fix: Prevent panic by Number::modulo (#773)

In Number::modulo, it calls Number::ints_to_bigint, which could panic. The reason is that calling .to_integer() isn't enough to guarantee that .to_bigint_owned() will return Some, but Number::ints_to_bigint assumes it will and calls unwrap(). In particular, it might be that it's a float corresponding to an integer that's larger than F64_SAFE_INTEGER. The fix is to not call Number::ints_to_bigint (and indeed to delete that entire function, which is only used in this one place), and instead only call unwrap when Some is returned.

.dir-locals.el

@@ -0,0 +1,12 @@
+;;; Directory Local Variables            -*- no-byte-compile: t; -*-
+;;; For more information see (info "(emacs) Directory Variables")
+
+;; Regorus is a cargo-verus project (package.metadata.verus.verify = true), so
+;; verus-mode.el runs `cargo verus verify' rather than the raw `verus' binary.
+;; The cargo-verus path ignores `package.metadata.verus.ide.extra_args' and
+;; instead reads `verus-cargo-verus-arguments'. We set it here so that Verus is
+;; invoked with the `verus' Cargo feature enabled.
+;;
+;; Everything before `--' is passed to cargo-verus; everything after `--' is
+;; forwarded to the Verus binary. The `--' is required by verus-mode.el.
+((verus-mode . ((verus-cargo-verus-arguments . ("--features" "verus" "--")))))

.github/workflows/codeql.yml

@@ -62,7 +62,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     # Setup language-specific dependencies BEFORE CodeQL init for proper tracing setup
     - name: Setup Rust
@@ -86,26 +86,26 @@ jobs:
 
     - name: Setup Python
       if: matrix.language == 'python'
-      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         python-version: '3.10'
 
     - name: Setup Java
       if: matrix.language == 'java-kotlin'
-      uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
       with:
         distribution: 'corretto'
         java-version: '8'
 
     - name: Setup Go
       if: matrix.language == 'go'
-      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
         go-version: '1.21'
 
     - name: Setup .NET
       if: matrix.language == 'csharp'
-      uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
+      uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
       with:
         global-json-file: ./bindings/csharp/global.json
 
@@ -115,12 +115,12 @@ jobs:
 
     - name: Setup Node.js
       if: matrix.language == 'javascript-typescript'
-      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: '18'
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+      uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -141,7 +141,7 @@ jobs:
 
     - name: Setup Ruby
       if: matrix.language == 'rust' && contains(matrix.working-directory, 'ruby')
-      uses: ruby/setup-ruby@c4e5b1316158f92e3d49443a9d58b31d25ac0f8f # v1.306.0
+      uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
       with:
         ruby-version: '3.4.2'
         bundler-cache: true
@@ -188,6 +188,6 @@ jobs:
       run: cargo xtask build-wasm --release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+      uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/dependabot-refresh-cargo-lockfiles.yml

@@ -33,7 +33,7 @@ jobs:
       # ONLY cargo update and cargo metadata (which do NOT execute build
       # scripts) may run against this checkout. Do NOT add cargo build/check/
       # test/run steps.
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v4.2.2
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
           ref: ${{ github.event.pull_request.head.sha }}

.github/workflows/dependency-audit.yml

@@ -27,7 +27,7 @@ jobs:
           - bindings/wasm/Cargo.lock
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Run cargo audit
         uses: rustsec/audit-check@v2
@@ -53,7 +53,7 @@ jobs:
           - xtask/Cargo.toml
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Rust
         uses: ./.github/actions/toolchains/rust

.github/workflows/feature-matrix.yml

@@ -67,7 +67,7 @@ jobs:
             features: arc,opa-no-std
 
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Setup Rust toolchain
       uses: ./.github/actions/toolchains/rust
     - name: Cache cargo

.github/workflows/miri.yml

@@ -14,7 +14,7 @@ jobs:
       MIRIFLAGS: "-Zmiri-disable-isolation"
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - uses: ./.github/actions/toolchains/rust
         with:
           toolchain: nightly

.github/workflows/pr-extensions.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Setup Rust toolchain
       uses: ./.github/actions/toolchains/rust
     - name: Cache cargo

.github/workflows/pr.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Setup Rust toolchain
       uses: ./.github/actions/toolchains/rust
     - name: Cache cargo

.github/workflows/publish-java.yml

@@ -35,10 +35,10 @@ jobs:
             os: windows-latest
             extension: dll
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           java-version: 8
           distribution: "corretto"
@@ -46,7 +46,7 @@ jobs:
         with:
           targets: ${{ matrix.target }}
       - if: ${{ matrix.build_cmd == 'zigbuild' }}
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
       - if: ${{ matrix.build_cmd == 'zigbuild' }}
@@ -66,10 +66,10 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           java-version: 8
           distribution: "corretto"

.github/workflows/publish-python.yml

@@ -20,8 +20,8 @@ jobs:
       matrix:
         target: [x86_64, x86, aarch64, armv7, s390x, ppc64le]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.10'
       - uses: ./.github/actions/toolchains/rust
@@ -52,8 +52,8 @@ jobs:
       matrix:
         target: [x64, x86]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.10'
           architecture: ${{ matrix.target }}
@@ -84,8 +84,8 @@ jobs:
       matrix:
         target: [x86_64, aarch64, universal2-apple-darwin]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.10'
       - uses: ./.github/actions/toolchains/rust

.github/workflows/publish-wasm.yml

@@ -15,11 +15,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       # Setup .npmrc file to publish to npm
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '20.x'
           registry-url: 'https://registry.npmjs.org'

.github/workflows/release-plz.yml

@@ -17,13 +17,13 @@ jobs:
       contents: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: Install Rust toolchain
         uses: ./.github/actions/toolchains/rust
       - name: Run release-plz
-        uses: MarcoIeni/release-plz-action@1528104d2ca23787631a1c1f022abb64b34c1e11 # v0.5.128
+        uses: MarcoIeni/release-plz-action@2eb1d8bcb770b4c48ccfaad919734b38b51958c9 # v0.5.131
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

.github/workflows/rust-clippy.yml

@@ -32,7 +32,7 @@ jobs:
       actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Rust toolchain
         uses: ./.github/actions/toolchains/rust
@@ -52,7 +52,7 @@ jobs:
 
       - name: Upload analysis results to GitHub
         if: ${{ hashFiles('rust-clippy-results.sarif') != '' }}
-        uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v3.29.11
+        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3.29.11
         with:
           sarif_file: rust-clippy-results.sarif
           wait-for-processing: true

.github/workflows/test-c-cpp.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 

.github/workflows/test-csharp.yml

@@ -39,7 +39,7 @@ jobs:
               **/release/libregorus_ffi.dylib
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - uses: ./.github/actions/toolchains/rust
@@ -73,11 +73,11 @@ jobs:
     needs: build-ffi
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0  
       - uses: ./.github/actions/toolchains/rust
-      - uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           global-json-file: ./bindings/csharp/global.json
 
@@ -131,13 +131,13 @@ jobs:
             target: aarch64-apple-darwin
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
       - uses: ./.github/actions/toolchains/rust
 
-      - uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           global-json-file: ./bindings/csharp/global.json
 

.github/workflows/test-ffi.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - uses: ./.github/actions/toolchains/rust

.github/workflows/test-go.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - uses: ./.github/actions/toolchains/rust
@@ -30,7 +30,7 @@ jobs:
       - name: Fetch FFI crate dependencies
         run: cargo fetch --locked --manifest-path bindings/ffi/Cargo.toml
 
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           architecture: x64
 

.github/workflows/test-java.yml

@@ -16,11 +16,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           java-version: 8
           distribution: "corretto"

.github/workflows/test-musl.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - uses: ./.github/actions/toolchains/rust
       with:
         targets: x86_64-unknown-linux-musl

.github/workflows/test-no-std.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - uses: ./.github/actions/toolchains/rust
       with:
         targets: thumbv7m-none-eabi

.github/workflows/test-python.yml

@@ -23,7 +23,7 @@ jobs:
     runs-on: ${{ matrix.host.name }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - uses: ./.github/actions/toolchains/rust
@@ -39,7 +39,7 @@ jobs:
       - name: Fetch Python crate dependencies
         run: cargo fetch --locked --manifest-path bindings/python/Cargo.toml --target ${{ matrix.host.target }}
 
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.10"
           architecture: x64
@@ -68,7 +68,7 @@ jobs:
     runs-on: ${{ matrix.host.name }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - uses: ./.github/actions/toolchains/rust
@@ -82,7 +82,7 @@ jobs:
       - name: Fetch Python crate dependencies
         run: cargo fetch --locked --manifest-path bindings/python/Cargo.toml
 
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
           architecture: x64

.github/workflows/test-ruby.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 

.github/workflows/test-wasm.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
@@ -33,7 +33,7 @@ jobs:
         run: cargo fetch --locked --manifest-path bindings/wasm/Cargo.toml
 
       - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
 

.github/workflows/tests-debug.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Setup Rust toolchain
       uses: ./.github/actions/toolchains/rust
     - name: Cache cargo

.github/workflows/verus.yml

@@ -0,0 +1,80 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+#
+name: verus
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+
+env:
+  CARGO_TERM_COLOR: always
+
+# This workflow only checks out code, downloads a pinned Verus release asset,
+# and runs verification. It never writes to the repository, so restrict the
+# GITHUB_TOKEN to read-only access to repository contents.
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - name: Setup Rust toolchain
+      uses: ./.github/actions/toolchains/rust
+      with:
+        components: ""
+    - name: Cache cargo
+      uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+      with:
+        shared-key: ${{ runner.os }}-regorus-verus
+    - name: Install Verus and run verification
+      shell: bash
+      run: |
+        set -euxo pipefail
+        asset_url=https://github.com/verus-lang/verus/releases/download/release%2F0.2026.07.12.0b42f4c/verus-0.2026.07.12.0b42f4c-x86-linux.zip
+        asset_sha256=f6f4f5d08e07d3e1ad721d775bda5ba96b9dd0c73b48fc17f2e071866fbd01c0
+        test -n "$asset_url"
+        curl -fsSL "$asset_url" -o verus.zip
+
+        # Verify the download integrity before trusting/executing its contents.
+        echo "${asset_sha256}  verus.zip" | sha256sum --check --strict
+
+        unzip -q verus.zip -d verus-dist
+
+        # Search under an absolute path so that `find` yields absolute paths;
+        # this keeps the PATH entries below valid regardless of the working
+        # directory.
+        verus_bin="$(find "$PWD/verus-dist" -type f -name verus -perm -u+x | head -n1)"
+        cargo_verus_bin="$(find "$PWD/verus-dist" -type f -name cargo-verus -perm -u+x | head -n1)"
+        version_json="$(find "$PWD/verus-dist" -type f -name version.json | head -n1)"
+        test -n "$verus_bin"
+        test -n "$cargo_verus_bin"
+        test -n "$version_json"
+
+        # Verus is built against a specific Rust toolchain and refuses to run
+        # against any other version. Read the required toolchain from the
+        # release metadata so we track it automatically instead of hardcoding.
+        required_toolchain="$(sed -n 's/.*"toolchain"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$version_json")"
+        test -n "$required_toolchain"
+        echo "Verus requires Rust toolchain: $required_toolchain"
+
+        # Install the exact toolchain Verus expects, including the extra
+        # components (rustc-dev, llvm-tools) that Verus links against and that
+        # are not part of the default rustup profile.
+        rustup toolchain install "$required_toolchain" \
+          --profile minimal \
+          --component rustc-dev --component llvm-tools --component rustfmt
+
+        # Force cargo/rustc to resolve to the Verus toolchain for the commands
+        # below, overriding any repository/directory toolchain override.
+        export RUSTUP_TOOLCHAIN="$required_toolchain"
+
+        # Put cargo-verus on PATH for the commands below.
+        export PATH="$(dirname "$cargo_verus_bin"):$(dirname "$verus_bin"):$PATH"
+        cargo verus --help
+        cargo fetch --locked
+        cargo verus verify --locked --features verus

CHANGELOG.md

@@ -6,6 +6,35 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.11.0](https://github.com/microsoft/regorus/compare/regorus-v0.10.1...regorus-v0.11.0) - 2026-07-21
+
+### Added
+
+- *(compiler)* support registered host-await builtins for natural function call syntax ([#667](https://github.com/microsoft/regorus/pull/667))
+- *(value)* introduce Set storage abstraction ([#740](https://github.com/microsoft/regorus/pull/740))
+
+### Fixed
+
+- *(rvm)* assert every-quantifier results so failing cases don't pass ([#765](https://github.com/microsoft/regorus/pull/765))
+- `Engine::add_data` now deep-merges nested data documents instead of only merging top-level keys. Adding `{ "a": { "x": 1 } }` followed by `{ "a": { "y": 2 } }` now yields `{ "a": { "x": 1, "y": 2 } }` (matching OPA's data-document merge). Nested sets under a shared key are unioned. Only genuine leaf conflicts (the same path holding two different values) are reported as errors. ([#760](https://github.com/microsoft/regorus/pull/760))
+- A zero-arg function producing two different complete values (e.g. `f() := { "a": 1 }` and `f() := { "b": 2 }`) is now reported as a conflict, matching OPA's complete-rule semantics, instead of silently combining the outputs.
+
+### Security
+
+- `Engine::add_data` now rejects data nested beyond 128 levels instead of risking a stack overflow on adversarially deep input.
+
+### Other
+
+- *(deps)* bump the rust-dependencies group across 5 directories with 11 updates ([#764](https://github.com/microsoft/regorus/pull/764))
+- Expand keyword-in-ref coverage for complex parser edge cases (interpreter + RVM) ([#744](https://github.com/microsoft/regorus/pull/744))
+- *(deps)* bump the rust-dependencies group across 5 directories with 4 updates ([#754](https://github.com/microsoft/regorus/pull/754))
+- *(deps)* bump the rust-dependencies group across 5 directories with 6 updates ([#750](https://github.com/microsoft/regorus/pull/750))
+- *(value)* migrate Value::Object to Object storage abstraction ([#736](https://github.com/microsoft/regorus/pull/736))
+- normalize path separators in folder filter on Windows ([#742](https://github.com/microsoft/regorus/pull/742))
+- Introduce Object storage abstraction ([#735](https://github.com/microsoft/regorus/pull/735))
+- *(rvm)* add debug-mode invariant assertions ([#737](https://github.com/microsoft/regorus/pull/737))
+- *(deps)* bump the rust-dependencies group across 5 directories with 5 updates ([#734](https://github.com/microsoft/regorus/pull/734))
+
 ## [0.10.1](https://github.com/microsoft/regorus/compare/regorus-v0.10.0...regorus-v0.10.1) - 2026-05-22
 
 ### Fixed

Cargo.toml

@@ -8,12 +8,17 @@ members = [
 [package]
 name = "regorus"
 description = "A fast, lightweight Rego (OPA policy language) interpreter"
-version = "0.10.1"
+version = "0.11.0"
 edition = "2021"
 license = "MIT AND Apache-2.0 AND BSD-3-Clause"
 repository = "https://github.com/microsoft/regorus"
 keywords = ["interpreter", "no_std", "opa", "policy-as-code", "rego"]
 
+# Support verification with Verus, a Rust verifier (https://github.com/verus-lang/verus)
+
+[package.metadata.verus]
+verify = true
+
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [lib]
@@ -21,6 +26,7 @@ doctest = false
 
 [features]
 default = ["full-opa", "arc", "rvm"]
+verus = ["dep:vstd"]
 
 arc = []
 ast = []
@@ -43,7 +49,7 @@ cache = ["dep:lru"]
 rvm = ["dep:postcard", "dep:indexmap"]
 semver = ["dep:semver"]
 allocator-memory-limits = ["std", "mimalloc", "mimalloc/allocator-memory-limits"]
-std = ["rand/std", "rand/std_rng", "serde_json/std", "indexmap?/std", "msvc_spectre_libs", "dep:parking_lot" ]
+std = ["rand/std", "rand/std_rng", "serde_json/std", "indexmap?/std", "msvc_spectre_libs", "dep:parking_lot", "vstd?/std" ]
 time = ["dep:chrono", "dep:chrono-tz"]
 uuid = ["dep:uuid"]
 urlquery = ["dep:url"]
@@ -104,7 +110,7 @@ lazy_static =  { version = "1.4.0", default-features = false }
 thiserror = { version = "2.0", default-features = false }
 
 data-encoding = { version = "2.8.0", optional = true, default-features=false, features = ["alloc"] }
-num-bigint = { version = "0.4", default-features = false }
+num-bigint = { version = "0.5", default-features = false }
 num-traits = { version = "0.2", default-features = false }
 parking_lot = { version = "0.12", optional = true }
 spin = { version = "0.12.0", default-features = false, features = ["mutex", "spin_mutex"] }
@@ -114,7 +120,7 @@ regex = {version = "1.12.3", optional = true, default-features = false }
 semver = {version = "1.0.28", optional = true, default-features = false }
 url = { version = "2.5.4", optional = true }
 uuid = { version = "1.22.0", default-features = false, features = ["v4", "fast-rng"], optional = true }
-jsonschema = { version = "0.46.5", default-features = false, optional = true }
+jsonschema = { version = "0.48.5", default-features = false, optional = true }
 chrono = { version = "0.4.44", optional = true }
 chrono-tz = { version = "0.10.1", optional = true }
 ipnet = { version = "2.12.0", optional = true, default-features = false }
@@ -134,6 +140,11 @@ mimalloc = { package = "regorus-mimalloc", path = "mimalloc", version = "2.2.7",
 indexmap = { version = "2.13.1", default-features = false, features = ["serde"], optional = true }
 postcard = { version = "1.1.3", default-features = false, features = ["alloc"], optional = true }
 
+# Verus-related dependencies.
+# vstd is enabled via the `verus` feature. In no_std builds only the `alloc` feature is used;
+# the crate's `std` feature additionally enables `vstd/std` (matching vstd's default features).
+vstd = { version = "=0.0.0-2026-07-12-0122", optional = true, default-features = false, features = ["alloc"] }
+
 [dev-dependencies]
 anyhow = "1.0.102"
 cfg-if = "1.0.0"
@@ -214,3 +225,7 @@ doctest=false
 # RUSTDOCFLAGS="--cfg docsrs" cargo +nightly doc --all-features --no-deps
 all-features = true
 rustdoc-args = ["--cfg", "docsrs"]
+
+[lints.rust]
+# Allow `verus_keep_ghost` configuration flag (used by Verus)
+unexpected_cfgs = { level = "warn", check-cfg = ['cfg(verus_keep_ghost)'] }

bindings/csharp/Directory.Packages.props

@@ -1,7 +1,7 @@
 <Project>
   <PropertyGroup>
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
-    <RegorusPackageVersion>0.10.1</RegorusPackageVersion>
+    <RegorusPackageVersion>0.11.0</RegorusPackageVersion>
     <RegorusPackageVersionSuffix Condition="'$(VersionSuffix)' != ''">-$(VersionSuffix)</RegorusPackageVersionSuffix>
   </PropertyGroup>
 

bindings/csharp/Regorus.Tests/MemoryGrowthTests.cs

@@ -115,6 +115,10 @@ public class MemoryGrowthTests
 
                 if (i % LogEvery == 0)
                 {
+                    // Collect transient managed garbage so the working-set delta reflects
+                    // retained (leaked) memory rather than uncollected allocations. A real
+                    // native leak from a missed Dispose() would survive GC and still be caught.
+                    ForceFullGc();
                     process.Refresh();
                     var workingSet = process.WorkingSet64;
                     var managed = GC.GetTotalMemory(false);
@@ -228,6 +232,10 @@ public class MemoryGrowthTests
 
                 if (i % LogEvery == 0)
                 {
+                    // Collect transient managed garbage so the working-set delta reflects
+                    // retained (leaked) memory rather than uncollected allocations. A real
+                    // native leak from a missed Dispose() would survive GC and still be caught.
+                    ForceFullGc();
                     process.Refresh();
                     var workingSet = process.WorkingSet64;
                     var managed = GC.GetTotalMemory(false);

bindings/ffi/Cargo.toml

@@ -2,7 +2,7 @@
 
 [package]
 name = "regorus-ffi"
-version = "0.10.1"
+version = "0.11.0"
 edition = "2021"
 license = "MIT AND Apache-2.0 AND BSD-3-Clause"
 

bindings/java/Cargo.toml

@@ -2,7 +2,7 @@
 
 [package]
 name = "regorus-java"
-version = "0.10.1"
+version = "0.11.0"
 edition = "2021"
 repository = "https://github.com/microsoft/regorus/bindings/java"
 description = "Java bindings for Regorus - a fast, lightweight Rego interpreter written in Rust"

bindings/java/pom.xml

@@ -9,7 +9,7 @@
 
   <groupId>com.microsoft.regorus</groupId>
   <artifactId>regorus-java</artifactId>
-  <version>0.10.1</version>
+  <version>0.11.0</version>
 
   <name>Regorus Java</name>
   <description>Java bindings for Regorus - a fast, lightweight Rego interpreter written in Rust</description>
@@ -97,7 +97,7 @@
 
       <plugin>
         <artifactId>maven-surefire-plugin</artifactId>
-        <version>3.5.5</version>
+        <version>3.5.6</version>
         <configuration>
           <!-- Add debug build to Java path, so it's discoverable by JVM. This is only for tests. -->
           <argLine>-Djava.library.path=${project.basedir}/target/debug:${java.library.path}</argLine>

bindings/python/Cargo.toml

@@ -2,7 +2,7 @@
 
 [package]
 name = "regoruspy"
-version = "0.10.1"
+version = "0.11.0"
 edition = "2021"
 repository = "https://github.com/microsoft/regorus/bindings/python"
 description = "Python bindings for Regorus - a fast, lightweight Rego interpreter written in Rust"
@@ -23,7 +23,7 @@ coverage = ["regorus/coverage"]
 [dependencies]
 anyhow = "1.0"
 ordered-float = "5.3.0"
-pyo3 = { version = "0.28.3", features = ["abi3-py310", "anyhow", "extension-module"] }
+pyo3 = { version = "0.29.0", features = ["abi3-py310", "anyhow", "extension-module"] }
 regorus = { path  = "../..", default-features = false, features = ["arc", "rvm"] }
 serde_json = "1.0.150"
 

bindings/python/pyproject.toml

@@ -1,5 +1,5 @@
 [build-system]
-requires = ["maturin>=1.4,<2.0"]
+requires = ["maturin>=1.14.1,<2.0"]
 build-backend = "maturin"
 
