fix: gate slot cancel-safety + post-inference freeze discard (algo #6)

Codex 质量审 4 项:推理后二次冻结检查(τ 后 in-flight 结果整体丢弃)、
acquire 取消回滚(半持有 permit 自动归还)、BoundedSemaphore 防静默扩容、
补取消恢复与冻结丢弃两个回归测试。

tests/unit/test_gate_unit_arm.py

@@ -196,3 +196,62 @@ async def test_question_slots_rejects_oversized_request() -> None:
     slots = _QuestionSlots(1)
     with pytest.raises(ValueError, match="自死锁"):
         await slots.acquire(2)
+
+
+@pytest.mark.asyncio
+async def test_acquire_cancellation_restores_capacity() -> None:
+    """acquire 半持有时被取消:已拿 permit 自动回滚,容量完全恢复(Codex 质量审 2)。"""
+    slots = _QuestionSlots(2)
+    await slots.acquire(1)  # 预占 1 槽,使 acquire(2) 卡在第二槽
+    task = asyncio.ensure_future(slots.acquire(2))
+    for _ in range(5):
+        await asyncio.sleep(0)  # 让 task 拿到第 1 个 permit 并阻塞在第 2 个
+    task.cancel()
+    with pytest.raises(asyncio.CancelledError):
+        await task
+    slots.release(1)  # 归还预占
+    # 半持有的 permit 若泄漏,此处 acquire(2) 将永久阻塞 → wait_for 超时暴露泄漏
+    await asyncio.wait_for(slots.acquire(2), timeout=1.0)
+    slots.release(2)
+
+
+@pytest.mark.asyncio
+async def test_frozen_during_inference_discards_result(tmp_path) -> None:
+    """推理 await 期间被冻结:in-flight 结果整体丢弃(不写 slot/计数器/缓存)。
+
+    设计语义:τ(冻结时刻)之后到达的结果不计入,滞后 INFRA 也不得触发护栏。
+    """
+    run, cache = _mk_gate_run(1, tmp_path)
+    log = _FakeLog()
+    gate_open = asyncio.Event()
+
+    async def _slow_run(questions, *, run_id: str, skills_dir: Path):
+        await gate_open.wait()
+        return await _fake_run_inference(log, correct=True)(
+            questions, run_id=run_id, skills_dir=skills_dir
+        )
+
+    task = asyncio.ensure_future(
+        _run_unit_arm(
+            run,
+            0,
+            "base",
+            _QuestionSlots(4),
+            _slow_run,
+            log,
+            cache,
+            "v1",
+            tmp_path,
+            tmp_path,
+            _PARAMS,
+            0.10,
+        )
+    )
+    for _ in range(5):
+        await asyncio.sleep(0)  # 让 task 进入推理等待
+    run.frozen = True
+    gate_open.set()
+    await task
+    assert run.slots[0].base is None
+    assert run.infra_denom == 0 and run.errors == 0
+    assert cache.get("Action Reasoning", run.s_hash, "v1", "q0") is None