Stash Deployment

Encrypting a column that already holds live data is a deployment problem, not a schema problem. The schema change is trivial; the danger is the window between "the database can hold ciphertext" and "the application reads ciphertext". Getting that window wrong loses data silently — rows written during the gap keep only plaintext, or keep only ciphertext nobody can decrypt, and nothing errors until a user reads the row.

This skill covers how to sequence that across deploys. For the API and the lifecycle model see stash-encryption; for the commands see stash-cli; for framework specifics see stash-drizzle / stash-supabase / stash-prisma.

Everything here describes EQL v3, the only authoring generation. The EQL v2 rollout commands were removed — stash encrypt cutover (the old v2 rename swap) now exits with an error on every project. A column that started under v2 finishes the same way as v3: complete the backfill, switch reads to the encrypted column by name, then stash encrypt drop. Legacy v2 payloads remain readable; stash-encryption covers that.