 [project]

bindings/ruby/Gemfile

@@ -11,6 +11,6 @@ gem "minitest", "~> 6.0"
 gem "rake", "~> 13.4"
 gem "rake-compiler", "~> 1.3"
 gem "rake-compiler-dock", "~> 1.12"
-gem "rubocop", "~> 1.86", require: false
-gem "rubocop-minitest", "~> 0.39.1", require: false
+gem "rubocop", "~> 1.88", require: false
+gem "rubocop-minitest", "~> 0.40.0", require: false
 gem "rubocop-rake", "~> 0.7.1", require: false

bindings/ruby/Gemfile.lock

@@ -9,14 +9,14 @@ GEM
   specs:
     ast (2.4.3)
     drb (2.2.3)
-    json (2.19.4)
-    language_server-protocol (3.17.0.5)
+    json (2.21.1)
+    language_server-protocol (3.17.0.6)
     lint_roller (1.1.0)
-    minitest (6.0.5)
+    minitest (6.0.6)
       drb (~> 2.0)
       prism (~> 1.5)
     parallel (2.1.0)
-    parser (3.3.11.1)
+    parser (3.3.12.0)
       ast (~> 2.4.1)
       racc
     prism (1.9.0)
@@ -26,10 +26,10 @@ GEM
     rake-compiler (1.3.1)
       rake
     rake-compiler-dock (1.12.0)
-    rb_sys (0.9.127)
+    rb_sys (0.9.128)
       rake-compiler-dock (= 1.12.0)
     regexp_parser (2.12.0)
-    rubocop (1.86.1)
+    rubocop (1.88.2)
       json (~> 2.3)
       language_server-protocol (~> 3.17.0.2)
       lint_roller (~> 1.1.0)
@@ -40,10 +40,10 @@ GEM
       rubocop-ast (>= 1.49.0, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 2.4.0, < 4.0)
-    rubocop-ast (1.49.1)
+    rubocop-ast (1.50.0)
       parser (>= 3.3.7.2)
       prism (~> 1.7)
-    rubocop-minitest (0.39.1)
+    rubocop-minitest (0.40.0)
       lint_roller (~> 1.1)
       rubocop (>= 1.75.0, < 2.0)
       rubocop-ast (>= 1.38.0, < 2.0)
@@ -65,8 +65,8 @@ DEPENDENCIES
   rake-compiler (~> 1.3)
   rake-compiler-dock (~> 1.12)
   regorusrb!
-  rubocop (~> 1.86)
-  rubocop-minitest (~> 0.39.1)
+  rubocop (~> 1.88)
+  rubocop-minitest (~> 0.40.0)
   rubocop-rake (~> 0.7.1)
 
 BUNDLED WITH

bindings/ruby/ext/regorusrb/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "regorusrb"
-version = "0.10.1"
+version = "0.11.0"
 edition = "2024"
 description = "Ruby bindings for Regorus - a fast, lightweight Rego interpreter written in Rust"
 license = "MIT AND Apache-2.0 AND BSD-3-Clause"

bindings/ruby/lib/regorus/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Regorus
-  VERSION = "0.10.1"
+  VERSION = "0.11.0"
 end

bindings/wasm/Cargo.toml

@@ -2,7 +2,7 @@
 
 [package]
 name = "regorusjs"
-version = "0.10.1"
+version = "0.11.0"
 edition = "2021"
 repository = "https://github.com/microsoft/regorus/bindings/wasm"
 description = "WASM bindings for Regorus - a fast, lightweight Rego interpreter written in Rust"

docs/rvm/architecture.md

@@ -254,7 +254,13 @@ include formatted state snapshots where possible.
 7. **Host await**: In run-to-completion mode, `HostAwait` consumes a response
    from `host_await_responses`. Suspendable mode yields control with a
    `SuspendReason::HostAwait { dest, argument, identifier }` that the host must
-   service.
+   service. The compiler supports two ways to emit `HostAwait`:
+   - **Explicit**: `__builtin_host_await(payload, identifier)` — raw 2-argument
+     form.
+   - **Registered**: `compile_from_policy_with_host_await` accepts a list of
+     `(name, arg_count)` pairs. Calls to registered names are compiled as
+     `HostAwait` with the function name as the identifier literal. Registered
+     names take precedence over user-defined functions and standard builtins.
 8. **Completion**: `Return` wraps the selected register value into
    `InstructionOutcome::Return`, unwinding frames until the entry frame is
    cleared. `RuleReturn` is a specialised variant used by rule execution

docs/rvm/instruction-set.md

@@ -177,6 +177,75 @@ Parameter tables:
 - Suspendable: emits `InstructionOutcome::Suspend` with `SuspendReason::HostAwait`.
   The host must resume with a value that will be written into `dest`.
 
+### Registered host-await builtins
+
+The compiler can be configured with a list of function names that map directly
+to `HostAwait` instructions. This allows policy authors to write natural
+function calls (e.g. `lookup(input.account_id)`) instead of the raw
+`__builtin_host_await(payload, identifier)` builtin.
+
+Registration is done at compile time via `Compiler::compile_from_policy_with_host_await`:
+
+```rust
+let builtins = [("lookup", 1), ("persist", 1)];
+let program = Compiler::compile_from_policy_with_host_await(
+    &compiled_policy, &entry_points, &builtins,
+)?;
+```
+
+Each registered name is a `(name, arg_count)` pair. When the compiler
+encounters a call to a registered name, it emits a `HostAwait` instruction
+with:
+- `arg` = the first argument register
+- `id` = a register loaded with a string literal containing the function name
+
+Both the explicit `__builtin_host_await(arg, id)` call and a registered
+builtin call produce the **same `HostAwait` bytecode instruction**. The only
+difference is how the `id` register is populated: explicit calls take it from
+the second user-supplied argument, while registered calls auto-generate a
+`Load` instruction for the function name string. The VM cannot distinguish
+between the two at runtime.
+
+**Resolution order** in `determine_call_target()`:
+1. `__builtin_host_await` (magic 2-argument form)
+2. Registered host-await builtins (matched by **bare** function name only)
+3. User-defined functions (matched by package-qualified path)
+4. Standard builtins (matched by bare function name)
+
+Registered names shadow both user-defined functions and standard builtins.
+This means `time.parse_duration_ns` can be overridden to route through the
+host instead of the built-in Rust implementation.
+
+**Only unqualified calls are intercepted.** Registration matches a call by
+the name *as written in the policy*. A bare call — `lookup(x)` — is
+intercepted and compiled to a `HostAwait`. A package-qualified call —
+`data.pkg.lookup(x)` — is **not** intercepted; it is resolved normally, as
+if the name were never registered.
+
+```rego
+# "lookup" is registered as a host-await builtin.
+
+package other
+import rego.v1
+lookup(k) := k            # an ordinary rule that happens to share the name
+
+package demo
+import rego.v1
+a := lookup(input.k)             # intercepted     -> HostAwait
+b := data.other.lookup(input.k)  # NOT intercepted -> calls other.lookup
+```
+
+The qualified form is resolved exactly as it would be without registration:
+if a rule exists at that path it is called, otherwise compilation fails with
+`Unknown function`. (A standard builtin like `count` has no qualified form at
+all, so `data.pkg.count(x)` is always an `Unknown function` error, registered
+or not.)
+
+**Argument handling**: The `HostAwait` instruction carries a single `arg`
+register. Registered builtins must use `arg_count: 1`; the compiler rejects
+`arg_count > 1` at registration time. To pass multiple values, use object
+packing: `lookup({"user": x, "resource": y})`.
+
 ---
 
 ## Halt instruction

docs/value/set.md

@@ -0,0 +1,79 @@
+# Set
+
+Opaque container for `Value::Set`'s element storage, enabling alternative
+backends without call-site changes. Pairs with [`Object`](object.md) under
+a shared design philosophy.
+
+## Design
+
+`Set` wraps a `BTreeSet<Value>` today but exposes only a curated method
+surface (`contains`, `insert`, `remove`, `iter`, `iter_sorted`, `cursor`,
+`is_subset`, `intersection`, `union`, `difference`, serde). The inner set is
+private — callers cannot pattern-match it or hand out references to the
+backing store, so the backend can change without churn at the ~400 call
+sites that name `Set`.
+
+Two iteration methods reflect a real distinction: `iter()` makes no
+ordering promise (lets future hash/lazy backends skip sorting work);
+`iter_sorted()` guarantees deterministic order (used by serialization and
+`Ord`). Cursor types support incremental traversal needed by the RVM
+iteration state without exposing iterator internals.
+
+`Ord` is hand-written against `iter_sorted` rather than derived, so two
+backends that store elements differently still compare equal when their
+sorted contents match.
+
+## Scenarios enabled
+
+- **Hash-backed storage** — `FxHashSet`-backed inner turns O(log n)
+  membership checks into O(1); swap in for policies where elements aren't
+  compared ordinally.
+- **Lazy/streaming** — wrap a `LazySetProvider` (DB query, CBOR slice,
+  REST endpoint) and materialize elements on demand.
+- **Arena allocation** — bumpalo-backed inner for eval-time temporaries;
+  drop the whole arena at query end with zero per-element free cost.
+- **FFI-backed** — host-language collections (Python set, JS Set) without
+  copying into Rust.
+- **Bloom-filter pre-check** — front a large backing set with a Bloom
+  filter for fast negative-membership tests on read-mostly allowlists.
+
+## Known use cases
+
+- **Azure Policy allowed-values lists** — large allowlists (allowed
+  regions, allowed SKUs, allowed image publishers) compared against
+  single resource values. Hash-backed Set turns O(log n) membership
+  checks into O(1).
+- **SARIF rule deduplication** — collapsing duplicate rule references
+  across thousands of result records. Set-of-objects with structural
+  hashing avoids the BTreeSet sort cost on every insert.
+- **RBAC role membership** — checking whether a principal belongs to any
+  of dozens of role groups. Hash-backed Set scales to thousands of
+  members with constant-time membership.
+- **Azure Policy denied-resource-type sets** — exclusion lists used by
+  deny-effect policies; same hash-backed pattern as allowed-values.
+
+## Precedents
+
+- **`indexmap::IndexSet`** — opaque newtype that pairs hash lookup with
+  insertion-order iteration; precedent for "Set with alternative
+  ordering semantics behind a stable surface."
+- **`hashbrown::HashSet`** — backs Rust's `std::collections::HashSet`
+  and demonstrates a fully swappable backend behind a stable API.
+- **`roaring::RoaringBitmap`** — bitmap-backed integer set. Not
+  applicable to `Value` keys directly, but a precedent for the broader
+  idea of "Set with alternative storage representations chosen by
+  workload shape."
+- **`serde_json`** — note that `serde_json` has no Set equivalent: its
+  Value enum collapses sets into arrays. Regorus's first-class Set with
+  storage abstraction is therefore unusually well-positioned among JSON
+  value libraries.
+
+## Notes
+
+Cursor types are `pub` (referenced by public `IterationState`) but not
+re-exported at the crate root. The crate-internal `Set`/`Map`/`MapEntry`
+aliases for `BTreeSet`/`BTreeMap` in `lib.rs` were renamed to
+`MapSet`/`Map`/`MapEntry` when this type landed, to free the `Set` name
+for the new public type. Future Array and String abstractions follow the
+same shape — see `docs/value/array.md` and `docs/value/string.md` when
+they land.

src/compiled_policy.rs

@@ -217,7 +217,7 @@ pub(crate) struct CompiledPolicyData {
     pub(crate) default_rules: Map<String, Vec<DefaultRuleInfo>>,
     pub(crate) imports: BTreeMap<String, Ref<Expr>>,
     pub(crate) functions: FunctionTable,
-    pub(crate) rule_paths: Set<String>,
+    pub(crate) rule_paths: MapSet<String>,
     #[cfg(feature = "azure_policy")]
     pub(crate) target_info: Option<TargetInfo>,
     #[cfg(feature = "azure_policy")]

src/engine.rs

@@ -434,7 +434,13 @@ impl Engine {
 
     /// Add data document.
     ///
-    /// The specified data document is merged into existing data document.
+    /// The specified data document is deep-merged into the existing data document. Nested
+    /// objects are merged recursively (matching OPA's data-document merge), so adding
+    /// `{ "a": { "x": 1 } }` and then `{ "a": { "y": 2 } }` yields `{ "a": { "x": 1, "y": 2 } }`.
+    /// A conflict — the same path holding two different values — is an error.
+    ///
+    /// The merge is atomic: if any conflict is detected (including one deep in a nested
+    /// document), the call fails and the existing data document is left unchanged.
     ///
     /// ```
     /// # use regorus::*;
@@ -453,9 +459,13 @@ impl Engine {
     /// // Merge { "z" : 3 }. Conflict error.
     /// assert!(engine.add_data(Value::from_json_str(r#"{ "z" : 3 }"#)?).is_err());
     ///
+    /// // Nested objects are deep-merged. Merge { "y" : { "a" : 10 } } then { "y" : { "b" : 20 } }.
+    /// assert!(engine.add_data(Value::from_json_str(r#"{ "y" : { "a" : 10 } }"#)?).is_ok());
+    /// assert!(engine.add_data(Value::from_json_str(r#"{ "y" : { "b" : 20 } }"#)?).is_ok());
+    ///
     /// assert_eq!(
     ///   engine.eval_query("data".to_string(), false)?.result[0].expressions[0].value,
-    ///   Value::from_json_str(r#"{ "x": 1, "y": {}, "z": 2}"#)?
+    ///   Value::from_json_str(r#"{ "x": 1, "y": { "a": 10, "b": 20 }, "z": 2}"#)?
     /// );
     /// # Ok(())
     /// # }
@@ -464,8 +474,29 @@ impl Engine {
         if data.as_object().is_err() {
             bail!("data must be object");
         }
-        self.prepared = false;
-        self.interpreter.get_init_data_mut().merge(data)
+
+        // add_data is all-or-nothing; the atomic strategy differs by build because the failure
+        // modes do: a conflict (same path, differing values) is possible everywhere, an
+        // allocator-limit failure mid-merge only under `allocator-memory-limits`.
+        #[cfg(not(feature = "allocator-memory-limits"))]
+        {
+            // Conflict is the only failure mode; `check_mergeable` catches it up front without
+            // allocating, so validate then deep-merge in place (zero-copy fast path).
+            self.interpreter.get_init_data().check_mergeable(&data)?;
+            self.prepared = false;
+            self.interpreter.get_init_data_mut().deep_merge(data)
+        }
+        #[cfg(feature = "allocator-memory-limits")]
+        {
+            // A limit failure can strike mid-merge and can't be predicted, so merge into a
+            // candidate and commit only on success. `Value` is copy-on-write, so only touched
+            // subtrees are cloned.
+            let mut candidate = self.interpreter.get_init_data().clone();
+            candidate.deep_merge(data)?;
+            *self.interpreter.get_init_data_mut() = candidate;
+            self.prepared = false;
+            Ok(())
+        }
     }
 
     /// Get the data document.

src/interpreter.rs

@@ -60,6 +60,17 @@ enum FunctionModifier {
     Value(Value),
 }
 
+/// How [`Interpreter::update_data`] merges a rule's value into the data document.
+#[derive(Debug, Clone, Copy)]
+enum RuleValueMerge {
+    /// Shallow-merge keeping disjoint keys, so rules sharing a path prefix scaffold into one
+    /// object (`a.foo` + `a.bar` → one `a`) instead of conflicting.
+    Combine,
+    /// Complete-rule semantics: existing value must be absent or exactly equal, else conflict.
+    /// Used for zero-arg function outputs (`f() := …`), which OPA treats like complete rules.
+    Strict,
+}
+
 type RuleValues = BTreeMap<Vec<Value>, (Value, Ref<Expr>)>;
 
 #[derive(Debug)]
@@ -1247,7 +1258,34 @@ impl Interpreter {
             // Apply with modifiers.
             for wm in &stmt.with_mods {
                 let path = Parser::get_path_ref_components(&wm.refr)?;
-                let path: Vec<&str> = path.iter().map(|s| s.text()).collect();
+                let mut path: Vec<String> = path.iter().map(|s| s.text().to_string()).collect();
+
+                // Matching OPA, a leading import alias is rewritten before
+                // any lookups: functions register as overrides below,
+                // anything else becomes a data override. Only the alias
+                // component is replaced so bracketed keys containing dots
+                // survive the rewrite.
+                let rewritten: Option<Vec<String>> = match path.split_first() {
+                    Some((head, rest)) if head.as_str() != "data" => {
+                        self.lookup_import(head).and_then(|import_expr| {
+                            // Use the import target's parsed components, not
+                            // its dot-joined string, so bracketed keys
+                            // containing dots survive in the import path too.
+                            let comps = Parser::get_path_ref_components(import_expr).ok()?;
+                            Some(
+                                comps
+                                    .iter()
+                                    .map(|s| s.text().to_string())
+                                    .chain(rest.iter().cloned())
+                                    .collect(),
+                            )
+                        })
+                    }
+                    _ => None,
+                };
+                if let Some(new_path) = rewritten {
+                    path = new_path;
+                }
                 let mut target = path.join(".");
 
                 let mut target_is_function = self.lookup_function_by_name(&target).is_some()
@@ -1286,11 +1324,17 @@ impl Interpreter {
                             if self.lookup_function_by_name(&function_path).is_none() {
                                 // Lookup without current module path prefixed.
                                 function_path = get_path_string(&wm.r#as, None)?;
-                                if self.lookup_function_by_name(&function_path).is_none()
-                                    && !Self::is_builtin(wm.r#as.span(), &function_path)
-                                {
-                                    // bail!(wm.r#as.span().error("could not evaluate expression"));
-                                    skip_exec = true;
+                                if self.lookup_function_by_name(&function_path).is_none() {
+                                    // Resolve an aliased replacement before builtins.
+                                    let resolved = self
+                                        .resolve_fcn_path_through_imports(&function_path)
+                                        .filter(|r| self.compiled_policy.functions.contains_key(r));
+                                    if let Some(resolved) = resolved {
+                                        function_path = resolved;
+                                    } else if !Self::is_builtin(wm.r#as.span(), &function_path) {
+                                        // bail!(wm.r#as.span().error("could not evaluate expression"));
+                                        skip_exec = true;
+                                    }
                                 }
                             }
                             self.with_functions
@@ -2360,6 +2404,72 @@ impl Interpreter {
         }
     }
 
+    /// Look up the import of the current module with the given alias, e.g.
+    /// the `data.a.b` import expression for `b` after `import data.a.b`.
+    fn lookup_import(&self, alias: &str) -> Option<&Ref<Expr>> {
+        if self.compiled_policy.imports.is_empty() {
+            return None;
+        }
+        let import_key = format!("{}.{}", self.current_module_path, alias);
+        self.compiled_policy.imports.get(&import_key)
+    }
+
+    /// Look up the dot-joined target path of an import of the current module
+    /// with the given alias, e.g. `data.a.b` for `b` after `import data.a.b`.
+    fn lookup_import_alias(&self, alias: &str) -> Option<String> {
+        get_path_string(self.lookup_import(alias)?, None).ok()
+    }
+
+    /// Rewrite a path whose leading component is an import alias of the
+    /// current module to the import's target, e.g. `b.f` to `data.a.b.f`
+    /// after `import data.a.b`.
+    fn rewrite_path_through_imports(&self, path: &str) -> Option<String> {
+        if path.starts_with("data.") {
+            return None;
+        }
+
+        let (alias, rest) = match path.split_once('.') {
+            Some((alias, rest)) => (alias, Some(rest)),
+            None => (path, None),
+        };
+        let target = self.lookup_import_alias(alias)?;
+        Some(match rest {
+            Some(rest) => format!("{target}.{rest}"),
+            None => target,
+        })
+    }
+
+    /// Rewrite an import-aliased call path to its target, e.g. `b.f(1)` to
+    /// `data.a.b.f` after `import data.a.b`. Resolves only when the target is
+    /// a known function or default function, so an alias whose target defines
+    /// the called function shadows a like-named builtin namespace, while other
+    /// spellings keep their prior meaning (e.g. a builtin call). OPA instead
+    /// rewrites aliases unconditionally and rejects calls to a missing target
+    /// at compile time.
+    fn resolve_fcn_path_through_imports(&self, path: &str) -> Option<String> {
+        let candidate = self.rewrite_path_through_imports(path)?;
+        (self.compiled_policy.functions.contains_key(&candidate)
+            || self.is_default_function(&candidate))
+        .then_some(candidate)
+    }
+
+    /// True if `path` is the exact path of a `default` function rule.
+    /// `default_rules` also indexes every prefix of a rule path, so it cannot
+    /// be consulted alone: `rule_paths` holds only exact rule paths, and the
+    /// non-empty argument list distinguishes functions from value rules.
+    fn is_default_function(&self, path: &str) -> bool {
+        self.compiled_policy.rule_paths.contains(path)
+            && self
+                .compiled_policy
+                .default_rules
+                .get(path)
+                .is_some_and(|rules| {
+                    rules.iter().any(|(rule, _)| {
+                        matches!(rule.as_ref(), Rule::Default { args, .. } if !args.is_empty())
+                    })
+                })
+    }
+
     fn eval_builtin_call(
         &mut self,
         span: &Span,
@@ -2531,6 +2641,13 @@ impl Interpreter {
             param_values.push(self.eval_expr(p)?);
         }
 
+        // Resolve a leading import alias before the `with` override and builtin
+        // lookups, so an override keyed by the full path reaches aliased calls
+        // and the alias shadows a like-named builtin namespace (matching OPA).
+        let fcn_path = self
+            .resolve_fcn_path_through_imports(&fcn_path)
+            .unwrap_or(fcn_path);
+
         let orig_fcn_path = fcn_path.clone();
 
         let mut with_functions_saved = None;
@@ -2707,7 +2824,12 @@ impl Interpreter {
             let value = match self.eval_rule_bodies(ctx, span, bodies) {
                 Ok(v) => v,
                 Err(e) => {
-                    // If the rule produces an error, save the error.
+                    // If the rule produces an error, save the error. Restore
+                    // the caller's module even so: leaving the callee's module
+                    // in place would make the rest of the caller's body
+                    // resolve paths through the wrong module's imports when
+                    // the error is swallowed below in non-strict mode.
+                    self.set_current_module(prev_module)?;
                     errors.push(e);
                     self.scopes = scopes;
                     continue;
@@ -3408,6 +3530,23 @@ impl Interpreter {
         }
     }
 
+    /// Materialize a complete-rule value: the existing value must be absent or *exactly equal*
+    /// to `new`, else it is a conflict.
+    ///
+    /// Unlike the shallow [`Self::merge_rule_value`], differing outputs conflict instead of
+    /// combining — `f() := {"a": 1}` and `f() := {"b": 2}` conflict — matching OPA's semantics
+    /// for zero-arg functions.
+    fn merge_rule_value_strict(span: &Span, value: &mut Value, new: Value) -> Result<()> {
+        if *value == Value::Undefined {
+            *value = new;
+            Ok(())
+        } else if *value == new {
+            Ok(())
+        } else {
+            Err(span.error("rules should not produce multiple outputs."))
+        }
+    }
+
     pub fn get_path_string(refr: &Expr, document: Option<&str>) -> Result<String> {
         let mut comps = vec![];
         let mut expr_opt = Some(refr);
@@ -3663,6 +3802,7 @@ impl Interpreter {
         _refr: &Expr,
         path: &[&str],
         value: Value,
+        merge: RuleValueMerge,
     ) -> Result<()> {
         if value == Value::Undefined {
             return Ok(());
@@ -3670,7 +3810,10 @@ impl Interpreter {
         // Ensure that path is created.
         let vref = Self::make_or_get_value_mut(&mut self.data, path)?;
         if Self::get_value_chained(self.init_data.clone(), path) == Value::Undefined {
-            Self::merge_rule_value(span, vref, value)
+            match merge {
+                RuleValueMerge::Strict => Self::merge_rule_value_strict(span, vref, value),
+                RuleValueMerge::Combine => Self::merge_rule_value(span, vref, value),
+            }
         } else {
             // Retain specified value.
             Ok(())
@@ -3778,7 +3921,13 @@ impl Interpreter {
                         // `a` is created as an empty object.
                         if let Some((_, prefix)) = path.split_last() {
                             if !prefix.is_empty() {
-                                self.update_data(span, refr, prefix, Value::new_object())?;
+                                self.update_data(
+                                    span,
+                                    refr,
+                                    prefix,
+                                    Value::new_object(),
+                                    RuleValueMerge::Combine,
+                                )?;
                             }
                         }
 
@@ -3790,7 +3939,13 @@ impl Interpreter {
                             };
 
