@@ -40,14 +40,15 @@ export const IDEMPOTENCY_KEY_TTL_MS = 24 * 60 * 60 * 1000;
  *
  * Must comfortably outlast the slowest legitimate handler: the escrow
  * mutations this interceptor guards go through
- * SorobanClientService.invoke → pollTransaction, which polls up to 10
- * times at 2000ms (~20s) *on top of* the getAccount/simulate/send RPC
- * round-trips. A 30s window was shorter than that worst case, letting a
- * client retry reclaim a row whose original request was still actively
- * running and re-execute a concurrent money-moving operation (#90). 90s
- * leaves ~4x headroom over the poll ceiling for RPC latency.
+ * SorobanClientService.invoke → pollTransaction, which polls for the
+ * transaction's full 60s time bound (31 × 2000ms, ~62s, #527) *on top of*
+ * the getAccount/simulate/send RPC round-trips. A 30s window was shorter
+ * than that worst case, letting a client retry reclaim a row whose original
+ * request was still actively running and re-execute a concurrent
+ * money-moving operation (#90). 180s leaves ~3x headroom over the poll
+ * ceiling for RPC latency.
  */
-export const STALE_PROCESSING_MS = 90 * 1000;
+export const STALE_PROCESSING_MS = 180 * 1000;
 
 /** Postgres SQLSTATE for unique_violation. */
 const PG_UNIQUE_VIOLATION = '23505';
 
@@ -3,7 +3,11 @@ import { getRepositoryToken } from '@nestjs/typeorm';
 import { BadRequestException } from '@nestjs/common';
 import { DataSource } from 'typeorm';
 import { EscrowService } from './escrow.service';
-import { SorobanClientService, u64 } from './soroban-client.service';
+import {
+  SorobanClientService,
+  SorobanPendingError,
+  u64,
+} from './soroban-client.service';
 import { Escrow, Payment, User } from '../common/entities';
 import { AssetType, EscrowStatus, PaymentStatus } from '../common/enums';
 import { TOTAL_BASIS_POINTS } from './split-math.util';
@@ -75,9 +79,7 @@ describe('EscrowService', () => {
         entity === Escrow ? escrowRepo.findOne(options) : Promise.resolve(null),
       ),
       find: jest.fn((entity: unknown, options: unknown) =>
-        entity === Payment
-          ? paymentRepo.find(options)
-          : Promise.resolve([]),
+        entity === Payment ? paymentRepo.find(options) : Promise.resolve([]),
       ),
       save: jest.fn((entity: unknown, data: unknown) =>
         entity === Payment ? paymentRepo.save(data) : escrowRepo.save(data),
@@ -221,6 +223,29 @@ describe('EscrowService', () => {
       );
     });
 
+    it('keeps the escrow PENDING with the tx hash when the poll times out (#527)', async () => {
+      soroban.invoke.mockRejectedValueOnce(new SorobanPendingError('tx-abc'));
+
+      await expect(
+        service.fund({
+          amount: '10',
+          asset: AssetType.XLM,
+          funderAddress: 'G...',
+          bountyId: 'bounty-1',
+        }),
+      ).rejects.toBeInstanceOf(SorobanPendingError);
+
+      const savedCalls = (
+        escrowRepo.save.mock.calls as [Partial<Escrow>][]
+      ).map((c) => c[0]);
+      const last = savedCalls[savedCalls.length - 1];
+      expect(last.status).toBe(EscrowStatus.PENDING);
+      expect(last.fundTxHash).toBe('tx-abc');
+      expect(savedCalls.every((e) => e.status !== EscrowStatus.FAILED)).toBe(
+        true,
+      );
+    });
+
     it('keeps the escrow LOCKED when the on-chain call succeeded but the local write failed (#302, #42)', async () => {
       // First save (the PENDING row) succeeds; the post-invoke save fails —
       // exactly the post-on-chain-success failure #42 describes.
@@ -241,12 +266,12 @@ describe('EscrowService', () => {
       const savedCalls = (
         escrowRepo.save.mock.calls as [Partial<Escrow>][]
       ).map((c) => c[0]);
-      expect(
-        savedCalls.some((e) => e.status === EscrowStatus.FAILED),
-      ).toBe(false);
-      expect(
-        savedCalls.every((e) => e.status !== EscrowStatus.FAILED),
-      ).toBe(true);
+      expect(savedCalls.some((e) => e.status === EscrowStatus.FAILED)).toBe(
+        false,
+      );
+      expect(savedCalls.every((e) => e.status !== EscrowStatus.FAILED)).toBe(
+        true,
+      );
 
