Ignore generated build directories

.gitignore

@@ -1,4 +1,6 @@
 build/
+Builds/
+build-*/
 build-release/
 build-sim/
 build-watch/

APPSTORE.md

@@ -1,6 +1,6 @@
 # FuelBoard App Store Submission Plan
 
-Updated: 2026-08-16 · Target: safe App Store submission.
+Updated: 2026-09-26 · Target: safe App Store submission.
 Companion to SECURITY.md (code security) — this file is the *review-gate*
 checklist: what must happen, who owns it, and the timeline.
 
@@ -15,8 +15,104 @@ The two 2026-08-11 blockers are RESOLVED by P0 (live chain):
   Alerts** (ProximityMonitor escalates WhenInUse → Always on alert opt-in).
   Onboarding requests WhenInUse only.
 
+## StoreKit sandbox: verified working configuration and caveats
+
+### Verified configuration
+
+The FuelBoard consumable tip products are:
+
+- `com.apt.fuelboard.tip099`
+- `com.apt.fuelboard.tip299`
+- `com.apt.fuelboard.tip499`
+
+The app requests these exact **Product IDs** with StoreKit 2
+`Product.products(for:)`; the UI names are display labels and are not used for
+lookup. The app bundle ID, App Store Connect app, explicit App ID, development
+team, and Sandbox Apple Account must belong to the same developer account.
+
+Two test environments must remain distinct:
+
+- **Local StoreKit testing:** select `/Users/apt/workspace/fuelboard/FuelBoardTips.storekit`
+  in Xcode, under Product > Scheme > Edit Scheme > Run > Options. This bypasses
+  App Store Connect and confirms the app's StoreKit loading and purchase code.
+- **Apple sandbox testing:** select **None** for StoreKit Configuration, then
+  use Product > Run on a physical device with the development-signed build and
+  a Sandbox Apple Account signed in under Settings > Developer. This exercises
+  the real App Store Connect catalog.
+
+The local configuration returning all three products does not prove that the
+Apple sandbox catalog is ready. Conversely, a successful local run showing `$`
+does not mean the App Store Connect price is USD: `Product.displayPrice` is
+formatted for the active StoreKit/device storefront. Local StoreKit prices are
+placeholders and do not upload to App Store Connect.
+
+### Availability versus pricing
+
+App Store Connect has separate controls:
+
+- **Availability** controls the storefronts where the IAP is offered. The
+  verified FuelBoard configuration uses **United Kingdom only**.
+- **Price schedule** may show generated prices for **175 countries and
+  regions**. This is expected and does not make the IAP available in all 175
+  storefronts; it is Apple's price conversion schedule.
+
+The Sandbox Apple Account's App Store Country or Region must match an enabled
+IAP storefront. After changing the sandbox tester's storefront, sign out and
+back in under Settings > Developer so the storefront change activates.
+
+### Important propagation/cache caveat
+
+During sandbox diagnosis, `Product.products(for:)` completed successfully but
+returned zero products with the IAP availability set to UK. Temporarily
+changing one product's availability to all regions caused it to appear in the
+sandbox catalog; changing it back to UK left it working. This indicates an
+Apple-side catalog refresh or propagation/cache issue, not a change required in
+the StoreKit code. Apple documents that product metadata changes can take up to
+approximately one hour to appear in sandbox.
+
+If an otherwise valid product returns zero products:
+
+1. Confirm the Sandbox Apple Account belongs to the same developer team.
+2. Confirm its storefront is an enabled availability region.
+3. Sign out and back in to the sandbox account on the device.
+4. Delete/reinstall the development build and retry with StoreKit Configuration
+   set to **None**.
+5. If necessary, temporarily broaden one product's availability to all
+   regions, allow propagation, verify the product, then restore the intended
+   availability and allow propagation again.
+
+Record whether the diagnostic result is **request failed**, **completed with
+zero products**, or **a partial product set**. These are different failure
+classes. Do not add fallback prices or change product lookup to display names.
+
+Sandbox testing does not require prior App Review approval of the IAP. It does
+require active developer membership, an active Paid Applications Agreement,
+complete banking and tax information, valid product metadata and pricing, the
+correct app/team association, and a matching Sandbox Apple Account.
+
 ## Hard blockers (must happen before ANY submission)
 
