Show the confirm form. CHANGES NOTHING, AND VALIDATES NOTHING (R6.7).

Brief §5 had the GET flip the flag; it must not. Mail scanners and link prefetchers follow GET links, so that shape unsubscribes people who never clicked — the customer then reports "you stopped sending my report" and nothing in the system disagrees with them. The state change is the POST.

THE PAGE IS BYTE-IDENTICAL FOR EVERY INPUT, apart from the token echoed into the hidden field it arrived in. The previous shape rendered a "this link is no longer valid" page without a form for a bad token and a confirm page with one for a good token, which is an oracle: anyone holding a harvested link learns from a single unauthenticated GET whether it is still live — i.e. whether that contact is still on this site's summary. Nothing is lost by dropping the distinction, because a forged token then gets a button whose POST already answers uniformly.

The only branch left is provisioning: with no usable secret the route 503s, exactly as the POST does, because no link we ever minted can be honoured.