Tell a broken normalize gate apart from a bad patch

[tarekziade]

The problem

When the repo normalizer rejects a patch, the in-loop gate feeds the failure back to the model and spends a correction. That is correct when the patch is at fault, and useless when the gate itself is broken: every correction is rejected by the same environment error, the budget runs out, and the task reports "the proposed patch does not pass the repository's normalizer" — pointing the reader at the model rather than at the runner image.

That is exactly what the 2026-08-17 nightly triage hit (transformers#48037):

• transformers' main moved its tokenizers pin to >=0.23.1,<0.24.0 (242f5df9, 2026-08-17 01:35 UTC);
• the task-runner image still had tokenizers==0.22.2;
• so every checker that imports transformers died on dependency_versions_check — 6 of them, while the 2 that don't import transformers passed;
• three groups (cosmos3_omni, generation, cwm) reported 🚫 no fix, and ~3.5M input tokens were spent on an error no patch could address.

The gate installs the worktree with --no-deps, and it has to: the task pod's egress allowlist has no PyPI. So it cannot repair a dependency drift on its own — it can only notice it.

The change

On a normalizer failure, re-run the normalizer once on the pristine checkout:

• clean exit → the gate works, the patch really is at fault → unchanged behavior (feedback to the model);
• non-zero → no patch can pass → raise NormalizeGateBroken, so the task fails loudly with the likely cause named.

Properties:

• Failure path only — a healthy task pays nothing.
• Cached per task — the extra normalizer run is paid at most once, no matter how many corrections follow.
• Not a 422 — 422 makes the runner skip to the next candidate group, but a broken gate breaks every group.
• Both call sites — the in-loop gate and publish_task's raw-apply fallback (the one that produced the message quoted above).
• Exit code, not diff, is the signal: a base that isn't itself normalizer-clean legitimately produces changes, and the worktree is left pristine either way.

Tests

653 passed, ruff clean. The existing "normalizer rejects the patch" tests used a normalizer that failed unconditionally — which is now the broken-gate case — so they were switched to a patch-sensitive one and still test what they claim to. New: broken gate raises (with status 500 and the normalize_error event), the baseline runs once per task, and a healthy gate never triggers it.

Not in this PR

The image drift itself. serge-task-runner needs a rebuild on a current transformers-quality base so prod stops failing on tokenizers; this PR only makes the next occurrence legible instead of expensive.

🤖 Generated with Claude Code