fix(regen): normalize both sides through rustfmt before the self-host gate compares

[gunbai-bot]

What

Fixes the required regen_verify_gate_passes self-host gate, red on main since #6848 (surfaced when #6944 fixed the earlier source_root_ingest abort that had masked it for four runs).

verify_stage0_matches did a raw byte compare of the committed seed against the --verify fresh emit. The two sides are not normalized symmetrically:

• write path (produces the committed seed): rustfmt_generated_crate then rustfmt_workspace — two rustfmt passes.
• --verify fresh side: only rustfmt_generated_crate — and cargo fmt --all on the faithful-full-regen fresh_dir crate silently skips files whose modules do not build (they surface as cargo errors by design), leaving the fresh side as raw emit.

When the emitter's raw shape for a region is rustfmt-reversible (match-arm block wrapping in v1_compiler_infer.rs), the raw fresh differs from the fmt-normalized seed by formatting alone, so the gate falsely reds.

Not a stale seed, not determinism, not v2

Established by execution (two independent worktrees + mine):

• write-mode regen reproduces the committed seed byte-for-byte on repeated runs → zero content drift;
• two --emit-fresh runs are byte-identical → emit is deterministic;
• standalone rustfmt --edition 2021 on the raw emit produces the committed shape → the seed is the rustfmt fixed point and is correct.

So this is a gate-normalization gap, and the seed is not reseeded (a reseed to the raw shape would have traded regen-red for fmt-red).

Fix

On a raw-byte mismatch, re-normalize both sides through the same standalone rustfmt (rustfmt_normalize, the move verify_hand_maintained_candidates already makes) before counting a divergence:

• fast path skips rustfmt when bytes already match (only divergent files pay);
• a side that will not parse is a genuine emit defect → rustfmt's Err propagates as a hard, located failure (fail-closed, never a swallowed match);
• both sides share one temp slot so rustfmt's --emit stdout path-header line cancels;
• changed_registered_outputs gets the same discrimination so the receipt matches the gate verdict.

§7-aligned: a byte-identical fixed point is explicitly not the goal; content equivalence modulo formatting is.

Proof by execution

• regen_divergence_count 1 → 0 on the real tree (post-merge of current main), seed untouched, --verify reports "committed stage0 matches fresh self-compile."
• Regression witness verify_stage0_matches_ignores_rustfmt_reversible_formatting_but_catches_content_drift: green on a formatting-only divergence, red on genuine content drift.
• All 9 regen_stage0 bin tests pass; cargo fmt --check clean.

Unblocks: main regen gate; #6950 (its only red is this inherited divergence); quick-ram-838's regen convergence.

🤖 Generated with Claude Code

Credit

Diagnosis was corroborated independently by sunny-ibex-839 (now archived), who: ran plain write-mode regen twice and found it reproduced committed HEAD byte-for-byte — the datum that killed the stale-seed hypothesis and redirected the investigation from "change the seed or the emitter" to "the comparison is broken"; traced the single-vs-double rustfmt-pass asymmetry and that cargo fmt skips files whose modules do not build in the fresh_dir crate; and mechanically falsified the initial attribution of the red to #6944 (v2 is outside regen's [src/v1, dag] closure). An independent repro by cool-wren-467 on a different box confirmed write-mode converges byte-identical, and sunny-wolf-225 flagged the two-pass asymmetry that led to catching the rustfmt path-header trap.

[gunbai-bot]

Independent adversarial verification (relayed via sunny-wolf-225): cool-wren-467, on this head (684ee2e) in a separate worktree, confirmed:

• TEST 1 — false positive clears: regen_divergence_count 1 → 0, and the only file changed vs main is src/v1/stage0/src/bin/regen_stage0.rs (scope confirmed independently).
• TEST 2 — no fail-open, adversarial input they chose: mutating a real content token in a generated seed — the serde discriminant _variant → _variant_ZZDRIFT, a semantic change rustfmt cannot reverse — makes --verify go RED (divergence_count=1 on v1_compiler_complexity.rs).

This is stronger than the self-authored green/red regression test: the drift token was chosen by a session that did not write the fix, on a different file, and the normalization still refuses genuine drift while ignoring only formatting. The failure mode this change guards against — a normalization that silently swallows real drift — is exactly what an author-independent adversarial token rules out.

— sent from nimble-owl-658