@@ -144,6 +144,23 @@ EQL's credentialed jobs (`test-eql.yml` lines 133–136 and 601–604) reach Cip
 
 There is also a convention mismatch. EQL reads all four values from `secrets`; this repo reads `CS_WORKSPACE_CRN` and `CS_CLIENT_ID` from `vars` and only the key material from `secrets` (`integration-supabase.yml`, `integration-prisma-next.yml`, `prisma-next-e2e.yml`). Port to this repo's convention or `require-cs-secrets` will report the CRN missing.
 
+### The credentials change WORKSPACE, not just variable plumbing — and two test constants are keyed to the workspace
+
+The finding above treats the credentials as a wiring problem. They are also an *identity* problem, which the first credentialed run found and this plan had not anticipated: `vars.CS_WORKSPACE_CRN` here names a different CipherStash workspace than the one EQL was developed against. Two pinned SteVec selectors are MACs of (column context, JSONPath) **under the workspace keyset**, so they re-pin on the move even though no Rust, no SQL and no fixture logic changed:
+
+- `tests/sqlx/src/fixtures/v3_doc_integer.rs::SELECTOR` — `fce8be75…` → `606a4a44…`, reported identically by two independent runs.
+- `tests/sqlx/src/fixtures/v3_ste_vec.rs::SEL_HELLO_OP` — same keying, value not yet observed.
+
+This is a known, accepted property rather than a defect: the module comment says supporting multiple workspaces "would require runtime selector resolution, which the static `ScalarType::column_expr()` seam cannot do — out of scope here." The consequence to record is that **these pins are now coupled to this repo's CI workspace**, so rotating `CS_WORKSPACE_CRN` re-pins them again, and a contributor running the suite against their own workspace will see the drift message and must not commit their local value.
+
+Three things this cost, all worth fixing rather than absorbing:
+
+1. **Only one of the two constants had a drift guard.** `v3_doc_integer` failed with one copy-pasteable "pinned X, live Y" message. `SEL_HELLO_OP` has no such guard, so its drift surfaces as wrong ANSWERS — `LB3` counting 0 distinct ops, ORDER BY arms returning insertion order — with the live value nowhere in the output. `v3_jsonb_sel_hello_op_matches_fixture` closes that asymmetry. It deliberately does **not** infer the replacement: it prints every op-carrying selector with a row count and `op`-length profile and states the discriminator, because guessing wrong re-pins to the wrong leaf silently — the exact bug already recorded in `SEL_HELLO_OP`'s own history, where it named `$.number` while claiming `$.hello` and survived because equality-only suites cannot separate the two.
+2. **The shards ran fail-fast**, so shard 1 reported 11 failures and skipped 643 of its 710 tests. One environmental fault therefore answered one question per CI round trip. `tasks/test/sqlx-partition.sh` now passes `--no-fail-fast` (nextest's own suggestion in that output); the cost is bounded because the shards run ~5s tests in parallel.
+3. **`tests/sqlx/src/selectors.rs` holds five more workspace-keyed constants (`ROOT`, `HELLO`, `N`, `ARRAY_ELEMENTS`, `ARRAY_ROOT`) with zero consumers** — `rg 'Selectors::'` finds no use outside their own definition — and no guard. They are stale against this workspace and nothing says so. Delete them or guard them before anything starts using them; a dead constant that is silently wrong is worse than a missing one. Not done here: it is unrelated to the failure and belongs in its own change.
+
+The other selector-shaped constants in the tree are **synthetic and unaffected** — `crates/eql-bindings/tests/*` and `tests/sqlx/tests/payload_schema_tests.rs` pair theirs with hand-made ciphertext literals and touch no keyset, and the `00000…01` / `deadbeef…` / `ffffffff…` literals in `v3_jsonb_tests.rs` are forged by construction.
+
 ### Three imported release workflows violate the no-caching rule — by omission, not by setting
 
 The global constraint is that publish workflows never restore the Actions cache. `release-plz.yml` complies explicitly:
 
@@ -37,7 +37,15 @@ test -f "${ARCHIVE_PATH}" \
 # the prebuilt binaries.
 echo "==> running nextest partition hash:${SHARD}/${SHARD_TOTAL} from ${ARCHIVE_PATH}"
 cd tests/sqlx
+# --no-fail-fast: this suite is sharded, and one environmental fault is enough to
+# blank a shard. When the workspace-keyed SteVec selector drifted on the move to
+# `cipherstash/stack`, shard 1 reported 11 failures and skipped 643 of its 710
+# tests — so the run answered "the selector is wrong" and nothing else, and every
+# further question cost another full CI round trip. Running to completion turns
+# that into one report per push. The cost is bounded: the shards run ~5s tests in
+# parallel, so a fully-failing shard finishes in a couple of minutes.
 cargo nextest run \
   --archive-file "${ARCHIVE_PATH}" \
   --workspace-remap "${REPO_ROOT}" \
+  --no-fail-fast \
   --partition "hash:${SHARD}/${SHARD_TOTAL}"
@@ -62,6 +62,7 @@ v3_jsonb_root_gte_blocker
 v3_jsonb_root_lt_blocker
 v3_jsonb_root_lte_blocker
 v3_jsonb_root_neq_blocker
+v3_jsonb_sel_hello_op_matches_fixture
 v3_jsonb_single_entry_containment_is_blocked
 v3_jsonb_ste_vec_entry_payload_check
 v3_jsonb_ste_vec_query_payload_check
 
