@@ -614,7 +614,7 @@ describe('SqlDriver unique × tenancy (#3696)', () => {
       // bucket rather than rebuilding it…
       const second = await driver.create('template', { key: 'welcome' });
       expect(second.key).toBe('welcome');
-      expect(await driver.count('template', { where: { key: 'welcome' } } as any)).toBe(3);
+      expect(await driver.count('template', { where: { key: 'welcome' } })).toBe(3);
       // …while the organization itself is still held to one row per value.
       await expect(driver.create('template', { organization_id: 'org_a', key: 'welcome' })).rejects.toThrow(
         /UNIQUE constraint failed|duplicate key value/,
 
@@ -20414,6 +20414,8 @@ export class SqlDriver implements IDataDriver {
   private tenantKeyCertifiedResolver?: () => boolean | Promise<boolean>;
   /** Set once the resolver has answered yes — a certificate is never withdrawn. */
   private tenantKeyCertified?: true;
+  /** The resolver's failure is reported once per driver. */
+  private tenantKeyCertifiedReadFailureReported = false;
 
   /**
    * Asked lazily — only a table carrying the NULL-safe tenant key part needs
@@ -20429,7 +20431,18 @@ export class SqlDriver implements IDataDriver {
       // yet answers with a refused read, which is not a fault (see
       // {@link PRE_DDL_QUESTION_SCOPE}).
       if ((await PRE_DDL_QUESTION_SCOPE.run(true, resolver)) !== true) return false;
-    } catch {
+    } catch (e: any) {
+      // Not knowing reads as "not certified" — the reading that never proposes
+      // a rebuild on a guess — and is said once, so a drift report that then
+      // names an 18.0 index is not taken for a verdict on a certified store.
+      if (!this.tenantKeyCertifiedReadFailureReported) {
+        this.tenantKeyCertifiedReadFailureReported = true;
+        this.logger.warn(
+          `[schema-drift] could not read whether this database is certified for the organization-ownership shape ` +
+            `(${e?.message ?? e}); an index keyed COALESCE(<tenant>, …) on a nullable tenant column is compared ` +
+            `as a different constraint from the plain key until it can be read.`,
+        );
+      }
       return false;
     }
     this.tenantKeyCertified = true;
 
@@ -41,7 +41,7 @@ interface Sink {
   resolver: (() => Promise<boolean>) | null;
 }
 
-function boot(rows: Rows, opts: { sink?: Sink; readThrows?: boolean; withFlagObject?: boolean } = {}): ObjectQL {
+function boot(rows: Rows, opts: { sink?: Sink; readThrows?: string; withFlagObject?: boolean } = {}): ObjectQL {
   const driver: Record<string, unknown> = {
     name: 'default',
     version: '1.0.0',
@@ -52,7 +52,7 @@ function boot(rows: Rows, opts: { sink?: Sink; readThrows?: boolean; withFlagObj
       return typeof ast?.limit === 'number' ? found.slice(0, ast.limit) : found;
     },
     async findOne(_object: string, ast: any) {
-      if (opts.readThrows) throw new Error('relation "sys_migration" does not exist');
+      if (opts.readThrows) throw new Error(opts.readThrows);
       return rows.find((r) => matches(r, ast?.where)) ?? null;
     },
     async count() {
@@ -130,12 +130,21 @@ describe('[ADR-0131 D1] isOrganizationOwnershipCertified()', () => {
       'an older shape generation',
     ).toBe(false);
     expect(await boot([certified({ details: null })]).isOrganizationOwnershipCertified(), 'no generation named').toBe(false);
-    expect(await boot([certified()], { readThrows: true }).isOrganizationOwnershipCertified(), 'unreadable').toBe(false);
+    expect(
+      await boot([certified()], { readThrows: 'relation "sys_migration" does not exist' }).isOrganizationOwnershipCertified(),
+      'no ledger table yet',
+    ).toBe(false);
     expect(await boot([certified()], { withFlagObject: false }).isOrganizationOwnershipCertified(), 'no ledger object').toBe(
       false,
     );
   });
 
+  it('any other read failure is thrown, never answered as "not certified"', async () => {
+    await expect(boot([certified()], { readThrows: 'connection reset' }).isOrganizationOwnershipCertified()).rejects.toThrow(
+      'connection reset',
+    );
+  });
+
   it('registerDriver hands a driver with the seam a closure over the same reading', async () => {
     const rows: Rows = [];
     const sink: Sink = { resolver: null };
 
@@ -12223,8 +12223,10 @@ export class ObjectQL implements IObjectQLEngine {
    * shape — a verified `sys_migration` row for the ceremony's id (the birth
    * marker a store created from empty receives, or the ceremony's completion
    * marker) at this release's shape generation or above? The same reading the
-   * runtime's boot guard boots on. Every way of not knowing (no ledger object,
-   * no row, an unreadable read, an unverified or older row) answers `false`.
+   * runtime's boot guard boots on. No ledger object, no ledger table yet, no
+   * row, or an unverified or older row answers `false`. Any other read failure
+   * is thrown: "I could not check" is not "not certified", and the driver
+   * asking reports it (`SqlDriver.isTenantKeyCertified`).
    */
   async isOrganizationOwnershipCertified(): Promise<boolean> {
     if (!this._registry.getObject(DATA_MIGRATION_FLAG_OBJECT)) return false;
@@ -12241,8 +12243,10 @@ export class ObjectQL implements IObjectQLEngine {
         blocking: typeof row.blocking === 'number' ? row.blocking : Number(row.blocking ?? Number.NaN),
       });
       return verified && organizationOwnershipShapeGenerationOf(row.details) >= ORGANIZATION_OWNERSHIP_SHAPE_GENERATION;
-    } catch {
-      return false;
+    } catch (error) {
+      // A store whose ledger table does not exist yet has no certificate.
+      if (isMissingTableError(error, DATA_MIGRATION_FLAG_OBJECT)) return false;
+      throw error;
     }
   }