@@ -154,16 +154,7 @@ impl IngestError {
         if let IngestError::Http { body, .. } = self {
             match util::error_code(body).as_deref() {
                 Some("destination_table_conflict") => {
-                    let conflicting = util::error_detail(body, "conflicting_ingest_id")
-                        .unwrap_or_else(|| "<ingest-id>".into());
-                    eprintln!(
-                        "{}",
-                        format!(
-                            "A continuous ingest already owns that table. Release it with: \
-                             hotdata ingest delete {conflicting}"
-                        )
-                        .dark_grey()
-                    );
+                    eprintln!("{}", table_conflict_hint(body).dark_grey());
                 }
                 // The destination is per-family, and the pair of flags that
                 // build it is the thing to re-read: a family lands one table
@@ -215,6 +206,46 @@ impl IngestError {
     }
 }
 
+/// What to DO about a destination-table conflict, chosen from what the service
+/// reported about the ingest already holding the reservation.
+///
+/// The server's message says what happened and which release rule applies; this
+/// only names the command. It has to read the reported holder rather than
+/// assume one, because the rule covers a saved load of any kind and the kinds
+/// release differently — a hint naming one kind unconditionally contradicts the
+/// message printed directly above it, and prescribing a delete for a holder
+/// that is about to release on its own tears down a live load for nothing.
+fn table_conflict_hint(body: &str) -> String {
+    let conflicting =
+        util::error_detail(body, "conflicting_ingest_id").unwrap_or_else(|| "<ingest-id>".into());
+    let releases_itself = matches!(
+        util::error_detail(body, "conflicting_ingest_type").as_deref(),
+        Some("one_time") | Some("scheduled")
+    );
+    // An empty reservation is the holder taking the source's own table names,
+    // and it is the one conflict the caller can settle without touching the
+    // holder: a prefix makes two loads unable to reach the same name. The
+    // server names the JSON field; this names the flag that fills it.
+    let unprefixed =
+        util::error_detail(body, "reserved_table").is_some_and(|reserved| reserved.is_empty());
+    let mut hint = if unprefixed {
+        "Give this ingest a --dest-table-prefix so the two cannot land the same table".to_string()
+    } else if releases_itself {
+        format!(
+            "That ingest frees the table when it finishes or is stopped — check it with: \
+             hotdata ingest show {conflicting}"
+        )
+    } else {
+        format!("Free the table with: hotdata ingest delete {conflicting}")
+    };
+    if unprefixed || releases_itself {
+        hint.push_str(&format!(
+            ", or take the table now with: hotdata ingest delete {conflicting}"
+        ));
+    }
+    hint
+}
+
 /// Ingest client bound to a workspace + a resolved bearer token.
 pub struct IngestClient {
     /// `{api_url}/ingest` — api_url already carries the `/v1` suffix.
@@ -650,6 +681,17 @@ pub struct ValidateResponse {
     pub normalized_config: Option<serde_json::Value>,
     #[serde(default)]
     pub discovered: Option<serde_json::Value>,
+    /// Whether anything actually connected to the source.
+    ///
+    /// `valid` answers the narrower question of whether the config and
+    /// credentials PARSE. A family with no read-only probe, and a credential
+    /// shape no client can be built from, are both `valid: true` having
+    /// reached nothing — so this is the field that separates a config that
+    /// checked out from a credential that works, and the reason it is decoded
+    /// rather than dropped is that `-o json` is this struct serialized.
+    #[serde(default)]
+    pub probed: Option<bool>,
+    /// Why the probe did not run, when it did not.
     #[serde(default)]
     pub detail: Option<String>,
 }
@@ -1145,6 +1187,64 @@ mod tests {
         IngestClient::from_parts(&server.url(), "eyJ.fake.jwt", false, "ws-1")
     }
 
