@@ -437,22 +437,13 @@ function categorizeError(errorMsg: string): string {
 export async function checkPushGatewayHealth(): Promise<PushGatewayHealth> {
   const start = Date.now()
   try {
-    const response = await fetch(`${API_URL}/health/push`, {
-      signal: AbortSignal.timeout(5000)
-    })
+    const data = await fetchApi<{
+      vapid_configured?: boolean
+      queue_connected?: boolean
+      pending_jobs?: number
+      failed_jobs?: number
+    }>('/api/admin/push/gateway', { signal: AbortSignal.timeout(5000) })
     const latency = Date.now() - start
-
-    if (!response.ok) {
-      return {
-        status: 'degraded',
-        latency,
-        vapidConfigured: false,
-        queueConnected: false,
-        error: `HTTP ${response.status}`
-      }
-    }
-
-    const data = await response.json()
     return {
       status: data.vapid_configured && data.queue_connected ? 'healthy' : 'degraded',
       latency,
 
@@ -112,10 +112,6 @@ Redis `PING`. `disabled` when Redis is not configured.
 
 Supabase reachability. `disabled` when `SUPABASE_URL`/`SUPABASE_ANON_KEY` are unset.
 
-### GET /health/push
-
-Push gateway status. `200` when VAPID is configured and the queue is connected.
-
 ## Documents
 
 Base path `/api/documents` (`src/api/routers/documents.router.ts`). Success responses use `{ "success": true, "data": ... }`.
@@ -1206,11 +1202,11 @@ Render a template (`notification` or `digest`) with sample data, as HTML. Servic
 
 ### GET /api/email/unsubscribe?token=
 
-One-click unsubscribe from an email link. No auth (the token is the credential). Verifies the token in `lib/unsubscribeToken.ts`, then applies the change through the `apply_unsubscribe` Supabase RPC, and returns an HTML confirmation page.
+The email link. No auth (the token is the credential). Verifies the token in `lib/unsubscribeToken.ts` and returns an HTML page with an Unsubscribe button. It changes nothing. Mail link scanners open every link, so a GET must never write.
 
 ### POST /api/email/unsubscribe?token=
 
-RFC 8058 `List-Unsubscribe-Post` handler for mail clients. Returns JSON (`{ "success": true }` or an `{ "error": ... }` body).
+The only route that writes. It applies the change through the `apply_unsubscribe` Supabase RPC. The confirm page's button posts the form field `confirm=yes` and gets an HTML result page. Any other body gets JSON (`{ "success": true }` or an `{ "error": ... }` body). That covers the RFC 8058 `List-Unsubscribe=One-Click` post from mail clients.
 
