Polish keyword-ref test expectations and validate coverage

.dir-locals.el

@@ -1,12 +0,0 @@
-;;; Directory Local Variables            -*- no-byte-compile: t; -*-
-;;; For more information see (info "(emacs) Directory Variables")
-
-;; Regorus is a cargo-verus project (package.metadata.verus.verify = true), so
-;; verus-mode.el runs `cargo verus verify' rather than the raw `verus' binary.
-;; The cargo-verus path ignores `package.metadata.verus.ide.extra_args' and
-;; instead reads `verus-cargo-verus-arguments'. We set it here so that Verus is
-;; invoked with the `verus' Cargo feature enabled.
-;;
-;; Everything before `--' is passed to cargo-verus; everything after `--' is
-;; forwarded to the Verus binary. The `--' is required by verus-mode.el.
-((verus-mode . ((verus-cargo-verus-arguments . ("--features" "verus" "--")))))

.github/workflows/codeql.yml

@@ -62,7 +62,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
     # Setup language-specific dependencies BEFORE CodeQL init for proper tracing setup
     - name: Setup Rust
@@ -86,26 +86,26 @@ jobs:
 
     - name: Setup Python
       if: matrix.language == 'python'
-      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
       with:
         python-version: '3.10'
 
     - name: Setup Java
       if: matrix.language == 'java-kotlin'
-      uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+      uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
       with:
         distribution: 'corretto'
         java-version: '8'
 
     - name: Setup Go
       if: matrix.language == 'go'
-      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
       with:
         go-version: '1.21'
 
     - name: Setup .NET
       if: matrix.language == 'csharp'
-      uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+      uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
       with:
         global-json-file: ./bindings/csharp/global.json
 
@@ -115,12 +115,12 @@ jobs:
 
     - name: Setup Node.js
       if: matrix.language == 'javascript-typescript'
-      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
       with:
         node-version: '18'
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+      uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -141,7 +141,7 @@ jobs:
 
     - name: Setup Ruby
       if: matrix.language == 'rust' && contains(matrix.working-directory, 'ruby')
-      uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
+      uses: ruby/setup-ruby@c4e5b1316158f92e3d49443a9d58b31d25ac0f8f # v1.306.0
       with:
         ruby-version: '3.4.2'
         bundler-cache: true
@@ -188,6 +188,6 @@ jobs:
       run: cargo xtask build-wasm --release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+      uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/dependabot-refresh-cargo-lockfiles.yml

@@ -33,7 +33,7 @@ jobs:
       # ONLY cargo update and cargo metadata (which do NOT execute build
       # scripts) may run against this checkout. Do NOT add cargo build/check/
       # test/run steps.
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v4.2.2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v4.2.2
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
           ref: ${{ github.event.pull_request.head.sha }}

.github/workflows/dependency-audit.yml

@@ -27,7 +27,7 @@ jobs:
           - bindings/wasm/Cargo.lock
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
 
       - name: Run cargo audit
         uses: rustsec/audit-check@v2
@@ -53,7 +53,7 @@ jobs:
           - xtask/Cargo.toml
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
 
       - name: Setup Rust
         uses: ./.github/actions/toolchains/rust

.github/workflows/feature-matrix.yml

@@ -67,7 +67,7 @@ jobs:
             features: arc,opa-no-std
 
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
     - name: Setup Rust toolchain
       uses: ./.github/actions/toolchains/rust
     - name: Cache cargo

.github/workflows/miri.yml

@@ -14,7 +14,7 @@ jobs:
       MIRIFLAGS: "-Zmiri-disable-isolation"
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
       - uses: ./.github/actions/toolchains/rust
         with:
           toolchain: nightly

.github/workflows/pr-extensions.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
     - name: Setup Rust toolchain
       uses: ./.github/actions/toolchains/rust
     - name: Cache cargo

.github/workflows/pr.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
     - name: Setup Rust toolchain
       uses: ./.github/actions/toolchains/rust
     - name: Cache cargo

.github/workflows/publish-java.yml

@@ -35,10 +35,10 @@ jobs:
             os: windows-latest
             extension: dll
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
-      - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           java-version: 8
           distribution: "corretto"
@@ -46,7 +46,7 @@ jobs:
         with:
           targets: ${{ matrix.target }}
       - if: ${{ matrix.build_cmd == 'zigbuild' }}
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.11"
       - if: ${{ matrix.build_cmd == 'zigbuild' }}
@@ -66,10 +66,10 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
-      - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           java-version: 8
           distribution: "corretto"

.github/workflows/publish-python.yml

@@ -20,8 +20,8 @@ jobs:
       matrix:
         target: [x86_64, x86, aarch64, armv7, s390x, ppc64le]
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.10'
       - uses: ./.github/actions/toolchains/rust
@@ -52,8 +52,8 @@ jobs:
       matrix:
         target: [x64, x86]
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.10'
           architecture: ${{ matrix.target }}
@@ -84,8 +84,8 @@ jobs:
       matrix:
         target: [x86_64, aarch64, universal2-apple-darwin]
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.10'
       - uses: ./.github/actions/toolchains/rust

.github/workflows/publish-wasm.yml

@@ -15,11 +15,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
       # Setup .npmrc file to publish to npm
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '20.x'
           registry-url: 'https://registry.npmjs.org'

.github/workflows/release-plz.yml

@@ -17,13 +17,13 @@ jobs:
       contents: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
       - name: Install Rust toolchain
         uses: ./.github/actions/toolchains/rust
       - name: Run release-plz
-        uses: MarcoIeni/release-plz-action@2eb1d8bcb770b4c48ccfaad919734b38b51958c9 # v0.5.131
+        uses: MarcoIeni/release-plz-action@1528104d2ca23787631a1c1f022abb64b34c1e11 # v0.5.128
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

.github/workflows/rust-clippy.yml

@@ -32,7 +32,7 @@ jobs:
       actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup Rust toolchain
         uses: ./.github/actions/toolchains/rust
@@ -52,7 +52,7 @@ jobs:
 
       - name: Upload analysis results to GitHub
         if: ${{ hashFiles('rust-clippy-results.sarif') != '' }}
-        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3.29.11
+        uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v3.29.11
         with:
           sarif_file: rust-clippy-results.sarif
           wait-for-processing: true

.github/workflows/test-c-cpp.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 

.github/workflows/test-csharp.yml

@@ -39,7 +39,7 @@ jobs:
               **/release/libregorus_ffi.dylib
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
       - uses: ./.github/actions/toolchains/rust
@@ -73,11 +73,11 @@ jobs:
     needs: build-ffi
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0  
       - uses: ./.github/actions/toolchains/rust
-      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+      - uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
         with:
           global-json-file: ./bindings/csharp/global.json
 
@@ -131,13 +131,13 @@ jobs:
             target: aarch64-apple-darwin
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 
       - uses: ./.github/actions/toolchains/rust
 
-      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+      - uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
         with:
           global-json-file: ./bindings/csharp/global.json
 

.github/workflows/test-ffi.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
       - uses: ./.github/actions/toolchains/rust

.github/workflows/test-go.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
       - uses: ./.github/actions/toolchains/rust
@@ -30,7 +30,7 @@ jobs:
       - name: Fetch FFI crate dependencies
         run: cargo fetch --locked --manifest-path bindings/ffi/Cargo.toml
 
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           architecture: x64
 

.github/workflows/test-java.yml

@@ -16,11 +16,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           java-version: 8
           distribution: "corretto"

.github/workflows/test-musl.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
     - uses: ./.github/actions/toolchains/rust
       with:
         targets: x86_64-unknown-linux-musl

.github/workflows/test-no-std.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
     - uses: ./.github/actions/toolchains/rust
       with:
         targets: thumbv7m-none-eabi

.github/workflows/test-python.yml

@@ -23,7 +23,7 @@ jobs:
     runs-on: ${{ matrix.host.name }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
       - uses: ./.github/actions/toolchains/rust
@@ -39,7 +39,7 @@ jobs:
       - name: Fetch Python crate dependencies
         run: cargo fetch --locked --manifest-path bindings/python/Cargo.toml --target ${{ matrix.host.target }}
 
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.10"
           architecture: x64
@@ -68,7 +68,7 @@ jobs:
     runs-on: ${{ matrix.host.name }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
       - uses: ./.github/actions/toolchains/rust
@@ -82,7 +82,7 @@ jobs:
       - name: Fetch Python crate dependencies
         run: cargo fetch --locked --manifest-path bindings/python/Cargo.toml
 
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
           architecture: x64

.github/workflows/test-ruby.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 

.github/workflows/test-wasm.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 
@@ -33,7 +33,7 @@ jobs:
         run: cargo fetch --locked --manifest-path bindings/wasm/Cargo.toml
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 22
 

.github/workflows/tests-debug.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
     - name: Setup Rust toolchain
       uses: ./.github/actions/toolchains/rust
     - name: Cache cargo

.github/workflows/verus.yml

@@ -1,80 +0,0 @@
-# Copyright (c) Microsoft Corporation. All rights reserved.
-#
-name: verus
-
-on:
-  push:
-    branches: [ "main" ]
-  pull_request:
-    branches: [ "main" ]
-
-env:
-  CARGO_TERM_COLOR: always
-
-# This workflow only checks out code, downloads a pinned Verus release asset,
-# and runs verification. It never writes to the repository, so restrict the
-# GITHUB_TOKEN to read-only access to repository contents.
-permissions:
-  contents: read
-
-jobs:
-  verify:
-    runs-on: ubuntu-latest
-
-    steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - name: Setup Rust toolchain
-      uses: ./.github/actions/toolchains/rust
-      with:
-        components: ""
-    - name: Cache cargo
-      uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
-      with:
-        shared-key: ${{ runner.os }}-regorus-verus
-    - name: Install Verus and run verification
-      shell: bash
-      run: |
-        set -euxo pipefail
-        asset_url=https://github.com/verus-lang/verus/releases/download/release%2F0.2026.07.12.0b42f4c/verus-0.2026.07.12.0b42f4c-x86-linux.zip
-        asset_sha256=f6f4f5d08e07d3e1ad721d775bda5ba96b9dd0c73b48fc17f2e071866fbd01c0
-        test -n "$asset_url"
-        curl -fsSL "$asset_url" -o verus.zip
-
-        # Verify the download integrity before trusting/executing its contents.
-        echo "${asset_sha256}  verus.zip" | sha256sum --check --strict
-
-        unzip -q verus.zip -d verus-dist
-
-        # Search under an absolute path so that `find` yields absolute paths;
-        # this keeps the PATH entries below valid regardless of the working
-        # directory.
-        verus_bin="$(find "$PWD/verus-dist" -type f -name verus -perm -u+x | head -n1)"
-        cargo_verus_bin="$(find "$PWD/verus-dist" -type f -name cargo-verus -perm -u+x | head -n1)"
-        version_json="$(find "$PWD/verus-dist" -type f -name version.json | head -n1)"
-        test -n "$verus_bin"
-        test -n "$cargo_verus_bin"
-        test -n "$version_json"
-
-        # Verus is built against a specific Rust toolchain and refuses to run
-        # against any other version. Read the required toolchain from the
-        # release metadata so we track it automatically instead of hardcoding.
-        required_toolchain="$(sed -n 's/.*"toolchain"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$version_json")"
-        test -n "$required_toolchain"
-        echo "Verus requires Rust toolchain: $required_toolchain"
-
-        # Install the exact toolchain Verus expects, including the extra
-        # components (rustc-dev, llvm-tools) that Verus links against and that
-        # are not part of the default rustup profile.
-        rustup toolchain install "$required_toolchain" \
-          --profile minimal \
-          --component rustc-dev --component llvm-tools --component rustfmt
-
-        # Force cargo/rustc to resolve to the Verus toolchain for the commands
-        # below, overriding any repository/directory toolchain override.
-        export RUSTUP_TOOLCHAIN="$required_toolchain"
-
-        # Put cargo-verus on PATH for the commands below.
-        export PATH="$(dirname "$cargo_verus_bin"):$(dirname "$verus_bin"):$PATH"
-        cargo verus --help
-        cargo fetch --locked
-        cargo verus verify --locked --features verus