                             let value = self.eval_rule_bodies(ctx, span, rule_body)?;
-                            self.update_data(refr.span(), refr, &path[..], value)?;
+                            self.update_data(
+                                refr.span(),
+                                refr,
+                                &path[..],
+                                value,
+                                RuleValueMerge::Strict,
+                            )?;
                         }
                     }
                 }
@@ -4037,6 +4192,7 @@ impl Interpreter {
                         rule_refr,
                         &prefix_path,
                         Value::new_object(),
+                        RuleValueMerge::Combine,
                     )?;
                 }
             }

src/languages/rego/compiler/function_calls.rs

@@ -17,8 +17,20 @@ use crate::lexer::Span;
 use crate::rvm::instructions::{BuiltinCallParams, FunctionCallParams};
 use crate::rvm::Instruction;
 use crate::utils::get_path_string;
-use alloc::{format, string::ToString, vec::Vec};
+use crate::value::Value;
+use alloc::{
+    format,
+    string::{String, ToString},
+    vec::Vec,
+};
 
+/// Resolved destination of a Rego function-call expression. Produced by
+/// [`Compiler::determine_call_target`] and consumed by
+/// [`Compiler::compile_function_call`] to choose which instruction to emit.
+/// Carrying the discrimination in the type (rather than re-matching on a
+/// magic name at the emit site) keeps the host-await handling honest under
+/// future refactors — the compiler will refuse to build if a new variant is
+/// added without updating every match site.
 enum CallTarget {
     User {
         rule_index: u16,
@@ -28,9 +40,14 @@ enum CallTarget {
         builtin_index: u16,
         expected_args: Option<usize>,
     },
-    HostAwait {
-        expected_args: Option<usize>,
-    },
+    /// Explicit `__builtin_host_await(arg, id)` call form (2 user args).
+    /// The identifier is supplied by the policy author at runtime via the
+    /// second argument register.
+    ExplicitHostAwait,
+    /// A registered host-awaitable builtin invoked by its registered name
+    /// (1 user arg). The identifier is the registered name itself and is
+    /// baked into the bytecode as a string literal at compile time.
+    RegisteredHostAwait { identifier: String },
 }
 
 impl<'a> Compiler<'a> {
@@ -46,6 +63,9 @@ impl<'a> Compiler<'a> {
         let original_fcn_path = fcn_path.clone();
         let full_fcn_path = if self.policy.inner.rules.contains_key(&fcn_path) {
             fcn_path
+        } else if let Some(resolved) = self.resolve_fcn_path_through_imports(&original_fcn_path) {
+            // Resolve a leading import alias before module-prefixing and builtins.
+            resolved
         } else {
             get_path_string(fcn, Some(&self.current_package))
                 .map_err(|_| CompilerError::InvalidFunctionExpressionWithPackage.at(&span))?
@@ -59,7 +79,11 @@ impl<'a> Compiler<'a> {
         let expected_args = match &call_target {
             CallTarget::User { expected_args, .. } => *expected_args,
             CallTarget::Builtin { expected_args, .. } => *expected_args,
-            CallTarget::HostAwait { expected_args } => *expected_args,
+            // Both host-await variants have a known fixed arity; carrying it
+            // in the variant lets the rest of the compiler depend on the type
+            // rather than re-matching on the magic name `__builtin_host_await`.
+            CallTarget::ExplicitHostAwait => Some(2),
+            CallTarget::RegisteredHostAwait { .. } => Some(1),
         };
 
         if let Some(expected) = expected_args {
@@ -126,7 +150,8 @@ impl<'a> Compiler<'a> {
                 });
                 self.emit_instruction(Instruction::BuiltinCall { params_index }, &span);
             }
-            CallTarget::HostAwait { .. } => {
+            CallTarget::ExplicitHostAwait => {
+                // Explicit __builtin_host_await(arg, id) — 2 arguments
                 if arg_regs.len() != 2 {
                     return Err(CompilerError::General {
                         message: format!(
@@ -136,7 +161,6 @@ impl<'a> Compiler<'a> {
                     }
                     .at(&span));
                 }
-
                 self.emit_instruction(
                     Instruction::HostAwait {
                         dest,
@@ -146,6 +170,37 @@ impl<'a> Compiler<'a> {
                     &span,
                 );
             }
+            CallTarget::RegisteredHostAwait { identifier } => {
+                // Registered host-awaitable builtin — the identifier is the
+                // registered name and is baked into the bytecode as a literal.
+                if arg_regs.len() != 1 {
+                    return Err(CompilerError::General {
+                        message: format!(
+                            "host-awaitable builtin '{}' expects exactly 1 argument, got {}",
+                            identifier,
+                            arg_regs.len()
+                        ),
+                    }
+                    .at(&span));
+                }
+                let id_reg = self.alloc_register();
+                let literal_idx = self.add_literal(Value::String(identifier.into()));
+                self.emit_instruction(
+                    Instruction::Load {
+                        dest: id_reg,
+                        literal_idx,
+                    },
+                    &span,
+                );
+                self.emit_instruction(
+                    Instruction::HostAwait {
+                        dest,
+                        arg: arg_regs[0],
+                        id: id_reg,
+                    },
+                    &span,
+                );
+            }
         }
 
         if let Some((plan, plan_span)) = &out_param_plan {
@@ -168,6 +223,37 @@ impl<'a> Compiler<'a> {
         Ok(dest)
     }
 
+    /// Rewrite an import-aliased call path to its target, e.g. `b.f(1)` to
+    /// `data.a.b.f` after `import data.a.b`. Resolves only when the target is
+    /// a known function (the `rules` map cannot be used here: it also indexes
+    /// value rules and every rule-path prefix, which must not become callable
+    /// through an alias), so an alias whose target defines the called
+    /// function shadows a like-named builtin namespace, while other spellings
+    /// keep their prior meaning (e.g. a builtin call). OPA instead rewrites
+    /// aliases unconditionally and rejects calls to a missing target at
+    /// compile time.
+    fn resolve_fcn_path_through_imports(&self, path: &str) -> Option<String> {
+        if self.policy.inner.imports.is_empty() || path.starts_with("data.") {
+            return None;
+        }
+        let (alias, rest) = match path.split_once('.') {
+            Some((alias, rest)) => (alias, Some(rest)),
+            None => (path, None),
+        };
+        let import_key = format!("{}.{}", self.current_package, alias);
+        let import_expr = self.policy.inner.imports.get(&import_key)?;
+        let target = get_path_string(import_expr, None).ok()?;
+        let candidate = match rest {
+            Some(rest) => format!("{target}.{rest}"),
+            None => target,
+        };
+        self.policy
+            .inner
+            .functions
+            .contains_key(&candidate)
+            .then_some(candidate)
+    }
+
     fn lookup_builtin_arity(&self, name: &str) -> Option<usize> {
         if name == "print" {
             Some(2)
@@ -187,8 +273,26 @@ impl<'a> Compiler<'a> {
         span: &Span,
     ) -> Result<CallTarget> {
         if original_fcn_path == "__builtin_host_await" {
-            return Ok(CallTarget::HostAwait {
-                expected_args: Some(2),
+            return Ok(CallTarget::ExplicitHostAwait);
+        }
+
+        // Check registered host-awaitable builtins. Registered builtins are
+        // restricted to arg_count == 1 at registration time (see
+        // `Compiler::register_host_await_builtin`), so the variant doesn't
+        // need to carry an arity — it's fixed at 1.
+        //
+        // We deliberately match against `original_fcn_path` only, not
+        // `full_fcn_path`. Registration intercepts the *unqualified* call
+        // form (e.g. `lookup(x)` inside the policy's own package). A
+        // package-qualified call like `data.other.lookup(x)` is left to
+        // resolve through the normal user-defined / builtin path, so a
+        // registered name does not leak into unrelated packages that
+        // happen to expose a rule with the same identifier. This is
+        // documented on `register_host_await_builtin`; the
+        // `registered_host_await.yaml` suite pins the behavior.
+        if self.host_await_builtins.contains_key(original_fcn_path) {
+            return Ok(CallTarget::RegisteredHostAwait {
+                identifier: original_fcn_path.to_string(),
             });
         }
 

src/languages/rego/compiler/loops.rs

@@ -13,7 +13,7 @@ use crate::ast::{self, ExprRef, LiteralStmt, Query};
 use crate::compiler::destructuring_planner::plans::BindingPlan;
 use crate::compiler::hoist::{HoistedLoop, LoopType};
 use crate::lexer::Span;
-use crate::rvm::instructions::{LoopMode, LoopStartParams};
+use crate::rvm::instructions::{GuardMode, LoopMode, LoopStartParams};
 use crate::rvm::Instruction;
 use crate::Value;
 use alloc::format;
@@ -197,6 +197,19 @@ impl<'a> Compiler<'a> {
             *end = loop_end;
         }
 
+        // The loop writes its overall pass/fail into `result_reg`
+        // (`success_count == total_iterations` for `Every`). The enclosing query
+        // must fail (evaluate to undefined) when the quantifier does not hold, so
+        // guard on `result_reg` here. Without this the `every` result is computed
+        // but discarded, leaving the surrounding rule to always succeed.
+        self.emit_instruction(
+            Instruction::Guard {
+                register: result_reg,
+                mode: GuardMode::Condition,
+            },
+            span,
+        );
+
         Ok(())
     }
 
@@ -312,6 +325,25 @@ impl<'a> Compiler<'a> {
             *end = loop_end;
         }
 
+        // A hoisted index-iteration loop inside an `every` body acts as a
+        // condition on the current iteration: if the indexed reference matches
+        // nothing the iteration must fail. The `every` body emits no context
+        // yield, so the loop result register is otherwise discarded (same
+        // situation as `some ... in`). Guard on it so a non-matching indexed
+        // reference fails the enclosing `every` iteration.
+        if matches!(
+            self.context_stack.last().map(|c| &c.context_type),
+            Some(ContextType::Every)
+        ) {
+            self.emit_instruction(
+                Instruction::Guard {
+                    register: result_reg,
+                    mode: GuardMode::Condition,
+                },
+                collection.span(),
+            );
+        }
+
         Ok(())
     }
 

src/languages/rego/compiler/mod.rs

@@ -26,7 +26,9 @@ use crate::rvm::program::{Program, RuleType, SpanInfo};
 use crate::CompiledPolicy;
 use crate::Value;
 use alloc::collections::{BTreeMap, BTreeSet};
+use alloc::format;
 use alloc::string::String;
+use alloc::string::ToString as _;
 use alloc::vec;
 use alloc::vec::Vec;
 use indexmap::IndexMap;
@@ -139,6 +141,10 @@ pub struct Compiler<'a> {
     current_call_stack: Vec<u16>,
     entry_points: IndexMap<String, usize>,
     soft_assert_mode: bool,
+    /// Registered host-awaitable builtins: name → expected arg count.
+    /// When the compiler encounters a call to one of these names, it emits a
+    /// `HostAwait` instruction instead of a regular function or builtin call.
+    host_await_builtins: BTreeMap<String, usize>,
 }
 
 impl<'a> Compiler<'a> {
@@ -173,9 +179,75 @@ impl<'a> Compiler<'a> {
             current_call_stack: Vec::new(),
             entry_points: IndexMap::new(),
             soft_assert_mode: false,
+            host_await_builtins: BTreeMap::new(),
         }
     }
 
+    /// Register a function name as a host-awaitable builtin.
+    ///
+    /// When the compiler encounters an **unqualified** call to `name(arg)`
+    /// (i.e. `name(arg)` from inside the policy's own package, not
+    /// `data.pkg.name(arg)` or any other package-qualified form), it will
+    /// emit a `HostAwait` instruction with the argument and `name` as the
+    /// identifier, instead of treating it as a user-defined or standard
+    /// builtin function.
+    ///
+    /// Package-qualified calls (e.g. `data.other.name(arg)`) are **not**
+    /// intercepted by registration. Those resolve through the normal
+    /// user-defined / builtin lookup against their fully-qualified path
+    /// (`data.other.name`).
+    ///
+    /// `arg_count` must be exactly 1. The `HostAwait` instruction carries a
+    /// single argument register; use object packing to pass multiple values
+    /// (e.g. `name({"key1": v1, "key2": v2})`).
+    ///
+    /// Returns `Err` when:
+    /// - `name` is the reserved identifier `__builtin_host_await`,
+    /// - `name` is empty, only whitespace, or has leading/trailing
+    ///   whitespace (whitespace-padded names would never match the
+    ///   trimmed identifier produced by the Rego parser, creating dead
+    ///   registrations),
+    /// - `name` is already registered (duplicate registration is rejected
+    ///   rather than silently overwritten),
+    /// - `arg_count` is not exactly 1.
+    pub fn register_host_await_builtin(&mut self, name: &str, arg_count: usize) -> Result<()> {
+        if name == "__builtin_host_await" {
+            return Err(CompilerError::General {
+                message: "__builtin_host_await is a reserved name and cannot be registered as a host-await builtin"
+                    .to_string(),
+            }
+            .into());
+        }
+        if name.is_empty() || name != name.trim() {
+            return Err(CompilerError::General {
+                message: format!(
+                    "host-await builtin name {name:?} must not be empty or contain leading/trailing whitespace"
+                ),
+            }
+            .into());
+        }
+        if self.host_await_builtins.contains_key(name) {
+            return Err(CompilerError::General {
+                message: format!(
+                    "host-await builtin '{name}' is already registered; \
+                     duplicate registration is not allowed"
+                ),
+            }
+            .into());
+        }
+        if arg_count != 1 {
+            return Err(CompilerError::General {
+                message: format!(
+                    "registered host-await builtin '{name}' must have arg_count == 1, got {arg_count}. \
+                     Use object packing to pass multiple values."
+                ),
+            }
+            .into());
+        }
+        self.host_await_builtins.insert(name.to_string(), arg_count);
+        Ok(())
+    }
+
     pub(super) fn with_soft_assert_mode<F, R>(&mut self, enabled: bool, f: F) -> R
     where
         F: FnOnce(&mut Self) -> R,

src/languages/rego/compiler/queries.rs

@@ -70,12 +70,31 @@ impl<'a> Compiler<'a> {
                     ..
                 } = &stmt.literal
                 {
-                    self.compile_some_in_loop_with_remaining_statements(
+                    let some_result_reg = self.compile_some_in_loop_with_remaining_statements(
                         key,
                         value,
                         collection,
                         &stmts[idx..],
                     )?;
+                    // Inside an `every` body a `some ... in` acts as a condition
+                    // on the current iteration: if it matches nothing the
+                    // iteration must fail. Unlike a top-level rule body (where
+                    // per-iteration context yields produce the results), the
+                    // `every` body has no yield, so the loop result register is
+                    // otherwise discarded. Guard on it so a `some` that matches
+                    // nothing fails the enclosing `every` iteration.
+                    if matches!(
+                        self.context_stack.last().map(|c| &c.context_type),
+                        Some(ContextType::Every)
+                    ) {
+                        self.emit_instruction(
+                            Instruction::Guard {
+                                register: some_result_reg,
+                                mode: GuardMode::Condition,
+                            },
+                            &stmt.span,
+                        );
+                    }
                     return Ok(());
                 }
             }

src/languages/rego/compiler/rules.rs

@@ -234,8 +234,20 @@ impl<'a> Compiler<'a> {
     pub fn compile_from_policy(
         policy: &CompiledPolicy,
         entry_points: &[&str],
+    ) -> Result<Arc<Program>> {
+        Self::compile_from_policy_with_host_await(policy, entry_points, &[])
+    }
+
+    /// Compile from a CompiledPolicy to RVM Program with registered host-awaitable builtins.
+    pub fn compile_from_policy_with_host_await(
+        policy: &CompiledPolicy,
+        entry_points: &[&str],
+        host_await_builtins: &[(&str, usize)],
     ) -> Result<Arc<Program>> {
         let mut compiler = Compiler::with_policy(policy);
+        for &(name, arg_count) in host_await_builtins {
+            compiler.register_host_await_builtin(name, arg_count)?;
+        }
         compiler.current_rule_path = "".to_string();
         let rules = policy.get_rules();
 

src/lib.rs

@@ -205,10 +205,10 @@ pub use alloc::sync::Arc as Rc;
 pub use alloc::rc::Rc;
 
 #[cfg(feature = "std")]
-use std::collections::{hash_map::Entry as MapEntry, HashMap as Map, HashSet as Set};
+use std::collections::{hash_map::Entry as MapEntry, HashMap as Map, HashSet as MapSet};
 
 #[cfg(not(feature = "std"))]
-use alloc::collections::{btree_map::Entry as MapEntry, BTreeMap as Map, BTreeSet as Set};
+use alloc::collections::{btree_map::Entry as MapEntry, BTreeMap as Map, BTreeSet as MapSet};
 
 use alloc::{
     borrow::ToOwned as _,

src/number.rs

@@ -27,10 +27,14 @@ use num_traits::{One, Signed, ToPrimitive, Zero};
 use serde::ser::Serializer;
 use serde::Serialize;
 
+#[cfg(feature = "verus")]
+use vstd::prelude::*;
+
 use crate::*;
 
 pub type BigInt = NumBigInt;
 
+#[cfg_attr(feature = "verus", verus_verify)]
 const F64_SAFE_INTEGER: f64 = 9_007_199_254_740_992.0; // 2^53
 
 #[derive(Clone)]
@@ -140,13 +144,9 @@ impl Number {
         }
     }
 
-    fn ints_to_bigint(a: &Number, b: &Number) -> (BigInt, BigInt) {
-        (a.to_bigint_owned().unwrap(), b.to_bigint_owned().unwrap())
-    }
-
     fn normalize_float(value: f64) -> Number {
-        if let Some(int) = Self::float_to_small_bigint(value) {
-            return Self::from_bigint_owned(int);
+        if let Some(i) = Self::float_to_small_bigint(value) {
+            return Self::from_bigint_owned(i);
         }
         Number::Float(value)
     }
@@ -587,7 +587,11 @@ impl Number {
                 }
             }
             (Number::Int(a), Number::Int(b)) => {
-                if *a % *b == 0 {
+                if *a == i64::MIN && *b == -1 {
+                    // Rust panics on i64::MIN % -1i64, so handle it specially
+                    let quotient = BigInt::from(*a) / BigInt::from(*b);
+                    Ok(Number::from_bigint_owned(quotient))
+                } else if *a % *b == 0 {
                     if let Some(q) = a.checked_div(*b) {
                         Ok(Number::Int(q))
                     } else {
@@ -656,15 +660,17 @@ impl Number {
     }
 
     pub fn modulo(self, rhs: &Self) -> Result<Number> {
-        if rhs.is_zero() {
+        // Conversion fails for a non-integral float, and also for an integral
+        // one whose magnitude exceeds 2^53, which cannot be represented exactly.
+        let (a, b) = match (self.to_bigint_owned(), rhs.to_bigint_owned()) {
+            (Some(a), Some(b)) => (a, b),
+            _ => bail!("modulo on floating-point number"),
+        };
+
+        if b.is_zero() {
             bail!("modulo by zero");
         }
 
-        if !self.is_integer() || !rhs.is_integer() {
-            bail!("modulo on floating-point number");
-        }
-
-        let (a, b) = Number::ints_to_bigint(&self, rhs);
         let rem = a % &b;
         Ok(Number::from_bigint_owned(rem))
     }
@@ -685,6 +691,7 @@ impl Number {
         }
     }
 
+    #[allow(clippy::if_then_some_else_none)]
     fn ensure_integers(a: &Number, b: &Number) -> Option<(BigInt, BigInt)> {
         if a.is_integer() && b.is_integer() {
             Some((a.to_bigint_owned()?, b.to_bigint_owned()?))
@@ -776,7 +783,8 @@ impl Number {
         if e >= 0 {
             Ok(two_pow_positive(e as u32))
         } else {
-            let denom = two_pow_positive((-e) as u32);
+            // Must cast to i64 before negating in case it's i32::MIN
+            let denom = two_pow_positive((-(e as i64)) as u32);
             Number::from(1u64).divide(&denom)
         }
     }
@@ -785,7 +793,8 @@ impl Number {
         if e >= 0 {
             Ok(ten_pow_positive(e as u32))
         } else {
-            let denom = ten_pow_positive((-e) as u32);
+            // Must cast to i64 before negating in case it's i32::MIN
+            let denom = ten_pow_positive((-(e as i64)) as u32);
             Number::from(1u64).divide(&denom)
         }
     }
@@ -984,3 +993,67 @@ fn scientific_parts_to_bigint(mantissa: &str, exponent: i32) -> Option<BigInt> {
 
     Some(value)
 }
+
+#[cfg(test)]
+mod tests {
+    #![allow(clippy::expect_used)] // tests expect() to assert arithmetic results
+
+    use super::*;
+    use alloc::string::ToString;
+
+    /// Regression test: `i64::MIN / -1` overflows `i64` and panics in Rust's
+    /// native integer division/remainder. `divide` must promote the result
+    /// instead of panicking.
+    #[test]
+    fn i64_min_by_negative_one() {
+        let quotient = Number::Int(i64::MIN)
+            .divide(&Number::Int(-1))
+            .expect("division should succeed");
+
+        // 2^63 does not fit in i64, but does fit in u64.
+        assert_eq!(quotient.as_u64(), Some(9_223_372_036_854_775_808));
+        assert_eq!(quotient.as_i64(), None);
+        assert_eq!(quotient.as_i128(), Some(9_223_372_036_854_775_808));
+        assert_eq!(
+            *quotient.to_big().expect("to_big should succeed"),
+            -BigInt::from(i64::MIN)
+        );
+
+        // The same overflow case reached via the mixed `Int`/`BigInt` path.
+        let big_quotient = Number::Int(i64::MIN)
+            .divide(&Number::BigInt(Rc::new(BigInt::from(-1))))
+            .expect("division should succeed");
+        assert_eq!(big_quotient.as_u64(), Some(9_223_372_036_854_775_808));
+
+        // `i64::MIN % -1` also panics natively; the result must be zero.
+        let remainder = Number::Int(i64::MIN)
+            .modulo(&Number::Int(-1))
+            .expect("modulo should succeed");
+        assert_eq!(remainder.as_i64(), Some(0));
+    }
+
+    #[test]
+    fn modulo_handles_floats_that_are_really_integers() {
+        // An integral float is a valid operand.
+        assert!(matches!(
+            Number::Float(4.0).modulo(&Number::Int(3)),
+            Ok(Number::UInt(1))
+        ));
+        // `1e300` has no fractional part, but it is too large to convert to an
+        // integer exactly. This must report an error, not panic.
+        assert_eq!(
+            Number::Float(1e300)
+                .modulo(&Number::Int(3))
+                .err()
+                .map(|e| e.to_string()),
+            Some("modulo on floating-point number".to_string())
+        );
+        assert_eq!(
+            Number::Int(3)
+                .modulo(&Number::Float(1e300))
+                .err()
+                .map(|e| e.to_string()),
+            Some("modulo on floating-point number".to_string())
+        );
+    }
+}

src/parser.rs

@@ -354,6 +354,33 @@ impl<'source> Parser<'source> {
         }
     }
 
+    /// Parse a field name after `.` in a ref expression.
+    ///
+    /// Unlike [`Self::parse_var`] and [`Self::parse_ident`], this method accepts **any**
+    /// `TokenKind::Ident` token, including reserved keywords (e.g. `as`, `default`, `else`,
+    /// `false`, `if`, `import`, `in`, `not`, `null`, `package`, `some`, `true`, `with`).
+    ///
+    /// The position immediately after `.` is unambiguously a field name, so there is no
+    /// syntactic ambiguity with statement-level keywords. This matches OPA's
+    /// `keywords_in_refs` capability, which is enabled by default in standard OPA builds.
+    ///
+    /// # Example
+    /// ```rego
+    /// allow if { input.v0.package.format == "npm" }  # `package` is a keyword but valid here
+    /// ```
+    fn parse_ref_field(&mut self) -> Result<Span> {
+        let span = self.tok.1.clone();
+        match self.tok.0 {
+            TokenKind::Ident => {
+                self.next_token()?;
+                Ok(span)
+            }
+            _ => Err(self
+                .source
+                .error(self.tok.1.line, self.tok.1.col, "expecting identifier")),
+        }
+    }
+
     fn read_number(&mut self, span: Span) -> Result<Expr> {
         match Number::from_str(span.text()) {
             Ok(v) => Ok(Expr::Number {
@@ -743,9 +770,10 @@ impl<'source> Parser<'source> {
                     );
                 }
                 "." => {
-                    // Read identifier.
+                    // Read identifier. Keywords are allowed as field names in
+                    // dot-notation refs (e.g. `input.package.name`).
                     self.next_token()?;
-                    let field = self.parse_var()?;
+                    let field = self.parse_ref_field()?;
                     span.end = self.end;
 
