- Shipped
- September 12, 2026 at 6:46 AM UTC
- Author
- Kamo
- Commit
- 6000db3
The unsubscribe link opened a bare confirm-or-leave card. Someone who only wanted fewer emails had no way to say so, and nothing told them why they were being mailed, what would keep arriving, or that their choice was kept on record. The link now opens a preference page for that address and sender. Unsubscribing from everything comes first and is one press. After it, the reader can switch off one kind of mail (when there is more than one to choose between, or one is already off) or pause everything for 30, 60 or 90 days. Once unsubscribed they can resubscribe with one button, or tell the sender why they left. The page says why the email came, what they will still receive, and that each change is recorded. Every change goes through the opt-out ledger together with the request it came from, so the history shows the choice was the reader's own. Opening the page records a view and changes nothing. One-click requests from mail clients (RFC 8058) still unsubscribe from everything, always answer 200, and still pull a queued campaign row from its send. A link that names nobody gets the same neutral page on every route and never reaches the ledger. The page is plain HTML forms with no script. It is drawn in the sender's brand colour, adjusted until it meets WCAG contrast in both light and dark themes, and it works from 320px wide up. Every response carries a strict content security policy, no referrer (the token is in the URL), no-store, noindex and a frame ban. Rendering lives in suppression/page: a view record, a pure renderer that tests and previews call directly, and a service that resolves tokens and talks to the ledger. The controller only routes and sets headers.