From 6a14989c03bee1051ae3669dcf810c961e2fdd9c Mon Sep 17 00:00:00 2001
From: Code Queue Review <code-queue-review@localhost>
Date: Sat, 23 May 2026 06:53:00 +0000
Subject: [PATCH] test: classify durable runtime auth blocker

---
 scripts/src/dev-runtime-migration.test.mjs | 35 ++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/scripts/src/dev-runtime-migration.test.mjs b/scripts/src/dev-runtime-migration.test.mjs
index fa7d1e7c..421beaef 100644
--- a/scripts/src/dev-runtime-migration.test.mjs
+++ b/scripts/src/dev-runtime-migration.test.mjs
@@ -106,6 +106,41 @@ test("live dry-run separates SSL negotiation blocker from auth and schema", asyn
   assert.equal(JSON.stringify(report).includes("The server does not support SSL connections"), false);
 });
 
+test("live dry-run classifies fixture 28P01 as auth before schema or migration", async () => {
+  const report = await buildDevRuntimeMigrationReport(
+    parseArgs(["--dry-run", "--allow-live-db-read", "--confirm-dev"]),
+    {
+      env: {
+        HWLAB_CLOUD_DB_SSL_MODE: "disable"
+      },
+      queryClient: {
+        async query(sql) {
+          assert.match(sql, /information_schema\.columns/u);
+          const error = new Error("fixture auth failure");
+          error.code = "28P01";
+          throw error;
+        }
+      },
+      now: () => "2026-05-23T00:00:00.000Z"
+    }
+  );
+
+  assert.equal(report.conclusion.status, "blocked");
+  assert.equal(report.actions.liveDbReadAttempted, true);
+  assert.equal(report.actions.liveDbWriteAttempted, false);
+  assert.equal(report.gates.auth.status, "blocked");
+  assert.equal(report.gates.schema.status, "not_checked");
+  assert.equal(report.gates.migration.status, "not_checked");
+  assert.equal(report.gates.readiness.status, "not_checked");
+  assert.equal(report.blockers[0].scope, "runtime-migration-auth");
+  assert.equal(report.blockers[0].evidence.blocker, "runtime_durable_adapter_auth_blocked");
+  assert.equal(report.runtime.blocker, "runtime_durable_adapter_auth_blocked");
+  assert.equal(report.runtime.connection.queryResult, "auth_blocked");
+  assert.equal(report.runtime.connection.errorCode, "28P01");
+  assert.equal(report.safety.fixtureEvidenceAllowed, false);
+  assert.equal(JSON.stringify(report).includes("fixture auth failure"), false);
+});
+
 test("live dry-run classifies pg_hba no-encryption rejection as SSL with ssl disabled", async () => {
   const report = await buildDevRuntimeMigrationReport(
     parseArgs(["--dry-run", "--allow-live-db-read", "--confirm-dev"]),