The request_uri a pushed authorization request returns lived sixty
seconds. That window has to cover the redirect, the sign-in page load,
reading every scope description on the consent screen, typing a handle
and a password, and the Approve POST -- and the permission-set expansion
is pinned only at that POST, so nothing about it can be done early. A
deliberate human does not finish in sixty seconds; the request was
measured dead between t+45s and t+75s, after which the client gets
invalid_request for a request_uri it was handed moments before and
the whole handshake restarts.
RFC 9126 §2.2 suggests a lifetime "in the order of a few seconds to
several minutes"; sixty seconds sits at the floor of that. The reference
provider uses PAR_EXPIRES_IN = 5 * MINUTE
(oauth-provider/src/oauth-constants.ts), so match it at 300.
The expiry tests aged their request by 120 seconds, which was past the old ceiling and is inside the new one, so both would now pass for the wrong reason -- they are keyed off the constant instead. The new test is the one that would have caught this: a 90-second-old request, an unremarkable sign-in, must still resolve and still be consumable.