Flip daily_summary_opt_out. Idempotent.

THE TOKEN MAY ARRIVE TWO WAYS (amendment A6). RFC 8058 one-click POSTs to the List-Unsubscribe URL itself with the body List-Unsubscribe=One-Click — so the token is in the QUERY STRING and the body carries no token at all. The confirm form in the GET page posts it as a field. The query wins when both are present, because that is the URL we signed into the header.

THE RESPONSE IS THE SAME PAGE FOR EVERY OUTCOME — valid, expired, forged, a contact row that no longer exists, and (R6.5) a contact row whose e-mail has since been changed to somebody else's. Anything else makes this an oracle for "was this token ever real", which is a statement about a real customer's address, answerable by anyone who can guess.