Each view regenerates the label from a fresh, audited vault read — nothing is stored. The first view of an unlabelled order assigns its tracking number.

Shipped orders show their PII-free shipment record only — the vault record is closed, so no label can be re-rendered here. A genuine post-ship emergency is what the break-glass lookup is for.