The AGI kvittenser cron error-logged 'Skatteverket token refresh failed
(400): access_denied / Refresh Token status is expired' every 15 minutes
(19+ times on 2026-07-24 alone) and kept re-attempting the dead token
against SKV forever. Only the 404 id_not_found dialect of a dead refresh
session was classified as SESSION_EXPIRED; the 400 variants escaped as
raw Errors, so the cron's needs_reconsent flagging never ran.
Extend the classifier in refreshTokenForUser to also match the 400
'Refresh Token status is expired' body and OAuth2's standard 400
invalid_grant. With a typed SESSION_EXPIRED, the cron marks the token
row needs_reconsent on the first failure and resolveReadAuth skips the
connection on every later run until the user reconnects via BankID.
Config-shaped 400s (invalid_client, invalid_scope) deliberately stay
raw errors: a reconnect cannot fix those, and mislabeling them would
re-create the self-perpetuating reconnect banner from the 2026-07
MISSING_SCOPE incident.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
