Every lifted example comes from a file proj_cm33_ns actually compiles: proj_cm33_ns/ipc_hsm_handler.c, bento_libs/claw/kit-pse84-ai/modules/tesaiot/optiga_trust_helpers.c, bento_libs/claw/kit-pse84-ai/modules/tesaiot/tesaiot_pu_ingest.c (under ENABLE_OPTIGA_CLM=1) and bento_libs/claw/common/modules/tesaiot_mqtt/mqtt_mtls_setup.c. One idiom is quoted from bento_libs/claw/kit-pse84-ai/tesaiot/src/tesaiot_crypto.c, which ships but is not compiled by proj_cm33_ns — it is always labelled "shipped reference, not compiled". Two other shipped files in the same directory are legacy reference code with no caller and are not the shipping path; they are not quoted anywhere in this reference. The bento_libs/claw/kit-pse84-eval-epc2/ tree is an unreferenced duplicate compiled by no Makefile — citations always name kit-pse84-ai.

The provisioning UI's Enrol / Protect buttons drive prov_run_locked() in ipc_hsm_handler.c; that is the shipping path these topics describe.