Wave C3 (shell→dag): nbd_proxy_serve typed session-lease completion

dag/extdeps/cloud/gcp/sts.dag

@@ -1,6 +1,6 @@
 module extdeps.cloud.gcp.sts
 
-import std.types { NonEmptyStr, HttpMethod, AuthScheme }
+import std.types { NonEmptyStr, HttpMethod, AuthScheme, Secret }
 import extdeps.cloud.gcp.errors { GcpErrorShape, GcpOAuth2ErrorShape }
 import extdeps.github.errors { GitHubErrorShape }
 
@@ -19,7 +19,7 @@ type SubjectTokenType = Jwt | StsAccessToken | IdToken | Saml2
 type RequestedTokenType = RequestAccessToken | RequestIdToken
 
 type StsTokenResponse {
-  access_token: String
+  access_token: Secret
   issued_token_type: String
   token_type: String
   expires_in: Int

dag/extdeps/tcgplayer/tcgplayer.dag

@@ -1,6 +1,6 @@
 module extdeps.tcgplayer.tcgplayer
 
-import std.types { NonEmptyStr, HttpMethod, AuthScheme }
+import std.types { NonEmptyStr, HttpMethod, AuthScheme, Secret }
 import extdeps.external_authority { ExternalAuthority }
 import extdeps.uri { Uri, Https }
 import extdeps.coverage { CoverageClosureEntry, CoverageClosureFact }
@@ -23,7 +23,7 @@ data structural_coverage_gap_versioned_paths: List<String> = [
 ]
 
 type TcgplayerTokenResponse {
-  access_token: String
+  access_token: Secret
   token_type: String
   expires_in: Int
   userName: String?

dag/gunbc/host_standup.dag

@@ -195,7 +195,7 @@ data host_standup_spine: List<HostStandupStep> = [
   host_standup_prefix_gap_step(
     phase: OsInstallActuated,
     label: "prefix:os-install-actuated",
-    interim_realization: "gunbc.srv3_os_install_actuate (runnable prep) + extdeps.bmc.webui.nbd_proxy_serve ShellProgram transport (bash_emit dissolve-on) + gunbc.nbd_proxy_virtual_media_install.srv3_os_install_actuator_plan + gunbc.network_identity_subsumption; live mount+boot proof operator-gated (docs/runbooks/srv3-os-install-actuate.md)",
+    interim_realization: "gunbc.srv3_os_install_actuate (runnable prep) + gunbc.host_effect_nbd_proxy_serve (Srv3NbdProxyServe typed session-lease on host_effect_apply; systemd-run transient units interim) + gunbc.nbd_proxy_virtual_media_install.srv3_os_install_actuator_plan + gunbc.network_identity_subsumption; live mount+boot proof operator-gated (docs/runbooks/srv3-os-install-actuate.md)",
     refusal: "host_standup:prefix:os-install-actuated:unexecuted — refuse assimilation until NBD-proxy install actuates and OS-up witness is green-by-execution",
     effect_evidence: host_effect_identity_evidence
   ),
@@ -322,7 +322,7 @@ data host_standup_gap_ledger: List<GapLedgerRow> = [
   GapLedgerRow {
     phase_label: "prefix:os-install-actuated",
     modeling: "gap",
-    authority_or_interim: "gunbc.srv3_os_install_actuate + extdeps.bmc.webui.nbd_proxy_serve (ShellProgram + bash_emit dissolve-on) + extdeps.bmc.os_install_actuator_toolchain + gunbc.network_identity_subsumption — live execution proof operator-gated (docs/runbooks/srv3-os-install-actuate.md)"
+    authority_or_interim: "gunbc.srv3_os_install_actuate + gunbc.host_effect_nbd_proxy_serve (Srv3NbdProxyServe typed session-lease on host_effect_apply) + extdeps.bmc.os_install_actuator_toolchain + gunbc.network_identity_subsumption — live execution proof operator-gated (docs/runbooks/srv3-os-install-actuate.md)"
   },
   GapLedgerRow {
     phase_label: "prefix:host-converge",

