feat(v3): workflow_root_port accessor + WorkflowRoot sum (Prereq-3a)

src/v3/compiler/src/dag.rs

@@ -1906,6 +1906,41 @@ pub enum Behavior {
     Bind(BindNode),
 }
 
+/// Workflow-root identification — Rust mirror of
+/// [`crate::dag::WorkflowRoot`]'s declaration in
+/// `src/v3/std/substrate.dag`.
+///
+/// 🟡 SCAFFOLD coproduct (mirroring the .dag receipt). The three arms
+/// partition every legitimate `Dag` exactly once:
+///
+///   - `SingleRoot(p)` — α (last topological `Bind`) selected `p`.
+///     Emitted whenever the Dag contains at least one `Bind`; multiple
+///     Binds are NOT ambiguous under α — linear `d.nodes` picks
+///     exactly one last element by definition.
+///   - `NoRoot` — zero `Bind` behaviors in `d.nodes`. Lens fold short-
+///     circuits to `DimensionFail`; runtime evaluation rejects.
+///   - `AmbiguousRoot { candidates }` — reserved for the future
+///     enumerate-all-eligible-entries rule that R2-Evaluator's
+///     `evaluate(program, entry, args)` consumes for multi-entry
+///     programs (per Items 4+5 / #1176 §3.2). The α / γ "last X Bind"
+///     rules cannot populate this arm; today's α implementation never
+///     emits it. Carried as `NonSingletonList<PortId>` to make the
+///     pre-disambiguation 1-candidate case structurally
+///     unrepresentable — `AmbiguousRoot` requires ≥2 candidates by
+///     construction.
+///
+/// Dissolution: γ refinement and the enumerate-all rule both reuse
+/// this same partition behind the `workflow_root_port` accessor; no
+/// carrier change required when those rules wire.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum WorkflowRoot {
+    SingleRoot(PortId),
+    NoRoot,
+    AmbiguousRoot {
+        candidates: NonSingletonList<PortId>,
+    },
+}
+
 impl Behavior {
     pub fn id(&self) -> NodeId {
         match self {
@@ -2962,6 +2997,29 @@ impl Dag {
         }
     }
 
+    /// Workflow-root accessor (Director-locked α implementation per
+    /// `docs/design-lens-fold-prerequisites.md` §"Prereq-3a"). Walks
+    /// `d.nodes` (which is topologically ordered) backwards and returns:
+    ///
+    /// - `WorkflowRoot::SingleRoot(p)` for the last `Behavior::Bind`'s
+    ///   `result_port`, when at least one `Bind` exists.
+    /// - `WorkflowRoot::NoRoot` when zero `Bind` behaviors are present
+    ///   (lens fold short-circuits to `DimensionFail`; runtime evaluation
+    ///   rejects).
+    /// - `WorkflowRoot::AmbiguousRoot { .. }` is intentionally never
+    ///   emitted by this α implementation — the linear `d.nodes` order
+    ///   cannot tie. The variant is reserved at the type level for the
+    ///   future enumerate-all-eligible-entries rule that R2-Evaluator's
+    ///   `evaluate(program, entry, args)` consumes.
+    pub fn workflow_root_port(&self) -> WorkflowRoot {
+        for behavior in self.nodes.iter().rev() {
+            if let Behavior::Bind(b) = behavior {
+                return WorkflowRoot::SingleRoot(b.result_port());
+            }
+        }
+        WorkflowRoot::NoRoot
+    }
+
     pub fn optional_match_disj(&self, cardinality_decl_id: DeclarationId) -> Option<DeclarationId> {
         self.optional_match_disjs.get(&cardinality_decl_id).copied()
     }
@@ -3778,6 +3836,22 @@ fn duplicate_target_clean_emission_binding(
 mod tests {
     use super::*;
 
