Spec a password reset flow that leaks nothing

Your Node app has email and password sign-in, and users who forget their password have no way back in. An agent will build the reset flow: the request form, the email, and the page where the user picks a new password. A teammate already wrote and reviewed the token module.

Write the spec you would hand the agent.

What you know:

• Express, Postgres, and server-side sessions stored in a sessions table
• resetTokens.issue(userId) returns a random token and stores only its hash, with a 30-minute expiry
• resetTokens.consume(token) returns the user id once, then never again
• email goes out through mailer.send(to, template, data)
• passwords are hashed with argon2.hash

Then, in a few sentences: what does a bare "add forgot password" prompt get wrong?