CHANGELOG.md

@@ -6,35 +6,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-## [0.11.0](https://github.com/microsoft/regorus/compare/regorus-v0.10.1...regorus-v0.11.0) - 2026-07-21
-
-### Added
-
-- *(compiler)* support registered host-await builtins for natural function call syntax ([#667](https://github.com/microsoft/regorus/pull/667))
-- *(value)* introduce Set storage abstraction ([#740](https://github.com/microsoft/regorus/pull/740))
-
-### Fixed
-
-- *(rvm)* assert every-quantifier results so failing cases don't pass ([#765](https://github.com/microsoft/regorus/pull/765))
-- `Engine::add_data` now deep-merges nested data documents instead of only merging top-level keys. Adding `{ "a": { "x": 1 } }` followed by `{ "a": { "y": 2 } }` now yields `{ "a": { "x": 1, "y": 2 } }` (matching OPA's data-document merge). Nested sets under a shared key are unioned. Only genuine leaf conflicts (the same path holding two different values) are reported as errors. ([#760](https://github.com/microsoft/regorus/pull/760))
-- A zero-arg function producing two different complete values (e.g. `f() := { "a": 1 }` and `f() := { "b": 2 }`) is now reported as a conflict, matching OPA's complete-rule semantics, instead of silently combining the outputs.
-
-### Security
-
-- `Engine::add_data` now rejects data nested beyond 128 levels instead of risking a stack overflow on adversarially deep input.
-
-### Other
-
-- *(deps)* bump the rust-dependencies group across 5 directories with 11 updates ([#764](https://github.com/microsoft/regorus/pull/764))
-- Expand keyword-in-ref coverage for complex parser edge cases (interpreter + RVM) ([#744](https://github.com/microsoft/regorus/pull/744))
-- *(deps)* bump the rust-dependencies group across 5 directories with 4 updates ([#754](https://github.com/microsoft/regorus/pull/754))
-- *(deps)* bump the rust-dependencies group across 5 directories with 6 updates ([#750](https://github.com/microsoft/regorus/pull/750))
-- *(value)* migrate Value::Object to Object storage abstraction ([#736](https://github.com/microsoft/regorus/pull/736))
-- normalize path separators in folder filter on Windows ([#742](https://github.com/microsoft/regorus/pull/742))
-- Introduce Object storage abstraction ([#735](https://github.com/microsoft/regorus/pull/735))
-- *(rvm)* add debug-mode invariant assertions ([#737](https://github.com/microsoft/regorus/pull/737))
-- *(deps)* bump the rust-dependencies group across 5 directories with 5 updates ([#734](https://github.com/microsoft/regorus/pull/734))
-
 ## [0.10.1](https://github.com/microsoft/regorus/compare/regorus-v0.10.0...regorus-v0.10.1) - 2026-05-22
 
 ### Fixed

Cargo.toml

@@ -8,17 +8,12 @@ members = [
 [package]
 name = "regorus"
 description = "A fast, lightweight Rego (OPA policy language) interpreter"
-version = "0.11.0"
+version = "0.10.1"
 edition = "2021"
 license = "MIT AND Apache-2.0 AND BSD-3-Clause"
 repository = "https://github.com/microsoft/regorus"
 keywords = ["interpreter", "no_std", "opa", "policy-as-code", "rego"]
 
-# Support verification with Verus, a Rust verifier (https://github.com/verus-lang/verus)
-
-[package.metadata.verus]
-verify = true
-
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [lib]
@@ -26,7 +21,6 @@ doctest = false
 
 [features]
 default = ["full-opa", "arc", "rvm"]
-verus = ["dep:vstd"]
 
 arc = []
 ast = []
@@ -49,7 +43,7 @@ cache = ["dep:lru"]
 rvm = ["dep:postcard", "dep:indexmap"]
 semver = ["dep:semver"]
 allocator-memory-limits = ["std", "mimalloc", "mimalloc/allocator-memory-limits"]
-std = ["rand/std", "rand/std_rng", "serde_json/std", "indexmap?/std", "msvc_spectre_libs", "dep:parking_lot", "vstd?/std" ]
+std = ["rand/std", "rand/std_rng", "serde_json/std", "indexmap?/std", "msvc_spectre_libs", "dep:parking_lot" ]
 time = ["dep:chrono", "dep:chrono-tz"]
 uuid = ["dep:uuid"]
 urlquery = ["dep:url"]
@@ -110,7 +104,7 @@ lazy_static =  { version = "1.4.0", default-features = false }
 thiserror = { version = "2.0", default-features = false }
 
 data-encoding = { version = "2.8.0", optional = true, default-features=false, features = ["alloc"] }
-num-bigint = { version = "0.5", default-features = false }
+num-bigint = { version = "0.4", default-features = false }
 num-traits = { version = "0.2", default-features = false }
 parking_lot = { version = "0.12", optional = true }
 spin = { version = "0.12.0", default-features = false, features = ["mutex", "spin_mutex"] }
@@ -120,7 +114,7 @@ regex = {version = "1.12.3", optional = true, default-features = false }
 semver = {version = "1.0.28", optional = true, default-features = false }
 url = { version = "2.5.4", optional = true }
 uuid = { version = "1.22.0", default-features = false, features = ["v4", "fast-rng"], optional = true }
-jsonschema = { version = "0.48.5", default-features = false, optional = true }
+jsonschema = { version = "0.46.5", default-features = false, optional = true }
 chrono = { version = "0.4.44", optional = true }
 chrono-tz = { version = "0.10.1", optional = true }
 ipnet = { version = "2.12.0", optional = true, default-features = false }
@@ -140,11 +134,6 @@ mimalloc = { package = "regorus-mimalloc", path = "mimalloc", version = "2.2.7",
 indexmap = { version = "2.13.1", default-features = false, features = ["serde"], optional = true }
 postcard = { version = "1.1.3", default-features = false, features = ["alloc"], optional = true }
 
-# Verus-related dependencies.
-# vstd is enabled via the `verus` feature. In no_std builds only the `alloc` feature is used;
-# the crate's `std` feature additionally enables `vstd/std` (matching vstd's default features).
-vstd = { version = "=0.0.0-2026-07-12-0122", optional = true, default-features = false, features = ["alloc"] }
-
 [dev-dependencies]
 anyhow = "1.0.102"
 cfg-if = "1.0.0"
@@ -225,7 +214,3 @@ doctest=false
 # RUSTDOCFLAGS="--cfg docsrs" cargo +nightly doc --all-features --no-deps
 all-features = true
 rustdoc-args = ["--cfg", "docsrs"]
-
-[lints.rust]
-# Allow `verus_keep_ghost` configuration flag (used by Verus)
-unexpected_cfgs = { level = "warn", check-cfg = ['cfg(verus_keep_ghost)'] }

bindings/csharp/Directory.Packages.props

@@ -1,7 +1,7 @@
 <Project>
   <PropertyGroup>
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
-    <RegorusPackageVersion>0.11.0</RegorusPackageVersion>
+    <RegorusPackageVersion>0.10.1</RegorusPackageVersion>
     <RegorusPackageVersionSuffix Condition="'$(VersionSuffix)' != ''">-$(VersionSuffix)</RegorusPackageVersionSuffix>
   </PropertyGroup>
 

bindings/csharp/Regorus.Tests/MemoryGrowthTests.cs

@@ -115,10 +115,6 @@ public class MemoryGrowthTests
 
                 if (i % LogEvery == 0)
                 {
-                    // Collect transient managed garbage so the working-set delta reflects
-                    // retained (leaked) memory rather than uncollected allocations. A real
-                    // native leak from a missed Dispose() would survive GC and still be caught.
-                    ForceFullGc();
                     process.Refresh();
                     var workingSet = process.WorkingSet64;
                     var managed = GC.GetTotalMemory(false);
@@ -232,10 +228,6 @@ public class MemoryGrowthTests
 
                 if (i % LogEvery == 0)
                 {
-                    // Collect transient managed garbage so the working-set delta reflects
-                    // retained (leaked) memory rather than uncollected allocations. A real
-                    // native leak from a missed Dispose() would survive GC and still be caught.
-                    ForceFullGc();
                     process.Refresh();
                     var workingSet = process.WorkingSet64;
                     var managed = GC.GetTotalMemory(false);

bindings/ffi/Cargo.toml

@@ -2,7 +2,7 @@
 
 [package]
 name = "regorus-ffi"
-version = "0.11.0"
+version = "0.10.1"
 edition = "2021"
 license = "MIT AND Apache-2.0 AND BSD-3-Clause"
 

bindings/java/Cargo.toml

@@ -2,7 +2,7 @@
 
 [package]
 name = "regorus-java"
-version = "0.11.0"
+version = "0.10.1"
 edition = "2021"
 repository = "https://github.com/microsoft/regorus/bindings/java"
 description = "Java bindings for Regorus - a fast, lightweight Rego interpreter written in Rust"

bindings/java/pom.xml

@@ -9,7 +9,7 @@
 
   <groupId>com.microsoft.regorus</groupId>
   <artifactId>regorus-java</artifactId>
-  <version>0.11.0</version>
+  <version>0.10.1</version>
 
   <name>Regorus Java</name>
   <description>Java bindings for Regorus - a fast, lightweight Rego interpreter written in Rust</description>
@@ -97,7 +97,7 @@
 
       <plugin>
         <artifactId>maven-surefire-plugin</artifactId>
-        <version>3.5.6</version>
+        <version>3.5.5</version>
         <configuration>
           <!-- Add debug build to Java path, so it's discoverable by JVM. This is only for tests. -->
           <argLine>-Djava.library.path=${project.basedir}/target/debug:${java.library.path}</argLine>

bindings/python/Cargo.toml

@@ -2,7 +2,7 @@
 
 [package]
 name = "regoruspy"
-version = "0.11.0"
+version = "0.10.1"
 edition = "2021"
 repository = "https://github.com/microsoft/regorus/bindings/python"
 description = "Python bindings for Regorus - a fast, lightweight Rego interpreter written in Rust"
@@ -23,7 +23,7 @@ coverage = ["regorus/coverage"]
 [dependencies]
 anyhow = "1.0"
 ordered-float = "5.3.0"
-pyo3 = { version = "0.29.0", features = ["abi3-py310", "anyhow", "extension-module"] }
+pyo3 = { version = "0.28.3", features = ["abi3-py310", "anyhow", "extension-module"] }
 regorus = { path  = "../..", default-features = false, features = ["arc", "rvm"] }
 serde_json = "1.0.150"
 

bindings/python/pyproject.toml

@@ -1,5 +1,5 @@
 [build-system]
-requires = ["maturin>=1.14.1,<2.0"]
+requires = ["maturin>=1.4,<2.0"]
 build-backend = "maturin"
 
 [project]

bindings/ruby/Gemfile

@@ -11,6 +11,6 @@ gem "minitest", "~> 6.0"
 gem "rake", "~> 13.4"
 gem "rake-compiler", "~> 1.3"
 gem "rake-compiler-dock", "~> 1.12"
-gem "rubocop", "~> 1.88", require: false
-gem "rubocop-minitest", "~> 0.40.0", require: false
+gem "rubocop", "~> 1.86", require: false
+gem "rubocop-minitest", "~> 0.39.1", require: false
 gem "rubocop-rake", "~> 0.7.1", require: false

bindings/ruby/Gemfile.lock

@@ -9,14 +9,14 @@ GEM
   specs:
     ast (2.4.3)
     drb (2.2.3)
-    json (2.21.1)
-    language_server-protocol (3.17.0.6)
+    json (2.19.4)
+    language_server-protocol (3.17.0.5)
     lint_roller (1.1.0)
-    minitest (6.0.6)
+    minitest (6.0.5)
       drb (~> 2.0)
       prism (~> 1.5)
     parallel (2.1.0)
-    parser (3.3.12.0)
+    parser (3.3.11.1)
       ast (~> 2.4.1)
       racc
     prism (1.9.0)
@@ -26,10 +26,10 @@ GEM
     rake-compiler (1.3.1)
       rake
     rake-compiler-dock (1.12.0)
-    rb_sys (0.9.128)
+    rb_sys (0.9.127)
       rake-compiler-dock (= 1.12.0)
     regexp_parser (2.12.0)
-    rubocop (1.88.2)
+    rubocop (1.86.1)
       json (~> 2.3)
       language_server-protocol (~> 3.17.0.2)
       lint_roller (~> 1.1.0)
@@ -40,10 +40,10 @@ GEM
       rubocop-ast (>= 1.49.0, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 2.4.0, < 4.0)
-    rubocop-ast (1.50.0)
+    rubocop-ast (1.49.1)
       parser (>= 3.3.7.2)
       prism (~> 1.7)
-    rubocop-minitest (0.40.0)
+    rubocop-minitest (0.39.1)
       lint_roller (~> 1.1)
       rubocop (>= 1.75.0, < 2.0)
       rubocop-ast (>= 1.38.0, < 2.0)
@@ -65,8 +65,8 @@ DEPENDENCIES
   rake-compiler (~> 1.3)
   rake-compiler-dock (~> 1.12)
   regorusrb!
-  rubocop (~> 1.88)
-  rubocop-minitest (~> 0.40.0)
+  rubocop (~> 1.86)
+  rubocop-minitest (~> 0.39.1)
   rubocop-rake (~> 0.7.1)
 
 BUNDLED WITH

bindings/ruby/ext/regorusrb/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "regorusrb"
-version = "0.11.0"
+version = "0.10.1"
 edition = "2024"
 description = "Ruby bindings for Regorus - a fast, lightweight Rego interpreter written in Rust"
 license = "MIT AND Apache-2.0 AND BSD-3-Clause"

bindings/ruby/lib/regorus/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Regorus
-  VERSION = "0.11.0"
+  VERSION = "0.10.1"
 end

bindings/wasm/Cargo.toml

@@ -2,7 +2,7 @@
 
 [package]
 name = "regorusjs"
-version = "0.11.0"
+version = "0.10.1"
 edition = "2021"
 repository = "https://github.com/microsoft/regorus/bindings/wasm"
 description = "WASM bindings for Regorus - a fast, lightweight Rego interpreter written in Rust"

docs/rvm/architecture.md

@@ -254,13 +254,7 @@ include formatted state snapshots where possible.
 7. **Host await**: In run-to-completion mode, `HostAwait` consumes a response
    from `host_await_responses`. Suspendable mode yields control with a
    `SuspendReason::HostAwait { dest, argument, identifier }` that the host must
-   service. The compiler supports two ways to emit `HostAwait`:
-   - **Explicit**: `__builtin_host_await(payload, identifier)` — raw 2-argument
-     form.
-   - **Registered**: `compile_from_policy_with_host_await` accepts a list of
-     `(name, arg_count)` pairs. Calls to registered names are compiled as
-     `HostAwait` with the function name as the identifier literal. Registered
-     names take precedence over user-defined functions and standard builtins.
+   service.
 8. **Completion**: `Return` wraps the selected register value into
    `InstructionOutcome::Return`, unwinding frames until the entry frame is
    cleared. `RuleReturn` is a specialised variant used by rule execution

docs/rvm/instruction-set.md

@@ -177,75 +177,6 @@ Parameter tables:
 - Suspendable: emits `InstructionOutcome::Suspend` with `SuspendReason::HostAwait`.
   The host must resume with a value that will be written into `dest`.
 
-### Registered host-await builtins
-
-The compiler can be configured with a list of function names that map directly
-to `HostAwait` instructions. This allows policy authors to write natural
-function calls (e.g. `lookup(input.account_id)`) instead of the raw
-`__builtin_host_await(payload, identifier)` builtin.
-
-Registration is done at compile time via `Compiler::compile_from_policy_with_host_await`:
-
-```rust
-let builtins = [("lookup", 1), ("persist", 1)];
-let program = Compiler::compile_from_policy_with_host_await(
-    &compiled_policy, &entry_points, &builtins,
-)?;
-```
-
-Each registered name is a `(name, arg_count)` pair. When the compiler
-encounters a call to a registered name, it emits a `HostAwait` instruction
-with:
-- `arg` = the first argument register
-- `id` = a register loaded with a string literal containing the function name
-
-Both the explicit `__builtin_host_await(arg, id)` call and a registered
-builtin call produce the **same `HostAwait` bytecode instruction**. The only
-difference is how the `id` register is populated: explicit calls take it from
-the second user-supplied argument, while registered calls auto-generate a
-`Load` instruction for the function name string. The VM cannot distinguish
-between the two at runtime.
-
-**Resolution order** in `determine_call_target()`:
-1. `__builtin_host_await` (magic 2-argument form)
-2. Registered host-await builtins (matched by **bare** function name only)
-3. User-defined functions (matched by package-qualified path)
-4. Standard builtins (matched by bare function name)
-
-Registered names shadow both user-defined functions and standard builtins.
-This means `time.parse_duration_ns` can be overridden to route through the
-host instead of the built-in Rust implementation.
-
-**Only unqualified calls are intercepted.** Registration matches a call by
-the name *as written in the policy*. A bare call — `lookup(x)` — is
-intercepted and compiled to a `HostAwait`. A package-qualified call —
-`data.pkg.lookup(x)` — is **not** intercepted; it is resolved normally, as
-if the name were never registered.
-
-```rego
-# "lookup" is registered as a host-await builtin.
-
-package other
-import rego.v1
-lookup(k) := k            # an ordinary rule that happens to share the name
-
-package demo
-import rego.v1
-a := lookup(input.k)             # intercepted     -> HostAwait
-b := data.other.lookup(input.k)  # NOT intercepted -> calls other.lookup
-```
-
-The qualified form is resolved exactly as it would be without registration:
-if a rule exists at that path it is called, otherwise compilation fails with
-`Unknown function`. (A standard builtin like `count` has no qualified form at
-all, so `data.pkg.count(x)` is always an `Unknown function` error, registered
-or not.)
-
-**Argument handling**: The `HostAwait` instruction carries a single `arg`
-register. Registered builtins must use `arg_count: 1`; the compiler rejects
-`arg_count > 1` at registration time. To pass multiple values, use object
-packing: `lookup({"user": x, "resource": y})`.
-
 ---
 
 ## Halt instruction

docs/value/set.md

@@ -1,79 +0,0 @@
-# Set
-
-Opaque container for `Value::Set`'s element storage, enabling alternative
-backends without call-site changes. Pairs with [`Object`](object.md) under
-a shared design philosophy.
-
-## Design
-
-`Set` wraps a `BTreeSet<Value>` today but exposes only a curated method
-surface (`contains`, `insert`, `remove`, `iter`, `iter_sorted`, `cursor`,
-`is_subset`, `intersection`, `union`, `difference`, serde). The inner set is
-private — callers cannot pattern-match it or hand out references to the
-backing store, so the backend can change without churn at the ~400 call
-sites that name `Set`.
-
-Two iteration methods reflect a real distinction: `iter()` makes no
-ordering promise (lets future hash/lazy backends skip sorting work);
-`iter_sorted()` guarantees deterministic order (used by serialization and
-`Ord`). Cursor types support incremental traversal needed by the RVM
-iteration state without exposing iterator internals.
-
-`Ord` is hand-written against `iter_sorted` rather than derived, so two
-backends that store elements differently still compare equal when their
-sorted contents match.
-
-## Scenarios enabled
-
-- **Hash-backed storage** — `FxHashSet`-backed inner turns O(log n)
-  membership checks into O(1); swap in for policies where elements aren't
-  compared ordinally.
-- **Lazy/streaming** — wrap a `LazySetProvider` (DB query, CBOR slice,
-  REST endpoint) and materialize elements on demand.
-- **Arena allocation** — bumpalo-backed inner for eval-time temporaries;
-  drop the whole arena at query end with zero per-element free cost.
-- **FFI-backed** — host-language collections (Python set, JS Set) without
-  copying into Rust.
-- **Bloom-filter pre-check** — front a large backing set with a Bloom
-  filter for fast negative-membership tests on read-mostly allowlists.
-
-## Known use cases
-
-- **Azure Policy allowed-values lists** — large allowlists (allowed
-  regions, allowed SKUs, allowed image publishers) compared against
-  single resource values. Hash-backed Set turns O(log n) membership
-  checks into O(1).
-- **SARIF rule deduplication** — collapsing duplicate rule references
-  across thousands of result records. Set-of-objects with structural
-  hashing avoids the BTreeSet sort cost on every insert.
-- **RBAC role membership** — checking whether a principal belongs to any
-  of dozens of role groups. Hash-backed Set scales to thousands of
-  members with constant-time membership.
-- **Azure Policy denied-resource-type sets** — exclusion lists used by
-  deny-effect policies; same hash-backed pattern as allowed-values.
-
-## Precedents
-
-- **`indexmap::IndexSet`** — opaque newtype that pairs hash lookup with
-  insertion-order iteration; precedent for "Set with alternative
-  ordering semantics behind a stable surface."
-- **`hashbrown::HashSet`** — backs Rust's `std::collections::HashSet`
-  and demonstrates a fully swappable backend behind a stable API.
-- **`roaring::RoaringBitmap`** — bitmap-backed integer set. Not
-  applicable to `Value` keys directly, but a precedent for the broader
-  idea of "Set with alternative storage representations chosen by
-  workload shape."
-- **`serde_json`** — note that `serde_json` has no Set equivalent: its
-  Value enum collapses sets into arrays. Regorus's first-class Set with
-  storage abstraction is therefore unusually well-positioned among JSON
-  value libraries.
-
-## Notes
-
-Cursor types are `pub` (referenced by public `IterationState`) but not
-re-exported at the crate root. The crate-internal `Set`/`Map`/`MapEntry`
-aliases for `BTreeSet`/`BTreeMap` in `lib.rs` were renamed to
-`MapSet`/`Map`/`MapEntry` when this type landed, to free the `Set` name
-for the new public type. Future Array and String abstractions follow the
-same shape — see `docs/value/array.md` and `docs/value/string.md` when
-they land.

