Visitors write without write access

On a real deployment a visitor is a viewer: they can read and carry presence, and every write they attempt is dropped on the wire. Yet the guestbook takes signatures and pages take hearts. Both are true at once, and the seam between them is worth understanding.

The runner writes, the visitor asks

Visitor contributions go through RPC to a service-role runner, which validates and writes. The server stamps the caller's identity onto the request, so the runner knows who asked without trusting anything the browser said — you cannot sign the guestbook as somebody else.

Why not just grant write access?

Because "can write" is not a scope. Granting it to sign a guestbook grants it for the whole subtree, and the site would be one bored visitor away from an empty tree. RPC lets the surface be exactly one operation wide.

This demo is the exception

Here every visitor is an editor, on this one space, so you can try the studio without an account. That is a deliberate departure and the reason the janitor exists. A real site leaves visitors as viewers, and DOCKER.md says which switch does which.