An OAuth token exchange succeeds, but the resource server clock skew rejects the just-issued JWT as not yet valid

Identity is correct, yet token freshness assumptions differ across the two systems.