reference creatortrack meta system user token gotcha 20260715T155812

In lib/social/oauth.ts, exchangeMeta stores a USER token for instagram connections but a PAGE token for facebook connections. scripts/seed-meta-connection.ts (the system-user seeding path, no Meta dev app needed) stores the system-user PAGE token in access_token for both platforms, which deviates from the canonical instagram shape.

This worked silently only because metaAccessTokenForConnection short-circuits to "return the stored token as-is" whenever no Meta dev app is configured (i.e. creatortrack-social.env has no META_APP_ID/META_APP_SECRET). Fixed 2026-07-15 (commit 45757f0): both rows now stamp credentials.user_token_type: "system_user", and metaAccessTokenForConnection checks that flag first and skips the refresh-exchange path entirely for system-user connections.

Why: the moment a real Meta dev app is wired up (needed eventually for user-facing OAuth, not just the system-user seed path), the old code would have silently tried to fb_exchange_token-refresh a page token as if it were a user token on every sync, an untested/undocumented combination likely to fail or silently corrupt the connection. How to apply: before or when adding META_APP_ID/META_APP_SECRET to ~/.forge-secrets/creatortrack-social.env for the first time, verify the user_token_type === "system_user" guard is still present in lib/social/oauth.ts's metaAccessTokenForConnection before trusting Instagram/Facebook token refresh.

[auto-memory session 60d132de-4659-485c-8044-427af0ccce7f, confidence 0.70, mode staged]