Completes the store-layer scoping pass -- every store method touching per-user data now requires an explicit userID.