Function lower_service_handler_signature_ir 

pub fn lower_service_handler_signature_ir(
    h: &Handler,
    program: &CheckedProgram,
) -> HandlerSignatureIr

A service handler’s resolved signature — params/given/ret/ effectful — and never its body. This is what emit_service (bynk-emit/src/emitter/emit.rs) reads per handler, and what lower_event_subscriber_shapes_ir reads for a subscriber’s parameter count. Mirrors body_writes_state’s posture (#1196): a narrow, standalone reader of already-resolved data, applied to signature data instead of a body walk.

A service handler’s own param type is not resolution-checked by the checker at all (1199_service_handler_unresolvable_param_type_no_ice pins it), so a resolve miss degrades to Ty::Unit here rather than panicking — the same fallback lower_protocol_ir documents for a WebSocket frame type, and for the same reason: an ADR 0334 panic may only assert a guarantee the checker actually gives. (The agent-handler signature reader that did panic on a miss was correct for its input, which the checker does guarantee resolves; it went with the body lowering in Slice D1 of #1542.)