Sandbox IAP: AuthKit succeeds, then AMSServerErrorDomain -5000 (cancel-purchase-batch)

Every sandbox purchase of our auto-renewable subscriptions cancels right after AuthKit sign-in succeeds. It's blocking our 1.0 release. Filed as FB25469063, no reply yet.

Capacitor iOS app, bundle io.xrplive.app, 1.0.0 (TestFlight), products io.xrplive.app.pro.monthly / .yearly, iPhone 17 Pro Max on iOS 27.0.1, StoreKit via @capgo/native-purchases.

Console on every attempt:

(1) AMSAuthKitUpdateTask: "The AuthKit authentication succeeded."

(2) Then: Error Domain=AMSServerErrorDomain Code=-5000 UserInfo={failureType=-5000, m-allowed=false, cancel-purchase-batch=true, customerMessage=Check the account information you entered and try again.}

Also AMSErrorDomain Code=100 (Authentication Failed), Code=2 ("Password reuse not available for account"), and a 401 from sandbox.itunes.apple.com/commerce/messages/app/inbox.

We already fixed a purchase(confirmIn:) presentation issue. This failure is in sandbox verification after a successful sign-in, which we can't fix from the client.

Is -5000 with cancel-purchase-batch a known sandbox account or commerce issue? Is there a sandbox tester or storefront state that fixes it when AuthKit succeeds but verification still fails?