@@ -250,16 +250,13 @@ that nothing would honour, each with the message `@objectstack/spec`'s
   would be ignored. Drop `mode` for an embedded replica, or drop `syncUrl` (and
   `sync`) for a plain local database.
 
-It refuses (`VALIDATION_ERROR` / 400) a non-empty `encryptionKey` on a local
-database or an embedded replica too, in the same message the spec contract
-gives at authoring. The driver reads and writes that file through
-better-sqlite3, which has no encryption codec, so the key would encrypt nothing
-and the file would be written in plaintext that any SQLite reader opens without
-it. Drop `encryptionKey`, and put the file on an encrypted disk or volume if it
-must be encrypted at rest, or use a remote Turso database, whose storage
-encryption is the server's to configure. A `file:` url or `:memory:` under a
-forced `mode: 'remote'` is refused the same way: the libSQL client the driver
-builds for that url is handed no key.
+It refuses (`VALIDATION_ERROR` / 400) any `encryptionKey`, in every mode, in
+the same message the spec contract gives at authoring: the key was removed in
+18 because it never encrypted anything. A local or replica file is read and
+written through better-sqlite3, which has no encryption codec, and the driver
+never handed the key to a remote database. Delete the key; put a local file on
+an encrypted disk or volume if it must be encrypted at rest, or use a remote
+Turso database, whose storage encryption the server configures.
 
 You can also force a specific mode:
 
@@ -337,13 +334,6 @@ interface TursoDriverConfig {
   /** JWT auth token for the remote Turso database */
   authToken?: string;
 
-  /**
-   * Encrypts nothing, in any mode: refused in local and replica modes
-   * (VALIDATION_ERROR / 400), because the local engine cannot encrypt the file,
-   * and beside a file: url or :memory: under a forced mode: 'remote'.
-   */
-  encryptionKey?: string;
-
   /**
    * Maximum concurrent requests to the remote database.
    * Effective in replica and remote modes.
 
@@ -81,6 +81,24 @@ const WASM_RETIRED =
   + 'the remote arm (`libsql://` / `https://`), which needs none. '
   + 'Run `os migrate meta --from 17` to list the mechanical edits for existing sources; `--write` applies the ones it can prove, and you apply the rest by hand.';
 
+/**
+ * The prescription the REMOVED `encryptionKey` raises (#25050, ADR-0049
+ * enforce-or-remove). Unlike the three above, it is not this package's own
+ * wording: it is `@objectstack/spec`'s `TursoConfigSchema` tombstone text, byte
+ * for byte, and the constructor in `../turso-driver.ts` refuses the key in it
+ * too, because the one key is judged at three places and an author must meet
+ * one prescription at all of them. `turso-config-constructor-parity.test.ts`
+ * holds the three copies equal.
+ */
+const ENCRYPTION_KEY_RETIRED =
+  '`turso config.encryptionKey` was removed in @objectstack/spec 18 and @objectstack/driver-turso 18 '
+  + '(ADR-0049) — it never encrypted anything, in any mode: a local or embedded-replica file is read and '
+  + 'written through a SQLite engine that has no encryption codec, and the driver never handed the key to '
+  + 'a remote database, whose storage encryption the server configures. Delete the key. A local file that '
+  + 'must be encrypted at rest belongs on an encrypted disk or volume. '
+  + 'Run `os migrate meta --from 17` to list the mechanical edits for the unset and remote-url cases; '
+  + '`--write` applies the ones it can prove, and you delete the key from a local or replica datasource by hand.';
+
 // ==========================================================================
 // 2a. Transport coherence — what `new TursoDriver` refuses
 // ==========================================================================
@@ -151,12 +169,11 @@ interface TursoTransportKeys {
   syncUrl?: unknown;
   mode?: TursoTransportModeName;
   timeoutMs?: unknown;
-  encryptionKey?: unknown;
 }
 
 /** One refusal: the key it sits on and its message. */
 interface TursoTransportIssue {
-  path: 'url' | 'syncUrl' | 'timeoutMs' | 'mode' | 'encryptionKey';
+  path: 'url' | 'syncUrl' | 'timeoutMs' | 'mode';
   message: string;
 }
 
@@ -276,26 +293,6 @@ function tursoTransportIssues(cfg: TursoTransportKeys): TursoTransportIssue[] {
           + "`url: 'file:./data/replica.db'`. For a plain local database, drop `syncUrl` (and `sync`).",
       }];
     }
-    if (typeof cfg.encryptionKey === 'string' && cfg.encryptionKey.length > 0) {
-      // #25020. The url and the mode are coherent (every other shape met a
-      // refusal above), so what the runtime cannot honour is the KEY: the
-      // local engine has no encryption codec, so the issue sits on
-      // `encryptionKey`. An empty key is unset, as the loaders read it.
-      return [{
-        path: 'encryptionKey',
-        message:
-          `\`encryptionKey\` asks for this datasource's database file to be encrypted, but this datasource is ${arm}, `
-          + 'which runs every read and write through a local SQLite engine that has no encryption codec'
-          + (mode === 'replica'
-            ? ' (the sync client shares that one file, and a file it encrypted could not be opened by that engine)'
-            : '')
-          + ': nothing would encrypt the file, so it would be written in plaintext that any SQLite reader opens '
-          + 'without the key — the turso driver refuses this configuration when it starts. Nothing in this driver '
-          + 'encrypts a local or replica file. Drop `encryptionKey`, and encrypt the disk or volume the file lives '
-          + "on instead, or keep the data in a remote Turso database, whose storage encryption is the server's to "
-          + "configure, not this key's.",
-      }];
-    }
     return [];
   }
 
