diff --git a/.changeset/pre.json b/.changeset/pre.json
index 40e6d09fa..7ddcdffb1 100644
--- a/.changeset/pre.json
+++ b/.changeset/pre.json
@@ -24,7 +24,9 @@
   "changesets": [
     "adapter-package-split",
     "adapter-split-skills",
+    "cli-anonymous-telemetry",
     "cli-eql-v3-single-bundle",
+    "drizzle-legacy-readme-pointer",
     "eql-v3-adapter-type-robustness",
     "eql-v3-bigint-domains",
     "eql-v3-bundle-from-package",
@@ -34,10 +36,12 @@
     "eql-v3-drizzle",
     "eql-v3-ffi-0-28-concrete-types",
     "eql-v3-ga-rebaseline",
+    "eql-v3-json-selector",
     "eql-v3-json-skills",
     "eql-v3-json",
     "eql-v3-public-domains",
     "eql-v3-rename-contains-to-matches",
+    "eql-v3-sole-docs",
     "eql-v3-supabase-adapter",
     "eql-v3-text-search",
     "eql-v3-typed-client",
@@ -47,6 +51,7 @@
     "remove-secrets-leftovers",
     "rename-db-install-to-eql-install",
     "schema-stevec-standard-pin",
+    "skills-identity-docs-refresh",
     "stack-1-0-0-rc",
     "stack-adapter-kit",
     "stash-cli-eql-v3-default",
@@ -58,7 +63,10 @@
     "supabase-in-list-operands",
     "supabase-is-null-operands",
     "supabase-or-string-parser",
+    "supabase-v3-json-querying",
     "supabase-v3-order-by-ope-term",
-    "wizard-allow-env-templates"
+    "v3-supabase-needle-lockcontext-errors",
+    "wizard-allow-env-templates",
+    "wizard-analytics-privacy"
   ]
 }
diff --git a/e2e/CHANGELOG.md b/e2e/CHANGELOG.md
index c213cf7b0..5ffa7eba1 100644
--- a/e2e/CHANGELOG.md
+++ b/e2e/CHANGELOG.md
@@ -1,5 +1,22 @@
 # @cipherstash/e2e
 
+## 0.0.3-rc.1
+
+### Patch Changes
+
+- Updated dependencies [134fd43]
+- Updated dependencies [3fdd740]
+- Updated dependencies [59b994e]
+- Updated dependencies [e297f64]
+- Updated dependencies [40ab142]
+- Updated dependencies [5fe9a2f]
+- Updated dependencies [7b53141]
+- Updated dependencies [d8e0c1d]
+  - stash@1.0.0-rc.1
+  - @cipherstash/drizzle@3.0.4-rc.1
+  - @cipherstash/stack@1.0.0-rc.1
+  - @cipherstash/wizard@0.5.0-rc.1
+
 ## 0.0.3-rc.0
 
 ### Patch Changes
diff --git a/e2e/package.json b/e2e/package.json
index 800cec15f..e5a05e3ff 100644
--- a/e2e/package.json
+++ b/e2e/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cipherstash/e2e",
-  "version": "0.0.3-rc.0",
+  "version": "0.0.3-rc.1",
   "private": true,
   "description": "End-to-end tests that exercise built CipherStash binaries and cross-package behaviour.",
   "type": "module",
diff --git a/examples/basic/CHANGELOG.md b/examples/basic/CHANGELOG.md
index e53d0faa3..80c21be04 100644
--- a/examples/basic/CHANGELOG.md
+++ b/examples/basic/CHANGELOG.md
@@ -1,5 +1,18 @@
 # @cipherstash/basic-example
 
+## 1.2.14-rc.1
+
+### Patch Changes
+
+- Updated dependencies [59b994e]
+- Updated dependencies [e297f64]
+- Updated dependencies [40ab142]
+- Updated dependencies [5fe9a2f]
+- Updated dependencies [7b53141]
+  - @cipherstash/stack-drizzle@1.0.0-rc.1
+  - @cipherstash/stack@1.0.0-rc.1
+  - @cipherstash/stack-supabase@1.0.0-rc.1
+
 ## 1.2.14-rc.0
 
