Removal from the root role is never durable, because only the destroyed subject key could sign a new root edge. So the root role is kept minimal and used rarely, like a root certificate authority.

It is the one place in Keyline where a mistake cannot be rotated away, and it decides how to set a document up.

Every role can rotate, except one. Rotating Owners needs a new root edge. Only the document's key could sign it, and that key was destroyed.

So everyone who ever held admin in Owners keeps Owners on their keyring. And every route in the document passes through Owners. Removal from the root role is never durable.

Rooting at edit keeps the root edge itself off every keyring. But an ex-owner can still unplug the owners' memberships, inside Owners. Then the document goes dark.

Two owners can revoke each other at the same time. Both land. Below the root, whoever feeds the role rotates it and picks who stays. In the root role, there is no one above. If all the owners unplug each other, nobody can ever be added again.

So keep the root role tiny. One key per human owner, or just the creator. Do all the churn in roles below, where rotation works.

One escape hatch. If the document's key was kept, in cold storage, it can cut the old root edge and wire a fresh Owners. That only helps when the document is rooted at edit.

And whoever holds that key can re-root out from under you, too. Destroy it, or guard it.

Check yourself. Why can the Owners role not be rotated?