nx_stage_alias.nx

nx_stage_alias.nx -- the missing RENAME BRIDGE in the build-over-API loop (seq983). THE GAP: /api/build stages an artifact as <target>.sov.elf.new, but the deploy plane expects per-target names -- cmd_selfswap renames a hardcoded nx_hostctl.new, and the deploy rows name things like nx_mgmt_api.elf.new. Nothing reachable over the API could bridge those two names: nx_fs_write is text-only (a binary would be corrupted), md_promote_staged only maps <n>.new -> <n>, /api/promote maps <t>.sov.elf.new -> <t>.elf and refuses daemon/oracle names outright, and /api/unpack writes only under buildroot/runtime at mode 0644. So the documented sequence "build then deploy" could never actually stage a deployable artifact, and the established workaround was to build off-hub and upload -- i.e. leave the sovereign API. WHY THIS IS NOT A GENERAL FILE-COPY TOOL: a general copy primitive exposed over the API would be a serious hazard. This is deliberately the narrowest thing that closes the gap: - the target name is sanitized to [A-Za-z0-9_] only, so a path separator or .. can never appear; - the source is ALWAYS <target>.sov.elf.new and the destination ALWAYS <target>.<suffix>, both in the daemon cwd -- neither is caller-supplied as a path; - the suffix is an allowlist of exactly {new, elf.new}; anything else is refused; - the source must exist, be non-empty, and begin with the ELF magic \x7fELF -- so a failed build that staged 0 bytes, or any non-ELF, is REFUSED rather than propagated into a deploy; - the destination is written fresh and chmod 0755, because a promoted binary must be executable. Refusals are LOUD and return non-zero; nothing is written on any refusal path. license_tier: ORIGINAL No hw writes (Rule 26).