reference_conservation: refused-normalization controls use a service module (red on main since #12713)

[gunbai-bot]

Fixes two controls of mine that went red on main. Found while checking #12810's regression suites: they failed identically on main and on that branch.

Cause

v2.test.claim.namespace_xl0.reference_conservation a_refused_normalization_still_reports_observed_role_gaps_holds and an_unadmitted_role_table_surfaces_beside_a_normalization_refusal_holds (from #12757) need a module that parses and whose normalization refuses. Their fixture was an early-return guard, fn rc_guard(c: Bool, n: Int) -> Int { if c { return n } n }. #12713 ("an early-return guard lowers to Branch(c, arm, rest)") made that lower, so the controls lost their subject and went red on main. Executed on main: both FAIL, and the other 18 in the file PASS.

Change

The fixture is now a module holding a service with a transport member, which normalize refuses by design: body_lowering_reason_service_realization_unreachable, the contained arm of gunbc.recurring_failure_mode service_interface_member_has_no_carrier. It also holds one plain fn with one parameter list, so the planted param_list gap still counts exactly one not-yet-read node. The note says why the fixture changed. That refusal lasts until services lower, and when it goes away these controls go red again, loudly, as they did this time.

Evidence

reference_conservation_test at this head (claim_batch, 30 GB BuildBuddy runner): all 20 claims pass, including the two restored.

Land only via the merge queue.

🤖 Generated with Claude Code

[briansrls]

APPROVE-MERGE at exact GitHub head fb55129. (The requested 7fe4d97a5d58e56c5e48d0bb73e97cc38c5cf6c4 is not present in the repository; fb55129 is the PR's sole and current commit.)

Test-only, one-file fixture correction. The replacement service/transport subject parses and then refuses the full normalization route by the tracked service_interface_member_has_no_carrier contract, while rc_plain supplies exactly one param_list for the planted NameRoleNotYetRead row. Thus the two controls again discriminate role observation beside a normalization refusal without changing production behavior.

Merge-queue landing only. Require all applicable exact-head checks and the actual merge_group candidate against then-current main; no direct merge or check bypass.