src/compiled_policy.rs

@@ -217,7 +217,7 @@ pub(crate) struct CompiledPolicyData {
     pub(crate) default_rules: Map<String, Vec<DefaultRuleInfo>>,
     pub(crate) imports: BTreeMap<String, Ref<Expr>>,
     pub(crate) functions: FunctionTable,
-    pub(crate) rule_paths: MapSet<String>,
+    pub(crate) rule_paths: Set<String>,
     #[cfg(feature = "azure_policy")]
     pub(crate) target_info: Option<TargetInfo>,
     #[cfg(feature = "azure_policy")]

src/engine.rs

@@ -434,13 +434,7 @@ impl Engine {
 
     /// Add data document.
     ///
-    /// The specified data document is deep-merged into the existing data document. Nested
-    /// objects are merged recursively (matching OPA's data-document merge), so adding
-    /// `{ "a": { "x": 1 } }` and then `{ "a": { "y": 2 } }` yields `{ "a": { "x": 1, "y": 2 } }`.
-    /// A conflict — the same path holding two different values — is an error.
-    ///
-    /// The merge is atomic: if any conflict is detected (including one deep in a nested
-    /// document), the call fails and the existing data document is left unchanged.
+    /// The specified data document is merged into existing data document.
     ///
     /// ```
     /// # use regorus::*;
@@ -459,13 +453,9 @@ impl Engine {
     /// // Merge { "z" : 3 }. Conflict error.
     /// assert!(engine.add_data(Value::from_json_str(r#"{ "z" : 3 }"#)?).is_err());
     ///
-    /// // Nested objects are deep-merged. Merge { "y" : { "a" : 10 } } then { "y" : { "b" : 20 } }.
-    /// assert!(engine.add_data(Value::from_json_str(r#"{ "y" : { "a" : 10 } }"#)?).is_ok());
-    /// assert!(engine.add_data(Value::from_json_str(r#"{ "y" : { "b" : 20 } }"#)?).is_ok());
-    ///
     /// assert_eq!(
     ///   engine.eval_query("data".to_string(), false)?.result[0].expressions[0].value,
-    ///   Value::from_json_str(r#"{ "x": 1, "y": { "a": 10, "b": 20 }, "z": 2}"#)?
+    ///   Value::from_json_str(r#"{ "x": 1, "y": {}, "z": 2}"#)?
     /// );
     /// # Ok(())
     /// # }
@@ -474,29 +464,8 @@ impl Engine {
         if data.as_object().is_err() {
             bail!("data must be object");
         }
-
-        // add_data is all-or-nothing; the atomic strategy differs by build because the failure
-        // modes do: a conflict (same path, differing values) is possible everywhere, an
-        // allocator-limit failure mid-merge only under `allocator-memory-limits`.
-        #[cfg(not(feature = "allocator-memory-limits"))]
-        {
-            // Conflict is the only failure mode; `check_mergeable` catches it up front without
-            // allocating, so validate then deep-merge in place (zero-copy fast path).
-            self.interpreter.get_init_data().check_mergeable(&data)?;
-            self.prepared = false;
-            self.interpreter.get_init_data_mut().deep_merge(data)
-        }
-        #[cfg(feature = "allocator-memory-limits")]
-        {
-            // A limit failure can strike mid-merge and can't be predicted, so merge into a
-            // candidate and commit only on success. `Value` is copy-on-write, so only touched
-            // subtrees are cloned.
-            let mut candidate = self.interpreter.get_init_data().clone();
-            candidate.deep_merge(data)?;
-            *self.interpreter.get_init_data_mut() = candidate;
-            self.prepared = false;
-            Ok(())
-        }
+        self.prepared = false;
+        self.interpreter.get_init_data_mut().merge(data)
     }
 
     /// Get the data document.

src/interpreter.rs

@@ -60,17 +60,6 @@ enum FunctionModifier {
     Value(Value),
 }
 
-/// How [`Interpreter::update_data`] merges a rule's value into the data document.
-#[derive(Debug, Clone, Copy)]
-enum RuleValueMerge {
-    /// Shallow-merge keeping disjoint keys, so rules sharing a path prefix scaffold into one
-    /// object (`a.foo` + `a.bar` → one `a`) instead of conflicting.
-    Combine,
-    /// Complete-rule semantics: existing value must be absent or exactly equal, else conflict.
-    /// Used for zero-arg function outputs (`f() := …`), which OPA treats like complete rules.
-    Strict,
-}
-
 type RuleValues = BTreeMap<Vec<Value>, (Value, Ref<Expr>)>;
 
 #[derive(Debug)]
@@ -1258,34 +1247,7 @@ impl Interpreter {
             // Apply with modifiers.
             for wm in &stmt.with_mods {
                 let path = Parser::get_path_ref_components(&wm.refr)?;
-                let mut path: Vec<String> = path.iter().map(|s| s.text().to_string()).collect();
-
-                // Matching OPA, a leading import alias is rewritten before
-                // any lookups: functions register as overrides below,
-                // anything else becomes a data override. Only the alias
-                // component is replaced so bracketed keys containing dots
-                // survive the rewrite.
-                let rewritten: Option<Vec<String>> = match path.split_first() {
-                    Some((head, rest)) if head.as_str() != "data" => {
-                        self.lookup_import(head).and_then(|import_expr| {
-                            // Use the import target's parsed components, not
-                            // its dot-joined string, so bracketed keys
-                            // containing dots survive in the import path too.
-                            let comps = Parser::get_path_ref_components(import_expr).ok()?;
-                            Some(
-                                comps
-                                    .iter()
-                                    .map(|s| s.text().to_string())
-                                    .chain(rest.iter().cloned())
-                                    .collect(),
-                            )
-                        })
-                    }
-                    _ => None,
-                };
-                if let Some(new_path) = rewritten {
-                    path = new_path;
-                }
+                let path: Vec<&str> = path.iter().map(|s| s.text()).collect();
                 let mut target = path.join(".");
 
                 let mut target_is_function = self.lookup_function_by_name(&target).is_some()
@@ -1324,17 +1286,11 @@ impl Interpreter {
                             if self.lookup_function_by_name(&function_path).is_none() {
                                 // Lookup without current module path prefixed.
                                 function_path = get_path_string(&wm.r#as, None)?;
-                                if self.lookup_function_by_name(&function_path).is_none() {
-                                    // Resolve an aliased replacement before builtins.
-                                    let resolved = self
-                                        .resolve_fcn_path_through_imports(&function_path)
-                                        .filter(|r| self.compiled_policy.functions.contains_key(r));
-                                    if let Some(resolved) = resolved {
-                                        function_path = resolved;
-                                    } else if !Self::is_builtin(wm.r#as.span(), &function_path) {
-                                        // bail!(wm.r#as.span().error("could not evaluate expression"));
-                                        skip_exec = true;
-                                    }
+                                if self.lookup_function_by_name(&function_path).is_none()
+                                    && !Self::is_builtin(wm.r#as.span(), &function_path)
+                                {
+                                    // bail!(wm.r#as.span().error("could not evaluate expression"));
+                                    skip_exec = true;
                                 }
                             }
                             self.with_functions
@@ -2404,72 +2360,6 @@ impl Interpreter {
         }
     }
 
-    /// Look up the import of the current module with the given alias, e.g.
-    /// the `data.a.b` import expression for `b` after `import data.a.b`.
-    fn lookup_import(&self, alias: &str) -> Option<&Ref<Expr>> {
-        if self.compiled_policy.imports.is_empty() {
-            return None;
-        }
-        let import_key = format!("{}.{}", self.current_module_path, alias);
-        self.compiled_policy.imports.get(&import_key)
-    }
-
-    /// Look up the dot-joined target path of an import of the current module
-    /// with the given alias, e.g. `data.a.b` for `b` after `import data.a.b`.
-    fn lookup_import_alias(&self, alias: &str) -> Option<String> {
-        get_path_string(self.lookup_import(alias)?, None).ok()
-    }
-
-    /// Rewrite a path whose leading component is an import alias of the
-    /// current module to the import's target, e.g. `b.f` to `data.a.b.f`
-    /// after `import data.a.b`.
-    fn rewrite_path_through_imports(&self, path: &str) -> Option<String> {
-        if path.starts_with("data.") {
-            return None;
-        }
-
-        let (alias, rest) = match path.split_once('.') {
-            Some((alias, rest)) => (alias, Some(rest)),
-            None => (path, None),
-        };
-        let target = self.lookup_import_alias(alias)?;
-        Some(match rest {
-            Some(rest) => format!("{target}.{rest}"),
-            None => target,
-        })
-    }
-
-    /// Rewrite an import-aliased call path to its target, e.g. `b.f(1)` to
-    /// `data.a.b.f` after `import data.a.b`. Resolves only when the target is
-    /// a known function or default function, so an alias whose target defines
-    /// the called function shadows a like-named builtin namespace, while other
-    /// spellings keep their prior meaning (e.g. a builtin call). OPA instead
-    /// rewrites aliases unconditionally and rejects calls to a missing target
-    /// at compile time.
-    fn resolve_fcn_path_through_imports(&self, path: &str) -> Option<String> {
-        let candidate = self.rewrite_path_through_imports(path)?;
-        (self.compiled_policy.functions.contains_key(&candidate)
-            || self.is_default_function(&candidate))
-        .then_some(candidate)
-    }
-
-    /// True if `path` is the exact path of a `default` function rule.
-    /// `default_rules` also indexes every prefix of a rule path, so it cannot
-    /// be consulted alone: `rule_paths` holds only exact rule paths, and the
-    /// non-empty argument list distinguishes functions from value rules.
-    fn is_default_function(&self, path: &str) -> bool {
-        self.compiled_policy.rule_paths.contains(path)
-            && self
-                .compiled_policy
-                .default_rules
-                .get(path)
-                .is_some_and(|rules| {
-                    rules.iter().any(|(rule, _)| {
-                        matches!(rule.as_ref(), Rule::Default { args, .. } if !args.is_empty())
-                    })
-                })
-    }
-
     fn eval_builtin_call(
         &mut self,
         span: &Span,
@@ -2641,13 +2531,6 @@ impl Interpreter {
             param_values.push(self.eval_expr(p)?);
         }
 
-        // Resolve a leading import alias before the `with` override and builtin
-        // lookups, so an override keyed by the full path reaches aliased calls
-        // and the alias shadows a like-named builtin namespace (matching OPA).
-        let fcn_path = self
-            .resolve_fcn_path_through_imports(&fcn_path)
-            .unwrap_or(fcn_path);
-
         let orig_fcn_path = fcn_path.clone();
 
         let mut with_functions_saved = None;
@@ -2824,12 +2707,7 @@ impl Interpreter {
             let value = match self.eval_rule_bodies(ctx, span, bodies) {
                 Ok(v) => v,
                 Err(e) => {
-                    // If the rule produces an error, save the error. Restore
-                    // the caller's module even so: leaving the callee's module
-                    // in place would make the rest of the caller's body
-                    // resolve paths through the wrong module's imports when
-                    // the error is swallowed below in non-strict mode.
-                    self.set_current_module(prev_module)?;
+                    // If the rule produces an error, save the error.
                     errors.push(e);
                     self.scopes = scopes;
                     continue;
@@ -3530,23 +3408,6 @@ impl Interpreter {
         }
     }
 
-    /// Materialize a complete-rule value: the existing value must be absent or *exactly equal*
-    /// to `new`, else it is a conflict.
-    ///
-    /// Unlike the shallow [`Self::merge_rule_value`], differing outputs conflict instead of
-    /// combining — `f() := {"a": 1}` and `f() := {"b": 2}` conflict — matching OPA's semantics
-    /// for zero-arg functions.
-    fn merge_rule_value_strict(span: &Span, value: &mut Value, new: Value) -> Result<()> {
-        if *value == Value::Undefined {
-            *value = new;
-            Ok(())
-        } else if *value == new {
-            Ok(())
-        } else {
-            Err(span.error("rules should not produce multiple outputs."))
-        }
-    }
-
     pub fn get_path_string(refr: &Expr, document: Option<&str>) -> Result<String> {
         let mut comps = vec![];
         let mut expr_opt = Some(refr);
@@ -3802,7 +3663,6 @@ impl Interpreter {
         _refr: &Expr,
         path: &[&str],
         value: Value,
-        merge: RuleValueMerge,
     ) -> Result<()> {
         if value == Value::Undefined {
             return Ok(());
@@ -3810,10 +3670,7 @@ impl Interpreter {
         // Ensure that path is created.
         let vref = Self::make_or_get_value_mut(&mut self.data, path)?;
         if Self::get_value_chained(self.init_data.clone(), path) == Value::Undefined {
-            match merge {
-                RuleValueMerge::Strict => Self::merge_rule_value_strict(span, vref, value),
-                RuleValueMerge::Combine => Self::merge_rule_value(span, vref, value),
-            }
+            Self::merge_rule_value(span, vref, value)
         } else {
             // Retain specified value.
             Ok(())
@@ -3921,13 +3778,7 @@ impl Interpreter {
                         // `a` is created as an empty object.
                         if let Some((_, prefix)) = path.split_last() {
                             if !prefix.is_empty() {
-                                self.update_data(
-                                    span,
-                                    refr,
-                                    prefix,
-                                    Value::new_object(),
-                                    RuleValueMerge::Combine,
-                                )?;
+                                self.update_data(span, refr, prefix, Value::new_object())?;
                             }
                         }
 
@@ -3939,13 +3790,7 @@ impl Interpreter {
                             };
 
                             let value = self.eval_rule_bodies(ctx, span, rule_body)?;
-                            self.update_data(
-                                refr.span(),
-                                refr,
-                                &path[..],
-                                value,
-                                RuleValueMerge::Strict,
-                            )?;
+                            self.update_data(refr.span(), refr, &path[..], value)?;
                         }
                     }
                 }
@@ -4192,7 +4037,6 @@ impl Interpreter {
                         rule_refr,
                         &prefix_path,
                         Value::new_object(),
-                        RuleValueMerge::Combine,
                     )?;
                 }
             }

src/languages/rego/compiler/function_calls.rs

@@ -17,20 +17,8 @@ use crate::lexer::Span;
 use crate::rvm::instructions::{BuiltinCallParams, FunctionCallParams};
 use crate::rvm::Instruction;
 use crate::utils::get_path_string;
-use crate::value::Value;
-use alloc::{
-    format,
-    string::{String, ToString},
-    vec::Vec,
-};
+use alloc::{format, string::ToString, vec::Vec};
 
-/// Resolved destination of a Rego function-call expression. Produced by
-/// [`Compiler::determine_call_target`] and consumed by
-/// [`Compiler::compile_function_call`] to choose which instruction to emit.
-/// Carrying the discrimination in the type (rather than re-matching on a
-/// magic name at the emit site) keeps the host-await handling honest under
-/// future refactors — the compiler will refuse to build if a new variant is
-/// added without updating every match site.
 enum CallTarget {
     User {
         rule_index: u16,
@@ -40,14 +28,9 @@ enum CallTarget {
         builtin_index: u16,
         expected_args: Option<usize>,
     },
-    /// Explicit `__builtin_host_await(arg, id)` call form (2 user args).
-    /// The identifier is supplied by the policy author at runtime via the
-    /// second argument register.
-    ExplicitHostAwait,
-    /// A registered host-awaitable builtin invoked by its registered name
-    /// (1 user arg). The identifier is the registered name itself and is
-    /// baked into the bytecode as a string literal at compile time.
-    RegisteredHostAwait { identifier: String },
+    HostAwait {
+        expected_args: Option<usize>,
+    },
 }
 
 impl<'a> Compiler<'a> {
@@ -63,9 +46,6 @@ impl<'a> Compiler<'a> {
         let original_fcn_path = fcn_path.clone();
         let full_fcn_path = if self.policy.inner.rules.contains_key(&fcn_path) {
             fcn_path
-        } else if let Some(resolved) = self.resolve_fcn_path_through_imports(&original_fcn_path) {
-            // Resolve a leading import alias before module-prefixing and builtins.
-            resolved
         } else {
             get_path_string(fcn, Some(&self.current_package))
                 .map_err(|_| CompilerError::InvalidFunctionExpressionWithPackage.at(&span))?
@@ -79,11 +59,7 @@ impl<'a> Compiler<'a> {
         let expected_args = match &call_target {
             CallTarget::User { expected_args, .. } => *expected_args,
             CallTarget::Builtin { expected_args, .. } => *expected_args,
-            // Both host-await variants have a known fixed arity; carrying it
-            // in the variant lets the rest of the compiler depend on the type
-            // rather than re-matching on the magic name `__builtin_host_await`.
-            CallTarget::ExplicitHostAwait => Some(2),
-            CallTarget::RegisteredHostAwait { .. } => Some(1),
+            CallTarget::HostAwait { expected_args } => *expected_args,
         };
 
         if let Some(expected) = expected_args {
@@ -150,8 +126,7 @@ impl<'a> Compiler<'a> {
                 });
                 self.emit_instruction(Instruction::BuiltinCall { params_index }, &span);
             }
-            CallTarget::ExplicitHostAwait => {
-                // Explicit __builtin_host_await(arg, id) — 2 arguments
+            CallTarget::HostAwait { .. } => {
                 if arg_regs.len() != 2 {
                     return Err(CompilerError::General {
                         message: format!(
@@ -161,6 +136,7 @@ impl<'a> Compiler<'a> {
                     }
                     .at(&span));
                 }
+
                 self.emit_instruction(
                     Instruction::HostAwait {
                         dest,
@@ -170,37 +146,6 @@ impl<'a> Compiler<'a> {
                     &span,
                 );
             }
-            CallTarget::RegisteredHostAwait { identifier } => {
-                // Registered host-awaitable builtin — the identifier is the
-                // registered name and is baked into the bytecode as a literal.
-                if arg_regs.len() != 1 {
-                    return Err(CompilerError::General {
-                        message: format!(
-                            "host-awaitable builtin '{}' expects exactly 1 argument, got {}",
-                            identifier,
-                            arg_regs.len()
-                        ),
-                    }
-                    .at(&span));
-                }
-                let id_reg = self.alloc_register();
-                let literal_idx = self.add_literal(Value::String(identifier.into()));
-                self.emit_instruction(
-                    Instruction::Load {
-                        dest: id_reg,
-                        literal_idx,
-                    },
-                    &span,
-                );
-                self.emit_instruction(
-                    Instruction::HostAwait {
-                        dest,
-                        arg: arg_regs[0],
-                        id: id_reg,
-                    },
-                    &span,
-                );
-            }
         }
 
         if let Some((plan, plan_span)) = &out_param_plan {
@@ -223,37 +168,6 @@ impl<'a> Compiler<'a> {
         Ok(dest)
     }
 
-    /// Rewrite an import-aliased call path to its target, e.g. `b.f(1)` to
-    /// `data.a.b.f` after `import data.a.b`. Resolves only when the target is
-    /// a known function (the `rules` map cannot be used here: it also indexes
-    /// value rules and every rule-path prefix, which must not become callable
-    /// through an alias), so an alias whose target defines the called
-    /// function shadows a like-named builtin namespace, while other spellings
-    /// keep their prior meaning (e.g. a builtin call). OPA instead rewrites
-    /// aliases unconditionally and rejects calls to a missing target at
-    /// compile time.
-    fn resolve_fcn_path_through_imports(&self, path: &str) -> Option<String> {
-        if self.policy.inner.imports.is_empty() || path.starts_with("data.") {
-            return None;
-        }
-        let (alias, rest) = match path.split_once('.') {
-            Some((alias, rest)) => (alias, Some(rest)),
-            None => (path, None),
-        };
-        let import_key = format!("{}.{}", self.current_package, alias);
-        let import_expr = self.policy.inner.imports.get(&import_key)?;
-        let target = get_path_string(import_expr, None).ok()?;
-        let candidate = match rest {
-            Some(rest) => format!("{target}.{rest}"),
-            None => target,
-        };
-        self.policy
-            .inner
-            .functions
-            .contains_key(&candidate)
-            .then_some(candidate)
-    }
-
     fn lookup_builtin_arity(&self, name: &str) -> Option<usize> {
         if name == "print" {
             Some(2)
@@ -273,26 +187,8 @@ impl<'a> Compiler<'a> {
         span: &Span,
     ) -> Result<CallTarget> {
         if original_fcn_path == "__builtin_host_await" {
-            return Ok(CallTarget::ExplicitHostAwait);
-        }
-
-        // Check registered host-awaitable builtins. Registered builtins are
-        // restricted to arg_count == 1 at registration time (see
-        // `Compiler::register_host_await_builtin`), so the variant doesn't
-        // need to carry an arity — it's fixed at 1.
-        //
-        // We deliberately match against `original_fcn_path` only, not
-        // `full_fcn_path`. Registration intercepts the *unqualified* call
-        // form (e.g. `lookup(x)` inside the policy's own package). A
-        // package-qualified call like `data.other.lookup(x)` is left to
-        // resolve through the normal user-defined / builtin path, so a
-        // registered name does not leak into unrelated packages that
-        // happen to expose a rule with the same identifier. This is
-        // documented on `register_host_await_builtin`; the
-        // `registered_host_await.yaml` suite pins the behavior.
-        if self.host_await_builtins.contains_key(original_fcn_path) {
-            return Ok(CallTarget::RegisteredHostAwait {
-                identifier: original_fcn_path.to_string(),
+            return Ok(CallTarget::HostAwait {
+                expected_args: Some(2),
             });
         }
 

src/languages/rego/compiler/loops.rs

@@ -13,7 +13,7 @@ use crate::ast::{self, ExprRef, LiteralStmt, Query};
 use crate::compiler::destructuring_planner::plans::BindingPlan;
 use crate::compiler::hoist::{HoistedLoop, LoopType};
 use crate::lexer::Span;
-use crate::rvm::instructions::{GuardMode, LoopMode, LoopStartParams};
+use crate::rvm::instructions::{LoopMode, LoopStartParams};
 use crate::rvm::Instruction;
 use crate::Value;
 use alloc::format;
@@ -197,19 +197,6 @@ impl<'a> Compiler<'a> {
             *end = loop_end;
         }
 
-        // The loop writes its overall pass/fail into `result_reg`
-        // (`success_count == total_iterations` for `Every`). The enclosing query
-        // must fail (evaluate to undefined) when the quantifier does not hold, so
-        // guard on `result_reg` here. Without this the `every` result is computed
-        // but discarded, leaving the surrounding rule to always succeed.
-        self.emit_instruction(
-            Instruction::Guard {
-                register: result_reg,
-                mode: GuardMode::Condition,
-            },
-            span,
-        );
-
         Ok(())
     }
 
@@ -325,25 +312,6 @@ impl<'a> Compiler<'a> {
             *end = loop_end;
         }
 
-        // A hoisted index-iteration loop inside an `every` body acts as a
-        // condition on the current iteration: if the indexed reference matches
-        // nothing the iteration must fail. The `every` body emits no context
-        // yield, so the loop result register is otherwise discarded (same
-        // situation as `some ... in`). Guard on it so a non-matching indexed
-        // reference fails the enclosing `every` iteration.
-        if matches!(
-            self.context_stack.last().map(|c| &c.context_type),
-            Some(ContextType::Every)
-        ) {
-            self.emit_instruction(
-                Instruction::Guard {
-                    register: result_reg,
-                    mode: GuardMode::Condition,
-                },
-                collection.span(),
-            );
-        }
-
         Ok(())
     }
 

src/languages/rego/compiler/mod.rs

@@ -26,9 +26,7 @@ use crate::rvm::program::{Program, RuleType, SpanInfo};
 use crate::CompiledPolicy;
 use crate::Value;
 use alloc::collections::{BTreeMap, BTreeSet};
-use alloc::format;
 use alloc::string::String;
-use alloc::string::ToString as _;
 use alloc::vec;
 use alloc::vec::Vec;
 use indexmap::IndexMap;
@@ -141,10 +139,6 @@ pub struct Compiler<'a> {
     current_call_stack: Vec<u16>,
     entry_points: IndexMap<String, usize>,
     soft_assert_mode: bool,
-    /// Registered host-awaitable builtins: name → expected arg count.
-    /// When the compiler encounters a call to one of these names, it emits a
-    /// `HostAwait` instruction instead of a regular function or builtin call.
-    host_await_builtins: BTreeMap<String, usize>,
 }
 
 impl<'a> Compiler<'a> {
@@ -179,75 +173,9 @@ impl<'a> Compiler<'a> {
             current_call_stack: Vec::new(),
             entry_points: IndexMap::new(),
             soft_assert_mode: false,
-            host_await_builtins: BTreeMap::new(),
         }
     }
 
-    /// Register a function name as a host-awaitable builtin.
-    ///
-    /// When the compiler encounters an **unqualified** call to `name(arg)`
-    /// (i.e. `name(arg)` from inside the policy's own package, not
-    /// `data.pkg.name(arg)` or any other package-qualified form), it will
-    /// emit a `HostAwait` instruction with the argument and `name` as the
-    /// identifier, instead of treating it as a user-defined or standard
-    /// builtin function.
-    ///
-    /// Package-qualified calls (e.g. `data.other.name(arg)`) are **not**
-    /// intercepted by registration. Those resolve through the normal
-    /// user-defined / builtin lookup against their fully-qualified path
-    /// (`data.other.name`).
-    ///
-    /// `arg_count` must be exactly 1. The `HostAwait` instruction carries a
-    /// single argument register; use object packing to pass multiple values
-    /// (e.g. `name({"key1": v1, "key2": v2})`).
-    ///
-    /// Returns `Err` when:
-    /// - `name` is the reserved identifier `__builtin_host_await`,
-    /// - `name` is empty, only whitespace, or has leading/trailing
-    ///   whitespace (whitespace-padded names would never match the
-    ///   trimmed identifier produced by the Rego parser, creating dead
-    ///   registrations),
-    /// - `name` is already registered (duplicate registration is rejected
-    ///   rather than silently overwritten),
-    /// - `arg_count` is not exactly 1.
-    pub fn register_host_await_builtin(&mut self, name: &str, arg_count: usize) -> Result<()> {
-        if name == "__builtin_host_await" {
-            return Err(CompilerError::General {
-                message: "__builtin_host_await is a reserved name and cannot be registered as a host-await builtin"
-                    .to_string(),
-            }
-            .into());
-        }
-        if name.is_empty() || name != name.trim() {
-            return Err(CompilerError::General {
-                message: format!(
-                    "host-await builtin name {name:?} must not be empty or contain leading/trailing whitespace"
-                ),
-            }
-            .into());
-        }
-        if self.host_await_builtins.contains_key(name) {
-            return Err(CompilerError::General {
-                message: format!(
-                    "host-await builtin '{name}' is already registered; \
-                     duplicate registration is not allowed"
-                ),
-            }
-            .into());
-        }
-        if arg_count != 1 {
-            return Err(CompilerError::General {
-                message: format!(
-                    "registered host-await builtin '{name}' must have arg_count == 1, got {arg_count}. \
-                     Use object packing to pass multiple values."
-                ),
-            }
-            .into());
-        }
-        self.host_await_builtins.insert(name.to_string(), arg_count);
-        Ok(())
-    }
-
     pub(super) fn with_soft_assert_mode<F, R>(&mut self, enabled: bool, f: F) -> R
     where
         F: FnOnce(&mut Self) -> R,

src/languages/rego/compiler/queries.rs

@@ -70,31 +70,12 @@ impl<'a> Compiler<'a> {
                     ..
                 } = &stmt.literal
                 {
-                    let some_result_reg = self.compile_some_in_loop_with_remaining_statements(
+                    self.compile_some_in_loop_with_remaining_statements(
                         key,
                         value,
                         collection,
                         &stmts[idx..],
                     )?;
-                    // Inside an `every` body a `some ... in` acts as a condition
-                    // on the current iteration: if it matches nothing the
-                    // iteration must fail. Unlike a top-level rule body (where
-                    // per-iteration context yields produce the results), the
-                    // `every` body has no yield, so the loop result register is
-                    // otherwise discarded. Guard on it so a `some` that matches
-                    // nothing fails the enclosing `every` iteration.
-                    if matches!(
-                        self.context_stack.last().map(|c| &c.context_type),
-                        Some(ContextType::Every)
-                    ) {
-                        self.emit_instruction(
-                            Instruction::Guard {
-                                register: some_result_reg,
-                                mode: GuardMode::Condition,
-                            },
-                            &stmt.span,
-                        );
-                    }
                     return Ok(());
                 }
             }

src/languages/rego/compiler/rules.rs

@@ -234,20 +234,8 @@ impl<'a> Compiler<'a> {
     pub fn compile_from_policy(
         policy: &CompiledPolicy,
         entry_points: &[&str],
-    ) -> Result<Arc<Program>> {
-        Self::compile_from_policy_with_host_await(policy, entry_points, &[])
-    }
-
-    /// Compile from a CompiledPolicy to RVM Program with registered host-awaitable builtins.
-    pub fn compile_from_policy_with_host_await(
-        policy: &CompiledPolicy,
-        entry_points: &[&str],
-        host_await_builtins: &[(&str, usize)],
     ) -> Result<Arc<Program>> {
         let mut compiler = Compiler::with_policy(policy);
-        for &(name, arg_count) in host_await_builtins {
-            compiler.register_host_await_builtin(name, arg_count)?;
-        }
         compiler.current_rule_path = "".to_string();
         let rules = policy.get_rules();
 

src/lib.rs

@@ -205,10 +205,10 @@ pub use alloc::sync::Arc as Rc;
 pub use alloc::rc::Rc;
 
 #[cfg(feature = "std")]
-use std::collections::{hash_map::Entry as MapEntry, HashMap as Map, HashSet as MapSet};
+use std::collections::{hash_map::Entry as MapEntry, HashMap as Map, HashSet as Set};
 
 #[cfg(not(feature = "std"))]
-use alloc::collections::{btree_map::Entry as MapEntry, BTreeMap as Map, BTreeSet as MapSet};
+use alloc::collections::{btree_map::Entry as MapEntry, BTreeMap as Map, BTreeSet as Set};
 
 use alloc::{
     borrow::ToOwned as _,

src/number.rs

@@ -27,14 +27,10 @@ use num_traits::{One, Signed, ToPrimitive, Zero};
 use serde::ser::Serializer;
 use serde::Serialize;
 
-#[cfg(feature = "verus")]
-use vstd::prelude::*;
-
 use crate::*;
 
 pub type BigInt = NumBigInt;
 
-#[cfg_attr(feature = "verus", verus_verify)]
 const F64_SAFE_INTEGER: f64 = 9_007_199_254_740_992.0; // 2^53
 
 #[derive(Clone)]
@@ -144,9 +140,13 @@ impl Number {
         }
     }
 
+    fn ints_to_bigint(a: &Number, b: &Number) -> (BigInt, BigInt) {
+        (a.to_bigint_owned().unwrap(), b.to_bigint_owned().unwrap())
+    }
+
     fn normalize_float(value: f64) -> Number {
-        if let Some(i) = Self::float_to_small_bigint(value) {
-            return Self::from_bigint_owned(i);
+        if let Some(int) = Self::float_to_small_bigint(value) {
+            return Self::from_bigint_owned(int);
         }
         Number::Float(value)
     }
@@ -587,11 +587,7 @@ impl Number {
                 }
             }
             (Number::Int(a), Number::Int(b)) => {
-                if *a == i64::MIN && *b == -1 {
-                    // Rust panics on i64::MIN % -1i64, so handle it specially
-                    let quotient = BigInt::from(*a) / BigInt::from(*b);
-                    Ok(Number::from_bigint_owned(quotient))
-                } else if *a % *b == 0 {
+                if *a % *b == 0 {
                     if let Some(q) = a.checked_div(*b) {
                         Ok(Number::Int(q))
                     } else {
@@ -660,17 +656,15 @@ impl Number {
     }
 
     pub fn modulo(self, rhs: &Self) -> Result<Number> {
-        // Conversion fails for a non-integral float, and also for an integral
-        // one whose magnitude exceeds 2^53, which cannot be represented exactly.
-        let (a, b) = match (self.to_bigint_owned(), rhs.to_bigint_owned()) {
-            (Some(a), Some(b)) => (a, b),
-            _ => bail!("modulo on floating-point number"),
-        };
-
-        if b.is_zero() {
+        if rhs.is_zero() {
             bail!("modulo by zero");
         }
 
+        if !self.is_integer() || !rhs.is_integer() {
+            bail!("modulo on floating-point number");
+        }
+
+        let (a, b) = Number::ints_to_bigint(&self, rhs);
         let rem = a % &b;
         Ok(Number::from_bigint_owned(rem))
     }
@@ -691,7 +685,6 @@ impl Number {
         }
     }
 
-    #[allow(clippy::if_then_some_else_none)]
     fn ensure_integers(a: &Number, b: &Number) -> Option<(BigInt, BigInt)> {
         if a.is_integer() && b.is_integer() {
             Some((a.to_bigint_owned()?, b.to_bigint_owned()?))
@@ -783,8 +776,7 @@ impl Number {
         if e >= 0 {
             Ok(two_pow_positive(e as u32))
         } else {
-            // Must cast to i64 before negating in case it's i32::MIN
-            let denom = two_pow_positive((-(e as i64)) as u32);
+            let denom = two_pow_positive((-e) as u32);
             Number::from(1u64).divide(&denom)
         }
     }
@@ -793,8 +785,7 @@ impl Number {
         if e >= 0 {
             Ok(ten_pow_positive(e as u32))
         } else {
-            // Must cast to i64 before negating in case it's i32::MIN
-            let denom = ten_pow_positive((-(e as i64)) as u32);
+            let denom = ten_pow_positive((-e) as u32);
             Number::from(1u64).divide(&denom)
         }
     }
@@ -993,67 +984,3 @@ fn scientific_parts_to_bigint(mantissa: &str, exponent: i32) -> Option<BigInt> {
 
     Some(value)
 }
-
-#[cfg(test)]
-mod tests {
-    #![allow(clippy::expect_used)] // tests expect() to assert arithmetic results
-
-    use super::*;
-    use alloc::string::ToString;
-
-    /// Regression test: `i64::MIN / -1` overflows `i64` and panics in Rust's
-    /// native integer division/remainder. `divide` must promote the result
-    /// instead of panicking.
-    #[test]
-    fn i64_min_by_negative_one() {
-        let quotient = Number::Int(i64::MIN)
-            .divide(&Number::Int(-1))
-            .expect("division should succeed");
-
-        // 2^63 does not fit in i64, but does fit in u64.
-        assert_eq!(quotient.as_u64(), Some(9_223_372_036_854_775_808));
-        assert_eq!(quotient.as_i64(), None);
-        assert_eq!(quotient.as_i128(), Some(9_223_372_036_854_775_808));
-        assert_eq!(
-            *quotient.to_big().expect("to_big should succeed"),
-            -BigInt::from(i64::MIN)
-        );
-
-        // The same overflow case reached via the mixed `Int`/`BigInt` path.
-        let big_quotient = Number::Int(i64::MIN)
-            .divide(&Number::BigInt(Rc::new(BigInt::from(-1))))
-            .expect("division should succeed");
-        assert_eq!(big_quotient.as_u64(), Some(9_223_372_036_854_775_808));
-
-        // `i64::MIN % -1` also panics natively; the result must be zero.
-        let remainder = Number::Int(i64::MIN)
-            .modulo(&Number::Int(-1))
-            .expect("modulo should succeed");
-        assert_eq!(remainder.as_i64(), Some(0));
-    }
-
-    #[test]
-    fn modulo_handles_floats_that_are_really_integers() {
-        // An integral float is a valid operand.
-        assert!(matches!(
-            Number::Float(4.0).modulo(&Number::Int(3)),
-            Ok(Number::UInt(1))
-        ));
-        // `1e300` has no fractional part, but it is too large to convert to an
-        // integer exactly. This must report an error, not panic.
-        assert_eq!(
-            Number::Float(1e300)
-                .modulo(&Number::Int(3))
-                .err()
-                .map(|e| e.to_string()),
-            Some("modulo on floating-point number".to_string())
-        );
-        assert_eq!(
-            Number::Int(3)
-                .modulo(&Number::Float(1e300))
-                .err()
-                .map(|e| e.to_string()),
-            Some("modulo on floating-point number".to_string())
-        );
-    }
-}

src/rvm/vm/comprehension.rs

@@ -226,7 +226,6 @@ impl RegoVM {
         }
     }
 
-    #[allow(clippy::if_then_some_else_none)]
     fn execute_comprehension_yield_run_to_completion(
         &mut self,
         value_reg: u8,
@@ -333,7 +332,6 @@ impl RegoVM {
         Ok(())
     }
 
-    #[allow(clippy::if_then_some_else_none)]
     fn execute_comprehension_yield_suspendable(
         &mut self,
         value_reg: u8,

src/rvm/vm/loops.rs

@@ -495,15 +495,8 @@ impl RegoVM {
                     // over a virtual null element.
                     Ok(Some(IterationState::Single { consumed: false }))
                 } else {
-                    // Standard Rego: iterating a non-collection scalar (number,
-                    // string, bool, null, undefined) yields no iterations. For
-                    // `every` this makes the quantifier undefined (it fails) — it
-                    // is NOT vacuously true, which only applies to a genuinely
-                    // empty collection. `any`/`forEach` remain false.
-                    let result = match *mode {
-                        LoopMode::Every => Value::Undefined,
-                        LoopMode::Any | LoopMode::ForEach => Value::Bool(false),
-                    };
+                    // Standard Rego or count/forEach: non-collection → immediate result.
+                    let result = non_collection_result(mode);
                     self.set_register(params.result_reg, result)?;
                     self.pc = usize::from(params.loop_end).saturating_sub(1);
                     Ok(None)

src/tests/interpreter/mod.rs

@@ -24,7 +24,6 @@ use anyhow::{bail, Result};
 use core::num::NonZeroU32;
 use core::time::Duration;
 use serde::{Deserialize, Serialize};
-use std::collections::{BTreeMap, BTreeSet};
 use test_generator::test_resources;
 use timer_test_support::{
     apply_engine_timer, configure_time_source, reset_time_source, GlobalTimerGuard,
@@ -819,446 +818,3 @@ fn test_get_data() -> Result<()> {
 
