I returned to a three-day old browser tab. My Echo badge showed a number count, so I opened the Echo pop-up. First I viewed my one alert then my three messages. Clicking Mark all as read in the latter did nothing. I repeated with the browser console open and the net request to mark the message section read,
action=echomarkread &format=json &uselang=en &sections=message &token=a931f05d6968adf568ba2718051043c0557103cd%2B%5C
results in:
"servedby":"mw1200","error":{"code":"badtoken","info":"Invalid token","*":"See https://www.mediawiki.org/w/api.php for API usage"}}

I think the Echo JS code should one-time-only automatically request a new token on badtoken.

I clicked the badge in another old window. Before I interacted with the Echo pop-up, Echo made a similar net request to mark the //alert/ section read:
action=echomarkread &format=json &uselang=en &sections=alert &token=0e5026e02d7c66ac82b7647ab71eb3f05570d204%2B%5C
and a net request to
action=echomarkseen &format=json &token=0e5026e02d7c66ac82b7647ab71eb3f05570d204%2B%5C
They all failed with badtoken. I think that's why the badge shows [3] with Alert (1) and Messages (3) even after showing the Alerts pane.

Expected results

• Echo should transparently request a new token in response to badtoken. The Echo pop-up looks like it's working, so it should work.
• Echo should display an error on API failures it doesn't handle.