 ### Patch Changes
diff --git a/examples/basic/package.json b/examples/basic/package.json
index 7bbf20cf4..7845affa5 100644
--- a/examples/basic/package.json
+++ b/examples/basic/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@cipherstash/basic-example",
   "private": true,
-  "version": "1.2.14-rc.0",
+  "version": "1.2.14-rc.1",
   "type": "module",
   "scripts": {
     "start": "tsx index.ts"
diff --git a/examples/prisma/CHANGELOG.md b/examples/prisma/CHANGELOG.md
index 79cb7ad62..38095e758 100644
--- a/examples/prisma/CHANGELOG.md
+++ b/examples/prisma/CHANGELOG.md
@@ -1,5 +1,16 @@
 # @cipherstash/prisma-next-example
 
+## 0.0.6-rc.1
+
+### Patch Changes
+
+- Updated dependencies [e297f64]
+- Updated dependencies [40ab142]
+- Updated dependencies [5fe9a2f]
+- Updated dependencies [7b53141]
+  - @cipherstash/stack@1.0.0-rc.1
+  - @cipherstash/prisma-next@0.4.0-rc.1
+
 ## 0.0.6-rc.0
 
 ### Patch Changes
diff --git a/examples/prisma/package.json b/examples/prisma/package.json
index e8e5169fe..e4fe91f8f 100644
--- a/examples/prisma/package.json
+++ b/examples/prisma/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@cipherstash/prisma-next-example",
   "private": true,
-  "version": "0.0.6-rc.0",
+  "version": "0.0.6-rc.1",
   "description": "End-to-end example of @cipherstash/prisma-next: searchable application-layer encryption for Postgres with Prisma Next, using @cipherstash/stack as the SDK.",
   "type": "module",
   "scripts": {
diff --git a/packages/bench/CHANGELOG.md b/packages/bench/CHANGELOG.md
index 283dabc77..d75a8d3bb 100644
--- a/packages/bench/CHANGELOG.md
+++ b/packages/bench/CHANGELOG.md
@@ -1,5 +1,17 @@
 # @cipherstash/bench
 
+## 0.0.5-rc.1
+
+### Patch Changes
+
+- Updated dependencies [59b994e]
+- Updated dependencies [e297f64]
+- Updated dependencies [40ab142]
+- Updated dependencies [5fe9a2f]
+- Updated dependencies [7b53141]
+  - @cipherstash/stack-drizzle@1.0.0-rc.1
+  - @cipherstash/stack@1.0.0-rc.1
+
 ## 0.0.5-rc.0
 
 ### Patch Changes
diff --git a/packages/bench/package.json b/packages/bench/package.json
index ada4786a2..5d1d956b8 100644
--- a/packages/bench/package.json
+++ b/packages/bench/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cipherstash/bench",
-  "version": "0.0.5-rc.0",
+  "version": "0.0.5-rc.1",
   "private": true,
   "description": "Performance / index-engagement benchmarks for stack integrations (Drizzle, encryptedSupabase, Prisma).",
   "type": "module",
diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md
index 782edb2e6..da24622e5 100644
--- a/packages/cli/CHANGELOG.md
+++ b/packages/cli/CHANGELOG.md
@@ -1,5 +1,102 @@
 # @cipherstash/cli
 
