse (Just $ snd signed) Nothing) entries_
-              pure $ fromRight (errorResponse BSEInternal) r
+      Right (Right IssuedCode {badgeCodeId, badgeType, months}) ->
+        signFirstMonth key cc masterKey badgeType months SCCode now >>= \case
+          Left resp -> pure resp
+          Right firstMonth -> do
+            -- If the code was revoked or redeemed while signing, the claim fails. Read the code again to tell the client why.
+            r <- withDB "writeCodeRedemption" cc $ \db ->
+              liftIO (createCodePurchase db NewCodePurchase {badgeCodeId, purchaseKey, masterKey, badgeType} now) >>= \case
+                Nothing ->
+                  readCode now code db >>= \case
+                    Left resp -> pure resp
+                    Right _ -> logError "badge service: redeeming a code failed, but the code is neither redeemed nor revoked" $> errorResponse BSEInternal
+                Just purchaseId -> liftIO $ firstMonthResponse db purchaseId Nothing firstMonth
+            pure $ fromRight (errorResponse BSEInternal) r
   where
     readCode now code db = liftIO $
       getBadgeCode db (badgeCodeHash code) >>= \case
@@ -417,19 +443,99 @@ redeemCode key cc purchaseKey masterKey codeText = case parseBadgeCode codeText
           -- Redeeming an unpaid code would issue a free badge, so unpaid is refused.
           | CPSUnpaid <- paymentStatus -> pure $ Left $ errorResponse BSEPaymentPending
           | otherwise ->
-              checkUnspent db redemption >>= \case
+              creditedResponse db BSECodeUsed purchaseKey redemption >>= \case
                 Left resp -> pure $ Left resp
                 Right ()
                   | maybe False (now >=) expiresAt -> pure $ Left $ errorResponse BSECodeExpired
                   | otherwise -> pure $ Right c
-    checkUnspent db = \case
-      CodeUnredeemed -> pure $ Right ()
-      CodeRedeemedUnreadable -> pure $ Left $ errorResponse BSEInternal
-      CodeRedeemed RedeemedCode {purchaseKey = k, badgePurchaseId, credential}
-        | k /= purchaseKey -> pure $ Left $ errorResponse BSECodeUsed
-        | otherwise ->
-            maybe (Left $ errorResponse BSEInternal) (Left . credentialResponse (Just credential) Nothing)
-              <$> getLedgerEntries db badgePurchaseId 0
+
+-- | Every refusal is answered before anything is written, so it leaves the receipt unclaimed; and
+-- nothing is written until the credential is signed.
+purchaseWithReceipt :: BadgeIssuerKey -> ChatController -> C.PublicKeyEd25519 -> BadgeMasterKey -> StoreReceipt -> IO BadgeServiceResponse
+purchaseWithReceipt key cc purchaseKey masterKey StoreReceipt {txRef = StoreTransactionRef {provider, transactionRef = providerRef}, verifyReceipt} =
+  withDB' "getStorePayment" cc (\db -> getStorePaymentCredit db provider providerRef) >>= \case
+    Left _ -> pure $ errorResponse BSEInternal
+    Right credit
+      -- only the key it credited can ask, and it is told only what it was given, so the store is not asked
+      | creditedBy credit -> answerCredit credit
+      | otherwise ->
+          verifyReceipt >>= \case
+            Left refusal -> storeRefusalResponse refusal
+            -- the claim was read from the evidence before it was verified, so it must name the transaction the store vouched for
+            Right VerifiedStoreTransaction {transactionRef}
+              | transactionRef /= providerRef -> storeRefusalResponse $ SRVerifierFailed "verified a transaction other than the one claimed"
+            Right VerifiedStoreTransaction {quantity}
+              | quantity /= 1 -> storeRefusalResponse $ SRVerifierFailed $ "verified a quantity of " <> tshow quantity
+            Right VerifiedStoreTransaction {testPurchase = True} -> storeRefusalResponse $ SRInvalid "test purchase"
+            -- another key's credit is told only once the store vouched for the receipt, or it would reveal which transactions were credited
+            Right tx -> case credit of
+              Uncredited -> newPurchase tx
+              _ -> answerCredit credit
+  where
+    creditedBy = \case
+      Credited CreditedPurchase {purchaseKey = k} -> k == purchaseKey
+      _ -> False
+    answerCredit credit =
+      withDB' "answerStoreCredit" cc (\db -> creditedResponse db BSEReceiptUsed purchaseKey credit) <&> \case
+        Right (Left resp) -> resp
+        _ -> errorResponse BSEInternal
+    -- the product is read only for a receipt not yet credited, so retiring it leaves its replays answered
+    newPurchase VerifiedStoreTransaction {productId, paid} = case storeProduct provider productId of
+      Nothing -> pure $ errorResponse BSEProductUnavailable
+      Just StoreProduct {badgeType, months} -> do
+        now <- badgeNow cc
+        signFirstMonth key cc masterKey badgeType months (SCPayment Nothing) now >>= \case
+          Left resp -> pure resp
+          Right firstMonth -> do
+            paymentId <- randomId cc
+            r <- withDB "writeStorePurchase" cc $ \db ->
+              liftIO (createStorePurchase db NewStorePurchase {paymentId, provider, providerRef, paid, purchaseKey, masterKey, badgeType} now) >>= \case
+                -- Credited to another key, or to this one by a request that ran alongside it, while signing.
+                Nothing ->
+                  liftIO (getStorePaymentCredit db provider providerRef >>= creditedResponse db BSEReceiptUsed purchaseKey) >>= \case
+                    Left resp -> pure resp
+                    Right () -> logError ("badge service: a payment for " <> providerRef <> " exists but funds no purchase") $> errorResponse BSEInternal
+                Just purchaseId -> liftIO $ firstMonthResponse db purchaseId (Just paymentId) firstMonth
+            pure $ fromRight (errorResponse BSEInternal) r
+
+-- | The client learns only the code: a forged receipt, a refunded purchase and a test one are all receipt_invalid.
+storeRefusalResponse :: StoreRefusal -> IO BadgeServiceResponse
+storeRefusalResponse = \case
+  SRInvalid reason -> logInfo ("store receipt refused: " <> reason) $> errorResponse BSEReceiptInvalid
+  SRPending -> pure $ errorResponse BSEPaymentPending
+  SRUnreachable reason -> logWarn ("store unreachable: " <> reason) $> errorResponse BSEProviderUnavailable
+  SRVerifierFailed reason -> logError ("store receipt not verified: " <> reason) $> errorResponse BSEInternal
+  SRNotConfigured -> logWarn "store receipt refused: no verifier for this store is configured" $> errorResponse BSEProviderNotConfigured
+
+creditedResponse :: DB.Connection -> BadgeServiceErrorCode -> C.PublicKeyEd25519 -> FundingCredit -> IO (Either BadgeServiceResponse ())
+creditedResponse db usedCode purchaseKey = \case
+  Uncredited -> pure $ Right ()
+  CreditedUnreadable -> pure $ Left $ errorResponse BSEInternal
+  Credited CreditedPurchase {purchaseKey = k, badgePurchaseId, credential}
+    | k /= purchaseKey -> pure $ Left $ errorResponse usedCode
+    | otherwise ->
+        maybe (Left $ errorResponse BSEInternal) (Left . credentialResponse (Just credential) Nothing)
+          <$> getLedgerEntries db badgePurchaseId 0
+
+signFirstMonth :: BadgeIssuerKey -> ChatController -> BadgeMasterKey -> BadgeType -> Int -> StatementCreditType -> UTCTime -> IO (Either BadgeServiceResponse (StatementEntry, (StatementEntry, BadgeCredential)))
+signFirstMonth key cc masterKey badgeType months credit now = do
+  (grantUuid, issueUuid) <- (,) <$> randomId cc <*> randomId cc
+  -- TODO [badges] a top-up grants onto an existing ledger, and must lapse before it or the
+  -- months it adds are counted from a start already in the past
+  let granted = grantEntry now grantUuid months credit $ emptyEntry now badgeType
+  -- A grant of at least one month starting now always has a month to issue.
+  case issueEntry now issueUuid granted of
+    Nothing -> pure $ Left $ errorResponse BSEInternal
+    Just issued ->
+      credentialForEntry key masterKey issued >>= \case
+        Left e -> logError ("badge service signing failed: " <> T.pack e) $> Left (errorResponse BSEInternal)
+        Right signed -> pure $ Right (granted, signed)
+
+firstMonthResponse :: DB.Connection -> Int64 -> Maybe T.Text -> (StatementEntry, (StatementEntry, BadgeCredential)) -> IO BadgeServiceResponse
+firstMonthResponse db purchaseId creditPaymentId_ (granted, signed) = do
+  appendLedgerPlan db purchaseId creditPaymentId_ [granted] $ Just $ issuanceAfter granted signed
+  entries_ <- getLedgerEntries db purchaseId 0
+  pure $ maybe (errorResponse BSEInternal) (credentialResponse (Just $ snd signed) Nothing) entries_
 
 -- | The purchase is reached through the verified signer key and no other way.
 issueBadgeCmd :: BadgeIssuerKey -> ChatController -> C.PublicKeyEd25519 -> BadgeBalance -> IO BadgeServiceResponse
@@ -458,7 +564,7 @@ issueBadgeCmd key cc purchaseKey BadgeBalance {lastEntry} = do
     writeIssued purchaseId tip rows t issuance_ = do
       r <- withDB "issueBadge" cc $ \db -> liftIO $ do
         tip' <- getLedgerTip db purchaseId
-        when (fmap entryId tip' == fmap entryId tip) $ appendLedgerPlan db purchaseId rows issuance_
+        when (fmap entryId tip' == fmap entryId tip) $ appendLedgerPlan db purchaseId Nothing rows issuance_
         issueResponse db purchaseId t
       pure $ fromRight (errorResponse BSEInternal) r
     -- Only the asserted entry's identity is read, never the months it claims.
diff --git a/apps/simplex-badge-service/src/BadgeService/Store.hs b/apps/simplex-badge-service/src/BadgeService/Store.hs
index d8ab44c268..f81fbe4fe8 100644
--- a/apps/simplex-badge-service/src/BadgeService/Store.hs
+++ b/apps/simplex-badge-service/src/BadgeService/Store.hs
@@ -4,14 +4,17 @@
 {-# LANGUAGE OverloadedStrings #-}
 {-# LANGUAGE QuasiQuotes #-}
 {-# LANGUAGE ScopedTypeVariables #-}
+{-# LANGUAGE TypeOperators #-}
 
 module BadgeService.Store
   ( IssuedCode (..),
-    CodeRedemption (..),
-    RedeemedCode (..),
+    FundingCredit (..),
+    CreditedPurchase (..),
     NewCodePurchase (..),
+    NewStorePurchase (..),
     ServicePurchase (..),
     getBadgeCode,
+    getStorePaymentCredit,
     purchaseKeyExists,
     getPurchaseByKey,
     getLedgerTip,
@@ -20,13 +23,14 @@ module BadgeService.Store
     getCurrentIssuance,
     appendLedgerPlan,
     createCodePurchase,
+    createStorePurchase,
     insertBadgeCode,
     RevokeResult (..),
     revokeCode,
   )
 where
 
-import BadgeService.Store.Invoices (executeChanging)
+import BadgeService.Store.Invoices (executeChanging, paymentStatusText)
 import qualified Data.Aeson as J
 import Data.ByteString.Char8 (ByteString)
 import qualified Data.ByteString.Lazy.Char8 as LB
@@ -35,12 +39,14 @@ import Data.Text (Text)
 import Data.Time.Clock (UTCTime)
 import Simplex.Chat.Badges (BadgeCredential, BadgeMasterKey (..), BadgeType)
 import Simplex.Chat.Badges.Ledger
-import Simplex.Chat.Badges.Service (StatementEntry (..))
+import Simplex.Chat.Badges.Service (StatementCreditType (..), StatementEntry (..), StatementEntryType (..))
 import Simplex.Chat.Badges.Types (BadgeCodePaymentStatus, BadgePurchaseStatus (..))
+import Simplex.Chat.PaymentService.Types (CurrencyAmount (..), InvoiceId (..), PaymentProvider, PaymentStatus (..))
 import Simplex.Chat.Store.Shared (insertedRowId)
 import Simplex.Messaging.Agent.Store.DB (Binary (..))
 import qualified Simplex.Messaging.Agent.Store.DB as DB
 import qualified Simplex.Messaging.Crypto as C
+import Simplex.Messaging.Encoding.String (textEncode)
 import Simplex.Messaging.Util (maybeFirstRow, maybeFirstRow')
 
 #if defined(dbPostgres)
@@ -58,15 +64,15 @@ data IssuedCode = IssuedCode
     paymentStatus :: BadgeCodePaymentStatus,
     revokedAt :: Maybe UTCTime,
     expiresAt :: Maybe UTCTime,
-    redemption :: CodeRedemption
+    redemption :: FundingCredit
   }
 
-data CodeRedemption
-  = CodeUnredeemed
-  | CodeRedeemed RedeemedCode
-  | CodeRedeemedUnreadable
+data FundingCredit
+  = Uncredited
+  | Credited CreditedPurchase
+  | CreditedUnreadable
 
-data RedeemedCode = RedeemedCode
+data CreditedPurchase = CreditedPurchase
   { badgePurchaseId :: Int64,
     purchaseKey :: C.PublicKeyEd25519,
     credential :: BadgeCredential
@@ -79,6 +85,16 @@ data NewCodePurchase = NewCodePurchase
     badgeType :: BadgeType
   }
 
+data NewStorePurchase = NewStorePurchase
+  { paymentId :: Text,
+    provider :: PaymentProvider,
+    providerRef :: Text,
+    paid :: Maybe (CurrencyAmount, Text),
+    purchaseKey :: C.PublicKeyEd25519,
+    masterKey :: BadgeMasterKey,
+    badgeType :: BadgeType
+  }
+
 data ServicePurchase = ServicePurchase
   { badgePurchaseId :: Int64,
     masterKey :: BadgeMasterKey,
@@ -103,12 +119,31 @@ getBadgeCode db codeHash =
       (Only (Binary codeHash))
   where
     toCode (badgeCodeId, badgeType, months, paymentStatus, revokedAt, expiresAt, purchaseId_, purchaseKey_, credential_) =
-      IssuedCode {badgeCodeId, badgeType, months, paymentStatus, revokedAt, expiresAt, redemption = codeRedemption purchaseId_ purchaseKey_ credential_}
-    codeRedemption purchaseId_ purchaseKey_ credential_ = case (purchaseId_, purchaseKey_) of
-      (Just badgePurchaseId, Just purchaseKey) -> case decodeCredential =<< credential_ of
-        Just credential -> CodeRedeemed RedeemedCode {badgePurchaseId, purchaseKey, credential}
-        Nothing -> CodeRedeemedUnreadable
-      _ -> CodeUnredeemed
+      IssuedCode {badgeCodeId, badgeType, months, paymentStatus, revokedAt, expiresAt, redemption = fundingCredit purchaseId_ purchaseKey_ credential_}
+
+getStorePaymentCredit :: DB.Connection -> PaymentProvider -> Text -> IO FundingCredit
+getStorePaymentCredit db provider providerRef =
+  maybeFirstRow' Uncredited (\(purchaseId, purchaseKey, credential_) -> fundingCredit (Just purchaseId) (Just purchaseKey) credential_) $
+    DB.query
+      db
+      [sql|
+        SELECT p.badge_purchase_id, p.purchase_key, i.credential
+        FROM sx_badge_service_payments pay
+        JOIN sx_badge_service_badge_purchases p ON p.payment_id = pay.payment_id
+        LEFT JOIN sx_badge_service_badge_issuances i ON i.badge_purchase_id = p.badge_purchase_id
+        WHERE pay.provider = ? AND pay.provider_ref = ?
+        ORDER BY i.period_end DESC
+        LIMIT 1
+      |]
+      (textEncode provider, providerRef)
+
+fundingCredit :: Maybe Int64 -> Maybe C.PublicKeyEd25519 -> Maybe (Binary ByteString) -> FundingCredit
+fundingCredit purchaseId_ purchaseKey_ credential_ = case (purchaseId_, purchaseKey_) of
+  (Just badgePurchaseId, Just purchaseKey) -> case decodeCredential =<< credential_ of
+    Just credential -> Credited CreditedPurchase {badgePurchaseId, purchaseKey, credential}
+    Nothing -> CreditedUnreadable
+  _ -> Uncredited
+  where
     decodeCredential (Binary bs) = J.decodeStrict' bs
 
 purchaseKeyExists :: DB.Connection -> C.PublicKeyEd25519 -> IO Bool
@@ -137,11 +172,12 @@ getLedgerTip db purchaseId =
     DB.query
       db
       [sql|
-        SELECT entry_uuid, change_months, balance_months, balance_start_ts, balance_anchor_ts, balance_badge_type,
-               entry_type, entry_credit_type, entry_debit_type, service_created_at
-        FROM sx_badge_service_badge_ledger
-        WHERE badge_purchase_id = ?
-        ORDER BY entry_id DESC
+        SELECT l.entry_uuid, l.change_months, l.balance_months, l.balance_start_ts, l.balance_anchor_ts, l.balance_badge_type,
+               l.entry_type, l.entry_credit_type, l.entry_debit_type, l.service_created_at, l.payment_id, pay.invoice_id
+        FROM sx_badge_service_badge_ledger l
+        LEFT JOIN sx_badge_service_payments pay ON pay.payment_id = l.payment_id
+        WHERE l.badge_purchase_id = ?
+        ORDER BY l.entry_id DESC
         LIMIT 1
       |]
       (Only purchaseId)
@@ -161,18 +197,19 @@ getLedgerEntries db purchaseId afterEntryId =
     <$> DB.query
       db
       [sql|
-        SELECT entry_uuid, change_months, balance_months, balance_start_ts, balance_anchor_ts, balance_badge_type,
-               entry_type, entry_credit_type, entry_debit_type, service_created_at
-        FROM sx_badge_service_badge_ledger
-        WHERE badge_purchase_id = ? AND entry_id > ?
-        ORDER BY entry_id
+        SELECT l.entry_uuid, l.change_months, l.balance_months, l.balance_start_ts, l.balance_anchor_ts, l.balance_badge_type,
+               l.entry_type, l.entry_credit_type, l.entry_debit_type, l.service_created_at, l.payment_id, pay.invoice_id
+        FROM sx_badge_service_badge_ledger l
+        LEFT JOIN sx_badge_service_payments pay ON pay.payment_id = l.payment_id
+        WHERE l.badge_purchase_id = ? AND l.entry_id > ?
+        ORDER BY l.entry_id
       |]
       (purchaseId, afterEntryId)
 
-toEntry :: (Text, Int, Int, UTCTime, UTCTime, BadgeType, Text, Maybe Text, Maybe Text, UTCTime) -> Maybe StatementEntry
-toEntry (entryId, changeMonths, balanceMonths, balanceStartTs, balanceAnchorTs, balanceBadgeType, entryType_, credit_, debit_, createdAt) =
+toEntry :: (Text, Int, Int, UTCTime, UTCTime, BadgeType, Text, Maybe Text, Maybe Text, UTCTime) :. (Maybe Text, Maybe Text) -> Maybe StatementEntry
+toEntry ((entryId, changeMonths, balanceMonths, balanceStartTs, balanceAnchorTs, balanceBadgeType, entryType_, credit_, debit_, createdAt) :. (paymentId_, invoiceId_)) =
   (\entryType -> StatementEntry {entryId, changeMonths, balanceMonths, balanceStartTs, balanceAnchorTs, balanceBadgeType, wasPausedSince = Nothing, createdAt, entryType})
-    <$> entryTypeFromColumns entryType_ credit_ debit_
+    <$> entryTypeFromColumns ((InvoiceId <$> invoiceId_) <$ paymentId_) entryType_ credit_ debit_
 
 getCurrentIssuance :: DB.Connection -> Int64 -> UTCTime -> IO (Maybe BadgeCredential)
 getCurrentIssuance db purchaseId now = do
@@ -190,9 +227,10 @@ getCurrentIssuance db purchaseId now = do
     [Only (Binary bs)] -> J.decodeStrict' bs
     _ -> Nothing
 
--- TODO write the reference columns (payment_id, charge_id, from_purchase_id, to_purchase_id) for entry types that carry one; only the tag is written today.
-appendLedgerPlan :: DB.Connection -> Int64 -> [StatementEntry] -> Maybe (StatementEntry, StatementEntry, BadgeCredential) -> IO ()
-appendLedgerPlan db purchaseId rows issuance_ = do
+-- | creditPaymentId_ names the payment behind a payment credit among the rows.
+-- TODO write the other reference columns (charge_id, from_purchase_id, to_purchase_id) for entry types that carry one; only the tag is written today.
+appendLedgerPlan :: DB.Connection -> Int64 -> Maybe Text -> [StatementEntry] -> Maybe (StatementEntry, StatementEntry, BadgeCredential) -> IO ()
+appendLedgerPlan db purchaseId creditPaymentId_ rows issuance_ = do
   mapM_ appendRow rows
   case issuance_ of
     Nothing -> pure ()
@@ -211,15 +249,18 @@ appendLedgerPlan db purchaseId rows issuance_ = do
   where
     appendRow StatementEntry {entryId, changeMonths, balanceMonths, balanceStartTs, balanceAnchorTs, balanceBadgeType, createdAt, entryType} = do
       let (entryTypeT, creditType, debitType) = entryTypeColumns entryType
+          paymentId_ = case entryType of
+            SECredit SCPayment {} -> creditPaymentId_
+            _ -> Nothing
       DB.execute
         db
         [sql|
           INSERT INTO sx_badge_service_badge_ledger
             (entry_uuid, badge_purchase_id, change_months, balance_months, balance_start_ts, balance_anchor_ts,
-             balance_badge_type, service_created_at, created_at, entry_type, entry_credit_type, entry_debit_type)
-          VALUES (?,?,?,?,?,?,?,?,?,?,?,?)
+             balance_badge_type, service_created_at, created_at, entry_type, entry_credit_type, entry_debit_type, payment_id)
+          VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)
         |]
-        ((entryId, purchaseId, changeMonths, balanceMonths, balanceStartTs, balanceAnchorTs) :. (balanceBadgeType, createdAt, createdAt, entryTypeT, creditType, debitType))
+        ((entryId, purchaseId, changeMonths, balanceMonths, balanceStartTs, balanceAnchorTs) :. (balanceBadgeType, createdAt, createdAt, entryTypeT, creditType, debitType, paymentId_))
       insertedRowId db
 
 -- redeemed_at is stamped here, so this must run in the same transaction as the credential rows.
@@ -245,6 +286,32 @@ createCodePurchase db NewCodePurchase {badgeCodeId, purchaseKey, masterKey = Bad
         (purchaseKey, Binary mk, badgeType, badgeType, PSIssued, badgeCodeId, now, now)
       Just <$> insertedRowId db
 
+-- | In the transaction of the credential rows. The payment's unique (provider, provider_ref) is the
+-- claim: a transaction presented twice at once, or under another key, inserts nothing the second time.
+createStorePurchase :: DB.Connection -> NewStorePurchase -> UTCTime -> IO (Maybe Int64)
+createStorePurchase db NewStorePurchase {paymentId, provider, providerRef, paid, purchaseKey, masterKey = BadgeMasterKey mk, badgeType} now = do
+  claimed <-
+    executeChanging
+      db
+      [sql|
+        INSERT INTO sx_badge_service_payments (payment_id, provider, provider_ref, amount, currency, status, created_at, updated_at)
+        VALUES (?,?,?,?,?,?,?,?)
+        ON CONFLICT (provider, provider_ref) DO NOTHING
+      |]
+      (paymentId, textEncode provider, providerRef, (\(CurrencyAmount a) -> a) . fst <$> paid, snd <$> paid, paymentStatusText PSSettled, now, now)
+  if claimed == 0
+    then pure Nothing
+    else do
+      DB.execute
+        db
+        [sql|
+          INSERT INTO sx_badge_service_badge_purchases
+            (purchase_key, master_key, initial_badge_type, current_badge_type, status, payment_id, created_at, updated_at)
+          VALUES (?,?,?,?,?,?,?,?)
+        |]
+        (purchaseKey, Binary mk, badgeType, badgeType, PSIssued, paymentId, now, now)
+      Just <$> insertedRowId db
+
 data RevokeResult = Revoked | AlreadyRevoked | AlreadyRedeemed | NoSuchCode
   deriving (Eq, Show)
 
diff --git a/apps/simplex-badge-service/src/BadgeService/Store/Invoices.hs b/apps/simplex-badge-service/src/BadgeService/Store/Invoices.hs
index a3e177400e..57f9341308 100644
--- a/apps/simplex-badge-service/src/BadgeService/Store/Invoices.hs
+++ b/apps/simplex-badge-service/src/BadgeService/Store/Invoices.hs
@@ -17,7 +17,6 @@ module BadgeService.Store.Invoices
     getInvoice,
     getInvoiceByProviderRef,
     unpaidRefs,
-    providerText,
     codeHashExists,
     OverdueInvoice (..),
     overdueInvoices,
@@ -59,7 +58,7 @@ import Simplex.Chat.Store.Shared (insertedRowId)
 import Simplex.Chat.PaymentService.Types (CardProvider (..), CryptoCurrency (..), CurrencyAmount (..), InvoiceId (..), InvoiceStatus (..), PaymentProvider (..), PaymentStatus (..), ServicePaymentDestination (..))
 import Simplex.Messaging.Agent.Store.Common (DBStore, withConnection, withTransaction)
 import qualified Simplex.Messaging.Agent.Store.DB as DB
-import Simplex.Messaging.Encoding.String (textEncode)
+import Simplex.Messaging.Encoding.String (textDecode, textEncode)
 import Simplex.Messaging.Util (safeDecodeUtf8, tshow)
 
 #if defined(dbPostgres)
@@ -290,25 +289,6 @@ qSeedBadgeOffer =
     "INSERT INTO @badge_offers (offer_id, price_id, months, free_months, discount, status, created_at) "
       <> "VALUES (?,?,?,?,?,?,?) ON CONFLICT (offer_id) DO NOTHING"
 
-providerText :: PaymentProvider -> Text
-providerText = \case
-  PPApple -> "apple"
-  PPGoogle -> "google"
-  PPStripe -> "stripe"
-  PPCrypto -> "crypto"
-  PPCode -> "code"
-  PPReceipt -> "receipt"
-
-textToProvider :: Text -> Maybe PaymentProvider
-textToProvider = \case
-  "apple" -> Just PPApple
-  "google" -> Just PPGoogle
-  "stripe" -> Just PPStripe
-  "crypto" -> Just PPCrypto
-  "code" -> Just PPCode
-  "receipt" -> Just PPReceipt
-  _ -> Nothing
-
 cryptoCurrencyText :: CryptoCurrency -> Text
 cryptoCurrencyText CCBtc = "btc"
 cryptoCurrencyText CCXmr = "xmr"
@@ -380,7 +360,7 @@ mkInvoiceRow
       :. (cryptoAmt, expiresAt, statusTxt, createdAt)
       :. (pAmount, pCryptoPaid, pCryptoDue, pPaidInFull, pStatus, pUpdatedAt)
     ) = do
-    provider <- note "invoices.provider" (textToProvider providerTxt)
+    provider <- note "invoices.provider" (textDecode providerTxt)
     status <- note "invoices.status" (textToInvoiceStatus statusTxt)
     destination <- note "invoice payment destination" (mkDestination url addr cryptoCur cryptoAmt)
     pure
@@ -462,7 +442,7 @@ insertInvoiceRows db NewInvoice {..} = do
   DB.execute
     db
     qInsertInvoice
-    ( (invId, providerText niProvider, price, discountAmount, Nothing :: Maybe Word32, amount, niCurrency)
+    ( (invId, textEncode niProvider, price, discountAmount, Nothing :: Maybe Word32, amount, niCurrency)
         :. (url, addr, cryptoCur, cryptoAmt, expiresAt, invoiceStatusText ISOpen, createdAt, createdAt)
     )
   DB.execute
@@ -526,7 +506,7 @@ overdueInvoices st cutoff = withConnection st $ \db -> do
   rows <- DB.query db qOverdueInvoices (Only (truncateToSecond cutoff))
   either (E.throwIO . StoreDecodeError) pure (traverse toOverdue rows)
   where
-    toOverdue (i, providerTxt, oiProviderRef, oiCreatedAt) = case textToProvider providerTxt of
+    toOverdue (i, providerTxt, oiProviderRef, oiCreatedAt) = case textDecode providerTxt of
       Just oiProvider -> Right OverdueInvoice {oiInvoiceId = InvoiceId i, oiProvider, oiProviderRef, oiCreatedAt}
       Nothing -> Left ("invoices.provider: " <> providerTxt)
 
@@ -591,7 +571,7 @@ upsertPayment db InvoiceRow {irInvoiceId, irProvider, irProviderRef, irCurrency}
   DB.execute
     db
     qUpsertPayment
-    ( (invId, invId, providerText irProvider, irProviderRef, amount)
+    ( (invId, invId, textEncode irProvider, irProviderRef, amount)
         :. (irCurrency, cryptoAmount, cryptoDue, if paidInFull then 1 :: Int else 0, paymentStatusText status, at, at)
     )
   where
diff --git a/apps/simplex-badge-service/src/BadgeService/Store/Postgres/Migrations.hs b/apps/simplex-badge-service/src/BadgeService/Store/Postgres/Migrations.hs
index c8179d5df2..a58df6d02b 100644
--- a/apps/simplex-badge-service/src/BadgeService/Store/Postgres/Migrations.hs
+++ b/apps/simplex-badge-service/src/BadgeService/Store/Postgres/Migrations.hs
@@ -17,7 +17,8 @@ badgeServiceSchemaMigrations = sortOn name $ map migration schemaMigrations
 
 schemaMigrations :: [(String, Text, Maybe Text)]
 schemaMigrations =
-  [ ("20260915_badge_service_schema", m20260915_badge_service_schema, Just down_m20260915_badge_service_schema)
+  [ ("20260915_badge_service_schema", m20260915_badge_service_schema, Just down_m20260915_badge_service_schema),
+    ("20260925_badge_store_receipts", m20260925_badge_store_receipts, Just down_m20260925_badge_store_receipts)
   ]
 
 -- | The client tables share this database, so the service tables are the same names behind a prefix.
@@ -109,6 +110,44 @@ DROP INDEX @idx_badge_purchases_code;
 DROP TABLE @badge_codes;
 |]
 
+m20260925_badge_store_receipts :: Text
+m20260925_badge_store_receipts =
+  withPrefix
+    servicePrefix
+    -- The unique provider_ref is what makes one store transaction fund one purchase: presented twice
+    -- at once, or under two keys, only one insert of its payment succeeds.
+    [r|
+DROP INDEX @idx_payments_provider_ref;
+
+CREATE UNIQUE INDEX @idx_payments_provider_ref ON @payments(provider, provider_ref);
+
+ALTER TABLE @badge_purchases ADD COLUMN payment_id TEXT REFERENCES @payments;
+
+CREATE UNIQUE INDEX @idx_badge_purchases_payment ON @badge_purchases(payment_id);
+
+ALTER TABLE @badge_ledger ADD COLUMN payment_id TEXT REFERENCES @payments;
+
+CREATE INDEX @idx_badge_ledger_payment ON @badge_ledger(payment_id);
+|]
+
+down_m20260925_badge_store_receipts :: Text
+down_m20260925_badge_store_receipts =
+  withPrefix
+    servicePrefix
+    [r|
+DROP INDEX @idx_badge_ledger_payment;
+
+ALTER TABLE @badge_ledger DROP COLUMN payment_id;
+
+DROP INDEX @idx_badge_purchases_payment;
+
+ALTER TABLE @badge_purchases DROP COLUMN payment_id;
+
+DROP INDEX @idx_payments_provider_ref;
+
+CREATE INDEX @idx_payments_provider_ref ON @payments(provider, provider_ref);
+|]
+
 {- TODO [badges] deferred with the draft in M20260915_user_badges, service only.
 
 ALTER TABLE @payments ADD COLUMN receipt_hash BYTEA;
diff --git a/apps/simplex-badge-service/src/BadgeService/Store/SQLite/Migrations.hs b/apps/simplex-badge-service/src/BadgeService/Store/SQLite/Migrations.hs
index bf022f189c..fed5fd5ed0 100644
--- a/apps/simplex-badge-service/src/BadgeService/Store/SQLite/Migrations.hs
+++ b/apps/simplex-badge-service/src/BadgeService/Store/SQLite/Migrations.hs
@@ -18,7 +18,8 @@ badgeServiceSchemaMigrations = sortOn name $ map migration schemaMigrations
 
 schemaMigrations :: [(String, Query, Maybe Query)]
 schemaMigrations =
-  [ ("20260915_badge_service_schema", m20260915_badge_service_schema, Just down_m20260915_badge_service_schema)
+  [ ("20260915_badge_service_schema", m20260915_badge_service_schema, Just down_m20260915_badge_service_schema),
+    ("20260925_badge_store_receipts", m20260925_badge_store_receipts, Just down_m20260925_badge_store_receipts)
   ]
 
 -- | The client tables share this database, so the service tables are the same names behind a prefix.
@@ -110,6 +111,44 @@ DROP INDEX @idx_badge_purchases_code;
 DROP TABLE @badge_codes;
 |]
 
+m20260925_badge_store_receipts :: Query
+m20260925_badge_store_receipts =
+  withPrefix
+    servicePrefix
+    -- The unique provider_ref is what makes one store transaction fund one purchase: presented twice
+    -- at once, or under two keys, only one insert of its payment succeeds.
+    [sql|
+DROP INDEX @idx_payments_provider_ref;
+
+CREATE UNIQUE INDEX @idx_payments_provider_ref ON @payments(provider, provider_ref);
+
+ALTER TABLE @badge_purchases ADD COLUMN payment_id TEXT REFERENCES @payments;
+
+CREATE UNIQUE INDEX @idx_badge_purchases_payment ON @badge_purchases(payment_id);
+
+ALTER TABLE @badge_ledger ADD COLUMN payment_id TEXT REFERENCES @payments;
+
+CREATE INDEX @idx_badge_ledger_payment ON @badge_ledger(payment_id);
+|]
+
+down_m20260925_badge_store_receipts :: Query
+down_m20260925_badge_store_receipts =
+  withPrefix
+    servicePrefix
+    [sql|
+DROP INDEX @idx_badge_ledger_payment;
+
+ALTER TABLE @badge_ledger DROP COLUMN payment_id;
+
+DROP INDEX @idx_badge_purchases_payment;
+
+ALTER TABLE @badge_purchases DROP COLUMN payment_id;
+
+DROP INDEX @idx_payments_provider_ref;
+
+CREATE INDEX @idx_payments_provider_ref ON @payments(provider, provider_ref);
+|]
+
 {- TODO [badges] deferred with the draft in M20260915_user_badges, service only.
 