       // The retry records the reconciliation marker (and keeps the LOCKED
       // status + tx hash) so a reconciliation job can find the row.
@@ -278,9 +303,9 @@ describe('EscrowService', () => {
       const savedCalls = (
         escrowRepo.save.mock.calls as [Partial<Escrow>][]
       ).map((c) => c[0]);
-      expect(
-        savedCalls.some((e) => e.status === EscrowStatus.FAILED),
-      ).toBe(false);
+      expect(savedCalls.some((e) => e.status === EscrowStatus.FAILED)).toBe(
+        false,
+      );
     });
 
     it.each([
@@ -572,15 +597,18 @@ describe('EscrowService', () => {
       escrowRepo.findOne.mockResolvedValue({ ...lockedEscrow });
       paymentRepo.find.mockResolvedValue([]);
       const order: string[] = [];
-      dataSource.manager.findOne.mockImplementation(
-        async () => {
-          order.push('locked-read');
-          return { ...lockedEscrow };
-        },
-      );
+      dataSource.manager.findOne.mockImplementation(async () => {
+        order.push('locked-read');
+        return { ...lockedEscrow };
+      });
       soroban.invoke.mockImplementation(async () => {
         order.push('invoke');
-        return { txHash: 'tx-1', ledger: 1, returnValue: null, status: 'SUCCESS' };
+        return {
+          txHash: 'tx-1',
+          ledger: 1,
+          returnValue: null,
+          status: 'SUCCESS',
+        };
       });
       paymentRepo.save.mockImplementation(async (data: Partial<Payment>) => {
         order.push('payment-write');
@@ -834,7 +862,9 @@ describe('EscrowService', () => {
     it('records a failed withdraw via the invokeOnLockedEscrow failure path (#89) and keeps the escrow LOCKED', async () => {
       const escrow = lockedPoolEscrow();
       escrowRepo.findOne.mockResolvedValue(escrow);
-      soroban.invoke.mockRejectedValueOnce(new Error('withdraw simulation failed'));
+      soroban.invoke.mockRejectedValueOnce(
+        new Error('withdraw simulation failed'),
+      );
 
       await expect(
         service.poolWithdraw('escrow-pool', '10.0000000', 'GRECIPIENT'),
 
@@ -18,6 +18,7 @@ import {
   ContractInvocationResult,
   SorobanClientService,
   u64,
+  SorobanPendingError,
 } from './soroban-client.service';
 import {
   apportionBasisPoints,
@@ -120,6 +121,18 @@ export class EscrowService {
         this.contractOpts(escrow),
       );
     } catch (err) {
+      if (err instanceof SorobanPendingError) {
+        // Submitted but not finalized when polling ran out: the funds may
+        // still lock. Keep PENDING with the hash so reconciliation (#371) or
+        // a retry resolves it via getTransaction(hash) — marking FAILED here
+        // invites a client retry that locks funds twice (#527).
+        escrow.fundTxHash = err.txHash;
+        escrow.metadata = {
+          pending: { txHash: err.txHash, at: new Date().toISOString() },
+        };
+        await this.escrowRepo.save(escrow);
+        throw err;
+      }
       // Only reached when the *contract call* failed: nothing was locked
       // on-chain, so FAILED is the truthful state.
       escrow.status = EscrowStatus.FAILED;
 
@@ -2,7 +2,12 @@ import { ConfigService } from '@nestjs/config';
 import { nativeToScVal, rpc } from '@stellar/stellar-sdk';
 import { AssetType } from '../common/enums';
 import { AppConfig } from '../config/configuration';
-import { SorobanClientService, u64 } from './soroban-client.service';
+import {
+  SOROBAN_TX_TIMEOUT_SECONDS,
+  SorobanClientService,
+  SorobanPendingError,
+  u64,
+} from './soroban-client.service';
 
 jest.mock('@stellar/stellar-sdk', () => ({
   ...jest.requireActual('@stellar/stellar-sdk'),
@@ -240,7 +245,7 @@ describe('SorobanClientService', () => {
       expect(result.ledger).toBe(9);
     });
 