+    #[test]
+    fn workflow_root_zero_bind_returns_no_root() {
+        // V3 surface syntax always lowers each top-level decl to a
+        // Bind, so the zero-Bind case is structurally unreachable from
+        // `compile_to_dag` fixtures. The α path's `NoRoot` arm is
+        // defensive-only at the substrate boundary; this unit test
+        // exercises it via the crate-private `Dag::empty()` constructor.
+        let dag = Dag::empty();
+        let root = dag.workflow_root_port();
+        assert_eq!(
+            root,
+            WorkflowRoot::NoRoot,
+            "Dag with no Bind behaviors must fail closed with NoRoot"
+        );
+    }
+
     fn binding_fields(language: DeclarationId, clean_emission: DeclarationId) -> ValueBody {
         ValueBody::Structural {
             fields: vec![

src/v3/compiler/tests/integration.rs

@@ -171,6 +171,8 @@ mod test_runner_test;
 mod thesis_parallelism_test;
 #[path = "integration/thesis_validation_test.rs"]
 mod thesis_validation_test;
+#[path = "integration/workflow_root_port_test.rs"]
+mod workflow_root_port_test;
 
 mod t_demo_fixture_test {
     //! **Layer:** integration

src/v3/compiler/tests/integration/m1_substrate_test.rs

@@ -2972,8 +2972,8 @@ fn substrate_accessor_rust_binding_invariants() {
         checked += 1;
     }
     assert_eq!(
-        checked, 5,
-        "expected 5 substrate accessor bindings (port, node, resolve_producer, lane2_workflow, declaration_by_id)"
+        checked, 6,
+        "expected 6 substrate accessor bindings (port, node, resolve_producer, lane2_workflow_at, declaration_by_id, workflow_root_port)"
     );
     let missing: Vec<_> = universe.difference(&rust_covered).copied().collect();
     assert!(

src/v3/compiler/tests/integration/parse_corpus_manifest.txt

@@ -19,7 +19,7 @@ src/v3/compiler/tests/four_fixture_pressure/wrap.v3	4	5189	ac633b042c944480
 src/v3/compiler/tokenize.dag	29	59946	0a087425b90a125a
 src/v3/spec/go.dag	126	1146003	8a2493e5cde56374
 src/v3/spec/python.dag	89	582347	2fe9185bf19030a5
-src/v3/spec/rust.dag	144	1219155	e3772d77c07c3de1
+src/v3/spec/rust.dag	147	1229942	cf14d578f8e6e598
 src/v3/spec/v3_l1.dag	8	2246	57294d687b4753f4
 src/v3/std/algebra.dag	42	303630	8be5b86cc9520bc3
 src/v3/std/clean_emission.dag	15	23867	e7bc1e6145f4781e
@@ -41,7 +41,7 @@ src/v3/std/python_method_template_contracts.dag	5	120438	17c36841b44234d2
 src/v3/std/resources.dag	5	3632	5303e31e96b01ee5
 src/v3/std/runtime.dag	6	7993	0e703b02069526f6
 src/v3/std/rust_method_template_contracts.dag	5	61868	1e4c73f0fe7f03c6
-src/v3/std/substrate.dag	57	124531	9d03ca981cab59c3
+src/v3/std/substrate.dag	59	128739	82987951254e7b4d
 src/v3/std/substrate_minimal.dag	8	5372	feeb314c735f4672
 src/v3/std/termination.dag	18	36478	d010232f0373dc99
 src/v3/std/tokenize.dag	8	38819	2e158a74f33c18cc

src/v3/compiler/tests/integration/sg0_census_test.rs

@@ -370,6 +370,17 @@ const EXPECTED_HAND_AUTHORED_TEST: &[&str] = &[
     "src/v3/compiler/tests/integration/test_runner_test.rs",
     "src/v3/compiler/tests/integration/thesis_parallelism_test.rs",
     "src/v3/compiler/tests/integration/thesis_validation_test.rs",
+    // R2-Substrate Prereq-3a (`workflow_root_port` accessor + `WorkflowRoot`
+    // sum) per merged audit `docs/design-lens-fold-prerequisites.md`.
+    // Director-locked α: last topological `Bind`. Three integration
+    // claims exercise the `SingleRoot` single/multi cases and the
+    // unreachable-under-α ambiguous drift trigger; the zero-Bind
+    // `NoRoot` case lives as a unit test in `dag.rs` (crate-private
+    // `Dag::empty` constructor). Dispatch (#1130) accepted hand-Rust
+    // acceptance over real `compile_to_dag` fixtures; dissolves into
+    // `.dag` `TestClaim` form when testgen covers compile-and-fold
+    // structural assertions.
+    "src/v3/compiler/tests/integration/workflow_root_port_test.rs",
 ];
 