 ALTER TABLE @payments ADD COLUMN receipt_hash BLOB;
diff --git a/apps/simplex-badge-service/src/BadgeService/StoreReceipts.hs b/apps/simplex-badge-service/src/BadgeService/StoreReceipts.hs
new file mode 100644
index 0000000000..b623944c46
--- /dev/null
+++ b/apps/simplex-badge-service/src/BadgeService/StoreReceipts.hs
@@ -0,0 +1,101 @@
+{-# LANGUAGE DuplicateRecordFields #-}
+{-# LANGUAGE LambdaCase #-}
+{-# LANGUAGE NamedFieldPuns #-}
+{-# LANGUAGE OverloadedStrings #-}
+
+module BadgeService.StoreReceipts
+  ( VerifiedStoreTransaction (..),
+    StoreRefusal (..),
+    StoreVerifier (..),
+    StoreReceipt (..),
+    noStoreVerifier,
+    toStoreReceipt,
+  )
+where
+
+import Control.Exception (evaluate)
+import Data.Bifunctor (first)
+import Data.Char (isAsciiLower, isAsciiUpper, isDigit)
+import Data.Maybe (fromMaybe)
+import Data.Text (Text)
+import qualified Data.Text as T
+import Simplex.Chat.PaymentService (ServicePayment (..), appleTransactionId, googlePurchaseRef)
+import Simplex.Chat.PaymentService.Types (CurrencyAmount, PaymentProvider (..), StoreTransactionRef (..))
+import Simplex.Messaging.Util (catchOwn')
+import System.Timeout (timeout)
+
+-- | What a store vouches for about one completed transaction.
+-- TODO [badges] PaymentFunding's PFApple and PFGoogle sketch the same thing and have no producer;
+-- delete them, or build them out and reconcile.
+data VerifiedStoreTransaction = VerifiedStoreTransaction
+  { transactionRef :: Text, -- from what was verified: Apple's transactionId, googlePurchaseRef of the token asked about
+    productId :: Text,
+    quantity :: Int, -- as the store reported it; the service refuses any but 1, as the apps never buy more
+    -- costs the buyer nothing: Apple's Sandbox, which a public TestFlight build buys in, and Google's license testers
+    testPurchase :: Bool,
+    paid :: Maybe (CurrencyAmount, Text) -- in minor units; Google's purchase record carries no price
+  }
+  deriving (Eq, Show)
+
+-- | The reasons are for the service's log alone and must never quote the receipt.
+data StoreRefusal
+  = SRInvalid Text -- a verdict that cannot change, and the client consumes the purchase: forged, malformed, another app's, refunded
+  | SRPending -- a real purchase the store has not settled; it may yet
+  | SRUnreachable Text -- no verdict: the store was not asked, did not answer, or does not know the token (a Play 404 may be lag)
+  | SRVerifierFailed Text -- a bug, not the store's answer
+  | SRNotConfigured -- no verifier for this store is deployed; the purchase may be real
+  deriving (Eq, Show)
+
+-- | Apple signs its receipt and ships the certificate chain in it, so it is verified with no network
+-- call; a Play token is opaque and must be asked about, which is why only that field is in IO.
+data StoreVerifier = StoreVerifier
+  { verifyApple :: Maybe (Text -> Either Text VerifiedStoreTransaction), -- the JWS; Left is why Apple did not sign it
+    verifyGoogle :: Maybe (Text -> Text -> IO (Either StoreRefusal VerifiedStoreTransaction)), -- the product id and the token
+    -- microseconds; requests are answered one at a time, so a verifier that does not finish holds up every other one
+    verifyTimeout :: Int
+  }
+
+-- | A store payment, named by the store's own reference before anything is verified.
+data StoreReceipt = StoreReceipt
+  { txRef :: StoreTransactionRef,
+    verifyReceipt :: IO (Either StoreRefusal VerifiedStoreTransaction)
+  }
+
+noStoreVerifier :: StoreVerifier
+noStoreVerifier = StoreVerifier {verifyApple = Nothing, verifyGoogle = Nothing, verifyTimeout = 10000000}
+
+-- | Nothing for a payment no store made. Exceptions are not logged, since they can quote the receipt
+-- or, from Google, a URL holding the token.
+toStoreReceipt :: StoreVerifier -> ServicePayment -> Maybe (Either StoreRefusal StoreReceipt)
+toStoreReceipt StoreVerifier {verifyApple, verifyGoogle, verifyTimeout} = \case
+  SPApple {jws} -> Just $ case appleTransactionId jws of
+    Nothing -> Left $ SRInvalid "names no transaction"
+    Just ref -> Right $ StoreReceipt (StoreTransactionRef PPApple ref) $ maybe unconfigured (\verify -> offline $ first SRInvalid $ verify jws) verifyApple
+  SPGoogle {productId, token}
+    -- the claim is the token's hash, so neither string may name any purchase but the one it claims,
+    -- whatever path a verifier builds from them
+    | not (googleProductId productId) -> Just $ Left $ SRInvalid "not a Play product id"
+    -- Play documents no token grammar, so this is our guess, and refusing to ask Play is not its verdict
+    | not (googleToken token) -> Just $ Left $ SRUnreachable "a Play token this service will not send"
+    | otherwise -> Just $ Right $ StoreReceipt (StoreTransactionRef PPGoogle (googlePurchaseRef token)) $ maybe unconfigured (\verify -> online $ verify productId token) verifyGoogle
+  SPInvoice {} -> Nothing
+  SPReceipt {} -> Nothing
+  where
+    unconfigured = pure $ Left SRNotConfigured
+    -- nothing was fetched, so a throw or an overrun is a bug or a malformed receipt, never an outage
+    offline verdict =
+      (fromMaybe (Left $ SRVerifierFailed "apple verifier timed out") <$> timeout verifyTimeout (forced verdict))
+        `catchOwn'` \_ -> pure $ Left $ SRVerifierFailed "apple verifier threw"
+    online verify =
+      (fromMaybe (Left $ SRUnreachable "google verifier timed out") <$> timeout verifyTimeout (verify >>= forced))
+        `catchOwn'` \_ -> pure $ Left $ SRUnreachable "google verifier threw"
+    -- a verdict holding a thunk that throws would otherwise throw later, outside these handlers
+    forced = either (fmap Left . evaluate) (fmap Right . evaluate)
+
+googleProductId :: Text -> Bool
+googleProductId pid = case T.uncons pid of
+  Just (c, _) -> T.length pid <= 150 && (isAsciiLower c || isDigit c) && T.all (\x -> isAsciiLower x || isDigit x || x == '_' || x == '.') pid
+  Nothing -> False
+
+googleToken :: Text -> Bool
+googleToken t = not (T.null t) && T.length t <= 4096 && T.all (\x -> isAsciiLower x || isAsciiUpper x || isDigit x || x == '.' || x == '_' || x == '-') t
diff --git a/apps/simplex-badge-service/src/BadgeService/StoreReceipts/Mock.hs b/apps/simplex-badge-service/src/BadgeService/StoreReceipts/Mock.hs
new file mode 100644
index 0000000000..c2fd1ab63d
--- /dev/null
+++ b/apps/simplex-badge-service/src/BadgeService/StoreReceipts/Mock.hs
@@ -0,0 +1,41 @@
+{-# LANGUAGE NamedFieldPuns #-}
+{-# LANGUAGE OverloadedStrings #-}
+
+module BadgeService.StoreReceipts.Mock (mockStoreVerifier) where
+
+import BadgeService.StoreReceipts
+import qualified Data.Aeson as J
+import qualified Data.Aeson.KeyMap as JM
+import qualified Data.ByteString.Base64.URL as B64U
+import Data.Text (Text)
+import qualified Data.Text as T
+import Data.Text.Encoding (encodeUtf8)
+import Simplex.Chat.PaymentService (appleTransactionId, googlePurchaseRef)
+import Simplex.Messaging.Util (eitherToMaybe)
+
+-- | Vouches for any well-formed receipt without verifying anything. Each transaction is named by
+-- the same function its claim is named by, so the two cannot differ.
+mockStoreVerifier :: StoreVerifier
+mockStoreVerifier = noStoreVerifier {verifyApple = Just mockApple, verifyGoogle = Just mockGoogle}
+
+mockApple :: Text -> Either Text VerifiedStoreTransaction
+mockApple signed = case T.splitOn "." signed of
+  [_, payload, _] -> do
+    o <- case J.decodeStrict' =<< eitherToMaybe (B64U.decodeUnpadded $ encodeUtf8 payload) of
+      Just (J.Object obj) -> Right obj
+      _ -> Left "payload is not base64url JSON"
+    productId <- case JM.lookup "productId" o of
+      Just (J.String p) -> Right p
+      _ -> Left "no productId"
+    transactionRef <- maybe (Left "no transactionId") Right $ appleTransactionId signed
+    Right $ vouched transactionRef productId
+  _ -> Left "not three dot-separated parts"
+
+mockGoogle :: Text -> Text -> IO (Either StoreRefusal VerifiedStoreTransaction)
+mockGoogle productId token = pure $ Right $ vouched (googlePurchaseRef token) productId
+
+vouched :: Text -> Text -> VerifiedStoreTransaction
+vouched transactionRef productId =
+  -- not a test purchase, though nothing was paid: a test purchase is refused as receipt_invalid, which is
+  -- terminal and drops the client's keys, so every dev purchase would fail for good
+  VerifiedStoreTransaction {transactionRef, productId, quantity = 1, testPurchase = False, paid = Nothing}
diff --git a/apps/simplex-badge-service/test-fixtures/apple/transaction-legend.json b/apps/simplex-badge-service/test-fixtures/apple/transaction-legend.json
new file mode 100644
index 0000000000..72ee85416c
--- /dev/null
+++ b/apps/simplex-badge-service/test-fixtures/apple/transaction-legend.json
@@ -0,0 +1,19 @@
+{
+  "transactionId": "2000000812345672",
+  "originalTransactionId": "2000000812345672",
+  "bundleId": "chat.simplex.app",
+  "productId": "BADGE_LEGEND_01",
+  "purchaseDate": 1790000000000,
+  "originalPurchaseDate": 1790000000000,
+  "quantity": 1,
+  "type": "Consumable",
+  "appAccountToken": "0b6a7e1d-5c3f-4a8e-b2d4-9e1f6c7a8b20",
+  "inAppOwnershipType": "PURCHASED",
+  "signedDate": 1790000001000,
+  "environment": "Production",
+  "transactionReason": "PURCHASE",
+  "storefront": "USA",
+  "storefrontId": "143441",
+  "price": 70000,
+  "currency": "USD"
+}
diff --git a/apps/simplex-badge-service/test-fixtures/apple/transaction-sandbox.json b/apps/simplex-badge-service/test-fixtures/apple/transaction-sandbox.json
new file mode 100644
index 0000000000..e61c63d2a7
--- /dev/null
+++ b/apps/simplex-badge-service/test-fixtures/apple/transaction-sandbox.json
@@ -0,0 +1,19 @@
+{
+  "transactionId": "2000000812345673",
+  "originalTransactionId": "2000000812345673",
+  "bundleId": "chat.simplex.app",
+  "productId": "BADGE_LEGEND_01",
+  "purchaseDate": 1790000000000,
+  "originalPurchaseDate": 1790000000000,
+  "quantity": 1,
+  "type": "Consumable",
+  "appAccountToken": "4d2c9a61-8e3b-4f70-a1c5-6b0e9d2f3a47",
+  "inAppOwnershipType": "PURCHASED",
+  "signedDate": 1790000001000,
+  "environment": "Sandbox",
+  "transactionReason": "PURCHASE",
+  "storefront": "USA",
+  "storefrontId": "143441",
+  "price": 70000,
+  "currency": "USD"
+}
diff --git a/apps/simplex-badge-service/test-fixtures/apple/transaction-supporter.json b/apps/simplex-badge-service/test-fixtures/apple/transaction-supporter.json
new file mode 100644
index 0000000000..267184c036
--- /dev/null
+++ b/apps/simplex-badge-service/test-fixtures/apple/transaction-supporter.json
@@ -0,0 +1,19 @@
+{
+  "transactionId": "2000000812345671",
+  "originalTransactionId": "2000000812345671",
+  "bundleId": "chat.simplex.app",
+  "productId": "BADGE_SUPPORTER_01",
+  "purchaseDate": 1790000000000,
+  "originalPurchaseDate": 1790000000000,
+  "quantity": 1,
+  "type": "Consumable",
+  "appAccountToken": "7f7c0f43-4b7b-4c2e-9d57-1b7a2b1f3c11",
+  "inAppOwnershipType": "PURCHASED",
+  "signedDate": 1790000001000,
+  "environment": "Production",
+  "transactionReason": "PURCHASE",
+  "storefront": "USA",
+  "storefrontId": "143441",
+  "price": 7000,
+  "currency": "USD"
+}
diff --git a/bots/api/TYPES.md b/bots/api/TYPES.md
index f1122979a9..338fa6c206 100644
--- a/bots/api/TYPES.md
+++ b/bots/api/TYPES.md
@@ -441,6 +441,9 @@ Remote controller app version range (min and max as version strings).
 InvalidCode:
 - type: "invalidCode"
 
+InvalidReceipt:
+- type: "invalidReceipt"
+
 ServiceNotConfigured:
 - type: "serviceNotConfigured"
 
@@ -477,6 +480,7 @@ CredentialNotVerified:
 - "payment_not_entitled"
 - "payment_pending"
 - "provider_unavailable"
+- "provider_not_configured"
 - "rate_limited"
 - "code_invalid"
 - "code_used"
diff --git a/bots/src/API/Docs/Commands.hs b/bots/src/API/Docs/Commands.hs
index 4ffba7bfbe..ae1789f47e 100644
--- a/bots/src/API/Docs/Commands.hs
+++ b/bots/src/API/Docs/Commands.hs
@@ -361,6 +361,7 @@ undocumentedCommands =
     "APIConnectPreparedGroup",
     "APIContactInfo",
     "APIContactQueueInfo",
+    "APICreateBadgeInvoice",
     "APICreateChatItems",
     "APICreateChatTag",
     "APICreateMemberContact",
@@ -407,6 +408,7 @@ undocumentedCommands =
     "APIPlanForwardChatItems",
     "APIPrepareContact",
     "APIPrepareGroup",
+    "APIPurchaseBadge",
     "APIRedeemBadgeCode",
     "APIRegisterToken",
     "APIRejectCall",
diff --git a/bots/src/API/Docs/Events.hs b/bots/src/API/Docs/Events.hs
index dab06e9262..e35cd6ffe5 100644
--- a/bots/src/API/Docs/Events.hs
+++ b/bots/src/API/Docs/Events.hs
@@ -221,6 +221,7 @@ undocumentedEvents =
     "CEvtSndFileRedirectStartXFTP",
     "CEvtSndFileStart", -- legacy SMP files
     "CEvtSndStandaloneFileComplete",
+    "CEvtStorePurchaseResolved",
     "CEvtConnectionsDiff",
     "CEvtSubscriptionEnd",
     "CEvtTerminalEvent",
diff --git a/bots/src/API/Docs/Responses.hs b/bots/src/API/Docs/Responses.hs
index 18392ae1b5..674620487f 100644
--- a/bots/src/API/Docs/Responses.hs
+++ b/bots/src/API/Docs/Responses.hs
@@ -134,6 +134,7 @@ undocumentedResponses =
     "CRAppSettings",
     "CRArchiveExported",
     "CRArchiveImported",
+    "CRBadgeInvoice",
     "CRBadgeLedger",
     "CRBadgeRedeemed",
     "CRBadgeState",
diff --git a/docs/protocol/badges-rpc.md b/docs/protocol/badges-rpc.md
index 8ea70e1d19..b35e6b8001 100644
--- a/docs/protocol/badges-rpc.md
+++ b/docs/protocol/badges-rpc.md
@@ -20,21 +20,28 @@ A timeout hides the outcome, so the client repeats the identical signed request
 
 - `getBadgeInvoice` — returns the open invoice again; a new invoice is created only when none is open.
 - `redeemBadgeCode` — a code already redeemed by the signing key returns the same `badgeCredential` and writes nothing; redeemed by another key, `code_used`. The client must therefore keep the key it first signed with, or a retry cannot be recognised.
-- `purchaseBadge` — a payment already credited returns the same `badgeCredential` and writes nothing.
+- `purchaseBadge` — a payment already credited returns the same `badgeCredential` and writes nothing; a store payment credited to another key, `receipt_used`.
 - `upgradeBadgeSubscription` — evidence already applied returns the same result and writes nothing.
 - `issueBadge` — repeated within an issued period, returns the cached credential and writes nothing.
-- `purchaseBadge` with a `receipt` — presented again by the same key it returns the same result; presented by another key, `receipt_used`.
+- `purchaseBadge` with the recovery `receipt` — presented again by the same key it returns the same result; presented by another key, `receipt_used`.
 
 ## Commands
 
-`purchaseBadge` and `upgradeBadgeSubscription` carry `badgeRequest`, the signer's input (`BadgeRequest`, `Simplex.Chat.Badges`): the service signs exactly this content or rejects the command. The proposed `badgeExpiry` is capped by the funded coverage (`sundayAfter`, model §3) and is required — a credential always expires, and a badge that does not is expressed as a long finite term; `badgeExtra` is reserved and must be empty. `issueBadge` carries no `badgeRequest`: the tier, the master key and the expiry are all the service's own, so there is nothing for the client to state.
+The client never states what is signed. The tier is that of whatever funded the purchase; the expiry is the `sundayAfter` of the period issued (`endOfMondayAfter` in code), shared by every credential of that week; `badgeExtra` is reserved and empty. A client-proposed expiry, even one capped by the funded coverage, would fall off that shared boundary and single its holder out of the week's anonymity set — so no command carries `badgeRequest`. `upgradeBadgeSubscription` still has the field in the schema; that is wrong and it must be dropped when the command is implemented.
 
 - `getBadgeCatalog` → `badgeCatalog` — the prices and offers; signed, also the purchase's `badgeStatement`. Store builds never send it: prices come from the store and SKUs from app config.
 - `getBadgeInvoice` → `badgeInvoice` — prices the purchase for `badgeInfo` and `paymentVia` (`card` — Stripe; `crypto` — btc, xmr). The response holds the generic `invoice` — `invoiceId`, `price`, `discount`, the upgrade `credit`, `amount` = price − discount − credit, `currency`, `expiresAt`, and `paymentTo` (`url` for card; `address` and `cryptoAmount` for crypto) — beside the badge part, `badgeType` and `months`. `priceId` pins the price the client displayed; `offerId` selects a discounted duration, and its absence buys one month at that price. Price and offer status is checked here only: `deprecated` is still accepted, `disabled` is rejected; a badge type with no active price yields `product_unavailable`.
 - `redeemBadgeCode` → `badgeCredential` — redeems a code, records the credit, and issues the first credential, in one round trip. It carries `masterKey` and `code` and no `badgeRequest`: a code states no tier and no expiry, so the credential is what reports them. Errors: `code_invalid` for an unknown or malformed code, `code_used` when another key redeemed it, `code_expired` past a redemption deadline.
-- `purchaseBadge` → `badgeCredential` — verifies the funding (`apple` JWS offline; `google` token via the Publisher API; `invoice` against webhook-confirmed settlement, `payment_pending` until it lands; `receipt`), records the credit, and issues the first credential, in one round trip. The response `receipt` is the recovery bearer secret (model § recovery); the service stores its hash; lifetime badges receive none.
+- `purchaseBadge` → `badgeCredential` — verifies the funding (`apple` JWS offline; `google` product id and token via the Publisher API; `invoice` against webhook-confirmed settlement, `payment_pending` until it lands; `receipt`), records the credit, and issues the first credential, in one round trip. It carries `masterKey` and no `badgeRequest`. The response `receipt` is the recovery bearer secret (model § recovery); the service stores its hash; lifetime badges receive none.
+  - A store transaction is claimed by its own id, read from the evidence before verification, and credited only when the verified transaction carries that same id. A receipt already credited to the signing key is answered from the record, without asking the store.
+  - Errors: `receipt_invalid`, `payment_pending`, `provider_unavailable` — see the classes below; `receipt_used` when another key was credited with it; `product_unavailable` for a product this service does not price; `provider_not_configured` when this deployment has no verifier for the store, terminal for the request since retrying cannot deploy one. `receipt_invalid` and `receipt_used` are the only answers on which the client drops the keys it signed with and finishes the store transaction. Every other answer records nothing and leaves the purchase with its keys, to be presented again at the next trigger.
+  - **Which class an answer belongs to.** The two mistakes do not cost the same, so when it is not certain, answer unreachable. `receipt_invalid` tells the client the purchase is dead: it drops the keys it signed with and finishes the store transaction — consumed on Play, finished on StoreKit — and nothing can present it again, so a buyer answered this by mistake has paid for a badge they can never receive. Answering unreachable by mistake costs one more verification request each time the app presents the purchase again, and a Play purchase left unacknowledged for three days is refunded to the buyer.
+    - **Terminal**, `receipt_invalid` — the store answered about this purchase and cannot change its mind: an Apple signature or certificate chain that does not verify, another app's bundle id, a test purchase (Apple Sandbox, Play `purchaseType` test), a refunded or revoked purchase, Play `purchaseState` canceled.
+    - **Pending**, `payment_pending` — Play `purchaseState` pending.
+    - **Unreachable**, `provider_unavailable` — the store was not asked or did not answer: network, timeout, 5xx, quota, this service's own auth or permission failures, and every Play error response, a 404 from `purchases.products.get` or `purchases.subscriptionsv2.get` and a 400 or 410 calling the token invalid included. A 404 decides nothing: Play answers it both for a token it has just issued and not yet recorded, and for one that was never a purchase. Only a purchase record is a verdict. A token whose characters this service will not send is never sent, so Play never answers about it — and Play documents no token grammar, so that check is our guess, not its verdict. A product id outside the characters Play does document is terminal, since no product of this app can have one.
+    - Apple is verified offline, so it has no "not yet" and a negative answer about the signed evidence is terminal. Two things are not the store's answer and leave the client holding the purchase: the verifier's own failure, such as a root certificate it could not load, which is `internal`; and a product this service does not price, which is `product_unavailable` — the verifier vouched for the transaction either way.
   - Funding by `receipt` is a transfer (post-MVP): the unissued months of the purchase that receipt belongs to move to the signing key, recorded as `debit(transferOut)` on the source and `credit(transferIn)` on the new purchase, and the presented receipt is retired for a fresh one. The transferred period's issuance debits a month like any other. Lifetime badges hold no receipt, so support handles them.
-- `upgradeBadgeSubscription` → `badgeCredential` — the app-led store subscription change, on the same key: verifies the store evidence of the replaced subscription and records the new plan; an immediate upgrade returns the new credential, a deferred change returns none.
+- `upgradeBadgeSubscription` → `badgeCredential` — the app-led store subscription change, on the same key: verifies the store evidence of the replaced subscription and records the new plan; an immediate upgrade returns the new credential, a deferred change returns none. Its `badgeRequest` is to be dropped (see above).
 - `issueBadge` → `badgeCredential` — issues the next period from the balance, the only source of issuance. It carries `balance` alone: the credential is signed with the purchase's stored master key, for the type the balance funds, expiring at the `sundayAfter` of the period issued. The ledger is advanced first; the credential is signed before the `debit(badge)` and issuance rows are written, in one transaction. An exhausted balance yields no `credential`; the `statement` shows why. Issuing on a paused badge resumes it (model 2.13).
 - `pauseBadge` (post-MVP) → `badgeCredential` — suspends issuance and lapse (model 2.13).
 
@@ -63,4 +70,4 @@ An assertion that names an entry the service holds is a prefix: the service proc
 
 ## Errors
 
-`retryAfter` marks the transient codes: `payment_pending`, `provider_unavailable`, `rate_limited`. `offer_disabled` calls for a catalog refresh. `code_invalid` covers unknown, malformed and revoked codes alike, so a guesser learns nothing from the difference; `code_used` — redeemed under another key; `code_expired` — past its redemption deadline. `receipt_invalid` covers unknown receipts. All other codes are terminal for the attempted command.
+`retryAfter` marks the transient codes: `payment_pending`, `provider_unavailable`, `rate_limited`. `offer_disabled` calls for a catalog refresh. `code_invalid` covers unknown, malformed and revoked codes alike, so a guesser learns nothing from the difference; `code_used` — redeemed under another key; `code_expired` — past its redemption deadline. `receipt_invalid` covers forged, malformed, another app's, refunded and test receipts alike, so a guesser learns nothing from the difference; `receipt_used` — credited to another key; `provider_not_configured` — no verifier for that store is deployed, so the receipt is neither credited nor refused. All other codes are terminal for the attempted command.
diff --git a/docs/protocol/badges-rpc.schema.json b/docs/protocol/badges-rpc.schema.json
index 01581a5bac..f9ca9d4a14 100644
--- a/docs/protocol/badges-rpc.schema.json
+++ b/docs/protocol/badges-rpc.schema.json
@@ -95,7 +95,7 @@
           "properties": {"jws": {"type": "string"}}
         },
         "google": {
-          "properties": {"token": {"type": "string"}}
+          "properties": {"productId": {"type": "string"}, "token": {"type": "string"}}
         },
         "invoice": {
           "properties": {"invoiceId": {"type": "string"}}
@@ -309,7 +309,7 @@
         },
         "purchaseBadge": {
           "properties": {
-            "badgeRequest": {"ref": "badgeRequest"},
+            "masterKey": {"ref": "base64url"},
             "payment": {"ref": "payment"}
           },
           "optionalProperties": {
@@ -321,7 +321,10 @@
         },
         "upgradeBadgeSubscription": {
           "properties": {
-            "badgeRequest": {"ref": "badgeRequest"},
+            "badgeRequest": {
+              "ref": "badgeRequest",
+              "metadata": {"comment": "known wrong: to be dropped when implemented, see badges-rpc.md"}
+            },
             "payment": {
               "ref": "payment",
               "metadata": {"comment": "store payments only"}
diff --git a/packages/simplex-chat-client/types/typescript/src/types.ts b/packages/simplex-chat-client/types/typescript/src/types.ts
index d7db7f259f..56fa0b389e 100644
--- a/packages/simplex-chat-client/types/typescript/src/types.ts
+++ b/packages/simplex-chat-client/types/typescript/src/types.ts
@@ -249,6 +249,7 @@ export interface BadgeProof {
 
 export type BadgeRedeemError = 
   | BadgeRedeemError.InvalidCode
+  | BadgeRedeemError.InvalidReceipt
   | BadgeRedeemError.ServiceNotConfigured
   | BadgeRedeemError.BadgeActive
   | BadgeRedeemError.ServiceError
@@ -259,6 +260,7 @@ export type BadgeRedeemError =
 export namespace BadgeRedeemError {
   export type Tag = 
     | "invalidCode"
+    | "invalidReceipt"
     | "serviceNotConfigured"
     | "badgeActive"
     | "serviceError"
@@ -274,6 +276,10 @@ export namespace BadgeRedeemError {
     type: "invalidCode"
   }
 
+  export interface InvalidReceipt extends Interface {
+    type: "invalidReceipt"
+  }
+
   export interface ServiceNotConfigured extends Interface {
     type: "serviceNotConfigured"
   }
@@ -312,6 +318,7 @@ export enum BadgeServiceErrorCode {
   Payment_not_entitled = "payment_not_entitled",
   Payment_pending = "payment_pending",
   Provider_unavailable = "provider_unavailable",
+  Provider_not_configured = "provider_not_configured",
   Rate_limited = "rate_limited",
   Code_invalid = "code_invalid",
   Code_used = "code_used",
diff --git a/packages/simplex-chat-python/src/simplex_chat/types/_types.py b/packages/simplex-chat-python/src/simplex_chat/types/_types.py
index ab06a24f53..eca43f04ed 100644
--- a/packages/simplex-chat-python/src/simplex_chat/types/_types.py
+++ b/packages/simplex-chat-python/src/simplex_chat/types/_types.py
@@ -188,6 +188,9 @@ class BadgeProof(TypedDict):
 class BadgeRedeemError_invalidCode(TypedDict):
     type: Literal["invalidCode"]
 
+class BadgeRedeemError_invalidReceipt(TypedDict):
+    type: Literal["invalidReceipt"]
+
 class BadgeRedeemError_serviceNotConfigured(TypedDict):
     type: Literal["serviceNotConfigured"]
 
@@ -210,6 +213,7 @@ class BadgeRedeemError_credentialNotVerified(TypedDict):
 
 BadgeRedeemError = (
     BadgeRedeemError_invalidCode
+    | BadgeRedeemError_invalidReceipt
     | BadgeRedeemError_serviceNotConfigured
     | BadgeRedeemError_badgeActive
     | BadgeRedeemError_serviceError
@@ -218,9 +222,9 @@ BadgeRedeemError = (
     | BadgeRedeemError_credentialNotVerified
 )
 
-BadgeRedeemError_Tag = Literal["invalidCode", "serviceNotConfigured", "badgeActive", "serviceError", "invalidResponse", "unknownKeyIndex", "credentialNotVerified"]
+BadgeRedeemError_Tag = Literal["invalidCode", "invalidReceipt", "serviceNotConfigured", "badgeActive", "serviceError", "invalidResponse", "unknownKeyIndex", "credentialNotVerified"]
 
-BadgeServiceErrorCode = Literal["bad_request", "unsupported_version", "unknown_purchase_key", "unknown_offer_id", "offer_disabled", "offer_mismatch", "product_unavailable", "payment_not_entitled", "payment_pending", "provider_unavailable", "rate_limited", "code_invalid", "code_used", "code_expired", "receipt_invalid", "receipt_used", "internal"]
+BadgeServiceErrorCode = Literal["bad_request", "unsupported_version", "unknown_purchase_key", "unknown_offer_id", "offer_disabled", "offer_mismatch", "product_unavailable", "payment_not_entitled", "payment_pending", "provider_unavailable", "provider_not_configured", "rate_limited", "code_invalid", "code_used", "code_expired", "receipt_invalid", "receipt_used", "internal"]
 
 BadgeStatus = Literal["active", "expired", "expiredOld", "failed", "unknownKey"]
 
diff --git a/plans/2026-09-24-badge-buy-in-browser.md b/plans/2026-09-24-badge-buy-in-browser.md
index d0a4b9c18f..826d8766a5 100644
--- a/plans/2026-09-24-badge-buy-in-browser.md
+++ b/plans/2026-09-24-badge-buy-in-browser.md
@@ -80,7 +80,7 @@ Getting the URL to an app that is already running is the part that half exists.
 
 The browser lane needs nothing. The store lane needs `purchaseBadge` to accept a store receipt and verify it — Apple's JWS offline, Google's token through the Publisher API, per `docs/protocol/badges-rpc.md`. No provider adapter for either exists today.
 
-Two properties matter more than the plumbing. It must be idempotent per signing key, since the app will retry. And an unknown or invalid token must be a plain refusal, not a retryable error — Android has no local verification, so tampered clients will send junk tokens as a matter of course, and a retryable answer would leave the worker grinding on one that can never become valid.
+Two properties matter more than the plumbing. It must be idempotent per signing key, since the app will retry. And only a store's verdict about a purchase may be a plain refusal: the client consumes a purchase answered `receipt_invalid`, so a store that has merely not answered — or that does not yet know a token it has just issued — must be answered retryably, or a paid badge is thrown away. Junk tokens from tampered clients are the cheap side of that trade: each costs one request per client trigger, nothing loops on the service, and Play refunds an unacknowledged purchase after three days. `docs/protocol/badges-rpc.md` has the classes.
 