+## 1.0.0-rc.1
+
+### Minor Changes
+
+- 134fd43: Add anonymous, opt-out usage analytics to the `stash` CLI, plus a
+  `stash telemetry [status|enable|disable]` command to manage it.
+
+  Only coarse events are collected — command name, CLI version, OS/arch, Node
+  version, success/failure, duration, and a coarse caller class (e.g.
+  `claude-code`, `cursor`, `interactive`) derived from environment markers so we
+  can gauge agent- vs human-driven usage. Events carry a random install
+  identifier (a locally generated UUID, not derived from any machine or user
+  attribute) used only to de-duplicate events in aggregate. Plaintext, schema,
+  table/column names,
+  connection strings, argument values, and any session/trace identifier are never
+  collected — enforced by a property-key allowlist at the emitter boundary plus
+  closed-vocabulary coercion of every argv- or error-derived value (unrecognised
+  commands, subcommands, and error class names all collapse to `<other>`). A
+  one-time notice is shown on first run, and nothing is sent on that run.
+
+  Telemetry is off by default in CI and can be disabled with `DO_NOT_TRACK=1`
+  (the cross-tool standard), `STASH_TELEMETRY_DISABLED=1`, or
+  `stash telemetry disable` (persisted to `~/.cipherstash/telemetry.json`).
+
+  Events are sent via a first-party proxy and never block or slow the CLI. The
+  feature ships dormant — no events are sent until a PostHog project key is
+  embedded at release. Updates the `stash-cli` skill to document the command and
+  opt-out controls.
+
+### Patch Changes
+
+- 59b994e: Add EQL v3 JSON **selector-with-constraint** querying to the Drizzle integration
+  (#623). `ops.selector(col, '$.path')` returns comparison methods bound to a
+  JSONPath into a `types.Json` column — `eq`/`ne`/`gt`/`gte`/`lt`/`lte` — emitting
+  `col->'<selector>' <op> <value>` over the encrypted document. Its unique power
+  over `contains` is **ordering at a path** (`col->'$.age' > 21`), which
+  containment cannot express.
+
+  Complements the existing `contains` (JSONB `@>`) containment operator. Core
+  `@cipherstash/stack` needs no change — the selector hash and comparison entry are
+  produced by `encryptQuery`/`encrypt` on the existing `types.Json` surface. v1
+  supports dot-notation object paths; array-index/wildcard paths are rejected with
+  a clear error. The Supabase adapter is tracked separately.
+
+  The right-hand comparison operand is currently a storage-encrypted needle (its
+  ste_vec entry carries the ordering term), pending a ciphertext-free ordering
+  query needle from protect-ffi (cipherstash/protectjs-ffi#137); until then the
+  value's ciphertext appears in the WHERE clause.
+
+  The bundled `stash-encryption` and `stash-drizzle` skills document the new
+  `ops.selector(...)` surface (they previously said JSONPath selector queries were
+  not yet implemented).
+
+- e297f64: Docs: EQL v3 is now the sole documented approach. The `stash-encryption`,
+  `stash-drizzle`, and `stash-supabase` skills and the `@cipherstash/stack`
+  README teach only the v3 typed surface (`EncryptionV3`, `types.*` concrete
+  domains, `@cipherstash/stack-drizzle/v3`, `encryptedSupabaseV3`); EQL v2
+  shrinks to one short Legacy section per document. Two explicit exceptions are
+  called out: DynamoDB still requires the v2 schema surface (#657), and the
+  encrypt rollout tooling (`stash encrypt backfill`/`cutover`,
+  `@cipherstash/migrate`) currently targets v2 columns (#648) — its guidance is
+  kept under a version callout. Also corrects the legacy `@cipherstash/drizzle`
+  README's pointer to the removed `@cipherstash/stack/drizzle` subpath (now the
+  separate `@cipherstash/stack-drizzle` package).
+- 40ab142: Docs: stop teaching the deprecated `LockContext.identify()` as the primary
+  identity-aware-encryption path (#591). The `stash-encryption` and `stash-supabase`
+  skills and the `@cipherstash/stack` README now lead with the current pattern —
+  authenticate the client with `OidcFederationStrategy`, then bind the claim per
+  operation with `.withLockContext({ identityClaim })` — and demote
+  `LockContext.identify()` to a clearly-marked deprecated note (per-operation CTS
+  tokens were removed in protect-ffi 0.25). Skills ship in the `stash` tarball, so
+  this keeps the bundled guidance correct for the 1.0 surface.
+- 5fe9a2f: Encrypted-JSON querying on the v3 Supabase surface (#650). A `types.Json`
+  column now supports exact encrypted containment — `contains(col, subDocument)`
+  (ste_vec `@>` via PostgREST `cs`, with the sub-document storage-encrypted
+  against the column) — and JSONPath selector predicates: `selectorEq(col, path,
+value)` and `selectorNe(col, path, value)` (dot-notation paths; `ne` includes
+  rows where the path is absent, mirroring the Drizzle selector's semantics).
+  Raw `.filter(col, 'cs', subDocument)` and `not(col, 'contains', …)` route
+  through the same encrypted path. Selector ordering is not expressible over
+  PostgREST yet (needs an EQL-bundle overload — see
+  cipherstash/encrypt-query-language#407); the Drizzle integration's
+  `ops.selector()` covers ordering today.
+
+  In core, `QueryTypesForColumn` gains the `searchableJson` arm (a `types.Json`
+  column no longer resolves to `never`, so typed adapter key sets can include
+  it), and the JSONPath selector-path helpers the Drizzle adapter introduced in
+  #651 moved to `@cipherstash/stack/adapter-kit` so both adapters share one
+  validation surface (`@cipherstash/stack-drizzle` re-exports them unchanged).
+
+  The bundled `stash-supabase` and `stash-encryption` skills are updated to
+  document the new querying surface (including the array-leaf and SQL-NULL
+  semantics, and the operand-exposure caveat) — skills ship inside the `stash`
+  tarball, hence the patch.
+
+  - @cipherstash/migrate@1.0.0-rc.0
+
 ## 1.0.0-rc.0
 
