.

apps/web/src/App.tsx

@@ -93,9 +93,7 @@ export default function App() {
     setErrorMessage(null);
 
     try {
-      const result = await api.createUser({ email });
-      await loadUsers();
-      return result;
+      return await api.createUser({ email });
     } finally {
       setBusy(false);
     }

apps/web/src/components/ResetLinkModal.tsx

@@ -1,4 +1,5 @@
 type ResetLinkModalProps = {
+  variant?: "invite" | "reset";
   email: string;
   resetLink: string;
   expiresAt: string;
@@ -6,6 +7,7 @@ type ResetLinkModalProps = {
 };
 
 export default function ResetLinkModal({
+  variant = "reset",
   email,
   resetLink,
   expiresAt,
@@ -19,14 +21,18 @@ export default function ResetLinkModal({
     }
   };
 
+  const isInvite = variant === "invite";
+
   return (
     <div className="modal-backdrop" role="presentation">
       <div className="modal-card" role="dialog" aria-modal="true">
         <div className="modal-header">
           <div>
-            <h2>Temporary reset link</h2>
+            <h2>{isInvite ? "Mailbox setup link" : "Temporary reset link"}</h2>
             <p>
-              No email was sent for <strong>{email}</strong>. Share this one-time link yourself.
+              {isInvite
+                ? <>Share this one-time setup link for <strong>{email}</strong>. The mailbox will only be created after the user chooses a password.</>
+                : <>No email was sent for <strong>{email}</strong>. Share this one-time link yourself.</>}
             </p>
           </div>
           <button type="button" className="ghost-button" onClick={onClose}>
@@ -36,7 +42,7 @@ export default function ResetLinkModal({
 
         <div className="stack">
           <label className="field">
-            <span>One-time link</span>
+            <span>{isInvite ? "Setup link" : "One-time link"}</span>
             <input type="text" readOnly value={resetLink} />
           </label>
 

apps/web/src/components/UserFormModal.tsx

@@ -46,7 +46,7 @@ export default function UserFormModal({
           <div>
             <h2>Create user</h2>
             <p>
-              A temporary password will be generated and a reset link will be emailed automatically.
+              A 48-hour setup link will be generated. The mailbox will only be created after the user chooses a password through that link.
             </p>
           </div>
           <button type="button" className="ghost-button" onClick={onClose} disabled={busy}>

apps/web/src/pages/DashboardPage.tsx

@@ -55,10 +55,12 @@ export default function DashboardPage({
     try {
       const result = await onCreateUser(email);
       setCreateOpen(false);
-      setInlineMessage(
-        result.warning ??
-          `Mailbox created and reset email sent. Link expires at ${result.resetLinkExpiresAt}.`
-      );
+      setResetLinkData({
+        email: result.email,
+        resetLink: result.setupLink,
+        expiresAt: result.expiresAt
+      });
+      setInlineMessage(`Setup link generated for ${result.email}. The mailbox will be created only after the user sets a password.`);
     } finally {
       setModalBusy(false);
     }
@@ -199,6 +201,7 @@ export default function DashboardPage({
 
       {resetLinkData ? (
         <ResetLinkModal
+          variant="invite"
           email={resetLinkData.email}
           resetLink={resetLinkData.resetLink}
           expiresAt={resetLinkData.expiresAt}

apps/web/src/pages/ResetPasswordPage.tsx

@@ -7,6 +7,7 @@ type ResetPasswordPageProps = {
 
 export default function ResetPasswordPage({ token }: ResetPasswordPageProps) {
   const [status, setStatus] = useState<"loading" | "ready" | "invalid" | "done">("loading");
+  const [mode, setMode] = useState<"invite" | "reset">("reset");
   const [emailHint, setEmailHint] = useState("");
   const [expiresAt, setExpiresAt] = useState("");
   const [password, setPassword] = useState("");
@@ -23,6 +24,7 @@ export default function ResetPasswordPage({ token }: ResetPasswordPageProps) {
         if (cancelled) {
           return;
         }
+        setMode(result.mode);
         setEmailHint(result.emailHint);
         setExpiresAt(result.expiresAt);
         setStatus("ready");
@@ -73,15 +75,17 @@ export default function ResetPasswordPage({ token }: ResetPasswordPageProps) {
   return (
     <main className="auth-shell">
       <section className="auth-card">
-        <div className="eyebrow">Secure reset</div>
-        <h1>Choose a new mailbox password</h1>
+        <div className="eyebrow">{mode === "invite" ? "Mailbox setup" : "Secure reset"}</div>
+        <h1>{mode === "invite" ? "Create your mailbox password" : "Choose a new mailbox password"}</h1>
 
         {status === "loading" ? <p className="auth-copy">Checking your reset link…</p> : null}
 
         {status === "invalid" ? (
           <>
             <p className="auth-copy">
-              This link is no longer valid. Ask your administrator for a new reset email.
+              {mode === "invite"
+                ? "This setup link is no longer valid. Ask your administrator for a new setup link."
+                : "This link is no longer valid. Ask your administrator for a new reset link."}
             </p>
             {error ? <p className="form-error">{error}</p> : null}
           </>
@@ -89,14 +93,18 @@ export default function ResetPasswordPage({ token }: ResetPasswordPageProps) {
 
         {status === "done" ? (
           <p className="notice success">
-            Your mailbox password has been updated. You can close this page and sign in with the new password.
+            {mode === "invite"
+              ? "Your mailbox has been created. You can close this page and sign in with the password you just chose."
+              : "Your mailbox password has been updated. You can close this page and sign in with the new password."}
           </p>
         ) : null}
 
         {status === "ready" ? (
           <>
             <p className="auth-copy">
-              Resetting the password for <strong>{emailHint}</strong>. This link expires at {expiresAt}.
+              {mode === "invite"
+                ? <>Creating the mailbox for <strong>{emailHint}</strong>. This setup link expires at {expiresAt}.</>
+                : <>Resetting the password for <strong>{emailHint}</strong>. This link expires at {expiresAt}.</>}
             </p>
 
             <form className="stack" onSubmit={handleSubmit}>