 ## Admin
 
@@ -1223,6 +1219,7 @@ Two audit routes are easy to misread. `/audit/media-storage` and `/audit/media-s
 | Method | Path                      | Purpose                  |
 | ------ | ------------------------- | ------------------------ |
 | GET    | `/stats`                  | Dashboard overview stats |
+| GET    | `/push/gateway`           | Push gateway status      |
 | GET    | `/users/document-counts`  | Document count per user  |
 | GET    | `/users/admins`           | All admin user IDs       |
 | POST   | `/users/:id/toggle-admin` | Grant or revoke admin    |
@@ -1331,7 +1328,7 @@ await supabase.rpc('register_push_subscription', {
 await supabase.rpc('unregister_push_subscription', { p_device_id: 'unique-device-id' })
 ```
 
-`GET /health/push` reports gateway status.
+Push has no public HTTP endpoint. Admins read the gateway status on `GET /api/admin/push/gateway`. It always answers `200` with the status, even when push is not set up.
 
 ## Rate limiting
 
 
@@ -29,6 +29,8 @@ This file is the operator and API changelog. The pad product lives in the [root
 - **Owner and author profiles drop `status` ([#434](https://github.com/docs-plus/docs.plus/issues/434)).**
   The `ownerProfile` on `GET /api/documents/:docName`, the documents list
   `owner`, and the `history.list` profiles no longer send it. See Security.
+- **`GET /health/push` is removed ([#433](https://github.com/docs-plus/docs.plus/issues/433)).**
+  It now answers `404`. See Security.
 
 ### Migration
 
@@ -52,6 +54,12 @@ breaks its sign-in and its heartbeat. After the push, check that
 `users.status` and `users.online_at`. Also check that `pg_publication_tables`
 has no `users` row.
 
+**Push gateway status ([#433](https://github.com/docs-plus/docs.plus/issues/433)).** If you
+polled `GET /health/push`, call `GET /api/admin/push/gateway` with an admin
+token. That route always answers `200`, so read the VAPID and queue flags in
+the body, not the status code. Move or delete any uptime probe of the old
+path, because it now answers `404`.
+
 **Media objects ([#408](https://github.com/docs-plus/docs.plus/issues/408)).** New S3 uploads are
 private. Objects written before this release stay `public-read` until you
 change them. Deploy the server first, then set the existing objects private.
@@ -429,6 +437,12 @@ SMTP_PASS=...
 
 ### Fixed
 
+- **The unsubscribe link asks before it changes anything ([#445](https://github.com/docs-plus/docs.plus/issues/445)).**
+  `GET /api/email/unsubscribe` now checks the token and shows an Unsubscribe
+  button. It writes nothing, so a mail link scanner can no longer unsubscribe
+  a reader. The button posts `confirm=yes` to the same URL, and that post
+  writes. One-click unsubscribe from a mail client is unchanged. Links in
+  mail already sent still work, and they now open the confirm page.
 - **Without Redis, a failed mail is no longer sent twice ([#421](https://github.com/docs-plus/docs.plus/issues/421)).**
   The service sent again after an inline failure. Now an inline failure is
   final: the row settles `failed`, and the pgmq message is acked. A skipped
@@ -537,6 +551,12 @@ SMTP_PASS=...
 
 ### Security
 
+- **Push gateway status needs an admin token ([#433](https://github.com/docs-plus/docs.plus/issues/433)).**
+  `GET /health/push` is removed and now answers `404`. It showed queue counts
+  and the VAPID subject with no auth. Admins read the same status on
+  `GET /api/admin/push/gateway`. That route always answers `200` with the
+  status, even when push is not set up. `GET /api/email/health` stays public,
+  because it already returns status only ([#423](https://github.com/docs-plus/docs.plus/issues/423)).
 - **Media of a document in Trash stops serving ([#408](https://github.com/docs-plus/docs.plus/issues/408)).**
   `GET /api/plugins/hypermultimedia/:documentId/:mediaId` answers `404`
   `NOT_FOUND` while the document is in Trash. After Restore, it serves again.
 
@@ -193,6 +193,7 @@ Moved verbatim out of the repo-root [AGENTS.md](../../AGENTS.md). The `### Supab
