Durable ambient stubs outlive vendor removal — no supported purge path

What happened: We removed a custom auto-provisioning gatekeeper worker from our deployment (bindings dropped, worker later deleted). Brand-new workspaces kept receiving a working env.SPHERE binding for it: /admin clean, Connections empty, portals disabled — yet recall returned live data.

Root cause (our reading): the User DO's connectedAccounts holds the ambient account with a durable stub to the vendor worker. prepareChatBindings folds stored ambient accounts into every chat regardless of current deployment bindings, and subscribeConnectedAccounts hides the row once the vendor is unresolvable (vendors.get miss → logged + skipped), so no UI can show or remove it. disconnectAccount would allow it (mode defaults to optional), but nothing surfaces the account to call it on. Dashboard Data Studio can't help either (_cf_KV is SQLITE_AUTH-blocked).

Our workaround: temporarily restored the worker, set the vendor to Optional, disconnected via the Gatekeepers page, dropped again, deleted the orphan. Three deploys for a one-row delete.

Suggestions: (1) list unresolvable ambient accounts somewhere admin-visible instead of skipping silently; (2) support forced removal (the protection in user.ts assumes the vendor exists to revoke() — best-effort revoke + row delete already handles a dead vendor); (3) consider Data Studio visibility for typed-storage KV or a documented purge recipe.

Happy to test a fix on our deployment.

Start in user.ts and trace prepareChatBindings, subscribeConnectedAccounts, and disconnectAccount for an ambient account whose vendor no longer resolves. Check the Gatekeepers page and the _cf_KV limitation described in the report; done should include an admin-visible or forced-removal path and prevent the orphaned binding from reaching new workspaces.

Written by the indexing model from the issue text.