 `badges-rpc.md` also specifies `getBadgeCatalog` and `getBadgeInvoice`. Neither is needed by anything here and neither should be built: the page owns the catalog and the invoice.
 
diff --git a/scripts/badge-service/badge_service.ini.example b/scripts/badge-service/badge_service.ini.example
index 09ca430fc7..1dfaaef95c 100644
--- a/scripts/badge-service/badge_service.ini.example
+++ b/scripts/badge-service/badge_service.ini.example
@@ -42,5 +42,10 @@ idle_seconds = 60
 index = 1
 private_key = replace-me
 
+; local testing only: signs a credential for anyone who sends /redeem <code> over chat,
+; with a master key this service generates and can therefore link
 [dev]
-chat_redeem = on
+chat_redeem = off
+; local testing only, in both run modes: accepts any well-formed App Store or Play receipt without
+; verifying it, so anyone who can reach this service can mint badges
+accept_unverified_store_receipts = off
diff --git a/simplex-chat.cabal b/simplex-chat.cabal
index e759fbdd3e..4a5fa0e5a7 100644
--- a/simplex-chat.cabal
+++ b/simplex-chat.cabal
@@ -168,6 +168,7 @@ library
           Simplex.Chat.Store.Postgres.Migrations.M20260915_user_badges
           Simplex.Chat.Store.Postgres.Migrations.M20260918_badge_issue_errors
           Simplex.Chat.Store.Postgres.Migrations.M20260923_preferences_json
+          Simplex.Chat.Store.Postgres.Migrations.M20260925_badge_store_receipts
   else
       exposed-modules:
           Simplex.Chat.Archive
@@ -345,6 +346,7 @@ library
           Simplex.Chat.Store.SQLite.Migrations.M20260915_user_badges
           Simplex.Chat.Store.SQLite.Migrations.M20260918_badge_issue_errors
           Simplex.Chat.Store.SQLite.Migrations.M20260923_preferences_json
+          Simplex.Chat.Store.SQLite.Migrations.M20260925_badge_store_receipts
   other-modules:
       Paths_simplex_chat
   hs-source-dirs:
@@ -441,6 +443,8 @@ executable simplex-badge-service
       BadgeService.Store
       BadgeService.Store.Invoices
       BadgeService.Store.Migrate
+      BadgeService.StoreReceipts
+      BadgeService.StoreReceipts.Mock
       BadgeService.Waiters
       BadgeService.Web.Server
       Paths_simplex_chat
@@ -729,6 +733,8 @@ test-suite simplex-chat-test
       BadgeService.Store
       BadgeService.Store.Invoices
       BadgeService.Store.Migrate
+      BadgeService.StoreReceipts
+      BadgeService.StoreReceipts.Mock
       BadgeService.Waiters
       BadgeService.Web.Server
       Bots.BadgeService.BTCPayTests
@@ -736,6 +742,7 @@ test-suite simplex-chat-test
       Bots.BadgeService.CatalogTests
       Bots.BadgeService.ConfigTests
       Bots.BadgeService.FakeBTCPay
+      Bots.BadgeService.FakeStore
       Bots.BadgeService.FakeStripe
       Bots.BadgeService.StripeTests
       Bots.BadgeService.WaitersTests
diff --git a/src/Simplex/Chat.hs b/src/Simplex/Chat.hs
index 3e6fb7e229..d80184d4a0 100644
--- a/src/Simplex/Chat.hs
+++ b/src/Simplex/Chat.hs
@@ -72,6 +72,7 @@ defaultChatConfig =
       badgeServiceAddress = Just $ either error id $ strDecode "https://smp5.simplex.im/a#ooSNWlEZTO2RPE0Ff5ZoybAs5zEhWLMlQrXesnhaZHM",
       badgeCurrentTime = getCurrentTime,
       badgeRetryInterval = RetryInterval {initialInterval = 30_000000, increaseAfter = 0, maxInterval = 3600_000000},
+      badgeConsecutiveRetries = 3,
       confirmMigrations = MCConsole,
       -- this property should NOT use operator = Nothing
       -- non-operator servers can be passed via options
@@ -195,6 +196,7 @@ newChatController
         deliveryJobWorkers <- TM.emptyIO
         relayRequestWorkers <- TM.emptyIO
         badgeWorkers <- TM.emptyIO
+        storeReceiptWorkers <- TM.emptyIO
         badgeSeq <- newTVarIO 0
         relayGroupLinkChecksAsync <- newTVarIO Nothing
         webPreviewState <- forM webPreviewConfig $ \_ -> newWebPreviewState
@@ -243,6 +245,7 @@ newChatController
               deliveryJobWorkers,
               relayRequestWorkers,
               badgeWorkers,
+              storeReceiptWorkers,
               badgeSeq,
               relayGroupLinkChecksAsync,
               webPreviewState,
diff --git a/src/Simplex/Chat/Badges/Ledger.hs b/src/Simplex/Chat/Badges/Ledger.hs
index 2f31773d2d..870820d7c8 100644
--- a/src/Simplex/Chat/Badges/Ledger.hs
+++ b/src/Simplex/Chat/Badges/Ledger.hs
@@ -26,6 +26,7 @@ import Data.Time.Calendar.WeekDate (toWeekDate)
 import Data.Time.Clock (NominalDiffTime, UTCTime (..), addUTCTime)
 import Simplex.Chat.Badges (BadgeType)
 import Simplex.Chat.Badges.Service (StatementCreditType (..), StatementDebitType (..), StatementEntry (..), StatementEntryType (..))
+import Simplex.Chat.PaymentService.Types (InvoiceId)
 
 -- The calendar difference overshoots by at most one month, so one comparison settles it.
 monthsBetween :: UTCTime -> UTCTime -> Integer
@@ -204,13 +205,15 @@ debitTypeTag = \case
   SDLapse -> "lapse"
   SDUnknown {tag} -> tag
 
--- | Only the types a tag alone rebuilds, which is those whose constructor has no fields; the rest
--- answer Nothing rather than a type with an invented payload. The client also stores each type's
--- JSON and reads that first, so this is its fallback; the service has no such column.
--- TODO [badges] take the reference columns and rebuild payment, charge, transferIn, upgrade and
--- transferOut, without which the service cannot re-emit a statement carrying one.
-entryTypeFromColumns :: Text -> Maybe Text -> Maybe Text -> Maybe StatementEntryType
-entryTypeFromColumns entryType credit_ debit_ = case (entryType, credit_, debit_) of
+-- | Rebuilds only what the columns determine: constructors with no fields, and a payment credit.
+-- payment_ is Nothing when the row references no payment, and Just Nothing when that payment had no
+-- invoice, as a store purchase has none. The rest answer Nothing rather than invent a payload.
+-- The client stores each type's JSON and reads that first, so this is its fallback; the service has none.
+-- TODO [badges] rebuild charge, transferIn, upgrade and transferOut from their reference columns,
+-- without which the service cannot re-emit a statement carrying one.
+entryTypeFromColumns :: Maybe (Maybe InvoiceId) -> Text -> Maybe Text -> Maybe Text -> Maybe StatementEntryType
+entryTypeFromColumns payment_ entryType credit_ debit_ = case (entryType, credit_, debit_) of
+  ("credit", Just "payment", _) -> SECredit . SCPayment <$> payment_
   ("credit", Just t, _) -> SECredit <$> creditType t
   ("debit", _, Just t) -> SEDebit <$> debitType t
   _ -> Nothing
diff --git a/src/Simplex/Chat/Badges/Service.hs b/src/Simplex/Chat/Badges/Service.hs
index 725009d839..80ee632c25 100644
--- a/src/Simplex/Chat/Badges/Service.hs
+++ b/src/Simplex/Chat/Badges/Service.hs
@@ -87,12 +87,12 @@ data BadgeServiceCommand
         code :: Text -- no badgeRequest: a code carries no tier for the client to state
       }
   | BSCPurchaseBadge
-      { badgeRequest :: BadgeRequest,
+      { masterKey :: BadgeMasterKey, -- no badgeRequest: the tier is the product's, the expiry the one every credential of that week shares
         payment :: ServicePayment,
         upgrade :: Maybe BadgeUpgrade -- upgrade store 1-time badge
       }
   | BSCUpgradeBadgeSubscription
-      { badgeRequest :: BadgeRequest,
+      { badgeRequest :: BadgeRequest, -- TODO [badges] drop when implemented: a client-stated expiry leaves the week's anonymity set
         payment :: ServicePayment, -- store payments only
         balance :: BadgeBalance
       }
diff --git a/src/Simplex/Chat/Badges/Types.hs b/src/Simplex/Chat/Badges/Types.hs
index 1038b2b64f..376869f584 100644
--- a/src/Simplex/Chat/Badges/Types.hs
+++ b/src/Simplex/Chat/Badges/Types.hs
@@ -30,6 +30,7 @@ module Simplex.Chat.Badges.Types
     BadgeAlert (..),
     BadgeAlertPrice (..),
     BadgeState (..),
+    OpenStorePurchase (..),
   ) where
 
 import Control.Applicative ((<|>))
@@ -43,7 +44,7 @@ import Data.Text.Encoding (decodeLatin1, encodeUtf8)
 import Data.Time.Clock (UTCTime)
 import Data.Word (Word8)
 import Simplex.Chat.Badges hiding (BadgePurchase (..))
-import Simplex.Chat.PaymentService.Types (InvoiceId, PaymentId, StoredPayment)
+import Simplex.Chat.PaymentService.Types (InvoiceId, PaymentId)
 import Simplex.Chat.Types (BoolDef (..))
 import Simplex.Messaging.Agent.Protocol (UserId)
 import Simplex.Messaging.Agent.Store.DB (fromTextField_)
@@ -236,6 +237,7 @@ data BadgeServiceErrorCode
   | BSEPaymentNotEntitled
   | BSEPaymentPending
   | BSEProviderUnavailable
+  | BSEProviderNotConfigured -- no verifier deployed: a dev service, not the store failing to answer
   | BSERateLimited
   | BSECodeInvalid
   | BSECodeUsed
@@ -281,6 +283,17 @@ data BadgeState = BadgeState
   }
   deriving (Show)
 
+-- | One of a profile's store purchases that no receipt has reached yet, or whose receipt is held until
+-- the service credits it; transactionRef is set once a receipt arrived. Neither reference is a secret:
+-- Apple's is the transaction id, Google's is a hash of the token. creditError is set only while the
+-- held receipt's last attempt failed in a way that cannot clear on its own.
+data OpenStorePurchase = OpenStorePurchase
+  { invoiceId :: Maybe Text,
+    transactionRef :: Maybe Text,
+    creditError :: Maybe BadgeIssueFailure
+  }
+  deriving (Show)
+
 instance TextEncoding BadgePurchaseStatus where
   textEncode = \case
     PSAcquiring -> "acquiring"
@@ -325,6 +338,7 @@ instance TextEncoding BadgeServiceErrorCode where
     BSEPaymentNotEntitled -> "payment_not_entitled"
     BSEPaymentPending -> "payment_pending"
     BSEProviderUnavailable -> "provider_unavailable"
+    BSEProviderNotConfigured -> "provider_not_configured"
     BSERateLimited -> "rate_limited"
     BSECodeInvalid -> "code_invalid"
     BSECodeUsed -> "code_used"
@@ -344,6 +358,7 @@ instance TextEncoding BadgeServiceErrorCode where
     "payment_not_entitled" -> BSEPaymentNotEntitled
     "payment_pending" -> BSEPaymentPending
     "provider_unavailable" -> BSEProviderUnavailable
+    "provider_not_configured" -> BSEProviderNotConfigured
     "rate_limited" -> BSERateLimited
     "code_invalid" -> BSECodeInvalid
     "code_used" -> BSECodeUsed
@@ -410,3 +425,5 @@ $(JQ.deriveJSON (sumTypeJSON $ dropPrefix "BIF") ''BadgeIssueFailure)
 $(JQ.deriveJSON defaultJSON ''BadgeIssueError)
 
 $(JQ.deriveJSON defaultJSON ''BadgeState)
+
+$(JQ.deriveJSON defaultJSON ''OpenStorePurchase)
diff --git a/src/Simplex/Chat/Controller.hs b/src/Simplex/Chat/Controller.hs
index 9cc80fc54b..2719c588d8 100644
--- a/src/Simplex/Chat/Controller.hs
+++ b/src/Simplex/Chat/Controller.hs
@@ -85,7 +85,8 @@ import Simplex.Messaging.Client (HostMode (..), SMPProxyFallback (..), SMPProxyM
 import qualified Simplex.Messaging.Crypto as C
 import Simplex.Chat.Badges (BadgeCredential, FileSizeLimits, LocalBadge)
 import Simplex.Chat.Badges.Service (BadgeServiceErrorCode, StatementEntry)
-import Simplex.Chat.Badges.Types (BadgeAlert (..), BadgeAlertKind, BadgeState (..))
+import Simplex.Chat.Badges.Types (BadgeAlert (..), BadgeAlertKind, BadgeState (..), OpenStorePurchase (..))
+import Simplex.Chat.PaymentService (ServicePayment)
 import Simplex.Messaging.Crypto.BBS (BBSPublicKey)
 import Simplex.Messaging.Crypto.File (CryptoFile (..))
 import qualified Simplex.Messaging.Crypto.File as CF
@@ -152,6 +153,8 @@ data ChatConfig = ChatConfig
     badgeCurrentTime :: IO UTCTime,
     -- how long a badge worker waits before repeating a renewal that failed for a passing reason
     badgeRetryInterval :: RetryInterval,
+    -- attempts a store receipt gets in one turn before its next one waits for the stored schedule
+    badgeConsecutiveRetries :: Int,
     confirmMigrations :: MigrationConfirmation,
     presetServers :: PresetServers,
     shortLinkPresetServers :: NonEmpty SMPServer,
@@ -327,6 +330,7 @@ data ChatController = ChatController
     relayRequestWorkers :: TMap Int Worker, -- single global worker with key 1 is used to fit into existing worker management framework
     -- one badge worker per user: badge state is per profile, and one profile must not stall another
     badgeWorkers :: TMap UserId (SessionVar BadgeWorker),
+    storeReceiptWorkers :: TMap UserId Worker,
     badgeSeq :: TVar Int,
     relayGroupLinkChecksAsync :: TVar (Maybe (Async ())),
     webPreviewState :: Maybe WebPreviewState,
@@ -659,6 +663,8 @@ data ChatCommand
   | UpdateProfileImageFromFile FilePath -- set profile image from a .png/.jpg/.jpeg file
   | AddBadge BadgeCredential -- attach an issued badge credential (testing; credential from `simplex-chat badge sign`)
   | APIRedeemBadgeCode {userId :: UserId, code :: Text} -- redeem a badge code with the configured badge service
+  | APIPurchaseBadge {userId :: UserId, echoedInvoiceId :: Maybe Text, payment :: ServicePayment} -- hand over an App Store or Google Play receipt, held until a worker credits it; answers from the record and sends nothing
+  | APICreateBadgeInvoice {userId :: UserId} -- the record of a store purchase, created before the store charges; answers the id the store echoes
   | APIGetBadgeState {userId :: UserId} -- the user's badges, their balances and any current alert
   | APIGetBadgeLedger {userId :: UserId, badgePurchaseId :: Int64} -- the purchase's ledger, oldest first
   -- episode is last because it is free text: it is the value that makes one occurrence of an
@@ -869,7 +875,8 @@ data ChatResponse
   | CRServiceResponse {user :: User, responseData :: J.Object}
   | CRServiceReplyAccepted {user :: User, connectionId :: AgentConnId}
   | CRBadgeRedeemed {user :: User, redeemedBadge :: LocalBadge, newBadge :: Bool, badgeState :: Maybe BadgeState}
-  | CRBadgeState {user :: User, badgeState :: Maybe BadgeState}
+  | CRBadgeInvoice {user :: User, invoiceId :: Text}
+  | CRBadgeState {user :: User, badgeState :: Maybe BadgeState, storePurchases :: [OpenStorePurchase]}
   | CRBadgeLedger {user :: User, badgeLedger :: [StatementEntry]}
   | CRUserAcceptedGroupSent {user :: User, groupInfo :: GroupInfo, hostContact :: Maybe Contact}
   | CRUserDeletedMembers {user :: User, groupInfo :: GroupInfo, members :: [GroupMember], withMessages :: Bool, msgSigned :: Bool}
@@ -990,6 +997,7 @@ data ChatEvent
   | CEvtServiceReplySent {connectionId :: AgentConnId}
   | CEvtBadgeChanged {user :: User, badgeState :: Maybe BadgeState} -- badge state changed, including a renewal that arrived without a command
   | CEvtBadgeAlert {user :: User, badgeAlert :: BadgeAlert}
+  | CEvtStorePurchaseResolved {user :: User} -- a held store receipt was credited or refused, so its store transaction can be finished
   | CEvtContactRequestRejected {user :: User, contact :: Contact, rejectionReason :: Maybe ContactRejectionReason}
   | CEvtAcceptingContactRequest {user :: User, contact :: Contact} -- there is the same command response
   | CEvtAcceptingBusinessRequest {user :: User, groupInfo :: GroupInfo}
@@ -1479,8 +1487,10 @@ data SimplexDomainError
   | SDEUnknownDomain -- the resolved link's profile has no name, or a different name
   deriving (Eq, Show)
 
+-- | Why acquiring a badge failed, for a code and for a store purchase alike.
 data BadgeRedeemError
   = BREInvalidCode -- format or check character
+  | BREInvalidReceipt -- names no transaction, or is not a store payment
   | BREServiceNotConfigured
   | BREBadgeActive
   | BREServiceError {serviceError :: BadgeServiceErrorCode}
diff --git a/src/Simplex/Chat/Library/Commands.hs b/src/Simplex/Chat/Library/Commands.hs
index d02a189b1d..043b06d829 100644
--- a/src/Simplex/Chat/Library/Commands.hs
+++ b/src/Simplex/Chat/Library/Commands.hs
@@ -61,7 +61,7 @@ import Crypto.Random (ChaChaDRG)
 import Simplex.Messaging.Session (SessionVar (..), withGetSessVar')
 import Simplex.Chat.Badges (BadgeCredential (..), BadgeInfo (..), BadgeMasterKey, BadgeType, LocalBadge (..), badgeServerCredential, mkBadgeStatus, maxSndXFTPFileSize, verifyCredential)
 import qualified Simplex.Chat.Badges.Ledger as L
-import Simplex.Chat.Badges.Types (BadgeAlert (..), BadgeAlertKind (..), BadgeIssueError (..), BadgeIssueFailure (..), BadgeState (..))
+import Simplex.Chat.Badges.Types (BadgeAlert (..), BadgeAlertKind (..), BadgeIssueError (..), BadgeIssueFailure (..), BadgeState (..), OpenStorePurchase (..))
 import Simplex.Chat.Badges.Code (badgeCodeText, parseBadgeCode)
 import Simplex.Chat.Badges.Service (BadgeBalance (..), BadgeServiceCommand (..), BadgeServiceErrorCode (..), BadgeServiceRequest (..), BadgeServiceResponse (..), BadgeStatement (..), StatementDebitType (..), StatementEntry (..), StatementEntryType (..), currentBadgeServiceVersion)
 import Simplex.Chat.Names (SimplexDomainProof (..), SimplexDomainClaim (..), claimDomain, mkDomainClaim)
@@ -76,6 +76,8 @@ import Simplex.Chat.Messages.CIContent
 import Simplex.Chat.Messages.CIContent.Events
 import Simplex.Chat.Operators
 import Simplex.Chat.Options
+import Simplex.Chat.PaymentService (ServicePayment (..), appleTransactionId, googlePurchaseRef)
+import Simplex.Chat.PaymentService.Types (PaymentProvider (..), StoreTransactionRef (..))
 import Simplex.Chat.ProfileGenerator (generateRandomProfile)
 import Simplex.Chat.Protocol
 import Simplex.Chat.Remote
@@ -103,9 +105,10 @@ import qualified Simplex.Chat.Util as U
 import Simplex.Chat.Web (webPreviewWorker)
 import Simplex.FileTransfer.Description (FileDescriptionURI (..), maxFileSizeHard)
 import Simplex.Messaging.Agent
-import Simplex.Messaging.Agent.Env.SQLite (ServerCfg (..), ServerRoles (..), allRoles)
+import Simplex.Messaging.Agent.Client (getAgentWorker, waitForUserNetwork, waitForWork, waitWhileSuspended, withWork_)
+import Simplex.Messaging.Agent.Env.SQLite (ServerCfg (..), ServerRoles (..), Worker (..), allRoles)
 import Simplex.Messaging.Agent.Protocol
-import Simplex.Messaging.Agent.RetryInterval (RetryInterval (..), withRetryInterval)
+import Simplex.Messaging.Agent.RetryInterval (RetryInterval (..), nextRetryDelay, withRetryInterval, withRetryIntervalCount)
 import Simplex.Messaging.Agent.Store.Entity
 import Simplex.Messaging.Agent.Store.Interface (execSQL)
 import Simplex.Messaging.Agent.Store.Shared (upMigration)
@@ -261,6 +264,7 @@ startChatController mainApp enableSndFiles serviceRequests = do
           startRelayRequestWorker_
           startCleanupManager
           mapM_ startBadgeWork users
+          startStoreReceiptWorkers users
           void $ forkIO $ mapM_ startExpireCIs users
           startRelayChecks users
           startWebPreview users
@@ -279,6 +283,10 @@ startChatController mainApp enableSndFiles serviceRequests = do
       runExceptT startRelayRequestWorker >>= \case
         Left e -> liftIO $ putStrLn $ "Error starting relay request worker: " <> show e
         Right _ -> pure ()
+    startStoreReceiptWorkers users =
+      runExceptT (mapM_ startStoreReceiptWork users) >>= \case
+        Left e -> liftIO $ putStrLn $ "Error starting store receipt workers: " <> show e
+        Right _ -> pure ()
     startCleanupManager = do
       cleanupAsync <- asks cleanupManagerAsync
       readTVarIO cleanupAsync >>= \case
@@ -357,7 +365,7 @@ restoreCalls = do
   atomically $ writeTVar calls callsMap
 
 stopChatController :: ChatController -> IO ()
-stopChatController ChatController {smpAgent, agentAsync = s, sndFiles, rcvFiles, expireCIFlags, remoteHostSessions, remoteCtrlSession, cleanupManagerAsync, relayGroupLinkChecksAsync, webPreviewState, expireCIThreads, timedItemThreads, deliveryTaskWorkers, deliveryJobWorkers, relayRequestWorkers, badgeWorkers} = do
+stopChatController ChatController {smpAgent, agentAsync = s, sndFiles, rcvFiles, expireCIFlags, remoteHostSessions, remoteCtrlSession, cleanupManagerAsync, relayGroupLinkChecksAsync, webPreviewState, expireCIThreads, timedItemThreads, deliveryTaskWorkers, deliveryJobWorkers, relayRequestWorkers, badgeWorkers, storeReceiptWorkers} = do
   readTVarIO remoteHostSessions >>= mapM_ (cancelRemoteHost False . snd)
   atomically (stateTVar remoteCtrlSession (,Nothing)) >>= mapM_ (cancelRemoteCtrl False . snd)
   disconnectAgentClient smpAgent
@@ -371,6 +379,7 @@ stopChatController ChatController {smpAgent, agentAsync = s, sndFiles, rcvFiles,
   clearMap deliveryJobWorkers >>= mapM_ cancelWorker
   clearMap relayRequestWorkers >>= mapM_ cancelWorker
   stopBadgeWorkers badgeWorkers
+  clearMap storeReceiptWorkers >>= mapM_ cancelWorker
   closeFiles sndFiles
   closeFiles rcvFiles
   atomically $ do
@@ -603,6 +612,7 @@ processChatCommand cxt nm = \case
         void . forkIO $ startFilesToReceive users
         setAllExpireCIFlags True
         mapM_ startBadgeWork users
+      mapM_ startStoreReceiptWork users
     ok_
   APISuspendChat t -> do
     chatWriteVar chatActivated False
@@ -3562,10 +3572,19 @@ processChatCommand cxt nm = \case
   ShowProfile -> withUser $ \user@User {profile} -> pure $ CRUserProfile user (fromLocalProfile profile)
   AddBadge cred -> withUser $ \user -> addUserBadge user cred >> ok user
   APIRedeemBadgeCode userId codeText -> withUserId userId $ \user -> redeemBadgeCode nm user codeText
+  APIPurchaseBadge userId echoedInvoiceId payment -> withUserId userId $ \user -> handOverStoreReceipt user echoedInvoiceId payment
+  APICreateBadgeInvoice userId -> withUserId userId $ \user -> do
+    void requireBadgeService
+    refuseWhileBadgeHeld user
+    g <- asks random
+    now <- badgeNow
+    invoiceId <- UUID.toText <$> liftIO V4.nextRandom
+    withStore' $ \db -> createBadgeStoreReceipt db g user invoiceId now
+    pure $ CRBadgeInvoice user invoiceId
   APIGetBadgeState userId -> withUserId' userId $ \user -> do
     -- the read also signals the worker, whose results follow as CEvtBadgeChanged
     lift $ startBadgeWork user
-    CRBadgeState user <$> getUserBadgeState user
+    badgeStateResponse user
   APIGetBadgeLedger userId badgePurchaseId -> withUserId userId $ \user ->
     CRBadgeLedger user <$> withStore' (\db -> getBadgeLedger db user badgePurchaseId)
   APIAckBadgeAlert userId badgePurchaseId alertKind snooze episode -> withUserId userId $ \user -> do
@@ -3574,7 +3593,7 @@ processChatCommand cxt nm = \case
     withStore' $ \db -> setBadgeAlertAcked db user badgePurchaseId alertKind episode snoozeUntil
     -- after the write, so the pass it signals arms a wake for the snooze rather than raising again
     lift $ startBadgeWork user
-    CRBadgeState user <$> getUserBadgeState user
+    badgeStateResponse user
   SetBotCommands commands -> withUser $ \user@User {profile} -> do
     let LocalProfile {preferences} = profile
         prefs = Just (fromMaybe emptyChatPrefs preferences :: Preferences) {commands = Just commands}
@@ -5219,30 +5238,20 @@ presentUserBadgeToContacts user'@User {userId, profile = LocalProfile {localBadg
 redeemBadgeCode :: NetworkRequestMode -> User -> Text -> CM ChatResponse
 redeemBadgeCode nm user@User {userId} codeText = do
   code <- maybe (throwRedeemError BREInvalidCode) pure $ parseBadgeCode codeText
-  sendTarget <- asks (badgeServiceAddress . config) >>= maybe (throwRedeemError BREServiceNotConfigured) pure
+  sendTarget <- requireBadgeService
   g <- asks random
   now <- liftIO getCurrentTime
   let codeSent = badgeCodeText code
   -- the guard, the request and the write are one section: without it two codes redeemed at once
   -- both pass the guard and are both spent, for one badge
   (present_, redeemed) <- withEntityLock "badgeRedeem" (CLBadgeUser userId) $ do
-    redemption_ <- withStore' $ \db -> getBadgeCodeRedemption db user codeSent
-    -- a code already redeemed here is allowed through: re-sending it returns the badge it bought
-    -- and adds nothing. Refused before its keys are stashed and before the request, so it stays unspent
-    replaying <- maybe (pure False) (\r -> withStore' $ \db -> isJust <$> getCodeBadgePurchase db r) redemption_
-    unless replaying $ whenM (withStore' (`userHasBadge` user)) $ throwRedeemError BREBadgeActive
-    redemption@BadgeCodeRedemption {purchaseKey, purchasePrivKey, masterKey} <-
-      maybe (withStore' $ \db -> createBadgeCodeRedemption db g user codeSent now) pure redemption_
-    let req = BadgeServiceRequest {version = currentBadgeServiceVersion, purchaseKey = Just purchaseKey, request = BSCRedeemBadgeCode {masterKey, code = codeSent}}
-    respBytes <- sendServiceRequestBytes nm user sendTarget Nothing (Just purchasePrivKey) req
-    respData <- either (const $ throwRedeemError $ BREInvalidResponse "not JSON") pure $ J.eitherDecodeStrict' respBytes
-    case J.fromJSON (J.Object respData) of
-      J.Error _ -> throwRedeemError $ BREInvalidResponse "not a badge service response"
-      J.Success BSPError {code = errCode} -> do
-        when (terminalCodeError errCode) $ withStore' $ \db -> deleteBadgeCodeRedemption db (redemptionId redemption)
+    stash_ <- withStore' $ \db -> getBadgeCodeRedemption db user codeSent
+    stash@BadgeStash {masterKey} <- stashBadgeKeys user stash_ $ \db -> createBadgeCodeRedemption db g user codeSent now
+    requestBadgeStash nm user sendTarget stash BSCRedeemBadgeCode {masterKey, code = codeSent} >>= \case
+      Left (errCode, _) -> do
+        when (terminalCodeError errCode) $ withStore' $ \db -> deleteBadgeCodeRedemption db user codeSent
         throwRedeemError $ BREServiceError errCode
-      J.Success BSPBadgeCredential {credential = Just cred, statement} -> storeRedeemedBadge user redemption cred statement
-      J.Success _ -> throwRedeemError $ BREInvalidResponse "unexpected response type"
+      Right redeemed -> pure redeemed
   -- outside the badge lock: the chat lock must not be taken under it
   mapM_ presentUserBadgeToContacts present_
   pure redeemed
@@ -5254,6 +5263,69 @@ redeemBadgeCode nm user@User {userId} codeText = do
       BSECodeExpired -> True
       _ -> False
 
+-- | The app hands a receipt over until it is answered credited or refused, under whichever profile is
+-- active; the answer is the owner's, read from the record. Nothing is sent: the owner's receipt worker is.
+handOverStoreReceipt :: User -> Maybe Text -> ServicePayment -> CM ChatResponse
+handOverStoreReceipt presentingUser echoedInvoiceId payment = do
+  txRef <- maybe (throwRedeemError BREInvalidReceipt) pure $ storeTransactionRef payment
+  void requireBadgeService
+  g <- asks random
+  now <- badgeNow
+  BadgeReceiptRecord {ownerId, status} <-
+    withStore' (\db -> holdStoreReceipt db g presentingUser echoedInvoiceId txRef payment now)
+      >>= maybe (throwChatError $ CEInternalError "store receipt was not recorded") pure
+  owner <- withStore $ \db -> getUser db ownerId
+  case status of
+    RSHeld {} -> lift (resumeStoreReceiptWork ownerId) >> badgeStateResponse owner
+    RSCredited {badgePurchaseId} -> do
+      cred_ <- withStore' (`getLatestIssuedCredential` badgePurchaseId)
+      cred@(BadgeCredential _ _ _ info) <- maybe (throwChatError $ CEInternalError "credited store purchase has no credential") pure cred_
+      CRBadgeRedeemed owner (OwnBadge cred (mkBadgeStatus now (Just True) info)) False <$> getUserBadgeState owner
+    RSRefused {refusal = Just BIFServiceError {code}} -> throwRedeemError $ BREServiceError code
+    RSRefused {} -> throwChatError $ CEInternalError "store purchase refused for no recorded reason"
+
+-- | The receipt will never be credited to its key; any other refusal may pass on a retry.
+storeReceiptRefused :: BadgeServiceErrorCode -> Bool
+storeReceiptRefused = \case
+  BSEReceiptInvalid -> True
+  BSEReceiptUsed -> True
+  _ -> False
+
+-- | The same reference the service claims a transaction by, read without verifying anything.
+storeTransactionRef :: ServicePayment -> Maybe StoreTransactionRef
+storeTransactionRef = \case
+  SPApple {jws} -> StoreTransactionRef PPApple <$> appleTransactionId jws
+  SPGoogle {token} -> Just $ StoreTransactionRef PPGoogle $ googlePurchaseRef token
+  SPInvoice {} -> Nothing
+  SPReceipt {} -> Nothing
+
+-- | A stash that already bought a badge here passes, as re-sending it adds nothing; any other is
+-- refused while a badge is held, before its keys are stashed or sent, so the funding stays unspent.
+stashBadgeKeys :: User -> Maybe BadgeStash -> (DB.Connection -> IO BadgeStash) -> CM BadgeStash
+stashBadgeKeys user stash_ createStash = do
+  replaying <- maybe (pure False) (\s -> withStore' $ \db -> isJust <$> getStashBadgePurchase db s) stash_
+  unless replaying $ refuseWhileBadgeHeld user
+  maybe (withStore' createStash) pure stash_
+
+requireBadgeService :: CM (ConnectTarget 'CMContact)
+requireBadgeService = asks (badgeServiceAddress . config) >>= maybe (throwRedeemError BREServiceNotConfigured) pure
+
+refuseWhileBadgeHeld :: User -> CM ()
+refuseWhileBadgeHeld user = whenM (withStore' (`userHasBadge` user)) $ throwRedeemError BREBadgeActive
+
+-- | One attempt to turn a stash into a badge. A refusal is answered rather than thrown, with the
+-- service's retryAfter.
+requestBadgeStash :: NetworkRequestMode -> User -> ConnectTarget 'CMContact -> BadgeStash -> BadgeServiceCommand -> CM (Either (BadgeServiceErrorCode, Maybe Word32) (Maybe User, ChatResponse))
+requestBadgeStash nm user sendTarget stash@BadgeStash {purchaseKey, purchasePrivKey} request = do
+  let req = BadgeServiceRequest {version = currentBadgeServiceVersion, purchaseKey = Just purchaseKey, request}
+  respBytes <- sendServiceRequestBytes nm user sendTarget Nothing (Just purchasePrivKey) req
+  respData <- either (const $ throwRedeemError $ BREInvalidResponse "not JSON") pure $ J.eitherDecodeStrict' respBytes
+  case J.fromJSON (J.Object respData) of
+    J.Error _ -> throwRedeemError $ BREInvalidResponse "not a badge service response"
+    J.Success BSPError {code, retryAfter} -> pure $ Left (code, retryAfter)
+    J.Success BSPBadgeCredential {credential = Just cred, statement} -> Right <$> storeRedeemedBadge user stash cred statement
+    J.Success _ -> throwRedeemError $ BREInvalidResponse "unexpected response type"
+
 throwRedeemError :: BadgeRedeemError -> CM a
 throwRedeemError = throwChatError . CEBadgeRedeemError
 
@@ -5362,6 +5434,89 @@ waitBadgeWake badgeWork now = \case
 badgeMaxWake :: NominalDiffTime
 badgeMaxWake = 100 * 365 * nominalDay
 
+startStoreReceiptWork :: User -> CM ()
+startStoreReceiptWork User {userId} = do
+  held <- withStore' $ \db -> getNextHeldStoreReceipt db userId
+  when (either (const False) isJust held) $ lift $ resumeStoreReceiptWork userId
+
+resumeStoreReceiptWork :: UserId -> CM' ()
+resumeStoreReceiptWork userId = do
+  ws <- asks storeReceiptWorkers
+  a <- asks smpAgent
+  void $ getAgentWorker "store_receipt" True a userId ws $ runStoreReceiptWorker a userId
+
+runStoreReceiptWorker :: AgentClient -> UserId -> Worker -> CM ()
+runStoreReceiptWorker a userId Worker {doWork} = do
+  scheduled <- newTVarIO S.empty
+  forever $ do
+    lift $ waitForWork doWork
+    withWork_ a doWork (getDueReceipt scheduled) $ \case
+      BadgeReceiptRecord {receiptId, status = RSHeld {stash, payment, retryDelay}} -> creditStoreReceipt a userId receiptId stash payment retryDelay
+      BadgeReceiptRecord {receiptId} -> notHeld receiptId
+  where
+    getDueReceipt scheduled =
+      withStore' (`getNextHeldStoreReceipt` userId) >>= \case
+        Right (Just r@BadgeReceiptRecord {receiptId, status = RSHeld {nextAttemptAt}}) -> do
+          now <- badgeNow
+          if nextAttemptAt <= now
+            then pure $ Right (Just r)
+            else Right Nothing <$ scheduleReceipt scheduled receiptId (diffUTCTime nextAttemptAt now)
+        Right (Just BadgeReceiptRecord {receiptId}) -> Right Nothing <$ notHeld receiptId
+        r -> pure r
+    -- getNextHeldStoreReceipt reads held rows only, so this says its query and its result type disagree
+    notHeld receiptId = eToView $ ChatError $ CEInternalError $ "store receipt " <> show receiptId <> " is not held"
+    scheduleReceipt scheduled receiptId delay = do
+      new <- atomically $ stateTVar scheduled $ \ids -> (S.notMember receiptId ids, S.insert receiptId ids)
+      when new . void . liftIO . forkIO $ do
+        threadDelay' $ diffToMicroseconds delay
+        atomically $ modifyTVar' scheduled $ S.delete receiptId
+        void $ atomically $ tryPutTMVar doWork ()
+
+data StoreReceiptOutcome = SROCredited (Maybe User) | SRORefused | SRORetry | SRODeferred
+
+-- | Under the owner's badge lock, which keeps a profile's requests to the service serial.
+creditStoreReceipt :: AgentClient -> UserId -> Int64 -> BadgeStash -> Text -> Maybe Int64 -> CM ()
+creditStoreReceipt a userId receiptId stash@BadgeStash {masterKey} payment retryDelay = do
+  ChatConfig {badgeRetryInterval = ri, badgeConsecutiveRetries} <- asks config
+  withRetryIntervalCount (maybe ri (\d -> ri {initialInterval = d, increaseAfter = 0}) retryDelay) $ \n delay loop -> do
+    liftIO $ waitWhileSuspended a
+    liftIO $ waitForUserNetwork a
+    outcome <- withEntityLock "badgePurchase" (CLBadgeUser userId) $
+      tryAllErrors attempt >>= \case
+        Right (Right (present_, _)) -> pure $ SROCredited present_
+        Right (Left (code, retryAfter))
+          | storeReceiptRefused code -> SRORefused <$ withStore' (\db -> refuseStoreReceipt db receiptId $ serviceFailure code retryAfter)
+          | otherwise -> failed ri delay (serviceFailure code retryAfter) retryAfter
+        Left e -> failed ri delay (badgeIssueFailure e) Nothing
+    -- only a settlement is announced, and the sweep it prompts signals this worker only for a receipt still held, so it cannot loop
+    case outcome of
+      SROCredited present_ -> do
+        user <- withStore $ \db -> getUser db userId
+        toView . CEvtBadgeChanged user =<< getUserBadgeState user
+        toView $ CEvtStorePurchaseResolved user
+        -- last, so a failed broadcast cannot lose the settlement; outside the badge lock, as it takes the chat lock
+        mapM_ presentUserBadgeToContacts present_
+      SRORefused -> withStore (`getUser` userId) >>= toView . CEvtStorePurchaseResolved
+      SRORetry | n + 1 < badgeConsecutiveRetries -> loop
+      _ -> pure ()
+  where
+    attempt = do
+      user <- withStore $ \db -> getUser db userId
+      refuseWhileBadgeHeld user
+      sendTarget <- requireBadgeService
+      payment' <- maybe (throwChatError $ CEInternalError "held store payment does not decode") pure $ decodeJSON payment
+      requestBadgeStash NRMBackground user sendTarget stash BSCPurchaseBadge {masterKey, payment = payment', upgrade = Nothing}
+    serviceFailure code retryAfter = BIFServiceError {code = boundedServiceErrorCode code, retryable = isJust retryAfter}
+    failed ri delay failure retryAfter = do
+      now <- badgeNow
+      let (retryIn, outcome)
+            | isJust retryAfter = (badgeRetryAfter ri retryAfter, SRODeferred)
+            -- a buyer is waiting, so unlike a renewal a failure that can clear on its own never waits the day
+            | badgeFailureTransient failure = (fromIntegral delay / 1000000, SRORetry)
+            | otherwise = (badgeStalledInterval, SRODeferred)
+      withStore' $ \db -> recordStoreReceiptFailure db receiptId (nextRetryDelay 0 delay ri) (retryIn `addUTCTime` now) failure
+      pure outcome
+
 -- | Retire what has ended, renew what is due, then report the next wake. Waking early, late or not
 -- at all changes only timing: each run reads stored state and works out what to do.
 updateUserBadge :: UserId -> TVar (Maybe BadgeOccurrence) -> UTCTime -> CM (Maybe UTCTime)
@@ -5439,6 +5594,15 @@ emitBadgeAlert user emitted p@UserBadgePurchase {alertSnoozeUntil} shownCred now
     raised <- atomically $ stateTVar emitted (,occurrence)
     when (raised /= occurrence) $ toView $ CEvtBadgeAlert user alert
 
