Connect custom OAuth: completed_authorization_request and a live provider token, but /v1/connect/token returns user_authorization_required

Setup

• Custom OAuth connector (type oauth) against WHOOP's OAuth 2.0 server, tokenEndpointAuthMethod: client_secret_post, user authorization + refresh tokens enabled
• Project linked for production, preview, development; calls made from development with the project's OIDC token
• @vercel/connect 2.0.0, Next.js 16.3.3

What happens

1. startAuthorization(connector, { subject: { type: "user", id: "<our-user-id>" }, scopes: [...] }, { callbackUrl }), redirect the user to the returned URL.
2. User clicks Continue on the Connect page, signs in at the provider, taps Allow.
3. Connect redirects to callbackUrl. Observability logs completed_authorization_request for the subject with a tokenGroupId, all requested scopes, environment development.
4. getTokenResponse(connector, { subject: { type: "user", id: "<our-user-id>" } }) and the raw POST /v1/connect/token/<connector> both return 401 user_authorization_required. Same with forceRefresh, explicit scopes, scopes: ["*"], and with the provider's own user id as the subject.

Reproduced three times on a clean slate (revoked between runs; the provider showed its consent screen again each time).

Why I'm confident Connect holds a token DELETE /v1/connect/connectors/<connector>/tokens with the same subject returned {"tokensFound":1,"deleted":1,"providerRevoked":1,"providerSkipped":0,"providerFailed":0} providerRevoked: 1 means Connect sent a valid token to the provider's revocation endpoint and it was accepted, so a live token existed while token requests were being refused.

Ruled out

• Client secret: one early attempt had a mistyped secret; Connect correctly surfaced "OAuth token request failed: Client authentication failed". Fixed via PATCH /v1/connect/connectors/:id (data.clientSecret). Failures above are with the correct secret.
• Provider: the same client id/secret driven directly (standard authorization-code flow) works end to end: exchange 200, refresh token issued, all scopes, userinfo 200.
• Request Connect sends the provider (captured in browser): exactly the requested scopes, redirect_uri https://connect.vercel.com/callback, no PKCE, no openid. Provider accepts it.
• Caller auth: same OIDC token succeeds for startAuthorization and for the revoke call.

Questions

1. Under what conditions does /v1/connect/token return user_authorization_required for a subject that has a completed_authorization_request and a revocable provider token?
2. Does completed_authorization_request mean the provider token exchange succeeded, or only that the user finished consent?