Fleet-internal engines model: census proposal

Status: RULED as census-ruling-design-fleet-internal-engines (Paul, as census owner, 2026-10-21), accepted as proposed on #280. The overlay rows carry rev3=census-ruling-design-fleet-internal-engines.

Branch: design-fleet-internal-engines, pinned at bb1bf408 (main merged in). CI's only failure was TestPlan14RootReadCensus in internal/provision, with two discrepancies: the new internal/sim/engines source envelope and the unclassified internal/sim/engines/mutate.sh:external read.

No production code changes on this branch. internal/sim/engines (amadan #335 plan 1) is a new package whose Go files are all _test.go files, which the census does not scan. Its one scanned file is the bash mutation harness mutate.sh, adapted from internal/sim/hostlife/mutate.sh. The scanner pins every .sh file whole as an external read.

Root-read entry

• internal/sim/engines/mutate.sh:external. Executing identity: none at runtime. A developer or CI runs go test or the harness by hand, as their own user. No root, no production binary. The harness runs a prebuilt engines test binary once per rule with ENGINESIM_MUTATE set and writes logs only under $TMPDIR/enginesim. It never copies or edits source. Basis: classified as internal/sim/hostlife/mutate.sh is (plan14-root-reads.tsv, re-pinned in plan14-root-reads-merge.tsv under merge-ruling-2): a test harness pinned by the conservative external envelope, not production root authority. Class: legacy, task: accepted-legacy. Sites: file:external@0. Digest: e13dc977dabeaefddbdb3dfca68c04d531b282f6ea1b256d72c13a1caa365c46. Frozen fingerprint: 4f5ed448b20df36eb514bcf2ddfbd74dc0c516b327f5f4c5e7dabed700b98df4.

Source envelope

• internal/sim/engines (new; mutate.sh alone): 41ab761e50cf9d98d1f2c51b472cf453085a80c506ab382914fe01ce930ae2fe.

Seal

The overlay internal/provision/testdata/plan14-root-reads-design-fleet-internal-engines.tsv is loaded last, after claim-merge-main-4. It adds one frozen declaration, so the seal moves. The preceding seal, securelisten-337's, which every later overlay left standing, is checked first: 33a8ff46dd9fcf85664c42c42eaf01585af6c92806cb7830fa8f30fd0950c430. The resulting seal is ca73eb766db03c4820076a28e84bbf15b61135a284294feaea78ae14b9b55071.