A Programs subscription changes only after a resident makes an explicit choice. Email links establish control of an address and open the next step; simply opening one does not replace a working feed.
Lifecycle
stateDiagram-v2 [*] --> Preview: open email link Preview --> Active: subscribe Active --> Active: renew Active --> Replaced: replace deliberately Active --> Revoked: revoke Active --> Expired: term ends Expired --> Active: renew Replaced --> [*] Revoked --> [*]
Safety rules
- Preview is non-mutating.
- Subscribe creates the first private feed only after confirmation.
- Renew extends the same feed so calendar apps keep working.
- Replace invalidates the previous private URL and requires the new one to be added.
- Revoke stops future fetches but cannot erase events already copied into a calendar app.
- A newer email request does not silently cancel an existing active feed.
Resident recovery
The Manage page is the first recovery path. It lets the resident check status and renew the current feed without unnecessary replacement. Replacement is appropriate when a URL was exposed or revoked, or when renewal does not restore service.
The service never asks a resident to paste a private calendar URL into a support message.