+    // --- the destination-conflict hint -------------------------------------
+
+    fn conflict_body(kind: &str, reserved: &str) -> String {
+        format!(
+            r#"{{"error":{{"code":"destination_table_conflict","message":"...",
+                "details":{{"conflicting_ingest_id":"ing_held",
+                            "conflicting_ingest_type":"{kind}",
+                            "reserved_table":"{reserved}"}}}}}}"#
+        )
+    }
+
+    /// The three cases differ in what the caller can do about them, and the
+    /// hint has to differ with them: a holder that never releases on its own,
+    /// one that does, and a reservation the caller can step around entirely.
+    #[test]
+    fn conflict_hint_prescribes_a_delete_only_where_nothing_else_frees_the_table() {
+        let hint = table_conflict_hint(&conflict_body("continuous", "orders_raw"));
+        assert_eq!(hint, "Free the table with: hotdata ingest delete ing_held");
+    }
+
+    #[test]
+    fn conflict_hint_says_a_finishing_holder_frees_the_table_itself() {
+        for kind in ["one_time", "scheduled"] {
+            let hint = table_conflict_hint(&conflict_body(kind, "orders_raw"));
+            assert!(
+                hint.starts_with("That ingest frees the table when it finishes or is stopped"),
+                "{kind}: {hint}"
+            );
+            // Delete stays reachable — it is the way to take the table NOW —
+            // but as the second option rather than the prescription.
+            assert!(hint.ends_with("hotdata ingest delete ing_held"), "{hint}");
+        }
+    }
+
+    /// An empty `reserved_table` is the holder taking the source's own table
+    /// names. It is the only conflict with a remedy that touches nothing else,
+    /// and the remedy is a flag this CLI owns the spelling of.
+    #[test]
+    fn conflict_hint_offers_a_prefix_when_the_reservation_is_the_raw_names() {
+        let hint = table_conflict_hint(&conflict_body("one_time", ""));
+        assert!(
+            hint.starts_with("Give this ingest a --dest-table-prefix"),
+            "{hint}"
+        );
+    }
+
+    /// A server that reports no holder type still gets a usable hint rather
+    /// than a claim about a type nobody reported.
+    #[test]
+    fn conflict_hint_falls_back_to_delete_when_the_holder_type_is_absent() {
+        let body = r#"{"error":{"code":"destination_table_conflict","message":"...",
+                       "details":{"conflicting_ingest_id":"ing_held"}}}"#;
+        assert_eq!(
+            table_conflict_hint(body),
+            "Free the table with: hotdata ingest delete ing_held"
+        );
+    }
+
     // --- datasources -------------------------------------------------------
 
     #[test]
 
@@ -31,8 +31,11 @@
 //! nothing a script does changed.
 //!
 //! **Presentation contract:** `validate` persists nothing and is the preflight
-//! path; `create` validates again regardless. Secrets are never echoed back by
-//! the server, never printed here, and never shown while being typed.
+//! path; `create` validates again regardless. `valid` and `probed` are printed
+//! as two lines because they are two answers — the config parsed, and the
+//! source was contacted — and only the second one is what "do these
+//! credentials work?" is asking. Secrets are never echoed back by the server,
+//! never printed here, and never shown while being typed.
 
 use crate::client::ingest::{
     Capabilities, ConfigUpdate, ConnectorEntry, Datasource, DatasourceConfig, FamilyReference,
@@ -52,6 +55,12 @@ pub enum DatasourceCommands {
     /// Persists no datasource, config version, managed database, or secret —
     /// run it before `create` to see what the credentials can reach. The
     /// response carries family-specific discovery (schemas/tables, topics, …).
+    ///
+    /// Two lines answer two questions. `valid` says the config and credentials
+    /// were accepted; `probed` says whether the source was actually contacted,
+    /// which is the one that means the credentials work. Some families have no
+    /// read-only probe and can only be checked for shape — they report `valid:
+    /// yes` with `probed: no` and a detail saying why.
     Validate {
         /// Source family — the shape of --config: sql, filesystem, iceberg,
         /// delta, ducklake, kafka, rest. Use `sql` for any SQL dialect (the
@@ -431,6 +440,7 @@ fn validate(workspace_id: &str, output: &str, family: &str, payload: ConfigArgs)
         } else {
             field("valid:", &"no".red().to_string());
         }
+        field("probed:", &probed_cell(resp.probed));
         field("family:", &cell(resp.family.as_deref()));
         if let Some(d) = resp.detail.as_deref().filter(|d| !d.trim().is_empty()) {
             field("detail:", d);
@@ -449,6 +459,32 @@ fn validate(workspace_id: &str, output: &str, family: &str, payload: ConfigArgs)
     }
 }
 
