Struct AuthorityClosure 

pub struct AuthorityClosure<'view, 'certificate, 'document> { /* private fields */ }

Complete reachable authority-input set, not a baseline level or Good verdict. Every borrowed node retains the original status, freshness, nonce, configured trust and noCheck facts. Only reached nodes are retained; temporary indexes are released before return. No provider/parse/signature callback is replayed.

Implementations

impl<'view, 'certificate, 'document> AuthorityClosure<'view, 'certificate, 'document>

pub fn roots( &self, ) -> &'view [&'view PathStatuses<'view, 'certificate, 'document>]

Actual selected actor inputs; actor-to-signature association is separate.

pub fn nodes(&self) -> &[&'view AuthorityNode<'view, 'certificate, 'document>]

All reached original paths, each once per exact evaluation label.

impl<'view, 'certificate, 'document> AuthorityClosure<'view, 'certificate, 'document>

pub fn visit_roots<E, W: Work>( &self, work: &W, visitor: impl FnMut(usize, &'view AuthorityNode<'view, 'certificate, 'document>) -> Result<(), E>, ) -> Result<(), AuthorityVisitError<E>>

Visit each root’s exact reachable authority nodes once, including the root itself. The root ordinal retains individual actor attribution even when different TSA/signature/credential actors share a path. This is the relation needed for EN319132-1 §6.3(x), not aggregate TSA-purpose bits. https://www.etsi.org/deliver/etsi_en/319100_319199/31913201/01.03.01_60/en_31913201v010301p.pdf

Reuses the SAME complete/delta/OCSP dependency kernel as closure and role propagation. No parsing, provider, cryptographic/status check is replayed. One current-operation index and iterative queue are reused across roots; cycles terminate, shared paths remain attributed to each original root. Work admits each edge/lookup/visitor dispatch, and scratch capacity is released on success/refusal. The visitor funds its own dependent work. No partial returned collection or baseline/Good verdict is manufactured.