Admin reach is computed as if no revocation existed, so it only ever grows. That is what lets two concurrent revocations land the same way on every replica.

Without it, removing a moderator would un-ban everyone they banned, and two devices could disagree.

Your reach is every room you have ever held a key to. Ever. Not currently. Here is why.

Two revocations at the same moment. Dan removes Bob from Members. Bob, still an admin as far as he knows, removes Eve.

Suppose Bob's reach depended on being an admin right now. A device that sees Dan's note first ignores Bob's. Eve stays. A device that sees Bob's note first removes Eve. Same bag. Different answers.

So Keyline works in two passes. Pass one ignores every revocation and draws the full map. Who ever stood where. That fixes everyone's reach.

Pass two applies all the revocations to that map. Revocations never look at each other. Both land. Everywhere. In any order.

Removing a moderator does not un-ban the people they banned. Quitting does not un-ban anyone either. And two devices never disagree.

Reach only grows. And more reach only ever removes access. The surprise, if any, is always in the safe direction.

The price: a removed admin keeps the keys to every room they ever had. That is the sharp edge.

Check yourself. Why can a replica not shrink Bob's reach after Dan removes him?