The guest list is a chain that may never fork; a consensus node accepts the first slip that extends it and rejects the other, so changing membership needs the network.

It is the one place the local-first rule bends, and the reason is structural.

The guest list is a chain. Each slip names the slip before it. Unlike objects, this chain may never fork.

Three of the slips. An invite. A request to join, signed with a key that came with the invite. An accept, which carries the read key, sealed for the newcomer.

Two admins change the list at the same time. Both slips point at the same previous slip. Now there are two lists.

That is why there is a referee. The consensus node. It accepts the first slip that extends the chain. The other is rejected.

So changing membership needs the network. Every other write works offline. This one does not.

Check yourself. Why can an ACL change not be made offline?