What happens to an open Ledger API stream upon token expiry?

Assuming that I subscribe to a stream on the Ledger API using a token that expires, what will happen upon expiry?

1. Will the stream will be closed server-side with a descriptive error, or
2. is the auth checked only when establishing the stream, which would result in the stream remaining open, while only a new connection would be rejected?

The streams are interrupted as the token expires. I believe it’s PERMISSION_DENIED but I haven’t double checked the error code you get in that case.