+-- | Scoped to one profile, so another profile's store purchase, which may be hidden, never shows under it.
+badgeStateResponse :: User -> CM ChatResponse
+badgeStateResponse user = do
+  badgeState <- getUserBadgeState user
+  CRBadgeState user badgeState . map finalError <$> withStore' (`getOpenStorePurchases` user)
+  where
+    -- like a renewal's, only a failure that cannot clear on its own is the user's to know about
+    finalError p@OpenStorePurchase {creditError} = p {creditError = find (not . badgeFailureTransient) creditError}
+
 -- | Read from stored rows alone; the worker's results follow as CEvtBadgeChanged.
 getUserBadgeState :: User -> CM (Maybe BadgeState)
 getUserBadgeState user = do
@@ -5472,9 +5636,10 @@ badgeStalledInterval = nominalDay
 -- | The wait after a service refusal, floored at initialInterval so answering 0 cannot spin the
 -- worker, and uncapped above it.
 badgeRetryAfter :: RetryInterval -> Maybe Word32 -> NominalDiffTime
-badgeRetryAfter RetryInterval {initialInterval} = maybe badgeStalledInterval (max floorWait . fromIntegral)
-  where
-    floorWait = fromIntegral initialInterval / 1000000
+badgeRetryAfter ri = maybe badgeStalledInterval (max (retryFloor ri) . fromIntegral)
+
+retryFloor :: RetryInterval -> NominalDiffTime
+retryFloor RetryInterval {initialInterval} = fromIntegral initialInterval / 1000000
 
 -- | How far ahead of the shown credential's expiry the renewal is requested - a day, so a failure
 -- has that long to retry. The wake and the due check both derive from it and have to agree.
@@ -5531,6 +5696,8 @@ badgeIssueFailure e = case e of
     | otherwise -> BIFUnexpected {message = tshow agentError}
   ChatError (CECommandError m) -> BIFUnexpected {message = T.pack m}
   ChatError (CEInternalError m) -> BIFUnexpected {message = T.pack m}
+  ChatError (CEBadgeRedeemError BREUnknownKeyIndex) -> BIFInvalidCredential
+  ChatError (CEBadgeRedeemError BRECredentialNotVerified) -> BIFInvalidCredential
   _ -> BIFUnexpected {message = tshow e}
 
 -- | Whether a failure can clear on its own, which decides whether the alert waits for the shown
@@ -5654,8 +5821,8 @@ stopBadgeWorkers workers =
 -- | Verify the credential before writing anything; the purchase, the statement's rows, the
 -- issuance and the profile's badge go in one transaction. Answers the user to tell contacts about,
 -- which the caller does once the badge lock is released.
-storeRedeemedBadge :: User -> BadgeCodeRedemption -> BadgeCredential -> BadgeStatement -> CM (Maybe User, ChatResponse)
-storeRedeemedBadge user@User {userId} redemption@BadgeCodeRedemption {masterKey} cred@(BadgeCredential _ credMasterKey _ info@BadgeInfo {badgeType}) statement =
+storeRedeemedBadge :: User -> BadgeStash -> BadgeCredential -> BadgeStatement -> CM (Maybe User, ChatResponse)
+storeRedeemedBadge user@User {userId} stash@BadgeStash {masterKey} cred@(BadgeCredential _ credMasterKey _ info@BadgeInfo {badgeType}) statement =
   verifyOwnBadge cred >>= \case
     Nothing -> throwRedeemError BREUnknownKeyIndex
     Just False -> throwRedeemError BRECredentialNotVerified
@@ -5668,7 +5835,7 @@ storeRedeemedBadge user@User {userId} redemption@BadgeCodeRedemption {masterKey}
       let badge = OwnBadge cred (mkBadgeStatus now (Just True) info)
       -- TODO [badges] retire a previously held badge
       (user', newBadge, applied) <- withStore $ \db -> do
-        (purchaseId, newBadge) <- liftIO $ createCodeBadgePurchase db user redemption cred now
+        (purchaseId, newBadge) <- liftIO $ createStashBadgePurchase db user stash cred now
         applied <- liftIO $ applyBadgeStatement db g purchaseId badgeType statement (Just cred) now
         -- a replay must not put a superseded badge back, or tell every contact again
         user' <- if newBadge then setUserBadge db user (Just badge) else getUser db userId
@@ -5818,6 +5985,7 @@ cleanupManager = do
       cleanupDeliveryJobs `catchAllErrors` eToView
       -- TODO possibly, also cleanup async commands
       cleanupProbes `catchAllErrors` eToView
+      cleanupStoreReceipts `catchAllErrors` eToView
     liftIO $ threadDelay' $ diffToMicroseconds interval
   where
     runWithoutInitialDelay cleanupInterval = flip catchAllErrors eToView $ do
@@ -5887,6 +6055,11 @@ cleanupManager = do
       ts <- liftIO getCurrentTime
       let cutoffTs = addUTCTime (-(14 * nominalDay)) ts
       withStore' (`deleteOldProbes` cutoffTs)
+    -- the badge clock, which the records are written with
+    cleanupStoreReceipts = do
+      ts <- badgeNow
+      let cutoffTs = addUTCTime (-(30 * nominalDay)) ts
+      withStore' (`deleteUnfundedStoreReceipts` cutoffTs)
 
 deleteInProgressGroup :: User -> GroupInfo -> CM ()
 deleteInProgressGroup user gInfo = do
@@ -6109,6 +6282,8 @@ chatCommandP =
       "/_reject " *> (APIRejectContact <$> A.decimal <*> (" notify=" *> onOffP <|> pure False)),
       "/_service_request " *> (APISendServiceRequest <$> A.decimal <* A.space <*> strP <*> optional (" timeout=" *> (realToFrac <$> A.double)) <*> optional (" sign_key=" *> strP) <* A.space <*> jsonP),
       "/_redeem_badge_code " *> (APIRedeemBadgeCode <$> A.decimal <* A.space <*> textP),
+      "/_badge purchase " *> (APIPurchaseBadge <$> A.decimal <*> optional (" invoice=" *> (safeDecodeUtf8 <$> A.takeTill (== ' '))) <* A.space <*> jsonP),
+      "/_badge invoice " *> (APICreateBadgeInvoice <$> A.decimal),
       "/_badge state " *> (APIGetBadgeState <$> A.decimal),
       "/_badge ledger " *> (APIGetBadgeLedger <$> A.decimal <* A.space <*> A.decimal),
       "/_badge ack " *> (APIAckBadgeAlert <$> A.decimal <* A.space <*> A.decimal <* A.space <*> badgeAlertKindP <* A.space <*> onOffP <* A.space <*> textP),
diff --git a/src/Simplex/Chat/PaymentService.hs b/src/Simplex/Chat/PaymentService.hs
index 38f94b2118..91b7a9fde1 100644
--- a/src/Simplex/Chat/PaymentService.hs
+++ b/src/Simplex/Chat/PaymentService.hs
@@ -1,17 +1,28 @@
 {-# LANGUAGE DuplicateRecordFields #-}
+{-# LANGUAGE OverloadedStrings #-}
 {-# LANGUAGE TemplateHaskell #-}
 
 module Simplex.Chat.PaymentService
   ( ServiceInvoice (..),
     ServicePayment (..),
+    appleTransactionId,
+    googlePurchaseRef,
     module Simplex.Chat.PaymentService.Types,
   ) where
 
+import qualified Data.Aeson as J
+import qualified Data.Aeson.KeyMap as JM
 import qualified Data.Aeson.TH as JQ
+import qualified Data.ByteString.Base64.URL as B64U
 import Data.Text (Text)
+import qualified Data.Text as T
+import Data.Text.Encoding (encodeUtf8)
 import Data.Time.Clock (UTCTime)
 import Simplex.Chat.PaymentService.Types
+import qualified Simplex.Messaging.Crypto as C
+import Simplex.Messaging.Encoding.String (strEncode)
 import Simplex.Messaging.Parsers (defaultJSON, dropPrefix, taggedObjectJSON)
+import Simplex.Messaging.Util (eitherToMaybe, safeDecodeUtf8)
 
 data ServiceInvoice = ServiceInvoice
   { invoiceId :: InvoiceId,
@@ -27,11 +38,24 @@ data ServiceInvoice = ServiceInvoice
 
 data ServicePayment
   = SPApple {jws :: Text}
-  | SPGoogle {token :: Text}
+  | SPGoogle {productId :: Text, token :: Text} -- the Publisher API finds a purchase by product and token
   | SPInvoice {invoiceId :: InvoiceId}
   | SPReceipt {receipt :: Text} -- transfer of unissued months
   deriving (Show)
 
+-- | Read without verifying the signature: it names the transaction, and proves nothing about it.
+appleTransactionId :: Text -> Maybe Text
+appleTransactionId signed = case T.splitOn "." signed of
+  [_, payload, _] -> do
+    J.Object o <- J.decodeStrict' =<< eitherToMaybe (B64U.decodeUnpadded $ encodeUtf8 payload)
+    J.String txId <- JM.lookup "transactionId" o
+    pure txId
+  _ -> Nothing
+
+-- | A purchase token is a bearer secret, so a purchase is named by its hash.
+googlePurchaseRef :: Text -> Text
+googlePurchaseRef = safeDecodeUtf8 . strEncode . C.sha256Hash . encodeUtf8
+
 $(JQ.deriveJSON defaultJSON ''ServiceInvoice)
 
 $(JQ.deriveJSON (taggedObjectJSON $ dropPrefix "SP") ''ServicePayment)
diff --git a/src/Simplex/Chat/PaymentService/Types.hs b/src/Simplex/Chat/PaymentService/Types.hs
index 067e170e90..fe05ecbca4 100644
--- a/src/Simplex/Chat/PaymentService/Types.hs
+++ b/src/Simplex/Chat/PaymentService/Types.hs
@@ -1,6 +1,9 @@
+{-# LANGUAGE CPP #-}
 {-# LANGUAGE DerivingStrategies #-}
 {-# LANGUAGE DuplicateRecordFields #-}
 {-# LANGUAGE GeneralizedNewtypeDeriving #-}
+{-# LANGUAGE LambdaCase #-}
+{-# LANGUAGE OverloadedStrings #-}
 {-# LANGUAGE TemplateHaskell #-}
 
 module Simplex.Chat.PaymentService.Types
@@ -8,6 +11,7 @@ module Simplex.Chat.PaymentService.Types
     InvoiceId (..),
     PaymentId (..),
     PaymentProvider (..),
+    StoreTransactionRef (..),
     CardProvider (..),
     CryptoCurrency (..),
     ServicePaymentMethod (..),
@@ -26,7 +30,16 @@ import Data.ByteString.Char8 (ByteString)
 import Data.Text (Text)
 import Data.Time.Clock (UTCTime)
 import Data.Word (Word32)
+import Simplex.Messaging.Agent.Store.DB (fromTextField_)
+import Simplex.Messaging.Encoding.String (TextEncoding (..))
 import Simplex.Messaging.Parsers (dropPrefix, enumJSON, taggedObjectJSON)
+#if defined(dbPostgres)
+import Database.PostgreSQL.Simple.FromField (FromField (..))
+import Database.PostgreSQL.Simple.ToField (ToField (..))
+#else
+import Database.SQLite.Simple.FromField (FromField (..))
+import Database.SQLite.Simple.ToField (ToField (..))
+#endif
 
 -- USD etc. are in minor units, following Stripe etc. convention
 newtype CurrencyAmount = CurrencyAmount Word32
@@ -45,6 +58,31 @@ newtype PaymentId = PaymentId Text
 data PaymentProvider = PPApple | PPGoogle | PPStripe | PPCrypto | PPCode | PPReceipt
   deriving (Eq, Show)
 
+instance TextEncoding PaymentProvider where
+  textEncode = \case
+    PPApple -> "apple"
+    PPGoogle -> "google"
+    PPStripe -> "stripe"
+    PPCrypto -> "crypto"
+    PPCode -> "code"
+    PPReceipt -> "receipt"
+  textDecode = \case
+    "apple" -> Just PPApple
+    "google" -> Just PPGoogle
+    "stripe" -> Just PPStripe
+    "crypto" -> Just PPCrypto
+    "code" -> Just PPCode
+    "receipt" -> Just PPReceipt
+    _ -> Nothing
+
+instance FromField PaymentProvider where fromField = fromTextField_ textDecode
+
+instance ToField PaymentProvider where toField = toField . textEncode
+
+-- | The stable name of one store transaction, by which a retry resolves to the same row.
+data StoreTransactionRef = StoreTransactionRef {provider :: PaymentProvider, transactionRef :: Text}
+  deriving (Eq, Show)
+
 data CardProvider = CPStripe
   deriving (Eq, Show)
 
diff --git a/src/Simplex/Chat/Store/Badges.hs b/src/Simplex/Chat/Store/Badges.hs
index 19d6d2efef..e749a7fc37 100644
--- a/src/Simplex/Chat/Store/Badges.hs
+++ b/src/Simplex/Chat/Store/Badges.hs
@@ -7,7 +7,8 @@
 {-# LANGUAGE TypeOperators #-}
 
 module Simplex.Chat.Store.Badges
-  ( BadgeCodeRedemption (..),
+  ( BadgeStash (..),
+    BadgeStashRef (..),
     UserBadgePurchase (..),
     getUserBadgePurchase,
     getBadgePurchase,
@@ -18,9 +19,18 @@ module Simplex.Chat.Store.Badges
     clearShownBadge,
     getBadgeCodeRedemption,
     createBadgeCodeRedemption,
+    BadgeReceiptRecord (..),
+    BadgeReceiptStatus (..),
+    holdStoreReceipt,
+    createBadgeStoreReceipt,
+    getOpenStorePurchases,
+    getNextHeldStoreReceipt,
+    recordStoreReceiptFailure,
+    refuseStoreReceipt,
+    deleteUnfundedStoreReceipts,
     deleteBadgeCodeRedemption,
-    createCodeBadgePurchase,
-    getCodeBadgePurchase,
+    createStashBadgePurchase,
+    getStashBadgePurchase,
     storeBadgeIssuance,
     getLatestIssuedCredential,
     storeBadgeStatement,
@@ -31,8 +41,10 @@ module Simplex.Chat.Store.Badges
 where
 
 import Control.Concurrent.STM (TVar, atomically)
+import Control.Monad (forM, forM_, join)
 import Crypto.Random (ChaChaDRG)
 import qualified Data.Aeson as J
+import Data.ByteString.Char8 (ByteString)
 import qualified Data.ByteString.Lazy.Char8 as LB
 import Data.Int (Int64)
 import Data.Maybe (isJust, mapMaybe)
@@ -41,9 +53,12 @@ import Data.Time.Clock (UTCTime)
 import Simplex.Chat.Badges
 import Simplex.Chat.Badges.Ledger
 import Simplex.Chat.Badges.Service (StatementCreditType (..), StatementDebitType (..), StatementEntry (..), StatementEntryType (..))
-import Simplex.Chat.Badges.Types (BadgeAlertKind, BadgeIssueError (..), BadgeIssueFailure, BadgePurchaseStatus (..))
-import Simplex.Chat.Store.Shared (insertedRowId)
+import Simplex.Chat.Badges.Types (BadgeAlertKind, BadgeIssueError (..), BadgeIssueFailure, BadgePurchaseStatus (..), OpenStorePurchase (..))
+import Simplex.Chat.PaymentService (ServicePayment)
+import Simplex.Chat.PaymentService.Types (StoreTransactionRef (..))
+import Simplex.Chat.Store.Shared (StoreError, insertedRowId)
 import Simplex.Chat.Types
+import Simplex.Messaging.Agent.Protocol (UserId)
 import Simplex.Messaging.Agent.Store.DB (Binary (..), BoolInt (..))
 import qualified Simplex.Messaging.Agent.Store.DB as DB
 import qualified Simplex.Messaging.Crypto as C
@@ -58,18 +73,20 @@ import Database.SQLite.Simple (Only (..), (:.) (..))
 import Database.SQLite.Simple.QQ (sql)
 #endif
 
--- | The keys one redemption attempt is signed with, stashed before the request is sent so that a
--- retry reaches the service as the same signer and is answered with the credential already issued.
-data BadgeCodeRedemption = BadgeCodeRedemption
-  { redemptionId :: Int64,
+-- | The keys one attempt to fund a badge is signed with, stashed before the request is sent so that
+-- a retry reaches the service as the same signer and is answered with the credential already issued.
+data BadgeStash = BadgeStash
+  { stashRef :: BadgeStashRef,
     purchaseKey :: C.PublicKeyEd25519,
     purchasePrivKey :: C.PrivateKeyEd25519,
     masterKey :: BadgeMasterKey
   }
 
-getBadgeCodeRedemption :: DB.Connection -> User -> Text -> IO (Maybe BadgeCodeRedemption)
+data BadgeStashRef = BSRCodeRedemption Int64 | BSRStoreReceipt Int64
+
+getBadgeCodeRedemption :: DB.Connection -> User -> Text -> IO (Maybe BadgeStash)
 getBadgeCodeRedemption db User {userId} code =
-  maybeFirstRow toRedemption $
+  maybeFirstRow (toBadgeStash BSRCodeRedemption) $
     DB.query
       db
       [sql|
@@ -78,11 +95,8 @@ getBadgeCodeRedemption db User {userId} code =
         WHERE user_id = ? AND code = ?
       |]
       (userId, code)
-  where
-    toRedemption (redemptionId, purchaseKey, purchasePrivKey, Binary mk) =
-      BadgeCodeRedemption {redemptionId, purchaseKey, purchasePrivKey, masterKey = BadgeMasterKey mk}
 
-createBadgeCodeRedemption :: DB.Connection -> TVar ChaChaDRG -> User -> Text -> UTCTime -> IO BadgeCodeRedemption
+createBadgeCodeRedemption :: DB.Connection -> TVar ChaChaDRG -> User -> Text -> UTCTime -> IO BadgeStash
 createBadgeCodeRedemption db g User {userId} code now = do
   (purchaseKey, purchasePrivKey) <- atomically $ C.generateKeyPair g
   masterKey@(BadgeMasterKey mk) <- generateMasterKey g
@@ -94,42 +108,205 @@ createBadgeCodeRedemption db g User {userId} code now = do
     |]
     (userId, code, purchaseKey, purchasePrivKey, Binary mk, now)
   redemptionId <- insertedRowId db
-  pure BadgeCodeRedemption {redemptionId, purchaseKey, purchasePrivKey, masterKey}
+  pure BadgeStash {stashRef = BSRCodeRedemption redemptionId, purchaseKey, purchasePrivKey, masterKey}
 
--- | Drop a stashed attempt whose code the service refused for good, unless a purchase already
--- came from it - badge_purchases references this row.
-deleteBadgeCodeRedemption :: DB.Connection -> Int64 -> IO ()
-deleteBadgeCodeRedemption db redemptionId =
+-- | Our record of a store receipt, as against the receipt itself: held until the service credits or refuses it.
+data BadgeReceiptRecord = BadgeReceiptRecord
+  { receiptId :: Int64,
+    ownerId :: UserId,
+    status :: BadgeReceiptStatus
+  }
+
+data BadgeReceiptStatus
+  = RSHeld {stash :: BadgeStash, payment :: Text, nextAttemptAt :: UTCTime, retryDelay :: Maybe Int64}
+  | RSCredited {badgePurchaseId :: Int64}
+  | RSRefused {refusal :: Maybe BadgeIssueFailure}
+
+-- | Resolves a store transaction to the record that owns it, looking up by its reference again after each step
+-- rather than trusting the write: finding none still leaves the echoed invoice's record to attach it to, and a
+-- concurrent hand-over of the same transaction may win either write. It stays with the record that already has
+-- it, whose keys the service may have credited; failing that it joins the record Buy created; and only when the
+-- store echoed no invoice does the presenting profile get a new one, nothing else saying who paid.
+holdStoreReceipt :: DB.Connection -> TVar ChaChaDRG -> User -> Maybe Text -> StoreTransactionRef -> ServicePayment -> UTCTime -> IO (Maybe BadgeReceiptRecord)
+holdStoreReceipt db g User {userId} invoiceId_ txRef@StoreTransactionRef {provider, transactionRef} payment now =
+  getReceiptRecord db txRef >>= \case
+    Just r@BadgeReceiptRecord {receiptId} -> do
+      -- a resolved record stays resolved, so a hand-over landing just after its credit cannot hold it again
+      DB.execute db "UPDATE badge_store_receipts SET payment = ? WHERE badge_store_receipt_id = ? AND payment IS NOT NULL" (paymentJSON, receiptId)
+      pure $ Just r
+    Nothing -> do
+      forM_ invoiceId_ $ \invoiceId ->
+        DB.execute
+          db
+          "UPDATE badge_store_receipts SET provider = ?, transaction_ref = ?, payment = ?, next_attempt_at = ? WHERE invoice_id = ? AND transaction_ref IS NULL"
+          (provider, transactionRef, paymentJSON, now, invoiceId)
+      getReceiptRecord db txRef >>= \case
+        Just r -> pure $ Just r
+        Nothing -> do
+          insertReceipt
+          getReceiptRecord db txRef
+  where
+    paymentJSON = safeDecodeUtf8 . LB.toStrict $ J.encode payment
+    insertReceipt = do
+      (purchaseKey, purchasePrivKey) <- atomically (C.generateKeyPair g) :: IO C.KeyPairEd25519
+      BadgeMasterKey mk <- generateMasterKey g
+      -- an invoice id another record holds is not repeated: this record is then keyed by its transaction alone
+      invoiceId' <- fmap join . forM invoiceId_ $ \invoiceId -> do
+        taken <- DB.query db "SELECT badge_store_receipt_id FROM badge_store_receipts WHERE invoice_id = ?" (Only invoiceId) :: IO [Only Int64]
+        pure $ if null taken then Just invoiceId else Nothing
+      DB.execute
+        db
+        [sql|
+          INSERT INTO badge_store_receipts
+            (user_id, invoice_id, provider, transaction_ref, payment, next_attempt_at, purchase_key, purchase_priv_key, master_key, created_at)
+          VALUES (?,?,?,?,?,?,?,?,?,?)
+          ON CONFLICT DO NOTHING
+        |]
+        ((userId, invoiceId', provider, transactionRef, paymentJSON, now) :. (purchaseKey, purchasePrivKey, Binary mk, now))
+
+getReceiptRecord :: DB.Connection -> StoreTransactionRef -> IO (Maybe BadgeReceiptRecord)
+getReceiptRecord db StoreTransactionRef {provider, transactionRef} =
+  maybeFirstRow toReceiptRecord $
+    DB.query
+      db
+      [sql|
+        SELECT r.badge_store_receipt_id, r.user_id, r.purchase_key, r.purchase_priv_key, r.master_key,
+          r.payment, r.next_attempt_at, r.retry_delay, p.badge_purchase_id, r.credit_error
+        FROM badge_store_receipts r
+        LEFT JOIN badge_purchases p ON p.badge_store_receipt_id = r.badge_store_receipt_id
+        WHERE r.provider = ? AND r.transaction_ref = ?
+      |]
+      (provider, transactionRef)
+  where
+    toReceiptRecord ((receiptId, ownerId, purchaseKey, purchasePrivKey, mk) :. (payment_, nextAttemptAt_, retryDelay, purchaseId_, refusal)) =
+      BadgeReceiptRecord {receiptId, ownerId, status}
+      where
+        status = case (payment_, nextAttemptAt_) of
+          (Just payment, Just nextAttemptAt) -> RSHeld {stash = toBadgeStash BSRStoreReceipt (receiptId, purchaseKey, purchasePrivKey, mk), payment, nextAttemptAt, retryDelay}
+          _ -> maybe (RSRefused refusal) RSCredited purchaseId_
+
+-- | The record made when Buy is tapped, before any receipt: the store echoes its invoice id.
+createBadgeStoreReceipt :: DB.Connection -> TVar ChaChaDRG -> User -> Text -> UTCTime -> IO ()
+createBadgeStoreReceipt db g User {userId} invoiceId now = do
+  (purchaseKey, purchasePrivKey) <- atomically (C.generateKeyPair g) :: IO C.KeyPairEd25519
+  BadgeMasterKey mk <- generateMasterKey g
+  DB.execute
+    db
+    [sql|
+      INSERT INTO badge_store_receipts (user_id, invoice_id, purchase_key, purchase_priv_key, master_key, created_at)
+      VALUES (?,?,?,?,?,?)
+    |]
+    (userId, invoiceId, purchaseKey, purchasePrivKey, Binary mk, now)
+
+-- | No receipt yet, or one held: a credited or refused record is resolved and not listed.
+getOpenStorePurchases :: DB.Connection -> User -> IO [OpenStorePurchase]
+getOpenStorePurchases db User {userId} =
+  map toOpenStorePurchase
+    <$> DB.query
+      db
+      [sql|
+        SELECT invoice_id, transaction_ref, credit_error
+        FROM badge_store_receipts
+        WHERE user_id = ? AND (transaction_ref IS NULL OR payment IS NOT NULL)
+        ORDER BY badge_store_receipt_id
+      |]
+      (Only userId)
+  where
+    toOpenStorePurchase (invoiceId, transactionRef, creditError) = OpenStorePurchase {invoiceId, transactionRef, creditError}
+
+getNextHeldStoreReceipt :: DB.Connection -> UserId -> IO (Either StoreError (Maybe BadgeReceiptRecord))
+getNextHeldStoreReceipt db userId =
+  fmap Right . maybeFirstRow toHeld $
+    DB.query
+      db
+      [sql|
+        SELECT r.badge_store_receipt_id, r.purchase_key, r.purchase_priv_key, r.master_key, r.payment, r.next_attempt_at, r.retry_delay
+        FROM badge_store_receipts r
+        JOIN users u ON u.user_id = r.user_id
+        WHERE r.user_id = ? AND r.payment IS NOT NULL AND u.shown_badge_id IS NULL
+        ORDER BY r.next_attempt_at, r.retry_count, r.badge_store_receipt_id
+        LIMIT 1
+      |]
+      (Only userId)
+  where
+    toHeld (stashRow@(receiptId, _, _, _) :. (payment, nextAttemptAt, retryDelay)) =
+      BadgeReceiptRecord {receiptId, ownerId = userId, status = RSHeld {stash = toBadgeStash BSRStoreReceipt stashRow, payment, nextAttemptAt, retryDelay}}
+
+recordStoreReceiptFailure :: DB.Connection -> Int64 -> Int64 -> UTCTime -> BadgeIssueFailure -> IO ()
+recordStoreReceiptFailure db receiptId retryDelay nextAttemptAt failure =
+  DB.execute
+    db
+    [sql|
+      UPDATE badge_store_receipts
+      SET retry_delay = ?, next_attempt_at = ?, retry_count = retry_count + 1, credit_error = ?
+      WHERE badge_store_receipt_id = ? AND payment IS NOT NULL
+    |]
+    (retryDelay, nextAttemptAt, failure, receiptId)
+
+-- | Kept rather than deleted, so that a later hand-over of the same transaction is answered from the record.
+refuseStoreReceipt :: DB.Connection -> Int64 -> BadgeIssueFailure -> IO ()
+refuseStoreReceipt db receiptId refusal =
+  DB.execute
+    db
+    "UPDATE badge_store_receipts SET payment = NULL, next_attempt_at = NULL, retry_delay = NULL, retry_count = 0, credit_error = ? WHERE badge_store_receipt_id = ?"
+    (refusal, receiptId)
+
+-- | A held record is paid for and a credited one is referenced by its purchase, so neither is deleted.
+deleteUnfundedStoreReceipts :: DB.Connection -> UTCTime -> IO ()
+deleteUnfundedStoreReceipts db createdBefore =
+  DB.execute
+    db
+    [sql|
+      DELETE FROM badge_store_receipts
+      WHERE payment IS NULL AND created_at < ?
+        AND NOT EXISTS (SELECT 1 FROM badge_purchases p WHERE p.badge_store_receipt_id = badge_store_receipts.badge_store_receipt_id)
+    |]
+    (Only createdBefore)
+
+toBadgeStash :: (Int64 -> BadgeStashRef) -> (Int64, C.PublicKeyEd25519, C.PrivateKeyEd25519, Binary ByteString) -> BadgeStash
+toBadgeStash ref (stashId, purchaseKey, purchasePrivKey, Binary mk) =
+  BadgeStash {stashRef = ref stashId, purchaseKey, purchasePrivKey, masterKey = BadgeMasterKey mk}
+
+-- | Drop the keys stashed for a code the service refused for good, unless a purchase already came
+-- from them - badge_purchases references their row.
+deleteBadgeCodeRedemption :: DB.Connection -> User -> Text -> IO ()
+deleteBadgeCodeRedemption db User {userId} code =
   DB.execute
     db
     [sql|
       DELETE FROM badge_code_redemptions
-      WHERE badge_code_redemption_id = ?
-        AND NOT EXISTS (SELECT 1 FROM badge_purchases WHERE badge_code_redemption_id = ?)
+      WHERE user_id = ? AND code = ?
+        AND NOT EXISTS (SELECT 1 FROM badge_purchases p WHERE p.badge_code_redemption_id = badge_code_redemptions.badge_code_redemption_id)
     |]
-    (redemptionId, redemptionId)
+    (userId, code)
 
--- | 'False' when the code was already redeemed here: the service replays the credential it
+-- | 'False' when the stash already funded a purchase here: the service replays the credential it
 -- issued, and that must add no purchase and leave the shown badge alone.
-createCodeBadgePurchase :: DB.Connection -> User -> BadgeCodeRedemption -> BadgeCredential -> UTCTime -> IO (Int64, Bool)
-createCodeBadgePurchase db User {userId} redemption credential now =
-  getCodeBadgePurchase db redemption >>= \case
+createStashBadgePurchase :: DB.Connection -> User -> BadgeStash -> BadgeCredential -> UTCTime -> IO (Int64, Bool)
+createStashBadgePurchase db User {userId} stash credential now = do
+  -- the credit settles a held receipt in the transaction that stores its purchase, a replay included
+  forM_ storeReceiptId_ $ \storeReceiptId -> DB.execute db "UPDATE badge_store_receipts SET payment = NULL, next_attempt_at = NULL, retry_delay = NULL, retry_count = 0 WHERE badge_store_receipt_id = ?" (Only storeReceiptId)
+  getStashBadgePurchase db stash >>= \case
     Just purchaseId -> pure (purchaseId, False)
     Nothing -> do
       DB.execute
         db
         [sql|
           INSERT INTO badge_purchases
-            (user_id, purchase_key, purchase_priv_key, master_key, initial_badge_type, current_badge_type, status, badge_code_redemption_id, created_at, updated_at)
-          VALUES (?,?,?,?,?,?,?,?,?,?)
+            (user_id, purchase_key, purchase_priv_key, master_key, initial_badge_type, current_badge_type, status,
+             badge_code_redemption_id, badge_store_receipt_id, created_at, updated_at)
+          VALUES (?,?,?,?,?,?,?,?,?,?,?)
         |]
-        (userId, purchaseKey, purchasePrivKey, Binary mk, badgeType, badgeType, PSIssued, redemptionId, now, now)
+        ((userId, purchaseKey, purchasePrivKey, Binary mk, badgeType, badgeType) :. (PSIssued, redemptionId_, storeReceiptId_, now, now))
       purchaseId <- insertedRowId db
       DB.execute db "UPDATE users SET shown_badge_id = ? WHERE user_id = ?" (purchaseId, userId)
       pure (purchaseId, True)
   where
-    BadgeCodeRedemption {redemptionId, purchaseKey, purchasePrivKey, masterKey = BadgeMasterKey mk} = redemption
+    BadgeStash {stashRef, purchaseKey, purchasePrivKey, masterKey = BadgeMasterKey mk} = stash
     BadgeCredential {badgeInfo = BadgeInfo {badgeType}} = credential
+    (redemptionId_, storeReceiptId_) = case stashRef of
+      BSRCodeRedemption redemptionId -> (Just redemptionId, Nothing)
+      BSRStoreReceipt storeReceiptId -> (Nothing, Just storeReceiptId)
 
 -- | The period comes from the ledger, the expiry from the credential, which runs a week longer.
 -- 'False' means no issuance row was written, which the caller reports rather than drop in silence.
@@ -194,10 +371,13 @@ getIssuedPeriod db badgePurchaseId entryId = do
     [(Just periodStart, periodEnd)] -> Just (periodStart, periodEnd)
     _ -> Nothing
 
-getCodeBadgePurchase :: DB.Connection -> BadgeCodeRedemption -> IO (Maybe Int64)
-getCodeBadgePurchase db BadgeCodeRedemption {redemptionId} =
-  maybeFirstRow fromOnly $
-    DB.query db "SELECT badge_purchase_id FROM badge_purchases WHERE badge_code_redemption_id = ?" (Only redemptionId)
+getStashBadgePurchase :: DB.Connection -> BadgeStash -> IO (Maybe Int64)
+getStashBadgePurchase db BadgeStash {stashRef} =
+  maybeFirstRow fromOnly $ case stashRef of
+    BSRCodeRedemption redemptionId ->
+      DB.query db "SELECT badge_purchase_id FROM badge_purchases WHERE badge_code_redemption_id = ?" (Only redemptionId)
+    BSRStoreReceipt storeReceiptId ->
+      DB.query db "SELECT badge_purchase_id FROM badge_purchases WHERE badge_store_receipt_id = ?" (Only storeReceiptId)
 
 data UserBadgePurchase = UserBadgePurchase
   { badgePurchaseId :: Int64,
@@ -370,7 +550,7 @@ getBadgeLedger db User {userId} badgePurchaseId =
 toStatementEntry :: (Text, Int, Int, UTCTime, UTCTime, BadgeType) :. (Maybe UTCTime, UTCTime, Text, Maybe Text, Maybe Text, Maybe Text) -> Maybe StatementEntry
 toStatementEntry ((entryId, changeMonths, balanceMonths, balanceStartTs, balanceAnchorTs, balanceBadgeType) :. (wasPausedSince, createdAt, entryType_, credit_, debit_, value_)) =
   (\entryType -> StatementEntry {entryId, changeMonths, balanceMonths, balanceStartTs, balanceAnchorTs, balanceBadgeType, wasPausedSince, createdAt, entryType})
-    <$> maybe (entryTypeFromColumns entryType_ credit_ debit_) (entryTypeFromValue entryType_) value_
+    <$> maybe (entryTypeFromColumns Nothing entryType_ credit_ debit_) (entryTypeFromValue entryType_) value_
 
 -- | Decodes the stored JSON rather than rebuilding from the tag, so a version that has since
 -- learnt the type reads it with its fields, and one that has not still gets it back verbatim.
diff --git a/src/Simplex/Chat/Store/Postgres/Migrations.hs b/src/Simplex/Chat/Store/Postgres/Migrations.hs
index 24ed45c9a9..dd5e812595 100644
--- a/src/Simplex/Chat/Store/Postgres/Migrations.hs
+++ b/src/Simplex/Chat/Store/Postgres/Migrations.hs
@@ -53,6 +53,7 @@ import Simplex.Chat.Store.Postgres.Migrations.M20260904_file_badges
 import Simplex.Chat.Store.Postgres.Migrations.M20260915_user_badges
 import Simplex.Chat.Store.Postgres.Migrations.M20260918_badge_issue_errors
 import Simplex.Chat.Store.Postgres.Migrations.M20260923_preferences_json
+import Simplex.Chat.Store.Postgres.Migrations.M20260925_badge_store_receipts
 import Simplex.Messaging.Agent.Store.Shared (Migration (..))
 
 schemaMigrations :: [(String, Text, Maybe Text)]
@@ -105,7 +106,8 @@ schemaMigrations =
     ("20260904_file_badges", m20260904_file_badges, Just down_m20260904_file_badges),
     ("20260915_user_badges", m20260915_user_badges, Just down_m20260915_user_badges),
     ("20260918_badge_issue_errors", m20260918_badge_issue_errors, Just down_m20260918_badge_issue_errors),
-    ("20260923_preferences_json", m20260923_preferences_json, Just down_m20260923_preferences_json)
+    ("20260923_preferences_json", m20260923_preferences_json, Just down_m20260923_preferences_json),
+    ("20260925_badge_store_receipts", m20260925_badge_store_receipts, Just down_m20260925_badge_store_receipts)
   ]
 
 -- | The list of migrations in ascending order by date
diff --git a/src/Simplex/Chat/Store/Postgres/Migrations/M20260915_user_badges.hs b/src/Simplex/Chat/Store/Postgres/Migrations/M20260915_user_badges.hs
index 98bdd53db7..20fc4fa99d 100644
--- a/src/Simplex/Chat/Store/Postgres/Migrations/M20260915_user_badges.hs
+++ b/src/Simplex/Chat/Store/Postgres/Migrations/M20260915_user_badges.hs
@@ -152,6 +152,7 @@ DROP TABLE @badge_prices;
 |]
 
 {- TODO [badges] deferred draft schema for paid purchases, subscriptions, upgrades and transfers.
+The service added @badge_purchases.payment_id and @badge_ledger.payment_id in its 20260925_badge_store_receipts, so they left this draft; the client's stay deferred with the rest, as nothing writes its @payments yet.
 