 ### Digest Email Links And Counts
 
 - **The app has no `/notifications` and no `/settings` route.** `apps/webapp/src/pages/` holds neither, and `[...slugs].tsx` serves every path, so those URLs returned HTTP 200 and opened a blank pad named after the path. `/settings/notifications` was worse: the second segment became a filter term. Every email link into the app must therefore be a real route plus a hash. `/unsubscribe` stays a real URL on the app's own domain, but the webapp no longer renders it: `next.config.js` proxies it to this server's `/api/email/unsubscribe`, which answers with HTML and needs no JavaScript. Its `routePolicy.ts` `UTILITY_PATHS` entry stays as a fall-through guard, so a broken rewrite opens no blank pad.
+  **A GET of `/unsubscribe` never writes (#445).** It checks the token and renders a confirm page. Only a POST writes: the page's form (`confirm=yes`, HTML) or a mail client's RFC 8058 one-click (JSON). Mail link scanners open every link, so never make GET write again.
 - **Both parts of a mail must offer the same link.** `resolveFooterLinks` in `packages/email-templates/src/helpers.ts` owns one table of action to link and label. `footerLinks` renders the HTML and `footerLinksText` the plain text, so neither can drift. The plain-text parts used to hardcode a tokenless URL, and the digest HTML aliased `unsubscribe_all` onto the digest link, which labelled a digest-scoped link "Unsubscribe from all". Pass the notification type, never a doctored links object.
 - **Footer links are signed in Node, never in Postgres.** `lib/unsubscribeToken.ts` owns signing and verification, keyed on `EMAIL_UNSUBSCRIBE_SECRET`; Postgres keeps only `apply_unsubscribe(user_id, action)`, the write. The SQL signer was deleted because a hosted project's `postgres` role cannot set `app.unsubscribe_secret` — `ALTER DATABASE` and `ALTER ROLE` both raise `42501` — so the secret was never provisioned, `get_email_footer_links` raised on every send, `sender.ts` swallowed the error, and every footer shipped a tokenless link the route then rejected. Postgres also wraps `encode(…, 'base64')` at 76 characters, which the old signer never stripped, so a long payload carried an embedded newline. **Do not re-propose signing in SQL, and do not reach for Vault: the fix was to delete the requirement, not to store the secret somewhere else.** `apply_unsubscribe` names a user with no proof of identity, so its `service_role`-only grant is load-bearing.
 - **The contributor count is a floor, never a census, and zero never ships.** `withSections` reads `outcome.result.summary.contributors.length`, which compute already resolved, so no new query exists. It sets the field only above 0, `contributorLine` returns an empty string for absent and 0, and both surfaces guard on that string. The number can legitimately be 0 while the document changed: a service-role write sets `triggeredBy` to an explicit null, and `resolveProfiles` returns `[]` on a profile outage. `Documents.contributors` is also per-replica and editor-only. Never word that line as complete.
 
@@ -1,10 +1,11 @@
 /**
  * Runs through the service_role client. The browser anon-key is RLS-scoped,
  * and email/push/email_queue are revoked from `authenticated`, so these
- * counts cannot be computed client-side.
+ * counts cannot be computed client-side. The push gateway status reads process state.
  */
 
 import { adminLogger } from '../../lib/logger'
+import { pushGateway } from '../../lib/push'
 import type { AppContext } from '../../types/hono.types'
 import { getSupabaseClient } from '../utils/supabase'
 
@@ -206,6 +207,16 @@ export async function getPushStatsAdmin(c: AppContext) {
   }
 }
 
+/** Always 200 with the status, so the dashboard reads the VAPID and queue flags from the body. */
+export async function getPushGatewayAdmin(c: AppContext) {
+  try {
+    return c.json(await pushGateway.getHealth())
+  } catch (error) {
+    adminLogger.error({ err: error }, 'Failed to get push gateway status')
+    return c.json({ error: 'Failed to fetch push gateway status' }, 500)
+  }
+}
+
