audit: close review gaps, dedupe control-region and activation helpers

tests/core/test_foreach_back_edges.py

@@ -695,6 +695,32 @@ def test_nonlocal_runtime_return_fails_closed_when_validation_is_bypassed() -> N
         advance_frame(run, run.frames["inner-item"], outcome="ok", next_node_id="outer")
 
 
+def test_root_frame_targeting_foreach_enters_normally() -> None:
+    """A root frame naming a foreach enters it; only an item frame returns."""
+    from wf_core.runtime.ops.flow import advance_frame
+
+    run = RunState(
+        workflow_name="root_entry",
+        status=RunStatus.RUNNING,
+        workflow_input={},
+        state={},
+        frames={},
+    )
+    add_frame(
+        run,
+        ExecutionFrame(id="root", kind="workflow", node_id="start"),
+    )
+    run.current_frame_id = "root"
+    run.sync_from_current_frame()
+
+    advance_frame(run, run.frames["root"], outcome="ok", next_node_id="each")
+
+    entered = run.frames["root"]
+    assert entered.node_id == "each"
+    assert entered.status == FrameStatus.PENDING
+    assert entered.finished_at_node_id is None
+
+
 def test_completed_activation_cannot_consume_later_activation_result_or_wake() -> None:
     """A closed visit rejects buffered results and wake-ups from other visits."""
     from wf_core.runtime.foreach_state import (

tests/core/test_foreach_control_regions.py

@@ -265,6 +265,31 @@ def test_skipping_inner_foreach_owner_is_invalid_return() -> None:
     assert matching[0].path == "edges[2]"
 
 
+def test_reentering_active_ancestor_foreach_as_nested_controller_is_invalid() -> None:
+    workflow = _workflow(
+        start="f1",
+        nodes=[_foreach("f1"), _foreach("f2")],
+        edges=[
+            {"from": "f1", "outcome": "loop", "to": "f2"},
+            {"from": "f2", "outcome": "loop", "to": "f1"},
+            {"from": "f2", "outcome": "done", "to": "f1"},
+            {"from": "f1", "outcome": "done", "to": END},
+        ],
+    )
+
+    analysis = analyze_control_regions(workflow)
+
+    assert (ControlRegionIssueKind.INVALID_FOREACH_RETURN, "edges[1]") in [
+        (issue.kind, issue.path) for issue in analysis.issues
+    ]
+    matching = [
+        issue
+        for issue in workflow.validate_structure().errors
+        if issue.code == ValidationIssueCode.INVALID_FOREACH_RETURN
+    ]
+    assert matching[0].path == "edges[1]"
+
+
 def test_entering_sibling_foreach_body_is_region_conflict() -> None:
     workflow = _workflow(
         start="f1",