@@ -46,7 +46,17 @@ const FIELD: &str = "field";
 /// derived from the workspace keyset + the fixed STE_VEC_PREFIX + the `field`
 /// path, so it is stable for a given CipherStash workspace; if it drifts,
 /// regenerate the fixture and re-pin from the emitted `"s"`.
-pub const SELECTOR: &str = "fce8be759db230351b10a058b7ba50a7";
+///
+/// **Pinned to this repo's CI workspace** (`vars.CS_WORKSPACE_CRN`), which is
+/// not the workspace the suite was developed against. The value below replaced
+/// `fce8be759db230351b10a058b7ba50a7` when the suite moved here from
+/// `cipherstash/encrypt-query-language`: the selector is keyed by the workspace
+/// keyset, so absorbing the repo re-pinned it even though no Rust, no SQL and
+/// no fixture logic changed. That is a property of the design, not a defect —
+/// `jsonb_entry_integer_selector_matches_fixture` exists precisely to report it
+/// as one copy-pasteable message. A contributor running the suite against their
+/// own workspace will see that message and should NOT commit their local value.
+pub const SELECTOR: &str = "606a4a449a26442d80915f78d142694f";
 
 /// Build the plaintext documents: `{"field": <value>}` per integer fixture value,
 /// paired with the bare integer oracle value.
 
@@ -649,6 +649,81 @@ async fn v3_jsonb_ord_ope_term_entry_branches(pool: PgPool) -> anyhow::Result<()
     Ok(())
 }
 
+// ============================================================================
+// Drift guard for the workspace-keyed `$.hello` op selector.
+//
+// `SEL_HELLO_OP` is a MAC of (column context, JSONPath) under the workspace
+// keyset, so regenerating the fixture against a different CipherStash workspace
+// re-pins it. Its sibling `v3_doc_integer::SELECTOR` has carried such a guard
+// since upstream; this constant did not, and the asymmetry has a cost: when the
+// suite moved to `cipherstash/stack` the workspace changed, every
+// `payload -> SEL_HELLO_OP` lookup returned NULL, and the suite reported wrong
+// ANSWERS — LB3 counting 0 distinct ops, ordering arms seeing unordered rows —
+// rather than the one wrong CONSTANT behind all of them.
+//
+// The live selector cannot be derived without credentials, so on failure this
+// prints every op-carrying selector with the profile needed to pick the right
+// one. It deliberately does NOT choose automatically: guessing wrong would
+// re-pin to the wrong leaf silently, which is the exact bug recorded in
+// `v3_ste_vec::SEL_HELLO_OP`'s history (it once named `$.number` while claiming
+// `$.hello`, and survived because equality-only suites cannot separate them).
+//
+// `$.hello` is the selector on all 10 rows whose `op` length takes exactly TWO
+// values in a 9/1 split: a string op term is 8 * (len + 1) + 1 bits, and the
+// values are `world-1`..`world-9` (equal length) plus the one-longer
+// `world-10`. `$.number` and `$.large` are fixed-width numeric terms (one
+// length), `$.accented` spans four, and `$.empty` / `$.nested.deep` are
+// constant.
+// ============================================================================
+
+#[sqlx::test(fixtures(path = "../fixtures", scripts("v3_ste_vec")))]
+async fn v3_jsonb_sel_hello_op_matches_fixture(pool: PgPool) -> anyhow::Result<()> {
+    let carrying: i64 = sqlx::query_scalar(&format!(
+        "SELECT count(*) FROM fixtures.v3_ste_vec f \
+         WHERE EXISTS ( \
+           SELECT 1 FROM jsonb_array_elements(f.payload::jsonb->'sv') e \
+           WHERE e->>'s' = '{SEL_HELLO_OP}' AND e ? 'op' \
+         )"
+    ))
+    .fetch_one(&pool)
+    .await?;
+
+    if carrying == 10 {
+        return Ok(());
+    }
+
+    let menu: Vec<(String, i64, i64, i64, i64)> = sqlx::query_as(
+        "SELECT e->>'s', \
+                count(DISTINCT f.id), \
+                count(DISTINCT length(e->>'op')), \
+                min(length(e->>'op'))::bigint, \
+                max(length(e->>'op'))::bigint \
+         FROM fixtures.v3_ste_vec f, jsonb_array_elements(f.payload::jsonb->'sv') e \
+         WHERE e ? 'op' \
+         GROUP BY 1 ORDER BY 1",
+    )
+    .fetch_all(&pool)
+    .await?;
+
+    let table = menu
+        .iter()
+        .map(|(sel, rows, lengths, lo, hi)| {
+            format!("    {sel}  rows={rows} distinct_op_lengths={lengths} min={lo} max={hi}")
+        })
+        .collect::<Vec<_>>()
+        .join("\n");
+
+    anyhow::bail!(
+        "v3_ste_vec $.hello op-selector drifted from the pinned constant.\n  \
+         pinned v3_ste_vec::SEL_HELLO_OP = {SEL_HELLO_OP}\n  \
+         carries `op` on {carrying}/10 rows (want 10)\n  \
+         live op-carrying selectors:\n{table}\n\
+         The SteVec selector is keyed by the CipherStash workspace. Pick the entry with \
+         rows=10 and distinct_op_lengths=2 (the 9/1 `world-1..9` vs `world-10` split), \
+         re-pin SEL_HELLO_OP to it, and re-run.",
+    )
+}
+
 /// LB1–LB3 structural invariants of the GENERATED fixture, asserted directly
 /// (the containment / index oracles only imply them). This is the "generated
 /// fixture matches the load-bearing properties" guard, and it doubles as the