 // Non-`.rs` scaffold fragments under `src/v3/compiler/` that are

src/v3/compiler/tests/integration/workflow_root_port_test.rs

@@ -0,0 +1,105 @@
+//! **Layer:** integration
+//!
+//! Acceptance for Prereq-3a (`workflow_root_port` accessor) per the
+//! merged audit at `docs/design-lens-fold-prerequisites.md`. Director-
+//! locked α implementation: last topological `Bind` in `d.nodes`.
+//!
+//! Three claims in this module pin the α partition over `WorkflowRoot`:
+//! - `workflow_root_single_bind_returns_single_root`
+//! - `workflow_root_multi_bind_returns_single_under_alpha`
+//! - `workflow_root_ambiguous_unreachable_under_alpha`
+//!
+//! The fourth claim — `workflow_root_zero_bind_returns_no_root` —
+//! lives as a unit test in `src/v3/compiler/src/dag.rs` because
+//! constructing an empty `Dag` requires the crate-private
+//! `Dag::empty()` constructor.
+//!   (renamed from the audit's `_returns_ambiguous` since linear
+//!    `d.nodes` cannot produce ambiguity under α; the test pins
+//!    that α picks the LAST Bind even with multiple Binds present).
+//!
+//! `WorkflowRoot::AmbiguousRoot` cannot be exercised by the α
+//! implementation today; `workflow_root_ambiguous_unreachable_under_alpha`
+//! pins that claim explicitly so a future enumerate-all-eligible-entries
+//! rule landing under the same accessor causes the test to fail loudly,
+//! forcing the rule's behavior to grow its own coverage.
+//!
+//! The fourth audit claim — `workflow_root_consumed_by_runtime_entry_point`
+//! — is deferred to the R2-Evaluator integration PR; this slice
+//! only authors the substrate accessor.
+
+use crate::common::cached_compile_to_dag;
+use v3_compiler::dag::{Behavior, Dag, PortId, WorkflowRoot};
+
+fn last_bind_result_port(dag: &Dag) -> PortId {
+    for behavior in dag.nodes().iter().rev() {
+        if let Behavior::Bind(b) = behavior {
+            return b.result_port();
+        }
+    }
+    panic!("test fixture has no Bind — adjust source");
+}
+
+#[test]
+fn workflow_root_single_bind_returns_single_root() {
+    let dag = cached_compile_to_dag("let x = 1 + 2", "workflow_root_single.v3");
+    let expected = last_bind_result_port(&dag);
+    let root = dag.workflow_root_port();
+    assert_eq!(
+        root,
+        WorkflowRoot::SingleRoot(expected),
+        "single Bind must return SingleRoot pointing at its result_port"
+    );
+}
+
+#[test]
+fn workflow_root_multi_bind_returns_single_under_alpha() {
+    // Two top-level Binds in source order. Under α (last topological
+    // Bind), the second Bind's result_port is the workflow root.
+    // AmbiguousRoot is intentionally NOT emitted — it's reserved for
+    // the future enumerate-all-eligible-entries rule.
+    let dag = cached_compile_to_dag("let x = 1\nlet y = x + 2", "workflow_root_multi.v3");
+    let expected = last_bind_result_port(&dag);
+    let root = dag.workflow_root_port();
+    assert_eq!(
+        root,
+        WorkflowRoot::SingleRoot(expected),
+        "α picks the last topological Bind even with multiple Binds; \
+         AmbiguousRoot reserved for the enumerate-all rule"
+    );
+}
+
+#[test]
+fn workflow_root_ambiguous_unreachable_under_alpha() {
+    // Drift trigger: under α with linear d.nodes, AmbiguousRoot is
+    // structurally unreachable. If a future commit makes
+    // workflow_root_port emit AmbiguousRoot, this test fails and
+    // forces the change to grow its own enumerate-all-rule coverage
+    // rather than silently inheriting α's tests.
+    let fixtures = [
+        ("let x = 1", "wf_root_amb_a.v3"),
+        ("let x = 1\nlet y = 2\nlet z = x + y", "wf_root_amb_b.v3"),
+    ];
+    for (src, file) in fixtures.iter() {
+        let dag = cached_compile_to_dag(src, file);
+        let root = dag.workflow_root_port();
+        assert!(
+            !matches!(root, WorkflowRoot::AmbiguousRoot { .. }),
+            "fixture `{file}` produced AmbiguousRoot under α — α is a \
+             single-pick rule over linear d.nodes and must never tie. \
+             If this fires, an enumerate-all-eligible-entries rule has \
+             been wired and the audit's ambiguous-acceptance must move \
+             to its own consumer test."
+        );
+    }
+}
+
+// `workflow_root_zero_bind_returns_no_root` lives as a `#[cfg(test)]`
+// unit test inside `src/v3/compiler/src/dag.rs` next to
+// `Dag::workflow_root_port` itself, because constructing a truly
+// empty `Dag` requires the crate-private `Dag::empty()` constructor.
+// V3 surface syntax always lowers each top-level decl to a `Bind`, so
+// the zero-Bind case is structurally unreachable from `compile_to_dag`
+// fixtures and the `NoRoot` arm is defensive-only at the substrate
+// boundary.
+//
+// See: dag.rs `mod tests::workflow_root_zero_bind_returns_no_root`.