                     // Disallow any whitespace between . and identifier.
@@ -1418,9 +1446,10 @@ impl<'source> Parser<'source> {
                     );
                 }
                 "." => {
-                    // Read identifier.
+                    // Read identifier. Keywords are allowed as field names in
+                    // dot-notation refs (e.g. `import data.my.package`).
                     self.next_token()?;
-                    let field = self.parse_ident()?;
+                    let field = self.parse_ref_field()?;
                     span.end = self.end;
 
                     // Disallow any whitespace between . and identifier.
@@ -1523,7 +1552,8 @@ impl<'source> Parser<'source> {
                 "." => {
                     let sep_pos = self.tok.1.start;
                     self.next_token()?;
-                    let field = self.parse_var()?;
+                    // Keywords are allowed as field names in dot-notation refs.
+                    let field = self.parse_ref_field()?;
                     span.end = self.end;
 
                     // Disallow any whitespace between . and identifier.

src/rvm/vm/comprehension.rs

@@ -226,6 +226,7 @@ impl RegoVM {
         }
     }
 
+    #[allow(clippy::if_then_some_else_none)]
     fn execute_comprehension_yield_run_to_completion(
         &mut self,
         value_reg: u8,
@@ -332,6 +333,7 @@ impl RegoVM {
         Ok(())
     }
 
+    #[allow(clippy::if_then_some_else_none)]
     fn execute_comprehension_yield_suspendable(
         &mut self,
         value_reg: u8,

src/rvm/vm/loops.rs

@@ -495,8 +495,15 @@ impl RegoVM {
                     // over a virtual null element.
                     Ok(Some(IterationState::Single { consumed: false }))
                 } else {
-                    // Standard Rego or count/forEach: non-collection → immediate result.
-                    let result = non_collection_result(mode);
+                    // Standard Rego: iterating a non-collection scalar (number,
+                    // string, bool, null, undefined) yields no iterations. For
+                    // `every` this makes the quantifier undefined (it fails) — it
+                    // is NOT vacuously true, which only applies to a genuinely
+                    // empty collection. `any`/`forEach` remain false.
+                    let result = match *mode {
+                        LoopMode::Every => Value::Undefined,
+                        LoopMode::Any | LoopMode::ForEach => Value::Bool(false),
+                    };
                     self.set_register(params.result_reg, result)?;
                     self.pc = usize::from(params.loop_end).saturating_sub(1);
                     Ok(None)

src/tests/interpreter/mod.rs

@@ -24,6 +24,7 @@ use anyhow::{bail, Result};
 use core::num::NonZeroU32;
 use core::time::Duration;
 use serde::{Deserialize, Serialize};
+use std::collections::{BTreeMap, BTreeSet};
 use test_generator::test_resources;
 use timer_test_support::{
     apply_engine_timer, configure_time_source, reset_time_source, GlobalTimerGuard,
@@ -818,3 +819,446 @@ fn test_get_data() -> Result<()> {
 
     Ok(())
 }
+
+#[test]
+fn test_add_data_deep_merge() -> Result<()> {
+    let mut engine = Engine::new();
+
+    // Nested objects under a shared top-level key are deep-merged, not replaced.
+    engine.add_data(Value::from_json_str(r#"{ "a" : { "x" : 1 } }"#)?)?;
+    engine.add_data(Value::from_json_str(r#"{ "a" : { "y" : 2 } }"#)?)?;
+
+    assert_eq!(
+        engine.get_data(),
+        Value::from_json_str(r#"{ "a" : { "x" : 1, "y" : 2 } }"#)?
+    );
+
+    Ok(())
+}
+
+#[test]
+fn test_add_data_deep_merge_multi_level() -> Result<()> {
+    let mut engine = Engine::new();
+
+    // Merging recurses through multiple levels of nesting.
+    engine.add_data(Value::from_json_str(
+        r#"{ "a" : { "b" : { "x" : 1 } }, "top" : 0 }"#,
+    )?)?;
+    engine.add_data(Value::from_json_str(
+        r#"{ "a" : { "b" : { "y" : 2 }, "c" : 3 } }"#,
+    )?)?;
+
+    assert_eq!(
+        engine.get_data(),
+        Value::from_json_str(r#"{ "a" : { "b" : { "x" : 1, "y" : 2 }, "c" : 3 }, "top" : 0 }"#)?
+    );
+
+    Ok(())
+}
+
+#[test]
+fn test_add_data_leaf_conflict_errors() -> Result<()> {
+    let mut engine = Engine::new();
+
+    // A genuine leaf conflict (same nested path, different value) is an error.
+    engine.add_data(Value::from_json_str(r#"{ "a" : { "x" : 1 } }"#)?)?;
+    assert!(engine
+        .add_data(Value::from_json_str(r#"{ "a" : { "x" : 2 } }"#)?)
+        .is_err());
+
+    Ok(())
+}
+
+#[test]
+fn test_add_data_object_vs_scalar_conflict_errors() -> Result<()> {
+    let mut engine = Engine::new();
+
+    // An object cannot be merged with a scalar at the same path.
+    engine.add_data(Value::from_json_str(r#"{ "a" : { "x" : 1 } }"#)?)?;
+    assert!(engine
+        .add_data(Value::from_json_str(r#"{ "a" : 5 }"#)?)
+        .is_err());
+
+    Ok(())
+}
+
+#[test]
+fn test_add_data_equal_leaf_is_noop() -> Result<()> {
+    let mut engine = Engine::new();
+
+    // Re-adding identical data (including equal nested leaves) is tolerated as a no-op.
+    engine.add_data(Value::from_json_str(r#"{ "a" : { "x" : 1 } }"#)?)?;
+    engine.add_data(Value::from_json_str(r#"{ "a" : { "x" : 1 }, "b" : 2 }"#)?)?;
+
+    assert_eq!(
+        engine.get_data(),
+        Value::from_json_str(r#"{ "a" : { "x" : 1 }, "b" : 2 }"#)?
+    );
+
+    Ok(())
+}
+
+#[test]
+fn test_add_data_set_union() -> Result<()> {
+    let mut engine = Engine::new();
+
+    // Sets under a shared key are unioned rather than conflicting (consistent with the
+    // rule-evaluation merge, where partial set rules accumulate elements). JSON cannot express
+    // sets, so the data documents are built via the `Value` API.
+    engine.add_data(Value::from(BTreeMap::from([(
+        Value::from("s"),
+        Value::from(BTreeSet::from([Value::from(1_u64), Value::from(2_u64)])),
+    )])))?;
+    engine.add_data(Value::from(BTreeMap::from([(
+        Value::from("s"),
+        Value::from(BTreeSet::from([Value::from(2_u64), Value::from(3_u64)])),
+    )])))?;
+
+    let expected = Value::from(BTreeMap::from([(
+        Value::from("s"),
+        Value::from(BTreeSet::from([
+            Value::from(1_u64),
+            Value::from(2_u64),
+            Value::from(3_u64),
+        ])),
+    )]));
+    assert_eq!(engine.get_data(), expected);
+
+    Ok(())
+}
+
+#[test]
+fn test_add_data_nested_set_union() -> Result<()> {
+    let mut engine = Engine::new();
+
+    // A set nested under an object key exercises the recursive merge: the outer objects are
+    // deep-merged and the inner sets are then unioned.
+    engine.add_data(Value::from(BTreeMap::from([(
+        Value::from("a"),
+        Value::from(BTreeMap::from([(
+            Value::from("s"),
+            Value::from(BTreeSet::from([Value::from(1_u64)])),
+        )])),
+    )])))?;
+    engine.add_data(Value::from(BTreeMap::from([(
+        Value::from("a"),
+        Value::from(BTreeMap::from([(
+            Value::from("s"),
+            Value::from(BTreeSet::from([Value::from(2_u64)])),
+        )])),
+    )])))?;
+
+    let expected = Value::from(BTreeMap::from([(
+        Value::from("a"),
+        Value::from(BTreeMap::from([(
+            Value::from("s"),
+            Value::from(BTreeSet::from([Value::from(1_u64), Value::from(2_u64)])),
+        )])),
+    )]));
+    assert_eq!(engine.get_data(), expected);
+
+    Ok(())
+}
+
+#[test]
+fn test_add_data_equal_set_is_noop() -> Result<()> {
+    let mut engine = Engine::new();
+
+    // Re-adding an identical set is tolerated as a no-op (not a conflict).
+    engine.add_data(Value::from(BTreeMap::from([(
+        Value::from("s"),
+        Value::from(BTreeSet::from([Value::from(1_u64), Value::from(2_u64)])),
+    )])))?;
+    engine.add_data(Value::from(BTreeMap::from([(
+        Value::from("s"),
+        Value::from(BTreeSet::from([Value::from(1_u64), Value::from(2_u64)])),
+    )])))?;
+
+    let expected = Value::from(BTreeMap::from([(
+        Value::from("s"),
+        Value::from(BTreeSet::from([Value::from(1_u64), Value::from(2_u64)])),
+    )]));
+    assert_eq!(engine.get_data(), expected);
+
+    Ok(())
+}
+
+#[test]
+fn test_add_data_failed_merge_is_atomic() -> Result<()> {
+    let mut engine = Engine::new();
+
+    engine.add_data(Value::from_json_str(r#"{ "a" : { "z" : 1 } }"#)?)?;
+
+    // Mixes a new key `m` with a conflicting leaf `z` (1 vs 3). Because `m` sorts
+    // before `z`, a naive in-place merge would insert `m` and only then hit the `z`
+    // conflict. add_data must be all-or-nothing: the whole call fails AND leaves the
+    // existing data untouched — `m` must not leak in.
+    assert!(engine
+        .add_data(Value::from_json_str(r#"{ "a" : { "m" : 2, "z" : 3 } }"#)?)
+        .is_err());
+
+    assert_eq!(
+        engine.get_data(),
+        Value::from_json_str(r#"{ "a" : { "z" : 1 } }"#)?
+    );
+
+    Ok(())
+}
+
+#[test]
+fn test_add_data_failed_set_merge_is_atomic() -> Result<()> {
+    let mut engine = Engine::new();
+
+    // Existing data: a set `s` alongside a scalar `z` under `a`.
+    engine.add_data(Value::from(BTreeMap::from([(
+        Value::from("a"),
+        Value::from(BTreeMap::from([
+            (
+                Value::from("s"),
+                Value::from(BTreeSet::from([Value::from(1_u64), Value::from(2_u64)])),
+            ),
+            (Value::from("z"), Value::from(1_u64)),
+        ])),
+    )])))?;
+
+    // This add would union `s` with {3} but conflicts on `z` (1 vs 2). Since `s`
+    // sorts before `z`, a naive in-place merge would union the set *before* failing
+    // on `z`, leaking {3} into `s`. The atomic add must reject the whole call and
+    // leave `s` as {1, 2}.
+    assert!(engine
+        .add_data(Value::from(BTreeMap::from([(
+            Value::from("a"),
+            Value::from(BTreeMap::from([
+                (
+                    Value::from("s"),
+                    Value::from(BTreeSet::from([Value::from(3_u64)])),
+                ),
+                (Value::from("z"), Value::from(2_u64)),
+            ])),
+        )])))
+        .is_err());
+
+    // `s` must be unchanged ({1, 2}, not {1, 2, 3}) and `z` must still be 1.
+    let expected = Value::from(BTreeMap::from([(
+        Value::from("a"),
+        Value::from(BTreeMap::from([
+            (
+                Value::from("s"),
+                Value::from(BTreeSet::from([Value::from(1_u64), Value::from(2_u64)])),
+            ),
+            (Value::from("z"), Value::from(1_u64)),
+        ])),
+    )]));
+    assert_eq!(engine.get_data(), expected);
+
+    Ok(())
+}
+
+#[test]
+fn test_add_data_failed_array_merge_is_atomic() -> Result<()> {
+    let mut engine = Engine::new();
+
+    engine.add_data(Value::from_json_str(r#"{ "a" : { "arr" : [1, 2] } }"#)?)?;
+
+    // Arrays are atomic leaves (never element-merged), so a differing array at the
+    // same path is a conflict. The new key `aa` sorts before `arr`, so a naive
+    // in-place merge would insert `aa` and only then hit the `arr` conflict. add_data
+    // must reject the whole call and leave the data untouched — `aa` must not leak in.
+    assert!(engine
+        .add_data(Value::from_json_str(
+            r#"{ "a" : { "aa" : 5, "arr" : [3] } }"#
+        )?)
+        .is_err());
+
+    assert_eq!(
+        engine.get_data(),
+        Value::from_json_str(r#"{ "a" : { "arr" : [1, 2] } }"#)?
+    );
+
+    Ok(())
+}
+
+// The `Value::merge` used by `add_data` is shared with the rule-evaluation path
+// (`Interpreter::merge_rule_value`, reached via `with data.* as ...` and rule-value
+// materialization). The tests below pin down that making `merge` recursive changed only the
+// data-document semantics and left rule evaluation — in particular the `with data.* as ...`
+// modifier — behaving exactly as before (an override, never a deep merge).
+
+#[test]
+fn test_with_data_modifier_replaces_nested_object() -> Result<()> {
+    let mut engine = Engine::new();
+
+    // Base data provides a nested object with two keys.
+    engine.add_data(Value::from_json_str(
+        r#"{ "base" : { "foo" : { "a" : 1, "b" : 2 } } }"#,
+    )?)?;
+
+    engine.add_policy(
+        "policy.rego".to_string(),
+        r#"
+package test
+
+result := x if {
+    x := data.base.foo with data.base.foo as {"a": 99}
+}
+"#
+        .to_string(),
+    )?;
+
+    // `with data.base.foo as {"a": 99}` REPLACES the whole subtree for the duration of the
+    // rule; it must NOT deep-merge with the base `{ "a": 1, "b": 2 }`. So `b` is gone.
+    assert_eq!(
+        engine
+            .eval_query("data.test.result".to_string(), false)?
+            .result[0]
+            .expressions[0]
+            .value
+            .clone(),
+        Value::from_json_str(r#"{ "a" : 99 }"#)?
+    );
+
+    Ok(())
+}
+
+#[test]
+fn test_with_data_modifier_replaces_whole_subtree() -> Result<()> {
+    let mut engine = Engine::new();
+
+    engine.add_data(Value::from_json_str(
+        r#"{ "base" : { "foo" : 1, "bar" : 2 } }"#,
+    )?)?;
+
+    engine.add_policy(
+        "policy.rego".to_string(),
+        r#"
+package test
+
+result := x if {
+    x := data.base with data.base as {"only": 3}
+}
+"#
+        .to_string(),
+    )?;
+
+    // `with data.base as {...}` replaces the entire `data.base` object; the original
+    // `foo`/`bar` keys are not merged in.
+    assert_eq!(
+        engine
+            .eval_query("data.test.result".to_string(), false)?
+            .result[0]
+            .expressions[0]
+            .value
+            .clone(),
+        Value::from_json_str(r#"{ "only" : 3 }"#)?
+    );
+
+    Ok(())
+}
+
+#[test]
+fn test_with_data_modifier_nested_replace_preserves_siblings() -> Result<()> {
+    let mut engine = Engine::new();
+
+    // `data.base` has a nested `foo` object AND a sibling `bar`.
+    engine.add_data(Value::from_json_str(
+        r#"{ "base" : { "foo" : { "a" : 1, "b" : 2 }, "bar" : 7 } }"#,
+    )?)?;
+
+    engine.add_policy(
+        "policy.rego".to_string(),
+        r#"
+package test
+
+# `with` targets the nested `data.base.foo`, but the rule observes the PARENT `data.base`.
+result := x if {
+    x := data.base with data.base.foo as {"a": 99}
+}
+"#
+        .to_string(),
+    )?;
+
+    // The nested `foo` is deep-replaced (its `b` is gone — `with` never merges), while the
+    // sibling `bar` under the same parent is preserved.
+    assert_eq!(
+        engine
+            .eval_query("data.test.result".to_string(), false)?
+            .result[0]
+            .expressions[0]
+            .value
+            .clone(),
+        Value::from_json_str(r#"{ "foo" : { "a" : 99 }, "bar" : 7 }"#)?
+    );
+
+    Ok(())
+}
+
+#[test]
+fn test_rule_reads_deep_merged_base_data() -> Result<()> {
+    let mut engine = Engine::new();
+
+    // Two add_data calls deep-merge into a single nested object...
+    engine.add_data(Value::from_json_str(
+        r#"{ "base" : { "foo" : { "a" : 1 } } }"#,
+    )?)?;
+    engine.add_data(Value::from_json_str(
+        r#"{ "base" : { "foo" : { "b" : 2 } } }"#,
+    )?)?;
+
+    engine.add_policy(
+        "policy.rego".to_string(),
+        r#"
+package test
+
+a := data.base.foo.a
+b := data.base.foo.b
+"#
+        .to_string(),
+    )?;
+
+    // ...and both merged leaves are visible to rule evaluation.
+    assert_eq!(
+        engine.eval_query("data.test".to_string(), false)?.result[0].expressions[0]
+            .value
+            .clone(),
+        Value::from_json_str(r#"{ "a" : 1, "b" : 2 }"#)?
+    );
+
+    Ok(())
+}
+
+#[test]
+fn test_rule_values_coexist_with_merged_base_data() -> Result<()> {
+    let mut engine = Engine::new();
+
+    // Deep-merged base data under `base`...
+    engine.add_data(Value::from_json_str(
+        r#"{ "base" : { "foo" : { "a" : 1 } } }"#,
+    )?)?;
+    engine.add_data(Value::from_json_str(
+        r#"{ "base" : { "foo" : { "b" : 2 } } }"#,
+    )?)?;
+
+    engine.add_policy(
+        "policy.rego".to_string(),
+        r#"
+package test
+
+computed := data.base.foo.a + data.base.foo.b
+"#
+        .to_string(),
+    )?;
+
+    let data = engine.eval_query("data".to_string(), false)?.result[0].expressions[0]
+        .value
+        .clone();
+
+    // Base data is preserved and deep-merged...
+    assert_eq!(
+        data["base"],
+        Value::from_json_str(r#"{ "foo" : { "a" : 1, "b" : 2 } }"#)?
+    );
+    // ...and the rule-computed value materializes alongside it without disturbing the merge.
+    assert_eq!(data["test"]["computed"], Value::from(3_u64));
+
+    Ok(())
+}

src/value/mod.rs

@@ -12,16 +12,22 @@
 )] // value helpers index paths directly for performance
 
 mod object;
+mod set;
 
 #[cfg(test)]
 mod tests;
 
 #[allow(unused_imports)] // surface for downstream PRs
 pub use object::{IntoIter, Iter, IterMut, Object};
+#[allow(unused_imports)] // surface for downstream PRs
+pub use set::Set;
 
 #[cfg(feature = "rvm")]
 #[allow(unused_imports)] // surface for downstream PRs
 pub use object::ObjectCursor;
+#[cfg(feature = "rvm")]
+#[allow(unused_imports)] // surface for downstream PRs
+pub use set::SetCursor;
 
 use crate::number::Number;
 
@@ -1326,6 +1332,13 @@ impl Value {
     }
 }
 
+/// Depth cap for `deep_merge`/`check_mergeable`, set at serde_json's default recursion limit.
+///
+/// Prevents a stack overflow from adversarially nested data — an uncatchable abort that poisons
+/// every engine in an FFI process. At serde_json's limit it only backstops `Value`s built without
+/// a parse-time cap: the Python/Ruby native bindings, or programmatic construction.
+const MAX_MERGE_DEPTH: usize = 128;
+
 impl Value {
     pub(crate) fn make_or_get_value_mut<'a>(&'a mut self, paths: &[&str]) -> Result<&'a mut Value> {
         if paths.is_empty() {
@@ -1359,6 +1372,11 @@ impl Value {
         }
     }
 
