Struct FoldedRoster 

pub struct FoldedRoster {

    pub roles: CommunityRoles,
    pub role_authors: Vec<PublicKey>,
    pub grant_authors: Vec<PublicKey>,
    pub gapped_entities: Vec<[u8; 32]>,
    pub skipped: usize,
    pub fetched: usize,
    pub heads: Vec<EntityHead>,
    pub banned: Vec<String>,
    pub banlist_author: Option<PublicKey>,
    pub dissolved_by: Vec<PublicKey>,
    pub banlist_head: Option<EntityHead>,
    pub invite_link_sets: Vec<InviteLinkSet>,
    pub root_meta: Option<CommunityMetadata>,
    pub root_author: Option<PublicKey>,
    pub root_head: Option<EntityHead>,
    pub root_candidates: Vec<RootCandidate>,
    pub channel_meta: Vec<ChannelMetaHead>,
    pub channel_candidates: Vec<ChannelMetaHead>,
}

The outcome of folding the control plane.

Fields

roles: CommunityRoles

The anchored, bound, validly-signed heads. This is “validly signed, anchored, and current” — NOT yet “authorized.” authorize_delegation is the next layer: it filters these by the delegation chain (each signer must outrank what it defines, chaining to the owner). Use the authorized result for any authority decision; this raw roster is the binding-layer output.

role_authors: Vec<PublicKey>

The signer (inner real-npub author) of each entry in roles.roles, SAME ORDER — so authorize_delegation can check whether that signer was allowed to define the role.

grant_authors: Vec<PublicKey>

The signer of each entry in roles.grants, SAME ORDER (the delegation chain needs the granter).

gapped_entities: Vec<[u8; 32]>

Entity ids whose head is NOT chain-anchored (a gap, §version). These are quarantined — NOT folded into roles (fail closed). A bootstrapping joiner re-verifies them via authority before trusting; a tracking client refetches the missing prereqs.

skipped: usize

Count of editions dropped: bad signature, missing/duplicate fields, an entity_id↔content mismatch, unparseable content, or beyond the cap. Nonzero ⇒ the roster may be degraded (a role/grant could be silently missing), so the caller should refetch rather than trust it.

fetched: usize

Count of RAW control editions the source fetch returned (before opening/folding). Set by fetch_control_folded; 0 for a roster folded from a hand-supplied edition set (tests, prefolds). fetch_and_apply_control surfaces it so an admin-write guard can tell “≥1 relay responded” (any raw event) from total network isolation — without a second, throwaway probe fetch.

heads: Vec<EntityHead>

The current head (entity_hex, version, self_hash) of every successfully-bound ROLE/GRANT entity, for the caller to advance set_edition_head (monotonic). Excludes the banlist (its head is banlist_head, advanced by the banlist path) and gapped/quarantined entities.

banned: Vec<String>

The folded banlist content (banned pubkeys, lowercase hex) — only meaningful once the BAN authority of banlist_author is checked against the authorized roster. Empty if no banlist edition folded (distinct from “an authored empty banlist,” which the caller learns via banlist_head/banlist_author being Some).

banlist_author: Option<PublicKey>

The signer (inner real-npub author) of the folded banlist head, so the caller can verify they held BAN. None if no banlist edition folded.

dissolved_by: Vec<PublicKey>

The DISTINCT signers of every well-formed GroupDissolved tombstone (vsk=10) at dissolved_locator Detection is owner-SIGNATURE-filtered, NOT position/version dependent: the fold scans the locator directly (NOT via the version-chain version::fold — the tombstone has no chain) and lists each authoring npub, so a flood of forged NON-owner editions can never bury the real owner’s signer out of the MAX_CONTROL_EDITIONS cap and truncate the true tombstone away. The CALLER treats the community as dissolved ONLY if the proven owner is in this set (mirrors banlist_author’s BAN check). A malformed edition at the locator is dropped (skipped), never honored.

banlist_head: Option<EntityHead>

The banlist entity’s current head, for the banlist path to advance set_edition_head.

invite_link_sets: Vec<InviteLinkSet>

Folded per-creator invite-link sets (vsk=8, one per creator at invite_links_locator(cid, creator)). Each holds that creator’s active link locators + head. The caller authorizes each creator (held CREATE_INVITE) and UNIONS the locators into the aggregate active-set — the source of truth for the Public/Private mode + registry-authoritative joins. No shared registry.

root_meta: Option<CommunityMetadata>

The folded GroupRoot (community metadata, vsk=0 at entity_id == community_id). None if no GroupRoot edition folded. Applied only once the caller checks root_author held MANAGE_METADATA.

root_author: Option<PublicKey>

The signer of the folded GroupRoot head, so the caller can verify they held MANAGE_METADATA.

root_head: Option<EntityHead>

The GroupRoot entity’s current head, for the metadata path to advance set_edition_head.

root_candidates: Vec<RootCandidate>

Every gap-vetted GroupRoot candidate at-or-above the floor (fork members included), highest version first (deterministic inner-id tiebreak within a version). The consumer applies the highest whose author is CURRENTLY authorized (MANAGE_METADATA) — an author-aware descending scan (B1b), so a demoted author’s edition (incl. a same-version forgery) can’t be the head, and a fresh fold converges to the highest authorized edition (the owner’s re-assert). root_head is root_candidates[0] (the author-blind head) for back-compat.

channel_meta: Vec<ChannelMetaHead>

Folded per-channel metadata (vsk=2, one per channel entity_id == channel_id) — the author-blind top head per channel (back-compat: used by the demoted-author re-assert path). For convergence the consumer scans Self::channel_candidates instead.

channel_candidates: Vec<ChannelMetaHead>

Every gap-vetted channel-metadata candidate at-or-above each channel’s floor (fork members included), highest version first with the deterministic inner-id tiebreak — the per-channel mirror of Self::root_candidates. Grouped contiguously per channel (sorted within each channel). The consumer applies, per channel, the highest whose author CURRENTLY holds MANAGE_CHANNELS — an author-aware scan, so a demoted author’s same-version forgery can’t orphan an authorized re-assert and a concurrent same-version rename converges to one deterministic winner on every client.

Trait Implementations

impl Clone for FoldedRoster

fn clone(&self) -> FoldedRoster

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.