-    it('times out after exhausting all attempts when the transaction stays NOT_FOUND', async () => {
+    it('polls for the full tx time bound, then throws SorobanPendingError (#527)', async () => {
       const getTxSpy = jest
         .spyOn(rpc.Server.prototype, 'getTransaction')
         .mockResolvedValue(txResponse({ status: 'NOT_FOUND' }));
@@ -249,11 +254,15 @@ describe('SorobanClientService', () => {
         () => null,
         (err: Error) => err,
       );
-      await jest.advanceTimersByTimeAsync(21_000);
+      await jest.advanceTimersByTimeAsync(
+        SOROBAN_TX_TIMEOUT_SECONDS * 1000 + 5_000,
+      );
       const err = await settled;
 
-      expect(getTxSpy).toHaveBeenCalledTimes(10);
-      expect(err).toBeInstanceOf(Error);
+      // 60s time bound at 2s per poll, plus one final attempt past expiry.
+      expect(getTxSpy).toHaveBeenCalledTimes(31);
+      expect(err).toBeInstanceOf(SorobanPendingError);
+      expect((err as SorobanPendingError).txHash).toBe('mock-hash');
       expect((err as Error).message).toContain(
         'Timed out waiting for Soroban transaction mock-hash to finalize',
       );
 
@@ -15,6 +15,30 @@ import {
 import { AssetType } from '../common/enums';
 import { AppConfig } from '../config/configuration';
 
+/** Transaction time bound set on every invocation (`setTimeout`), in seconds. */
+export const SOROBAN_TX_TIMEOUT_SECONDS = 60;
+const POLL_DELAY_MS = 2000;
+/**
+ * Poll at least as long as the transaction's time bound (+1 attempt), so a
+ * timeout really means "outcome still unknown at expiry", not "gave up early" (#527).
+ */
+const POLL_ATTEMPTS =
+  Math.ceil((SOROBAN_TX_TIMEOUT_SECONDS * 1000) / POLL_DELAY_MS) + 1;
+
+/**
+ * The transaction was accepted (`sendTransaction` → PENDING) but had not
+ * finalized when polling ran out. Its outcome is unknown, not failed: it may
+ * still be included, so callers must not treat this as "nothing happened" (#527).
+ */
+export class SorobanPendingError extends Error {
+  constructor(public readonly txHash: string) {
+    super(
+      `Timed out waiting for Soroban transaction ${txHash} to finalize; outcome unknown`,
+    );
+    this.name = 'SorobanPendingError';
+  }
+}
+
 export interface ContractInvocationResult {
   txHash: string;
   ledger: number | null;
@@ -185,7 +209,7 @@ export class SorobanClientService {
       networkPassphrase: this.networkPassphrase,
     })
       .addOperation(contract.call(method, ...scArgs))
-      .setTimeout(60)
+      .setTimeout(SOROBAN_TX_TIMEOUT_SECONDS)
       .build();
 
     const simulated = await this.server.simulateTransaction(tx);
@@ -223,8 +247,8 @@ export class SorobanClientService {
 
   private async pollTransaction(
     hash: string,
-    attempts = 10,
-    delayMs = 2000,
+    attempts = POLL_ATTEMPTS,
+    delayMs = POLL_DELAY_MS,
   ): Promise<rpc.Api.GetTransactionResponse> {
     for (let i = 0; i < attempts; i++) {
       const res = await this.server.getTransaction(hash);
@@ -233,9 +257,7 @@ export class SorobanClientService {
       }
       await new Promise((resolve) => setTimeout(resolve, delayMs));
     }
-    throw new Error(
-      `Timed out waiting for Soroban transaction ${hash} to finalize`,
-    );
+    throw new SorobanPendingError(hash);
   }
 
   private toScVal(value: unknown): xdr.ScVal {