 ### Major Changes
diff --git a/packages/cli/package.json b/packages/cli/package.json
index f68f7b870..18e893003 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "stash",
-	"version": "1.0.0-rc.0",
+	"version": "1.0.0-rc.1",
 	"description": "CipherStash CLI — the one stash command for auth, init, encryption schema, database setup, and secrets.",
 	"repository": {
 		"type": "git",
diff --git a/packages/drizzle/CHANGELOG.md b/packages/drizzle/CHANGELOG.md
index f85a1c41d..50838a578 100644
--- a/packages/drizzle/CHANGELOG.md
+++ b/packages/drizzle/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @cipherstash/drizzle
 
+## 3.0.4-rc.1
+
+### Patch Changes
+
+- 3fdd740: Docs: the README's "for new projects" pointer named the removed
+  `@cipherstash/stack/drizzle` subpath; it now points at the separate
+  `@cipherstash/stack-drizzle` package (EQL v3 on its `/v3` subpath).
+
 ## 3.0.4-rc.0
 
 ### Patch Changes
diff --git a/packages/drizzle/package.json b/packages/drizzle/package.json
index 6e41233e6..7a9122544 100644
--- a/packages/drizzle/package.json
+++ b/packages/drizzle/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@cipherstash/drizzle",
-	"version": "3.0.4-rc.0",
+	"version": "3.0.4-rc.1",
 	"description": "CipherStash Protect.js Drizzle ORM integration for TypeScript",
 	"keywords": [
 		"encrypted",
diff --git a/packages/prisma-next/CHANGELOG.md b/packages/prisma-next/CHANGELOG.md
index c1a0e7b1b..3beb2fbf3 100644
--- a/packages/prisma-next/CHANGELOG.md
+++ b/packages/prisma-next/CHANGELOG.md
@@ -1,5 +1,15 @@
 # @cipherstash/prisma-next
 
+## 0.4.0-rc.1
+
+### Patch Changes
+
+- Updated dependencies [e297f64]
+- Updated dependencies [40ab142]
+- Updated dependencies [5fe9a2f]
+- Updated dependencies [7b53141]
+  - @cipherstash/stack@1.0.0-rc.1
+
 ## 0.4.0-rc.0
 
 ### Minor Changes
diff --git a/packages/prisma-next/package.json b/packages/prisma-next/package.json
index a14470ae8..37e0556dc 100644
--- a/packages/prisma-next/package.json
+++ b/packages/prisma-next/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@cipherstash/prisma-next",
-	"version": "0.4.0-rc.0",
+	"version": "0.4.0-rc.1",
 	"license": "MIT",
 	"author": "CipherStash <support@cipherstash.com>",
 	"description": "CipherStash extension for Prisma Next: searchable application-layer field-level encryption for Postgres, with six encrypted column types, 17 query operators, bulk encrypt/decrypt middleware, and a baseline migration that installs the vendored EQL bundle SQL byte-for-byte.",
diff --git a/packages/stack-drizzle/CHANGELOG.md b/packages/stack-drizzle/CHANGELOG.md
index 5cbf048f1..aafd3feb6 100644
--- a/packages/stack-drizzle/CHANGELOG.md
+++ b/packages/stack-drizzle/CHANGELOG.md
@@ -1,5 +1,39 @@
 # @cipherstash/stack-drizzle
 
