carlos / platform Public

Merge origin/main (moves-plan15-proof, region-ha-two-box-build, settings-5-surfaces) into region-ha-1b-next-build

moves-plan15-proof replaces the C8 provider's origin proof with claim Plan 15's ClaimOriginProof (one batch Proven over the claim's recorded admissions, no retained-chain fallback). It addresses none of merge round 6's findings 1 to 4, so relocation's fixes carry forward onto it.

Conflicts:
- internal/host/claimfiles.go: movesFilesSource.Open takes main's claims store and builds main's ClaimOriginProof, keeps the branch's Routes requirement, and binds EnvFile: claimEnvFileFor (the env file through the row) where main bound the flat FilesDir. The branch's claimEnvFile and claimEnvFileFor are kept.
- internal/host/movesfiles.go: the movesFiles fields are the branch's EnvFile with main's Proof comment (nil refuses). movesFilesAllowed takes main's batch body (generations, proveOrigins) over the branch's moves.FilesGenerationBase. preparedBinding, relocationPreparedManifest and preparedOpening carry forward unchanged and feed main's proveOrigins.
- internal/host/movesfiles_test.go: main's fixture (a claims store, ClaimOriginProof) with the branch's EnvFile: flatClaimEnvFile.
- internal/host/movesprobeowners_test.go: main's realC8 (Proof: ClaimOriginProof) with the branch's EnvFile: envFileOf.
- internal/provision/plan9_b8_census_test.go: both sides' rows. handleAPIInstanceList takes main's digest (558d0b3e..., settings-5 changed it; the branch did not). handleAPIInstanceCreate keeps the branch's digest (3a4cbb44..., its EvidenceComplete line; main did not change it) with its review comments. The census passes as merged, so no digest is recomputed.

Also: relocation's provider tests turn on CARLOS_HOST_CLAIM_ORIGINS, so the claim records the admissions Plan 15's proof walks.

Copy gate passes. Main's moves rows run to MV-N456, so there is no collision with the branch's MV-N500.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>