+    /// Shallow-merge `new` into `self` with strict rule-output semantics.
+    ///
+    /// Objects merge one level deep: a key on both sides must hold the *same* value or it is a
+    /// conflict; sets union; equal values are a no-op. Non-recursive by design — data documents
+    /// use [`Value::deep_merge`] instead.
     pub(crate) fn merge(&mut self, mut new: Value) -> Result<()> {
         if self == &new {
             return Ok(());
@@ -1366,24 +1384,26 @@ impl Value {
         match (self, &mut new) {
             (v @ Value::Undefined, _) => *v = new,
             (Value::Set(ref mut set), Value::Set(new)) => {
-                Rc::make_mut(set).append(Rc::make_mut(new));
-                // Enforce allocator limit after merging set entries.
+                // Union without deep-cloning the RHS set (see `deep_merge`).
+                let dst = Rc::make_mut(set);
+                match Rc::try_unwrap(core::mem::take(new)) {
+                    Ok(owned) => dst.extend(owned),
+                    Err(shared) => dst.extend(shared.iter().cloned()),
+                }
                 enforce_limit_anyhow()?;
             }
             (Value::Object(map), Value::Object(new)) => {
                 for (k, v) in new.iter() {
                     match map.get(k) {
-                        Some(pv) if *pv != *v => {
-                            bail!(
-                                "value for key `{}` generated multiple times: `{}` and `{}`",
-                                serde_json::to_string_pretty(&k).map_err(anyhow::Error::msg)?,
-                                serde_json::to_string_pretty(&pv).map_err(anyhow::Error::msg)?,
-                                serde_json::to_string_pretty(&v).map_err(anyhow::Error::msg)?,
-                            )
-                        }
+                        // Same key, different value: the rule produced two outputs for one path.
+                        Some(pv) if *pv != *v => bail!(
+                            "value for key `{}` generated multiple times: `{}` and `{}`",
+                            serde_json::to_string_pretty(&k).map_err(anyhow::Error::msg)?,
+                            serde_json::to_string_pretty(&pv).map_err(anyhow::Error::msg)?,
+                            serde_json::to_string_pretty(&v).map_err(anyhow::Error::msg)?,
+                        ),
                         _ => {
                             Rc::make_mut(map).insert(k.clone(), v.clone());
-                            // Enforce allocator limit after merging object entries.
                             enforce_limit_anyhow()?;
                         }
                     };
@@ -1393,6 +1413,151 @@ impl Value {
         };
         Ok(())
     }
+
+    /// Recursively deep-merge `new` into `self` — the data-document merge behind [`Engine::add_data`].
+    ///
+    /// Objects recurse per-key, sets union, equal values are a no-op, any other differing pair
+    /// conflicts. Set-union is a regorus extension (OPA data is JSON, which has no sets). Distinct
+    /// from the strict, non-recursive [`Value::merge`] used for rule outputs — use deep-merge ONLY
+    /// for data documents.
+    ///
+    /// [`Engine::add_data`]: crate::Engine::add_data
+    pub(crate) fn deep_merge(&mut self, new: Value) -> Result<()> {
+        self.deep_merge_at(new, 0)
+    }
+
+    /// Depth-tracked worker for [`deep_merge`](Value::deep_merge). See [`MAX_MERGE_DEPTH`].
+    fn deep_merge_at(&mut self, mut new: Value, depth: usize) -> Result<()> {
+        if depth >= MAX_MERGE_DEPTH {
+            bail!("data merge exceeds maximum nesting depth of {MAX_MERGE_DEPTH}");
+        }
+        if self == &new {
+            return Ok(());
+        }
+        match (self, &mut new) {
+            (v @ Value::Undefined, _) => *v = new,
+            (Value::Set(ref mut set), Value::Set(new)) => {
+                // Union without deep-cloning the RHS set: move elements if uniquely owned,
+                // else clone only the element handles (`Rc` bumps), never the whole `BTreeSet`.
+                let dst = Rc::make_mut(set);
+                match Rc::try_unwrap(core::mem::take(new)) {
+                    Ok(owned) => dst.extend(owned),
+                    Err(shared) => dst.extend(shared.iter().cloned()),
+                }
+                enforce_limit_anyhow()?;
+            }
+            (Value::Object(map), Value::Object(new)) => {
+                // What each incoming key requires of the target map. Decided from a read-only
+                // probe so a no-op or a conflict never triggers `Rc::make_mut` (and never clones
+                // a shared map); `make_mut` is taken lazily, only when a key actually mutates.
+                enum Step {
+                    Skip,
+                    Insert,
+                    Recurse,
+                    Conflict,
+                }
+                for (k, v) in new.iter() {
+                    let step = match map.get(k) {
+                        None => Step::Insert,
+                        Some(existing) if existing == v => Step::Skip,
+                        Some(existing)
+                            if matches!(
+                                (existing, v),
+                                (Value::Object(_), Value::Object(_))
+                                    | (Value::Set(_), Value::Set(_))
+                            ) =>
+                        {
+                            Step::Recurse
+                        }
+                        Some(_) => Step::Conflict,
+                    };
+                    match step {
+                        Step::Skip => {}
+                        Step::Insert => {
+                            Rc::make_mut(map).insert(k.clone(), v.clone());
+                            enforce_limit_anyhow()?;
+                        }
+                        // Both sides are containers: recurse so nested objects merge rather than
+                        // the subtree being replaced (OPA data-merge semantics).
+                        Step::Recurse => {
+                            let existing = Rc::make_mut(map).get_mut(k).ok_or_else(|| {
+                                anyhow!("internal error: key vanished during merge")
+                            })?;
+                            existing.deep_merge_at(v.clone(), depth.saturating_add(1))?;
+                        }
+                        Step::Conflict => {
+                            let existing = map.get(k).ok_or_else(|| {
+                                anyhow!("internal error: key vanished during merge")
+                            })?;
+                            bail!(
+                                "value for key `{}` generated multiple times: `{}` and `{}`",
+                                serde_json::to_string_pretty(&k).map_err(anyhow::Error::msg)?,
+                                serde_json::to_string_pretty(&existing)
+                                    .map_err(anyhow::Error::msg)?,
+                                serde_json::to_string_pretty(&v).map_err(anyhow::Error::msg)?,
+                            )
+                        }
+                    }
+                }
+            }
+            _ => bail!("error: could not merge value"),
+        };
+        Ok(())
+    }
+
+    /// Read-only check that [`deep_merge`](Value::deep_merge)-ing `other` into `self` would not
+    /// conflict, without mutating or allocating.
+    ///
+    /// Lets [`Engine::add_data`] validate before merging in place. Since a conflict is the only
+    /// way the default-build merge can fail and it depends only on the inputs, a passing scan
+    /// guarantees the in-place `deep_merge` won't fail — avoiding the alternative of cloning the
+    /// whole document into a candidate just to validate. Only overlapping keys are walked, so
+    /// disjoint additions are near-free.
+    ///
+    /// [`Engine::add_data`]: crate::Engine::add_data
+    #[cfg(not(feature = "allocator-memory-limits"))]
+    pub(crate) fn check_mergeable(&self, other: &Value) -> Result<()> {
+        self.check_mergeable_at(other, 0)
+    }
+
+    /// Depth-tracked worker for [`check_mergeable`](Value::check_mergeable). See [`MAX_MERGE_DEPTH`].
+    #[cfg(not(feature = "allocator-memory-limits"))]
+    fn check_mergeable_at(&self, other: &Value, depth: usize) -> Result<()> {
+        if depth >= MAX_MERGE_DEPTH {
+            bail!("data merge exceeds maximum nesting depth of {MAX_MERGE_DEPTH}");
+        }
+        if self == other {
+            return Ok(());
+        }
+        match (self, other) {
+            (Value::Undefined, _) => Ok(()),
+            // Set union never conflicts.
+            (Value::Set(_), Value::Set(_)) => Ok(()),
+            (Value::Object(dst), Value::Object(src)) => {
+                for (k, sv) in src.iter() {
+                    // Only overlapping keys can conflict.
+                    if let Some(dv) = dst.get(k) {
+                        let both_mergeable = matches!(
+                            (dv, sv),
+                            (Value::Object(_), Value::Object(_)) | (Value::Set(_), Value::Set(_))
+                        );
+                        if both_mergeable {
+                            dv.check_mergeable_at(sv, depth.saturating_add(1))?;
+                        } else if dv != sv {
+                            bail!(
+                                "value for key `{}` generated multiple times: `{}` and `{}`",
+                                serde_json::to_string_pretty(&k).map_err(anyhow::Error::msg)?,
+                                serde_json::to_string_pretty(&dv).map_err(anyhow::Error::msg)?,
+                                serde_json::to_string_pretty(&sv).map_err(anyhow::Error::msg)?,
+                            )
+                        }
+                    }
+                }
+                Ok(())
+            }
+            _ => bail!("error: could not merge value"),
+        }
+    }
 }
 
 impl ops::Index<&Value> for Value {

src/value/set/iter.rs

@@ -0,0 +1,103 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+//! Opaque iterator types for [`Set`].
+//!
+//! These newtypes wrap the storage backend's iterators so the backend can be
+//! swapped without changing any iterator type signatures observed by callers.
+
+use alloc::collections::btree_set;
+use core::iter::FusedIterator;
+
+use super::Set;
+use crate::value::Value;
+
+/// Owned iterator over `Value` elements.
+#[derive(Debug)]
+pub struct IntoIter {
+    pub(super) inner: btree_set::IntoIter<Value>,
+}
+
+impl Iterator for IntoIter {
+    type Item = Value;
+    #[inline]
+    fn next(&mut self) -> Option<Self::Item> {
+        self.inner.next()
+    }
+    #[inline]
+    fn size_hint(&self) -> (usize, Option<usize>) {
+        self.inner.size_hint()
+    }
+}
+
+impl DoubleEndedIterator for IntoIter {
+    #[inline]
+    fn next_back(&mut self) -> Option<Self::Item> {
+        self.inner.next_back()
+    }
+}
+
+impl ExactSizeIterator for IntoIter {
+    #[inline]
+    fn len(&self) -> usize {
+        self.inner.len()
+    }
+}
+
+impl FusedIterator for IntoIter {}
+
+/// Borrowed iterator over `&Value` elements.
+#[derive(Debug, Clone)]
+pub struct Iter<'a> {
+    pub(super) inner: btree_set::Iter<'a, Value>,
+}
+
+impl<'a> Iterator for Iter<'a> {
+    type Item = &'a Value;
+    #[inline]
+    fn next(&mut self) -> Option<Self::Item> {
+        self.inner.next()
+    }
+    #[inline]
+    fn size_hint(&self) -> (usize, Option<usize>) {
+        self.inner.size_hint()
+    }
+}
+
+impl<'a> DoubleEndedIterator for Iter<'a> {
+    #[inline]
+    fn next_back(&mut self) -> Option<Self::Item> {
+        self.inner.next_back()
+    }
+}
+
+impl<'a> ExactSizeIterator for Iter<'a> {
+    #[inline]
+    fn len(&self) -> usize {
+        self.inner.len()
+    }
+}
+
+impl<'a> FusedIterator for Iter<'a> {}
+
+impl IntoIterator for Set {
+    type Item = Value;
+    type IntoIter = IntoIter;
+    #[inline]
+    fn into_iter(self) -> Self::IntoIter {
+        IntoIter {
+            inner: self.inner.into_iter(),
+        }
+    }
+}
+
+impl<'a> IntoIterator for &'a Set {
+    type Item = &'a Value;
+    type IntoIter = Iter<'a>;
+    #[inline]
+    fn into_iter(self) -> Self::IntoIter {
+        Iter {
+            inner: self.inner.iter(),
+        }
+    }
+}

src/value/set/mod.rs

@@ -0,0 +1,269 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+//! See [`Set`].
+
+mod iter;
+mod serde;
+
+use alloc::collections::BTreeSet;
+use core::cmp::Ordering;
+use core::fmt;
+use core::ops::Bound;
+
+use crate::value::Value;
+
+#[allow(unused_imports)] // surface for downstream PRs
+pub use iter::{IntoIter, Iter};
+
+/// Opaque, ordered set of [`Value`]s.
+///
+/// The current backing storage is `BTreeSet<Value>`. The inner field is
+/// private so the representation can change (hash-backed, lazy, bloom-fronted,
+/// FFI-backed) without touching call sites.
+///
+/// # Iteration
+///
+/// - [`Set::iter`] — implementation-defined order; non-resumable.
+/// - [`Set::iter_sorted`] — sorted by `Value::Ord`; non-resumable.
+/// - [`Set::cursor`] / [`Set::next`] — implementation-defined order,
+///   resumable; cheapest per-step cost. Used by interpreter/RVM when iteration
+///   must yield mid-flight.
+#[derive(Default, Clone, Eq, PartialEq)]
+pub struct Set {
+    inner: BTreeSet<Value>,
+}
+
+impl Set {
+    /// Create an empty `Set`.
+    #[inline]
+    pub const fn new() -> Self {
+        Self {
+            inner: BTreeSet::new(),
+        }
+    }
+
+    #[inline]
+    pub fn len(&self) -> usize {
+        self.inner.len()
+    }
+
+    #[inline]
+    pub fn is_empty(&self) -> bool {
+        self.inner.is_empty()
+    }
+
+    #[inline]
+    pub fn contains(&self, value: &Value) -> bool {
+        self.inner.contains(value)
+    }
+
+    #[inline]
+    pub fn get(&self, value: &Value) -> Option<&Value> {
+        self.inner.get(value)
+    }
+
+    /// First element in sorted order (by `Value::Ord`).
+    #[inline]
+    pub fn first(&self) -> Option<&Value> {
+        self.iter_sorted().next()
+    }
+
+    /// Last element in sorted order (by `Value::Ord`).
+    #[inline]
+    pub fn last(&self) -> Option<&Value> {
+        self.iter_sorted().next_back()
+    }
+
+    /// Iteration in implementation-defined order. Non-resumable.
+    ///
+    /// For the current BTree-backed storage this happens to be sorted, but
+    /// callers MUST NOT depend on that. Use [`Set::iter_sorted`] when
+    /// deterministic order is required, or [`Set::cursor`] when iteration
+    /// must yield and resume.
+    #[inline]
+    pub fn iter(&self) -> impl Iterator<Item = &Value> + '_ {
+        self.inner.iter()
+    }
+
+    /// Iteration in sorted order (by `Value::Ord`). Non-resumable.
+    ///
+    /// Use this for serialization, snapshots, hashing, `Debug`, etc.
+    #[inline]
+    pub fn iter_sorted(&self) -> Iter<'_> {
+        // BTree backend iterates sorted natively.
+        Iter {
+            inner: self.inner.iter(),
+        }
+    }
+
+    /// Insert `value`. Returns `true` if the value was newly inserted.
+    #[inline]
+    pub fn insert(&mut self, value: Value) -> bool {
+        self.inner.insert(value)
+    }
+
+    #[inline]
+    pub fn remove(&mut self, value: &Value) -> bool {
+        self.inner.remove(value)
+    }
+
+    #[inline]
+    pub fn retain<F>(&mut self, f: F)
+    where
+        F: FnMut(&Value) -> bool,
+    {
+        self.inner.retain(f);
+    }
+
+    #[inline]
+    pub fn clear(&mut self) {
+        self.inner.clear();
+    }
+
+    #[inline]
+    pub fn append(&mut self, other: &mut Set) {
+        self.inner.append(&mut other.inner);
+    }
+
+    /// Set intersection. Returns a new `Set` containing the elements
+    /// present in both `self` and `other`.
+    pub fn intersection(&self, other: &Set) -> Set {
+        Set {
+            inner: self.inner.intersection(&other.inner).cloned().collect(),
+        }
+    }
+
+    /// Set union. Returns a new `Set` containing the elements present in
+    /// either `self` or `other`.
+    pub fn union(&self, other: &Set) -> Set {
+        Set {
+            inner: self.inner.union(&other.inner).cloned().collect(),
+        }
+    }
+
+    /// Set difference. Returns a new `Set` containing the elements present
+    /// in `self` but not in `other`.
+    pub fn difference(&self, other: &Set) -> Set {
+        Set {
+            inner: self.inner.difference(&other.inner).cloned().collect(),
+        }
+    }
+
+    #[inline]
+    pub fn is_subset(&self, other: &Set) -> bool {
+        self.inner.is_subset(&other.inner)
+    }
+
+    /// Wrap into a `Value::Set`.
+    #[inline]
+    pub fn into_value(self) -> Value {
+        Value::Set(crate::Rc::new(self.inner))
+    }
+
+    /// Create a resumable cursor over elements in implementation-defined
+    /// order. Stable for the lifetime of `&self`. O(1).
+    ///
+    /// The cursor is fully self-owned (it stores a clone of the last-seen
+    /// element, not a reference) so it can be stored as a field of a
+    /// long-lived state struct — e.g. an RVM iteration frame that persists
+    /// across instruction dispatches. As a consequence, mutating the `Set`
+    /// between `next()` calls is not rejected by the borrow checker; the
+    /// resulting iteration order in that case is unspecified.
+    #[inline]
+    pub const fn cursor(&self) -> SetCursor {
+        SetCursor {
+            inner: SetCursorInner::BTree(None),
+        }
+    }
+
+    /// Advance `cursor` and yield the next element. O(log n) for the BTree
+    /// backend (range probe); future hash/inline variants may be O(1).
+    pub fn next<'a>(&'a self, cursor: &mut SetCursor) -> Option<&'a Value> {
+        let SetCursorInner::BTree(ref mut last) = cursor.inner;
+        let next = last.as_ref().map_or_else(
+            || self.inner.iter().next(),
+            |prev| {
+                // `(Bound<&T>, Bound<&T>)` impls `RangeBounds<T>` — no clone
+                // needed to build the resume bound.
+                self.inner
+                    .range((Bound::Excluded(prev), Bound::Unbounded))
+                    .next()
+            },
+        );
+        let v = next?;
+        *last = Some(v.clone());
+        Some(v)
+    }
+}
+
+/// Opaque resumable cursor over a [`Set`]'s elements in
+/// implementation-defined order.
+///
+/// Self-owned: holds no borrow on the `Set`, so it can be stored as a
+/// field of a long-lived state struct (e.g. an RVM iteration frame).
+#[derive(Debug, Clone)]
+pub struct SetCursor {
+    inner: SetCursorInner,
+}
+
+#[derive(Debug, Clone)]
+enum SetCursorInner {
+    /// BTree backend cursor: tracks last-seen element. `None` means "before start".
+    BTree(Option<Value>),
+}
+
+// ---- Hand-written Ord/PartialOrd ----------------------------------------
+//
+// Implemented in terms of `iter_sorted()` so ordering is consistent with the
+// canonical (sorted) view of the elements and is therefore independent of
+// the storage variant.
+
+impl Ord for Set {
+    fn cmp(&self, other: &Self) -> Ordering {
+        self.iter_sorted().cmp(other.iter_sorted())
+    }
+}
+
+impl PartialOrd for Set {
+    #[inline]
+    fn partial_cmp(&self, other: &Self) -> Option<Ordering> {
+        Some(self.cmp(other))
+    }
+}
+
+impl fmt::Debug for Set {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        // Use sorted iteration so Debug output is stable across storage
+        // variants.
+        f.debug_set().entries(self.iter_sorted()).finish()
+    }
+}
+
+impl Extend<Value> for Set {
+    fn extend<I: IntoIterator<Item = Value>>(&mut self, iter: I) {
+        self.inner.extend(iter);
+    }
+}
+
+impl FromIterator<Value> for Set {
+    fn from_iter<I: IntoIterator<Item = Value>>(iter: I) -> Self {
+        Self {
+            inner: BTreeSet::from_iter(iter),
+        }
+    }
+}
+
+impl From<BTreeSet<Value>> for Set {
+    #[inline]
+    fn from(set: BTreeSet<Value>) -> Self {
+        Self { inner: set }
+    }
+}
+
+impl From<Set> for Value {
+    #[inline]
+    fn from(s: Set) -> Self {
+        s.into_value()
+    }
+}

src/value/set/serde.rs

@@ -0,0 +1,44 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+//! Serde `Serialize`/`Deserialize` impls for [`Set`].
+
+use core::fmt;
+
+use serde::de::{Deserialize, Deserializer, Error as _, SeqAccess, Visitor};
+use serde::ser::{Serialize, Serializer};
+
+use super::Set;
+use crate::value::Value;
+
+impl Serialize for Set {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        // Sets serialize as JSON arrays. Sorted iteration: canonical output.
+        serializer.collect_seq(self.iter_sorted())
+    }
+}
+
+struct SetVisitor;
+
+impl<'de> Visitor<'de> for SetVisitor {
+    type Value = Set;
+
+    fn expecting(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("a sequence of Values")
+    }
+
+    fn visit_seq<A: SeqAccess<'de>>(self, mut access: A) -> Result<Self::Value, A::Error> {
+        let mut set = Set::new();
+        while let Some(v) = access.next_element::<Value>()? {
+            set.insert(v);
+            crate::utils::limits::check_memory_limit_if_needed().map_err(A::Error::custom)?;
+        }
+        Ok(set)
+    }
+}
+
+impl<'de> Deserialize<'de> for Set {
+    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        deserializer.deserialize_seq(SetVisitor)
+    }
+}

src/value/tests.rs

@@ -2,6 +2,7 @@
 // Licensed under the MIT License.
 
 #![allow(
+    clippy::panic,
     clippy::expect_used,
     clippy::unwrap_used,
     clippy::indexing_slicing,
@@ -13,11 +14,11 @@
     clippy::pattern_type_mismatch
 )]
 
-use alloc::collections::BTreeMap;
+use alloc::collections::{BTreeMap, BTreeSet};
 use alloc::format;
 use alloc::vec::Vec;
 
-use super::Object;
+use super::{Object, Set};
 use crate::value::Value;
 
