docs: hub v0.52.0 polish batch — CHANGELOG + REPORT + CONTEXT + REUSE (inline_confirm partial); take-two §4 dispositions: F-15/F-16/zero-toggle SHIPPED

Claude-Session: https://claude.ai/code/session_01GzammAMzsJTgpQHqxwM2bC

hub/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Felhom Hub — Changelog
 
+## v0.52.0 — polish batch: F-15 instant reset codes + F-16 inline confirms (2026-07-13)
+
+Hub half of the polish batch (take-two findings F-15/F-16). Companion: controller v0.123.0.
+
+- **F-15 instant reset codes**: `POST /api/v1/claim/reset-request` now returns the ACTIVE code
+  state in the response — `{claim: {code_hash, generation, issued_at}}`, the exact shape and
+  bcrypt-only guarantee of the report ACK — so the box applies the rotated hash in the same
+  request cycle and the emailed code works immediately (previously the box learned it only on
+  its next report ACK, ~15 min — Viktor's take-two live failure). Served on every authorized
+  outcome (a cap-reached refusal returns the unrotated row = controller-side no-op by
+  generation). Never a plaintext code. Live-proven: apply 1 s after the request; code accepted
+  on first try. The operator "Kód újraküldése" (no box round-trip) still has the ACK lag — its
+  flash + data-confirm copy now say so ("A kód a doboz következő jelentésekor (~15 percen belül)
+  aktiválódik."); the previously unmapped `claim-resent`/`claim-resend-failed` flashes render.
+- **F-16 inline confirms**: every native `confirm()` in the hub UI (offsite re-issue, freeze/
+  unfreeze, PBS re-issue, telemetry reset, dismiss-all-issues, regen-password, claim-resend,
+  block/delete, geo-disable) replaced by the LIGHT inline two-step — the shared
+  `inline_confirm.html` partial (`felhomConfirm` + `data-confirm` delegation, `requestSubmit` so
+  formaction survives). Native confirms are OS-modals that froze CDP browser automation (F-16;
+  the drill F-11 siblings). NOT the danger-zone typed-confirm — that heavyweight cascade flow is
+  untouched. New gate `scripts/hub_confirm_gate.py` (zero native confirm/prompt; red-proven).
+  Live-proven: the offsite re-issue completed under automation without freezing.
+
 ## v0.51.0 — DR-tier-by-default: per-customer flag + hands-free cascade + offsite coupling + capability chips (2026-07-12)
 
 Hub half of the DR-tier-by-default batch (DRILL-day0-vm-2026-07-12; operator decisions 1–5: