An OAuth consent app was disabled, but an existing refresh token continues minting new access tokens

Interactive login is blocked, yet delegated API access survives through a token lifecycle gap.