hub: F-15 instant reset codes — reset-request response carries the rotated {code_hash, generation, issued_at} (same shape/guarantee as the report ACK); claim-resent flash now states the operator-resend ACK lag

Claude-Session: https://claude.ai/code/session_01GzammAMzsJTgpQHqxwM2bC

hub/internal/api/handler.go

@@ -1403,9 +1403,21 @@ func (h *Handler) handleClaimResetRequest(w http.ResponseWriter, r *http.Request
 	} else {
 		h.logger.Printf("[INFO] claim reset-request for %s: reset code emailed to the registered address", payload.CustomerID)
 	}
+	// v0.52.0 (take-two F-15): serve the ACTIVE code state in the response — same shape and same
+	// bcrypt-only guarantee as the report ACK — so the box accepts the emailed code the moment it
+	// lands instead of waiting for the next ACK (~15 min). Served on every authorized outcome: on
+	// a cap-reached refusal it is the unrotated row (a controller-side no-op by generation).
+	resp := map[string]interface{}{"status": "ok"}
+	if cs, err := h.store.GetClaim(payload.CustomerID); err == nil && cs != nil {
+		resp["claim"] = map[string]interface{}{
+			"code_hash":  cs.CodeHash,
+			"generation": cs.Generation,
+			"issued_at":  cs.IssuedAt.UTC().Format(time.RFC3339),
+		}
+	}
 	w.Header().Set("Content-Type", "application/json")
 	w.WriteHeader(http.StatusOK)
-	w.Write([]byte(`{"status":"ok"}`))
+	json.NewEncoder(w).Encode(resp)
 }
 
 // allowedEventTypes lists all valid event_type values the Hub accepts.