+0. **[USER] Paid Applications Agreement in effect** — REQUIRED for paid IAP
+   configuration and sandbox testing. App Store Connect →
+   Business > Paid Applications Agreement → View and Agree. **This is the most
+   common cause of a 2.1(b) "unable to purchase item / error message" rejection
+   — without it every sandbox purchase fails.** (REJECTED once for this:
+   review date 2026-09-25, version 1.0 (21), iPad Air 11″ iPadOS 27.)
+   **Status 2026-09-25: agreement clicked Agree but shows "Pending user info" —
+   this is NOT in effect yet.** Complete the Banking (account + sort code/IBAN)
+   and Tax (W-8/W-9/UK tax ref, e.g. sole-trader UTR) sections under Business >
+   Payments & Tax until the agreement shows "Active" and every tab is green.
+   Only then do sandbox IAPs start working.
+0. **[USER] Tip IAPs configured and available to the sandbox** — the three
+   consumables may exist but must ALSO have complete metadata, a current price,
+   and an enabled storefront availability. Prior App Review approval or
+   `Cleared for Sale` status is **not required for sandbox product discovery**.
+   They must be backed by the **In-App Purchase capability on the App ID**
+   `com.apt.fuelboard` (developer portal → Identifiers → App ID capability).
+   3-tier tip code is already correct (retry lookup `7cb23e0`); do NOT churn
+   SettingsView.swift. Test product discovery and purchase with a Sandbox
+   Apple Account first: Settings → Support FuelBoard.
+
 1. **[USER] Apple Developer Program membership** — the app has never been
    signed (all builds are `CODE_SIGNING_ALLOWED=NO` + ad-hoc re-sign for
    SideStore). Requires a paid membership ($99/yr, up to 48 h to approve) and
@@ -31,7 +127,9 @@ The two 2026-08-11 blockers are RESOLVED by P0 (live chain):
    provisioning profile (or Xcode automatic signing once the account is in
    Xcode); then `xcodebuild archive` (no more `CODE_SIGNING_ALLOWED=NO`).
 5. **[USER] Privacy policy URL** in App Store Connect — mandatory; the app
-   collects location. A one-page GitHub Pages privacy policy is fine.
+   collects location. Policy text is now in `PRIVACY.md`; publish it via the
+   FuelBoard marketing site or GitHub Pages and paste that public URL into App
+   Store Connect.
 
 ## Required tasks — owner [ME] (technical, do after account exists)
 

Config/App-Info.plist

@@ -17,7 +17,7 @@
 	<key>CFBundlePackageType</key>
 	<string>$(PRODUCT_BUNDLE_PACKAGE_TYPE)</string>
 	<key>CFBundleShortVersionString</key>
-	<string>1.0.1</string>
+	<string>$(MARKETING_VERSION)</string>
 	<key>CFBundleURLTypes</key>
 	<array>
 		<dict>

FuelBoard.xcodeproj/project.pbxproj

@@ -37,17 +37,6 @@
 /* End PBXContainerItemProxy section */
 
 /* Begin PBXCopyFilesBuildPhase section */
-		ADCE5B653033A32D008C131C /* Embed App Extensions */ = {
-			isa = PBXCopyFilesBuildPhase;
-			buildActionMask = 2147483647;
-			dstPath = "";
-			dstSubfolderSpec = 13;
-			files = (
-				ADCE5B623033A32D008C131C /* FuelBoardWatch Watch App Extension.appex in Embed App Extensions */,
-			);
-			name = "Embed App Extensions";
-			runOnlyForDeploymentPostprocessing = 0;
-		};
 		ADCE5B5B3033A32C008C131C /* Embed Watch Content */ = {
 			isa = PBXCopyFilesBuildPhase;
 			buildActionMask = 2147483647;
@@ -59,6 +48,17 @@
 			name = "Embed Watch Content";
 			runOnlyForDeploymentPostprocessing = 0;
 		};
+		ADCE5B653033A32D008C131C /* Embed App Extensions */ = {
+			isa = PBXCopyFilesBuildPhase;
+			buildActionMask = 2147483647;
+			dstPath = "";
+			dstSubfolderSpec = 13;
+			files = (
+				ADCE5B623033A32D008C131C /* FuelBoardWatch Watch App Extension.appex in Embed App Extensions */,
+			);
+			name = "Embed App Extensions";
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 		BB0000000000000000000006 /* Embed App Extensions */ = {
 			isa = PBXCopyFilesBuildPhase;
 			buildActionMask = 2147483647;
@@ -165,9 +165,9 @@
 /* End PBXGroup section */
 
