fix(source): 원격 prefer 연결의 암호화 판정을 서버 자기 보고 대신 클라이언트 TLS 협상 결과로 한다

README.ko.md

@@ -95,11 +95,15 @@ Unix 소켓이나 루프백 주소(`127.0.0.0/8`, `::1`, `localhost`)가 아닌
 암호화하지 않은 연결로 카탈로그를 읽으면, catalog document와 그래프에
 `connection-not-encrypted:` limitation이 남습니다. 이런 호스트에서는
 `sslmode=disable`, `sslmode=allow`, `ssl-mode=DISABLED`가 항상 이 limitation을
-남깁니다. 기본 모드에서는 reader가 세션의 TLS 사용 여부를 서버에
-묻습니다(`pg_stat_ssl`, `Ssl_cipher`). 서버가 답하지 못하면 암호화를 확인하지
-못했다고 limitation에 적습니다. 커넥션 풀러나 프록시 뒤에서는 이 답이 풀러와
-서버 사이 연결을 말하므로, 암호화가 반드시 필요하면 verify 모드를 씁니다. 이
-limitation은 `catalog_complete`를 바꾸지 않습니다.
+남깁니다. 기본 모드에서는 reader가 이런 호스트에 먼저 `sslmode=require`·
+`ssl-mode=REQUIRED`처럼 접속하고, 서버가 TLS를 거절했을 때만 TLS 없이 다시
+접속합니다. 이때 limitation은 서버가 TLS를 받지 않았다고 적습니다. TLS
+핸드셰이크가 실패하면 그대로 종료 코드 2로 끝납니다. reader는 서버가 알려 주는
+세션 정보가 아니라 자기가 직접 한 TLS 협상 결과로 판정하므로, reader 쪽 TLS만
+거절하는 프록시가 이 limitation을 숨길 수 없습니다. 이 limitation은 reader 자신의
+연결을 말하며, 커넥션 풀러나 프록시가 DB로 잇는 연결은 다루지 않습니다. 암호화가
+반드시 필요하면 verify 모드를 씁니다. 이 limitation은 `catalog_complete`를 바꾸지
+않습니다.
 
 JDBC 기본 수집 범위는 드라이버가 제공하는 스키마·테이블·컬럼·키·인덱스·루틴
 메타데이터입니다. 본문과 사용 통계의 수집 범위는 DB 방언, 권한, 사용 가능한

README.md

@@ -104,12 +104,16 @@ When a catalog is read over an unencrypted connection to a host other than a
 Unix socket or a loopback address (`127.0.0.0/8`, `::1`, or `localhost`), the
 catalog document and graph record a `connection-not-encrypted:` limitation.
 For such a host, `sslmode=disable`, `sslmode=allow`, and `ssl-mode=DISABLED`
-always record it. In the default mode the reader asks the server whether the
-session uses TLS (`pg_stat_ssl`, `Ssl_cipher`); if the server cannot answer,
-the limitation says that encryption could not be confirmed. Behind a
-connection pooler or proxy, that answer describes the pooler's connection to
-the server, so use a verify mode when the connection must be encrypted. The
-limitation does not change `catalog_complete`.
+always record it. In the default mode the reader first connects to such a
+host as `sslmode=require` / `ssl-mode=REQUIRED` does, and reconnects without
+TLS only when the server refuses TLS; the limitation then says that the server
+did not accept TLS. A failed TLS handshake still ends the scan with exit code
+2. The reader decides from its own TLS negotiation, not from the server's
+report of the session, so a proxy that refuses TLS toward the reader cannot
+hide the limitation. The limitation describes the reader's own connection,
+not a pooler's or proxy's onward connection to the database; use a verify
+mode when the connection must be encrypted. The limitation does not change
+`catalog_complete`.
 
 The JDBC baseline collects schemas, tables, columns, keys, indexes, and
 routine metadata exposed by the driver. Body and usage collection depend on

RELEASE-NOTES.md

@@ -49,11 +49,15 @@ These changes are not yet in a published release.
   socket or a loopback address (`127.0.0.0/8`, `::1`, `localhost`) records a
   `connection-not-encrypted:` limitation in the catalog document and the graph.
   `sslmode=disable`, `sslmode=allow`, and `ssl-mode=DISABLED` always record it
-  for such a host. In the default mode the reader asks the server whether the
-  session uses TLS (`pg_stat_ssl`, `Ssl_cipher`); if the server cannot answer,
-  the limitation says that encryption could not be confirmed. Loopback and
-  Unix-socket scans, including the fixtures, produce the same output as before,
-  and `catalog_complete` is unchanged.
+  for such a host. In the default mode the reader first connects to such a
+  host as `sslmode=require` / `ssl-mode=REQUIRED` does and reconnects without
+  TLS only when the server refuses TLS; the limitation then says that the
+  server did not accept TLS. The reader decides from its own TLS negotiation,
+  not from the server's report of the session, so a proxy that refuses TLS
+  toward the reader cannot hide the limitation. The limitation describes the
+  reader's own connection, not the onward connection from a pooler or proxy
+  to the database. Loopback and Unix-socket scans, including the fixtures,
+  produce the same output as before, and `catalog_complete` is unchanged.
 - New dependencies, pinned by `engine/Cargo.lock`: rustls 0.23.43,
   rustls-webpki 0.103.14, rustls-pki-types 1.15.1, ring 0.17.14, untrusted
   0.9.0, and webpki-roots 0.26.11 and 1.0.10. The root certificate data in
@@ -86,9 +90,8 @@ These changes are not yet in a published release.
 - A native PostgreSQL or MySQL/MariaDB scan of a host that is not a Unix
   socket or a loopback address now adds a `connection-not-encrypted:`
   limitation to the catalog document and the graph when the catalog was read
-  over an unencrypted connection or encryption could not be confirmed (details
-  under Security). Loopback and Unix-socket scans, including the fixtures, keep
-  their output.
+  over an unencrypted connection (details under Security). Loopback and
+  Unix-socket scans, including the fixtures, keep their output.
 - Cache format version 4 makes existing `--cache-dir` entries miss once; the
   next scan rewrites them. Caches restored from another machine or CI run are
   reused only when they were written with the same `SCHEMAGRAPH_CACHE_KEY`.