src/v3/spec/rust.dag

@@ -1434,6 +1434,42 @@ data lane2_workflow_at_binding_rust: SubstrateAccessorBinding = {
   language: rust_language
 }
 
+// Workflow-root accessor (Prereq-3a per `docs/design-lens-fold-prerequisites.md`).
+// Renders to `Dag::workflow_root_port` per the α implementation at
+// `src/v3/compiler/src/dag.rs`. The accessor takes only `&self`, so the
+// `({p0})` template is a single positional argument receiver; the result
+// is a `WorkflowRoot` value (no Optional wrapping; the carrier itself
+// partitions SingleRoot / NoRoot / AmbiguousRoot fail-closed).
+//
+// Landing this binding alongside the substrate accessor closes the
+// `substrate_accessor_universe` boundary for this slice — the
+// emitter can resolve any `.dag` consumer of `workflow_root_port`
+// without falling through to plain callable dispatch.
+data rust_workflow_root_port_accessor: SubstrateAccessorRealization = {
+  carrier: "({p0}).workflow_root_port()"
+}
+
+data workflow_root_port_binding_rust: SubstrateAccessorBinding = {
+  accessor: workflow_root_port
+  realization: rust_workflow_root_port_accessor
+  language: rust_language
+}
+
+// `WorkflowRoot` substrate sum mirror — emitted Rust matches over
+// `SingleRoot(PortId) | NoRoot | AmbiguousRoot { candidates }` need
+// the substrate-to-Rust carrier mapping so generated code preserves
+// the sum identity rather than rendering through a free name. The
+// Rust enum lives at `src/v3/compiler/src/dag.rs:1936-1941` and is
+// directly addressable as `WorkflowRoot` in the v3-compiler crate.
+data rust_workflow_root: TypeRealization = {
+  language: rust_language
+  target: WorkflowRoot
+  carrier: "WorkflowRoot"
+  is_copy: false
+  fields: []
+  cost: 1
+}
+
 // `declaration_by_id(d: Dag, id: DeclarationId) -> Declaration?` —
 // id-keyed parity with `port` / `node`. Host realization is
 // `Dag::declaration_opt(&DeclarationId)`; `.cloned()` mirrors the

src/v3/std/substrate.dag

@@ -487,6 +487,73 @@ fn lane2_workflow_at(d: Dag, id: NodeId) -> WorkflowEffect? {
   host lane2_workflow_effect_at
 }
 
