fix(runtime): keep the landed names collectJobsWithoutBody and JobWithoutBody

The shipped job liveness ledger anchors job/enabled's evidence on
collectJobsWithoutBody, so the export keeps its name; its TSDoc now states
that the judgement also covers a body that does not bind (an expression
body, or one carrying body.timeoutMs).

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016GiHYRmLSNWTfbX9gVQkpz

Author: claude

.changeset/21585-hook-refusal-install-local.md

@@ -16,7 +16,7 @@ Clause-②: yes (narrowing)
 
 - **The refusal.** The install answers `422` with `VALIDATION_ERROR`, the answer the door already gives an enabled job with no `body`. One answer names everything the door cannot run: each hook and the function its `handler` names, each job and its handler, and each refused job `body` with the key the declaration refuses. Nothing is installed: nothing is registered, persisted, bound or scheduled. `os package install` exits non-zero and prints the code beside the status.
 - **Rehydrate.** A package installed by an earlier version keeps rehydrating after a restart. Its body hooks bind as before. A hook of it with no `body` is reported at `warn` by name and is **not bound**: this door carries no runtime module, so the hook's `handler` can never name the package's own code. Its job with no runnable `body` is reported and not run, as before.
-- **Runtime.** The binder exports the two judgements the door reads: `collectHooksWithoutBody`, and `collectJobsWithoutRunnableBody`, which also names a job whose `body` does not bind. `bindAppArtifactHandlers` takes `withholdHooksWithoutBody`, which a door that carries no runtime module sets, and reports the hooks it withheld as `withheldHooks`.
+- **Runtime.** The binder exports the two judgements the door reads: `collectHooksWithoutBody`, and `collectJobsWithoutBody`, which also names a job whose `body` does not bind. `bindAppArtifactHandlers` takes `withholdHooksWithoutBody`, which a door that carries no runtime module sets, and reports the hooks it withheld as `withheldHooks`.
 - **Unchanged:** a boot that loads the artifact's runtime module (`os start --artifact`, a `defineStack` config) binds an app's handler hooks to its own functions exactly as before. Hooks authored through the metadata API are unchanged too. A package whose hooks carry a `body` and whose enabled jobs carry a valid `body` installs exactly as before.
 
 The route for a refused package: give each hook a `body` (sandboxed JS, the form actions and jobs use), and correct each job `body` to the declared shape. That shape is a sandboxed JS body whose time limit is the job's own `timeoutMs`, and `os validate` reports the same refusal. Alternatively, boot the artifact with `os start --artifact`, which loads its runtime module. This ships as `minor`, under the launch-window convention for narrowings of an accept set.

packages/cloud-connection/src/marketplace-install-local-plugin.ts

@@ -1835,7 +1835,7 @@ export class MarketplaceInstallLocalPlugin implements Plugin {
      * install route refuses:
      *
      *   - the enabled jobs with no `body`, or with a `body` the declaration
-     *     refuses (`collectJobsWithoutRunnableBody`, which reads the jobs the
+     *     refuses (`collectJobsWithoutBody`, which reads the jobs the
      *     binder schedules and judges a body by the parse the binder binds by);
      *   - the hooks with no `body` (`collectHooksWithoutBody`, the judgement the
      *     binder withholds by on this door's rehydrate).
@@ -1850,16 +1850,16 @@ export class MarketplaceInstallLocalPlugin implements Plugin {
         manifest: unknown,
         manifestId: string,
     ): Promise<UnrunnableCode> => {
-        let collectJobs: typeof import('@objectstack/runtime')['collectJobsWithoutRunnableBody'] | undefined;
+        let collectJobs: typeof import('@objectstack/runtime')['collectJobsWithoutBody'] | undefined;
         let collectHooks: typeof import('@objectstack/runtime')['collectHooksWithoutBody'] | undefined;
         try {
             const mod: any = await import('@objectstack/runtime');
-            if (typeof mod?.collectJobsWithoutRunnableBody === 'function') collectJobs = mod.collectJobsWithoutRunnableBody;
+            if (typeof mod?.collectJobsWithoutBody === 'function') collectJobs = mod.collectJobsWithoutBody;
             if (typeof mod?.collectHooksWithoutBody === 'function') collectHooks = mod.collectHooksWithoutBody;
         } catch { /* reported below */ }
         if (!collectJobs) {
             ctx.logger?.warn?.(
-                `[MarketplaceInstallLocal] this runtime has no collectJobsWithoutRunnableBody — the jobs of ${manifestId} are not judged, `
+                `[MarketplaceInstallLocal] this runtime has no collectJobsWithoutBody — the jobs of ${manifestId} are not judged, `
                 + 'so a job with no runnable `body` installs and is never run. Upgrade @objectstack/runtime alongside @objectstack/cloud-connection.',
             );
         }

