Better the tester than a user.

And we absolutely wanted to shoot the tester who gave us this use case.

Why? Because he tested well and broke the software? A user changing their mind during a guided activity absolutely is a valid use case.

This makes want to become a tester. It scratches my evil itch just the way I like it.

Don’t shoot the tester shoot whoever wrote the code (or the framework / library) that got you into this situation in the first place.

If that broke the software it sounds like you have a very good tester.

What about the test case where I’m using the browser’s dev tools to re-send http requests in random orders?

Many services have a grace period. Mostly it's 30-90 days where they keep your data, just in case somebody else decided to delete your account or you were drunk or something. But it could also be for legal reasons, like websites where you can post stuff for everybody to see, in case you post something highly illegal and the authorities need to find you. Another example is where a webshop is required to keep a copy of your data for their bookkeeping.

The type of error where you have to give up trying to understand the user.

Not really the only reason. It would be better to just return "token invalid".

It could occur by someone messing with the URL from the reset password email, like accidently adding an extra character before pressing enter

Or a poor email client that wraps the URL and doesn't send the complete one when clicked.

Or someone attempting to find a weakness in the reset password system and sending junk as the token.

Immediately sue them for ~~DSGVO~~ GDPR

"Let's see how good their testers are."

Maybe there's a specific person who keeps doing this and they wrote this error specifically for him.

Don't be silly; it's obvious that there are different error messages for each gender expression. Error logs need to be detailed and specific in order to be useful.

In case you're serious, not everyone is a native speaker.

I believe rule of thumb is to track/log at least one level deeper than what you show to the end user, to ease with troubleshooting and debugging.

Beyond that, logs are only useless until they aren't, and then if you don't have them you're in for a universe of pain.

As the other comments have already said it's not Python. Not sure what you mean with text formatting, do you mean that it's multiple strings that are concatenated using +? You don't need the + in Python, you can do

some_function(
    "part one of really long string"
    " part two of really long string"
)

Which is identical to

some_function("part one of really long string part two of really long string")

It isn't, there are curly braces. It's TypeScript.