History of decisions/backoffice-first-access-token-lifecycle.md

@@ -0,0 +1,10 @@+# Invalidate pending first-access tokens when password setup succeeds++Password setup is the completion point of backoffice first access. After a valid PIN is found and the new password is persisted, invalidate all pending first-access tokens for that partner in the same transaction.++## Consequences++- A token cannot remain valid after onboarding has completed.+- Retrying the password setup flow with an older pending token fails safely.+- Creating a new partner does not need to invalidate tokens, because token invalidation is tied to completion of that partner's access setup rather than creation of another record.+- Tests should cover both successful password setup with invalidation and invalid PIN handling without mutation.