@@ -324,32 +321,6 @@ function tursoTransportIssues(cfg: TursoTransportKeys): TursoTransportIssue[] {
         + "file beside `syncUrl`: `url: 'file:./data/replica.db'`.",
     });
   }
-  if (
-    (isFileTursoUrl(url) || url === ':memory:')
-    && typeof cfg.encryptionKey === 'string' && cfg.encryptionKey.length > 0
-  ) {
-    // #25020, patch round 1. Only a FORCED remote mode reaches here with a
-    // `file:` url or `:memory:` (with no `mode`, those urls select a local
-    // engine). The key is judged by where the database lives, not by the
-    // mode: `connect()` hands that url to the libSQL client this driver
-    // builds, which is handed no key, so the issue sits on `encryptionKey`,
-    // last, like the local-engine arm's.
-    issues.push({
-      path: 'encryptionKey',
-      message: namesInMemoryTursoDatabase(url)
-        ? "`encryptionKey` asks for this datasource's database to be encrypted, but `url` names an in-memory "
-          + "database, and `mode: 'remote'` runs every read and write of it through the libSQL client this "
-          + 'driver builds, which is handed no key: there is no file for the key to encrypt, so it would change '
-          + 'nothing — the turso driver refuses this configuration when it starts. Drop `encryptionKey`.'
-        : "`encryptionKey` asks for this datasource's database file to be encrypted, but `url` is a local "
-          + "`file:` url, and `mode: 'remote'` runs every read and write of that file through the libSQL client "
-          + 'this driver builds, which is handed no key: nothing would encrypt the file, so it would be written '
-          + 'in plaintext that any SQLite reader opens without the key — the turso driver refuses this '
-          + 'configuration when it starts. Nothing in this driver encrypts a local file. Drop `encryptionKey`, '
-          + 'and encrypt the disk or volume the file lives on instead, or point `url` at a remote Turso '
-          + "database, whose storage encryption is the server's to configure, not this key's.",
-    });
-  }
   return issues;
 }
 
@@ -372,21 +343,23 @@ export const TursoConfigSchema = lazySchema(() => z.object({
   authToken: z.string().optional().describe('Authentication token for remote database'),
 
   /**
-   * Encryption Key — encrypts nothing, in any mode, and is REFUSED for a local
-   * or embedded-replica database, and beside a `file:` url or `:memory:` under
-   * a forced `mode: 'remote'` (#25020; the refusals are the
-   * `tursoTransportIssues` arms above, in the spec contract's words — this
-   * mirror declares no `mode`, so it judges such a config as the local
-   * database its url selects, and refuses it with that arm's text).
+   * Tombstone for the REMOVED `encryptionKey` (#25050, ADR-0049
+   * enforce-or-remove).
+   *
+   * It promised to encrypt the local database file at rest with AES-256 and
+   * was honoured in no mode: the driver reads and writes that file through
+   * better-sqlite3, which has no encryption codec (so #25020 refused it
+   * there), and it never handed the key to the libSQL client it builds for a
+   * remote url, where the key was parsed and dropped. `z.never()` rather than
+   * a bare deletion for the reason `timeout` below spells out: this shape is a
+   * plain `z.object`, and a deletion would strip the key in silence.
    *
-   * It used to promise to encrypt the local database file at rest with
-   * AES-256. The driver reads and writes that file through better-sqlite3,
-   * which has no encryption codec, so the file was written in plaintext that
-   * any SQLite reader opened without the key; an embedded replica handed it to
-   * its sync client only. The driver does not forward it to a remote database
-   * either, whose storage encryption is the server's.
+   * The text is `@objectstack/spec`'s `TursoConfigSchema` tombstone on the
+   * same key, byte for byte, and the constructor's refusal in
+   * `../turso-driver.ts`; `turso-config-constructor-parity.test.ts` holds the
+   * three equal.
    */
-  encryptionKey: z.string().optional().describe("Not honoured in any mode: refused for a local or replica datasource, whose SQLite engine cannot encrypt the file, and for a file: url or :memory: under a forced remote mode, whose libSQL client is handed no key; a remote database's storage encryption is the server's, not set by this key"),
+  encryptionKey: z.never({ error: () => ENCRYPTION_KEY_RETIRED }).optional().describe(`[REMOVED] ${ENCRYPTION_KEY_RETIRED}`),
 
   /**
    * Concurrency Limit.