 /* Begin PBXNativeTarget section */
-		ADCE5B4E3033A329008C131C /* FuelBoardWatch Watch App */ = {
+		ADCE5B4E3033A329008C131C /* FuelBoardWatch Watch App Extension */ = {
 			isa = PBXNativeTarget;
-			buildConfigurationList = ADCE5B593033A32B008C131C /* Build configuration list for PBXNativeTarget "FuelBoardWatch Watch App" */;
+			buildConfigurationList = ADCE5B593033A32B008C131C /* Build configuration list for PBXNativeTarget "FuelBoardWatch Watch App Extension" */;
 			buildPhases = (
 				ADCE5B4B3033A329008C131C /* Sources */,
 				ADCE5B4C3033A329008C131C /* Frameworks */,
@@ -405,8 +405,9 @@
 				CLANG_WARN_SUSPICIOUS_MOVE = YES;
 				CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
 				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
+				CODE_SIGN_ENTITLEMENTS = Config/WatchApp.entitlements;
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 3;
+				CURRENT_PROJECT_VERSION = 20;
 				DEVELOPMENT_TEAM = F3BE6NE7U3;
 				ENABLE_PREVIEWS = YES;
 				ENABLE_USER_SCRIPT_SANDBOXING = YES;
@@ -418,14 +419,13 @@
 				GCC_WARN_UNUSED_FUNCTION = YES;
 				GCC_WARN_UNUSED_VARIABLE = YES;
 				GENERATE_INFOPLIST_FILE = NO;
-				CODE_SIGN_ENTITLEMENTS = Config/WatchApp.entitlements;
-				INFOPLIST_FILE = Config/WatchExtension-Info.plist;
+				INFOPLIST_FILE = "Config/WatchExtension-Info.plist";
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
 				LOCALIZATION_PREFERS_STRING_CATALOGS = YES;
-				MARKETING_VERSION = 1.0.1;
+				MARKETING_VERSION = 1.0.0;
 				MTL_FAST_MATH = YES;
 				PRODUCT_BUNDLE_IDENTIFIER = com.apt.fuelboard.watchapp.watchkitextension;
 				PRODUCT_NAME = "$(TARGET_NAME)";
@@ -471,8 +471,9 @@
 				CLANG_WARN_SUSPICIOUS_MOVE = YES;
 				CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
 				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
+				CODE_SIGN_ENTITLEMENTS = Config/WatchApp.entitlements;
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 3;
+				CURRENT_PROJECT_VERSION = 20;
 				DEVELOPMENT_TEAM = F3BE6NE7U3;
 				ENABLE_PREVIEWS = YES;
 				ENABLE_USER_SCRIPT_SANDBOXING = YES;
@@ -484,14 +485,13 @@
 				GCC_WARN_UNUSED_FUNCTION = YES;
 				GCC_WARN_UNUSED_VARIABLE = YES;
 				GENERATE_INFOPLIST_FILE = NO;
-				CODE_SIGN_ENTITLEMENTS = Config/WatchApp.entitlements;
-				INFOPLIST_FILE = Config/WatchExtension-Info.plist;
+				INFOPLIST_FILE = "Config/WatchExtension-Info.plist";
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
 				LOCALIZATION_PREFERS_STRING_CATALOGS = YES;
-				MARKETING_VERSION = 1.0.1;
+				MARKETING_VERSION = 1.0.0;
 				MTL_FAST_MATH = YES;
 				PRODUCT_BUNDLE_IDENTIFIER = com.apt.fuelboard.watchapp.watchkitextension;
 				PRODUCT_NAME = "$(TARGET_NAME)";
@@ -537,7 +537,7 @@
 				CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
 				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 3;
+				CURRENT_PROJECT_VERSION = 20;
 				DEVELOPMENT_TEAM = F3BE6NE7U3;
 				ENABLE_PREVIEWS = YES;
 				ENABLE_USER_SCRIPT_SANDBOXING = YES;
@@ -549,13 +549,13 @@
 				GCC_WARN_UNUSED_FUNCTION = YES;
 				GCC_WARN_UNUSED_VARIABLE = YES;
 				GENERATE_INFOPLIST_FILE = NO;
-				INFOPLIST_FILE = Config/WatchWrapper-Info.plist;
+				INFOPLIST_FILE = "Config/WatchWrapper-Info.plist";
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
 				LOCALIZATION_PREFERS_STRING_CATALOGS = YES;
-				MARKETING_VERSION = 1.0.1;
+				MARKETING_VERSION = 1.0.0;
 				MTL_FAST_MATH = YES;
 				PRODUCT_BUNDLE_IDENTIFIER = com.apt.fuelboard.watchapp;
 				PRODUCT_NAME = "$(TARGET_NAME)";
@@ -602,7 +602,7 @@
 				CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
 				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 3;
+				CURRENT_PROJECT_VERSION = 20;
 				DEVELOPMENT_TEAM = F3BE6NE7U3;
 				ENABLE_PREVIEWS = YES;
 				ENABLE_USER_SCRIPT_SANDBOXING = YES;
@@ -614,13 +614,13 @@
 				GCC_WARN_UNUSED_FUNCTION = YES;
 				GCC_WARN_UNUSED_VARIABLE = YES;
 				GENERATE_INFOPLIST_FILE = NO;
-				INFOPLIST_FILE = Config/WatchWrapper-Info.plist;
+				INFOPLIST_FILE = "Config/WatchWrapper-Info.plist";
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
 				LOCALIZATION_PREFERS_STRING_CATALOGS = YES;
-				MARKETING_VERSION = 1.0.1;
+				MARKETING_VERSION = 1.0.0;
 				MTL_FAST_MATH = YES;
 				PRODUCT_BUNDLE_IDENTIFIER = com.apt.fuelboard.watchapp;
 				PRODUCT_NAME = "$(TARGET_NAME)";
@@ -699,7 +699,7 @@
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				CODE_SIGN_ENTITLEMENTS = Config/App.entitlements;
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 3;
+				CURRENT_PROJECT_VERSION = 20;
 				DEVELOPMENT_TEAM = F3BE6NE7U3;
 				GENERATE_INFOPLIST_FILE = NO;
 				INFOPLIST_FILE = "Config/App-Info.plist";
@@ -707,7 +707,7 @@
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
-				MARKETING_VERSION = 1.0.1;
+				MARKETING_VERSION = 1.0.0;
 				PRODUCT_BUNDLE_IDENTIFIER = com.apt.fuelboard;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SWIFT_EMIT_LOC_STRINGS = YES;
@@ -722,7 +722,7 @@
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				CODE_SIGN_ENTITLEMENTS = Config/App.entitlements;
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 3;
+				CURRENT_PROJECT_VERSION = 20;
 				DEVELOPMENT_TEAM = F3BE6NE7U3;
 				GENERATE_INFOPLIST_FILE = NO;
 				INFOPLIST_FILE = "Config/App-Info.plist";
@@ -730,7 +730,7 @@
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
-				MARKETING_VERSION = 1.0.1;
+				MARKETING_VERSION = 1.0.0;
 				PRODUCT_BUNDLE_IDENTIFIER = com.apt.fuelboard;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SWIFT_EMIT_LOC_STRINGS = YES;
@@ -745,7 +745,7 @@
 				APPLICATION_EXTENSION_API_ONLY = YES;
 				CODE_SIGN_ENTITLEMENTS = Config/Widget.entitlements;
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 3;
+				CURRENT_PROJECT_VERSION = 20;
 				DEVELOPMENT_TEAM = F3BE6NE7U3;
 				GENERATE_INFOPLIST_FILE = NO;
 				INFOPLIST_FILE = "Config/Widget-Info.plist";
@@ -754,7 +754,7 @@
 					"@executable_path/Frameworks",
 					"@executable_path/../../Frameworks",
 				);
-				MARKETING_VERSION = 1.0.1;
+				MARKETING_VERSION = 1.0.0;
 				PRODUCT_BUNDLE_IDENTIFIER = com.apt.fuelboard.widgets;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SKIP_INSTALL = YES;
@@ -770,7 +770,7 @@
 				APPLICATION_EXTENSION_API_ONLY = YES;
 				CODE_SIGN_ENTITLEMENTS = Config/Widget.entitlements;
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 3;
+				CURRENT_PROJECT_VERSION = 20;
 				DEVELOPMENT_TEAM = F3BE6NE7U3;
 				GENERATE_INFOPLIST_FILE = NO;
 				INFOPLIST_FILE = "Config/Widget-Info.plist";
@@ -779,7 +779,7 @@
 					"@executable_path/Frameworks",
 					"@executable_path/../../Frameworks",
 				);
-				MARKETING_VERSION = 1.0.1;
+				MARKETING_VERSION = 1.0.0;
 				PRODUCT_BUNDLE_IDENTIFIER = com.apt.fuelboard.widgets;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SKIP_INSTALL = YES;
@@ -792,7 +792,7 @@
 /* End XCBuildConfiguration section */
 
 /* Begin XCConfigurationList section */
-		ADCE5B593033A32B008C131C /* Build configuration list for PBXNativeTarget "FuelBoardWatch Watch App" */ = {
+		ADCE5B593033A32B008C131C /* Build configuration list for PBXNativeTarget "FuelBoardWatch Watch App Extension" */ = {
 			isa = XCConfigurationList;
 			buildConfigurations = (
 				ADCE5B573033A32B008C131C /* Debug */,

FuelBoard.xcodeproj/xcshareddata/xcschemes/FuelBoard.xcscheme

@@ -0,0 +1,85 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "2600"
+   version = "1.8">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "BB000000000000000000000F"
+               BuildableName = "FuelBoard.app"
+               BlueprintName = "FuelBoard"
+               ReferencedContainer = "container:FuelBoard.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES">
+      <Testables>
+      </Testables>
+      <StoreKitConfigurationFileReference
+         identifier = "../../../FuelBoardTips.storekit">
+      </StoreKitConfigurationFileReference>
+   </TestAction>
+   <LaunchAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      language = "en"
+      region = "GB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersion = "1.0"
+      debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
+      allowLocationSimulation = "YES">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "BB000000000000000000000F"
+            BuildableName = "FuelBoard.app"
+            BlueprintName = "FuelBoard"
+            ReferencedContainer = "container:FuelBoard.xcodeproj">
+         </BuildableReference>
+      </BuildableProductRunnable>
+   </LaunchAction>
+   <ProfileAction
+      buildConfiguration = "Release"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      debugDocumentVersion = "1.0"
+      debugDocumentVersioning = "YES">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "BB000000000000000000000F"
+            BuildableName = "FuelBoard.app"
+            BlueprintName = "FuelBoard"
+            ReferencedContainer = "container:FuelBoard.xcodeproj">
+         </BuildableReference>
+      </BuildableProductRunnable>
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

FuelBoard/SettingsView.swift

@@ -249,6 +249,55 @@ struct SettingsView: View {
                     }
                     .onAppear { refreshWidgetDiag() }
 
+                    Section {
+                        Button {
+                            Task { await tipStore.load() }
+                        } label: {
+                            Label("Probe App Store products", systemImage: "arrow.clockwise")
+                        }
+                        LabeledContent("Probe", value: tipStore.productLoadStatus)
+                        if let loadedAt = tipStore.lastProductLoadDate {
+                            LabeledContent("Last probe", value: loadedAt.formatted(date: .abbreviated, time: .standard))
+                        }
+                        LabeledContent("Requested", value: "\(TipStore.tiers.count) IDs")
+                        LabeledContent("Returned", value: "\(tipStore.debugProducts.count) products")
+                        if !tipStore.debugProducts.isEmpty {
+                            ForEach(tipStore.debugProducts) { product in
+                                VStack(alignment: .leading, spacing: 3) {
+                                    Text(product.id)
+                                        .font(.caption.monospaced())
+                                        .textSelection(.enabled)
+                                    Text(product.displayName)
+                                        .font(.footnote.weight(.medium))
+                                    Text("\(product.type) · \(product.displayPrice) · raw \(product.price)")
+                                        .font(.caption2)
+                                        .foregroundStyle(.secondary)
+                                        .textSelection(.enabled)
+                                }
+                            }
+                        } else {
+                            Text("No products were returned by StoreKit.")
+                                .font(.caption)
+                                .foregroundStyle(.secondary)
+                        }
+                        if !tipStore.missingProductIDs.isEmpty {
+                            Text("Missing IDs: \(tipStore.missingProductIDs.joined(separator: ", "))")
+                                .font(.caption2)
+                                .foregroundStyle(.orange)
+                                .textSelection(.enabled)
+                        }
+                        if let error = tipStore.lastProductLoadError {
+                            Text("Error: \(error)")
+                                .font(.caption2)
+                                .foregroundStyle(.red)
+                                .textSelection(.enabled)
+                        }
+                    } header: {
+                        Text("IAP Diagnostics")
+                    } footer: {
+                        Text("Shows the exact product identifiers requested and the StoreKit products returned. Product names and prices are read from StoreKit; missing IDs were not returned by the current App Store environment.")
+                    }
+
                     Section {
                         HStack {
                             Text("Connection")
@@ -631,19 +680,18 @@ final class TipStore: ObservableObject {
         let id: String          // product ID
         let name: String
         let blurb: String
-        let fallbackPrice: String
         let accent: Color       // card/price accent (matches the fuel palette)
     }
 
     static let tiers: [TipTier] = [
         TipTier(id: "com.apt.fuelboard.tip099", name: "Splash & Dash",
-                blurb: "Just enough to keep things moving.", fallbackPrice: "£0.99",
+                blurb: "Just enough to keep things moving.",
                 accent: Color(red: 0.39, green: 0.82, blue: 1.0)),    // #64D2FF
         TipTier(id: "com.apt.fuelboard.tip299", name: "Half a Tank",
-                blurb: "A generous top-up for development.", fallbackPrice: "£2.99",
+                blurb: "A generous top-up for development.",
                 accent: Color(red: 0.19, green: 0.82, blue: 0.35)),   // #30D158
         TipTier(id: "com.apt.fuelboard.tip499", name: "Fill 'Er Up",
-                blurb: "Keeping the app on the road.", fallbackPrice: "£4.99",
+                blurb: "Keeping the app on the road.",
                 accent: Color(red: 1.0, green: 0.84, blue: 0.04)),    // #FFD60A
     ]
 
@@ -657,6 +705,22 @@ final class TipStore: ObservableObject {
     @Published private(set) var products: [String: Product] = [:]
     @Published private(set) var purchaseInProgress = false
     @Published private(set) var outcome: TipOutcome?
+    @Published private(set) var productLoadStatus = "Not probed"
+    @Published private(set) var lastProductLoadDate: Date?
+    @Published private(set) var lastProductLoadError: String?
+    @Published private(set) var debugProducts: [DebugProduct] = []
+
+    struct DebugProduct: Identifiable {
+        let id: String
+        let displayName: String
+        let type: String
+        let displayPrice: String
+        let price: String
+    }
+
+    var missingProductIDs: [String] {
+        Self.tiers.map(\.id).filter { products[$0] == nil }
+    }
 
     /// Auto-dismiss timer for the outcome banner (replaced on each new outcome).
     private var dismissTask: Task<Void, Never>?
@@ -667,9 +731,31 @@ final class TipStore: ObservableObject {
     /// the queue but are never finished or acknowledged.
     private var updatesTask: Task<Void, Never>?
 
+    /// Drains verified FuelBoard transactions that were already unfinished
+    /// before this store was created (for example after termination during a
+    /// sandbox purchase). `Transaction.updates` only covers updates delivered
+    /// while the listener is active, so both sequences are required.
+    private var unfinishedTask: Task<Void, Never>?
+
+    /// Uses the existing hidden developer switch in Settings. StoreKit
+    /// diagnostics must stay silent unless the developer explicitly enables
+    /// Debug mode with the five-tap Version gesture.
+    private static func debugLog(_ message: @autoclosure () -> String) {
+        guard FuelStore.loadDebugMode() else { return }
+        print(message())
+    }
+
     init() {
+        Self.debugLog("[FuelBoard StoreKit] TipStore initialized; expected IDs=\(Self.tiers.map(\.id).joined(separator: ","))")
         updatesTask = Task { [weak self] in
             for await update in Transaction.updates {
+                Self.debugLog("[FuelBoard StoreKit] Transaction.updates received")
+                await self?.handle(update)
+            }
+        }
+        unfinishedTask = Task { [weak self] in
+            for await update in Transaction.unfinished {
+                Self.debugLog("[FuelBoard StoreKit] Transaction.unfinished received")
                 await self?.handle(update)
             }
         }
@@ -677,14 +763,27 @@ final class TipStore: ObservableObject {
 