+// Workflow-root identification (Director-locked α; per
+// `docs/design-lens-framework.md` Q-shape and merged audit
+// `docs/design-lens-fold-prerequisites.md` §"Prereq-3a").
+//
+// 🟡 SCAFFOLD coproduct. The three arms partition every legitimate
+// `Dag` exactly once at the substrate-load boundary:
+//
+//   - `SingleRoot(p)` — α (last topological `Bind`) selected `p` as
+//     the workflow-root port. Emitted whenever the Dag contains at
+//     least one `Bind`; multiple Binds are NOT ambiguous under α —
+//     the linear `d.nodes` order picks exactly one last element by
+//     definition. `p` is the chosen Bind's `result_port`.
+//   - `NoRoot` — zero `Bind` behaviors in `d.nodes`. The fold short-
+//     circuits (`fold_lens<C>` returns `DimensionFail` with a
+//     no-root diagnostic; `R2-Evaluator.evaluate(...)` rejects).
+//   - `AmbiguousRoot { candidates }` — reserved for the
+//     enumerate-all-eligible-entries rule that the runtime evaluator
+//     (`evaluate(program, entry, args)` per Items 4+5 / #1176 §3.2)
+//     consumes for multi-entry programs. The α / γ "last X Bind"
+//     rules cannot populate this arm over a linear `Dag.nodes` —
+//     both pick exactly one element by definition. Pinned here as a
+//     fail-closed surface for the future enumerate-all consumer
+//     wiring; today's α implementation never emits this variant.
+//
+// Pattern 1 (per-call total fact) was rejected: `-> PortId` would
+// fabricate or panic on `NoRoot` cases. Pattern 2 (collapse to
+// `Option<PortId>`) loses the `AmbiguousRoot` channel for the
+// multi-entry consumer. Pattern 3 (this sum) is the dissolution
+// path: each variant carries the structural reason its arm was
+// taken; consumers dispatch fail-closed without fabrication.
+//
+// Dissolution: γ refinement (last `UserCallable` `Bind`) and the
+// enumerate-all rule both reuse this same partition behind the
+// `workflow_root_port` accessor; no carrier change required.
+type WorkflowRoot
+  = SingleRoot(PortId)
+  | NoRoot
+  | AmbiguousRoot { candidates: NonSingletonList<PortId> }
+
+// Workflow-root accessor (per merged audit Prereq-3a). Implements
+// the α rule: last topological `Bind` in `d.nodes`. Returns
+// `WorkflowRoot::SingleRoot(b.result_port)` when the Dag contains
+// at least one Bind (α picks the last one); `NoRoot` when zero
+// Binds; never `AmbiguousRoot` under α (linear `d.nodes` cannot
+// tie — multiple Binds are not ambiguous, α just picks the last).
+// Shared authority — both `fold_lens<C>` (workflow-root
+// identification for the equivalence target) and R2-Evaluator
+// (runtime entry-point identification) are the planned consumers.
+//
+// 🟡 BOUNDED STAGING on the realization side. The declaration +
+// Rust impl + Rust binding (`rust_workflow_root_port_accessor` +
+// `workflow_root_port_binding_rust` in `src/v3/spec/rust.dag`) land
+// in Prereq-3a (this PR), which puts the accessor in
+// `substrate_accessor_universe` so any `.dag` consumer that
+// references it lowers to the Rust template. Per-target
+// Python/Go bindings are NOT in this PR. Trigger: when a Python
+// or Go emitter first consumes `workflow_root_port`, the
+// corresponding `SubstrateAccessorBinding` lands atomically with
+// that consumer — same staging discipline as `lane2_workflow_at`
+// (Rust binding landed first because the lens runtime needs it;
+// other targets land when they emit a consumer). Today's path
+// fails closed at emit time for the unbound targets via
+// `EmitError::MissingSubstrateAccessorRealization`.
+fn workflow_root_port(d: Dag) -> WorkflowRoot {
+  host workflow_root_port
+}
+
 // `Lookup<DeclarationId>` monomorphized constructors (same shim story as
 // `miss_int_lookup` in `v3.std.lookup` and `miss_symbolic_cost_lookup` in
 // `std.algebra`). Lives here so `infer_helpers.dag` can call them via