[NeoPlays]

Nimbus was the only consensus client Stereum pointed at the engine API over websockets. It now uses buildExecutionClientEngineRPCHttpEndpointUrl() like every other client, and the flag has moved to Nimbus's current name: --el=http://stereum-/<el>:8551

Launcher

Two lines. Changed in both places that build the endpoint:

• NimbusBeaconService for fresh installs
• ServiceManager's case "Nimbus" for later EL rewiring

Migration 2.5.2

New nimbus_engine_changes.yaml, wired into main.yml, with three guarded steps:

1. ws://stereum-…:8551 to http://…, matched per URL so comma-joined multi-EL values convert entirely, and scoped to stereum- so an external EL keeps the operator's own scheme.
2. --web3-url= to --el=, with no version guard (per your call: --el landed in v23.3.0, pre-Dencun).
3. Touches the Nimbus config and its execution clients so restart-services restarts both. The leaked sessions live on Besu's side, so the cap only clears when the EL restarts.

Molecule 252

Five fixtures, registered in the CI matrix. Passes all seven actions including idempotence. Verified as non-vacuous by neutering each half:

• neutered migration fails with not moved to http
• neutered EL touch fails with execution clients not touched

Notes from implementation

Three things that came out of building this rather than from the spec:

• The restart touch had to become conditional. Broadening the block guard to "is Nimbus" would otherwise have restarted every Nimbus and its EL on every Stereum update.
• stat before touch, because state: touch creates files. A dangling dependency id would have produced a phantom empty service config.
• The control fixture moved from Lighthouse to Prysm. Converge failed inside the 2.4.7 migration, which derives indentation from select('match', '.*--datadir.*') | first and throws on a command without --datadir. That fragility is still there for any real Lighthouse config missing --datadir, and ignore_errors on the include does not catch it.