generator share links; secure send copy message

CHANGELOG.md

@@ -12,6 +12,19 @@ ADR-007 and ADR-002.
 
 ### Added
 
+- **A link that opens the code generator with the work already in it.** Copy
+  share link hands somebody a URL that reopens the page with the content, the
+  label, the copy count and every layout value the sender changed - so "here is
+  the label, print it" is a link rather than a screenshot and a list of
+  settings to retype. Everything rides in the fragment, which browsers never
+  transmit: it does not reach Flask, the IIS log or the proxy in between. Only
+  the values that differ from a first-time visitor's defaults travel, so the
+  link stays short enough to paste into a chat box, and an unknown key is
+  ignored rather than refused, so a link made by a newer version still opens.
+  The picture never travels - a data URL runs to megabytes and no chat client
+  would carry it. This is convenience, not secrecy: anyone holding the link can
+  read the content, which is what Secure Send is for.
+
 - **Reading anything now needs a permission.** A sweep of the URL map found
   **165 GET routes that answered anybody with no token at all**: the whole
   asset inventory, every machine, PC, printer and network device, the USB
@@ -115,6 +128,17 @@ ADR-007 and ADR-002.
 
 ### Fixed
 
+- **Secure Send now hands you a message, not a bare URL.** A link on its own
+  invites being pasted onto text already sitting in the chat box, and a chat
+  client turns the selection into the link's caption - so the secret travels as
+  the visible message and the link beside it protects nothing. That happened in
+  production: six LAPS passwords sent as the caption of a link whose whole job
+  was to keep them out of the chat. Copy message puts a sentence on the
+  clipboard instead, which has nowhere to attach itself, and the success card
+  now says plainly to delete the password from the chat box before pasting.
+  Nothing about the link itself was wrong - the URL carries only the token, the
+  key rides in the fragment, and neither ever reached the message.
+
 - **Ticking a section off crossed out its title and nothing else.** The strike
   now covers everything under that heading, including its sub-sections, which
   is what "this section is done" means to somebody who ticked the thing that