 export async function getPushPipelineAdmin(c: AppContext) {
   const supabase = getSupabaseClient()
   if (!supabase) return c.json({ error: 'Supabase not configured' }, 500)
 
@@ -1,4 +1,3 @@
-import { pushGateway } from '../../lib/push'
 import type { HealthCheckResult } from '../../types'
 import type { AppContext } from '../../types/hono.types'
 import * as healthService from '../services/health.service'
@@ -45,10 +44,3 @@ export const checkSupabaseHealth = async (c: AppContext): Promise<Response> => {
 
   return c.json(result, statusCode)
 }
-
-export const checkPushHealth = async (c: AppContext): Promise<Response> => {
-  const result = await pushGateway.getHealth()
-  const statusCode = result.vapid_configured && result.queue_connected ? 200 : 503
-
-  return c.json(result, statusCode)
-}
@@ -12,7 +12,7 @@ import {
   renderUnsubscribePage
 } from '@docs.plus/email-templates'
 import { zValidator } from '@hono/zod-validator'
-import { Hono } from 'hono'
+import { type Context, Hono } from 'hono'
 import { z } from 'zod'
 
 import { config } from '../config/env'
@@ -22,7 +22,7 @@ import { emailGateway } from '../lib/email'
 import { recordEmailBounce } from '../lib/email/bounces'
 import { emailLogger } from '../lib/logger'
 import { getServiceRoleClient } from '../lib/supabase'
-import { verifyUnsubscribeToken } from '../lib/unsubscribeToken'
+import { type UnsubscribePayload, verifyUnsubscribeToken } from '../lib/unsubscribeToken'
 import {
   emailBounceSchema,
   sendDigestEmailSchema,
@@ -352,6 +352,18 @@ interface UnsubscribeResult {
 type UnsubscribeOutcome =
   { status: 'ok'; result: UnsubscribeResult } | { status: 'unconfigured' } | { status: 'failed' }
 
+const INVALID_TOKEN_MESSAGE = 'This unsubscribe link is invalid or has expired.'
+
+/** The one token check. GET and POST both call it, so they cannot disagree on a token. */
+function checkUnsubscribeToken(token: string): UnsubscribePayload | 'unconfigured' | null {
+  const secret = config.email.unsubscribeSecret
+  if (!secret) {
+    emailLogger.error('EMAIL_UNSUBSCRIBE_SECRET is not set — cannot verify unsubscribe tokens')
+    return 'unconfigured'
+  }
+  return verifyUnsubscribeToken({ token, secret })
+}
+
 /**
  * Identity comes from the token, which is verified here rather than in Postgres.
  * A missing secret and a missing client are both `unconfigured`: neither is the
@@ -363,21 +375,13 @@ async function processUnsubscribe(token: string): Promise<UnsubscribeOutcome> {
     emailLogger.error('Supabase service-role client is not configured for unsubscribe')
     return { status: 'unconfigured' }
   }
-  const secret = config.email.unsubscribeSecret
-  if (!secret) {
-    emailLogger.error('EMAIL_UNSUBSCRIBE_SECRET is not set — cannot verify unsubscribe tokens')
-    return { status: 'unconfigured' }
-  }
 
-  const payload = verifyUnsubscribeToken({ token, secret })
+  const payload = checkUnsubscribeToken(token)
+  if (payload === 'unconfigured') return { status: 'unconfigured' }
   if (!payload) {
     return {
       status: 'ok',
-      result: {
-        success: false,
-        error: 'invalid_token',
-        message: 'This unsubscribe link is invalid or has expired.'
-      }
+      result: { success: false, error: 'invalid_token', message: INVALID_TOKEN_MESSAGE }
     }
   }
 
@@ -393,21 +397,10 @@ async function processUnsubscribe(token: string): Promise<UnsubscribeOutcome> {
 }
 
 /**
- * One-click unsubscribe from an email link. The token is the only credential —
- * there is no session — and every outcome renders an HTML page, never a JSON error.
+ * Applies the unsubscribe, then renders the outcome as a page, never a JSON error.
+ * It writes, so only a POST may call it (#445).
  */
-emailRouter.get('/unsubscribe', async (c) => {
-  const token = c.req.query('token')
-
-  if (!token) {
-    return c.html(
-      renderUnsubscribePage({
-        title: 'Invalid link',
-        message: 'This unsubscribe link is missing required information.'
-      })
-    )
-  }
-
+async function applyUnsubscribeAsPage(c: Context, token: string): Promise<Response> {