 CREATE TABLE @subscription_charges(
   charge_id TEXT NOT NULL PRIMARY KEY,
@@ -165,10 +166,6 @@ CREATE TABLE @subscription_charges(
   UNIQUE(payment_id, provider_charge_ref)
 );
 
-ALTER TABLE @badge_purchases ADD COLUMN payment_id TEXT REFERENCES @payments;
-
-CREATE UNIQUE INDEX @idx_badge_purchases_payment ON @badge_purchases(payment_id);
-
 CREATE TABLE @badge_invoices(
   invoice_id TEXT NOT NULL PRIMARY KEY REFERENCES @invoices ON DELETE CASCADE,
   badge_purchase_id BIGINT NOT NULL REFERENCES @badge_purchases ON DELETE CASCADE,
@@ -200,16 +197,12 @@ CREATE TABLE @badge_subscription_changes(
 
 CREATE INDEX @idx_badge_subscription_changes_purchase ON @badge_subscription_changes(badge_purchase_id);
 
-ALTER TABLE @badge_ledger ADD COLUMN payment_id TEXT REFERENCES @payments;
-
 ALTER TABLE @badge_ledger ADD COLUMN charge_id TEXT REFERENCES @subscription_charges;
 
 ALTER TABLE @badge_ledger ADD COLUMN from_purchase_id BIGINT REFERENCES @badge_purchases;
 
 ALTER TABLE @badge_ledger ADD COLUMN to_purchase_id BIGINT REFERENCES @badge_purchases;
 
-CREATE INDEX @idx_badge_ledger_payment ON @badge_ledger(payment_id);
-
 CREATE INDEX @idx_badge_ledger_charge ON @badge_ledger(charge_id);
 
 CREATE INDEX @idx_badge_ledger_from_purchase ON @badge_ledger(from_purchase_id);
@@ -217,11 +210,9 @@ CREATE INDEX @idx_badge_ledger_from_purchase ON @badge_ledger(from_purchase_id);
 CREATE INDEX @idx_badge_ledger_to_purchase ON @badge_ledger(to_purchase_id);
 
 -- down
-DROP INDEX @idx_badge_ledger_payment;
 DROP INDEX @idx_badge_ledger_charge;
 DROP INDEX @idx_badge_ledger_from_purchase;
 DROP INDEX @idx_badge_ledger_to_purchase;
-ALTER TABLE @badge_ledger DROP COLUMN payment_id;
 ALTER TABLE @badge_ledger DROP COLUMN charge_id;
 ALTER TABLE @badge_ledger DROP COLUMN from_purchase_id;
 ALTER TABLE @badge_ledger DROP COLUMN to_purchase_id;
@@ -231,8 +222,6 @@ DROP INDEX @idx_badge_invoices_purchase;
 DROP INDEX @idx_badge_invoices_offer;
 DROP INDEX @idx_badge_invoices_price;
 DROP TABLE @badge_invoices;
-DROP INDEX @idx_badge_purchases_payment;
-ALTER TABLE @badge_purchases DROP COLUMN payment_id;
 DROP TABLE @subscription_charges;
 -}
 
diff --git a/src/Simplex/Chat/Store/Postgres/Migrations/M20260925_badge_store_receipts.hs b/src/Simplex/Chat/Store/Postgres/Migrations/M20260925_badge_store_receipts.hs
new file mode 100644
index 0000000000..093031e21d
--- /dev/null
+++ b/src/Simplex/Chat/Store/Postgres/Migrations/M20260925_badge_store_receipts.hs
@@ -0,0 +1,51 @@
+{-# LANGUAGE OverloadedStrings #-}
+{-# LANGUAGE QuasiQuotes #-}
+
+module Simplex.Chat.Store.Postgres.Migrations.M20260925_badge_store_receipts where
+
+import Data.Text (Text)
+import Text.RawString.QQ (r)
+
+-- | invoice_id is null for a receipt naming one another row holds: the transaction still has to be
+-- creditable, and its reference identifies it. provider and transaction_ref are null until a receipt
+-- arrives, and distinct NULLs let several rows await one at once. payment is held from the receipt's
+-- arrival until the service credits or refuses it; a refused row keeps its refusal in credit_error.
+m20260925_badge_store_receipts :: Text
+m20260925_badge_store_receipts =
+  [r|
+CREATE TABLE badge_store_receipts(
+  badge_store_receipt_id BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+  user_id BIGINT NOT NULL REFERENCES users ON DELETE CASCADE,
+  invoice_id TEXT UNIQUE,
+  provider TEXT,
+  transaction_ref TEXT,
+  purchase_key BYTEA NOT NULL,
+  purchase_priv_key BYTEA NOT NULL,
+  master_key BYTEA NOT NULL,
+  created_at TIMESTAMPTZ NOT NULL,
+  payment TEXT,
+  next_attempt_at TIMESTAMPTZ,
+  retry_delay BIGINT,
+  retry_count BIGINT NOT NULL DEFAULT 0,
+  credit_error TEXT,
+  UNIQUE(provider, transaction_ref)
+);
+
+CREATE INDEX idx_badge_store_receipts_user ON badge_store_receipts(user_id);
+
+ALTER TABLE badge_purchases ADD COLUMN badge_store_receipt_id BIGINT REFERENCES badge_store_receipts;
+
+CREATE UNIQUE INDEX idx_badge_purchases_store_receipt ON badge_purchases(badge_store_receipt_id);
+|]
+
+down_m20260925_badge_store_receipts :: Text
+down_m20260925_badge_store_receipts =
+  [r|
+DROP INDEX idx_badge_purchases_store_receipt;
+
+ALTER TABLE badge_purchases DROP COLUMN badge_store_receipt_id;
+
+DROP INDEX idx_badge_store_receipts_user;
+
+DROP TABLE badge_store_receipts;
+|]
diff --git a/src/Simplex/Chat/Store/Postgres/Migrations/chat_schema.sql b/src/Simplex/Chat/Store/Postgres/Migrations/chat_schema.sql
index ad975874db..faf872db07 100644
--- a/src/Simplex/Chat/Store/Postgres/Migrations/chat_schema.sql
+++ b/src/Simplex/Chat/Store/Postgres/Migrations/chat_schema.sql
@@ -279,7 +279,8 @@ CREATE TABLE test_chat_schema.badge_purchases (
     issue_failed_since timestamp with time zone,
     issue_error_at timestamp with time zone,
     issue_error text,
-    next_wake_at timestamp with time zone
+    next_wake_at timestamp with time zone,
+    badge_store_receipt_id bigint
 );
 
 
@@ -295,6 +296,36 @@ ALTER TABLE test_chat_schema.badge_purchases ALTER COLUMN badge_purchase_id ADD
 
 
 
+CREATE TABLE test_chat_schema.badge_store_receipts (
+    badge_store_receipt_id bigint NOT NULL,
+    user_id bigint NOT NULL,
+    invoice_id text,
+    provider text,
+    transaction_ref text,
+    purchase_key bytea NOT NULL,
+    purchase_priv_key bytea NOT NULL,
+    master_key bytea NOT NULL,
+    created_at timestamp with time zone NOT NULL,
+    payment text,
+    next_attempt_at timestamp with time zone,
+    retry_delay bigint,
+    retry_count bigint DEFAULT 0 NOT NULL,
+    credit_error text
+);
+
+
+
+ALTER TABLE test_chat_schema.badge_store_receipts ALTER COLUMN badge_store_receipt_id ADD GENERATED ALWAYS AS IDENTITY (
+    SEQUENCE NAME test_chat_schema.badge_store_receipts_badge_store_receipt_id_seq
+    START WITH 1
+    INCREMENT BY 1
+    NO MINVALUE
+    NO MAXVALUE
+    CACHE 1
+);
+
+
+
 CREATE TABLE test_chat_schema.calls (
     call_id bigint NOT NULL,
     contact_id bigint NOT NULL,
@@ -1793,6 +1824,21 @@ ALTER TABLE ONLY test_chat_schema.badge_purchases
 
 
 
+ALTER TABLE ONLY test_chat_schema.badge_store_receipts
+    ADD CONSTRAINT badge_store_receipts_invoice_id_key UNIQUE (invoice_id);
+
+
+
+ALTER TABLE ONLY test_chat_schema.badge_store_receipts
+    ADD CONSTRAINT badge_store_receipts_pkey PRIMARY KEY (badge_store_receipt_id);
+
+
+
+ALTER TABLE ONLY test_chat_schema.badge_store_receipts
+    ADD CONSTRAINT badge_store_receipts_provider_transaction_ref_key UNIQUE (provider, transaction_ref);
+
+
+
 ALTER TABLE ONLY test_chat_schema.calls
     ADD CONSTRAINT calls_pkey PRIMARY KEY (call_id);
 
@@ -2192,10 +2238,18 @@ CREATE UNIQUE INDEX idx_badge_purchases_code_redemption ON test_chat_schema.badg
 
 
 
+CREATE UNIQUE INDEX idx_badge_purchases_store_receipt ON test_chat_schema.badge_purchases USING btree (badge_store_receipt_id);
+
+
+
 CREATE INDEX idx_badge_purchases_user ON test_chat_schema.badge_purchases USING btree (user_id);
 
 
 
+CREATE INDEX idx_badge_store_receipts_user ON test_chat_schema.badge_store_receipts USING btree (user_id);
+
+
+
 CREATE INDEX idx_calls_chat_item_id ON test_chat_schema.calls USING btree (chat_item_id);
 
 
@@ -2994,11 +3048,21 @@ ALTER TABLE ONLY test_chat_schema.badge_purchases
 
 
 
+ALTER TABLE ONLY test_chat_schema.badge_purchases
+    ADD CONSTRAINT badge_purchases_badge_store_receipt_id_fkey FOREIGN KEY (badge_store_receipt_id) REFERENCES test_chat_schema.badge_store_receipts(badge_store_receipt_id);
+
+
+
 ALTER TABLE ONLY test_chat_schema.badge_purchases
     ADD CONSTRAINT badge_purchases_user_id_fkey FOREIGN KEY (user_id) REFERENCES test_chat_schema.users(user_id) ON DELETE CASCADE;
 
 
 
+ALTER TABLE ONLY test_chat_schema.badge_store_receipts
+    ADD CONSTRAINT badge_store_receipts_user_id_fkey FOREIGN KEY (user_id) REFERENCES test_chat_schema.users(user_id) ON DELETE CASCADE;
+
+
+
 ALTER TABLE ONLY test_chat_schema.calls
     ADD CONSTRAINT calls_chat_item_id_fkey FOREIGN KEY (chat_item_id) REFERENCES test_chat_schema.chat_items(chat_item_id) ON DELETE CASCADE;
 
diff --git a/src/Simplex/Chat/Store/SQLite/Migrations.hs b/src/Simplex/Chat/Store/SQLite/Migrations.hs
index 4dcefa1598..a5cb6b012d 100644
--- a/src/Simplex/Chat/Store/SQLite/Migrations.hs
+++ b/src/Simplex/Chat/Store/SQLite/Migrations.hs
@@ -176,6 +176,7 @@ import Simplex.Chat.Store.SQLite.Migrations.M20260904_file_badges
 import Simplex.Chat.Store.SQLite.Migrations.M20260915_user_badges
 import Simplex.Chat.Store.SQLite.Migrations.M20260918_badge_issue_errors
 import Simplex.Chat.Store.SQLite.Migrations.M20260923_preferences_json
+import Simplex.Chat.Store.SQLite.Migrations.M20260925_badge_store_receipts
 import Simplex.Messaging.Agent.Store.Shared (Migration (..))
 
 schemaMigrations :: [(String, Query, Maybe Query)]
@@ -351,7 +352,8 @@ schemaMigrations =
     ("20260904_file_badges", m20260904_file_badges, Just down_m20260904_file_badges),
     ("20260915_user_badges", m20260915_user_badges, Just down_m20260915_user_badges),
     ("20260918_badge_issue_errors", m20260918_badge_issue_errors, Just down_m20260918_badge_issue_errors),
-    ("20260923_preferences_json", m20260923_preferences_json, Just down_m20260923_preferences_json)
+    ("20260923_preferences_json", m20260923_preferences_json, Just down_m20260923_preferences_json),
+    ("20260925_badge_store_receipts", m20260925_badge_store_receipts, Just down_m20260925_badge_store_receipts)
   ]
 
 -- | The list of migrations in ascending order by date
diff --git a/src/Simplex/Chat/Store/SQLite/Migrations/M20260915_user_badges.hs b/src/Simplex/Chat/Store/SQLite/Migrations/M20260915_user_badges.hs
index 3462db9bc1..8646d8b29e 100644
--- a/src/Simplex/Chat/Store/SQLite/Migrations/M20260915_user_badges.hs
+++ b/src/Simplex/Chat/Store/SQLite/Migrations/M20260915_user_badges.hs
@@ -153,6 +153,7 @@ DROP TABLE @badge_prices;
 |]
 
 {- TODO [badges] deferred draft schema for paid purchases, subscriptions, upgrades and transfers.
+The service added @badge_purchases.payment_id and @badge_ledger.payment_id in its 20260925_badge_store_receipts, so they left this draft; the client's stay deferred with the rest, as nothing writes its @payments yet.
 
 CREATE TABLE @subscription_charges(
   charge_id TEXT NOT NULL PRIMARY KEY,
@@ -166,10 +167,6 @@ CREATE TABLE @subscription_charges(
   UNIQUE(payment_id, provider_charge_ref)
 ) STRICT;
 
-ALTER TABLE @badge_purchases ADD COLUMN payment_id TEXT REFERENCES @payments;
-
-CREATE UNIQUE INDEX @idx_badge_purchases_payment ON @badge_purchases(payment_id);
-
 CREATE TABLE @badge_invoices(
   invoice_id TEXT NOT NULL PRIMARY KEY REFERENCES @invoices ON DELETE CASCADE,
   badge_purchase_id INTEGER NOT NULL REFERENCES @badge_purchases ON DELETE CASCADE,
@@ -201,16 +198,12 @@ CREATE TABLE @badge_subscription_changes(
 
 CREATE INDEX @idx_badge_subscription_changes_purchase ON @badge_subscription_changes(badge_purchase_id);
 
-ALTER TABLE @badge_ledger ADD COLUMN payment_id TEXT REFERENCES @payments;
-
 ALTER TABLE @badge_ledger ADD COLUMN charge_id TEXT REFERENCES @subscription_charges;
 
 ALTER TABLE @badge_ledger ADD COLUMN from_purchase_id INTEGER REFERENCES @badge_purchases;
 
 ALTER TABLE @badge_ledger ADD COLUMN to_purchase_id INTEGER REFERENCES @badge_purchases;
 
-CREATE INDEX @idx_badge_ledger_payment ON @badge_ledger(payment_id);
-
 CREATE INDEX @idx_badge_ledger_charge ON @badge_ledger(charge_id);
 
 CREATE INDEX @idx_badge_ledger_from_purchase ON @badge_ledger(from_purchase_id);
@@ -218,11 +211,9 @@ CREATE INDEX @idx_badge_ledger_from_purchase ON @badge_ledger(from_purchase_id);
 CREATE INDEX @idx_badge_ledger_to_purchase ON @badge_ledger(to_purchase_id);
 
 -- down
-DROP INDEX @idx_badge_ledger_payment;
 DROP INDEX @idx_badge_ledger_charge;
 DROP INDEX @idx_badge_ledger_from_purchase;
 DROP INDEX @idx_badge_ledger_to_purchase;
-ALTER TABLE @badge_ledger DROP COLUMN payment_id;
 ALTER TABLE @badge_ledger DROP COLUMN charge_id;
 ALTER TABLE @badge_ledger DROP COLUMN from_purchase_id;
 ALTER TABLE @badge_ledger DROP COLUMN to_purchase_id;
@@ -232,8 +223,6 @@ DROP INDEX @idx_badge_invoices_purchase;
 DROP INDEX @idx_badge_invoices_offer;
 DROP INDEX @idx_badge_invoices_price;
 DROP TABLE @badge_invoices;
-DROP INDEX @idx_badge_purchases_payment;
-ALTER TABLE @badge_purchases DROP COLUMN payment_id;
 DROP TABLE @subscription_charges;
 -}
 
diff --git a/src/Simplex/Chat/Store/SQLite/Migrations/M20260925_badge_store_receipts.hs b/src/Simplex/Chat/Store/SQLite/Migrations/M20260925_badge_store_receipts.hs
new file mode 100644
index 0000000000..bf02837cb9
--- /dev/null
+++ b/src/Simplex/Chat/Store/SQLite/Migrations/M20260925_badge_store_receipts.hs
@@ -0,0 +1,50 @@
+{-# LANGUAGE QuasiQuotes #-}
+
+module Simplex.Chat.Store.SQLite.Migrations.M20260925_badge_store_receipts where
+
+import Database.SQLite.Simple (Query)
+import Database.SQLite.Simple.QQ (sql)
+
+-- | invoice_id is null for a receipt naming one another row holds: the transaction still has to be
+-- creditable, and its reference identifies it. provider and transaction_ref are null until a receipt
+-- arrives, and distinct NULLs let several rows await one at once. payment is held from the receipt's
+-- arrival until the service credits or refuses it; a refused row keeps its refusal in credit_error.
+m20260925_badge_store_receipts :: Query
+m20260925_badge_store_receipts =
+  [sql|
+CREATE TABLE badge_store_receipts(
+  badge_store_receipt_id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_id INTEGER NOT NULL REFERENCES users ON DELETE CASCADE,
+  invoice_id TEXT UNIQUE,
+  provider TEXT,
+  transaction_ref TEXT,
+  purchase_key BLOB NOT NULL,
+  purchase_priv_key BLOB NOT NULL,
+  master_key BLOB NOT NULL,
+  created_at TEXT NOT NULL,
+  payment TEXT,
+  next_attempt_at TEXT,
+  retry_delay INTEGER,
+  retry_count INTEGER NOT NULL DEFAULT 0,
+  credit_error TEXT,
+  UNIQUE(provider, transaction_ref)
+) STRICT;
+
+CREATE INDEX idx_badge_store_receipts_user ON badge_store_receipts(user_id);
+
+ALTER TABLE badge_purchases ADD COLUMN badge_store_receipt_id INTEGER REFERENCES badge_store_receipts;
+
+CREATE UNIQUE INDEX idx_badge_purchases_store_receipt ON badge_purchases(badge_store_receipt_id);
+|]
+
+down_m20260925_badge_store_receipts :: Query
+down_m20260925_badge_store_receipts =
+  [sql|
+DROP INDEX idx_badge_purchases_store_receipt;
+
+ALTER TABLE badge_purchases DROP COLUMN badge_store_receipt_id;
+
+DROP INDEX idx_badge_store_receipts_user;
+
+DROP TABLE badge_store_receipts;
+|]
diff --git a/src/Simplex/Chat/Store/SQLite/Migrations/chat_query_plans.txt b/src/Simplex/Chat/Store/SQLite/Migrations/chat_query_plans.txt
index 152d6c0c8d..6886687a23 100644
--- a/src/Simplex/Chat/Store/SQLite/Migrations/chat_query_plans.txt
+++ b/src/Simplex/Chat/Store/SQLite/Migrations/chat_query_plans.txt
@@ -1223,8 +1223,17 @@ Plan:
 
 Query: 
           INSERT INTO badge_purchases
-            (user_id, purchase_key, purchase_priv_key, master_key, initial_badge_type, current_badge_type, status, badge_code_redemption_id, created_at, updated_at)
+            (user_id, purchase_key, purchase_priv_key, master_key, initial_badge_type, current_badge_type, status,
+             badge_code_redemption_id, badge_store_receipt_id, created_at, updated_at)
+          VALUES (?,?,?,?,?,?,?,?,?,?,?)
+        
+Plan:
+
+Query: 
+          INSERT INTO badge_store_receipts
+            (user_id, invoice_id, provider, transaction_ref, payment, next_attempt_at, purchase_key, purchase_priv_key, master_key, created_at)
           VALUES (?,?,?,?,?,?,?,?,?,?)
+          ON CONFLICT DO NOTHING
         
 Plan:
 
@@ -4034,6 +4043,15 @@ Query:
 Plan:
 SCAN group_members
 
+Query: 
+        SELECT invoice_id, transaction_ref, credit_error
+        FROM badge_store_receipts
+        WHERE user_id = ? AND (transaction_ref IS NULL OR payment IS NOT NULL)
+        ORDER BY badge_store_receipt_id
+      
+Plan:
+SEARCH badge_store_receipts USING INDEX idx_badge_store_receipts_user (user_id=?)
+
 Query: 
         SELECT l.entry_uuid, l.change_months, l.balance_months, l.balance_start_ts, l.balance_anchor_ts, l.balance_badge_type,
                l.was_paused_since, l.service_created_at, l.entry_type, l.entry_credit_type, l.entry_debit_type, l.entry_type_value
@@ -4092,6 +4110,30 @@ Query:
 Plan:
 SEARCH file_badge_proofs USING INDEX idx_file_badge_proofs_file_id_kind (file_id=?)
 
+Query: 
+        SELECT r.badge_store_receipt_id, r.purchase_key, r.purchase_priv_key, r.master_key, r.payment, r.next_attempt_at, r.retry_delay
+        FROM badge_store_receipts r
+        JOIN users u ON u.user_id = r.user_id
+        WHERE r.user_id = ? AND r.payment IS NOT NULL AND u.shown_badge_id IS NULL
+        ORDER BY r.next_attempt_at, r.retry_count, r.badge_store_receipt_id
+        LIMIT 1
+      
+Plan:
+SEARCH u USING INTEGER PRIMARY KEY (rowid=?)
+SEARCH r USING INDEX idx_badge_store_receipts_user (user_id=?)
+USE TEMP B-TREE FOR ORDER BY
+
+Query: 
+        SELECT r.badge_store_receipt_id, r.user_id, r.purchase_key, r.purchase_priv_key, r.master_key,
+          r.payment, r.next_attempt_at, r.retry_delay, p.badge_purchase_id, r.credit_error
+        FROM badge_store_receipts r
+        LEFT JOIN badge_purchases p ON p.badge_store_receipt_id = r.badge_store_receipt_id
+        WHERE r.provider = ? AND r.transaction_ref = ?
+      
+Plan:
+SEARCH r USING INDEX sqlite_autoindex_badge_store_receipts_2 (provider=? AND transaction_ref=?)
+SEARCH p USING COVERING INDEX idx_badge_purchases_store_receipt (badge_store_receipt_id=?) LEFT-JOIN
+
 Query: 
         SELECT r.contact_id, g.group_id, r.group_member_id
         FROM received_probes r
@@ -4427,15 +4469,26 @@ SEARCH ug USING AUTOMATIC COVERING INDEX (group_id=?)
 
 Query: 
       DELETE FROM badge_code_redemptions
-      WHERE badge_code_redemption_id = ?
-        AND NOT EXISTS (SELECT 1 FROM badge_purchases WHERE badge_code_redemption_id = ?)
+      WHERE user_id = ? AND code = ?
+        AND NOT EXISTS (SELECT 1 FROM badge_purchases p WHERE p.badge_code_redemption_id = badge_code_redemptions.badge_code_redemption_id)
     
 Plan:
-SEARCH badge_code_redemptions USING INTEGER PRIMARY KEY (rowid=?)
-SCALAR SUBQUERY 1
-SEARCH badge_purchases USING COVERING INDEX idx_badge_purchases_code_redemption (badge_code_redemption_id=?)
+SEARCH badge_code_redemptions USING INDEX sqlite_autoindex_badge_code_redemptions_1 (user_id=? AND code=?)
+CORRELATED SCALAR SUBQUERY 1
+SEARCH p USING COVERING INDEX idx_badge_purchases_code_redemption (badge_code_redemption_id=?)
 SEARCH badge_purchases USING COVERING INDEX idx_badge_purchases_code_redemption (badge_code_redemption_id=?)
 
+Query: 
+      DELETE FROM badge_store_receipts
+      WHERE payment IS NULL AND created_at < ?
+        AND NOT EXISTS (SELECT 1 FROM badge_purchases p WHERE p.badge_store_receipt_id = badge_store_receipts.badge_store_receipt_id)
+    
+Plan:
+SCAN badge_store_receipts
+CORRELATED SCALAR SUBQUERY 1
+SEARCH p USING COVERING INDEX idx_badge_purchases_store_receipt (badge_store_receipt_id=?)
+SEARCH badge_purchases USING COVERING INDEX idx_badge_purchases_store_receipt (badge_store_receipt_id=?)
+
 Query: 
       DELETE FROM chat_items
       WHERE group_scope_group_member_id = ?
@@ -4928,6 +4981,12 @@ Query:
     
 Plan:
 
+Query: 
+      INSERT INTO badge_store_receipts (user_id, invoice_id, purchase_key, purchase_priv_key, master_key, created_at)
+      VALUES (?,?,?,?,?,?)
+    
+Plan:
+
 Query: 
       INSERT INTO calls
         (contact_id, shared_call_id, call_uuid, chat_item_id, call_state, call_ts, user_id, created_at, updated_at)
@@ -5162,6 +5221,14 @@ Query:
 Plan:
 SEARCH badge_purchases USING INTEGER PRIMARY KEY (rowid=?)
 
+Query: 
+      UPDATE badge_store_receipts
+      SET retry_delay = ?, next_attempt_at = ?, retry_count = retry_count + 1, credit_error = ?
+      WHERE badge_store_receipt_id = ? AND payment IS NOT NULL
+    
+Plan:
+SEARCH badge_store_receipts USING INTEGER PRIMARY KEY (rowid=?)
+
 Query: 
       UPDATE chat_items
       SET item_content = ?, item_text = ?, item_status = ?, item_deleted = ?, item_deleted_ts = ?, item_edited = ?, item_live = ?, updated_at = ?, timed_ttl = ?, timed_delete_at = ?
@@ -7109,6 +7176,7 @@ SEARCH connections USING COVERING INDEX idx_connections_user_contact_link_id (us
 Query: DELETE FROM users WHERE user_id = ?
 Plan:
 SEARCH users USING INTEGER PRIMARY KEY (rowid=?)
+SEARCH badge_store_receipts USING COVERING INDEX idx_badge_store_receipts_user (user_id=?)
 SEARCH badge_code_redemptions USING COVERING INDEX idx_badge_code_redemptions_user (user_id=?)
 SEARCH badge_purchases USING COVERING INDEX idx_badge_purchases_user (user_id=?)
 SEARCH chat_relays USING COVERING INDEX idx_chat_relays_user_id (user_id=?)
@@ -7266,6 +7334,14 @@ Query: SELECT 1 FROM settings WHERE user_id = ? LIMIT 1
 Plan:
 SEARCH settings USING COVERING INDEX idx_settings_user_id (user_id=?)
 
+Query: SELECT COUNT(*) FROM badge_store_receipts
+Plan:
+SCAN badge_store_receipts USING COVERING INDEX idx_badge_store_receipts_user
+
+Query: SELECT COUNT(*) FROM badge_store_receipts WHERE payment IS NOT NULL
+Plan:
+SCAN badge_store_receipts
+
 Query: SELECT COUNT(*) FROM groups WHERE relay_own_status IS NOT NULL
 Plan:
 SCAN groups
@@ -7365,6 +7441,14 @@ Query: SELECT badge_purchase_id FROM badge_purchases WHERE badge_code_redemption
 Plan:
 SEARCH badge_purchases USING COVERING INDEX idx_badge_purchases_code_redemption (badge_code_redemption_id=?)
 
+Query: SELECT badge_purchase_id FROM badge_purchases WHERE badge_store_receipt_id = ?
+Plan:
+SEARCH badge_purchases USING COVERING INDEX idx_badge_purchases_store_receipt (badge_store_receipt_id=?)
+
+Query: SELECT badge_store_receipt_id FROM badge_store_receipts WHERE invoice_id = ?
+Plan:
+SEARCH badge_store_receipts USING COVERING INDEX sqlite_autoindex_badge_store_receipts_1 (invoice_id=?)
+
 Query: SELECT balance_checked FROM badge_ledger ORDER BY entry_id
 Plan:
 SCAN badge_ledger
@@ -7502,6 +7586,10 @@ Query: SELECT count(1) FROM pending_group_messages
 Plan:
 SCAN pending_group_messages USING COVERING INDEX idx_pending_group_messages_group_member_id
 
+Query: SELECT credit_error FROM badge_store_receipts WHERE payment IS NOT NULL AND credit_error IS NOT NULL
+Plan:
+SCAN badge_store_receipts
+
 Query: SELECT entry_id FROM badge_ledger WHERE badge_purchase_id = ? AND entry_uuid = ?
 Plan:
 SEARCH badge_ledger USING INDEX idx_badge_ledger_uuid (entry_uuid=?)
@@ -7768,6 +7856,10 @@ Query: SELECT user_id FROM users WHERE local_display_name = ?
 Plan:
 SEARCH users USING COVERING INDEX sqlite_autoindex_users_2 (local_display_name=?)
 
+Query: SELECT user_id, invoice_id, transaction_ref IS NOT NULL FROM badge_store_receipts ORDER BY badge_store_receipt_id
+Plan:
+SCAN badge_store_receipts
+
 Query: SELECT via_contact_uri FROM connections WHERE connection_id = ?
 Plan:
 SEARCH connections USING INTEGER PRIMARY KEY (rowid=?)
@@ -7792,6 +7884,26 @@ Query: UPDATE badge_purchases SET next_wake_at = ? WHERE badge_purchase_id = ?
 Plan:
 SEARCH badge_purchases USING INTEGER PRIMARY KEY (rowid=?)
 
