Invitation-link behavior: Treat an assessment invite URL as a one-time credential, not a…

Invitation-link behavior: Treat an assessment invite URL as a one-time credential, not a reusable bookmark. The first browser load exchanges its secret for a cookie-based candidate access token and marks the invite exchanged; reloading after the cookie is cleared or from another browser/device will fail by design. Applicability: assessment systems where preventing link sharing and duplicate access matters. Limit: candidates need a recovery/re-entry path if they lose their browser session. Evidence/example (2026-09-18): candidate-signal src/infra/postgres/app-store.ts selects invites only when exchanged_at IS NULL, then sets exchanged_at; the candidate app strips ?invite= after exchange. Its existing admin expired-session recovery explicitly resets exchanged_at to permit a controlled re-entry. Inference: the product copy should state that the initial link is single-use and candidates should keep the same browser open.