 fn val(i: u64) -> Value {
@@ -562,3 +563,306 @@ fn object_insert_returns_previous_value() {
     assert_eq!(obj.insert(val(0), val(2)), Some(val(1)));
     assert_eq!(obj.get(&val(0)), Some(&val(2)));
 }
+
+// =========================================================================
+// Set tests
+// =========================================================================
+
+const SET_SIZES: &[u64] = &[0, 1, 2, 4, 8, 64, 256, 1024];
+
+#[test]
+fn set_iter_sorted_matches_btreeset_oracle() {
+    for &n in SET_SIZES {
+        let values: Vec<Value> = (0..n).map(val).collect();
+        let oracle: BTreeSet<Value> = values.iter().cloned().collect();
+        let s: Set = values.into_iter().collect();
+        let actual: Vec<&Value> = s.iter_sorted().collect();
+        let expected: Vec<&Value> = oracle.iter().collect();
+        assert_eq!(actual, expected, "size {n}");
+    }
+}
+
+#[test]
+fn set_iter_multiset_equality_with_oracle() {
+    for &n in SET_SIZES {
+        let values: Vec<Value> = (0..n).map(val).collect();
+        let oracle: BTreeSet<Value> = values.iter().cloned().collect();
+        let s: Set = values.into_iter().collect();
+        let mut a: Vec<Value> = s.iter().cloned().collect();
+        let mut b: Vec<Value> = oracle.iter().cloned().collect();
+        a.sort();
+        b.sort();
+        assert_eq!(a, b);
+    }
+}
+
+#[test]
+fn set_algebra_matches_btreeset() {
+    let a_vals: Vec<Value> = (0..32_u64).map(val).collect();
+    let b_vals: Vec<Value> = (16..48_u64).map(val).collect();
+    let a_btree: BTreeSet<Value> = a_vals.iter().cloned().collect();
+    let b_btree: BTreeSet<Value> = b_vals.iter().cloned().collect();
+    let a: Set = a_vals.into_iter().collect();
+    let b: Set = b_vals.into_iter().collect();
+
+    fn sorted<'a, I: Iterator<Item = &'a Value>>(it: I) -> Vec<&'a Value> {
+        let mut v: Vec<&Value> = it.collect();
+        v.sort();
+        v
+    }
+
+    let inter_set = a.intersection(&b);
+    assert_eq!(
+        sorted(inter_set.iter_sorted()),
+        sorted(a_btree.intersection(&b_btree))
+    );
+
+    let union_set = a.union(&b);
+    assert_eq!(
+        sorted(union_set.iter_sorted()),
+        sorted(a_btree.union(&b_btree))
+    );
+
+    let diff_set = a.difference(&b);
+    assert_eq!(
+        sorted(diff_set.iter_sorted()),
+        sorted(a_btree.difference(&b_btree))
+    );
+
+    // Subset: trivial + non-trivial cases.
+    let proper_subset: Set = (0..16_u64).map(val).collect();
+    let non_subset: Set = (30..50_u64).map(val).collect();
+    assert!(a.is_subset(&a));
+    assert!(proper_subset.is_subset(&a));
+    assert!(!non_subset.is_subset(&a));
+}
+
+#[test]
+fn set_first_last() {
+    let s: Set = (0..16_u64).map(val).collect();
+    assert_eq!(s.first(), Some(&val(0)));
+    assert_eq!(s.last(), Some(&val(15)));
+    assert!(Set::new().first().is_none());
+}
+
+#[test]
+fn set_serde_roundtrip() {
+    for &n in &[0_u64, 1, 8, 64] {
+        let s: Set = (0..n).map(val).collect();
+        let json = serde_json::to_string(&s).expect("ser");
+        let back: Set = serde_json::from_str(&json).expect("de");
+        assert_eq!(s, back, "size {n}");
+    }
+}
+
+#[test]
+fn set_append_drains_other() {
+    let mut a: Set = (0..4_u64).map(val).collect();
+    let mut b: Set = (4..8_u64).map(val).collect();
+    a.append(&mut b);
+    assert_eq!(a.len(), 8);
+    assert!(b.is_empty());
+}
+
+#[test]
+fn set_value_cow_make_mut_isolates_clones() {
+    let a = Value::new_set();
+    let b = a.clone();
+    let mut b_owned = b;
+    b_owned.as_set_mut().expect("set").insert(Value::from("x"));
+    assert_eq!(a.as_set().expect("set").len(), 0);
+    assert_eq!(b_owned.as_set().expect("set").len(), 1);
+}
+
+#[test]
+fn set_from_iter_dedups_duplicates() {
+    let s: Set = [val(1), val(1), val(2), val(2), val(2)]
+        .into_iter()
+        .collect();
+    assert_eq!(s.len(), 2);
+    assert!(s.contains(&val(1)));
+    assert!(s.contains(&val(2)));
+}
+
+#[test]
+fn set_accessor_coverage() {
+    let mut s: Set = (0..4_u64).map(val).collect();
+
+    assert!(s.contains(&val(2)));
+    assert!(!s.contains(&val(100)));
+
+    assert_eq!(s.get(&val(2)), Some(&val(2)));
+    assert!(s.get(&val(100)).is_none());
+
+    assert!(s.remove(&val(2)));
+    assert!(!s.remove(&val(2)));
+    assert_eq!(s.len(), 3);
+
+    s.retain(|v| v != &val(0));
+    assert!(!s.contains(&val(0)));
+    assert_eq!(s.len(), 2);
+
+    s.clear();
+    assert!(s.is_empty());
+    assert!(!s.contains(&val(1)));
+}
+
+#[test]
+fn set_into_iterator_ref() {
+    let s: Set = (0..4_u64).map(val).collect();
+    let mut count = 0;
+    for _v in &s {
+        count += 1;
+    }
+    assert_eq!(count, 4);
+}
+
+#[test]
+fn set_cursor_yields_every_element_once() {
+    for &n in SET_SIZES {
+        let vals: Vec<Value> = (0..n).map(val).collect();
+        let s: Set = vals.clone().into_iter().collect();
+        let mut cursor = s.cursor();
+        let mut collected: Vec<Value> = Vec::new();
+        while let Some(v) = s.next(&mut cursor) {
+            collected.push(v.clone());
+        }
+        let mut a = collected;
+        a.sort();
+        let mut b = vals;
+        b.sort();
+        assert_eq!(a, b, "size {n}");
+    }
+}
+
+#[test]
+fn set_cursor_empty_returns_none_immediately() {
+    let s = Set::new();
+    let mut c = s.cursor();
+    assert!(s.next(&mut c).is_none());
+}
+
+#[test]
+fn set_ord_invariant_to_insertion_order() {
+    let mut a = Set::new();
+    let mut b = Set::new();
+    for i in 0..16_u64 {
+        a.insert(val(i));
+    }
+    for i in (0..16_u64).rev() {
+        b.insert(val(i));
+    }
+    assert_eq!(a.cmp(&b), core::cmp::Ordering::Equal);
+}
+
+fn top_object_rc(v: &Value) -> crate::Rc<Object> {
+    match v {
+        Value::Object(rc) => crate::Rc::clone(rc),
+        other => panic!("expected object, got {other:?}"),
+    }
+}
+
+/// A no-op deep-merge (every incoming key already present with an equal value) must not clone
+/// the target map. `deep_merge` acquires mutable access lazily, so when nothing changes at a
+/// level the shared `Rc` is left untouched.
+#[test]
+fn deep_merge_noop_subset_does_not_clone_object() {
+    let mut a = Value::from_json_str(r#"{"x": {"deep": 1}, "y": 2}"#).unwrap();
+    // Keep a second reference so the map's refcount > 1: eager `make_mut` would clone here.
+    let shared = a.clone();
+    let before = top_object_rc(&a);
+
+    // Strict subset with identical values: no insert, no recurse, no conflict at any level.
+    a.deep_merge(Value::from_json_str(r#"{"y": 2}"#).unwrap())
+        .unwrap();
+
+    let after = top_object_rc(&a);
+    assert!(
+        crate::Rc::ptr_eq(&before, &after),
+        "no-op merge must not clone the shared object map"
+    );
+    assert_eq!(a, shared, "value must be unchanged by a no-op merge");
+}
+
+/// An equal nested object under a shared key is a no-op too — the equality short-circuit runs
+/// before any mutable access, so the map is not cloned.
+#[test]
+fn deep_merge_equal_nested_object_does_not_clone() {
+    let mut a = Value::from_json_str(r#"{"cfg": {"a": 1, "b": 2}, "n": 5}"#).unwrap();
+    let _shared = a.clone();
+    let before = top_object_rc(&a);
+
+    a.deep_merge(Value::from_json_str(r#"{"cfg": {"a": 1, "b": 2}}"#).unwrap())
+        .unwrap();
+
+    let after = top_object_rc(&a);
+    assert!(
+        crate::Rc::ptr_eq(&before, &after),
+        "merging an equal nested object must not clone the map"
+    );
+}
+
+/// A conflict on the first overlapping key is reported without cloning the target map: the
+/// read-only probe detects the conflict before any mutable access is taken.
+#[test]
+fn deep_merge_conflict_does_not_clone_object() {
+    let mut a = Value::from_json_str(r#"{"x": 1, "y": 2}"#).unwrap();
+    let _shared = a.clone();
+    let before = top_object_rc(&a);
+
+    let err = a
+        .deep_merge(Value::from_json_str(r#"{"x": 999}"#).unwrap())
+        .unwrap_err();
+    assert!(format!("{err}").contains("generated multiple times"));
+
+    let after = top_object_rc(&a);
+    assert!(
+        crate::Rc::ptr_eq(&before, &after),
+        "a conflict must not clone the shared object map"
+    );
+}
+
+/// Nest `depth` objects `{"k": {"k": ... leaf}}` iteratively, so building the value can't itself
+/// overflow and there's no parser to cap depth first.
+fn nest(depth: usize, leaf: Value) -> Value {
+    let mut v = leaf;
+    for _ in 0..depth {
+        let mut m = BTreeMap::new();
+        m.insert(Value::from("k"), v);
+        v = Value::from(m);
+    }
+    v
+}
+
+/// Over-deep data must fail with a clean `Err`, not overflow the stack. A `Value` can be built
+/// without serde_json's parse-time cap (the native bindings), so `deep_merge` must guard itself.
+#[test]
+fn deep_merge_rejects_excessive_depth() {
+    let depth = super::MAX_MERGE_DEPTH + 50;
+    // Shared key `k` on both sides forces full-depth recursion; distinct leaves keep the trees
+    // unequal so the equality short-circuit never fires.
+    let mut a = nest(depth, Value::from_json_str(r#"{"a": 1}"#).unwrap());
+    let b = nest(depth, Value::from_json_str(r#"{"b": 2}"#).unwrap());
+
+    let err = a.deep_merge(b).unwrap_err();
+    assert!(
+        format!("{err}").contains("nesting depth"),
+        "expected a depth-limit error, got: {err}"
+    );
+}
+
+/// The pre-scan carries the same guard, so the default build rejects over-deep input up front
+/// (leaving the live document untouched) instead of overflowing during validation.
+#[cfg(not(feature = "allocator-memory-limits"))]
+#[test]
+fn check_mergeable_rejects_excessive_depth() {
+    let depth = super::MAX_MERGE_DEPTH + 50;
+    let a = nest(depth, Value::from_json_str(r#"{"a": 1}"#).unwrap());
+    let b = nest(depth, Value::from_json_str(r#"{"b": 2}"#).unwrap());
+
+    let err = a.check_mergeable(&b).unwrap_err();
+    assert!(
+        format!("{err}").contains("nesting depth"),
+        "expected a depth-limit error, got: {err}"
+    );
+}

tests/interpreter/cases/builtins/numbers/mod.yaml

@@ -62,3 +62,12 @@ cases:
         x = 1 % 1.1
     query: data.test
     error: modulo on floating-point number
+
+  - note: integral float too large to convert
+    data: {}
+    modules:
+      - |
+        package test
+        x = 100000000000000000e-1 % 2
+    query: data.test
+    error: modulo on floating-point number

tests/interpreter/cases/import/tests.yaml

@@ -188,3 +188,435 @@ cases:
         import input
     query: data.test
     want_result: {}
+  - note: function call through import
+    modules:
+      - |
+        package lib
+        import rego.v1
+
+        double(x) := 2 * x
+      - |
+        package rules
+        import rego.v1
+        import data.lib
+
+        result := lib.double(21)
+    query: data.rules.result
+    want_result: 42
+  - note: function call through import alias
+    modules:
+      - |
+        package lib
+        import rego.v1
+
+        double(x) := 2 * x
+      - |
+        package rules
+        import rego.v1
+        import data.lib as l
+
+        result := l.double(21)
+    query: data.rules.result
+    want_result: 42
+  - note: function imported directly
+    modules:
+      - |
+        package lib
+        import rego.v1
+
+        double(x) := 2 * x
+      - |
+        package rules
+        import rego.v1
+        import data.lib.double
+
+        result := double(21)
+    query: data.rules.result
+    want_result: 42
+  - note: function call through import, nested package
+    modules:
+      - |
+        package a.b.c
+        import rego.v1
+
+        double(x) := 2 * x
+      - |
+        package rules
+        import rego.v1
+        import data.a
+
+        result := a.b.c.double(21)
+    query: data.rules.result
+    want_result: 42
+  - note: default function value via import
+    modules:
+      - |
+        package lib
+        import rego.v1
+
+        default pick(_) := "fallback"
+
+        pick(x) := x if x == "a"
+      - |
+        package rules
+        import rego.v1
+        import data.lib
+
+        a := lib.pick("a")
+        b := lib.pick("z")
+    query: data.rules
+    want_result:
+      a: a
+      b: fallback
+  - note: with override applies to function call through import
+    modules:
+      - |
+        package lib
+        import rego.v1
+
+        double(x) := 2 * x
+      - |
+        package lib2
+        import rego.v1
+
+        fake(x) := 1000 + x
+      - |
+        package rules
+        import rego.v1
+        import data.lib
+
+        result := lib.double(5)
+
+        main := x if {
+          x := result with data.lib.double as data.lib2.fake
+        }
+    query: data.rules.main
+    want_result: 1005
+  - note: with override target written through import alias
+    modules:
+      - |
+        package lib
+        import rego.v1
+
+        double(x) := 2 * x
+      - |
+        package lib2
+        import rego.v1
+
+        fake(x) := 1000 + x
+      - |
+        package rules
+        import rego.v1
+        import data.lib
+
+        result := data.lib.double(5)
+
+        main := x if {
+          x := result with lib.double as data.lib2.fake
+        }
+    query: data.rules.main
+    want_result: 1005
+  - note: with override replacement written through import alias
+    modules:
+      - |
+        package lib
+        import rego.v1
+
+        double(x) := 2 * x
+      - |
+        package lib2
+        import rego.v1
+
+        fake(x) := 1000 + x
+      - |
+        package rules
+        import rego.v1
+        import data.lib
+        import data.lib2
+
+        result := data.lib.double(5)
+
+        main := x if {
+          x := result with data.lib.double as lib2.fake
+        }
+    query: data.rules.main
+    want_result: 1005
+  - note: import alias shadows builtin namespace
+    modules:
+      - |
+        package lib
+        import rego.v1
+
+        unmarshal(_) := {"from": "lib"}
+      - |
+        package rules
+        import rego.v1
+        import data.lib as json
+
+        result := json.unmarshal(`[1,2]`)
+    query: data.rules.result
+    want_result:
+      from: lib
+  - note: with override target written through builtin-shadowing alias
+    modules:
+      - |
+        package lib
+        import rego.v1
+
+        unmarshal(_) := {"from": "lib"}
+      - |
+        package lib2
+        import rego.v1
+
+        unmarshal(_) := {"from": "lib2"}
+      - |
+        package rules
+        import rego.v1
+        import data.lib as json
+
+        result := json.unmarshal(`[1]`)
+
+        main := x if {
+          x := result with json.unmarshal as data.lib2.unmarshal
+        }
+    query: data.rules.main
+    want_result:
+      from: lib2
+  - note: with override replacement written through builtin-shadowing alias
+    modules:
+      - |
+        package lib
+        import rego.v1
+
+        double(x) := 2 * x
+      - |
+        package lib2
+        import rego.v1
+
+        unmarshal(_) := {"from": "lib2"}
+      - |
+        package rules
+        import rego.v1
+        import data.lib
+        import data.lib2 as json
+
+        result := lib.double(5)
+
+        main := x if {
+          x := result with data.lib.double as json.unmarshal
+        }
+    query: data.rules.main
+    want_result:
+      from: lib2
+  - note: with override target aliasing a non-function rule overrides the value
+    modules:
+      - |
+        package flib
+        import rego.v1
+
+        default flag := false
+
+        flag := true if input.x == 1
+      - |
+        package rules
+        import rego.v1
+        import data.flib as fl
+
+        result := data.flib.flag
+
+        main := x if {
+          x := result with fl.flag as 5
+        }
+    query: data.rules.main
+    want_result: 5
+  - note: import shadows module-local rule for function calls
+    modules:
+      - |
+        package lib
+        import rego.v1
+
+        double(x) := 2 * x
+      - |
+        package rules
+        import rego.v1
+        import data.lib
+
+        lib.double(x) := 100 * x
+
+        main := lib.double(3)
+    query: data.rules.main
+    want_result: 6
+  - note: import shadows module-local value rule for function calls
+    modules:
+      - |
+        package lib
+        import rego.v1
+
+        double(x) := 2 * x
+      - |
+        package rules
+        import rego.v1
+        import data.lib
+
+        lib.double := 7
+
+        main := lib.double(3)
+    query: data.rules.main
+    want_result: 6
+  - note: fully qualified function call with import present
+    modules:
+      - |
+        package lib
+        import rego.v1
+
+        double(x) := 2 * x
+      - |
+        package rules
+        import rego.v1
+        import data.lib
+
+        result := data.lib.double(21)
+    query: data.rules.result
+    want_result: 42
+  - note: unknown function through import is an error
+    modules:
+      - |
+        package lib
+        import rego.v1
+
+        double(x) := 2 * x
+      - |
+        package rules
+        import rego.v1
+        import data.lib
+
+        result := lib.missing(1)
+    query: data.rules.result
+    error: could not find function
+  - note: function call in module without imports
+    modules:
+      - |
+        package rules
+
+        double(x) := 2 * x
+
+        result := double(21)
+    query: data.rules.result
+    want_result: 42
+  - note: call to non-function value rule through import is an error
+    modules:
+      - |
+        package lib
+        import rego.v1
+
+        x := 5
+      - |
+        package rules
+        import rego.v1
+        import data.lib
+
+        result := lib.x(1)
+    query: data.rules.result
+    error: could not find function
+  - note: call to rule path prefix through import is an error
+    modules:
+      - |
+        package lib
+        import rego.v1
+
+        a.c := 9
+      - |
+        package rules
+        import rego.v1
+        import data.lib
+
+        result := lib.a(7)
+    query: data.rules.result
+    error: could not find function
+  - note: call to prefix of default function through import is an error
+    modules:
+      - |
+        package lib
+        import rego.v1
+
+        default a.b(_) := 1
+
+        a.b(x) := x * 2 if x > 10
+      - |
+        package rules
+        import rego.v1
+        import data.lib
+
+        result := lib.a(7)
+    query: data.rules.result
+    error: could not find function
+  - note: default-only function call through import
+    modules:
+      - |
+        package lib
+        import rego.v1
+
+        default dfl(_) := 42
+      - |
+        package rules
+        import rego.v1
+        import data.lib
+
+        result := lib.dfl(5)
+    query: data.rules.result
+    want_result: 42
+  - note: overload error does not leak callee module imports
+    strict: false
+    modules:
+      - |
+        package libx
+        import rego.v1
+
+        h(_) := "WRONG"
+      - |
+        package liby
+        import rego.v1
+
+        h(_) := "RIGHT"
+      - |
+        package lib
+        import rego.v1
+        import data.libx as ali
+
+        m(_) := 1
+
+        m(_) := 2
+
+        f(x) := 100 if x == 1
+
+        f(x) := y if {
+          x == 1
+          y := m(1)
+        }
+      - |
+        package rules
+        import rego.v1
+        import data.lib
+        import data.liby as ali
+
+        main := [v, w] if {
+          v := lib.f(1)
+          w := ali.h(1)
+        }
+    query: data.rules.main
+    want_result: [100, "RIGHT"]
+  - note: with target through dotted bracket key import
+    data:
+      "a.b":
+        x: 1
+    modules:
+      - |
+        package rules
+        import rego.v1
+        import data["a.b"] as ab
+
+        main := x if {
+          x := data["a.b"].x with ab.x as 2
+        }
+    query: data.rules.main
+    want_result: 2

tests/interpreter/cases/refr/keywords_in_refs.yaml

@@ -0,0 +1,268 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+#
+# Tests for keywords-as-field-names in dot-notation refs.
+# Matches OPA's `keywords_in_refs` behavior, enabled by default.
+cases:
+  - note: keywords_in_refs/package field
+    modules:
+      - |
+        package test
+        allow if {
+          input.v0.package.format == "npm"
+        }
+    input:
+      v0:
+        package:
+          format: npm
+    query: data.test.allow
+    want_result: true
+
+  - note: keywords_in_refs/as field
+    modules:
+      - |
+        package test
+        x = input.as.type
+    input:
+      as:
+        type: string
+    query: data.test.x
+    want_result: string
+
+  - note: keywords_in_refs/default field
+    modules:
+      - |
+        package test
+        x = input.default.value
+    input:
+      default:
+        value: 42
+    query: data.test.x
+    want_result: 42
+
+  - note: keywords_in_refs/else field
+    modules:
+      - |
+        package test
+        x = input.else.value
+    input:
+      else:
+        value: hello
+    query: data.test.x
+    want_result: hello
+
+  - note: keywords_in_refs/import field
+    modules:
+      - |
+        package test
+        x = input.import.name
+    input:
+      import:
+        name: foo
+    query: data.test.x
+    want_result: foo
+
+  - note: keywords_in_refs/not field
+    modules:
+      - |
+        package test
+        x = input.not.allowed
+    input:
+      not:
+        allowed: false
+    query: data.test.x
+    want_result: false
+
+  - note: keywords_in_refs/null field
+    modules:
+      - |
+        package test
+        x = input.null.value
+    input:
+      "null":
+        value: 1
+    query: data.test.x
+    want_result: 1
+
+  - note: keywords_in_refs/some field
+    modules:
+      - |
+        package test
+        x = input.some.field
+    input:
+      some:
+        field: bar
+    query: data.test.x
+    want_result: bar
+
+  - note: keywords_in_refs/true field
+    modules:
+      - |
+        package test
+        x = input.true.x
+    input:
+      "true":
+        x: 2
+    query: data.test.x
+    want_result: 2
+
+  - note: keywords_in_refs/false field
+    modules:
+      - |
+        package test
+        x = input.false.x
+    input:
+      "false":
+        x: 3
+    query: data.test.x
+    want_result: 3
+
+  - note: keywords_in_refs/with field
+    modules:
+      - |
+        package test
+        x = input.with.config
+    input:
+      with:
+        config: test
+    query: data.test.x
+    want_result: test
+
+  - note: keywords_in_refs/future keywords (if, in, every, contains)
+    modules:
+      - |
+        package test
+        import future.keywords
+        x if {
+          input.if.condition == true
+          input.in.set == "member"
+          input.every.item == "x"
+          input.contains.key == "val"
+        }
+    input:
+      if:
+        condition: true
+      in:
+        set: member
+      every:
+        item: x
+      contains:
+        key: val
+    query: data.test.x
+    want_result: true
+
+  - note: keywords_in_refs/chained keywords
+    modules:
+      - |
+        package test
+        x = input.package.import.default
+    input:
+      package:
+        import:
+          default: chained
+    query: data.test.x
+    want_result: chained
+
+  - note: keywords_in_refs/data path with keyword
+    modules:
+      - |
+        package test
+        x = data.mydata.package.name
+    data:
+      mydata:
+        package:
+          name: mypackage
+    query: data.test.x
+    want_result: mypackage
+
+  - note: keywords_in_refs/rego v1 all keywords
+    modules:
+      - |
+        package test
+        import rego.v1
+        allow if {
+          input.package.format == "npm"
+          input.default.value == 1
+          input.if.enabled == true
+          input.in.set == "member"
+          input.not.flag == false
+          input.with.config == "ok"
+        }
+    input:
+      package:
+        format: npm
+      default:
+        value: 1
+      if:
+        enabled: true
+      in:
+        set: member
+      not:
+        flag: false
+      with:
+        config: ok
+    query: data.test.allow
+    want_result: true
+
+  - note: keywords_in_refs/future keywords without import
+    modules:
+      - |
+        package test
+        x = [input.if.flag, input.in.value, input.every.item, input.contains.key]
+    input:
+      if:
+        flag: true
+      in:
+        value: member
+      every:
+        item: each
+      contains:
+        key: present
+    query: data.test.x
+    want_result: [true, "member", "each", "present"]
+
+  - note: keywords_in_refs/package path keywords
+    modules:
+      - |
+        package words.if.default
+        value = 7
+      - |
+        package test
+        x = data.words.if.default.value
+    query: data.test.x
+    want_result: 7
+
+  - note: keywords_in_refs/import path keywords
+    modules:
+      - |
+        package test
+        import data.catalog.if.default as kw
+        x = kw.value
+    data:
+      catalog:
+        if:
+          default:
+            value: 99
+    query: data.test.x
+    want_result: 99
+
+  - note: keywords_in_refs/rule head keyword path
+    modules:
+      - |
+        package test
+        policy.default.level := 3
+    query: data.test.policy.default.level
+    want_result: 3
+
+  - note: keywords_in_refs/mixed dot keyword and dynamic bracket
+    modules:
+      - |
+        package test
+        x = input.package[segment].value
+        segment = "import"
+    input:
+      package:
+        import:
+          value: from_dynamic
+    query: data.test.x
+    want_result: from_dynamic

