Secure Send documented, and the machine form stops re-creating a controlling-PC link that already exists

CHANGELOG.md

@@ -12,6 +12,30 @@ ADR-007 and ADR-002.
 
 ### Added
 
+- **Secure Send: hand somebody a password without leaving it in a chat
+  window.** A link in Tech Tools that carries one credential, dies when it is
+  opened, and expires on its own if nobody opens it. The secret is encrypted in
+  the sender's browser and the key rides in the URL fragment, which browsers
+  never transmit, so the server stores ciphertext it cannot read and a
+  compromised database yields nothing. Nobody can recover a lost secret either,
+  including an administrator, which is the same property seen from the other
+  side. Redeeming is a POST because chat and mail clients prefetch links to
+  build previews, and a one-view secret consumed by a preview window is a secret
+  the recipient never sees; a GET reports availability only. Expiry defaults to
+  24 hours (maximum a week) and views to one, whichever comes first, and a spent
+  row is deleted. Creating needs a login and `tools.secrets`; reading needs
+  neither, because the recipient usually has no account and the 128-bit token is
+  the authorisation. The 4096-character ciphertext limit is deliberately the
+  whole server-side enforcement: a zero-knowledge server cannot tell a password
+  from a document, so size is the only control it has, and raising it turns this
+  into the file transfer it was scoped not to be. Documented in
+  `docs/SECURE-SEND.md`.
+- **A site can let people without an account create a Secure Send link.**
+  New `securesend_allow_guests` setting (Settings > Tools > Secure Send), off by
+  default because a guest secret has no creator and the audit trail can then say
+  when and from where but never who. Guest creation is rate limited per address
+  and the setting fails closed if it cannot be read, so an error can never be
+  what opens an unauthenticated write endpoint.
 - **The code generator can print a back side.** A badge card is two-sided and
   the generator only ever emitted one page per card. The Back side section
   turns on a second page per card carrying either the same code again, a fixed
@@ -81,9 +105,27 @@ ADR-007 and ADR-002.
   the wrong code. The page index now travels with the page.
 - The back label's dotted preview outline outspecified the print reset and drew
   a dashed rule down the edge of every second card.
+- **Saving a machine that has a controlling PC answered "this relationship
+  already exists" and refused the save.** Reported against a map position
+  change, but the map was incidental: the form re-POSTed the controlling-PC
+  link on every save, and the row was already there. It used "do I know the
+  existing link's id" as a stand-in for "is there an existing link", and read
+  that id from a key the API does not emit, so the two disagreed on any machine
+  that had a PC. The same conflation meant CLEARING a machine's controlling PC
+  silently did nothing, which was the more dangerous half and had not been
+  reported. The loaded PC is now what decides, and re-selecting the same PC is
+  a no-op rather than a delete-and-recreate.
 
 ### Changed
 
+- **Tech Tools no longer asks people to sign in for tools that need no
+  account.** `/tools`, `/tools/codes` and `/tools/secure-send` were all behind
+  `requiresAuth`. The label generator runs entirely in the browser - no API, no
+  data, nothing to protect - so gating it only ever cost a guest the use of it,
+  and gating the Secure Send page contradicted the guest setting that lets
+  somebody with no account create a link. The server still decides who may
+  create a secret: making a page reachable is not the same as allowing the
+  action, and the two were conflated.
 - **Settings on the left, labels on the right.** The controls were a narrow
   column with the preview trailing underneath, so the labels being adjusted were
   off the bottom of the screen. The preview is now a column of its own that