packages/runtime/src/app-artifact-handlers.jobs.test.ts

@@ -2,7 +2,7 @@
 
 /**
  * #21489 — the binder's job half: `scheduleAppArtifactJobs`, the ONE place a
- * declared job becomes a scheduled one, and `collectJobsWithoutRunnableBody`,
+ * declared job becomes a scheduled one, and `collectJobsWithoutBody`,
  * the judgement the install-local door refuses on (#21585: no `body`, or a
  * `body` the declaration refuses — the same judgement the binder binds by).
  *
@@ -26,7 +26,7 @@
 
 import { describe, it, expect, vi } from 'vitest';
 import type { PluginContext } from '@objectstack/core';
-import { scheduleAppArtifactJobs, collectJobsWithoutRunnableBody, PACKAGE_JOBS_UNINSTALL_CLEANUP } from './app-artifact-handlers.js';
+import { scheduleAppArtifactJobs, collectJobsWithoutBody, PACKAGE_JOBS_UNINSTALL_CLEANUP } from './app-artifact-handlers.js';
 import { jobBodyRunnerFactory } from './sandbox/body-runner.js';
 import { QuickJSScriptRunner } from './sandbox/quickjs-runner.js';
 import { AppPlugin } from './app-plugin.js';
@@ -392,9 +392,9 @@ describe('#21489: the sandbox job origin', () => {
     });
 });
 
-describe('#21489: collectJobsWithoutRunnableBody — what no JSON door can run', () => {
+describe('#21489: collectJobsWithoutBody — what no JSON door can run', () => {
     it('names each ENABLED job without a body, with the function its handler declares', () => {
-        expect(collectJobsWithoutRunnableBody(pkg([
+        expect(collectJobsWithoutBody(pkg([
             { name: 'handler_only', schedule: INTERVAL, handler: 'tick' },
             { name: 'neither', schedule: INTERVAL },
             { name: 'body_job', schedule: INTERVAL, body: WRITE_BODY },
@@ -407,8 +407,8 @@ describe('#21489: collectJobsWithoutRunnableBody — what no JSON door can run',
     });
 
     it('a package without jobs has nothing to refuse', () => {
-        expect(collectJobsWithoutRunnableBody(pkg([]))).toEqual([]);
-        expect(collectJobsWithoutRunnableBody({ id: APP_ID })).toEqual([]);
+        expect(collectJobsWithoutBody(pkg([]))).toEqual([]);
+        expect(collectJobsWithoutBody({ id: APP_ID })).toEqual([]);
     });
 });
 
