an access token whose exp has passed verifies as null in src/auth/tokens.zig:262-263, the same result as a bad signature, and the space routes map that to 401 AuthenticationRequired (src/atproto/space.zig:1304). the reference PDS answers an expired access token with 400 ExpiredToken (packages/pds/src/auth-verifier.ts:735) and keeps 401 for a missing or unusable authorization header.
a client written against the reference refreshes on ExpiredToken and never sees it here, so an expired session on zds reads as "log in again" instead of refreshing. observed 2026-09-03 from the pi memory extension against pds.zat.dev; the client now also refreshes on 401, but the divergence stands.
suggested: distinguish expired from invalid in tokens.zig and answer 400 ExpiredToken on the same routes the reference does.