tests/interpreter/cases/rule/multiple_outputs.yaml

@@ -0,0 +1,223 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+
+# How multiple rule definitions writing to the same path combine vs. conflict.
+# Cross-checked against OPA v1.2.0 (`opa eval`); modules use `rego.v1` to match it.
+#
+#   * Zero-arg `f()` materializes as a COMPLETE document: any two differing outputs
+#     conflict, even disjoint objects (OPA does NOT deep-merge).
+#   * Partial-object `p[k]` and ref-head `p.q.r` COMBINE across disjoint keys/paths,
+#     but conflict on the same key/leaf with a different value (no deep-merge).
+#   * Equal re-definitions (same value twice) are tolerated in every family.
+
+cases:
+  # ----------------------------------------------------------------------------
+  # Zero-arg functions: materialize as a complete document.
+  # ----------------------------------------------------------------------------
+  - note: fn_single_output
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+
+        f() := {"a": 1}
+    query: data.test.f
+    want_result:
+      a: 1
+
+  - note: fn_identical_outputs_tolerated
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+
+        f() := {"a": 1}
+
+        f() := {"a": 1}
+    query: data.test.f
+    want_result:
+      a: 1
+
+  - note: fn_toplevel_disjoint_conflict
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+
+        f() := {"a": 1}
+
+        f() := {"b": 2}
+    query: data.test.f
+    error: "rules should not produce multiple outputs"
+
+  - note: fn_nested_object_conflict_no_deep_merge
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+
+        f() := {"a": {"x": 1}}
+
+        f() := {"a": {"y": 2}}
+    query: data.test.f
+    error: "rules should not produce multiple outputs"
+
+  # ----------------------------------------------------------------------------
+  # Partial-object rules with static keys: combine across disjoint keys.
+  # ----------------------------------------------------------------------------
+  - note: partial_object_disjoint_keys_combine
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+
+        p["a"] := 1
+
+        p["b"] := 2
+    query: data.test.p
+    want_result:
+      a: 1
+      b: 2
+
+  - note: partial_object_same_key_same_value_tolerated
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+
+        p["a"] := 1
+
+        p["a"] := 1
+    query: data.test.p
+    want_result:
+      a: 1
+
+  - note: partial_object_same_key_diff_scalar_conflict
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+
+        p["a"] := 1
+
+        p["a"] := 2
+    query: data.test.p
+    error: "rule conflicts with the following rule"
+
+  - note: partial_object_same_key_object_values_conflict_no_deep_merge
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+
+        p["a"] := {"x": 1}
+
+        p["a"] := {"y": 2}
+    query: data.test.p
+    error: "rule conflicts with the following rule"
+
+  # ----------------------------------------------------------------------------
+  # Ref-head rules: combine across disjoint sub-paths.
+  # ----------------------------------------------------------------------------
+  - note: refhead_disjoint_subpaths_combine
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+
+        p.q.r := 1
+
+        p.q.s := 2
+    query: data.test.p
+    want_result:
+      q:
+        r: 1
+        s: 2
+
+  - note: refhead_same_leaf_diff_value_conflict
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+
+        p.q.r := 1
+
+        p.q.r := 2
+    query: data.test.p
+    error: "rule conflicts with the following rule"
+
+  - note: refhead_same_node_object_values_conflict_no_deep_merge
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+
+        p.q := {"r": 1}
+
+        p.q := {"s": 2}
+    query: data.test.p
+    error: "rule conflicts with the following rule"
+
+  # ----------------------------------------------------------------------------
+  # Dynamic partial objects (keys computed at eval time).
+  # ----------------------------------------------------------------------------
+  - note: dynamic_partial_disjoint_keys_combine
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+
+        m := {"a": 1, "b": 2}
+
+        p[k] := v if {
+          some k, v in m
+        }
+    query: data.test.p
+    want_result:
+      a: 1
+      b: 2
+
+  - note: dynamic_partial_same_key_same_value_tolerated
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+
+        vals := [7, 7]
+
+        p[k] := v if {
+          some v in vals
+          k := "a"
+        }
+    query: data.test.p
+    want_result:
+      a: 7
+
+  - note: dynamic_partial_same_key_diff_value_conflict
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+
+        vals := [1, 2]
+
+        p[k] := v if {
+          some v in vals
+          k := "a"
+        }
+    query: data.test.p
+    error: "rules must not produce multiple outputs"

tests/memory_limits.rs

@@ -185,3 +185,75 @@ fn vm_memory_limit_during_large_allocation() {
         Ok(value) => panic!("expected VM memory limit error, got value {value:?}"),
     }
 }
+
+/// On the `allocator-memory-limits` build, an `add_data` whose merge trips the memory limit
+/// mid-way must leave the data document unchanged — no partial insertions may leak. Atomicity
+/// here relies on the candidate-copy commit (`check_mergeable` models conflicts, not limits).
+#[test]
+fn add_data_memory_limit_partial_merge_is_atomic() {
+    let mut guard = LimitGuard::lock();
+    let mut engine = Engine::new();
+
+    // Seed existing data while the limit is relaxed.
+    engine
+        .add_data(Value::from_json_str(r#"{ "a": { "existing": 1 } }"#).expect("valid JSON"))
+        .expect("seed add_data");
+
+    // Merge `{ "a": { "k0": 0, ... } }` into `a` as pure insertions. The count is sized to
+    // beat the limit check's throttling — a check only fires every MEMORY_CHECK_STRIDE (16)
+    // insertions or per MEMORY_CHECK_DELTA_BYTES (32 KiB), and mimalloc's usage snapshot lags
+    // small allocations — so the trip lands mid-merge rather than after it completes.
+    let elements = 20_000;
+    let mut payload = String::with_capacity(elements * 16);
+    payload.push_str("{\"a\":{");
+    for i in 0..elements {
+        if i > 0 {
+            payload.push(',');
+        }
+        payload.push_str("\"k");
+        payload.push_str(&i.to_string());
+        payload.push_str("\":");
+        payload.push_str(&i.to_string());
+    }
+    payload.push_str("}}");
+    let big = Value::from_json_str(&payload).expect("valid JSON");
+
+    // What the engine must still hold if the add is rejected.
+    let pristine = Value::from_json_str(r#"{ "a": { "existing": 1 } }"#).expect("valid JSON");
+
+    // Budget 0: the merge's insertions trip the limit mid-way.
+    guard.set_with_additional_budget(0);
+
+    let err = engine
+        .add_data(big)
+        .expect_err("expected memory limit error during add_data merge");
+    assert_memory_limit_error(&err);
+
+    // Atomicity: the rejected add must leave data untouched — no `k*` keys leaked.
+    assert_eq!(engine.get_data(), pristine);
+}
+
+/// Companion for the candidate-copy build: a *conflict* must also be atomic (the candidate is
+/// discarded before commit). Default-build conflict atomicity is covered in
+/// `src/tests/interpreter/mod.rs`; this exercises the distinct candidate-copy branch.
+#[test]
+fn add_data_conflict_is_atomic_on_allocator_build() {
+    // Hold the lock (no budget set) so the conflict — not a limit — is the sole failure.
+    let _guard = LimitGuard::lock();
+    let mut engine = Engine::new();
+
+    engine
+        .add_data(Value::from_json_str(r#"{ "a": { "z": 1 } }"#).expect("valid JSON"))
+        .expect("seed add_data");
+
+    // `m` sorts before `z`, so a naive in-place merge inserts `m` then hits the `z` conflict
+    // (1 vs 3). The whole call must be rejected with `m` left out.
+    assert!(engine
+        .add_data(Value::from_json_str(r#"{ "a": { "m": 2, "z": 3 } }"#).expect("valid JSON"))
+        .is_err());
+
+    assert_eq!(
+        engine.get_data(),
+        Value::from_json_str(r#"{ "a": { "z": 1 } }"#).expect("valid JSON")
+    );
+}

tests/opa.rs

@@ -26,7 +26,6 @@ const OPA_TODO_FOLDERS: &[&str] = &[
     "baseandvirtualdocs",
     "dataderef",
     "defaultkeyword",
-    "every",
     "fix1863",
     "functions",
     "partialdocconstants",
@@ -102,6 +101,20 @@ fn log_rvm_skip(case_note: &str, folder_name: Option<&str>) {
     }
 }
 
+/// Allows temporarily enabling RVM verification for folders otherwise listed in
+/// `OPA_TODO_FOLDERS`, without editing the source. Set `OPA_UNSKIP_FOLDERS` to a
+/// comma-separated list of folder names (e.g. `every,functions`) or `all`.
+/// Intended for auditing latent RVM bugs in currently-skipped constructs.
+fn folder_rvm_unskipped(folder: &str) -> bool {
+    match std::env::var("OPA_UNSKIP_FOLDERS") {
+        Ok(list) => {
+            let list = list.trim();
+            list.eq_ignore_ascii_case("all") || list.split(',').any(|f| f.trim() == folder)
+        }
+        Err(_) => false,
+    }
+}
+
 fn setup_engine_for_case(case: &TestCase, is_rego_v0_test: bool) -> Result<EngineSetup> {
     let mut engine = Engine::new();
 
@@ -388,7 +401,7 @@ fn run_opa_tests(opa_tests_dir: String, folders: &[String]) -> Result<()> {
         let folder_name = folder_name_from_path(path_dir);
         let skip_rvm_for_folder = folder_name
             .as_deref()
-            .map(|folder| OPA_TODO_FOLDERS.contains(&folder))
+            .map(|folder| OPA_TODO_FOLDERS.contains(&folder) && !folder_rvm_unskipped(folder))
             .unwrap_or(false);
 
         if path.is_dir() {

tests/rvm/rego/cases/chained_access.yaml

@@ -315,3 +315,109 @@ cases:
         }
     query: data.test.main
     want_result: "/api/v1/users"
+
+  - note: keywords_in_refs/package_field
+    data: {}
+    input:
+      v0:
+        package:
+          format: npm
+    modules:
+      - |
+        package test
+        allow := true if {
+          input.v0.package.format == "npm"
+        }
+    query: data.test.allow
+    want_result: true
+
+  - note: keywords_in_refs/multiple_keywords
+    data: {}
+    input:
+      default:
+        value: 42
+      import:
+        name: foo
+      not:
+        allowed: false
+      with:
+        config: ok
+    modules:
+      - |
+        package test
+        import rego.v1
+        result if {
+          input.default.value == 42
+          input.import.name == "foo"
+          input.not.allowed == false
+          input.with.config == "ok"
+        }
+    query: data.test.result
+    want_result: true
+
+  - note: keywords_in_refs/future_keywords_without_import
+    data: {}
+    input:
+      if:
+        flag: true
+      in:
+        value: member
+      every:
+        item: each
+      contains:
+        key: present
+    modules:
+      - |
+        package test
+        result := [input.if.flag, input.in.value, input.every.item, input.contains.key]
+    query: data.test.result
+    want_result: [true, "member", "each", "present"]
+
+  - note: keywords_in_refs/package_path_keywords
+    data: {}
+    modules:
+      - |
+        package words.if.default
+        value := 7
+      - |
+        package test
+        result := data.words.if.default.value
+    query: data.test.result
+    want_result: 7
+
+  - note: keywords_in_refs/import_path_keywords
+    data:
+      catalog:
+        if:
+          default:
+            value: 99
+    modules:
+      - |
+        package test
+        import data.catalog.if.default as kw
+        result := kw.value
+    query: data.test.result
+    want_result: 99
+
+  - note: keywords_in_refs/rule_head_keyword_path
+    data: {}
+    modules:
+      - |
+        package test
+        policy.default.level := 3
+    query: data.test.policy.default.level
+    want_result: 3
+
+  - note: keywords_in_refs/mixed_dot_keyword_and_dynamic_bracket
+    data: {}
+    input:
+      package:
+        import:
+          value: from_dynamic
+    modules:
+      - |
+        package test
+        segment := "import"
+        result := input.package[segment].value
+    query: data.test.result
+    want_result: "from_dynamic"

tests/rvm/rego/cases/imports.yaml

@@ -95,3 +95,204 @@ cases:
         }
     query: data.rules.present
     want_result: true
+  - note: import_function_call
+    modules:
+      - |
+        package lib
+        import rego.v1
+
+        double(x) := 2 * x
+      - |
+        package rules
+        import data.lib
+        import rego.v1
+
+        result := lib.double(21)
+    query: data.rules.result
+    want_result: 42
+  - note: import_function_call_alias
+    modules:
+      - |
+        package lib
+        import rego.v1
+
+        double(x) := 2 * x
+      - |
+        package rules
+        import data.lib as mylib
+        import rego.v1
+
+        result := mylib.double(21)
+    query: data.rules.result
+    want_result: 42
+  - note: import_function_directly
+    modules:
+      - |
+        package lib
+        import rego.v1
+
+        double(x) := 2 * x
+      - |
+        package rules
+        import data.lib.double
+        import rego.v1
+
+        result := double(21)
+    query: data.rules.result
+    want_result: 42
+  - note: import_function_call_nested_package
+    modules:
+      - |
+        package a.b.c
+        import rego.v1
+
+        double(x) := 2 * x
+      - |
+        package rules
+        import data.a
+        import rego.v1
+
+        result := a.b.c.double(21)
+    query: data.rules.result
+    want_result: 42
+  - note: import_alias_shadows_builtin_namespace
+    modules:
+      - |
+        package lib
+        import rego.v1
+
+        unmarshal(_) := {"from": "lib"}
+      - |
+        package rules
+        import rego.v1
+        import data.lib as json
+
+        result := json.unmarshal(`[1,2]`)
+    query: data.rules.result
+    want_result:
+      from: lib
+  - note: default_function_value_via_import
+    skip: true  # TODO: cross-package calls to functions with default values fail to compile ("not a valid rule path"), even with fully-qualified paths
+    modules:
+      - |
+        package lib
+        import rego.v1
+
+        default pick(_) := "fallback"
+
+        pick(x) := x if x == "a"
+      - |
+        package rules
+        import rego.v1
+        import data.lib
+
+        a := lib.pick("a")
+        b := lib.pick("z")
+    query: data.rules
+    want_result:
+      a: a
+      b: fallback
+  - note: import_shadows_module_local_rule_for_function_calls
+    modules:
+      - |
+        package lib
+        import rego.v1
+
+        double(x) := 2 * x
+      - |
+        package rules
+        import rego.v1
+        import data.lib
+
+        lib.double(x) := 100 * x
+
+        main := lib.double(3)
+    query: data.rules.main
+    want_result: 6
+  - note: import_shadows_module_local_value_rule_for_function_calls
+    modules:
+      - |
+        package lib
+        import rego.v1
+
+        double(x) := 2 * x
+      - |
+        package rules
+        import rego.v1
+        import data.lib
+
+        lib.double := 7
+
+        main := lib.double(3)
+    query: data.rules.main
+    want_result: 6
+  - note: import_fully_qualified_function_call
+    modules:
+      - |
+        package lib
+        import rego.v1
+
+        double(x) := 2 * x
+      - |
+        package rules
+        import rego.v1
+        import data.lib
+
+        result := data.lib.double(21)
+    query: data.rules.result
+    want_result: 42
+  - note: unknown_function_through_import
+    modules:
+      - |
+        package lib
+        import rego.v1
+
+        double(x) := 2 * x
+      - |
+        package rules
+        import rego.v1
+        import data.lib
+
+        result := lib.missing(1)
+    query: data.rules.result
+    want_error: "Unknown function"
+  - note: function_call_without_imports
+    modules:
+      - |
+        package rules
+
+        double(x) := 2 * x
+
+        result := double(21)
+    query: data.rules.result
+    want_result: 42
+  - note: non_function_value_rule_through_import
+    modules:
+      - |
+        package lib
+        import rego.v1
+
+        x := 5
+      - |
+        package rules
+        import rego.v1
+        import data.lib
+
+        result := lib.x(1)
+    query: data.rules.result
+    want_error: "Unknown function"
+  - note: rule_path_prefix_through_import
+    modules:
+      - |
+        package lib
+        import rego.v1
+
+        a.c := 9
+      - |
+        package rules
+        import rego.v1
+        import data.lib
+
+        result := lib.a(7)
+    query: data.rules.result
+    want_error: "Unknown function"

tests/rvm/rego/cases/loops_and_quantifiers.yaml

@@ -44,6 +44,295 @@ cases:
     query: data.test.main
     want_result: true
 
+  - note: every_body_fails_for_one_element
+    data: {}
+    modules:
+      - |
+        package test
+        main := result if {
+          every x in [1, 2, 3] {
+            x > 1
+          }
+          result := true
+        }
+    query: data.test.main
+    want_result: "#undefined"
+
+  - note: every_body_fails_for_all_elements
+    data: {}
+    modules:
+      - |
+        package test
+        main := result if {
+          every x in [1, 2, 3] {
+            x > 100
+          }
+          result := true
+        }
+    query: data.test.main
+    want_result: "#undefined"
+
+  - note: every_used_directly_as_condition_false
+    data: {}
+    modules:
+      - |
+        package test
+        allowed if {
+          every x in [1, 2, 3] {
+            x > 1
+          }
+        }
+        main := allowed
+    query: data.test.main
+    want_result: "#undefined"
+
+  - note: every_used_directly_as_condition_true
+    data: {}
+    modules:
+      - |
+        package test
+        allowed if {
+          every x in [1, 2, 3] {
+            x > 0
+          }
+        }
+        main := allowed
+    query: data.test.main
+    want_result: true
+
+  - note: every_over_non_iterable_number_is_undefined
+    data: {}
+    modules:
+      - |
+        package test
+        allowed if {
+          every x in 42 {
+            x > 1
+          }
+        }
+        main := allowed
+    query: data.test.main
+    want_result: "#undefined"
+
+  - note: every_over_non_iterable_string_is_undefined
+    data: {}
+    modules:
+      - |
+        package test
+        allowed if {
+          every x in "hello" {
+            x == x
+          }
+        }
+        main := allowed
+    query: data.test.main
+    want_result: "#undefined"
+
+  - note: every_over_empty_array_is_vacuously_true
+    data: {}
+    modules:
+      - |
+        package test
+        allowed if {
+          every x in [] {
+            x > 1
+          }
+        }
+        main := allowed
+    query: data.test.main
+    want_result: true
+
+  - note: every_with_inner_some_matching_nothing_fails
+    data: {}
+    modules:
+      - |
+        package test
+        allowed if {
+          every c in [1, 2] {
+            some x in []
+            c == x
+          }
+        }
+        main := allowed
+    query: data.test.main
+    want_result: "#undefined"
+
+  - note: every_with_inner_some_matching_succeeds
+    data: {}
+    modules:
+      - |
+        package test
+        allowed if {
+          every c in [1, 2] {
+            some x in [1, 2, 3]
+            c == x
+          }
+        }
+        main := allowed
+    query: data.test.main
+    want_result: true
+
+  - note: every_with_hoisted_index_matching_nothing_fails
+    data: {}
+    modules:
+      - |
+        package test
+        allowed if {
+          every c in [1] {
+            some i
+            [2, 3][i] == c
+          }
+        }
+        main := allowed
+    query: data.test.main
+    want_result: "#undefined"
+
+  - note: every_with_hoisted_index_matching_succeeds
+    data: {}
+    modules:
+      - |
+        package test
+        allowed if {
+          every c in [2, 3] {
+            some i
+            [1, 2, 3][i] == c
+          }
+        }
+        main := allowed
+    query: data.test.main
+    want_result: true
+
+  - note: every_keyval_over_object_succeeds
+    data: {}
+    modules:
+      - |
+        package test
+        allowed if {
+          every k, v in {"a": 1, "b": 2} {
+            v > 0
+          }
+        }
+        main := allowed
+    query: data.test.main
+    want_result: true
+
+  - note: every_keyval_over_object_fails
+    data: {}
+    modules:
+      - |
+        package test
+        allowed if {
+          every k, v in {"a": 1, "b": 2} {
+            v > 1
+          }
+        }
+        main := allowed
+    query: data.test.main
+    want_result: "#undefined"
+
+  - note: every_over_set_domain_succeeds
+    data: {}
+    modules:
+      - |
+        package test
+        allowed if {
+          every x in {1, 2, 3} {
+            x > 0
+          }
+        }
+        main := allowed
+    query: data.test.main
+    want_result: true
+
+  - note: every_over_empty_object_is_vacuously_true
+    data: {}
+    modules:
+      - |
+        package test
+        allowed if {
+          every k, v in {} {
+            v > 1
+          }
+        }
+        main := allowed
+    query: data.test.main
+    want_result: true
+
+  - note: every_over_empty_set_is_vacuously_true
+    data: {}
+    modules:
+      - |
+        package test
+        allowed if {
+          every x in set() {
+            x > 1
+          }
+        }
+        main := allowed
+    query: data.test.main
+    want_result: true
+
+  - note: every_over_undefined_domain_is_undefined
+    data: {}
+    modules:
+      - |
+        package test
+        allowed if {
+          every x in input.missing {
+            x > 0
+          }
+        }
+        main := allowed
+    query: data.test.main
+    want_result: "#undefined"
+
+  - note: every_nested_inside_every_succeeds
+    data: {}
+    modules:
+      - |
+        package test
+        allowed if {
+          every row in [[1, 2], [3, 4]] {
+            every c in row {
+              c > 0
+            }
+          }
+        }
+        main := allowed
+    query: data.test.main
+    want_result: true
+
+  - note: every_nested_inside_every_fails
+    data: {}
+    modules:
+      - |
+        package test
+        allowed if {
+          every row in [[1, 2], [3, 0]] {
+            every c in row {
+              c > 0
+            }
+          }
+        }
+        main := allowed
+    query: data.test.main
+    want_result: "#undefined"
+
+  - note: every_with_outer_binding
+    data: {}
+    modules:
+      - |
+        package test
+        allowed if {
+          threshold := 5
+          every x in [6, 7, 8] {
+            x > threshold
+          }
+        }
+        main := allowed
+    query: data.test.main
+    want_result: true
+
   - note: simple_loop_test
     data: {}
     modules:

