Renewal behavior of expired Consul ACL tokens

Determine whether a Consul ACL token that has exceeded its TTL can be renewed in‑place or whether a new token must be created, given the model’s time‑based least‑privilege enforcement.

The documentation confirms that expired tokens are treated as invalid and remain visible until garbage‑collected, but it does not explicitly state if renewal is supported after TTL expiry. Observed renewal attempts fail, yet it is unclear whether this is an intentional restriction or a limitation that could change.

Is renewal of an expired ACL token intentionally prohibited? Should operators always treat renewal failure as expected and issue a new token? Does the internal garbage collector’s timing affect the possibility of renewing a token before it is removed?