Send reset instructions
Capture the account email and preserve the user inside the controlled access path.
Restore access without breaking the secure-entry sequence
Recovery is part of the real access lifecycle. It should exist before entity, verification, and payment setup, not as an afterthought outside the journey.