dag/gunbc/srv3_actuate_shell_paths.dag

@@ -5,5 +5,4 @@ import std.types { String, NonEmptyStr }
 data srv3_bmcweb_login_body_path: String = "/tmp/srv3_bmcweb_login_body.json"
 data srv3_bmcweb_login_response_path: String = "/tmp/srv3_bmcweb_login_response.json"
 data srv3_bmcweb_token_path: String = "/tmp/srv3_bmcweb_token"
-data srv3_nbd_proxy_serve_script_path: String = "/tmp/srv3_nbd_proxy_serve.sh"
 data srv3_sol_console_log_path: NonEmptyStr = "/var/lib/gunbc/logs/srv3-install-sol-console.log" as NonEmptyStr

dag/gunbc/srv3_os_install_actuate.dag

@@ -2,7 +2,7 @@ module gunbc.srv3_os_install_actuate
 
 
 data gunbc_srv3_os_install_actuate_scope_disposition: Disposition = std.disposition.Terminal {
-  reason: "prefix:os-install-actuated runnable prep — ISO fetch, derived actuator host, three-step actuator plan (nbd_proxy_serve, boot-once-cd, force-restart) as gunbc run entrypoints. Scope boundary: gunbc.srv3_os_install_actuate_scope (actuator prep + runbook ONLY; seed gap fail-closed; credential debt scaffold). Live mount+boot+install operator-gated; nbd_proxy_serve is long-running foreground."
+  reason: "prefix:os-install-actuated runnable prep — ISO fetch, derived actuator host, three-step actuator plan (nbd_proxy_serve, boot-once-cd, force-restart) as gunbc run entrypoints. Scope boundary: gunbc.srv3_os_install_actuate_scope (actuator prep + runbook ONLY; seed gap fail-closed; credential debt scaffold). Live mount+boot+install operator-gated; nbd_proxy_serve is a held session via host_effect_apply (systemd transient units)."
 }
 
 data srv3_os_install_actuate_shell_runner_scaffold: Disposition = Scaffold {

docs/runbooks/srv3-os-install-actuate.md

@@ -26,8 +26,9 @@ with the toolchain grant (curl, websocat, nbdkit, socat).
 2. **Seeded ISO remaster before serve** — step 0b produces the actuator virtual-media path
    (`gunbc.srv3_os_install_actuate_scope.srv3_actuator_virtual_media_iso_install_path` →
    `.../ubuntu-24.04.3-live-server-srv3-seeded.iso`). `srv3_nbd_proxy_serve` binds this authority, not the stock path.
-3. **`srv3_nbd_proxy_serve` is long-running** — runs foreground until Ctrl-C or installer disconnect. Open a second
-   terminal for boot-once.
+3. **`srv3_nbd_proxy_serve` is a held session** — one-shot `host_effect_apply` reconciles `Srv3NbdProxyServe` via
+   systemd transient units (nbdkit + websocat). Units keep serving after the command returns; stop them when install
+   completes. Open a second terminal for boot-once.
 4. **Record receipts** — paste command output and router lease observation into the operator sign-off thread.
 
 ## Step 0a — actuator toolchain ensure (srv1)
@@ -99,11 +100,6 @@ cd "$GUNBC_ROOT"
 
 # Preflight: toolchain (ISO from step 0)
 which curl websocat nbdkit socat jq sha256sum gunbc
-
-# Emit the nbd-proxy serve script to /tmp/srv3_nbd_proxy_serve.sh (review before live)
-gunbc run --source-root dag \
-  --entry dag/gunbc/srv3_os_install_actuate.dag \
-  --function srv3_os_install_actuate_emit_nbd_script
 ```
 
 ### BMCweb login — credential resolution (read before live)
@@ -122,15 +118,16 @@ gunbc run --source-root dag \
 
 Run in **two terminals** on the actuator host.
 
-### Terminal A — virtual media serve (held open)
+### Terminal A — virtual media serve (typed session-lease apply)
 
 ```bash
 gunbc run --source-root dag \
   --entry dag/gunbc/srv3_os_install_actuate.dag \
   --function srv3_nbd_proxy_serve
 ```
 
-Leave running. The BMC should mount the ISO as virtual CD when the NBD handshake completes.
+Returns on converge (systemd transient units started). Verify port **10809** is listening, then proceed. The BMC
+should mount the ISO as virtual CD when the NBD handshake completes.
 
 ### Terminal B — boot once from CD + force restart (workflow escalation)