Payload contains: iss (Client ID), sub (referenceId), aud: "shopify", changes array with numeric variantId.

We have a Shopify Post-Purchase extension.
JWT is signed with HS256 using Client Secret (without shpss_ prefix).
Payload contains: iss (Client ID), sub (referenceId), aud: “shopify”, changes array with numeric variantId.
calculateChangeset returns success, but applyChangeset always returns:
{“errors”:[{“code”:“invalid_request”,“message”:“Invalid token”}],“status”:“unprocessed”}

Tested on development store with test orders only (bogus gateway).
Could this be a test order limitation?