@@ -0,0 +1,46 @@
+---
+'@objectstack/spec': minor
+'@objectstack/driver-turso': minor
+'@objectstack/service-datasource': minor
+---
+
+feat(spec,driver-turso)!: turso `config.encryptionKey` is removed — it never encrypted anything, in any mode, and is now refused everywhere it is written instead of accepted on a remote datasource
+
+Clause-②: no (narrowing)
+
+Metadata-protocol: narrowed
+
+<!-- adr-0087: registered turso-config-encryption-key-removed, turso-config-encryption-key-retired -->
+
+`encryptionKey` was declared as an AES-256 key for the database file. Nothing ever applied it. A local or embedded-replica file is read and written through better-sqlite3, which has no encryption codec, so #25020 already refused the key there. A remote database was never handed the key either: its storage encryption is configured on the server. That left a key that parsed on a remote datasource and did nothing. It was also the one credential-shaped key a datasource could still write in plain text (`STILL_WRITABLE_CREDENTIAL_KEYS`). Under ADR-0049 (enforce-or-remove) it is removed.
+
+**BREAKING** accept-set narrowing on a published schema, a published constructor and an exported type. It ships as `minor` under the repo's launch-window convention for breaking changes (`scripts/check-changeset-no-major.mjs`).
+
+- **`@objectstack/spec`**: `TursoConfigSchema.encryptionKey` is a `retiredKey()` tombstone. Authoring it is a `tsc` error and a parse error at `config.encryptionKey`, in every mode and with any value, the empty string included. The error carries the removal prescription. It is the only issue reported on that config, whatever else is wrong. The misspellings `encryption_key` and `encryptionkey` get the same prescription. The #25020 local and replica refusal arms are gone, since the tombstone subsumes them.
+- **`@objectstack/driver-turso`**: the published mirror `TursoConfigSchema` refuses the key the same way, as `z.never()`. `TursoDriverConfig.encryptionKey` is typed `never`. `new TursoDriver()` and `createTursoDriver()` refuse a defined `encryptionKey` with `VALIDATION_ERROR` / 400 in every mode, before anything else is checked, in the schema's words.
+- **`@objectstack/service-datasource`**: the exported `TursoDriverConfigInput.encryptionKey` is typed `never`. The shared loader still forwards a declared value, so a legacy stored row reaches the constructor's refusal instead of being dropped in silence.
+
+### Migration: FROM → TO
+
+| You wrote | Write instead |
+| --- | --- |
+| `url: 'libsql://my-db.turso.io', encryptionKey: '…'` (also `https://`, `ws(s)://`) | delete `encryptionKey`. Storage encryption for a remote database is configured on the Turso server |
+| `encryptionKey: ''` (or any unset value) | delete `encryptionKey` |
+| `url: 'file:./data/app.db', encryptionKey: '…'` (also `:memory:`, or a replica beside `syncUrl`) | delete `encryptionKey` (already refused since #25020). Put the file on an encrypted disk or volume if it must be encrypted at rest |
+
+The fix in one line: delete `encryptionKey` from every turso datasource.
+
+### The ADR-0087 disposition
+
+- **D2 `turso-config-encryption-key-removed`** deletes the key from a turso datasource's `config` when its value is unset (any non-string, or `''`) or when it sits beside a remote url (`libsql://`, `https://`, `http://`, `ws://`, `wss://`, in any case). It emits one notice per key. Nothing is lost: the driver never read the value.
+- A non-empty key beside a local url is **not** deleted. Removing it would let a datasource whose operator believed the file was encrypted boot in silence. It keeps the #25020 posture instead: the row fails at driver construction with the prescription, and the author deletes the key by hand.
+- The conversion is retired from the load path. A live author is refused at parse and taught. Stored rows (the datasource loaders), built artifacts inside their declared-floor window and `os migrate meta --from 17` replay it.
+- `RETIRED_KEYS_BY_MAJOR[18]` gains `data/TursoConfig:encryptionKey`. The D3 entry is `turso-config-encryption-key-retired`.
+
+### Stored rows stay redacted
+
+A tombstone is excluded from the schema-derived credential list, by its `[REMOVED]` prefix. Measured: after the retirement, no existing path would have withheld a stored `encryptionKey` on read. The derived turso list (`authToken`) is non-empty, so the canonical fallback never applies. `STILL_WRITABLE_CREDENTIAL_KEYS` is therefore renamed `RETIRED_CREDENTIAL_KEYS` and keeps `turso: ['encryptionKey']`. A legacy row's value is still withheld and still named in `redactedConfigKeys`, on the admin door and the metadata door alike.
+
+### Blast radius
+
+Measured on this tree: no example, template, CLI scaffold, published skill, host default or environment variable authors the key. A tree-scoped absence pin now holds that. Whether any out-of-repo deployment declares it is not measured, and is not claimed to be zero.
@@ -296,7 +296,8 @@ describe('turso config: the constructor, the spec contract and this mirror agree
     // [#20586] The forced-local half of the `mode` rows, floored on its own so
     // it cannot shrink behind the forced-replica half.
     expect(ROWS.filter((r) => r.refusedOn === 'mode' && r.config.mode === 'local').length).toBeGreaterThanOrEqual(8);
-    expect(SYNC_KEY_REFUSALS.length).toBeGreaterThanOrEqual(25);
+    // 20 measured at #25050, after the `encryptionKey` rows moved to RETIRED_KEY_ROWS.
+    expect(SYNC_KEY_REFUSALS.length).toBeGreaterThanOrEqual(20);
     // [#25050] The removed key, across every mode and beside other defects.
     expect(RETIRED_KEY_ROWS.length).toBeGreaterThanOrEqual(15);
     expect(RETIRED_KEY_ROWS.filter((r) => /^(libsql|https|wss):/i.test(r.config.url)).length).toBeGreaterThanOrEqual(5);
 
