Core user tokens have an explicit "invalid" state (User::INVALID_TOKEN), which can be used to detect when a user account is inaccessible (we use it for identifying system users). CentralAuth global user tokens don't have that, invalidating just involves setting a random value. For T358469: Display expired temporary account names differently and similar tasks (T358030, T359064) having a similar mechanism would be valuable.