     deinit {
         updatesTask?.cancel()
+        unfinishedTask?.cancel()
         dismissTask?.cancel()
     }
 
     private func handle(_ update: VerificationResult<StoreKit.Transaction>) async {
+        Self.debugLog("[FuelBoard StoreKit] Handling transaction update")
         // Never deliver or finish an untrusted purchase.
-        guard case .verified(let transaction) = update else { return }
+        guard case .verified(let transaction) = update else {
+            if case .unverified(_, let error) = update {
+                Self.debugLog("[FuelBoard StoreKit] Ignoring unverified transaction error=\(error.localizedDescription)")
+            } else {
+                Self.debugLog("[FuelBoard StoreKit] Ignoring unverified transaction update")
+            }
+            return
+        }
         // Only acknowledge our own consumables (future products get their own).
-        guard Self.tiers.contains(where: { $0.id == transaction.productID }) else { return }
+        guard Self.tiers.contains(where: { $0.id == transaction.productID }) else {
+            Self.debugLog("[FuelBoard StoreKit] Ignoring unrelated product ID=\(transaction.productID)")
+            return
+        }
+        Self.debugLog("[FuelBoard StoreKit] Finishing verified transaction productID=\(transaction.productID)")
         await transaction.finish()
         showOutcome(
             NSLocalizedString("Thank you! Your tip has been received. ⛽", comment: ""),
@@ -713,45 +812,101 @@ final class TipStore: ObservableObject {
     }
 
     func displayPrice(for tier: TipTier) -> String {
-        products[tier.id]?.displayPrice ?? tier.fallbackPrice
+        products[tier.id]?.displayPrice
+            ?? NSLocalizedString("Unavailable", comment: "Tip product has not been returned by StoreKit")
     }
 
     func load() async {
         // Refreshes product state on every visit so newly-approved products
         // (or restored transactions) are picked up.
+        let ids = Self.tiers.map(\.id)
+        productLoadStatus = "Loading…"
+        lastProductLoadError = nil
+        Self.debugLog("[FuelBoard StoreKit] Loading products IDs=\(ids.joined(separator: ","))")
         do {
-            let fetched = try await Product.products(for: Self.tiers.map(\.id))
+            let fetched = try await Product.products(for: ids)
+            lastProductLoadDate = Date()
+            Self.debugLog("[FuelBoard StoreKit] Product.products returned count=\(fetched.count) IDs=\(fetched.map(\.id).joined(separator: ","))")
+            for product in fetched {
+                Self.debugLog("[FuelBoard StoreKit] Product id=\(product.id) type=\(String(describing: product.type)) displayPrice=\(product.displayPrice) price=\(product.price)")
+            }
             products = Dictionary(uniqueKeysWithValues: fetched.map { ($0.id, $0) })
+            debugProducts = fetched.map {
+                DebugProduct(
+                    id: $0.id,
+                    displayName: $0.displayName,
+                    type: String(describing: $0.type),
+                    displayPrice: $0.displayPrice,
+                    price: String(describing: $0.price)
+                )
+            }
+            productLoadStatus = fetched.isEmpty ? "Completed — zero returned" : "Completed"
+            let matched = Self.tiers.filter { products[$0.id] != nil }.map(\.id)
+            Self.debugLog("[FuelBoard StoreKit] Matched products after load=\(matched.joined(separator: ","))")
         } catch {
-            // No products yet (sideloaded build) — the buttons still show the
-            // intended prices and report purchase attempts gracefully.
+            lastProductLoadDate = Date()
+            productLoadStatus = "Failed"
+            lastProductLoadError = "\(String(describing: type(of: error))): \(error.localizedDescription)"
+            debugProducts = []
+            Self.debugLog("[FuelBoard StoreKit] Product load failed type=\(String(describing: type(of: error))) error=\(error.localizedDescription)")
+            // Keep the cards visible so the user can retry while App Store
+            // Connect metadata propagates; displayPrice() shows "Unavailable"
+            // until StoreKit returns a real product.
             products = [:]
         }
     }
 
