fix(eql): re-pin SEL_HELLO_OP to this repo's CI workspace

b325a0c7… -> 6f1db3bd…, the second and last of the workspace-keyed SteVec
selectors. The new drift guard reported the candidates instead of choosing
one, so the leaf is identified rather than guessed: at 16 * len + 20 hex
chars all six op-carrying leaves reconcile against the fixture's known
documents — $.empty 20, $.accented 84/180/196 (three lengths, not four,
because the café/cafe collision pair shares one), $.nested.deep 148 for
"constant", $.number and $.large a fixed-width 132, and $.hello alone
spanning 132/148 for world-1..9 vs world-10.

--no-fail-fast paid for itself immediately: the run reported all seven
remaining failures at once (695/671/655 tests per shard, shard 1 fully
green) and every one is a SEL_HELLO_OP consumer, so this is expected to be
the last of it rather than the next round of one.

Author: tobyhede

docs/plans/2026-08-13-eql-monorepo-absorption.md

@@ -149,7 +149,9 @@ There is also a convention mismatch. EQL reads all four values from `secrets`; t
 The finding above treats the credentials as a wiring problem. They are also an *identity* problem, which the first credentialed run found and this plan had not anticipated: `vars.CS_WORKSPACE_CRN` here names a different CipherStash workspace than the one EQL was developed against. Two pinned SteVec selectors are MACs of (column context, JSONPath) **under the workspace keyset**, so they re-pin on the move even though no Rust, no SQL and no fixture logic changed:
 
 - `tests/sqlx/src/fixtures/v3_doc_integer.rs::SELECTOR` — `fce8be75…` → `606a4a44…`, reported identically by two independent runs.
-- `tests/sqlx/src/fixtures/v3_ste_vec.rs::SEL_HELLO_OP` — same keying, value not yet observed.
+- `tests/sqlx/src/fixtures/v3_ste_vec.rs::SEL_HELLO_OP` — `b325a0c7…` → `6f1db3bd…`, identified from the new guard's report.
+
+The identification is over-determined rather than rule-matched, which is the standard a silent mis-pin deserves. The guard printed all six `op`-carrying leaves, and at `16 * len + 20` hex chars every one reconciles against the fixture's known documents: `$.empty` 20, `$.accented` 84/180/196 — three lengths rather than four, because the `café`/`cafe` collision pair the fixture exists to carry shares one — `$.nested.deep` 148 for `"constant"`, `$.number` and `$.large` a fixed-width 132, and `$.hello` alone spanning 132/148 for `world-1..9` vs `world-10`.
 
 This is a known, accepted property rather than a defect: the module comment says supporting multiple workspaces "would require runtime selector resolution, which the static `ScalarType::column_expr()` seam cannot do — out of scope here." The consequence to record is that **these pins are now coupled to this repo's CI workspace**, so rotating `CS_WORKSPACE_CRN` re-pins them again, and a contributor running the suite against their own workspace will see the drift message and must not commit their local value.
 

packages/eql/tests/sqlx/src/fixtures/v3_ste_vec.rs

@@ -48,7 +48,21 @@ const NAME: &str = "v3_ste_vec";
 /// `op` is `8 * (len + 1) + 1` bits, so `$.hello` is 132 hex chars for
 /// `"world-1"`..`"world-9"` and 148 for `"world-10"`, while `$.number` is a
 /// fixed-width 65-bit number term — 132 on every row.
-pub const SEL_HELLO_OP: &str = "b325a0c77b130af97b805c12ff853ab3";
+///
+/// **Pinned to this repo's CI workspace** (`vars.CS_WORKSPACE_CRN`). The value
+/// below replaced `b325a0c77b130af97b805c12ff853ab3` when the suite moved here
+/// from `cipherstash/encrypt-query-language`: a different workspace means a
+/// different keyset, so the MAC re-pinned with no Rust, SQL or fixture change.
+/// `v3_jsonb_sel_hello_op_matches_fixture` is the drift guard; it reports the
+/// live candidates rather than choosing, so the leaf is identified by the
+/// length rule above, not guessed. Against that workspace the fixture's six
+/// `op`-carrying leaves separate cleanly at `16 * len + 20` hex chars —
+/// `$.empty` 20, `$.accented` 84/180/196 (three lengths, not four: the
+/// `café`/`cafe` collision pair shares one), `$.nested.deep` 148,
+/// `$.number` and `$.large` a fixed 132, and `$.hello` alone spanning 132/148.
+/// A contributor running against their own workspace will see the guard fire
+/// and should NOT commit their local value.
+pub const SEL_HELLO_OP: &str = "6f1db3bd70058dc4dab95cc692599b12";
 
 /// The canonical `payload` column type — the `public.eql_v3_json_search` DOMAIN, so the
 /// domain CHECK runs when the fixture loads.