a reset link is a credential rotation

Account recovery is usually the weakest path in an authentication system, because it is the one place where a stranger holding a link can obtain an account. The reset flow that landed treats that link as a credential, with every property a credential needs.

The token is issued either by the account holder or by a manager acting for a staff member, and stored only as a digest, so the system cannot show it back to anyone because it does not have it. It carries an expiry, a per-user index and a marker for the moment it is spent. Validation deliberately does not consume it, so a person can open the link, look at the page and still use it; consumption happens at completion, atomically, exactly once.

Completion is not a password change. It re-runs the account's cryptographic registration against the same user, so the new credential overwrites the old one on the server, and then it revokes every existing session for that account. Whoever else was holding a session is out of it.

Delivery sits behind an interface, with a development stub that emits the token to the local log and an explicit note that the real mail implementation must never do that. The end-to-end test asserts the four properties that matter: single use, expiry refused, the old credential no longer valid, sessions gone.

What it proves: recovery was designed as credential rotation with a token lifecycle worth auditing, not as a special case bolted alongside the login.