Function lower_op_sig_ir_from_commons 

pub fn lower_op_sig_ir_from_commons(
    op: &CapabilityOp,
    commons: &TypedCommons,
) -> OpSig

#1187’s own closing scoping pass: a TypedCommons-only sibling of lower_op_sig_ir, for the one real call site that never has a &CheckedProgram — emitter/lower.rs’s cap_op_param_names, feeding trace(Cap.op)/with-predicate observation lowering (bynk.test’s DSL). That call path’s own TypedCommons is a synthetic, hand-assembled project-wide view (project/tests_emit.rs’s synthetic_typed_commons_for_target, merging every consumed unit’s own capability declarations into one scratch commons for lookup) — never itself the output of certify, so wrapping it as a CheckedProgram here would misrepresent an uncertified value as certified (CheckedProgram’s own doc comment, bynk-check/src/checker.rs, warns against exactly this). Splitting this out is sound precisely because this function never calls LowerIrCtx::expr_ty — the one method whose .expect()-panic needs a genuinely certified program, the reason this module’s own file-level doc comment gives for taking &CheckedProgram everywhere else. resolve_type_ref/unit_ty() (below) both degrade via .unwrap_or_else and read nothing TypedCommons doesn’t already expose directly.