Wouldn't it make sense to store the subsite as well, if possible? So that one cannot only ask for the site-wide list of online users, but also for a list of online users for a specific subsite?
This would propably involve a call to [site_node_closest_ancestor_package "acs-subsite"] - which doesn't access the db, just digs in the site_nodes nsv - per request. Acceptable?