Function lower_protocol_ir 

pub fn lower_protocol_ir(
    protocol: &ServiceProtocol,
    program: &CheckedProgram,
) -> ProtocolIr

P6.11 ([DECISION A], #1171): lower a service’s own from <protocol> header into a real ProtocolIr — standalone, takes the sub-node rather than the owning ServiceDecl (mirrors lower_store_field_ir), so a from websocket/from Events fixture can pin the descriptor by itself even where lower_service_handler_ir cannot yet lower every handler on the same service (the WebSocket lifecycle-body deferral — see that function’s own doc comment).

WebSocket/Events’s own type refs resolve through the Ty::Unit fallback, not an ADR 0334 panic — deliberately, and for the same reason lower_agent_item_ir’s own key_ty does: resolver.rs skips CommonsItem::Service in every one of its own type-ref-resolution passes (resolver.rs:303-304/493-494/577-578), and the one checker site that does resolve a WebSocket frame type itself falls back to Ty::Unit on a miss rather than erroring (context_checks.rs:775-778). Panicking here would make this the second ADR-0334 site in this module asserting a guarantee the checker doesn’t actually give — the first being lower_agent_item_ir’s own key_ty, review of #1169.