@@ -85,7 +85,13 @@ const API = '/api/v1';
 const ADMIN = { email: 'admin@objectos.ai', password: 'admin123' };
 const MEMBER = { email: 'pin-member@example.invalid', password: 'Member-Pass-123' };
 
-/** The synthetic credential, stored in the datasource body's primary credential slot (turso's `authToken`). */
+/**
+ * The synthetic credential, stored in a credential slot the production writer
+ * ACCEPTS and the datasource redactor withholds on read: mongodb's
+ * `options.proxyPassword`. It was turso's `encryptionKey` until #25050 retired
+ * that key, and the primary slots (`password`, `authToken`) are refused inline
+ * at this writer, so they cannot seed the row.
+ */
 const SENTINEL = 'reader-seam-sentinel-6c1e9b';
 const DS_NAME = 'pin_ds';
 /** Non-credential configuration of the same body: present in a projection of THIS row. */
@@ -433,8 +439,8 @@ beforeAll(async () => {
   const save = await as(adminToken, 'PUT', `/meta/datasource/${DS_NAME}`, {
     name: DS_NAME,
     label: 'Pin datasource',
-    driver: 'turso',
-    config: { url: `libsql://${DS_HOST}`, authToken: SENTINEL },
+    driver: 'mongodb',
+    config: { url: `mongodb://${DS_HOST}:27017/pin`, options: { proxyPassword: SENTINEL } },
   });
   if (save.status >= 300) throw new Error(`pin seed refused: ${save.status} ${JSON.stringify(await readJson(save))}`);
 
 
@@ -325,19 +325,36 @@ describe('#16023 — every reader consults the spelling the authoring contract a
   // arrives (`loadDatasourceRows` / `loadDatasourceRow`), so a `??` fallback
   // here would be a consumer-side dialect for a spelling both doors closed —
   // the sqlite `filename` and mongo `url` arms say exactly this.
+  //
+  // ONE named exception, and it is a refusal, not a tolerance: `encryptionKey`
+  // (#25050) is a removal with no successor whose conversion deliberately
+  // leaves a non-empty value beside a LOCAL url for its author. Its reader
+  // forwards that value verbatim, under its own name, so the driver
+  // constructor refuses it by name instead of the row booting in silence. It
+  // is held to exactly that below: forwarded unchanged, never read into any
+  // other key.
+  const FORWARDED_TO_CONSTRUCTOR_REFUSAL = new Set(['encryptionKey']);
   it('reads NO retired spelling — a config authored the old way yields only `url`', () => {
     for (const { retired } of retirements()) {
       // Probed at every candidate type, not at the replacement's: a tolerance
       // arm could have been written with any type-test, and the tombstone
       // itself accepts nothing to sample from.
       for (const value of CANDIDATES) {
         const built = build({ url: 'libsql://x', [retired]: value });
+        if (FORWARDED_TO_CONSTRUCTOR_REFUSAL.has(retired)) {
+          expect(built, `\`${retired}\` is forwarded unchanged (probed with ${typeof value})`)
+            .toEqual({ url: 'libsql://x', [retired]: value });
+          continue;
+        }
         expect(
           Object.keys(built),
           `a reader still consults the retired \`${retired}\` (probed with ${typeof value})`,
         ).toEqual(['url']);
       }
     }
+    // The exception list names only keys the contract really retired.
+    const retiredNames = retirements().map((r) => r.retired);
+    for (const key of FORWARDED_TO_CONSTRUCTOR_REFUSAL) expect(retiredNames).toContain(key);
   });
 
   // The named, readable instance of the property above — the case #16023
 
@@ -3,7 +3,7 @@
   "measured": {
     "zod": "4.4.3",
     "publishedSchemasWithDroppedRefinements": 240,
-    "droppedRefinementSites": 812,
+    "droppedRefinementSites": 811,
     "refinementSitesThatDidProject": 369,
     "refinementSitesWithNoJsonFormToCompare": 0
   },