+Query: UPDATE badge_store_receipts SET payment = ?
+Plan:
+SCAN badge_store_receipts
+
+Query: UPDATE badge_store_receipts SET payment = ? WHERE badge_store_receipt_id = ? AND payment IS NOT NULL
+Plan:
+SEARCH badge_store_receipts USING INTEGER PRIMARY KEY (rowid=?)
+
+Query: UPDATE badge_store_receipts SET payment = NULL, next_attempt_at = NULL, retry_delay = NULL, retry_count = 0 WHERE badge_store_receipt_id = ?
+Plan:
+SEARCH badge_store_receipts USING INTEGER PRIMARY KEY (rowid=?)
+
+Query: UPDATE badge_store_receipts SET payment = NULL, next_attempt_at = NULL, retry_delay = NULL, retry_count = 0, credit_error = ? WHERE badge_store_receipt_id = ?
+Plan:
+SEARCH badge_store_receipts USING INTEGER PRIMARY KEY (rowid=?)
+
+Query: UPDATE badge_store_receipts SET provider = ?, transaction_ref = ?, payment = ?, next_attempt_at = ? WHERE invoice_id = ? AND transaction_ref IS NULL
+Plan:
+SEARCH badge_store_receipts USING INDEX sqlite_autoindex_badge_store_receipts_1 (invoice_id=?)
+
 Query: UPDATE chat_items SET item_msg_body = ?, item_chat_binding = ?, item_signatures = ?, item_signed_by_group_member_id = ? WHERE chat_item_id = ? AND include_in_history = 1
 Plan:
 SEARCH chat_items USING INTEGER PRIMARY KEY (rowid=?)
diff --git a/src/Simplex/Chat/Store/SQLite/Migrations/chat_schema.sql b/src/Simplex/Chat/Store/SQLite/Migrations/chat_schema.sql
index 995497d5ee..9ef56d8aa9 100644
--- a/src/Simplex/Chat/Store/SQLite/Migrations/chat_schema.sql
+++ b/src/Simplex/Chat/Store/SQLite/Migrations/chat_schema.sql
@@ -938,6 +938,7 @@ CREATE TABLE badge_purchases(
   issue_error_at TEXT,
   issue_error TEXT,
   next_wake_at TEXT,
+  badge_store_receipt_id INTEGER REFERENCES badge_store_receipts,
   UNIQUE(purchase_key)
 ) STRICT;
 CREATE TABLE badge_ledger(
@@ -981,6 +982,23 @@ CREATE TABLE badge_code_redemptions(
   created_at TEXT NOT NULL,
   UNIQUE(user_id, code)
 ) STRICT;
+CREATE TABLE badge_store_receipts(
+  badge_store_receipt_id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_id INTEGER NOT NULL REFERENCES users ON DELETE CASCADE,
+  invoice_id TEXT UNIQUE,
+  provider TEXT,
+  transaction_ref TEXT,
+  purchase_key BLOB NOT NULL,
+  purchase_priv_key BLOB NOT NULL,
+  master_key BLOB NOT NULL,
+  created_at TEXT NOT NULL,
+  payment TEXT,
+  next_attempt_at TEXT,
+  retry_delay INTEGER,
+  retry_count INTEGER NOT NULL DEFAULT 0,
+  credit_error TEXT,
+  UNIQUE(provider, transaction_ref)
+) STRICT;
 CREATE INDEX contact_profiles_index ON contact_profiles(
   display_name,
   full_name
@@ -1544,6 +1562,10 @@ CREATE INDEX idx_badge_code_redemptions_user ON badge_code_redemptions(
 CREATE UNIQUE INDEX idx_badge_purchases_code_redemption ON badge_purchases(
   badge_code_redemption_id
 );
+CREATE INDEX idx_badge_store_receipts_user ON badge_store_receipts(user_id);
+CREATE UNIQUE INDEX idx_badge_purchases_store_receipt ON badge_purchases(
+  badge_store_receipt_id
+);
 CREATE TRIGGER on_group_members_insert_update_summary
 AFTER INSERT ON group_members
 FOR EACH ROW
diff --git a/src/Simplex/Chat/View.hs b/src/Simplex/Chat/View.hs
index 1c62bc267b..30211ea181 100644
--- a/src/Simplex/Chat/View.hs
+++ b/src/Simplex/Chat/View.hs
@@ -46,7 +46,7 @@ import Simplex.Chat.Markdown
 import Simplex.Chat.Badges (BadgeInfo (..), BadgeStatus (..), BadgeType (..), LocalBadge, localBadgeInfo, localBadgeStatus)
 import Simplex.Chat.Badges.Ledger (creditTypeTag, debitTypeTag)
 import Simplex.Chat.Badges.Service (StatementEntry (..), StatementEntryType (..))
-import Simplex.Chat.Badges.Types (BadgeAlert (..), BadgeIssueError (..), BadgeState (..))
+import Simplex.Chat.Badges.Types (BadgeAlert (..), BadgeIssueError (..), BadgeState (..), OpenStorePurchase (..))
 import Simplex.Chat.Messages hiding (NewChatItem (..))
 import Simplex.Chat.Messages.CIContent
 import Simplex.Chat.Operators
@@ -193,7 +193,8 @@ chatResponseToView hu cfg@ChatConfig {logLevel, showReactions, showFullLinks, te
   CRServiceReplyAccepted u (AgentConnId cId) -> ttyUser u [plain $ "service reply accepted, connection id: " <> safeDecodeUtf8 (strEncode cId)]
   -- the badge is only shown when it is the one now on the profile; a replayed code's badge may not be
   CRBadgeRedeemed u badge newBadge _ -> ttyUser u $ if newBadge then "badge redeemed" : viewContactBadge (Just badge) else ["badge already redeemed"]
-  CRBadgeState u st -> ttyUser u $ viewUserBadgeState st
+  CRBadgeInvoice u invoiceId -> ttyUser u ["badge invoice: " <> plain invoiceId]
+  CRBadgeState u st storePurchases -> ttyUser u $ viewUserBadgeState st <> map viewOpenStorePurchase storePurchases
   CRBadgeLedger u entries -> ttyUser u $ viewBadgeLedger entries
   CRGroupCreated u g -> ttyUser u $ viewGroupCreated g testView
   CRPublicGroupCreated u g _groupLink _relays -> ttyUser u $ viewGroupCreated g testView
@@ -483,6 +484,7 @@ chatEventToView hu ChatConfig {logLevel, showReactions, showReceipts, testView}
   CEvtServiceReplySent (AgentConnId cId) -> [plain $ "service reply sent, connection id: " <> safeDecodeUtf8 (strEncode cId)]
   CEvtBadgeChanged u st -> ttyUser u $ viewUserBadgeState st
   CEvtBadgeAlert u alert -> ttyUser u $ viewBadgeAlert alert
+  CEvtStorePurchaseResolved u -> ttyUser u ["store purchase resolved"]
   CEvtContactRequestRejected u Contact {localDisplayName = c} _reason -> ttyUser u [ttyContact c <> ": contact request rejected"]
   CEvtRcvFileStart u ci -> ttyUser u $ receivingFile_' hu testView "started" ci
   CEvtRcvFileComplete u ci -> ttyUser u $ receivingFile_' hu testView "completed" ci
@@ -1863,6 +1865,14 @@ viewBadgeIssueError BadgeIssueError {failedSince, lastAttemptAt, reason} =
 viewBadgeAlert :: BadgeAlert -> [StyledString]
 viewBadgeAlert BadgeAlert {kind, date} = [plain $ "badge alert: " <> textEncode kind <> " " <> day date]
 
+viewOpenStorePurchase :: OpenStorePurchase -> StyledString
+viewOpenStorePurchase OpenStorePurchase {invoiceId, transactionRef, creditError} =
+  plain $
+    "store purchase open: invoice "
+      <> fromMaybe "none" invoiceId
+      <> maybe "" (", transaction " <>) transactionRef
+      <> maybe "" ((", not credited: " <>) . safeDecodeUtf8 . strEncode) creditError
+
 viewBadgeLedger :: [StatementEntry] -> [StyledString]
 viewBadgeLedger [] = ["no ledger entries"]
 viewBadgeLedger entries = map viewEntry entries
@@ -2867,13 +2877,14 @@ viewChatError isCmd logLevel testView = \case
     CEBadgeRedeemError e ->
       let reason = case e of
             BREInvalidCode -> "invalid code"
+            BREInvalidReceipt -> "invalid store receipt"
             BREServiceNotConfigured -> "badge service not configured"
             BREBadgeActive -> "badge already active"
             BREServiceError code -> "badge service error: " <> T.unpack (badgeServiceErrorText code)
             BREInvalidResponse m -> "invalid service response: " <> m
             BREUnknownKeyIndex -> "credential names an unknown badge key index"
             BRECredentialNotVerified -> "credential does not verify against configured key"
-       in ["cannot redeem badge code: " <> plain reason]
+       in ["cannot get badge: " <> plain reason]
     CEAgentCommandError e -> ["agent command error: " <> plain e]
     CEInvalidFileDescription e -> ["invalid file description: " <> plain e]
     CEConnectionIncognitoChangeProhibited -> ["incognito mode change prohibited"]
diff --git a/tests/BadgeTests.hs b/tests/BadgeTests.hs
index bd8f62d3fd..6bb4b14aa7 100644
--- a/tests/BadgeTests.hs
+++ b/tests/BadgeTests.hs
@@ -9,19 +9,26 @@
 
 module BadgeTests (badgeTests) where
 
-import BadgeService.Service (badgeErrorRetryAfter)
+import BadgeService.Service (badgeErrorRetryAfter, shownServiceRequest, survive)
+import BadgeService.StoreReceipts (StoreReceipt (..), StoreRefusal (..), StoreVerifier (..), VerifiedStoreTransaction (..), toStoreReceipt)
+import BadgeService.StoreReceipts.Mock (mockStoreVerifier)
+import Control.Concurrent (forkIO, killThread, threadDelay)
+import Control.Concurrent.MVar (newEmptyMVar, putMVar, takeMVar)
 import Control.Concurrent.STM (atomically)
+import Control.Exception (SomeAsyncException, SomeException, catch, fromException, throwIO)
 import Data.ByteString.Char8 (ByteString)
+import qualified Data.ByteString.Base64.URL as B64U
 import Data.Map.Strict (Map)
 import qualified Data.Map.Strict as M
 import qualified Data.Text as T
+import Data.Text.Encoding (encodeUtf8)
 import Data.Time.Calendar (fromGregorian)
 import Data.Time.Calendar.WeekDate (toWeekDate)
 import Data.Time.Clock (NominalDiffTime, UTCTime (..), addUTCTime, diffUTCTime, getCurrentTime, nominalDay)
 import Data.Time.Clock.POSIX (posixSecondsToUTCTime)
 import qualified Data.Aeson as J
 import qualified Data.Aeson.KeyMap as KM
-import Data.Maybe (fromMaybe, isNothing, maybeToList)
+import Data.Maybe (fromMaybe, isJust, isNothing, maybeToList)
 import qualified Simplex.Messaging.Crypto as C
 import Simplex.Chat.Badges
 import Simplex.Chat.Badges.Code
@@ -29,14 +36,16 @@ import Simplex.Chat.Badges.Ledger
 import Simplex.Chat.Badges.Service
 import Simplex.Chat.Badges.Types (BadgeIssueFailure (..))
 import Simplex.Chat (defaultChatConfig)
-import Simplex.Chat.Controller (ChatError (..), ChatErrorType (..), badgeRetryInterval, chatErrorAgent)
-import Simplex.Chat.Library.Commands (badgeErrorRetry, badgeFailureTransient, badgeIssueFailure, badgeRetryAfter, badgeServiceErrorText, badgeStalledInterval)
+import Simplex.Chat.Controller (BadgeRedeemError (..), ChatError (..), ChatErrorType (..), badgeRetryInterval, chatErrorAgent)
+import Simplex.Chat.Library.Commands (badgeErrorRetry, badgeFailureTransient, badgeIssueFailure, badgeRetryAfter, badgeServiceErrorText, badgeStalledInterval, storeTransactionRef)
+import Simplex.Chat.PaymentService (ServicePayment (..))
+import Simplex.Chat.PaymentService.Types (InvoiceId (..), PaymentProvider (..), StoreTransactionRef (..))
 import Simplex.Messaging.Agent.Protocol (AgentErrorType (..), AgentServiceError (..), SMPAgentError (..))
 import Simplex.Messaging.Agent.RetryInterval (RetryInterval (..), nextRetryDelay)
 import Simplex.Messaging.Crypto.BBS
 import Simplex.Messaging.Encoding.String
 import Simplex.Messaging.Protocol (BrokerErrorType (..), ErrorType (AUTH), NetworkError (..))
-import Simplex.Messaging.Util (tshow)
+import Simplex.Messaging.Util (safeDecodeUtf8, tshow)
 import Simplex.Messaging.Version.Internal (Version (..))
 import Test.Hspec
 
@@ -92,9 +101,18 @@ badgeTests = do
     it "bounds and strips a code this version does not know" testServiceErrorCodeBounded
   describe "service protocol JSON" $ do
     it "redeemBadgeCode request matches the schema" testRedeemRequestJSON
+    it "purchaseBadge request matches the schema" testPurchaseRequestJSON
     it "badgeCredential response matches the schema" testCredentialResponseJSON
     it "error response matches the schema" testErrorResponseJSON
     it "statement entries round-trip, unknown entry types verbatim" testStatementJSON
+  describe "store purchases" $ do
+    it "keys a purchase by the store's transaction id, not by the evidence signed over it" testStoreTransactionRef
+    it "shows a service request in the terminal as its type alone" testShownServiceRequest
+    it "refuses for good a Play product id that could name another purchase, before any verifier" testGoogleProductIdPath
+    it "does not send a Play token that could name another purchase, and leaves it retryable" testGoogleTokenPath
+    it "has the dev mock vouch for the transaction its claim names, as a production purchase" testMockVouchesForClaim
+  describe "badge service request loop" $ do
+    it "survives a request that throws, and still stops when cancelled" testSurviveRequestFailure
 
 proofOf :: BadgeProof -> BBSProof
 proofOf (BadgeProof _ _ p _) = p
@@ -682,7 +700,7 @@ testServiceRetryAfter = do
   badgeErrorRetryAfter BSEInternal `shouldBe` Nothing
   mapM_
     (\code -> badgeErrorRetryAfter code `shouldBe` Nothing)
-    [BSEBadRequest, BSEUnsupportedVersion, BSEUnknownPurchaseKey, BSECodeInvalid, BSECodeUsed, BSECodeExpired, BSEUnknown "future_code"]
+    [BSEBadRequest, BSEUnsupportedVersion, BSEUnknownPurchaseKey, BSECodeInvalid, BSECodeUsed, BSECodeExpired, BSEProviderNotConfigured, BSEUnknown "future_code"]
 
 -- The app shows the recorded failure in a sentence, so an agent error is stored as the agent
 -- error and not as the chat error wrapping it, whether or not it can clear on its own.
@@ -695,6 +713,8 @@ testIssueFailureClassification = do
   failureFor timeout `shouldBe` BIFNetwork {agentError = tshow timeout}
   failureFor auth `shouldBe` BIFUnexpected {message = tshow auth}
   badgeIssueFailure (ChatError (CECommandError "unexpected badge service response")) `shouldBe` BIFUnexpected {message = "unexpected badge service response"}
+  badgeIssueFailure (ChatError (CEBadgeRedeemError BREUnknownKeyIndex)) `shouldBe` BIFInvalidCredential
+  badgeIssueFailure (ChatError (CEBadgeRedeemError BRECredentialNotVerified)) `shouldBe` BIFInvalidCredential
 
 -- A refusal the service marks transient is not worth a word before the credential lapses. Internal
 -- comes without retryAfter so that a failing service is not pressed, not because the fault is
@@ -753,12 +773,18 @@ testEntryTypeColumns = do
       debits = [SDRefund, SDUpgrade k, SDTransferOut k, SDSupport, SDBadge, SDLapse]
   mapM_ (\c -> wireTag (J.toJSON (SECredit c)) "credit" `shouldBe` Just (creditTypeTag c)) credits
   mapM_ (\d -> wireTag (J.toJSON (SEDebit d)) "debit" `shouldBe` Just (debitTypeTag d)) debits
-  -- the three types this version writes survive a round trip through the columns
+  -- the types this version writes survive a round trip through the columns, a payment credit
+  -- through the payment its row references
   mapM_
-    (\t -> uncurry3 entryTypeFromColumns (entryTypeColumns t) `shouldSatisfy` sameEntryType t)
+    (\t -> uncurry3 (entryTypeFromColumns Nothing) (entryTypeColumns t) `shouldSatisfy` sameEntryType t)
     [SECredit SCCode, SEDebit SDBadge, SEDebit SDLapse]
+  let storeCredit = SECredit (SCPayment Nothing)
+      invoiceCredit = SECredit (SCPayment (Just (InvoiceId "inv1")))
+  uncurry3 (entryTypeFromColumns (Just Nothing)) (entryTypeColumns storeCredit) `shouldSatisfy` sameEntryType storeCredit
+  uncurry3 (entryTypeFromColumns (Just (Just (InvoiceId "inv1")))) (entryTypeColumns invoiceCredit) `shouldSatisfy` sameEntryType invoiceCredit
   -- a type that needs a reference column is not silently read back as something else
-  uncurry3 entryTypeFromColumns (entryTypeColumns (SECredit (SCCharge "ch1"))) `shouldSatisfy` isNothing
+  uncurry3 (entryTypeFromColumns Nothing) (entryTypeColumns storeCredit) `shouldSatisfy` isNothing
+  uncurry3 (entryTypeFromColumns Nothing) (entryTypeColumns (SECredit (SCCharge "ch1"))) `shouldSatisfy` isNothing
   -- which is why every type is stored as its own JSON as well, and read from that first: the
   -- columns alone would answer a row naming an invoice or a purchase as no row at all
   mapM_ roundTrips credits
@@ -790,6 +816,106 @@ testRedeemRequestJSON = do
     `shouldBe` J.object ["version" J..= (1 :: Int), "request" J..= J.object ["type" J..= ("getBadgeCatalog" :: T.Text)]]
   roundTrips req
 
+testPurchaseRequestJSON :: IO ()
+testPurchaseRequestJSON = do
+  drg <- C.newRandom
+  mk <- generateMasterKey drg
+  (k, _) <- atomically $ C.generateKeyPair drg :: IO (C.KeyPair 'C.Ed25519)
+  let payment = SPGoogle {productId = "badge_supporter_01", token = "token"}
+      req = BadgeServiceRequest {version = Version 1, purchaseKey = Just k, request = BSCPurchaseBadge {masterKey = mk, payment, upgrade = Nothing}}
+  -- the client states its master key and the store's evidence, and nothing a receipt already decides
+  J.toJSON req
+    `shouldBe` J.object
+      [ "version" J..= (1 :: Int),
+        "purchaseKey" J..= k,
+        "request"
+          J..= J.object
+            [ "type" J..= ("purchaseBadge" :: T.Text),
+              "masterKey" J..= mk,
+              "payment" J..= J.object ["type" J..= ("google" :: T.Text), "productId" J..= ("badge_supporter_01" :: T.Text), "token" J..= ("token" :: T.Text)]
+            ]
+      ]
+  J.toJSON SPApple {jws = "a.b.c"} `shouldBe` J.object ["type" J..= ("apple" :: T.Text), "jws" J..= ("a.b.c" :: T.Text)]
+  roundTrips req
+
+testStoreTransactionRef :: IO ()
+testStoreTransactionRef = do
+  let jws transactionId signature = T.intercalate "." [part "{\"alg\":\"ES256\"}", part ("{\"transactionId\":\"" <> transactionId <> "\",\"productId\":\"BADGE_SUPPORTER_01\"}"), signature]
+      part = safeDecodeUtf8 . B64U.encodeUnpadded . encodeUtf8
+      apple = storeTransactionRef . SPApple
+  -- the store may sign the same transaction again, and a retry must find the keys it stashed
+  apple (jws "2000000812345671" "c2lnbmVkIG9uY2U") `shouldBe` Just (StoreTransactionRef PPApple "2000000812345671")
+  apple (jws "2000000812345671" "c2lnbmVkIGFnYWlu") `shouldBe` apple (jws "2000000812345671" "c2lnbmVkIG9uY2U")
+  apple (jws "2000000812345672" "c2lnbmVkIG9uY2U") `shouldNotBe` apple (jws "2000000812345671" "c2lnbmVkIG9uY2U")
+  apple "not.a-jws" `shouldBe` Nothing
+  apple (T.intercalate "." [part "{}", part "{\"productId\":\"BADGE_SUPPORTER_01\"}", "sig"]) `shouldBe` Nothing
+  -- a Play token is a bearer secret, so it is kept only as its hash
+  let google = storeTransactionRef SPGoogle {productId = "badge_supporter_01", token = "play-token"}
+  google `shouldSatisfy` maybe False (\(StoreTransactionRef provider ref) -> provider == PPGoogle && ref /= "play-token")
+  google `shouldBe` storeTransactionRef SPGoogle {productId = "badge_supporter_01", token = "play-token"}
+  storeTransactionRef SPInvoice {invoiceId = InvoiceId "inv"} `shouldBe` Nothing
+
+testShownServiceRequest :: IO ()
+testShownServiceRequest = do
+  drg <- C.newRandom
+  mk <- generateMasterKey drg
+  (k, _) <- atomically $ C.generateKeyPair drg :: IO (C.KeyPair 'C.Ed25519)
+  let shown request = case J.toJSON BadgeServiceRequest {version = Version 1, purchaseKey = Just k, request} of
+        J.Object o -> J.Object (shownServiceRequest o)
+        _ -> J.Null
+      typeOnly t = J.object ["request" J..= J.object ["type" J..= (t :: T.Text)]]
+  shown BSCPurchaseBadge {masterKey = mk, payment = SPApple {jws = "a.b.c"}, upgrade = Nothing} `shouldBe` typeOnly "purchaseBadge"
+  shown BSCRedeemBadgeCode {masterKey = mk, code = "SB-00000-00000-00000-00001"} `shouldBe` typeOnly "redeemBadgeCode"
+
+testGoogleProductIdPath :: IO ()
+testGoogleProductIdPath = do
+  let refused productId = case toStoreReceipt uncalledVerifier SPGoogle {productId, token = validPlayToken} of
+        Just (Left SRInvalid {}) -> True
+        _ -> False
+  mapM_ (\p -> refused p `shouldBe` True) ["badge_legend_01/tokens/other?", "badge_legend_01?x", "badge_legend_01#x", "..", "../badge_legend_01", "Badge_legend_01", ""]
+  case toStoreReceipt uncalledVerifier SPGoogle {productId = "badge_supporter_01", token = validPlayToken} of
+    Just (Right StoreReceipt {txRef = StoreTransactionRef {provider}}) -> provider `shouldBe` PPGoogle
+    _ -> expectationFailure "a valid product id and token were refused"
+
+testGoogleTokenPath :: IO ()
+testGoogleTokenPath = do
+  let unsent token = case toStoreReceipt uncalledVerifier SPGoogle {productId = "badge_supporter_01", token} of
+        Just (Left SRUnreachable {}) -> True
+        _ -> False
+  mapM_ (\t -> unsent t `shouldBe` True) ["a/b", "../x", "t?x", "t#x", "t x", ""]
+
+uncalledVerifier :: StoreVerifier
+uncalledVerifier = StoreVerifier {verifyApple = Nothing, verifyGoogle = Just $ \_ _ -> error "verifier called", verifyTimeout = 500000}
+
+validPlayToken :: T.Text
+validPlayToken = "fake-play-token.AO-J1Oz9x2kqE7wYt3"
+
+testMockVouchesForClaim :: IO ()
+testMockVouchesForClaim = do
+  let part = safeDecodeUtf8 . B64U.encodeUnpadded . encodeUtf8
+      signed = T.intercalate "." [part "{\"alg\":\"ES256\"}", part "{\"transactionId\":\"2000000812345671\",\"productId\":\"BADGE_SUPPORTER_01\"}", "c2lnbmVk"]
+      vouchesForClaim payment = case toStoreReceipt mockStoreVerifier payment of
+        Just (Right StoreReceipt {txRef = StoreTransactionRef {transactionRef = providerRef}, verifyReceipt}) ->
+          verifyReceipt >>= \case
+            Right VerifiedStoreTransaction {transactionRef, testPurchase} -> (transactionRef, testPurchase) `shouldBe` (providerRef, False)
+            Left refusal -> expectationFailure ("the mock refused: " <> show refusal)
+        _ -> expectationFailure "refused before the mock was asked"
+  vouchesForClaim SPApple {jws = signed}
+  vouchesForClaim SPGoogle {productId = "badge_supporter_01", token = "fake-play-token.AO-J1Oz9x2kqE7wYt3"}
+
+testSurviveRequestFailure :: IO ()
+testSurviveRequestFailure = do
+  survive "a request" (throwIO $ userError "failed") `shouldReturn` ()
+  started <- newEmptyMVar
+  stopped <- newEmptyMVar
+  t <- forkIO $ survive "a request" (putMVar started () >> threadDelay 10000000) `catch` (putMVar stopped . asyncException)
+  takeMVar started
+  killThread t
+  takeMVar stopped `shouldReturn` True
+  where
+    asyncException :: SomeException -> Bool
+    asyncException e = isJust (fromException e :: Maybe SomeAsyncException)
+
 testCredentialResponseJSON :: IO ()
 testCredentialResponseJSON = do
   Right (_, sk) <- bbsKeyGen
diff --git a/tests/Bots/BadgeService/BotTests.hs b/tests/Bots/BadgeService/BotTests.hs
index c11af7f4d1..93b24fd427 100644
--- a/tests/Bots/BadgeService/BotTests.hs
+++ b/tests/Bots/BadgeService/BotTests.hs
@@ -4,6 +4,7 @@
 {-# LANGUAGE LambdaCase #-}
 {-# LANGUAGE NamedFieldPuns #-}
 {-# LANGUAGE OverloadedStrings #-}
+{-# LANGUAGE PostfixOperators #-}
 {-# LANGUAGE ScopedTypeVariables #-}
 {-# LANGUAGE TupleSections #-}
 {-# OPTIONS_GHC -fno-warn-ambiguous-fields #-}
@@ -12,9 +13,12 @@ module Bots.BadgeService.BotTests where
 
 import BadgeService.Config (BadgeIssuerKey (..), readServiceConfig)
 import Bots.BadgeService.ConfigTests (withIssuer)
+import Bots.BadgeService.FakeStore
 import BadgeService.Options
 import BadgeService.Service
+import BadgeService.Store (NewStorePurchase (..), createStorePurchase)
 import BadgeService.Store.Invoices (markCodePaid)
+import BadgeService.StoreReceipts (StoreRefusal (..), StoreVerifier (..), noStoreVerifier)
 import Simplex.Messaging.Agent.Store.DB (Binary (..))
 import qualified Simplex.Messaging.Agent.Store.DB as DB
 import ChatClient
@@ -27,10 +31,12 @@ import Control.Exception (finally)
 import qualified Data.Aeson as J
 import Data.ByteString.Char8 (ByteString)
 import qualified Data.ByteString.Char8 as B
+import qualified Data.ByteString.Lazy.Char8 as LB
 import Data.Char (toLower)
 import Data.Either (isLeft, isRight)
 import Data.Int (Int64)
-import Data.IORef (IORef, newIORef, readIORef, writeIORef)
+import Data.IORef (IORef, modifyIORef', newIORef, readIORef, writeIORef)
+import Data.List (isPrefixOf, stripPrefix)
 import qualified Data.Map.Strict as M
 import Data.Maybe (isJust, isNothing)
 import Data.String (fromString)
@@ -39,15 +45,19 @@ import Data.Text (Text)
 import qualified Data.Text as T
 import Data.Time.Clock (NominalDiffTime, UTCTime, addUTCTime, diffUTCTime, getCurrentTime, nominalDay)
 import Data.Time.Format (defaultTimeLocale, formatTime)
+import Data.Word (Word32)
 import Simplex.Chat.Badges (BadgeCredential (..), BadgeInfo (..), BadgeMasterKey, BadgeType (..), generateMasterKey)
 import Simplex.Chat.Badges.Code (BadgeCode, badgeCodeHash, badgeCodeText, formatBadgeCode, parseBadgeCode, randomBadgeCode)
-import Simplex.Chat.Badges.Ledger (addMonths, creditTypeTag, debitTypeTag, endOfMondayAfter)
+import Simplex.Chat.Badges.Ledger (addMonths, creditTypeTag, debitTypeTag, emptyEntry, endOfMondayAfter)
 import Simplex.Chat.Badges.Service
 import Simplex.Chat.Bot.Store (withDB')
 import Simplex.Chat.Controller (ChatConfig (..), ChatController (..), ChatResponse (CRCustomChatResponse))
 import Simplex.Chat.Core (sendChatCmdStr)
 import Simplex.Chat.Options (CoreChatOpts (..))
 import Simplex.Chat.Options.DB
+import Simplex.Chat.PaymentService (ServicePayment (..))
+import Simplex.Chat.PaymentService.Types (InvoiceId (..), PaymentProvider (..))
+import Simplex.Chat.Store.Badges (getNextHeldStoreReceipt)
 import Simplex.Messaging.Agent.Env.SQLite (AgentConfig (..))
 import Simplex.Messaging.Agent.RetryInterval (RetryInterval (..))
 import Simplex.Messaging.Agent.Store.Common (withTransaction)
@@ -106,6 +116,56 @@ badgeServiceTests = do
   it "should renew a badge on a profile that is not active, without switching to it" testRenewalKeepsActiveProfile
   it "should broadcast the current profile when a renewal presents a badge" testRenewalKeepsProfileEdits
   it "should present the month already issued when a previous pass did not" testPresentationCatchesUp
+  describe "store purchases" $ do
+    describe "what the store answers" $ do
+      it "should credit the months a store receipt paid for and issue the first" testStorePurchase
+      it "should return the same credential for a receipt its key presents again, writing nothing" testStorePurchaseReplay
+      it "should refuse a receipt another key was credited with" testStoreReceiptUsed
+      it "should refuse a receipt the store does not vouch for, with no retry" testStoreReceiptInvalid
+      it "should answer a store it cannot reach as retryable, writing nothing" testStoreUnreachable
+      it "should write nothing for a pending purchase, and credit it once when it settles" testStorePending
+      it "should refuse a product that grants no badge" testStoreUnknownProduct
+      it "should refuse a store purchase that carries an upgrade" testStoreUpgradeRefused
+      it "should grant the badge of the product the receipt proves" testStoreBadgeTypeFromProduct
+      it "should keep refusing invoice and receipt funding" testNonStoreFundingRefused
+      it "should replay a receipt to its own key while the store is down, and to no other" testStoreReplayWhileStoreDown
+      it "should answer a throwing Apple verifier as internal, and a failing or hanging Google one as retryable" testStoreVerifierFailures
+    describe "claim races" $ do
+      it "should credit a transaction claimed twice at once only once" testStoreClaimRace
+      it "should answer a request that lost the claim race with the credential the winner was given" testStorePurchaseRace
+      it "should refuse as receipt_used a key that lost the claim race to another key, crediting nothing" testStorePurchaseRaceOtherKey
+    describe "the service's own checks" $ do
+      it "should refuse a store with no verifier with no retry, and the client should hold the receipt, showing why it is not credited" testPurchaseWithNoVerifier
+      it "should credit nothing when the verified transaction is not the one the evidence names" testStoreVerifiedOtherTransaction
+      it "should refuse a verified quantity other than one as internal, and the client should hold the receipt" testStoreQuantityRefused
+      it "should refuse a store purchase whose purchaseKey is not the verified signer" testStorePurchaseKeyMismatch
+    describe "the hand-over" $ do
+      it "should hold a Play receipt until the worker credits it, and answer it as credited after" testPurchaseBadge
+      it "should credit an App Store purchase by its JWS" testPurchaseBadgeAppStore
+      it "should keep a refusal on the record, and hold a pending receipt until it settles" testPurchaseStash
+      it "should keep a receipt credited to another key as refused" testPurchaseStashReceiptUsed
+      it "should hold a Play token the service will not send to Play" testPurchaseUnsentPlayToken
+      it "should hold a store receipt while a badge is held, without attempting it" testPurchaseWhileBadgeHeld
+      it "should answer a receipt handed over under a second profile as the profile that bought it" testPurchaseSameReceiptOtherProfile
+      it "should credit a purchase first handed over under another profile to that profile" testPurchaseStrandedUnderOtherProfile
+      it "should credit a purchase to a hidden profile without naming it" testPurchaseDeliveredToHiddenProfile
+    describe "invoice first" $ do
+      it "should credit a receipt to the profile that created its invoice, and answer as that profile" testInvoiceOtherProfile
+      it "should resolve the same receipt to the same record, and answer it as credited" testInvoiceSameReceiptTwice
+      it "should credit a receipt naming an unknown invoice to the presenting profile" testInvoiceUnknown
+      it "should attach a late receipt to its record, and credit the profile that created it" testInvoiceLateReceipt
+      it "should list a record however old until a receipt reaching it is settled" testInvoiceAgedOut
+      it "should refuse an invoice with no service configured or while a badge is held, creating no record" testInvoiceRefusedBeforeCharge
+      it "should hold a receipt for an invoice while a badge is held, without attempting it" testInvoiceWhileBadgeHeld
+      it "should list only the asking profile's open store purchases" testInvoiceStateOtherProfile
+    describe "the receipt worker" $ do
+      it "should retry a receipt the service could not verify, and credit it with no trigger at all" testStoreReceiptRetried
+      it "should credit a second receipt while an earlier one waits for the store" testStoreReceiptNotBlocked
+      it "should answer a refused receipt from the record, sending nothing, and not list it" testStoreRefusalKept
+      it "should announce a settlement to an owner that is not active, and print nothing for a hidden one" testStoreSettledOtherProfile
+      it "should resolve one new transaction handed over twice at once to one record" testStoreReceiptTwoAtOnce
+      it "should delete a month-old record that will fund no badge, and keep held and credited ones" testStoreReceiptCleanup
+      it "should keep a receipt whose attempt throws" testStoreReceiptAttemptThrows
 
 badgeProfile :: Profile
 badgeProfile = Profile {displayName = "SimpleX Badges", fullName = "", shortDescr = Nothing, description = Nothing, image = Nothing, contactLink = Nothing, peerType = Just CPTBot, preferences = Nothing, badge = Nothing, contactDomain = Nothing}
@@ -157,7 +217,9 @@ data BadgeServiceEnv = BadgeServiceEnv
     bsClock :: TestClock,
     bsClientCfg :: ChatConfig,
     bsAddress :: String,
-    bsController :: ChatController
+    bsController :: ChatController,
+    bsStore :: FakeStore,
+    bsVerifier :: StoreVerifier
   }
 
 -- | Stop the service for good: requests sent after it go unanswered until they time out. Stopping
@@ -170,13 +232,18 @@ withBadgeService ps test =
   withBadgeServiceEnv ps $ \BadgeServiceEnv {bsClientCfg, bsAddress, bsController} -> test bsClientCfg bsAddress bsController
 
 withBadgeServiceEnv :: HasCallStack => TestParams -> (BadgeServiceEnv -> IO ()) -> IO ()
-withBadgeServiceEnv ps test = do
+withBadgeServiceEnv ps = withBadgeServiceVerifier ps fakeVerifier
+
+withBadgeServiceVerifier :: HasCallStack => TestParams -> (FakeStore -> StoreVerifier) -> (BadgeServiceEnv -> IO ()) -> IO ()
+withBadgeServiceVerifier ps verifierOf test = do
   Right (pk, sk) <- bbsKeyGen
   clock <- newTestClock
+  store <- newFakeStore
   let opts = mkBadgeServiceOpts ps sk
       svcCfg = testCfg {badgePublicKeys = M.singleton testIssuerKeyIdx pk, badgeCurrentTime = testClockTime clock}
+      verifier = verifierOf store
   withNewTestChatCfg ps testCfg serviceDbPrefix badgeProfile $ \_ -> pure ()
-  runBadgeService svcCfg opts $ \_ -> pure ()
+  runBadgeService verifier svcCfg opts $ \_ -> pure ()
   bsLink <- withTestChat ps serviceDbPrefix $ \bs -> do
     bs <## "subscribed 1 connections on server localhost"
     bs ##> "/sa"
@@ -185,9 +252,9 @@ withBadgeServiceEnv ps test = do
     pure sLink
   let clientCfg =
         svcCfg {badgeServiceAddress = Just $ either (error . ("bad badge service address: " <>)) id $ strDecode (B.pack bsLink)}
-  runBadgeService svcCfg opts $ \env -> do
+  runBadgeService verifier svcCfg opts $ \env -> do
     cc <- atomically $ readTMVar $ serviceCC env
-    test BadgeServiceEnv {bsIssuerKey = BadgeIssuerKey {keyIdx = testIssuerKeyIdx, secretKey = sk}, bsClock = clock, bsClientCfg = clientCfg, bsAddress = bsLink, bsController = cc}
+    test BadgeServiceEnv {bsIssuerKey = BadgeIssuerKey {keyIdx = testIssuerKeyIdx, secretKey = sk}, bsClock = clock, bsClientCfg = clientCfg, bsAddress = bsLink, bsController = cc, bsStore = store, bsVerifier = verifier}
 
 issueCode :: HasCallStack => ChatController -> BadgeType -> Int -> IO BadgeCode
 issueCode cc badgeType months = issueCodeAs cc badgeType months "free"
@@ -208,9 +275,9 @@ issueCodeAs cc badgeType months status =
     r -> error $ "issue failed: " <> show (() <$ r)
 
