---
title: "Verify reset form mismatch cannot consume a valid recovery link"
description: "Submit mismatched replacement passwords, verify accessible validation and no credential mutation, then correct the form using the same valid reset link."
canonical_url: "https://vostride.com/agent-library/account-recovery/reset-password-confirmation-mismatch.md"
md_url: "https://vostride.com/agent-library/account-recovery/reset-password-confirmation-mismatch.md"
content_kind: "recipe"
topic: "account-recovery"
---

# Verify reset form mismatch cannot consume a valid recovery link

Submit mismatched replacement passwords, verify accessible validation and no credential mutation, then correct the form using the same valid reset link.

## Risk

Client validation errors should not consume a valid recovery token or partially update the credential. This scenario checks that correcting an ordinary typing mistake leads to one intentional reset rather than forcing another email round trip.

## Fixtures

- A disposable account with its original password and a fresh reset message.
- Two different replacement secret values that each satisfy the documented password rules.
- A credential-version inspection hook and the product policy that validation failures do not consume reset tokens.

## Steps

1. Open the fresh reset link and enter the first replacement in the new-password field and the other value in confirmation.
2. Submit and verify a visible confirmation-mismatch error associated with the confirmation field; verify the page does not claim reset completion.
3. Inspect account state and verify its credential version is unchanged and the reset token remains usable according to policy.
4. Correct confirmation to match the first replacement and submit the same form once; verify successful reset completion.
5. Sign in from a signed-out state with the first replacement, verify account identity, and confirm the original password is rejected in a separate fresh attempt.

## Expected results

- Mismatched inputs do not update credentials or consume the valid recovery opportunity.
- The field error identifies the mismatch and supports correction without restarting recovery.
- Corrected submission results in exactly one valid credential transition.

## False-pass traps

- A browser validation bubble alone does not establish the server rejected a submitted invalid payload.
- A new recovery email fetched during correction would conceal premature consumption of the original token.

## Cleanup

- Reset the disposable account to its seed state and remove the test recovery email.

## Use with agent-qa

Adapt this test design to your application's acceptance criteria and configured target using the [recipe execution guide](/agent-library/software-factory/turn-a-recipe-into-an-agent-qa-test.md). External fixture setup and non-UI checks require your own supported hooks or test tooling. Validate the authored test, execute it, and inspect the completed evidence; this recipe is not a recorded test result.

## References

- [agent-qa test](/docs/agent-qa/configuration/test.md)
- [agent-qa hooks](/docs/agent-qa/guides/hooks.md)
- [agent-qa auth state](/docs/agent-qa/guides/auth-state.md)

- [Account recovery QA recipes](/agent-library/account-recovery.md)
- [Software factory QA library](/agent-library.md)