hub v0.72.0 — R-70 + R-71c: offsite delivery-state detector, card, stuck event, R-39(a)-guarded self-heal restage

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NKSN3gSg4TKVBBqkwW2djR

hub/internal/web/templates/config_form_body.html

@@ -117,7 +117,14 @@
                     </div>
                 </div>
                 {{with .Overrides}}{{with index . "offsite"}}{{if index . "host"}}
-                <p class="form-hint" style="margin-top:.5rem">Provisioned: {{index . "user"}}@{{index . "host"}}:{{index . "repo_path"}} — the transient password is delivered to the controller once (never shown here).</p>
+                <p class="form-hint" style="margin-top:.5rem">Provisioned: {{index . "user"}}@{{index . "host"}}:{{index . "repo_path"}} (the transient password is never shown here).</p>
+                <!-- R-70: the delivery state replaces the old static "delivered once" claim — the hub
+                     now RENDERS what it knows (one_time_secrets × report offbox presence) instead of
+                     asserting a delivery it never checked (DIAG-f10: a burned credential hid 2 days). -->
+                {{with $.Delivery}}
+                <p class="form-hint" style="margin-top:.35rem" data-delivery-state="{{.State}}"><span class="n {{.BadgeClass}}">{{.Badge}}</span> {{.Line}}</p>
+                {{if .StaleLine}}<p class="form-hint" style="margin-top:.35rem">{{.StaleLine}}</p>{{end}}
+                {{end}}
                 <!-- F4: explicit operator recovery for a consumed-password dead-end (fresh-guest DR).
                      Rides the parent form (nested forms are invalid HTML) via formaction; the _csrf field
                      submits with it. Resets the box credential + stages a fresh one-time password. -->