# Fleet-internal engines model: census proposal

Status: RULED as census-ruling-design-fleet-internal-engines (Paul, as census owner, 2026-10-21), accepted as proposed on #280. The overlay rows carry `rev3=census-ruling-design-fleet-internal-engines`.

Branch: `design-fleet-internal-engines`, pinned at `bb1bf408` (main merged in). CI's only failure was `TestPlan14RootReadCensus` in `internal/provision`, with two discrepancies: the new `internal/sim/engines` source envelope and the unclassified `internal/sim/engines/mutate.sh:external` read.

No production code changes on this branch. `internal/sim/engines` (amadan #335 plan 1) is a new package whose Go files are all `_test.go` files, which the census does not scan. Its one scanned file is the bash mutation harness `mutate.sh`, adapted from `internal/sim/hostlife/mutate.sh`. The scanner pins every `.sh` file whole as an external read.

## Root-read entry

- `internal/sim/engines/mutate.sh:external`. Executing identity: none at runtime. A developer or CI runs `go test` or the harness by hand, as their own user. No root, no production binary. The harness runs a prebuilt engines test binary once per rule with `ENGINESIM_MUTATE` set and writes logs only under `$TMPDIR/enginesim`. It never copies or edits source. Basis: classified as `internal/sim/hostlife/mutate.sh` is (`plan14-root-reads.tsv`, re-pinned in `plan14-root-reads-merge.tsv` under merge-ruling-2): a test harness pinned by the conservative external envelope, not production root authority. Class: `legacy`, task: `accepted-legacy`. Sites: `file:external@0`. Digest: `e13dc977dabeaefddbdb3dfca68c04d531b282f6ea1b256d72c13a1caa365c46`. Frozen fingerprint: `4f5ed448b20df36eb514bcf2ddfbd74dc0c516b327f5f4c5e7dabed700b98df4`.

## Source envelope

- `internal/sim/engines` (new; `mutate.sh` alone): `41ab761e50cf9d98d1f2c51b472cf453085a80c506ab382914fe01ce930ae2fe`.

## Seal

The overlay `internal/provision/testdata/plan14-root-reads-design-fleet-internal-engines.tsv` is loaded last, after claim-merge-main-4. It adds one frozen declaration, so the seal moves. The preceding seal, securelisten-337's, which every later overlay left standing, is checked first: `33a8ff46dd9fcf85664c42c42eaf01585af6c92806cb7830fa8f30fd0950c430`. The resulting seal is `ca73eb766db03c4820076a28e84bbf15b61135a284294feaea78ae14b9b55071`.