fix: classify pg hba no-encryption as ssl

scripts/src/dev-runtime-migration.mjs

@@ -638,6 +638,11 @@ function isMigrationSslError(error) {
     "ssl is not enabled",
     "ssl negotiation",
     "ssl off",
+    "ssl required",
+    "requires ssl",
+    "no ssl encryption",
+    "no encryption",
+    "hostssl",
     "server requires ssl",
     "before secure tls connection",
     "tls handshake"

scripts/src/dev-runtime-migration.test.mjs

@@ -55,7 +55,6 @@ test("live dry-run separates migration ledger blocker from auth and schema", asy
     parseArgs(["--dry-run", "--allow-live-db-read", "--confirm-dev"]),
     {
       env: {
-        HWLAB_CLOUD_DB_URL: "postgresql://hwlab:redacted@example.invalid:5432/hwlab",
         HWLAB_CLOUD_DB_SSL_MODE: "disable"
       },
       queryClient: createFakeQueryClient({ migrationReady: false }),
@@ -79,7 +78,6 @@ test("live dry-run separates SSL negotiation blocker from auth and schema", asyn
     parseArgs(["--dry-run", "--allow-live-db-read", "--confirm-dev"]),
     {
       env: {
-        HWLAB_CLOUD_DB_URL: "postgresql://hwlab:redacted@example.invalid:5432/hwlab",
         HWLAB_CLOUD_DB_SSL_MODE: "require"
       },
       queryClient: {
@@ -105,7 +103,41 @@ test("live dry-run separates SSL negotiation blocker from auth and schema", asyn
   assert.equal(report.blockers[0].evidence.blocker, "runtime_durable_adapter_ssl_blocked");
   assert.equal(report.runtime.blocker, "runtime_durable_adapter_ssl_blocked");
   assert.equal(report.runtime.connection.queryResult, "ssl_negotiation_blocked");
-  assert.equal(JSON.stringify(report).includes("redacted@example.invalid"), false);
+  assert.equal(JSON.stringify(report).includes("The server does not support SSL connections"), false);
+});
+
+test("live dry-run classifies pg_hba no-encryption rejection as SSL with ssl disabled", async () => {
+  const report = await buildDevRuntimeMigrationReport(
+    parseArgs(["--dry-run", "--allow-live-db-read", "--confirm-dev"]),
+    {
+      env: {
+        HWLAB_CLOUD_DB_SSL_MODE: "disable"
+      },
+      queryClient: {
+        async query(sql) {
+          assert.match(sql, /information_schema\.columns/u);
+          const error = new Error('no pg_hba.conf entry for host "[redacted]", user "[redacted]", database "[redacted]", no encryption');
+          error.code = "28000";
+          throw error;
+        }
+      },
+      now: () => "2026-05-22T00:00:00.000Z"
+    }
+  );
+
+  assert.equal(report.conclusion.status, "blocked");
+  assert.equal(report.actions.liveDbReadAttempted, true);
+  assert.equal(report.actions.liveDbWriteAttempted, false);
+  assert.equal(report.gates.auth.status, "not_checked");
+  assert.equal(report.gates.schema.status, "not_checked");
+  assert.equal(report.gates.migration.status, "not_checked");
+  assert.equal(report.gates.readiness.status, "not_checked");
+  assert.equal(report.blockers[0].scope, "runtime-migration-ssl");
+  assert.equal(report.blockers[0].evidence.blocker, "runtime_durable_adapter_ssl_blocked");
+  assert.equal(report.runtime.blocker, "runtime_durable_adapter_ssl_blocked");
+  assert.equal(report.runtime.connection.queryResult, "ssl_negotiation_blocked");
+  assert.equal(report.runtime.connection.errorCode, "28000");
+  assert.equal(JSON.stringify(report).includes("pg_hba.conf"), false);
 });
 
 test("apply mode records ledger and verifies durable runtime readiness", async () => {