+## 1.0.0-rc.1
+
+### Minor Changes
+
+- 59b994e: Add EQL v3 JSON **selector-with-constraint** querying to the Drizzle integration
+  (#623). `ops.selector(col, '$.path')` returns comparison methods bound to a
+  JSONPath into a `types.Json` column — `eq`/`ne`/`gt`/`gte`/`lt`/`lte` — emitting
+  `col->'<selector>' <op> <value>` over the encrypted document. Its unique power
+  over `contains` is **ordering at a path** (`col->'$.age' > 21`), which
+  containment cannot express.
+
+  Complements the existing `contains` (JSONB `@>`) containment operator. Core
+  `@cipherstash/stack` needs no change — the selector hash and comparison entry are
+  produced by `encryptQuery`/`encrypt` on the existing `types.Json` surface. v1
+  supports dot-notation object paths; array-index/wildcard paths are rejected with
+  a clear error. The Supabase adapter is tracked separately.
+
+  The right-hand comparison operand is currently a storage-encrypted needle (its
+  ste_vec entry carries the ordering term), pending a ciphertext-free ordering
+  query needle from protect-ffi (cipherstash/protectjs-ffi#137); until then the
+  value's ciphertext appears in the WHERE clause.
+
+  The bundled `stash-encryption` and `stash-drizzle` skills document the new
+  `ops.selector(...)` surface (they previously said JSONPath selector queries were
+  not yet implemented).
+
+### Patch Changes
+
+- Updated dependencies [e297f64]
+- Updated dependencies [40ab142]
+- Updated dependencies [5fe9a2f]
+- Updated dependencies [7b53141]
+  - @cipherstash/stack@1.0.0-rc.1
+
 ## 1.0.0-rc.0
 
 ### Major Changes
diff --git a/packages/stack-drizzle/package.json b/packages/stack-drizzle/package.json
index b6685ad7f..c5fb736ff 100644
--- a/packages/stack-drizzle/package.json
+++ b/packages/stack-drizzle/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@cipherstash/stack-drizzle",
-	"version": "1.0.0-rc.0",
+	"version": "1.0.0-rc.1",
 	"description": "CipherStash Stack Drizzle ORM integration: searchable, application-layer field-level encryption for PostgreSQL.",
 	"keywords": [
 		"encrypted",
diff --git a/packages/stack-supabase/CHANGELOG.md b/packages/stack-supabase/CHANGELOG.md
index a13b71b81..0e7fe3dad 100644
--- a/packages/stack-supabase/CHANGELOG.md
+++ b/packages/stack-supabase/CHANGELOG.md
@@ -1,5 +1,57 @@
 # @cipherstash/stack-supabase
 
+## 1.0.0-rc.1
+
+### Minor Changes
+
+- 5fe9a2f: Encrypted-JSON querying on the v3 Supabase surface (#650). A `types.Json`
+  column now supports exact encrypted containment — `contains(col, subDocument)`
+  (ste_vec `@>` via PostgREST `cs`, with the sub-document storage-encrypted
+  against the column) — and JSONPath selector predicates: `selectorEq(col, path,
+value)` and `selectorNe(col, path, value)` (dot-notation paths; `ne` includes
+  rows where the path is absent, mirroring the Drizzle selector's semantics).
+  Raw `.filter(col, 'cs', subDocument)` and `not(col, 'contains', …)` route
+  through the same encrypted path. Selector ordering is not expressible over
+  PostgREST yet (needs an EQL-bundle overload — see
+  cipherstash/encrypt-query-language#407); the Drizzle integration's
+  `ops.selector()` covers ordering today.
+
+  In core, `QueryTypesForColumn` gains the `searchableJson` arm (a `types.Json`
+  column no longer resolves to `never`, so typed adapter key sets can include
+  it), and the JSONPath selector-path helpers the Drizzle adapter introduced in
+  #651 moved to `@cipherstash/stack/adapter-kit` so both adapters share one
+  validation surface (`@cipherstash/stack-drizzle` re-exports them unchanged).
+
+  The bundled `stash-supabase` and `stash-encryption` skills are updated to
+  document the new querying surface (including the array-leaf and SQL-NULL
+  semantics, and the operand-exposure caveat) — skills ship inside the `stash`
+  tarball, hence the patch.
+
+### Patch Changes
+
+- 7b53141: Three correctness fixes surfaced while documenting the v3 surface:
+
+  - **Supabase `matches()` now rejects a short free-text needle.** A needle
+    below the tokenizer's `token_length` blooms to zero tokens, so `bloom @> {}`
+    matched (and the caller decrypted) every row — a fail-open exposure. The
+    guard (`matchNeedleError`) was wired into the Drizzle adapter only; the
+    Supabase adapter now applies it at the same term-resolution choke point, so
+    both first-party surfaces reject identically. (Authoritative FFI-level backstop
+    for the `encryptQuery` paths tracked in cipherstash/protectjs-ffi#138.)
+  - **Supabase `.withLockContext()` accepts the plain `{ identityClaim }` form**,
+    not only a `LockContext` instance — matching the stack-level operations and
+    the documented identity-aware example (widened to `LockContextInput`).
+  - **`EncryptionErrorTypes` is now `as const`**, so the `StackError` union
+    actually discriminates: `switch (error.type)` narrows and `error.code` is
+    reachable on the relevant branches. Without it every `type` was `string` and
+    the documented exhaustive error handler did not compile.
+
+- Updated dependencies [e297f64]
+- Updated dependencies [40ab142]
+- Updated dependencies [5fe9a2f]
+- Updated dependencies [7b53141]
+  - @cipherstash/stack@1.0.0-rc.1
+
 ## 1.0.0-rc.0
 