 -- | The post-start hook fills serviceCC once the address exists, so the test waits on it rather than on a fixed delay that would race with startup and let one start's address output arrive during the next test.
-runBadgeService :: ChatConfig -> BadgeServiceOpts -> (ServiceState -> IO ()) -> IO ()
-runBadgeService cfg opts action = do
-  env <- newServiceState
+runBadgeService :: StoreVerifier -> ChatConfig -> BadgeServiceOpts -> (ServiceState -> IO ()) -> IO ()
+runBadgeService verifier cfg opts action = do
+  env <- (\s -> s {storeVerifier = verifier}) <$> newServiceState
   t <- forkIO $ badgeService opts cfg env
   ready <- timeout 30000000 $ atomically $ readTMVar $ serviceCC env
   when (isNothing ready) $ killThread t >> error "badge service did not start"
@@ -276,10 +343,10 @@ testRedeemUnknownCode ps =
       g <- C.newRandom
       unknown <- randomBadgeCode g
       alice ##> ("/_redeem_badge_code 1 " <> codeArg unknown)
-      alice <## "cannot redeem badge code: badge service error: code_invalid"
+      alice <## "cannot get badge: badge service error: code_invalid"
       -- a failed check character is refused before anything leaves the device
       alice ##> "/_redeem_badge_code 1 SB-00000-00000-00000-00001"
-      alice <## "cannot redeem badge code: invalid code"
+      alice <## "cannot get badge: invalid code"
       -- sent straight to the service, past the client's own check, the two are one answer
       (_, redeemPriv) <- atomically $ C.generateKeyPair g :: IO (C.KeyPair 'C.Ed25519)
       redeemDirect alice bsLink redeemPriv (T.unpack $ badgeCodeText unknown)
@@ -330,7 +397,7 @@ testRedeemSecondCode ps =
       alice <## "supporter badge - active"
       alice <##. "expires "
       alice ##> ("/_redeem_badge_code 1 " <> codeArg legend)
-      alice <## "cannot redeem badge code: badge already active"
+      alice <## "cannot get badge: badge already active"
       alice ##> "/p"
       showActiveUser alice "alice (Alice, * supporter)"
       alice ##> "/create user alisa"
@@ -352,15 +419,15 @@ testRedeemSameCodeOtherProfile ps =
       alice ##> "/create user alisa"
       showActiveUser alice "alisa"
       alice ##> ("/_redeem_badge_code 2 " <> codeArg code)
-      alice <## "cannot redeem badge code: badge service error: code_used"
+      alice <## "cannot get badge: badge service error: code_used"
       alice ##> "/p"
       showActiveUser alice "alisa"
       alice ##> "/user alice"
       showActiveUser alice "alice (Alice, * supporter)"
 
 serviceCmd :: HasCallStack => BadgeServiceEnv -> C.PublicKeyEd25519 -> BadgeServiceCommand -> IO BadgeServiceResponse
-serviceCmd BadgeServiceEnv {bsIssuerKey, bsController} purchaseKey request =
-  badgeServiceResponse bsIssuerKey bsController (Just purchaseKey) reqObject
+serviceCmd BadgeServiceEnv {bsIssuerKey, bsController, bsVerifier} purchaseKey request =
+  badgeServiceResponse bsIssuerKey bsVerifier bsController (Just purchaseKey) reqObject
   where
     reqObject = case J.toJSON BadgeServiceRequest {version = currentBadgeServiceVersion, purchaseKey = Just purchaseKey, request} of
       J.Object o -> o
@@ -1267,7 +1334,7 @@ testRedeemUnpaidCode ps =
     withNewTestChatCfg ps clientCfg "alice" aliceProfile $ \alice -> do
       unpaid <- issueCodeAs cc BTSupporter 1 "unpaid"
       alice ##> ("/_redeem_badge_code 1 " <> codeArg unpaid)
-      alice <## "cannot redeem badge code: badge service error: payment_pending"
+      alice <## "cannot get badge: badge service error: payment_pending"
       paid <- issueCodeAs cc BTSupporter 1 "paid"
       alice ##> ("/_redeem_badge_code 1 " <> codeArg paid)
       alice <## "badge redeemed"
@@ -1284,7 +1351,7 @@ testExpiredCode ps =
       withDB' "markCodePaid" cc (\db -> markCodePaid db (badgeCodeHash code) (addUTCTime (-60) now))
         `shouldReturn` Right ()
       alice ##> ("/_redeem_badge_code 1 " <> codeArg code)
-      alice <## "cannot redeem badge code: badge service error: code_expired"
+      alice <## "cannot get badge: badge service error: code_expired"
 
 testRedeemedBeforeTheDeadline :: HasCallStack => TestParams -> IO ()
 testRedeemedBeforeTheDeadline ps =
@@ -1338,6 +1405,784 @@ testRevokedCode ps =
       paid <- issueCodeAs cc BTSupporter 1 "paid"
       revokeCodeAs cc paid `shouldReturn` "revoked"
       alice ##> ("/_redeem_badge_code 1 " <> codeArg paid)
-      alice <## "cannot redeem badge code: badge service error: code_invalid"
+      alice <## "cannot get badge: badge service error: code_invalid"
       second <- revokeCodeAs cc paid
       second `shouldSatisfy` T.isInfixOf "revoked already"
+
+purchaseCmd :: BadgeMasterKey -> ServicePayment -> BadgeServiceCommand
+purchaseCmd masterKey payment = BSCPurchaseBadge {masterKey, payment, upgrade = Nothing}
+
+supporterPlay :: ServicePayment
+supporterPlay = googlePayment "badge_supporter_01" googleSupporterToken
+
+paymentArg :: ServicePayment -> String
+paymentArg = LB.unpack . J.encode
+
+refusalOf :: HasCallStack => BadgeServiceResponse -> (BadgeServiceErrorCode, Maybe Word32)
+refusalOf = \case
+  BSPError {code, retryAfter} -> (code, retryAfter)
+  r -> error $ "expected an error, got " <> show (J.toJSON r)
+
+badgeTypeOf :: HasCallStack => BadgeServiceResponse -> Maybe BadgeType
+badgeTypeOf r = (\(BadgeCredential _ _ _ BadgeInfo {badgeType}) -> badgeType) <$> credentialOf r
+
+rowCount :: ChatController -> String -> IO Int
+rowCount ChatController {chatStore} table =
+  withTransaction chatStore $ \db -> do
+    [Only n] <- DB.query_ db $ fromString $ "SELECT COUNT(*) FROM " <> table
+    pure n
+
+-- | Each store payment's provider, amount and currency, and the ledger rows that name it.
+storePayments :: ChatController -> IO [(Text, Maybe Int, Maybe Text, Int)]
+storePayments ChatController {chatStore} =
+  withTransaction chatStore $ \db ->
+    DB.query_ db . fromString $
+      "SELECT pay.provider, pay.amount, pay.currency, COUNT(l.entry_id) FROM sx_badge_service_payments pay "
+        <> "LEFT JOIN sx_badge_service_badge_ledger l ON l.payment_id = pay.payment_id "
+        <> "GROUP BY pay.payment_id, pay.provider, pay.amount, pay.currency ORDER BY pay.provider"
+
+nothingPurchased :: HasCallStack => ChatController -> IO ()
+nothingPurchased cc = do
+  rowCount cc "sx_badge_service_payments" `shouldReturn` 0
+  rowCount cc "sx_badge_service_badge_purchases" `shouldReturn` 0
+
+testStorePurchase :: HasCallStack => TestParams -> IO ()
+testStorePurchase ps =
+  withBadgeServiceEnv ps $ \env@BadgeServiceEnv {bsController = cc} -> do
+    (purchaseKey, masterKey) <- newPurchaseKeys
+    purchased <- serviceCmd env purchaseKey $ purchaseCmd masterKey supporterPlay
+    let (entries, previousEntryId) = statementOf purchased
+    previousEntryId `shouldBe` Nothing
+    map entryTag entries `shouldBe` ["payment", "badge"]
+    map (\e -> let (c, m, _) = entryOf e in (c, m)) entries `shouldBe` [(1, 1), (-1, 0)]
+    badgeTypeOf purchased `shouldBe` Just BTSupporter
+    masterKeyOf purchased `shouldBe` Just masterKey
+    map (\(_, c, m, _, _, t) -> (c, m, t)) <$> ledgerRows cc "sx_badge_service_badge_ledger" `shouldReturn` [(1, 1, Just "payment"), (-1, 0, Just "badge")]
+    -- Play reports no price, and only the credit names the payment
+    storePayments cc `shouldReturn` [("google", Nothing, Nothing, 1)]
+
+testStorePurchaseReplay :: HasCallStack => TestParams -> IO ()
+testStorePurchaseReplay ps =
+  withBadgeServiceEnv ps $ \env@BadgeServiceEnv {bsController = cc} -> do
+    (purchaseKey, masterKey) <- newPurchaseKeys
+    purchased <- serviceCmd env purchaseKey $ purchaseCmd masterKey supporterPlay
+    ledger <- ledgerRows cc "sx_badge_service_badge_ledger"
+    replayed <- serviceCmd env purchaseKey $ purchaseCmd masterKey supporterPlay
+    credentialOf replayed `shouldBe` credentialOf purchased
+    map entryTag (fst $ statementOf replayed) `shouldBe` map entryTag (fst $ statementOf purchased)
+    ledgerRows cc "sx_badge_service_badge_ledger" `shouldReturn` ledger
+    storePayments cc `shouldReturn` [("google", Nothing, Nothing, 1)]
+    rowCount cc "sx_badge_service_badge_purchases" `shouldReturn` 1
+
+testStoreReceiptUsed :: HasCallStack => TestParams -> IO ()
+testStoreReceiptUsed ps =
+  withBadgeServiceEnv ps $ \env@BadgeServiceEnv {bsController = cc} -> do
+    (firstKey, firstMasterKey) <- newPurchaseKeys
+    _ <- serviceCmd env firstKey $ purchaseCmd firstMasterKey supporterPlay
+    ledger <- ledgerRows cc "sx_badge_service_badge_ledger"
+    (otherKey, otherMasterKey) <- newPurchaseKeys
+    used <- serviceCmd env otherKey $ purchaseCmd otherMasterKey supporterPlay
+    refusalOf used `shouldBe` (BSEReceiptUsed, Nothing)
+    ledgerRows cc "sx_badge_service_badge_ledger" `shouldReturn` ledger
+    rowCount cc "sx_badge_service_badge_purchases" `shouldReturn` 1
+
+testStoreReceiptInvalid :: HasCallStack => TestParams -> IO ()
+testStoreReceiptInvalid ps =
+  withBadgeServiceEnv ps $ \env@BadgeServiceEnv {bsController = cc, bsStore = FakeStore {appleSandboxJWS}} -> do
+    (purchaseKey, masterKey) <- newPurchaseKeys
+    let refused payment = refusalOf <$> serviceCmd env purchaseKey (purchaseCmd masterKey payment)
+    refused (googlePayment "badge_supporter_01" "not-a-purchase") `shouldReturn` (BSEReceiptInvalid, Nothing)
+    refused SPApple {jws = "not.a.jws"} `shouldReturn` (BSEReceiptInvalid, Nothing)
+    -- refused by the service, which the store would have vouched for
+    refused SPApple {jws = appleSandboxJWS} `shouldReturn` (BSEReceiptInvalid, Nothing)
+    nothingPurchased cc
+
+testStoreUnreachable :: HasCallStack => TestParams -> IO ()
+testStoreUnreachable ps =
+  withBadgeServiceEnv ps $ \env@BadgeServiceEnv {bsController = cc} -> do
+    (purchaseKey, masterKey) <- newPurchaseKeys
+    unreachable <- serviceCmd env purchaseKey $ purchaseCmd masterKey $ googlePayment "badge_supporter_01" googleUnreachableToken
+    refusalOf unreachable `shouldSatisfy` \(code, retryAfter) -> code == BSEProviderUnavailable && isJust retryAfter
+    nothingPurchased cc
+
+testStorePending :: HasCallStack => TestParams -> IO ()
+testStorePending ps =
+  withBadgeServiceEnv ps $ \env@BadgeServiceEnv {bsController = cc, bsStore = store} -> do
+    (purchaseKey, masterKey) <- newPurchaseKeys
+    let unsettled = purchaseCmd masterKey $ googlePayment "badge_supporter_01" googlePendingToken
+    waiting <- serviceCmd env purchaseKey unsettled
+    refusalOf waiting `shouldSatisfy` \(code, retryAfter) -> code == BSEPaymentPending && isJust retryAfter
+    nothingPurchased cc
+    settlePending store
+    settled <- serviceCmd env purchaseKey unsettled
+    badgeTypeOf settled `shouldBe` Just BTSupporter
+    again <- serviceCmd env purchaseKey unsettled
+    credentialOf again `shouldBe` credentialOf settled
+    rowCount cc "sx_badge_service_badge_purchases" `shouldReturn` 1
+    storePayments cc `shouldReturn` [("google", Nothing, Nothing, 1)]
+
+testStoreUnknownProduct :: HasCallStack => TestParams -> IO ()
+testStoreUnknownProduct ps =
+  withBadgeServiceEnv ps $ \env@BadgeServiceEnv {bsController = cc} -> do
+    (purchaseKey, masterKey) <- newPurchaseKeys
+    -- a real purchase of a subscription, whose renewals nothing adds to a badge yet
+    subscription <- serviceCmd env purchaseKey $ purchaseCmd masterKey $ googlePayment "subscr_badge_supporter_01" googleSubscriptionToken
+    refusalOf subscription `shouldBe` (BSEProductUnavailable, Nothing)
+    nothingPurchased cc
+
+testStoreUpgradeRefused :: HasCallStack => TestParams -> IO ()
+testStoreUpgradeRefused ps =
+  withBadgeServiceEnv ps $ \env@BadgeServiceEnv {bsController = cc} -> do
+    (purchaseKey, masterKey) <- newPurchaseKeys
+    g <- C.newRandom
+    (fromPurchaseKey, fromPriv) <- atomically $ C.generateKeyPair g :: IO (C.KeyPair 'C.Ed25519)
+    now <- getCurrentTime
+    let upgrade = BadgeUpgrade {fromPurchaseKey, receipt = "receipt", receiptSignature = C.sign' fromPriv "receipt", balance = BadgeBalance {lastEntry = emptyEntry now BTSupporter}}
+    upgraded <- serviceCmd env purchaseKey BSCPurchaseBadge {masterKey, payment = supporterPlay, upgrade = Just upgrade}
+    refusalOf upgraded `shouldBe` (BSEBadRequest, Nothing)
+    nothingPurchased cc
+
+testStoreBadgeTypeFromProduct :: HasCallStack => TestParams -> IO ()
+testStoreBadgeTypeFromProduct ps =
+  withBadgeServiceEnv ps $ \env@BadgeServiceEnv {bsController = cc, bsStore = FakeStore {appleLegendJWS}} -> do
+    (purchaseKey, masterKey) <- newPurchaseKeys
+    legend <- serviceCmd env purchaseKey $ purchaseCmd masterKey SPApple {jws = appleLegendJWS}
+    badgeTypeOf legend `shouldBe` Just BTLegend
+    map (\StatementEntry {balanceBadgeType} -> balanceBadgeType) (fst $ statementOf legend) `shouldBe` [BTLegend, BTLegend]
+    storePayments cc `shouldReturn` [("apple", Just 7000, Just "USD", 1)]
+
+testNonStoreFundingRefused :: HasCallStack => TestParams -> IO ()
+testNonStoreFundingRefused ps =
+  withBadgeServiceEnv ps $ \env@BadgeServiceEnv {bsController = cc} -> do
+    (purchaseKey, masterKey) <- newPurchaseKeys
+    invoice <- serviceCmd env purchaseKey $ purchaseCmd masterKey SPInvoice {invoiceId = InvoiceId "inv"}
+    refusalOf invoice `shouldBe` (BSEUnknownPurchaseKey, Nothing)
+    transfer <- serviceCmd env purchaseKey $ purchaseCmd masterKey SPReceipt {receipt = "receipt"}
+    refusalOf transfer `shouldBe` (BSEUnknownPurchaseKey, Nothing)
+    nothingPurchased cc
+
+testStoreReplayWhileStoreDown :: HasCallStack => TestParams -> IO ()
+testStoreReplayWhileStoreDown ps =
+  withBadgeServiceEnv ps $ \env@BadgeServiceEnv {bsController = cc, bsStore = store} -> do
+    (purchaseKey, masterKey) <- newPurchaseKeys
+    purchased <- serviceCmd env purchaseKey $ purchaseCmd masterKey supporterPlay
+    ledger <- ledgerRows cc "sx_badge_service_badge_ledger"
+    setGoogleDown store True
+    -- the key it was credited to is answered from the record
+    replayed <- serviceCmd env purchaseKey $ purchaseCmd masterKey supporterPlay
+    credentialOf replayed `shouldBe` credentialOf purchased
+    -- any other key waits for the store, or the answer would tell it which purchases were credited
+    (otherKey, otherMasterKey) <- newPurchaseKeys
+    other <- serviceCmd env otherKey $ purchaseCmd otherMasterKey supporterPlay
+    fst (refusalOf other) `shouldBe` BSEProviderUnavailable
+    ledgerRows cc "sx_badge_service_badge_ledger" `shouldReturn` ledger
+
+testStoreVerifierFailures :: HasCallStack => TestParams -> IO ()
+testStoreVerifierFailures ps =
+  withBadgeServiceEnv ps $ \env@BadgeServiceEnv {bsController = cc, bsStore = FakeStore {appleThrowingJWS}} -> do
+    (purchaseKey, masterKey) <- newPurchaseKeys
+    let answer payment = refusalOf <$> serviceCmd env purchaseKey (purchaseCmd masterKey payment)
+    -- Apple is checked offline, so a verifier that throws was answered by nothing but its own bug
+    answer SPApple {jws = appleThrowingJWS} `shouldReturn` (BSEInternal, Nothing)
+    answer (googlePayment "badge_supporter_01" googleThrowingToken) >>= (`shouldSatisfy` \(code, retryAfter) -> code == BSEProviderUnavailable && isJust retryAfter)
+    answer (googlePayment "badge_supporter_01" googleHangingToken) >>= (`shouldSatisfy` \(code, retryAfter) -> code == BSEProviderUnavailable && isJust retryAfter)
+    nothingPurchased cc
+
+testStoreVerifiedOtherTransaction :: HasCallStack => TestParams -> IO ()
+testStoreVerifiedOtherTransaction ps =
+  withBadgeServiceEnv ps $ \env@BadgeServiceEnv {bsController = cc, bsStore = FakeStore {appleMisnamedJWS}} -> do
+    (purchaseKey, masterKey) <- newPurchaseKeys
+    refusalOf <$> serviceCmd env purchaseKey (purchaseCmd masterKey SPApple {jws = appleMisnamedJWS}) `shouldReturn` (BSEInternal, Nothing)
+    nothingPurchased cc
+
+testStoreQuantityRefused :: HasCallStack => TestParams -> IO ()
+testStoreQuantityRefused ps =
+  withBadgeServiceEnv ps $ \env@BadgeServiceEnv {bsClientCfg, bsController = cc, bsStore = FakeStore {appleQuantityJWS}} -> do
+    (purchaseKey, masterKey) <- newPurchaseKeys
+    refusalOf <$> serviceCmd env purchaseKey (purchaseCmd masterKey SPApple {jws = appleQuantityJWS}) `shouldReturn` (BSEInternal, Nothing)
+    nothingPurchased cc
+    withNewTestChatCfg ps bsClientCfg "alice" aliceProfile $ \alice -> do
+      alice ##> ("/_badge purchase 1 " <> paymentArg SPApple {jws = appleQuantityJWS})
+      storePurchaseOpen alice ""
+      waitStoreReceiptError (chatController alice) "service_error final internal"
+      heldStoreReceipts (chatController alice) `shouldReturn` 1
+    nothingPurchased cc
+
+testPurchaseWithNoVerifier :: HasCallStack => TestParams -> IO ()
+testPurchaseWithNoVerifier ps =
+  withBadgeServiceVerifier ps (const noStoreVerifier) $ \env@BadgeServiceEnv {bsClientCfg, bsController = cc} -> do
+    (purchaseKey, masterKey) <- newPurchaseKeys
+    refusalOf <$> serviceCmd env purchaseKey (purchaseCmd masterKey supporterPlay) `shouldReturn` (BSEProviderNotConfigured, Nothing)
+    nothingPurchased cc
+    withNewTestChatCfg ps bsClientCfg "alice" aliceProfile $ \alice -> do
+      alice ##> ("/_badge purchase 1 " <> paymentArg supporterPlay)
+      storePurchaseOpen alice ""
+      -- not yet rather than never, so the receipt stays held for the retry once a verifier is deployed
+      waitStoreReceiptError (chatController alice) "service_error final provider_not_configured"
+      heldStoreReceipts (chatController alice) `shouldReturn` 1
+      alice ##> "/_badge state 1"
+      alice .<## ", not credited: service_error final provider_not_configured"
+
+testStoreClaimRace :: HasCallStack => TestParams -> IO ()
+testStoreClaimRace ps =
+  withBadgeServiceEnv ps $ \BadgeServiceEnv {bsController = cc} -> do
+    (firstKey, firstMasterKey) <- newPurchaseKeys
+    (otherKey, otherMasterKey) <- newPurchaseKeys
+    now <- getCurrentTime
+    let claim paymentId purchaseKey masterKey =
+          withDB' "claim" cc $ \db ->
+            createStorePurchase db NewStorePurchase {paymentId, provider = PPGoogle, providerRef = "ref", paid = Nothing, purchaseKey, masterKey, badgeType = BTSupporter} now
+    -- the second insert meets the first's claim, as a request that read before the first wrote would
+    claim "p1" firstKey firstMasterKey >>= (`shouldSatisfy` either (const False) isJust)
+    claim "p2" otherKey otherMasterKey `shouldReturn` Right Nothing
+    rowCount cc "sx_badge_service_payments" `shouldReturn` 1
+    rowCount cc "sx_badge_service_badge_purchases" `shouldReturn` 1
+
+testStorePurchaseRace :: HasCallStack => TestParams -> IO ()
+testStorePurchaseRace ps = do
+  hook <- newIORef (pure ())
+  withBadgeServiceVerifier ps (googleVerifierWithHook hook) $ \env@BadgeServiceEnv {bsController = cc} -> do
+    (purchaseKey, masterKey) <- newPurchaseKeys
+    winner <- newIORef Nothing
+    -- the same purchase is presented again while the first is with the store, and credited first
+    writeIORef hook $ serviceCmd env purchaseKey (purchaseCmd masterKey supporterPlay) >>= writeIORef winner . Just
+    raced <- serviceCmd env purchaseKey $ purchaseCmd masterKey supporterPlay
+    Just credited <- readIORef winner
+    credentialOf credited `shouldSatisfy` isJust
+    credentialOf raced `shouldBe` credentialOf credited
+    storePayments cc `shouldReturn` [("google", Nothing, Nothing, 1)]
+    rowCount cc "sx_badge_service_badge_purchases" `shouldReturn` 1
+
+testStorePurchaseRaceOtherKey :: HasCallStack => TestParams -> IO ()
+testStorePurchaseRaceOtherKey ps = do
+  hook <- newIORef (pure ())
+  withBadgeServiceVerifier ps (googleVerifierWithHook hook) $ \env@BadgeServiceEnv {bsController = cc} -> do
+    (purchaseKey, masterKey) <- newPurchaseKeys
+    (otherKey, otherMasterKey) <- newPurchaseKeys
+    winner <- newIORef Nothing
+    -- another key presents the same purchase while the first is with the store, and is credited first
+    writeIORef hook $ serviceCmd env otherKey (purchaseCmd otherMasterKey supporterPlay) >>= writeIORef winner . Just
+    raced <- serviceCmd env purchaseKey $ purchaseCmd masterKey supporterPlay
+    refusalOf raced `shouldBe` (BSEReceiptUsed, Nothing)
+    Just credited <- readIORef winner
+    masterKeyOf credited `shouldBe` Just otherMasterKey
+    ledger <- ledgerRows cc "sx_badge_service_badge_ledger"
+    replayed <- serviceCmd env otherKey $ purchaseCmd otherMasterKey supporterPlay
+    credentialOf replayed `shouldBe` credentialOf credited
+    ledgerRows cc "sx_badge_service_badge_ledger" `shouldReturn` ledger
+    storePayments cc `shouldReturn` [("google", Nothing, Nothing, 1)]
+    rowCount cc "sx_badge_service_badge_purchases" `shouldReturn` 1
+
+testStorePurchaseKeyMismatch :: HasCallStack => TestParams -> IO ()
+testStorePurchaseKeyMismatch ps =
+  withBadgeService ps $ \clientCfg bsLink cc ->
+    withNewTestChatCfg ps clientCfg "alice" aliceProfile $ \alice -> do
+      g <- C.newRandom
+      (_, signPriv) <- atomically $ C.generateKeyPair g :: IO (C.KeyPair 'C.Ed25519)
+      (claimedPub, _) <- atomically $ C.generateKeyPair g :: IO (C.KeyPair 'C.Ed25519)
+      let signKey = B.unpack $ strEncode (C.StoredPrivateKey signPriv)
+          claimed = B.unpack $ strEncode claimedPub
+          req =
+            "{\"version\":1,\"purchaseKey\":\"" <> claimed
+              <> "\",\"request\":{\"type\":\"purchaseBadge\",\"masterKey\":\"" <> testMasterKeyB64
+              <> "\",\"payment\":" <> paymentArg supporterPlay <> "}}"
+      alice ##> ("/_service_request 1 " <> bsLink <> " sign_key=" <> signKey <> " " <> req)
+      alice <## "service response: {\"code\":\"bad_request\",\"type\":\"error\"}"
+      nothingPurchased cc
+
+testPurchaseBadge :: HasCallStack => TestParams -> IO ()
+testPurchaseBadge ps =
+  withBadgeServiceEnv ps $ \BadgeServiceEnv {bsClientCfg, bsController = cc} ->
+    withNewTestChatCfg ps bsClientCfg "alice" aliceProfile $ \alice -> do
+      let purchase = "/_badge purchase 1 " <> paymentArg supporterPlay
+      alice ##> purchase
+      inAnyOrder alice [[openPurchase ""], creditedLines "" "1: supporter"]
+      -- the app hands a purchase over until it is answered credited, and one already credited adds nothing
+      alice ##> purchase
+      alice <## "badge already redeemed"
+      alice ##> "/p"
+      alice <## "user profile: alice (Alice, * supporter)"
+      alice <## "use /p <name> [<bio>] to change it"
+      rowCount cc "sx_badge_service_badge_purchases" `shouldReturn` 1
+      map (\(_, c, m, _, _, t) -> (c, m, t)) <$> ledgerRows (chatController alice) "badge_ledger" `shouldReturn` [(1, 1, Just "payment"), (-1, 0, Just "badge")]
+
+testPurchaseBadgeAppStore :: HasCallStack => TestParams -> IO ()
+testPurchaseBadgeAppStore ps =
+  withBadgeServiceEnv ps $ \BadgeServiceEnv {bsClientCfg, bsController = cc, bsStore = FakeStore {appleLegendJWS}} ->
+    withNewTestChatCfg ps bsClientCfg "alice" aliceProfile $ \alice -> do
+      alice ##> ("/_badge purchase 1 " <> paymentArg SPApple {jws = appleLegendJWS})
+      inAnyOrder alice [[openPurchase ""], creditedLines "" "1: legend"]
+      storePayments cc `shouldReturn` [("apple", Just 7000, Just "USD", 1)]
+
+testPurchaseStash :: HasCallStack => TestParams -> IO ()
+testPurchaseStash ps =
+  withBadgeServiceEnv ps $ \BadgeServiceEnv {bsClientCfg, bsController = cc} ->
+    withNewTestChatCfg ps bsClientCfg "alice" aliceProfile $ \alice -> do
+      let records = rowCount (chatController alice) "badge_store_receipts"
+          refused = "/_badge purchase 1 " <> paymentArg (googlePayment "badge_supporter_01" "not-a-purchase")
+      -- the store does not vouch for it, so it can never be credited, and the record says so
+      alice ##> refused
+      inAnyOrder alice [[openPurchase ""], ["store purchase resolved"]]
+      alice ##> refused
+      alice <## "cannot get badge: badge service error: receipt_invalid"
+      records `shouldReturn` 1
+      heldStoreReceipts (chatController alice) `shouldReturn` 0
+      -- no store transaction to key a record by, so nothing is held or sent
+      alice ##> ("/_badge purchase 1 " <> paymentArg SPApple {jws = "not.a-jws"})
+      alice <## "cannot get badge: invalid store receipt"
+      records `shouldReturn` 1
+      nothingPurchased cc
+      -- pending keeps the receipt held
+      alice ##> ("/_badge purchase 1 " <> paymentArg (googlePayment "badge_supporter_01" googlePendingToken))
+      storePurchaseOpen alice ""
+      waitStoreReceiptError (chatController alice) "service_error retry payment_pending"
+      records `shouldReturn` 2
+      heldStoreReceipts (chatController alice) `shouldReturn` 1
+      nothingPurchased cc
+
+testPurchaseStashReceiptUsed :: HasCallStack => TestParams -> IO ()
+testPurchaseStashReceiptUsed ps =
+  withBadgeServiceEnv ps $ \BadgeServiceEnv {bsClientCfg, bsController = cc} ->
+    withNewTestChatCfg ps bsClientCfg "alice" aliceProfile $ \alice ->
+      withNewTestChatCfg ps bsClientCfg "bob" bobProfile $ \bob -> do
+        let purchase = "/_badge purchase 1 " <> paymentArg supporterPlay
+        alice ##> purchase
+        inAnyOrder alice [[openPurchase ""], creditedLines "" "1: supporter"]
+        bob ##> purchase
+        inAnyOrder bob [[openPurchase ""], ["store purchase resolved"]]
+        bob ##> purchase
+        bob <## "cannot get badge: badge service error: receipt_used"
+        storeReceiptRows (chatController bob) `shouldReturn` [(1, Nothing, True)]
+        heldStoreReceipts (chatController bob) `shouldReturn` 0
+        rowCount (chatController alice) "badge_store_receipts" `shouldReturn` 1
+        rowCount cc "sx_badge_service_badge_purchases" `shouldReturn` 1
+        bob ##> "/p"
+        showActiveUser bob "bob (Bob)"
+
+testPurchaseUnsentPlayToken :: HasCallStack => TestParams -> IO ()
+testPurchaseUnsentPlayToken ps =
+  withBadgeServiceEnv ps $ \BadgeServiceEnv {bsClientCfg, bsController = cc} ->
+    withNewTestChatCfg ps bsClientCfg "alice" aliceProfile $ \alice -> do
+      alice ##> ("/_badge purchase 1 " <> paymentArg (googlePayment "badge_supporter_01" "token/other"))
+      storePurchaseOpen alice ""
+      waitStoreReceiptError (chatController alice) "service_error retry provider_unavailable"
+      heldStoreReceipts (chatController alice) `shouldReturn` 1
+      nothingPurchased cc
+
+testPurchaseWhileBadgeHeld :: HasCallStack => TestParams -> IO ()
+testPurchaseWhileBadgeHeld ps =
+  withBadgeServiceEnv ps $ \BadgeServiceEnv {bsClientCfg, bsController = cc} ->
+    withNewTestChatCfg ps bsClientCfg "alice" aliceProfile $ \alice -> do
+      code <- issueCode cc BTSupporter 1
+      redeemFirstBadge alice code
+      alice ##> ("/_badge purchase 1 " <> paymentArg supporterPlay)
+      alice <##. "1: supporter"
+      storePurchaseOpen alice ""
+      storeReceiptDue (chatController alice) 1 `shouldReturn` False
+      heldStoreReceipts (chatController alice) `shouldReturn` 1
+      rowCount cc "sx_badge_service_payments" `shouldReturn` 0
+
+testPurchaseSameReceiptOtherProfile :: HasCallStack => TestParams -> IO ()
+testPurchaseSameReceiptOtherProfile ps =
+  withBadgeServiceEnv ps $ \BadgeServiceEnv {bsClientCfg, bsController = cc} ->
+    withNewTestChatCfg ps bsClientCfg "alice" aliceProfile $ \alice -> do
+      alice ##> ("/_badge purchase 1 " <> paymentArg supporterPlay)
+      inAnyOrder alice [[openPurchase ""], creditedLines "" "1: supporter"]
+      alice ##> "/create user alisa"
+      showActiveUser alice "alisa"
+      -- the store transaction is the device's, so it stays with the profile it was bought under
+      alice ##> ("/_badge purchase 2 " <> paymentArg supporterPlay)
+      alice <## "[user: alice] badge already redeemed"
+      rowCount cc "sx_badge_service_badge_purchases" `shouldReturn` 1
+      alice ##> "/p"
+      showActiveUser alice "alisa"
+
+testPurchaseStrandedUnderOtherProfile :: HasCallStack => TestParams -> IO ()
+testPurchaseStrandedUnderOtherProfile ps = do
+  broken <- newIORef True
+  withBadgeServiceVerifier ps (brokenGoogle broken) $ \BadgeServiceEnv {bsClientCfg, bsController = cc} ->
+    withNewTestChatCfg ps (fastRetryCfg bsClientCfg) "alice" aliceProfile $ \alice -> do
+      let purchase userId = "/_badge purchase " <> show (userId :: Int) <> " " <> paymentArg supporterPlay
+      alice ##> purchase 1
+      storePurchaseOpen alice ""
+      waitStoreReceiptError (chatController alice) "service_error final internal"
+      alice ##> "/create user alisa"
+      showActiveUser alice "alisa"
+      -- handed over again under whichever profile is active, the purchase stays with the keys alice holds
+      alice ##> purchase 2
+      storePurchaseOpen alice "[user: alice] "
+      writeIORef broken False
+      mapM_ (alice <##.) $ creditedLines "[user: alice] " "1: supporter"
+      (alice </)
+      rowCount (chatController alice) "badge_store_receipts" `shouldReturn` 1
+      rowCount cc "sx_badge_service_badge_purchases" `shouldReturn` 1
+      alice ##> "/user alice"
+      showActiveUser alice "alice (Alice, * supporter)"
+
+testPurchaseDeliveredToHiddenProfile :: HasCallStack => TestParams -> IO ()
+testPurchaseDeliveredToHiddenProfile ps = do
+  broken <- newIORef True
+  withBadgeServiceVerifier ps (brokenGoogle broken) $ \BadgeServiceEnv {bsClientCfg} ->
+    withNewTestChatCfg ps (fastRetryCfg bsClientCfg) "alice" aliceProfile $ \alice -> do
+      let purchase userId = "/_badge purchase " <> show (userId :: Int) <> " " <> paymentArg supporterPlay
+      alice ##> purchase 1
+      storePurchaseOpen alice ""
+      waitStoreReceiptError (chatController alice) "service_error final internal"
+      alice ##> "/create user alisa"
+      showActiveUser alice "alisa"
+      alice ##> "/_hide user 1 \"password\""
+      alice <## "user alice:"
+      alice <## "messages are hidden (use /tail to view)"
+      alice <## "profile is hidden"
+      -- the answer and the credit are the hidden owner's, so the view prints none of them
+      alice ##> purchase 2
+      (alice </)
+      writeIORef broken False
+      waitHeldStoreReceipts (chatController alice) 0
+      (alice </)
+      alice ##> "/user alice password"
+      showActiveUser alice "alice (Alice, * supporter)"
+
+testInvoiceOtherProfile :: HasCallStack => TestParams -> IO ()
+testInvoiceOtherProfile ps =
+  withBadgeServiceEnv ps $ \BadgeServiceEnv {bsClientCfg} ->
+    withNewTestChatCfg ps bsClientCfg "alice" aliceProfile $ \alice -> do
+      invoiceId <- createInvoice alice 1
+      alice ##> "/create user alisa"
+      showActiveUser alice "alisa"
+      alice ##> purchaseWithInvoice 2 invoiceId supporterPlay
+      inAnyOrder alice [["[user: alice] store purchase open: invoice " <> invoiceId <> ", transaction "], creditedLines "[user: alice] " "1: supporter"]
+      (alice </)
+      storeReceiptRows (chatController alice) `shouldReturn` [(1, Just (T.pack invoiceId), True)]
+      alice ##> "/user alice"
+      showActiveUser alice "alice (Alice, * supporter)"
+
+testInvoiceSameReceiptTwice :: HasCallStack => TestParams -> IO ()
+testInvoiceSameReceiptTwice ps =
+  withBadgeServiceEnv ps $ \BadgeServiceEnv {bsClientCfg, bsController = cc} ->
+    withNewTestChatCfg ps bsClientCfg "alice" aliceProfile $ \alice -> do
+      invoiceId <- createInvoice alice 1
+      alice ##> purchaseWithInvoice 1 invoiceId supporterPlay
+      inAnyOrder alice [["store purchase open: invoice " <> invoiceId <> ", transaction "], creditedLines "" "1: supporter"]
+      alice ##> purchaseWithInvoice 1 invoiceId supporterPlay
+      alice <## "badge already redeemed"
+      storeReceiptRows (chatController alice) `shouldReturn` [(1, Just (T.pack invoiceId), True)]
+      rowCount cc "sx_badge_service_badge_purchases" `shouldReturn` 1
+
+testInvoiceUnknown :: HasCallStack => TestParams -> IO ()
+testInvoiceUnknown ps =
+  withBadgeServiceEnv ps $ \BadgeServiceEnv {bsClientCfg} ->
+    withNewTestChatCfg ps bsClientCfg "alice" aliceProfile $ \alice -> do
+      alice ##> "/create user alisa"
+      showActiveUser alice "alisa"
+      -- a reinstall or a second device: the store echoes an invoice this database never created
+      let unknown = "0b6a5e6c-4f3e-4d51-9f55-3a0f7c2f9e11"
+      alice ##> purchaseWithInvoice 2 unknown supporterPlay
+      inAnyOrder alice [["store purchase open: invoice " <> unknown <> ", transaction "], creditedLines "" "1: supporter"]
+      storeReceiptRows (chatController alice) `shouldReturn` [(2, Just (T.pack unknown), True)]
+
+testInvoiceLateReceipt :: HasCallStack => TestParams -> IO ()
+testInvoiceLateReceipt ps =
+  withBadgeServiceEnv ps $ \BadgeServiceEnv {bsClientCfg, bsClock = clock} ->
+    withNewTestChatCfg ps bsClientCfg "alice" aliceProfile $ \alice -> do
+      invoiceId <- createInvoice alice 1
+      getCurrentTime >>= setClockAt clock . addUTCTime (8 * nominalDay)
+      alice ##> "/create user alisa"
+      showActiveUser alice "alisa"
+      alice ##> purchaseWithInvoice 2 invoiceId supporterPlay
+      inAnyOrder alice [["[user: alice] store purchase open: invoice " <> invoiceId <> ", transaction "], creditedLines "[user: alice] " "1: supporter"]
+      (alice </)
+      storeReceiptRows (chatController alice) `shouldReturn` [(1, Just (T.pack invoiceId), True)]
+
+testInvoiceAgedOut :: HasCallStack => TestParams -> IO ()
+testInvoiceAgedOut ps =
+  withBadgeServiceEnv ps $ \BadgeServiceEnv {bsClientCfg, bsClock = clock} ->
+    withNewTestChatCfg ps bsClientCfg "alice" aliceProfile $ \alice -> do
+      unpaid <- createInvoice alice 1
+      presented <- createInvoice alice 1
+      refused <- createInvoice alice 1
+      alice ##> purchaseWithInvoice 1 refused (googlePayment "badge_supporter_01" "not-a-purchase")
+      inAnyOrder
+        alice
+        [ [ "store purchase open: invoice " <> unpaid,
+            "store purchase open: invoice " <> presented,
+            "store purchase open: invoice " <> refused <> ", transaction "
+          ],
+          ["store purchase resolved"]
+        ]
+      alice ##> purchaseWithInvoice 1 presented (googlePayment "badge_supporter_01" googlePendingToken)
+      alice <## ("store purchase open: invoice " <> unpaid)
+      alice <##. ("store purchase open: invoice " <> presented <> ", transaction ")
+      waitStoreReceiptError (chatController alice) "service_error retry payment_pending"
+      -- no age hides a record: one with no receipt and one held stay listed, and only a settled one goes
+      getCurrentTime >>= setClockAt clock . addUTCTime (8 * nominalDay)
+      alice ##> "/_badge state 1"
+      alice <## ("store purchase open: invoice " <> unpaid)
+      alice <##. ("store purchase open: invoice " <> presented <> ", transaction ")
+      (alice </)
+
+testInvoiceRefusedBeforeCharge :: HasCallStack => TestParams -> IO ()
+testInvoiceRefusedBeforeCharge ps = do
+  withNewTestChatCfg ps testCfg {badgeServiceAddress = Nothing} "bob" bobProfile $ \bob -> do
+    bob ##> "/_badge invoice 1"
+    bob <## "cannot get badge: badge service not configured"
+    storeReceiptRows (chatController bob) `shouldReturn` []
+  withBadgeServiceEnv ps $ \BadgeServiceEnv {bsClientCfg, bsController = cc} ->
+    withNewTestChatCfg ps bsClientCfg "alice" aliceProfile $ \alice -> do
+      code <- issueCode cc BTSupporter 1
+      redeemFirstBadge alice code
+      alice ##> "/_badge invoice 1"
+      alice <## "cannot get badge: badge already active"
+      storeReceiptRows (chatController alice) `shouldReturn` []
+
+testInvoiceWhileBadgeHeld :: HasCallStack => TestParams -> IO ()
+testInvoiceWhileBadgeHeld ps =
+  withBadgeServiceEnv ps $ \BadgeServiceEnv {bsClientCfg, bsController = cc} ->
+    withNewTestChatCfg ps bsClientCfg "alice" aliceProfile $ \alice -> do
+      invoiceId <- createInvoice alice 1
+      code <- issueCode cc BTSupporter 1
+      redeemFirstBadge alice code
+      alice ##> purchaseWithInvoice 1 invoiceId supporterPlay
+      alice <##. "1: supporter"
+      alice <##. ("store purchase open: invoice " <> invoiceId <> ", transaction ")
+      storeReceiptDue (chatController alice) 1 `shouldReturn` False
+      storeReceiptRows (chatController alice) `shouldReturn` [(1, Just (T.pack invoiceId), True)]
+      heldStoreReceipts (chatController alice) `shouldReturn` 1
+      rowCount cc "sx_badge_service_payments" `shouldReturn` 0
+
+testInvoiceStateOtherProfile :: HasCallStack => TestParams -> IO ()
+testInvoiceStateOtherProfile ps =
+  withBadgeServiceEnv ps $ \BadgeServiceEnv {bsClientCfg} ->
+    withNewTestChatCfg ps bsClientCfg "alice" aliceProfile $ \alice -> do
+      _ <- createInvoice alice 1
+      alice ##> "/create user alisa"
+      showActiveUser alice "alisa"
+      alice ##> "/_hide user 1 \"password\""
+      alice <## "user alice:"
+      alice <## "messages are hidden (use /tail to view)"
+      alice <## "profile is hidden"
+      invoiceId <- createInvoice alice 2
+      alice ##> "/_badge state 2"
+      alice <## ("store purchase open: invoice " <> invoiceId)
+      (alice </)
+
+testStoreReceiptRetried :: HasCallStack => TestParams -> IO ()
+testStoreReceiptRetried ps = do
+  broken <- newIORef True
+  withBadgeServiceVerifier ps (brokenGoogle broken) $ \BadgeServiceEnv {bsClientCfg, bsController = cc} ->
+    withNewTestChatCfg ps (fastRetryCfg bsClientCfg) "alice" aliceProfile $ \alice -> do
+      alice ##> ("/_badge purchase 1 " <> paymentArg supporterPlay)
+      storePurchaseOpen alice ""
+      waitStoreReceiptError (chatController alice) "service_error final internal"
+      writeIORef broken False
+      mapM_ (alice <##.) $ creditedLines "" "1: supporter"
+      rowCount cc "sx_badge_service_badge_purchases" `shouldReturn` 1
+
+testStoreReceiptNotBlocked :: HasCallStack => TestParams -> IO ()
+testStoreReceiptNotBlocked ps =
+  withBadgeServiceEnv ps $ \BadgeServiceEnv {bsClientCfg, bsStore = store@FakeStore {appleSupporterJWS}} ->
+    withNewTestChatCfg ps bsClientCfg "alice" aliceProfile $ \alice -> do
+      setGoogleDown store True
+      alice ##> ("/_badge purchase 1 " <> paymentArg supporterPlay)
+      storePurchaseOpen alice ""
+      waitStoreReceiptError (chatController alice) "service_error retry provider_unavailable"
+      alice ##> ("/_badge purchase 1 " <> paymentArg SPApple {jws = appleSupporterJWS})
+      inAnyOrder alice [[openPurchase "", openPurchase ""], creditedLines "" "1: supporter"]
+      heldStoreReceipts (chatController alice) `shouldReturn` 1
+
+testStoreRefusalKept :: HasCallStack => TestParams -> IO ()
+testStoreRefusalKept ps = do
+  hook <- newIORef (pure ())
+  verifications <- countGoogleVerifications hook
+  withBadgeServiceVerifier ps (googleVerifierWithHook hook) $ \BadgeServiceEnv {bsClientCfg} ->
+    withNewTestChatCfg ps bsClientCfg "alice" aliceProfile $ \alice -> do
+      let refused = "/_badge purchase 1 " <> paymentArg (googlePayment "badge_supporter_01" "not-a-purchase")
+      alice ##> refused
+      inAnyOrder alice [[openPurchase ""], ["store purchase resolved"]]
+      alice ##> refused
+      alice <## "cannot get badge: badge service error: receipt_invalid"
+      alice ##> "/_badge state 1"
+      (alice </)
+      verifications `shouldReturn` 1
+      storeReceiptRows (chatController alice) `shouldReturn` [(1, Nothing, True)]
+
+testStoreSettledOtherProfile :: HasCallStack => TestParams -> IO ()
+testStoreSettledOtherProfile ps =
+  withBadgeServiceEnv ps $ \BadgeServiceEnv {bsClientCfg} ->
+    withNewTestChatCfg ps bsClientCfg "alice" aliceProfile $ \alice -> do
+      shown <- createInvoice alice 1
+      hidden <- createInvoice alice 1
+      alice ##> "/create user alisa"
+      showActiveUser alice "alisa"
+      -- the invoice makes alice the owner, so the hand-over's answer and the settlement are hers
+      alice ##> purchaseWithInvoice 2 shown (googlePayment "badge_supporter_01" "not-a-purchase")
+      inAnyOrder
+        alice
+        [ ["[user: alice] store purchase open: invoice " <> shown <> ", transaction ", "store purchase open: invoice " <> hidden],
+          ["[user: alice] store purchase resolved"]
+        ]
+      alice ##> "/_hide user 1 \"password\""
+      alice <## "user alice:"
+      alice <## "messages are hidden (use /tail to view)"
+      alice <## "profile is hidden"
+      alice ##> purchaseWithInvoice 2 hidden (googlePayment "badge_supporter_01" "not-a-purchase-either")
+      (alice </)
+      waitHeldStoreReceipts (chatController alice) 0
+      (alice </)
+      storeReceiptRows (chatController alice) `shouldReturn` [(1, Just (T.pack shown), True), (1, Just (T.pack hidden), True)]
+
+testStoreReceiptTwoAtOnce :: HasCallStack => TestParams -> IO ()
+testStoreReceiptTwoAtOnce ps =
+  withBadgeServiceEnv ps $ \BadgeServiceEnv {bsClientCfg, bsController = cc} ->
+    withNewTestChatCfg ps bsClientCfg "alice" aliceProfile $ \alice -> do
+      let handOver = void $ sendChatCmdStr (chatController alice) ("/_badge purchase 1 " <> paymentArg supporterPlay)
+      concurrentlyN_ [handOver, handOver]
+      mapM_ (alice <##.) $ creditedLines "" "1: supporter"
+      (alice </)
+      storeReceiptRows (chatController alice) `shouldReturn` [(1, Nothing, True)]
+      rowCount cc "sx_badge_service_badge_purchases" `shouldReturn` 1
+
+testStoreReceiptCleanup :: HasCallStack => TestParams -> IO ()
+testStoreReceiptCleanup ps =
+  withBadgeServiceEnv ps $ \BadgeServiceEnv {bsClientCfg, bsClock, bsStore = FakeStore {appleSupporterJWS}} -> do
+    let cfg = bsClientCfg {initialCleanupManagerDelay = 0, cleanupManagerInterval = 1, cleanupManagerStepDelay = 0}
+    withNewTestChatCfg ps cfg "alice" aliceProfile $ \alice -> do
+      unpaid <- createInvoice alice 1
+      alice ##> ("/_badge purchase 1 " <> paymentArg (googlePayment "badge_supporter_01" "not-a-purchase"))
+      inAnyOrder alice [["store purchase open: invoice " <> unpaid, openPurchase ""], ["store purchase resolved"]]
+      alice ##> ("/_badge purchase 1 " <> paymentArg SPApple {jws = appleSupporterJWS})
+      inAnyOrder alice [["store purchase open: invoice " <> unpaid, openPurchase ""], creditedLines "" "1: supporter"]
+      alice ##> ("/_badge purchase 1 " <> paymentArg (googlePayment "badge_supporter_01" googleUnreachableToken))
+      alice <##. "1: supporter"
+      alice <## ("store purchase open: invoice " <> unpaid)
+      storePurchaseOpen alice ""
+      storeReceiptRows (chatController alice) `shouldReturn` [(1, Just (T.pack unpaid), False), (1, Nothing, True), (1, Nothing, True), (1, Nothing, True)]
+      -- a month on, the record no receipt reached and the refusal go; the credited and the held one stay
+      testClockTime bsClock >>= setClockAt bsClock . addUTCTime (31 * nominalDay)
+      -- the move also ends the badge credited above; whether its worker wakes alone or on this signal, its lines are read here
+      alice `send` "/_app activate"
+      inAnyOrder alice [["/_app activate"], ["ok"], ["badge alert: support_ended "], ["1: supporter", "badge alert: support_ended "]]
+      waitStoreReceiptRows (chatController alice) 2 `shouldReturn` [(1, Nothing, True), (1, Nothing, True)]
+      heldStoreReceipts (chatController alice) `shouldReturn` 1
+      -- a receipt for the deleted invoice now arrives with no record to name its profile, so the presenting one gets it
+      alice ##> "/create user alisa"
+      showActiveUser alice "alisa"
+      alice ##> purchaseWithInvoice 2 unpaid (googlePayment "badge_supporter_01" googlePendingToken)
+      alice <##. ("store purchase open: invoice " <> unpaid <> ", transaction ")
+      waitStoreReceiptRows (chatController alice) 3 >>= (`shouldContain` [(2, Just (T.pack unpaid), True)])
+
+testStoreReceiptAttemptThrows :: HasCallStack => TestParams -> IO ()
+testStoreReceiptAttemptThrows ps = do
+  broken <- newIORef True
+  withBadgeServiceVerifier ps (brokenGoogle broken) $ \BadgeServiceEnv {bsClientCfg} ->
+    withNewTestChatCfg ps (fastRetryCfg bsClientCfg) "alice" aliceProfile $ \alice -> do
+      alice ##> ("/_badge purchase 1 " <> paymentArg supporterPlay)
+      storePurchaseOpen alice ""
+      waitStoreReceiptError (chatController alice) "service_error final internal"
+      -- a stored payment this version cannot read makes the attempt throw before anything is sent
+      setStoreReceiptPayment (chatController alice) "not a payment"
+      waitStoreReceiptError (chatController alice) "unexpected held store payment does not decode"
+      (alice </)
+      heldStoreReceipts (chatController alice) `shouldReturn` 1
+
+createInvoice :: HasCallStack => TestCC -> Int -> IO String
+createInvoice cc userId = do
+  cc ##> ("/_badge invoice " <> show userId)
+  line <- getTermLine cc
+  maybe (error $ "expected an invoice, got " <> line) pure $ stripPrefix "badge invoice: " line
+
+purchaseWithInvoice :: Int -> String -> ServicePayment -> String
+purchaseWithInvoice userId invoiceId payment = "/_badge purchase " <> show userId <> " invoice=" <> invoiceId <> " " <> paymentArg payment
+
+-- | Each store purchase record's profile, invoice id, and whether a receipt reached it.
+storeReceiptRows :: ChatController -> IO [(Int64, Maybe Text, Bool)]
+storeReceiptRows ChatController {chatStore} =
+  withTransaction chatStore $ \db ->
+    DB.query_ db $
+      "SELECT user_id, invoice_id, transaction_ref IS NOT NULL "
+        <> "FROM badge_store_receipts ORDER BY badge_store_receipt_id"
+
+waitStoreReceiptRows :: HasCallStack => ChatController -> Int -> IO [(Int64, Maybe Text, Bool)]
+waitStoreReceiptRows cc n = loop (100 :: Int)
+  where
+    loop 0 = storeReceiptRows cc >>= \rows -> error $ "expected " <> show n <> " store purchase records, got " <> show rows
+    loop i = do
+      rows <- storeReceiptRows cc
+      if length rows == n then pure rows else threadDelay 50000 >> loop (i - 1)
+
+storeReceiptDue :: ChatController -> Int64 -> IO Bool
+storeReceiptDue ChatController {chatStore} userId =
+  withTransaction chatStore $ \db ->
+    getNextHeldStoreReceipt db userId >>= either (error . show) (pure . isJust)
+
+heldStoreReceipts :: ChatController -> IO Int
+heldStoreReceipts ChatController {chatStore} =
+  withTransaction chatStore $ \db -> do
+    [Only n] <- DB.query_ db "SELECT COUNT(*) FROM badge_store_receipts WHERE payment IS NOT NULL"
+    pure n
+
+waitHeldStoreReceipts :: HasCallStack => ChatController -> Int -> IO ()
+waitHeldStoreReceipts cc n = loop (100 :: Int)
+  where
+    loop 0 = heldStoreReceipts cc >>= (`shouldBe` n)
+    loop i = heldStoreReceipts cc >>= \held -> if held == n then pure () else threadDelay 50000 >> loop (i - 1)
+
+waitStoreReceiptError :: HasCallStack => ChatController -> Text -> IO ()
+waitStoreReceiptError ChatController {chatStore} failure = loop (100 :: Int)
+  where
+    loop 0 = heldFailures >>= (`shouldContain` [failure])
+    loop i = heldFailures >>= \failures -> if failure `elem` failures then pure () else threadDelay 50000 >> loop (i - 1)
+    heldFailures =
+      withTransaction chatStore $ \db ->
+        map fromOnly <$> DB.query_ db "SELECT credit_error FROM badge_store_receipts WHERE payment IS NOT NULL AND credit_error IS NOT NULL"
+
+setStoreReceiptPayment :: ChatController -> Text -> IO ()
+setStoreReceiptPayment ChatController {chatStore} payment =
+  withTransaction chatStore $ \db -> DB.execute db "UPDATE badge_store_receipts SET payment = ?" (Only payment)
+
+fastRetryCfg :: ChatConfig -> ChatConfig
+fastRetryCfg cfg = cfg {badgeRetryInterval = RetryInterval {initialInterval = 100000, increaseAfter = 0, maxInterval = 500000}}
+
+-- | The fake store's Google verdicts, failing as a verifier bug while broken is set: internal, with no retryAfter.
+brokenGoogle :: IORef Bool -> FakeStore -> StoreVerifier
+brokenGoogle broken FakeStore {fakeVerifier = v@StoreVerifier {verifyGoogle}} =
+  v {verifyGoogle = unlessBroken <$> verifyGoogle}
+  where
+    unlessBroken verify productId token =
+      readIORef broken >>= \case
+        True -> pure $ Left $ SRVerifierFailed "fake verifier bug"
+        False -> verify productId token
+
+-- | Each block's lines in order, the blocks in any order: the worker is signalled before the command that
+-- signalled it has answered, so its events can print first. Every line is matched as a prefix.
+inAnyOrder :: HasCallStack => TestCC -> [[String]] -> IO ()
+inAnyOrder _ [] = pure ()
+inAnyOrder cc blocks = do
+  line <- getTermLine cc
+  case break (startsWith line) blocks of
+    (earlier, (_ : rest) : others) -> do
+      mapM_ (cc <##.) rest
+      inAnyOrder cc (earlier <> others)
+    _ -> error $ "expected a line starting one of " <> show blocks <> ", got " <> show line
+  where
+    startsWith l = \case
+      start : _ -> start `isPrefixOf` l
+      [] -> False
+
+-- | Counts the Google verifications the service makes, re-arming the one-shot hook each time.
+countGoogleVerifications :: IORef (IO ()) -> IO (IO Int)
+countGoogleVerifications hook = do
+  n <- newIORef 0
+  let count = modifyIORef' n (+ 1) >> writeIORef hook count
+  writeIORef hook count
+  pure $ readIORef n
+
+storePurchaseOpen :: HasCallStack => TestCC -> String -> IO ()
+storePurchaseOpen cc userPrefix = cc <##. openPurchase userPrefix
+
+openPurchase :: String -> String
+openPurchase userPrefix = userPrefix <> "store purchase open: invoice none, transaction "
+
+-- | The worker's credit as the owner's terminal shows it: the badge, then the settlement.
+creditedLines :: String -> String -> [String]
+creditedLines userPrefix badge = [userPrefix <> badge, userPrefix <> "store purchase resolved"]
diff --git a/tests/Bots/BadgeService/ConfigTests.hs b/tests/Bots/BadgeService/ConfigTests.hs
index d27698622d..4e797e6335 100644
--- a/tests/Bots/BadgeService/ConfigTests.hs
+++ b/tests/Bots/BadgeService/ConfigTests.hs
@@ -50,6 +50,10 @@ badgeConfigTests = describe "badge service config" $ do
   it "reads chat_redeem = on" testDevRedeemOn
   it "reads chat_redeem = off" testDevRedeemOff
   it "refuses a chat_redeem that is not on or off" testDevRedeemNotBoolean
+  it "verifies store receipts when the dev section is absent" testDevUnverifiedReceiptsAbsent
+  it "reads accept_unverified_store_receipts = on" testDevUnverifiedReceiptsOn
+  it "reads accept_unverified_store_receipts = off" testDevUnverifiedReceiptsOff
+  it "refuses an accept_unverified_store_receipts that is not on or off" testDevUnverifiedReceiptsNotBoolean
 
