> only lets the original writer delete a shard.

That makes sense on the very surface, but eventually someone's going to lose their config, and all their orphaned storage is just occupied forever in the rest of the group.

I'm pondering an "anti-challenge" primitive, whereby storing nodes can ask the original writer to confirm that it still has the stub file. (Because if that's lost, the data can't be decrypted anyway, there's no point to still saving it.) And if that fails for X months in a row, sorry, time to go. Or maybe raise it for manual review so the node operator can check in with the others before pushing the "reclaim storage" button.