Deflake the drop-abort freshness test with a deterministic gate

[KaiCode2]

Fixes the pre-existing flaky test dropping_speculative_sim_aborts_before_queueing_correction (tests/freshness.rs), surfaced during the Phase 5 review: it passes in isolation but trips intermittently under full-suite parallel load. Stacked on phase-5-cow-snapshots; product code is untouched.

Root cause

The test did let sim = controller.run(...); drop(sim); and assumed the SpeculativeSim's drop-abort() would win a race against the spawned multi_thread validator's first poll — asserting (via a called atomic) that the validator never even reached the fetcher. Under load the spawned task can reach the fetcher / queue a correction before the abort lands, so the assertion fails. The flakiness is in the test's timing assumption, not the product (the abort-on-drop behavior is correct).

Fix

Replace the racy called flag with a Gate (Mutex + Condvar, Send + Sync): the fetcher blocks until the test calls gate.release(), and the test releases it only after drop(sim) has set the cancel flag. So the validator's fetch — and therefore its post-fetch, correction-queuing checkpoint — can only complete once cancellation is already observable, regardless of how the scheduler interleaves the two threads. Drops the over-strict "fetcher never reached" assertion (the product guarantees a cancel seen at a checkpoint suppresses side effects, not that an in-flight fetch is skipped) and keeps the real invariants: no correction queued, no re-run.

Verification

Deflaked test 10/10 under repeated runs; full freshness suite green in both configs; full default suite clean. Test-only change (tests/freshness.rs + the Gate/gated_tracking_fetcher helper in tests/common/mod.rs).

🤖 Generated with Claude Code