Function with_parsed_program_checked 

pub fn with_parsed_program_checked<T>(
    input: &str,
    f: impl for<'a> FnOnce(Result<(&'a [Stmt<'a>], &'a TypeRegistry, PolicyRegistry), ParseError>, &'a Interner) -> Result<T, ParseError>,
) -> Result<T, ParseError>

with_parsed_program for a Result-returning compile (the emit c/isa/wasm backends): installs ## No, opens a ## Require firing-trace around f, and after f succeeds fails the compile on any demanded optimization that did not fire — the honest answer when a backend (e.g. the VM tiers, which don’t memoize) cannot provide a required optimization. f’s own error propagates unchanged.

f is handed the parse Result RAW — spans still in the prelude-expanded text f actually parsed, exactly like every backend’s own stmts — and undone EXACTLY ONCE, at the single point below where an error leaves this function. f may return the parse error unchanged (the overwhelming majority: let (stmts, ..) = parsed?;) or a NEW error located at an AST span compile_with_oracle_located or a resolver check built (also still prelude-coordinate, unavoidably, since nothing between the parse and here ever undoes the splice) — both need the SAME one undoing, so there is exactly one place to trust and it runs on whatever comes out, not on what goes in. Undoing it going IN as well as coming OUT re-translated an already-correct span a second time: the splice’s stdlib segment is typically the largest run in the expanded text, so almost any small, correct, already-undone offset falls inside where IT sits and maps to “added text” — silently becoming Span::default() for any caller whose f simply forwards parsed’s own error, which is the shape every current caller uses.