 fullIni :: T.Text
 fullIni =
@@ -365,5 +369,25 @@ testDevRedeemNotBoolean = withDev "chat_redeem = true\n" $ \r -> case r of
   Left e -> e `shouldContain` "chat_redeem"
   Right _ -> expectationFailure "only on and off are accepted, so a typo cannot silently disarm the gate"
 
+testDevUnverifiedReceiptsAbsent :: IO ()
+testDevUnverifiedReceiptsAbsent = withIni fullIni $ \p -> do
+  Right cfg <- readServiceConfig p
+  devAcceptUnverifiedStoreReceipts cfg `shouldBe` False
+
+testDevUnverifiedReceiptsOn :: IO ()
+testDevUnverifiedReceiptsOn = withDev "accept_unverified_store_receipts = on\n" $ \r -> case r of
+  Right cfg -> devAcceptUnverifiedStoreReceipts cfg `shouldBe` True
+  Left e -> expectationFailure ("[dev] accept_unverified_store_receipts = on is legal: " <> e)
+
+testDevUnverifiedReceiptsOff :: IO ()
+testDevUnverifiedReceiptsOff = withDev "accept_unverified_store_receipts = off\n" $ \r -> case r of
+  Right cfg -> devAcceptUnverifiedStoreReceipts cfg `shouldBe` False
+  Left e -> expectationFailure ("[dev] accept_unverified_store_receipts = off is legal: " <> e)
+
+testDevUnverifiedReceiptsNotBoolean :: IO ()
+testDevUnverifiedReceiptsNotBoolean = withDev "accept_unverified_store_receipts = yes\n" $ \r -> case r of
+  Left e -> e `shouldContain` "accept_unverified_store_receipts"
+  Right _ -> expectationFailure "only on and off are accepted, so a typo cannot silently arm the mock"
+
 withDev :: T.Text -> (Either String ServiceConfig -> IO a) -> IO a
 withDev keys act = withIni (fullIni <> "[dev]\n" <> keys) $ \p -> readServiceConfig p >>= act
diff --git a/tests/Bots/BadgeService/FakeStore.hs b/tests/Bots/BadgeService/FakeStore.hs
new file mode 100644
index 0000000000..986351c47f
--- /dev/null
+++ b/tests/Bots/BadgeService/FakeStore.hs
@@ -0,0 +1,141 @@
+{-# LANGUAGE DuplicateRecordFields #-}
+{-# LANGUAGE LambdaCase #-}
+{-# LANGUAGE NamedFieldPuns #-}
+{-# LANGUAGE OverloadedStrings #-}
+{-# LANGUAGE TupleSections #-}
+
+module Bots.BadgeService.FakeStore
+  ( FakeStore (..),
+    newFakeStore,
+    googleVerifierWithHook,
+    settlePending,
+    setGoogleDown,
+    googleSupporterToken,
+    googlePendingToken,
+    googleUnreachableToken,
+    googleThrowingToken,
+    googleHangingToken,
+    googleSubscriptionToken,
+    googlePayment,
+    unsignedJWS,
+  )
+where
+
+import BadgeService.StoreReceipts
+import Control.Concurrent (threadDelay)
+import Control.Monad (forever)
+import qualified Data.Aeson as J
+import qualified Data.ByteString.Base64.URL as B64U
+import qualified Data.ByteString.Char8 as B
+import qualified Data.ByteString.Lazy as LB
+import Data.IORef (IORef, atomicModifyIORef', newIORef, readIORef, writeIORef)
+import Data.Text (Text)
+import Simplex.Chat.PaymentService (ServicePayment (..), googlePurchaseRef)
+import Simplex.Chat.PaymentService.Types (CurrencyAmount (..))
+import Simplex.Messaging.Util (safeDecodeUtf8)
+import System.FilePath ((</>))
+
+fixtureDir :: FilePath
+fixtureDir = "apps" </> "simplex-badge-service" </> "test-fixtures" </> "apple"
+
+-- | The Apple JWS are the fixtures under no real signature, so they are accepted as these exact
+-- strings only, never because a payload decodes - which a real verifier must refuse to do.
+data FakeStore = FakeStore
+  { appleSupporterJWS :: Text,
+    appleLegendJWS :: Text,
+    appleSandboxJWS :: Text,
+    appleThrowingJWS :: Text,
+    appleMisnamedJWS :: Text,
+    appleQuantityJWS :: Text,
+    pendingSettled :: IORef Bool,
+    googleDown :: IORef Bool,
+    fakeVerifier :: StoreVerifier
+  }
+
+newFakeStore :: IO FakeStore
+newFakeStore = do
+  appleSupporterJWS <- fixtureJWS "transaction-supporter.json"
+  appleLegendJWS <- fixtureJWS "transaction-legend.json"
+  appleSandboxJWS <- fixtureJWS "transaction-sandbox.json"
+  let appleThrowingJWS = unsignedJWS "{\"transactionId\":\"2000000812345679\",\"productId\":\"BADGE_SUPPORTER_01\"}"
+      appleMisnamedJWS = unsignedJWS "{\"transactionId\":\"2000000812345698\",\"productId\":\"BADGE_SUPPORTER_01\"}"
+      appleQuantityJWS = unsignedJWS "{\"transactionId\":\"2000000812345697\",\"productId\":\"BADGE_SUPPORTER_01\"}"
+  pendingSettled <- newIORef False
+  googleDown <- newIORef False
+  let appleReceipts =
+        [ (appleSupporterJWS, appleTransaction "2000000812345671" "BADGE_SUPPORTER_01" False 700),
+          (appleLegendJWS, appleTransaction "2000000812345672" "BADGE_LEGEND_01" False 7000),
+          (appleSandboxJWS, appleTransaction "2000000812345673" "BADGE_LEGEND_01" True 7000),
+          -- a verifier vouching for another transaction than the one the evidence names
+          (appleMisnamedJWS, appleTransaction "2000000812345671" "BADGE_SUPPORTER_01" False 700),
+          (appleQuantityJWS, (appleTransaction "2000000812345697" "BADGE_SUPPORTER_01" False 1400) {quantity = 2})
+        ]
+      verifyApple jws
+        | jws == appleThrowingJWS = error "fake verifier bug"
+        | otherwise = maybe (Left "not a fake receipt") Right $ lookup jws appleReceipts
+      verifyGoogle = googleVerdict pendingSettled googleDown
+  pure
+    FakeStore
+      { appleSupporterJWS,
+        appleLegendJWS,
+        appleSandboxJWS,
+        appleThrowingJWS,
+        appleMisnamedJWS,
+        appleQuantityJWS,
+        pendingSettled,
+        googleDown,
+        fakeVerifier = StoreVerifier {verifyApple = Just verifyApple, verifyGoogle = Just verifyGoogle, verifyTimeout = 500000}
+      }
+  where
+    fixtureJWS name = unsignedJWS <$> B.readFile (fixtureDir </> name)
+    appleTransaction transactionRef productId testPurchase cents =
+      VerifiedStoreTransaction {transactionRef, productId, quantity = 1, testPurchase, paid = Just (CurrencyAmount cents, "USD")}
+
+googleVerdict :: IORef Bool -> IORef Bool -> Text -> Text -> IO (Either StoreRefusal VerifiedStoreTransaction)
+googleVerdict pendingSettled googleDown productId token =
+  readIORef googleDown >>= \case
+    True -> pure $ Left $ SRUnreachable "fake store is down"
+    False
+      | (productId, token) == ("badge_supporter_01", googleSupporterToken) -> pure $ Right purchased
+      | (productId, token) == ("subscr_badge_supporter_01", googleSubscriptionToken) -> pure $ Right purchased
+      | (productId, token) == ("badge_supporter_01", googlePendingToken) -> do
+          settled <- readIORef pendingSettled
+          pure $ if settled then Right purchased else Left SRPending
+      | token == googleUnreachableToken -> pure $ Left $ SRUnreachable "fake store is down"
+      | token == googleThrowingToken -> ioError $ userError "fake connection reset"
+      | token == googleHangingToken -> forever $ threadDelay 1000000
+      | otherwise -> pure $ Left $ SRInvalid "not a fake purchase"
+  where
+    purchased = VerifiedStoreTransaction {transactionRef = googlePurchaseRef token, productId, quantity = 1, testPurchase = False, paid = Nothing}
+
+-- | The fake store, running the hook's action once, inside the first Google verification, before it answers.
+googleVerifierWithHook :: IORef (IO ()) -> FakeStore -> StoreVerifier
+googleVerifierWithHook hook FakeStore {fakeVerifier = v@StoreVerifier {verifyGoogle}} =
+  v {verifyGoogle = hooked <$> verifyGoogle, verifyTimeout = 10000000}
+  where
+    hooked verify productId token = do
+      action <- atomicModifyIORef' hook (pure (),)
+      action
+      verify productId token
+
+settlePending :: FakeStore -> IO ()
+settlePending FakeStore {pendingSettled} = writeIORef pendingSettled True
+
+setGoogleDown :: FakeStore -> Bool -> IO ()
+setGoogleDown FakeStore {googleDown} = writeIORef googleDown
+
+googleSupporterToken, googlePendingToken, googleUnreachableToken, googleThrowingToken, googleHangingToken, googleSubscriptionToken :: Text
+googleSupporterToken = "fake-play-token-supporter.AO-J1Oz9x2kqE7wYt3"
+googlePendingToken = "fake-play-token-pending.AO-J1Oy8w1jpD6vXs2"
+googleUnreachableToken = "fake-play-token-unreachable.AO-J1Ox7v0ioC5uWr1"
+googleThrowingToken = "fake-play-token-throwing.AO-J1Ov5t8gmA3sUp9"
+googleHangingToken = "fake-play-token-hanging.AO-J1Ou4s7flZ2rTo8"
+googleSubscriptionToken = "fake-play-token-subscription.AO-J1Ow6u9hnB4tVq0"
+
+googlePayment :: Text -> Text -> ServicePayment
+googlePayment productId token = SPGoogle {productId, token}
+
+unsignedJWS :: B.ByteString -> Text
+unsignedJWS payload = safeDecodeUtf8 $ B.intercalate "." $ map B64U.encodeUnpadded [header, payload, "not a signature"]
+  where
+    header = LB.toStrict $ J.encode $ J.object ["alg" J..= ("ES256" :: Text), "x5c" J..= (["leaf", "intermediate", "root"] :: [Text])]
diff --git a/tests/Bots/BadgeService/WebTests.hs b/tests/Bots/BadgeService/WebTests.hs
index dd21c820dd..bd8b166094 100644
--- a/tests/Bots/BadgeService/WebTests.hs
+++ b/tests/Bots/BadgeService/WebTests.hs
@@ -14,7 +14,7 @@ import BadgeService.Poller
 import BadgeService.Providers
 import BadgeService.Providers.BTCPay (btcpayProvider, listPageSize, maxListPages)
 import BadgeService.Providers.Stripe (stripeProvider)
-import BadgeService.Store (CodeRedemption (..), IssuedCode (..), NewCodePurchase (..), RevokeResult (..), createCodePurchase, getBadgeCode, insertBadgeCode, revokeCode)
+import BadgeService.Store (FundingCredit (..), IssuedCode (..), NewCodePurchase (..), RevokeResult (..), createCodePurchase, getBadgeCode, insertBadgeCode, revokeCode)
 import BadgeService.Store.Invoices
 import BadgeService.Waiters (awaitStatus, newWaiters, publish, waitingCount)
 import BadgeService.Web.Server
@@ -471,7 +471,7 @@ testRevokeAndRedeemExcludeEachOther = withServiceStore $ \st -> do
       revoke codeHash = withTransaction st $ \db -> revokeCode db codeHash now
       unredeemed codeHash =
         withTransaction st (`getBadgeCode` codeHash) >>= \case
-          Just IssuedCode {redemption = CodeUnredeemed} -> pure True
+          Just IssuedCode {redemption = Uncredited} -> pure True
           _ -> pure False
   revokedFirst <- newCode "revoked-first"
   revoke "revoked-first" `shouldReturn` Revoked
@@ -801,7 +801,8 @@ testServiceConfig staticDir trustForwarded =
       stripe = Nothing,
       poll = PollConfig {pWaitingSeconds = 3, pIdleSeconds = 60},
       issuer = Nothing,
-      devChatRedeem = False
+      devChatRedeem = False,
+      devAcceptUnverifiedStoreReceipts = False
     }
 
 testServeWebappOff :: IO ()