+    private func merge(_ fetched: [Product]) {
+        products.merge(Dictionary(uniqueKeysWithValues: fetched.map { ($0.id, $0) })) { _, new in new }
+    }
+
+    private func product(for tier: TipTier) async throws -> Product? {
+        if let product = products[tier.id] {
+            Self.debugLog("[FuelBoard StoreKit] Using cached product ID=\(tier.id)")
+            return product
+        }
+
+        // TestFlight/App Store Connect product availability can lag the Settings
+        // onAppear load. Re-query the tapped tier before falling back so a newly
+        // approved IAP opens the system purchase sheet instead of showing stale
+        // "not available" copy.
+        Self.debugLog("[FuelBoard StoreKit] Re-querying tapped product ID=\(tier.id)")
+        let fetched = try await Product.products(for: [tier.id])
+        Self.debugLog("[FuelBoard StoreKit] Re-query returned count=\(fetched.count) IDs=\(fetched.map(\.id).joined(separator: ","))")
+        merge(fetched)
+        let match = fetched.first { $0.id == tier.id }
+        Self.debugLog("[FuelBoard StoreKit] Tapped product match=\(match != nil) ID=\(tier.id)")
+        return match
+    }
+
     func purchase(_ tier: TipTier) async {
-        guard !purchaseInProgress else { return }
+        Self.debugLog("[FuelBoard StoreKit] Purchase requested ID=\(tier.id) name=\(tier.name)")
+        guard !purchaseInProgress else {
+            Self.debugLog("[FuelBoard StoreKit] Purchase ignored because another purchase is in progress")
+            return
+        }
         purchaseInProgress = true
         defer { purchaseInProgress = false }
 
-        // If the product hasn't loaded (e.g. not configured in App Store
-        // Connect yet), still allow the attempt so the user sees a clear
-        // outcome rather than a dead button.
-        guard let product = products[tier.id] else {
-            showOutcome(
-                NSLocalizedString("The tip isn't available in this build yet — check back after an App Store release.", comment: ""),
-                icon: "info.circle.fill",
-                tint: Color(.secondaryLabel)
-            )
-            return
-        }
-
         do {
+            guard let product = try await product(for: tier) else {
+                Self.debugLog("[FuelBoard StoreKit] Purchase stopped: no StoreKit product for ID=\(tier.id)")
+                showOutcome(
+                    NSLocalizedString("This tip isn't available from the App Store yet. Please try again shortly.", comment: ""),
+                    icon: "info.circle.fill",
+                    tint: Color(.secondaryLabel)
+                )
+                return
+            }
+
+            Self.debugLog("[FuelBoard StoreKit] Calling product.purchase() ID=\(product.id) displayPrice=\(product.displayPrice)")
             let result = try await product.purchase()
             switch result {
             case .success(let verification):
+                Self.debugLog("[FuelBoard StoreKit] Purchase result=success")
                 switch verification {
                 case .verified(let transaction):
+                    Self.debugLog("[FuelBoard StoreKit] Purchase verified productID=\(transaction.productID); finishing")
                     // Consume the consumable — otherwise StoreKit re-delivers
                     // it through Transaction.updates on every launch.
                     await transaction.finish()
@@ -761,6 +916,7 @@ final class TipStore: ObservableObject {
                         tint: Color(red: 0.19, green: 0.82, blue: 0.35)      // #30D158
                     )
                 case .unverified:
+                    Self.debugLog("[FuelBoard StoreKit] Purchase result=unverified")
                     showOutcome(
                         NSLocalizedString("The purchase couldn't be verified. Please try again.", comment: ""),
                         icon: "exclamationmark.triangle.fill",
@@ -768,17 +924,21 @@ final class TipStore: ObservableObject {
                     )
                 }
             case .userCancelled:
+                Self.debugLog("[FuelBoard StoreKit] Purchase result=userCancelled")
                 dismissOutcome()   // silent — the user just closed the sheet
             case .pending:
+                Self.debugLog("[FuelBoard StoreKit] Purchase result=pending")
                 showOutcome(
                     NSLocalizedString("Your tip is pending approval. It'll finish automatically.", comment: ""),
                     icon: "hourglass",
                     tint: Color(red: 0.39, green: 0.82, blue: 1.0)           // #64D2FF
                 )
             @unknown default:
+                Self.debugLog("[FuelBoard StoreKit] Purchase result=unknown")
                 dismissOutcome()
             }
         } catch {
+            Self.debugLog("[FuelBoard StoreKit] Purchase threw type=\(String(describing: type(of: error))) error=\(error.localizedDescription)")
             showOutcome(
                 String(format: NSLocalizedString("The tip couldn't be completed: %@", comment: ""), error.localizedDescription),
                 icon: "xmark.circle.fill",