@@ -418,7 +418,7 @@ describe('#21585: a job body the declaration refuses is judged as unrunnable —
     const GOOD = { name: 'good_job', schedule: INTERVAL, body: WRITE_BODY };
 
     it('names an L1 expression body and a body carrying timeoutMs, each with the declaration\'s refusal', () => {
-        const named = collectJobsWithoutRunnableBody(pkg([L1, TWO_LIMITS, GOOD, { ...L1, name: 'l1_disabled', enabled: false }]));
+        const named = collectJobsWithoutBody(pkg([L1, TWO_LIMITS, GOOD, { ...L1, name: 'l1_disabled', enabled: false }]));
 
         expect(named.map((j) => j.name)).toEqual(['l1_job', 'two_limits']);
         // The key the refusal names, so the author knows where to look.
@@ -429,7 +429,7 @@ describe('#21585: a job body the declaration refuses is judged as unrunnable —
     });
 
     it('a body with a handler beside it is judged by its body — the body wins, as it does in the binder', () => {
-        const named = collectJobsWithoutRunnableBody(pkg([{ ...L1, handler: 'tick' }, { ...GOOD, name: 'good_both', handler: 'tick' }]));
+        const named = collectJobsWithoutBody(pkg([{ ...L1, handler: 'tick' }, { ...GOOD, name: 'good_both', handler: 'tick' }]));
 
         expect(named).toEqual([{ name: 'l1_job', handler: 'tick', bodyRefusal: expect.stringMatching(/^body\.language: /) }]);
     });
@@ -438,7 +438,7 @@ describe('#21585: a job body the declaration refuses is judged as unrunnable —
         const h = harness();
         const jobs = [L1, TWO_LIMITS, GOOD, { name: 'handler_only', schedule: INTERVAL, handler: 'tick' }];
 
-        const named = new Set(collectJobsWithoutRunnableBody(pkg(jobs)).map((j) => j.name));
+        const named = new Set(collectJobsWithoutBody(pkg(jobs)).map((j) => j.name));
         await h.schedule(pkg(jobs));
 
         expect([...named].sort()).toEqual(['handler_only', 'l1_job', 'two_limits']);

packages/runtime/src/app-artifact-handlers.ts

@@ -68,7 +68,7 @@
  * A job runs on a JSON door only through a `body` that binds. Its deprecated
  * `handler` names a `defineStack({ functions })` entry, which is code: it
  * travels in the artifact's runtime module, which only `os start --artifact`
- * loads, so no JSON door can ever resolve it. {@link collectJobsWithoutRunnableBody}
+ * loads, so no JSON door can ever resolve it. {@link collectJobsWithoutBody}
  * names those jobs — and the ones whose `body` the declaration refuses
  * (`judgeJobBody`) — and the install-local install route refuses a package that
  * declares one enabled.
@@ -285,12 +285,14 @@ export function bindAppArtifactHandlers(
 // ─── The job half (#21489) ─────────────────────────────────────────────
 
 /**
- * An enabled job a JSON door cannot run: it carries no `body`, or a `body` the
- * declaration refuses. Its `handler` (deprecated) names a
+ * An enabled job a JSON door cannot run: it carries no `body` — or, since
+ * #21585, a `body` that does not BIND (the declaration refuses it: an expression
+ * body, or one carrying `body.timeoutMs`), which no door can run either. "Without
+ * body" reads as "without a body that runs". Its `handler` (deprecated) names a
  * `defineStack({ functions })` entry — code, which a JSON artifact never
  * carries (ADR-0088) — or it names nothing at all.
  */
-export interface JobWithoutRunnableBody {
+export interface JobWithoutBody {
     /** The job's `name`. */
     name: string;
     /** The function name the job's `handler` declares, when it declares one. */
@@ -305,18 +307,20 @@ export interface JobWithoutRunnableBody {
 