 ### Major Changes
diff --git a/packages/stack-supabase/package.json b/packages/stack-supabase/package.json
index 914705643..2a60c65f2 100644
--- a/packages/stack-supabase/package.json
+++ b/packages/stack-supabase/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@cipherstash/stack-supabase",
-	"version": "1.0.0-rc.0",
+	"version": "1.0.0-rc.1",
 	"description": "CipherStash Stack Supabase integration: transparent, searchable field-level encryption for Supabase.",
 	"keywords": [
 		"encrypted",
diff --git a/packages/stack/CHANGELOG.md b/packages/stack/CHANGELOG.md
index 477d7c593..d7206f420 100644
--- a/packages/stack/CHANGELOG.md
+++ b/packages/stack/CHANGELOG.md
@@ -1,5 +1,70 @@
 # @cipherstash/stack
 
+## 1.0.0-rc.1
+
+### Minor Changes
+
+- 5fe9a2f: Encrypted-JSON querying on the v3 Supabase surface (#650). A `types.Json`
+  column now supports exact encrypted containment — `contains(col, subDocument)`
+  (ste_vec `@>` via PostgREST `cs`, with the sub-document storage-encrypted
+  against the column) — and JSONPath selector predicates: `selectorEq(col, path,
+value)` and `selectorNe(col, path, value)` (dot-notation paths; `ne` includes
+  rows where the path is absent, mirroring the Drizzle selector's semantics).
+  Raw `.filter(col, 'cs', subDocument)` and `not(col, 'contains', …)` route
+  through the same encrypted path. Selector ordering is not expressible over
+  PostgREST yet (needs an EQL-bundle overload — see
+  cipherstash/encrypt-query-language#407); the Drizzle integration's
+  `ops.selector()` covers ordering today.
+
+  In core, `QueryTypesForColumn` gains the `searchableJson` arm (a `types.Json`
+  column no longer resolves to `never`, so typed adapter key sets can include
+  it), and the JSONPath selector-path helpers the Drizzle adapter introduced in
+  #651 moved to `@cipherstash/stack/adapter-kit` so both adapters share one
+  validation surface (`@cipherstash/stack-drizzle` re-exports them unchanged).
+
+  The bundled `stash-supabase` and `stash-encryption` skills are updated to
+  document the new querying surface (including the array-leaf and SQL-NULL
+  semantics, and the operand-exposure caveat) — skills ship inside the `stash`
+  tarball, hence the patch.
+
+### Patch Changes
+
+- e297f64: Docs: EQL v3 is now the sole documented approach. The `stash-encryption`,
+  `stash-drizzle`, and `stash-supabase` skills and the `@cipherstash/stack`
+  README teach only the v3 typed surface (`EncryptionV3`, `types.*` concrete
+  domains, `@cipherstash/stack-drizzle/v3`, `encryptedSupabaseV3`); EQL v2
+  shrinks to one short Legacy section per document. Two explicit exceptions are
+  called out: DynamoDB still requires the v2 schema surface (#657), and the
+  encrypt rollout tooling (`stash encrypt backfill`/`cutover`,
+  `@cipherstash/migrate`) currently targets v2 columns (#648) — its guidance is
+  kept under a version callout. Also corrects the legacy `@cipherstash/drizzle`
+  README's pointer to the removed `@cipherstash/stack/drizzle` subpath (now the
+  separate `@cipherstash/stack-drizzle` package).
+- 40ab142: Docs: stop teaching the deprecated `LockContext.identify()` as the primary
+  identity-aware-encryption path (#591). The `stash-encryption` and `stash-supabase`
+  skills and the `@cipherstash/stack` README now lead with the current pattern —
+  authenticate the client with `OidcFederationStrategy`, then bind the claim per
+  operation with `.withLockContext({ identityClaim })` — and demote
+  `LockContext.identify()` to a clearly-marked deprecated note (per-operation CTS
+  tokens were removed in protect-ffi 0.25). Skills ship in the `stash` tarball, so
+  this keeps the bundled guidance correct for the 1.0 surface.
+- 7b53141: Three correctness fixes surfaced while documenting the v3 surface:
+
+  - **Supabase `matches()` now rejects a short free-text needle.** A needle
+    below the tokenizer's `token_length` blooms to zero tokens, so `bloom @> {}`
+    matched (and the caller decrypted) every row — a fail-open exposure. The
+    guard (`matchNeedleError`) was wired into the Drizzle adapter only; the
+    Supabase adapter now applies it at the same term-resolution choke point, so
+    both first-party surfaces reject identically. (Authoritative FFI-level backstop
+    for the `encryptQuery` paths tracked in cipherstash/protectjs-ffi#138.)
+  - **Supabase `.withLockContext()` accepts the plain `{ identityClaim }` form**,
+    not only a `LockContext` instance — matching the stack-level operations and
+    the documented identity-aware example (widened to `LockContextInput`).
+  - **`EncryptionErrorTypes` is now `as const`**, so the `StackError` union
+    actually discriminates: `switch (error.type)` narrows and `error.code` is
+    reachable on the relevant branches. Without it every `type` was `string` and
+    the documented exhaustive error handler did not compile.
+
 ## 1.0.0-rc.0
 