tests/rvm/rego/cases/registered_host_await.yaml

@@ -0,0 +1,610 @@
+cases:
+  - note: registered_builtin_suspendable
+    data: {}
+    input:
+      account_id: "acct-42"
+    skip_interpreter: true
+    execution_mode: suspendable
+    host_await_builtins:
+      - name: get_account
+        arg_count: 1
+    modules:
+      - |
+        package demo
+        import rego.v1
+
+        allow if {
+          account := get_account({"id": input.account_id})
+          account.status == "active"
+        }
+    query: data.demo.allow
+    host_await_responses_suspendable:
+      - id: "get_account"
+        args:
+          id: "acct-42"
+        value:
+          status: "active"
+          name: "Alice"
+    want_result: true
+
+  - note: registered_builtin_run_to_completion
+    data: {}
+    input:
+      lang: "es"
+    skip_interpreter: true
+    execution_mode: run-to-completion
+    host_await_builtins:
+      - name: translate
+        arg_count: 1
+    modules:
+      - |
+        package demo
+        import rego.v1
+
+        greeting := msg if {
+          msg := translate(input.lang)
+        }
+    query: data.demo.greeting
+    host_await_responses:
+      - id: "translate"
+        value: "hola"
+    want_result: "hola"
+
+  - note: registered_builtin_run_to_completion_rejects_args
+    data: {}
+    input:
+      lang: "es"
+    skip_interpreter: true
+    execution_mode: run-to-completion
+    # `args:` payload validation is only meaningful in suspendable mode, where
+    # the harness sees each call's argument. In run-to-completion mode the VM
+    # consumes pre-loaded responses internally, so an `args:` expectation can
+    # never be checked. Rather than silently ignore it (which would let a case
+    # "assert" a payload that is never verified), the harness rejects it.
+    host_await_builtins:
+      - name: translate
+        arg_count: 1
+    modules:
+      - |
+        package demo
+        import rego.v1
+
+        greeting := msg if {
+          msg := translate(input.lang)
+        }
+    query: data.demo.greeting
+    host_await_responses:
+      - id: "translate"
+        args: "es"
+        value: "hola"
+    want_error: "not supported in run-to-completion mode"
+
+  - note: registered_builtin_multiple_names
+    data: {}
+    input:
+      user_id: "user-7"
+    skip_interpreter: true
+    execution_mode: suspendable
+    host_await_builtins:
+      - name: lookup
+        arg_count: 1
+      - name: persist
+        arg_count: 1
+    modules:
+      - |
+        package demo
+        import rego.v1
+
+        result := {"data": fetched, "stored": saved} if {
+          fetched := lookup(input.user_id)
+          saved := persist({"id": input.user_id, "action": "audit"})
+        }
+    query: data.demo.result
+    host_await_responses_suspendable:
+      - id: "lookup"
+        args: "user-7"
+        value:
+          name: "Charlie"
+      - id: "persist"
+        args:
+          id: "user-7"
+          action: "audit"
+        value: true
+    want_result:
+      data:
+        name: "Charlie"
+      stored: true
+
+  - note: registered_builtin_suspendable_queue
+    data: {}
+    input:
+      items: ["alpha", "beta", "gamma"]
+    skip_interpreter: true
+    execution_mode: suspendable
+    host_await_builtins:
+      - name: enrich
+        arg_count: 1
+    modules:
+      - |
+        package demo
+        import rego.v1
+
+        results := [r |
+          item := input.items[_]
+          r := enrich(item)
+        ]
+    query: data.demo.results
+    host_await_responses_suspendable:
+      - id: "enrich"
+        args: "alpha"
+        value: "enriched-alpha"
+      - id: "enrich"
+        args: "beta"
+        value: "enriched-beta"
+      - id: "enrich"
+        args: "gamma"
+        value: "enriched-gamma"
+    want_result: ["enriched-alpha", "enriched-beta", "enriched-gamma"]
+
+  - note: registered_builtin_shadows_user_function
+    data: {}
+    input:
+      key: "test-key"
+    skip_interpreter: true
+    execution_mode: suspendable
+    host_await_builtins:
+      - name: resolve
+        arg_count: 1
+    modules:
+      - |
+        package demo
+        import rego.v1
+
+        # This user-defined function should be shadowed by the registered builtin
+        resolve(x) := {"local": true, "key": x}
+
+        result := resolve(input.key)
+    query: data.demo.result
+    host_await_responses_suspendable:
+      - id: "resolve"
+        args: "test-key"
+        value: "from-host"
+    # The registered builtin takes precedence — result is the host response, not the user function
+    want_result: "from-host"
+
+  - note: registered_builtin_multi_arg_object_packing
+    data: {}
+    input:
+      user: "alice"
+      resource: "/api/data"
+    skip_interpreter: true
+    execution_mode: suspendable
+    host_await_builtins:
+      - name: check_access
+        arg_count: 1
+    modules:
+      - |
+        package demo
+        import rego.v1
+
+        # Multi-value calls pack arguments into a single object
+        allowed if {
+          result := check_access({"user": input.user, "resource": input.resource})
+          result.granted == true
+        }
+    query: data.demo.allowed
+    host_await_responses_suspendable:
+      - id: "check_access"
+        args:
+          user: "alice"
+          resource: "/api/data"
+        value:
+          granted: true
+          reason: "admin"
+    want_result: true
+
+  - note: registered_builtin_rejects_arg_count_greater_than_one
+    data: {}
+    input:
+      key: "k1"
+      value: "v1"
+    skip_interpreter: true
+    execution_mode: suspendable
+    host_await_builtins:
+      - name: kv_store
+        arg_count: 2
+    modules:
+      - |
+        package demo
+        import rego.v1
+
+        result := kv_store(input.key, input.value)
+    query: data.demo.result
+    # Registration fails with an error because arg_count must be 1.
+    # Use object packing instead: kv_store({"key": input.key, "value": input.value})
+    want_error: "arg_count == 1"
+
+  - note: registered_builtin_overrides_standard_builtin
+    data: {}
+    input:
+      duration: "2h30m"
+    skip_interpreter: true
+    execution_mode: suspendable
+    host_await_builtins:
+      - name: time.parse_duration_ns
+        arg_count: 1
+    modules:
+      - |
+        package demo
+        import rego.v1
+
+        # time.parse_duration_ns is a standard Rego builtin (1 arg, returns nanoseconds).
+        # Registering it as a host-await builtin shadows the standard implementation.
+        duration_ns := time.parse_duration_ns(input.duration)
+    query: data.demo.duration_ns
+    host_await_responses_suspendable:
+      - id: "time.parse_duration_ns"
+        args: "2h30m"
+        value: 9000000000000
+    # Host returns 9000000000000 (custom value) instead of the real parse result.
+    # This proves the registered builtin shadows the standard one.
+    want_result: 9000000000000
+
+  - note: registered_builtin_rejects_reserved_name
+    data: {}
+    input: {}
+    skip_interpreter: true
+    execution_mode: suspendable
+    host_await_builtins:
+      - name: __builtin_host_await
+        arg_count: 1
+    modules:
+      - |
+        package demo
+        import rego.v1
+        result := true
+    query: data.demo.result
+    # __builtin_host_await is a reserved name handled by the explicit code path;
+    # registering it as a host-await builtin is rejected at compile time.
+    want_error: "__builtin_host_await is a reserved name"
+
+  - note: registered_builtin_empty_list_is_noop
+    data: {}
+    input: {}
+    skip_interpreter: true
+    execution_mode: suspendable
+    # Empty registration list: nothing is registered, the policy compiles
+    # normally and no HostAwait machinery fires.
+    host_await_builtins: []
+    modules:
+      - |
+        package demo
+        import rego.v1
+        result := 42
+    query: data.demo.result
+    want_result: 42
+
+  - note: registered_builtin_rejects_duplicate_name
+    data: {}
+    input: {}
+    skip_interpreter: true
+    execution_mode: suspendable
+    # Registering the same name twice is rejected (rather than silently
+    # overwritten) so the host can't accidentally clobber its own registration.
+    host_await_builtins:
+      - name: lookup
+        arg_count: 1
+      - name: lookup
+        arg_count: 1
+    modules:
+      - |
+        package demo
+        import rego.v1
+        result := lookup("anything")
+    query: data.demo.result
+    want_error: "already registered"
+
+  - note: registered_builtin_rejects_empty_name
+    data: {}
+    input: {}
+    skip_interpreter: true
+    execution_mode: suspendable
+    # The empty identifier is meaningless; reject at registration time.
+    host_await_builtins:
+      - name: ""
+        arg_count: 1
+    modules:
+      - |
+        package demo
+        import rego.v1
+        result := true
+    query: data.demo.result
+    want_error: "must not be empty"
+
+  - note: registered_builtin_rejects_whitespace_name
+    data: {}
+    input: {}
+    skip_interpreter: true
+    execution_mode: suspendable
+    # Whitespace-only names are equivalent to empty for registration purposes.
+    host_await_builtins:
+      - name: "   "
+        arg_count: 1
+    modules:
+      - |
+        package demo
+        import rego.v1
+        result := true
+    query: data.demo.result
+    want_error: "leading/trailing whitespace"
+
+  - note: registered_builtin_rejects_leading_whitespace_name
+    data: {}
+    input: {}
+    skip_interpreter: true
+    execution_mode: suspendable
+    # Whitespace-padded names would never match the trimmed identifier produced
+    # by the Rego parser, creating an unreachable registration. Reject at
+    # registration time so misconfiguration is loud, not silent.
+    host_await_builtins:
+      - name: " lookup"
+        arg_count: 1
+    modules:
+      - |
+        package demo
+        import rego.v1
+        result := true
+    query: data.demo.result
+    want_error: "leading/trailing whitespace"
+
+  - note: registered_builtin_rejects_trailing_whitespace_name
+    data: {}
+    input: {}
+    skip_interpreter: true
+    execution_mode: suspendable
+    host_await_builtins:
+      - name: "lookup "
+        arg_count: 1
+    modules:
+      - |
+        package demo
+        import rego.v1
+        result := true
+    query: data.demo.result
+    want_error: "leading/trailing whitespace"
+
+  - note: registered_builtin_out_param_syntax
+    data: {}
+    input: {}
+    skip_interpreter: true
+    execution_mode: suspendable
+    # Rego's "output-param" calling form: `f(in, out)` desugars to `f(in)`
+    # with the return value unified with `out`. With a registered arg_count=1
+    # builtin, only the first positional argument (input) reaches the host;
+    # the second positional is the output binding, not a second host-await
+    # argument. The host returns the response, which is then unified with the
+    # output binding (here, `out`).
+    host_await_builtins:
+      - name: lookup
+        arg_count: 1
+    modules:
+      - |
+        package demo
+        import rego.v1
+        result := out if {
+          lookup("ping", out)
+        }
+    query: data.demo.result
+    host_await_responses_suspendable:
+      - id: "lookup"
+        args: "ping"
+        value: "pong"
+    want_result: "pong"
+
+  - note: registered_builtin_mixed_with_explicit_builtin_host_await
+    data: {}
+    input: {}
+    skip_interpreter: true
+    execution_mode: suspendable
+    # Both invocation forms in the same policy. The explicit
+    # __builtin_host_await call uses the user-supplied identifier ("kv_get"),
+    # while the registered "lookup" name resolves to a HostAwait with the
+    # registered identifier. Both are emitted as HostAwait instructions and
+    # consume from their respective identifier queues.
+    host_await_builtins:
+      - name: lookup
+        arg_count: 1
+    modules:
+      - |
+        package demo
+        import rego.v1
+        registered_value := lookup("alpha")
+        explicit_value   := __builtin_host_await("beta", "kv_get")
+        result := {
+          "registered": registered_value,
+          "explicit":   explicit_value,
+        }
+    query: data.demo.result
+    host_await_responses_suspendable:
+      - id: "lookup"
+        args: "alpha"
+        value: "from_registered"
+      - id: "kv_get"
+        args: "beta"
+        value: "from_explicit"
+    want_result:
+      registered: "from_registered"
+      explicit:   "from_explicit"
+
+  - note: registered_builtin_does_not_intercept_qualified_calls
+    data: {}
+    input:
+      key: "alpha"
+    skip_interpreter: true
+    execution_mode: suspendable
+    # Pins the documented FQN behavior: a registered name (`resolve`) only
+    # intercepts the unqualified call form (`resolve(x)`) inside the
+    # registering package. A package-qualified call (`data.other.resolve(x)`)
+    # resolves through the normal user-defined function path. The other
+    # package's `resolve` is invoked and returns its own value — the host
+    # never sees the call. The test asserts both: the registered intercept
+    # is consumed once (from the unqualified call), and the qualified call
+    # returns the user-rule output without registering as a host-await.
+    host_await_builtins:
+      - name: resolve
+        arg_count: 1
+    modules:
+      - |
+        package other
+        import rego.v1
+        resolve(k) := result if {
+          result := sprintf("user-rule-handled:%s", [k])
+        }
+      - |
+        package demo
+        import rego.v1
+        intercepted := resolve(input.key)
+        bypassed    := data.other.resolve(input.key)
+        result := {
+          "intercepted": intercepted,
+          "bypassed":    bypassed,
+        }
+    query: data.demo.result
+    host_await_responses_suspendable:
+      - id: "resolve"
+        args: "alpha"
+        value: "from_host"
+    want_result:
+      intercepted: "from_host"
+      bypassed: "user-rule-handled:alpha"
+
+  - note: registered_builtin_same_package_qualified_reaches_local_rule
+    data: {}
+    input:
+      key: "alpha"
+    skip_interpreter: true
+    execution_mode: suspendable
+    # When a registered name *also* exists as a rule in the registering
+    # package, the bare call is intercepted (HostAwait) while the
+    # same-package qualified call reaches the local rule. Registration is a
+    # bare-name intercept only; the qualified path resolves as it normally
+    # would. This gives a policy a deliberate escape hatch: register `resolve`
+    # for host interception, yet still reach the local rule via
+    # `data.demo.resolve` when the host should be bypassed.
+    host_await_builtins:
+      - name: resolve
+        arg_count: 1
+    modules:
+      - |
+        package demo
+        import rego.v1
+        resolve(k) := sprintf("local-rule:%s", [k])
+        intercepted := resolve(input.key)
+        bypassed    := data.demo.resolve(input.key)
+        result := {
+          "intercepted": intercepted,
+          "bypassed":    bypassed,
+        }
+    query: data.demo.result
+    host_await_responses_suspendable:
+      - id: "resolve"
+        args: "alpha"
+        value: "from_host"
+    want_result:
+      intercepted: "from_host"
+      bypassed: "local-rule:alpha"
+
+  - note: registered_builtin_shadows_standard_builtin_by_bare_name
+    data: {}
+    input: {}
+    skip_interpreter: true
+    execution_mode: suspendable
+    # Registering a name that collides with a standard builtin (`count`)
+    # intercepts the bare call form: `count([...])` compiles to a HostAwait
+    # instead of invoking the built-in implementation. The qualified form
+    # `data.demo.count([...])` has no meaning for a builtin (builtins are
+    # callable only by bare name) and would fail to compile with
+    # `Unknown function` whether or not `count` is registered, so it is not
+    # exercised here.
+    host_await_builtins:
+      - name: count
+        arg_count: 1
+    modules:
+      - |
+        package demo
+        import rego.v1
+        result := count([10, 20, 30])
+    query: data.demo.result
+    host_await_responses_suspendable:
+      - id: "count"
+        args: [10, 20, 30]
+        value: "from_host"
+    want_result: "from_host"
+
+  - note: registered_builtin_qualified_unknown_function_when_no_rule
+    data: {}
+    input:
+      key: "alpha"
+    skip_interpreter: true
+    execution_mode: suspendable
+    # Registration is a bare-name intercept and creates no rule. A qualified
+    # call to the registered name therefore has nothing to resolve to (no rule
+    # exists at `data.demo.resolve`) and fails to compile with
+    # `Unknown function` — the same outcome as without registration. Pins the
+    # documented "otherwise compilation fails with Unknown function" case.
+    host_await_builtins:
+      - name: resolve
+        arg_count: 1
+    modules:
+      - |
+        package demo
+        import rego.v1
+        result := data.demo.resolve(input.key)
+    query: data.demo.result
+    want_error: "Unknown function"
+
+  - note: registered_builtin_qualified_builtin_name_is_unknown_function
+    data: {}
+    input: {}
+    skip_interpreter: true
+    execution_mode: suspendable
+    # A standard builtin has no package-qualified form: `data.demo.count([...])`
+    # fails with `Unknown function` whether or not `count` is registered as a
+    # host-await builtin. Pins the parenthetical in the docs.
+    host_await_builtins:
+      - name: count
+        arg_count: 1
+    modules:
+      - |
+        package demo
+        import rego.v1
+        result := data.demo.count([10, 20, 30])
+    query: data.demo.result
+    want_error: "Unknown function"
+
+  - note: registered_builtin_suspendable_set_argument
+    data: {}
+    input: {}
+    skip_interpreter: true
+    execution_mode: suspendable
+    # Regression pin for the host-await argument comparison: the policy passes
+    # a *set* as the payload. The runtime argument is already a `Value::Set`,
+    # and the expected `args` decodes (via the `set!` helper) to the same set.
+    # The harness must compare them directly -- re-running `process_value` on the
+    # runtime argument would bail with "unexpected set in value read from
+    # json/yaml" and fail the case for the wrong reason.
+    host_await_builtins:
+      - name: lookup
+        arg_count: 1
+    modules:
+      - |
+        package demo
+        import rego.v1
+        result := lookup({1, 2, 3})
+    query: data.demo.result
+    host_await_responses_suspendable:
+      - id: "lookup"
+        args:
+          set!: [1, 2, 3]
+        value: "found"
+    want_result: "found"

tests/rvm/rego/mod.rs

@@ -41,6 +41,7 @@ struct TestCase {
     pub host_await_responses: Option<Vec<HostAwaitResponseSpec>>,
     pub host_await_responses_run_to_completion: Option<Vec<HostAwaitResponseSpec>>,
     pub host_await_responses_suspendable: Option<Vec<HostAwaitResponseSpec>>,
+    pub host_await_builtins: Option<Vec<HostAwaitBuiltinSpec>>,
 }
 
 fn default_strict() -> bool {
@@ -55,14 +56,24 @@ struct YamlTest {
 #[derive(Debug, Clone, Deserialize, Serialize, PartialEq)]
 struct HostAwaitResponseSpec {
     pub id: Value,
+    pub args: Option<Value>,
     pub value: Value,
 }
 
+#[derive(Debug, Clone, Deserialize, Serialize, PartialEq)]
+struct HostAwaitBuiltinSpec {
+    pub name: String,
+    pub arg_count: usize,
+}
+
+type HostAwaitResponseMap = BTreeMap<Value, VecDeque<(Option<Value>, Value)>>;
+
 #[derive(Debug, Clone)]
 struct RvmExecutionOptions {
     execution_mode: ExecutionMode,
     host_await_responses_run_to_completion: Option<Vec<(Value, Vec<Value>)>>,
-    host_await_responses_suspendable: Option<BTreeMap<Value, VecDeque<Value>>>,
+    host_await_responses_suspendable: Option<HostAwaitResponseMap>,
+    host_await_builtins: Option<Vec<(String, usize)>>,
 }
 
 impl Default for RvmExecutionOptions {
@@ -71,6 +82,7 @@ impl Default for RvmExecutionOptions {
             execution_mode: ExecutionMode::RunToCompletion,
             host_await_responses_run_to_completion: None,
             host_await_responses_suspendable: None,
+            host_await_builtins: None,
         }
     }
 }
@@ -82,12 +94,13 @@ fn render_program_listing(program: &Program) -> String {
 
 fn build_host_await_response_map(
     responses: &[HostAwaitResponseSpec],
-) -> anyhow::Result<BTreeMap<Value, VecDeque<Value>>> {
-    let mut map: BTreeMap<Value, VecDeque<Value>> = BTreeMap::new();
+) -> anyhow::Result<HostAwaitResponseMap> {
+    let mut map: HostAwaitResponseMap = BTreeMap::new();
     for response in responses {
         let id = process_value(&response.id)?;
+        let expected_args = response.args.as_ref().map(process_value).transpose()?;
         let value = process_value(&response.value)?;
-        map.entry(id).or_default().push_back(value);
+        map.entry(id).or_default().push_back((expected_args, value));
     }
     Ok(map)
 }
@@ -95,10 +108,24 @@ fn build_host_await_response_map(
 fn build_host_await_response_vec(
     responses: &[HostAwaitResponseSpec],
 ) -> anyhow::Result<Vec<(Value, Vec<Value>)>> {
+    // Run-to-completion responses are pre-loaded into the VM, which consumes
+    // them internally without surfacing each call's argument to the harness.
+    // There is therefore no point at which an `args:` expectation could be
+    // checked, so silently dropping it would let a case "assert" a payload
+    // that is never verified. Reject `args:` up front instead, pointing the
+    // author at suspendable mode where argument validation is supported.
+    if let Some(response) = responses.iter().find(|response| response.args.is_some()) {
+        return Err(anyhow::anyhow!(
+            "`args:` payload validation is not supported in run-to-completion mode \
+             (response for id {:?}); drop the `args:` field or move the case to \
+             execution_mode: suspendable",
+            response.id
+        ));
+    }
     let map = build_host_await_response_map(responses)?;
     Ok(map
         .into_iter()
-        .map(|(id, values)| (id, values.into_iter().collect()))
+        .map(|(id, values)| (id, values.into_iter().map(|(_, output)| output).collect()))
         .collect())
 }
 
@@ -111,12 +138,20 @@ fn build_execution_options(case: &TestCase) -> anyhow::Result<RvmExecutionOption
         }
     };
 
-    let rtc_responses = case
-        .host_await_responses_run_to_completion
-        .as_ref()
-        .or(case.host_await_responses.as_ref())
-        .map(|responses| build_host_await_response_vec(responses))
-        .transpose()?;
+    // Only build the run-to-completion response vec when the case actually
+    // runs in RTC mode. A suspendable case may legitimately use the shared
+    // `host_await_responses` field with `args:` expectations (validated via
+    // the suspendable map below); building the RTC vec for it would wrongly
+    // trip the RTC-only `args:` rejection in `build_host_await_response_vec`.
+    let rtc_responses = if execution_mode == ExecutionMode::RunToCompletion {
+        case.host_await_responses_run_to_completion
+            .as_ref()
+            .or(case.host_await_responses.as_ref())
+            .map(|responses| build_host_await_response_vec(responses))
+            .transpose()?
+    } else {
+        None
+    };
 
     let suspendable_responses = case
         .host_await_responses_suspendable
@@ -125,10 +160,18 @@ fn build_execution_options(case: &TestCase) -> anyhow::Result<RvmExecutionOption
         .map(|responses| build_host_await_response_map(responses))
         .transpose()?;
 
+    let ha_builtins = case.host_await_builtins.as_ref().map(|specs| {
+        specs
+            .iter()
+            .map(|s| (s.name.clone(), s.arg_count))
+            .collect()
+    });
+
     Ok(RvmExecutionOptions {
         execution_mode,
         host_await_responses_run_to_completion: rtc_responses,
         host_await_responses_suspendable: suspendable_responses,
+        host_await_builtins: ha_builtins,
     })
 }
 
@@ -227,7 +270,13 @@ fn compile_and_run_rvm_with_all_entry_points(
     listing_out: &mut Option<String>,
     execution_options: &RvmExecutionOptions,
 ) -> anyhow::Result<Vec<Value>> {
-    let program = Compiler::compile_from_policy(compiled_policy, entry_points)?;
+    let ha_builtins = execution_options
+        .host_await_builtins
+        .as_ref()
+        .map(|b| b.iter().map(|(n, a)| (n.as_str(), *a)).collect::<Vec<_>>())
+        .unwrap_or_default();
+    let program =
+        Compiler::compile_from_policy_with_host_await(compiled_policy, entry_points, &ha_builtins)?;
 
     // Basic serialization sanity check keeps regressions visible in CI.
     test_round_trip_serialization(program.as_ref()).map_err(|e| anyhow::anyhow!(e))?;
@@ -269,8 +318,12 @@ fn compile_and_run_rvm_with_all_entry_points(
                         return Err(anyhow::anyhow!("{}", error));
                     }
                     ExecutionState::Suspended { reason, .. } => match reason {
-                        SuspendReason::HostAwait { identifier, .. } => {
-                            let response = suspendable_responses
+                        SuspendReason::HostAwait {
+                            identifier,
+                            argument,
+                            ..
+                        } => {
+                            let (expected_args, response) = suspendable_responses
                                 .get_mut(identifier)
                                 .and_then(|queue| queue.pop_front())
                                 .ok_or_else(|| {
@@ -279,6 +332,24 @@ fn compile_and_run_rvm_with_all_entry_points(
                                         identifier
                                     )
                                 })?;
+                            if let Some(expected) = expected_args {
+                                // `argument` is already a runtime `Value`; the
+                                // expected side has been through `process_value`
+                                // once at YAML decode time (see
+                                // `build_host_await_response_map`). Comparing
+                                // raw runtime values keeps fixture sentinels like
+                                // "#undefined" from coercing a runtime string
+                                // payload into a different shape, which would
+                                // otherwise let tests pass for the wrong reason.
+                                if argument != &expected {
+                                    return Err(anyhow::anyhow!(
+                                        "HostAwait argument mismatch for {:?}: expected {:?}, got {:?}",
+                                        identifier,
+                                        expected,
+                                        argument
+                                    ));
+                                }
+                            }
                             vm.resume(Some(response))?;
                         }
                         other => {
@@ -365,7 +436,34 @@ fn yaml_test_impl(file: &str) -> Result<()> {
             Some(engine.eval_rule(case.query.clone()))
         };
 
-        let execution_options = build_execution_options(&case)?;
+        let execution_options = match build_execution_options(&case) {
+            Ok(options) => options,
+            Err(options_error) => {
+                // A malformed host-await fixture (e.g. an `args:` expectation on
+                // a run-to-completion response, which can never be validated) is
+                // reported here. Mirror the compilation-error handling below: if
+                // the case expects an error, match it; otherwise fail hard.
+                if let (None, Some(expected_error)) = (&case.want_result, &case.want_error) {
+                    let error_str = options_error.to_string();
+                    if error_str.contains(expected_error) {
+                        println!(
+                            "✓ Execution-options error matches expected for case '{}'",
+                            case.note
+                        );
+                        println!("passed");
+                        continue;
+                    }
+                    panic_with_listing!(
+                        &last_listing,
+                        &case.note,
+                        "Execution-options error does not match expected for case '{}':\nExpected: '{expected_error}'\nActual: '{error_str}'",
+                        case.note
+                    );
+                }
+                dump_rvm_listing(&case.note, &last_listing);
+                return Err(options_error);
+            }
+        };
 
         if let Err(compilation_error) = &compilation_result {
             if let (None, Some(expected_error)) = (&case.want_result, &case.want_error) {