 /**
  * The enabled jobs of an artifact that no JSON door can schedule (#21489):
- * those with no `body`, and (#21585) those whose `body` does not bind — the
- * judgement the binder's own {@link jobBodyRunnerFactory} makes
- * ({@link judgeJobBody}, a parse against `JobSchema.body`), so the door and the
- * binder cannot disagree. The install-local install route refuses a package
- * that declares one; see the module header.
+ * those with no `body`, and (#21585) those whose `body` does not BIND — an
+ * expression (L1) body, or one carrying `body.timeoutMs`, or any other shape
+ * the declaration refuses. That second half is the judgement the binder's own
+ * {@link jobBodyRunnerFactory} makes ({@link judgeJobBody}, a parse against
+ * `JobSchema.body`), so the door and the binder cannot disagree; such a job is
+ * named with its `bodyRefusal`. The install-local install route refuses a
+ * package that declares one; see the module header.
  *
  * Reads the jobs the binder reads ({@link collectBundleJobs}), and calls a job
  * enabled exactly when the binder does: `enabled: false` is the one value that
  * disables it (the schema's default is `true`).
  */
-export function collectJobsWithoutRunnableBody(bundle: unknown): JobWithoutRunnableBody[] {
-    const out: JobWithoutRunnableBody[] = [];
+export function collectJobsWithoutBody(bundle: unknown): JobWithoutBody[] {
+    const out: JobWithoutBody[] = [];
     for (const job of collectBundleJobs(bundle)) {
         if (!job || typeof job !== 'object') continue;
         if (job.enabled === false) continue;
@@ -440,7 +444,7 @@ export interface AppArtifactJobScheduling {
  *   - else a `handler` → the `functions` entry it names, invoked with the
  *     in-process `JobHandlerContext` (#14094). A JSON artifact carries no
  *     functions, so on install-local this resolves nothing — which is why that
- *     door refuses the shape up front ({@link collectJobsWithoutRunnableBody});
+ *     door refuses the shape up front ({@link collectJobsWithoutBody});
  *   - else → not scheduled (warn).
  *
  * The schedule is lowered to the boundary tier (`toBoundaryJobSchedule`), and

packages/runtime/src/index.ts

@@ -68,7 +68,7 @@ export { AppPlugin, collectBundleHooks, collectBundleFunctions, collectBundleFun
 // hooks, under the owner `app:<appId>` — called by `AppPlugin.start` and by the
 // install-local plugin (`@objectstack/cloud-connection`) on install and rehydrate.
 // [#21489] …and its job half: `scheduleAppArtifactJobs` schedules a package's
-// jobs (a `body` runs sandboxed on every door), and `collectJobsWithoutRunnableBody`
+// jobs (a `body` runs sandboxed on every door), and `collectJobsWithoutBody`
 // names the enabled jobs no JSON door can run (no `body`, or one that does not
 // bind), which install-local refuses.
 // [#21585] `collectHooksWithoutBody` names the hooks whose code is only a
@@ -78,15 +78,15 @@ export {
     bindAppArtifactHandlers,
     appArtifactHandlerOwner,
     scheduleAppArtifactJobs,
-    collectJobsWithoutRunnableBody,
+    collectJobsWithoutBody,
     collectHooksWithoutBody,
 } from './app-artifact-handlers.js';
 export type {
     AppArtifactHandlerBinding,
     AppArtifactHandlerBindingOptions,
     AppArtifactJobScheduling,
     AppArtifactJobSchedulingOptions,
-    JobWithoutRunnableBody,
+    JobWithoutBody,
     HookWithoutBody,
 } from './app-artifact-handlers.js';
 // #14094 — what a DECLARATIVE job's handler is invoked with. A job has no graph,

packages/runtime/src/sandbox/body-runner.ts

@@ -491,7 +491,7 @@ export type JobBodyJudgement =
  *
  * Two readers, so they cannot disagree: {@link jobBodyRunnerFactory} binds
  * nothing for a body this refuses, and the install-local door refuses a
- * package whose enabled job carries one (`collectJobsWithoutRunnableBody` in
+ * package whose enabled job carries one (`collectJobsWithoutBody` in
  * `../app-artifact-handlers.ts`). Before the door asked, it judged only that a
  * `body` was PRESENT — an L1 expression body, or one carrying `timeoutMs`,
  * installed with a 200 and the job was never scheduled, with only a server