The App Store rejected our Marketing app four times.
The first three were arguable. The fourth was not, and it taught us more than the other three combined.
We fixed it and never shipped it
By the fourth rejection we had genuinely addressed what review flagged. The code was written. The build was made. It sat on a machine.
What we had not done was submit it. Review kept looking at an older binary and rejecting it for the same reason, while on our side everyone believed the problem was solved because the work was solved.
This is the same failure we have now hit in three different costumes: a download serving an old build while fixes sat committed and unshipped; an app running from a bundle that had been deleted underneath it; and now a review queue evaluating a binary we had quietly stopped believing was the current one. Every time, the gap is between the artifact we made and the artifact someone received.
There is only one rule that closes that gap, and it is not "be more careful." It is: prove it at the receiving end. Check the review record, not the local build. Check the served file, not the source tree. Check what the running process is, not what the folder holds.
The build flag that removed our own payment path
The second cause was subtler. A conditional in the code was gated on the wrong axis — it keyed off the operating system when what actually mattered was the distribution channel. The result was that our store build silently dropped the store's own payment path.
We had written the flag as "is this platform X," when the real question was "is this the build that goes to the store." Those two questions had the same answer for months, right up until they didn't.
The ruling
Out of this came a standing rule about what our apps are: consumer apps stay consumer apps. Licence-key unlocking, enterprise entitlements, and anything that routes a purchase outside the store came out of the store builds entirely. In-app purchase is the only unlock path there.
Enterprise work still exists — it just lives on this side of the house, sold directly, where it belongs. Trying to serve both buyers from one binary is what got us rejected in the first place, and the honest fix was to stop pretending one app could be both.
Both platforms went back into review after that. It took four rejections to learn something we will now never have to learn again, which is roughly the going rate.