+/// PROBED — whether the source was contacted, printed on its own line beside
+/// `valid`.
+///
+/// A command called `validate` answering `valid: yes` is read as "the
+/// credentials work", and for some families it does not mean that: one with no
+/// read-only probe, and a credential shape no client can be built from, both
+/// check the config's SHAPE and connect to nothing. The response has always
+/// distinguished the two, but only through a detail line that appears when the
+/// probe was skipped — so the reader had to infer a negative from the absence
+/// of an explanation, and the reading that requires noticing nothing is the
+/// reading nobody performs. Stating it is what makes a preflight worth running.
+///
+/// Absent is its own answer rather than a `no`: a response that does not carry
+/// the field says nothing about the probe, and printing "no" there would be
+/// this command inventing the very claim it exists to report.
+fn probed_cell(probed: Option<bool>) -> String {
+    use crossterm::style::{Color, Stylize};
+    match probed {
+        Some(true) => "yes — the source answered".with(Color::Green).to_string(),
+        Some(false) => "no — nothing connected; the config's shape was checked"
+            .with(Color::Yellow)
+            .to_string(),
+        None => "not reported".with(Color::DarkGrey).to_string(),
+    }
+}
+
 // --- create -----------------------------------------------------------------
 
 fn create(
@@ -1429,6 +1465,51 @@ mod tests {
         assert_eq!(config, serde_json::json!({"root_uri": "hdfs://nn/data"}));
     }
 
+    /// `valid` and `probed` are two answers, and the second is the one a user
+    /// came for. A source that was never contacted must say so in words, not
+    /// by omitting a line somebody has to notice is missing.
+    #[test]
+    fn validate_states_whether_the_source_was_contacted() {
+        let connected = strip_ansi(&probed_cell(Some(true)));
+        assert!(connected.contains("yes"), "{connected}");
+        assert!(connected.contains("answered"), "{connected}");
+
+        // The case the line exists for: valid, and nothing reached.
+        let shape_only = strip_ansi(&probed_cell(Some(false)));
+        assert!(shape_only.starts_with("no"), "{shape_only}");
+        assert!(shape_only.contains("nothing connected"), "{shape_only}");
+        assert!(shape_only.contains("shape"), "{shape_only}");
+
+        // A response that does not carry the field is not a probe that failed.
+        let unknown = strip_ansi(&probed_cell(None));
+        assert!(unknown.contains("not reported"), "{unknown}");
+        assert!(!unknown.contains("no "), "{unknown}");
+    }
+
+    /// `-o json` is the struct serialized, so a field the struct drops is a
+    /// field a script cannot read however faithfully the service sends it.
+    #[test]
+    fn the_validate_response_carries_the_probe_through_to_json() {
+        let body = serde_json::json!({
+            "valid": true,
+            "family": "rest",
+            "normalized_config": {"base_url": "https://api.example.com"},
+            "discovered": null,
+            "probed": false,
+            "detail": "this family has no read-only probe",
+        });
+        let resp: crate::client::ingest::ValidateResponse = serde_json::from_value(body).unwrap();
+        assert!(resp.valid);
+        assert_eq!(resp.probed, Some(false));
+
+        let rendered = serde_json::to_value(&resp).unwrap();
+        assert_eq!(rendered["probed"], false);
+        assert_eq!(
+            strip_ansi(&probed_cell(resp.probed)),
+            "no — nothing connected; the config's shape was checked"
+        );
+    }
+
     #[test]
     fn discovered_lines_render_schema_qualified_tables() {
         let d = serde_json::json!({