Visitors are soft identities

A visitor here is not an anonymous session. The SDK mints an Ed25519 keypair in your browser and registers it, so you are a real account — which is what lets you carry presence at all. An anonymous principal can only hold Observer, and Observer is excluded from the server's awareness check. Close registration and presence silently stops working for everyone.

What a real site does

Authenticated visitors land on viewer: read plus presence, no write. Everything a visitor contributes — guestbook signatures, reactions — goes through the RPC runner instead, which receives a server-stamped caller id that a client cannot forge.

What this demo does instead

This site raises public_access to editor on its own subtree, so you can edit it. The global floor stays viewer and top-level document creation stays closed, so the blast radius is exactly this site — and the janitor puts it back.