Watchers: double opt-in

redoal_watchers starts pending; /watching (the confirmation mail's
landing page) confirms to open or drops. Only open watchers are told.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

aggregates.yaml

@@ -14,10 +14,15 @@ aggregates:
       unsubscribed: { event: unsubscribed }
     transitions:
       open: [unsubscribed]
+  # Double opt-in: a watcher is pending until the address confirms from
+  # the mail n8n sends (redoal: confirm watching); only open watchers
+  # are told when something lands at their shape.
   - bucket: redoal_watchers
-    initial: open
+    initial: pending
     states:
-      open: { event: subscribed }
+      pending: { event: requested }
+      open: { event: confirmed }
       unsubscribed: { event: unsubscribed }
     transitions:
+      pending: [open, unsubscribed]
       open: [unsubscribed]

questions/review/index.yaml

@@ -68,7 +68,14 @@ alternatives:
             bucket: redoal_watchers
           requires_group: owners
           transitions:
-            - to: unsubscribed
+            - from: pending
+              to: open
+              label: Confirm by hand
+            - from: pending
+              to: unsubscribed
+              label: Drop
+            - from: open
+              to: unsubscribed
               label: Unsubscribe
 
   - name: Announced pages

questions/shape/[key].yaml

@@ -68,7 +68,9 @@ alternatives:
       - name: Where the note goes
         description: >
           The note is about one exact address, so it needs one exact
-          place to land.
+          place to land. One mail comes first, asking you to confirm —
+          nothing is sent before you do, and at most one note a day
+          after.
         icon: lucide:mail
         requirements:
           - name: email

questions/watching.yaml

@@ -0,0 +1,27 @@
+# Landing page of the confirmation mail: /watching?chain=<record>&email=<address>.
+# A followup - never in the nav; the record id in the link is the only
+# way here, and it plus the matching email is what authorizes the
+# transition (portal's self_transition).
+followup: true
+name: Are you watching this address?
+description: >
+  Someone asked to hear from a shape on redoal with your address. Say
+  yes and you get one note when something is left there — nothing
+  else, ever. Say it wasn't you and the request is dropped.
+alternatives:
+  - name: Yes, watch it
+    description: >
+      One note per day at most, only when a recording or a program
+      lands at exactly this shape.
+    self_transition:
+      bucket: redoal_watchers
+      to: open
+      label: Yes, watch it
+
+  - name: That wasn't me
+    description: >
+      The request is dropped and the address stays unused.
+    self_transition:
+      bucket: redoal_watchers
+      to: unsubscribed
+      label: Drop it