The token endpoint refused any private_key_jwt assertion whose exp came more than 300 seconds after its iat. marque.at sends 330 seconds, so signing in there with an account on this PDS got through PAR and consent and then failed at /oauth/token with invalid_client, which the client shows as a generic callback failure.
RFC 7523 sets no maximum window, and the reference authorization server doesn't either: it verifies the assertion with maxTokenAge (one minute from iat), leaves exp optional, and never compares exp with iat.
The ceiling now bounds age. An assertion is usable until min(exp, iat + 300s + 60s skew), is refused as too old once past that whatever its exp says, and an absent exp still means iat + 300s. The jti replay entry is held until that same cut-off rather than until exp, so a far-future exp still cannot write a replay row that never ages out, which is what the old refusal was protecting.
Tests cover 330-second and hour-long windows accepted, a decades-long exp accepted but cut off at the ceiling, a stale iat refused whatever its exp, and a past exp still refused.