 ### Major Changes
diff --git a/packages/stack/package.json b/packages/stack/package.json
index c71b75a1c..df0a47648 100644
--- a/packages/stack/package.json
+++ b/packages/stack/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@cipherstash/stack",
-	"version": "1.0.0-rc.0",
+	"version": "1.0.0-rc.1",
 	"description": "CipherStash Stack for TypeScript and JavaScript",
 	"keywords": [
 		"encrypted",
diff --git a/packages/test-kit/CHANGELOG.md b/packages/test-kit/CHANGELOG.md
index 07cab3ed7..9810185ba 100644
--- a/packages/test-kit/CHANGELOG.md
+++ b/packages/test-kit/CHANGELOG.md
@@ -1,5 +1,15 @@
 # @cipherstash/test-kit
 
+## 0.0.1-rc.1
+
+### Patch Changes
+
+- Updated dependencies [e297f64]
+- Updated dependencies [40ab142]
+- Updated dependencies [5fe9a2f]
+- Updated dependencies [7b53141]
+  - @cipherstash/stack@1.0.0-rc.1
+
 ## 0.0.1-rc.0
 
 ### Patch Changes
diff --git a/packages/test-kit/package.json b/packages/test-kit/package.json
index a5e80f168..cc77c68c3 100644
--- a/packages/test-kit/package.json
+++ b/packages/test-kit/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@cipherstash/test-kit",
-	"version": "0.0.1-rc.0",
+	"version": "0.0.1-rc.1",
 	"private": true,
 	"description": "Shared EQL v3 test harness: the domain catalog, the plaintext oracle, and the integration-suite driver. Consumed as TypeScript source — no build step.",
 	"type": "module",
diff --git a/packages/wizard/CHANGELOG.md b/packages/wizard/CHANGELOG.md
index b21943629..0f23eebf6 100644
--- a/packages/wizard/CHANGELOG.md
+++ b/packages/wizard/CHANGELOG.md
@@ -1,5 +1,17 @@
 # @cipherstash/wizard
 
+## 0.5.0-rc.1
+
+### Patch Changes
+
+- d8e0c1d: Align the wizard's analytics with the `stash` CLI's telemetry privacy contract.
+  The wizard now honors `DO_NOT_TRACK`, `STASH_TELEMETRY_DISABLED`, and CI
+  auto-detection; uses a random per-session identifier instead of one derived
+  from username@hostname; disables IP→geo resolution; and reports error events as
+  fixed labels / error class names instead of raw messages (which could embed
+  schema names or connection details). Analytics remain dormant unless a PostHog
+  key is configured at build time.
+
 ## 0.5.0-rc.0
 
 ### Minor Changes
diff --git a/packages/wizard/package.json b/packages/wizard/package.json
index 7cea274f2..39f50aa2f 100644
--- a/packages/wizard/package.json
+++ b/packages/wizard/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@cipherstash/wizard",
-	"version": "0.5.0-rc.0",
+	"version": "0.5.0-rc.1",
 	"description": "AI-powered encryption setup for CipherStash. Reads your codebase, picks columns to encrypt, and wires everything up.",
 	"repository": {
 		"type": "git",