FuelBoardTips.storekit

@@ -0,0 +1,63 @@
+{
+  "identifier" : "fuelboard-local-tips",
+  "nonRenewingSubscriptions" : [
+
+  ],
+  "products" : [
+    {
+      "displayPrice" : "0.99",
+      "familyShareable" : false,
+      "internalID" : "fuelboard-tip099",
+      "localizations" : [
+        {
+          "description" : "Just enough to keep things moving.",
+          "displayName" : "Splash & Dash",
+          "locale" : "en_GB"
+        }
+      ],
+      "productID" : "com.apt.fuelboard.tip099",
+      "referenceName" : "FuelBoard Tip 099 - Splash & Dash",
+      "type" : "Consumable"
+    },
+    {
+      "displayPrice" : "2.99",
+      "familyShareable" : false,
+      "internalID" : "fuelboard-tip299",
+      "localizations" : [
+        {
+          "description" : "A generous top-up for development.",
+          "displayName" : "Half a Tank",
+          "locale" : "en_GB"
+        }
+      ],
+      "productID" : "com.apt.fuelboard.tip299",
+      "referenceName" : "FuelBoard Tip 299 - Half a Tank",
+      "type" : "Consumable"
+    },
+    {
+      "displayPrice" : "4.99",
+      "familyShareable" : false,
+      "internalID" : "fuelboard-tip499",
+      "localizations" : [
+        {
+          "description" : "Keeping the app on the road.",
+          "displayName" : "Fill 'Er Up",
+          "locale" : "en_GB"
+        }
+      ],
+      "productID" : "com.apt.fuelboard.tip499",
+      "referenceName" : "FuelBoard Tip 499 - Fill 'Er Up",
+      "type" : "Consumable"
+    }
+  ],
+  "settings" : {
+
+  },
+  "subscriptionGroups" : [
+
+  ],
+  "version" : {
+    "major" : 2,
+    "minor" : 0
+  }
+}

PRIVACY.md

@@ -0,0 +1,98 @@
+# FuelBoard Privacy Policy
+
+Effective date: 2026-09-19
+
+FuelBoard helps users in the UK find nearby petrol, diesel, and premium fuel prices, save favourite stations, view widgets and Live Activities, and optionally receive location-based alerts.
+
+## Summary
+
+- FuelBoard does not track you across apps or websites.
+- FuelBoard does not sell personal data.
+- FuelBoard does not use advertising SDKs or analytics SDKs.
+- FuelBoard uses location only to show nearby stations, calculate distances, power widgets, and provide optional fuel-price alerts.
+- Most app preferences and cached data stay on your device.
+- Fuel price data comes from public UK fuel-price datasets mirrored through GitHub raw content and a bundled offline snapshot.
+
+## Data FuelBoard uses
+
+### Location
+
+FuelBoard may use your device location to:
+
+- sort stations by distance;
+- show stations within your chosen search radius;
+- provide directions to a selected station;
+- update home-screen widgets with nearby fuel prices;
+- run optional geofenced alerts when you enable the Alerts feature.
+
+On first launch, FuelBoard asks for When In Use location access. If you enable optional Alerts, iOS may ask you to allow Always location access so alerts can work while the app is not open.
+
+FuelBoard stores your last known location on your device so it can refresh nearby results and widgets. FuelBoard does not sell or share your location for advertising.
+
+### Notifications
+
+FuelBoard may request notification permission so it can send optional fuel-price alerts. Notifications are used only for FuelBoard features such as station alerts and test alerts.
+
+### App preferences and favourites
+
+FuelBoard stores settings such as favourite stations, fuel type, distance unit, price display style, alert settings, widget configuration, and cached public fuel-price data on your device using Apple storage APIs such as UserDefaults and Keychain.
+
+### Diagnostics
+
+FuelBoard may send limited diagnostic beacons when developer relay fallback is enabled from the hidden Debug section. These requests are used to diagnose data-source and widget-refresh behaviour during testing. They are not used for advertising or tracking.
+
+The consumer data path uses public HTTPS GitHub raw content and a bundled offline snapshot. Normal consumer use does not require a private local relay.
+
+### Purchases
+
+FuelBoard may offer optional consumable tip purchases. Payments are handled by Apple through StoreKit. FuelBoard does not receive or store your payment card details.
+
+## Data FuelBoard does not collect
+
+FuelBoard does not collect or access:
+
+- contacts;
+- photos or videos;
+- camera or microphone content;
+- browsing history;
+- advertising identifiers for tracking;
+- payment card details.
+
+FuelBoard does not use App Tracking Transparency because it does not track users across apps or websites.
+
+## Third-party services
+
+FuelBoard may contact these services as part of normal app functionality:
+
+- GitHub raw content, to download the public FuelBoard fuel-price mirror;
+- Apple Maps, when you choose to open directions;
+- Apple StoreKit, when optional tip purchases are available;
+- Apple notification, widget, Live Activity, location, and keychain services provided by iOS.
+
+Fuel price data is based on the UK Fuel Finder dataset made available under the Open Government Licence.
+
+## Data retention
+
+FuelBoard keeps local settings, favourites, cached station data, and cached price-history data on your device until you delete them, change the relevant settings, or delete the app. iOS may also remove cached app data according to system behaviour.
+
+## Your choices
+
+You can control FuelBoard's access at any time in iOS Settings:
+
+- Location: Settings > Privacy & Security > Location Services > FuelBoard
+- Notifications: Settings > Notifications > FuelBoard
+- Widgets and Live Activities: managed through iOS widget and Live Activity controls
+
+You can also delete FuelBoard to remove app data stored on the device, subject to normal iOS and iCloud/device-backup behaviour.
+
+## Children's privacy
+
+FuelBoard is not directed at children and does not knowingly collect personal information from children.
+
+## Changes to this policy
+
+This policy may be updated as FuelBoard changes. The effective date above will be updated when the policy changes.
+
+## Contact
+
+For privacy questions, use FuelBoard's listed App Store support contact or the public project issue tracker associated with the app.