Function scope 

pub fn scope(tenant: &TenantId, unit: &str) -> String

The erasure scope for a unit within a tenant.

Derived here and nowhere else. The write path and the erasure path must agree byte-for-byte about which key seals a payload; deriving the string separately in each is how writes come to seal under tenant/case while erasure destroys case, so every erasure reports success and destroys nothing. Two places deriving one fact is the defect, so there is one place.

TenantId refuses /, which is what stops a tenant named acme/prod from colliding with tenant acme, unit prod.

The implementation is crate::core::erasure_scope, because the blob layer consumes the same string as the unit that leads a storage address — and the key a scope destroys and the addresses it expires must name one unit, not two spellings of one.