   try {
     const outcome = await processUnsubscribe(token)
 
@@ -453,7 +446,7 @@ emailRouter.get('/unsubscribe', async (c) => {
     return c.html(
       renderUnsubscribePage({
         title: 'Unable to unsubscribe',
-        message: result.message || 'The unsubscribe link is invalid or has expired.'
+        message: result.message || INVALID_TOKEN_MESSAGE
       })
     )
   } catch (err) {
@@ -465,18 +458,64 @@ emailRouter.get('/unsubscribe', async (c) => {
       })
     )
   }
+}
+
+/**
+ * The email link. Mail link scanners open every link, so GET only checks the
+ * token and asks. It never writes (#445). The token is the only credential.
+ */
+emailRouter.get('/unsubscribe', (c) => {
+  const token = c.req.query('token')
+
+  if (!token) {
+    return c.html(
+      renderUnsubscribePage({
+        title: 'Invalid link',
+        message: 'This unsubscribe link is missing required information.'
+      })
+    )
+  }
+
+  const payload = checkUnsubscribeToken(token)
+  if (payload === 'unconfigured') {
+    return c.html(
+      renderUnsubscribePage({
+        title: 'Service error',
+        message: 'Unable to process your request. Please try again later.'
+      })
+    )
+  }
+  if (!payload) {
+    return c.html(
+      renderUnsubscribePage({ title: 'Unable to unsubscribe', message: INVALID_TOKEN_MESSAGE })
+    )
+  }
+
+  return c.html(
+    renderUnsubscribePage({
+      title: 'Unsubscribe?',
+      message: 'Press Unsubscribe to stop these emails. Nothing changes until you press it.',
+      confirm: true
+    })
+  )
 })
 
 /**
- * RFC 8058 List-Unsubscribe-Post: mail clients POST "List-Unsubscribe=One-Click"
- * in the body, so this answers JSON where the GET above answers HTML.
+ * The only write. The confirm page's form sends `confirm=yes` and gets a page.
+ * Any other body is an RFC 8058 mail client, which sends
+ * "List-Unsubscribe=One-Click" and gets JSON.
  */
 emailRouter.post(
   '/unsubscribe',
   zValidator('query', z.object({ token: z.string().min(1) }), houseEnvelopeHook),
   async (c) => {
     const { token } = c.req.valid('query')
 
+    const form: Record<string, unknown> = await c.req.parseBody().catch(() => ({}))
+    if (form.confirm === 'yes') {
+      return applyUnsubscribeAsPage(c, token)
+    }
+
     try {
       const outcome = await processUnsubscribe(token)
 
 
@@ -51,6 +51,7 @@ admin.get(
 admin.get('/stats/push', adminController.getPushStatsAdmin)
 admin.get('/stats/push/pipeline', adminController.getPushPipelineAdmin)
 admin.get('/push/subscriptions', adminController.getPushSubscriptionsRaw)
+admin.get('/push/gateway', adminController.getPushGatewayAdmin)
 admin.get('/system/table-sizes', adminController.getTableSizes)
 admin.get('/users', adminController.listUsers)
 admin.get('/users/notification-subs', adminController.getUserNotificationSubs)
 
@@ -15,6 +15,5 @@ health.get('/live', healthController.checkLiveness)
 health.get('/database', healthController.checkDatabaseHealth)
 health.get('/redis', healthController.checkRedisHealth)
 health.get('/supabase', healthController.checkSupabaseHealth)
-health.get('/push', healthController.checkPushHealth)
 
 export default health
@@ -144,16 +144,6 @@ const overallHealth: JsonSchema = {
   required: ['status', 'timestamp', 'services']
 }
 
-const pushHealth: JsonSchema = {
-  type: 'object',
-  description: 'Push gateway status. 200 when VAPID is configured and the queue is connected.',
-  properties: {
-    vapid_configured: { type: 'boolean' },
-    queue_connected: { type: 'boolean' }
-  },
-  additionalProperties: true
-}
-
 /** Row shape is a Prisma projection plus a joined owner profile — not modelled field-by-field. */
 const documentSummary: JsonSchema = {
   type: 'object',
@@ -287,7 +277,6 @@ export const components: OpenApiComponents = {
     RateLimitError: rateLimitError,
     HealthCheckResult: healthCheckResult,
     OverallHealth: overallHealth,
-    PushHealth: pushHealth,
     DocumentSummary: documentSummary,
     DocumentListPage: documentListPage,
     TiptapDoc: toJsonSchema(tiptapDocSchema),