Email account recovery is often tested as a happy path: request a link, open the newest message, click it, and expect a new password form. That proves the feature works once. It does not prove that the link belongs to the right user, that an old token is rejected, or that two parallel runs cannot cross wires.

Recovery deserves its own security boundary. The browser session, recovery request, synthetic identity, mailbox message, and consumed token should all be tied to one test run. A free temp email inbox can help isolate message delivery during development, but it cannot provide the identity contract by itself.

Why recovery needs its own boundary

An account-recovery link is a credential for a short period of time.…