     Ok(())
 }
-
-#[test]
-fn test_add_data_deep_merge() -> Result<()> {
-    let mut engine = Engine::new();
-
-    // Nested objects under a shared top-level key are deep-merged, not replaced.
-    engine.add_data(Value::from_json_str(r#"{ "a" : { "x" : 1 } }"#)?)?;
-    engine.add_data(Value::from_json_str(r#"{ "a" : { "y" : 2 } }"#)?)?;
-
-    assert_eq!(
-        engine.get_data(),
-        Value::from_json_str(r#"{ "a" : { "x" : 1, "y" : 2 } }"#)?
-    );
-
-    Ok(())
-}
-
-#[test]
-fn test_add_data_deep_merge_multi_level() -> Result<()> {
-    let mut engine = Engine::new();
-
-    // Merging recurses through multiple levels of nesting.
-    engine.add_data(Value::from_json_str(
-        r#"{ "a" : { "b" : { "x" : 1 } }, "top" : 0 }"#,
-    )?)?;
-    engine.add_data(Value::from_json_str(
-        r#"{ "a" : { "b" : { "y" : 2 }, "c" : 3 } }"#,
-    )?)?;
-
-    assert_eq!(
-        engine.get_data(),
-        Value::from_json_str(r#"{ "a" : { "b" : { "x" : 1, "y" : 2 }, "c" : 3 }, "top" : 0 }"#)?
-    );
-
-    Ok(())
-}
-
-#[test]
-fn test_add_data_leaf_conflict_errors() -> Result<()> {
-    let mut engine = Engine::new();
-
-    // A genuine leaf conflict (same nested path, different value) is an error.
-    engine.add_data(Value::from_json_str(r#"{ "a" : { "x" : 1 } }"#)?)?;
-    assert!(engine
-        .add_data(Value::from_json_str(r#"{ "a" : { "x" : 2 } }"#)?)
-        .is_err());
-
-    Ok(())
-}
-
-#[test]
-fn test_add_data_object_vs_scalar_conflict_errors() -> Result<()> {
-    let mut engine = Engine::new();
-
-    // An object cannot be merged with a scalar at the same path.
-    engine.add_data(Value::from_json_str(r#"{ "a" : { "x" : 1 } }"#)?)?;
-    assert!(engine
-        .add_data(Value::from_json_str(r#"{ "a" : 5 }"#)?)
-        .is_err());
-
-    Ok(())
-}
-
-#[test]
-fn test_add_data_equal_leaf_is_noop() -> Result<()> {
-    let mut engine = Engine::new();
-
-    // Re-adding identical data (including equal nested leaves) is tolerated as a no-op.
-    engine.add_data(Value::from_json_str(r#"{ "a" : { "x" : 1 } }"#)?)?;
-    engine.add_data(Value::from_json_str(r#"{ "a" : { "x" : 1 }, "b" : 2 }"#)?)?;
-
-    assert_eq!(
-        engine.get_data(),
-        Value::from_json_str(r#"{ "a" : { "x" : 1 }, "b" : 2 }"#)?
-    );
-
-    Ok(())
-}
-
-#[test]
-fn test_add_data_set_union() -> Result<()> {
-    let mut engine = Engine::new();
-
-    // Sets under a shared key are unioned rather than conflicting (consistent with the
-    // rule-evaluation merge, where partial set rules accumulate elements). JSON cannot express
-    // sets, so the data documents are built via the `Value` API.
-    engine.add_data(Value::from(BTreeMap::from([(
-        Value::from("s"),
-        Value::from(BTreeSet::from([Value::from(1_u64), Value::from(2_u64)])),
-    )])))?;
-    engine.add_data(Value::from(BTreeMap::from([(
-        Value::from("s"),
-        Value::from(BTreeSet::from([Value::from(2_u64), Value::from(3_u64)])),
-    )])))?;
-
-    let expected = Value::from(BTreeMap::from([(
-        Value::from("s"),
-        Value::from(BTreeSet::from([
-            Value::from(1_u64),
-            Value::from(2_u64),
-            Value::from(3_u64),
-        ])),
-    )]));
-    assert_eq!(engine.get_data(), expected);
-
-    Ok(())
-}
-
-#[test]
-fn test_add_data_nested_set_union() -> Result<()> {
-    let mut engine = Engine::new();
-
-    // A set nested under an object key exercises the recursive merge: the outer objects are
-    // deep-merged and the inner sets are then unioned.
-    engine.add_data(Value::from(BTreeMap::from([(
-        Value::from("a"),
-        Value::from(BTreeMap::from([(
-            Value::from("s"),
-            Value::from(BTreeSet::from([Value::from(1_u64)])),
-        )])),
-    )])))?;
-    engine.add_data(Value::from(BTreeMap::from([(
-        Value::from("a"),
-        Value::from(BTreeMap::from([(
-            Value::from("s"),
-            Value::from(BTreeSet::from([Value::from(2_u64)])),
-        )])),
-    )])))?;
-
-    let expected = Value::from(BTreeMap::from([(
-        Value::from("a"),
-        Value::from(BTreeMap::from([(
-            Value::from("s"),
-            Value::from(BTreeSet::from([Value::from(1_u64), Value::from(2_u64)])),
-        )])),
-    )]));
-    assert_eq!(engine.get_data(), expected);
-
-    Ok(())
-}
-
-#[test]
-fn test_add_data_equal_set_is_noop() -> Result<()> {
-    let mut engine = Engine::new();
-
-    // Re-adding an identical set is tolerated as a no-op (not a conflict).
-    engine.add_data(Value::from(BTreeMap::from([(
-        Value::from("s"),
-        Value::from(BTreeSet::from([Value::from(1_u64), Value::from(2_u64)])),
-    )])))?;
-    engine.add_data(Value::from(BTreeMap::from([(
-        Value::from("s"),
-        Value::from(BTreeSet::from([Value::from(1_u64), Value::from(2_u64)])),
-    )])))?;
-
-    let expected = Value::from(BTreeMap::from([(
-        Value::from("s"),
-        Value::from(BTreeSet::from([Value::from(1_u64), Value::from(2_u64)])),
-    )]));
-    assert_eq!(engine.get_data(), expected);
-
-    Ok(())
-}
-
-#[test]
-fn test_add_data_failed_merge_is_atomic() -> Result<()> {
-    let mut engine = Engine::new();
-
-    engine.add_data(Value::from_json_str(r#"{ "a" : { "z" : 1 } }"#)?)?;
-
-    // Mixes a new key `m` with a conflicting leaf `z` (1 vs 3). Because `m` sorts
-    // before `z`, a naive in-place merge would insert `m` and only then hit the `z`
-    // conflict. add_data must be all-or-nothing: the whole call fails AND leaves the
-    // existing data untouched — `m` must not leak in.
-    assert!(engine
-        .add_data(Value::from_json_str(r#"{ "a" : { "m" : 2, "z" : 3 } }"#)?)
-        .is_err());
-
-    assert_eq!(
-        engine.get_data(),
-        Value::from_json_str(r#"{ "a" : { "z" : 1 } }"#)?
-    );
-
-    Ok(())
-}
-
-#[test]
-fn test_add_data_failed_set_merge_is_atomic() -> Result<()> {
-    let mut engine = Engine::new();
-
-    // Existing data: a set `s` alongside a scalar `z` under `a`.
-    engine.add_data(Value::from(BTreeMap::from([(
-        Value::from("a"),
-        Value::from(BTreeMap::from([
-            (
-                Value::from("s"),
-                Value::from(BTreeSet::from([Value::from(1_u64), Value::from(2_u64)])),
-            ),
-            (Value::from("z"), Value::from(1_u64)),
-        ])),
-    )])))?;
-
-    // This add would union `s` with {3} but conflicts on `z` (1 vs 2). Since `s`
-    // sorts before `z`, a naive in-place merge would union the set *before* failing
-    // on `z`, leaking {3} into `s`. The atomic add must reject the whole call and
-    // leave `s` as {1, 2}.
-    assert!(engine
-        .add_data(Value::from(BTreeMap::from([(
-            Value::from("a"),
-            Value::from(BTreeMap::from([
-                (
-                    Value::from("s"),
-                    Value::from(BTreeSet::from([Value::from(3_u64)])),
-                ),
-                (Value::from("z"), Value::from(2_u64)),
-            ])),
-        )])))
-        .is_err());
-
-    // `s` must be unchanged ({1, 2}, not {1, 2, 3}) and `z` must still be 1.
-    let expected = Value::from(BTreeMap::from([(
-        Value::from("a"),
-        Value::from(BTreeMap::from([
-            (
-                Value::from("s"),
-                Value::from(BTreeSet::from([Value::from(1_u64), Value::from(2_u64)])),
-            ),
-            (Value::from("z"), Value::from(1_u64)),
-        ])),
-    )]));
-    assert_eq!(engine.get_data(), expected);
-
-    Ok(())
-}
-
-#[test]
-fn test_add_data_failed_array_merge_is_atomic() -> Result<()> {
-    let mut engine = Engine::new();
-
-    engine.add_data(Value::from_json_str(r#"{ "a" : { "arr" : [1, 2] } }"#)?)?;
-
-    // Arrays are atomic leaves (never element-merged), so a differing array at the
-    // same path is a conflict. The new key `aa` sorts before `arr`, so a naive
-    // in-place merge would insert `aa` and only then hit the `arr` conflict. add_data
-    // must reject the whole call and leave the data untouched — `aa` must not leak in.
-    assert!(engine
-        .add_data(Value::from_json_str(
-            r#"{ "a" : { "aa" : 5, "arr" : [3] } }"#
-        )?)
-        .is_err());
-
-    assert_eq!(
-        engine.get_data(),
-        Value::from_json_str(r#"{ "a" : { "arr" : [1, 2] } }"#)?
-    );
-
-    Ok(())
-}
-
-// The `Value::merge` used by `add_data` is shared with the rule-evaluation path
-// (`Interpreter::merge_rule_value`, reached via `with data.* as ...` and rule-value
-// materialization). The tests below pin down that making `merge` recursive changed only the
-// data-document semantics and left rule evaluation — in particular the `with data.* as ...`
-// modifier — behaving exactly as before (an override, never a deep merge).
-
-#[test]
-fn test_with_data_modifier_replaces_nested_object() -> Result<()> {
-    let mut engine = Engine::new();
-
-    // Base data provides a nested object with two keys.
-    engine.add_data(Value::from_json_str(
-        r#"{ "base" : { "foo" : { "a" : 1, "b" : 2 } } }"#,
-    )?)?;
-
-    engine.add_policy(
-        "policy.rego".to_string(),
-        r#"
-package test
-
-result := x if {
-    x := data.base.foo with data.base.foo as {"a": 99}
-}
-"#
-        .to_string(),
-    )?;
-
-    // `with data.base.foo as {"a": 99}` REPLACES the whole subtree for the duration of the
-    // rule; it must NOT deep-merge with the base `{ "a": 1, "b": 2 }`. So `b` is gone.
-    assert_eq!(
-        engine
-            .eval_query("data.test.result".to_string(), false)?
-            .result[0]
-            .expressions[0]
-            .value
-            .clone(),
-        Value::from_json_str(r#"{ "a" : 99 }"#)?
-    );
-
-    Ok(())
-}
-
-#[test]
-fn test_with_data_modifier_replaces_whole_subtree() -> Result<()> {
-    let mut engine = Engine::new();
-
-    engine.add_data(Value::from_json_str(
-        r#"{ "base" : { "foo" : 1, "bar" : 2 } }"#,
-    )?)?;
-
-    engine.add_policy(
-        "policy.rego".to_string(),
-        r#"
-package test
-
-result := x if {
-    x := data.base with data.base as {"only": 3}
-}
-"#
-        .to_string(),
-    )?;
-
-    // `with data.base as {...}` replaces the entire `data.base` object; the original
-    // `foo`/`bar` keys are not merged in.
-    assert_eq!(
-        engine
-            .eval_query("data.test.result".to_string(), false)?
-            .result[0]
-            .expressions[0]
-            .value
-            .clone(),
-        Value::from_json_str(r#"{ "only" : 3 }"#)?
-    );
-
-    Ok(())
-}
-
-#[test]
-fn test_with_data_modifier_nested_replace_preserves_siblings() -> Result<()> {
-    let mut engine = Engine::new();
-
-    // `data.base` has a nested `foo` object AND a sibling `bar`.
-    engine.add_data(Value::from_json_str(
-        r#"{ "base" : { "foo" : { "a" : 1, "b" : 2 }, "bar" : 7 } }"#,
-    )?)?;
-
-    engine.add_policy(
-        "policy.rego".to_string(),
-        r#"
-package test
-
-# `with` targets the nested `data.base.foo`, but the rule observes the PARENT `data.base`.
-result := x if {
-    x := data.base with data.base.foo as {"a": 99}
-}
-"#
-        .to_string(),
-    )?;
-
-    // The nested `foo` is deep-replaced (its `b` is gone — `with` never merges), while the
-    // sibling `bar` under the same parent is preserved.
-    assert_eq!(
-        engine
-            .eval_query("data.test.result".to_string(), false)?
-            .result[0]
-            .expressions[0]
-            .value
-            .clone(),
-        Value::from_json_str(r#"{ "foo" : { "a" : 99 }, "bar" : 7 }"#)?
-    );
-
-    Ok(())
-}
-
-#[test]
-fn test_rule_reads_deep_merged_base_data() -> Result<()> {
-    let mut engine = Engine::new();
-
-    // Two add_data calls deep-merge into a single nested object...
-    engine.add_data(Value::from_json_str(
-        r#"{ "base" : { "foo" : { "a" : 1 } } }"#,
-    )?)?;
-    engine.add_data(Value::from_json_str(
-        r#"{ "base" : { "foo" : { "b" : 2 } } }"#,
-    )?)?;
-
-    engine.add_policy(
-        "policy.rego".to_string(),
-        r#"
-package test
-
-a := data.base.foo.a
-b := data.base.foo.b
-"#
-        .to_string(),
-    )?;
-
-    // ...and both merged leaves are visible to rule evaluation.
-    assert_eq!(
-        engine.eval_query("data.test".to_string(), false)?.result[0].expressions[0]
-            .value
-            .clone(),
-        Value::from_json_str(r#"{ "a" : 1, "b" : 2 }"#)?
-    );
-
-    Ok(())
-}
-
-#[test]
-fn test_rule_values_coexist_with_merged_base_data() -> Result<()> {
-    let mut engine = Engine::new();
-
-    // Deep-merged base data under `base`...
-    engine.add_data(Value::from_json_str(
-        r#"{ "base" : { "foo" : { "a" : 1 } } }"#,
-    )?)?;
-    engine.add_data(Value::from_json_str(
-        r#"{ "base" : { "foo" : { "b" : 2 } } }"#,
-    )?)?;
-
-    engine.add_policy(
-        "policy.rego".to_string(),
-        r#"
-package test
-
-computed := data.base.foo.a + data.base.foo.b
-"#
-        .to_string(),
-    )?;
-
-    let data = engine.eval_query("data".to_string(), false)?.result[0].expressions[0]
-        .value
-        .clone();
-
-    // Base data is preserved and deep-merged...
-    assert_eq!(
-        data["base"],
-        Value::from_json_str(r#"{ "foo" : { "a" : 1, "b" : 2 } }"#)?
-    );
-    // ...and the rule-computed value materializes alongside it without disturbing the merge.
-    assert_eq!(data["test"]["computed"], Value::from(3_u64));
-
-    Ok(())
-}

src/value/mod.rs

@@ -12,22 +12,16 @@
 )] // value helpers index paths directly for performance
 
 mod object;
-mod set;
 
 #[cfg(test)]
 mod tests;
 
 #[allow(unused_imports)] // surface for downstream PRs
 pub use object::{IntoIter, Iter, IterMut, Object};
-#[allow(unused_imports)] // surface for downstream PRs
-pub use set::Set;
 
 #[cfg(feature = "rvm")]
 #[allow(unused_imports)] // surface for downstream PRs
 pub use object::ObjectCursor;
-#[cfg(feature = "rvm")]
-#[allow(unused_imports)] // surface for downstream PRs
-pub use set::SetCursor;
 
 use crate::number::Number;
 
@@ -1332,13 +1326,6 @@ impl Value {
     }
 }
 
-/// Depth cap for `deep_merge`/`check_mergeable`, set at serde_json's default recursion limit.
-///
-/// Prevents a stack overflow from adversarially nested data — an uncatchable abort that poisons
-/// every engine in an FFI process. At serde_json's limit it only backstops `Value`s built without
-/// a parse-time cap: the Python/Ruby native bindings, or programmatic construction.
-const MAX_MERGE_DEPTH: usize = 128;
-
 impl Value {
     pub(crate) fn make_or_get_value_mut<'a>(&'a mut self, paths: &[&str]) -> Result<&'a mut Value> {
         if paths.is_empty() {
@@ -1372,11 +1359,6 @@ impl Value {
         }
     }
 
-    /// Shallow-merge `new` into `self` with strict rule-output semantics.
-    ///
-    /// Objects merge one level deep: a key on both sides must hold the *same* value or it is a
-    /// conflict; sets union; equal values are a no-op. Non-recursive by design — data documents
-    /// use [`Value::deep_merge`] instead.
     pub(crate) fn merge(&mut self, mut new: Value) -> Result<()> {
         if self == &new {
             return Ok(());
@@ -1384,180 +1366,33 @@ impl Value {
         match (self, &mut new) {
             (v @ Value::Undefined, _) => *v = new,
             (Value::Set(ref mut set), Value::Set(new)) => {
-                // Union without deep-cloning the RHS set (see `deep_merge`).
-                let dst = Rc::make_mut(set);
-                match Rc::try_unwrap(core::mem::take(new)) {
-                    Ok(owned) => dst.extend(owned),
-                    Err(shared) => dst.extend(shared.iter().cloned()),
-                }
+                Rc::make_mut(set).append(Rc::make_mut(new));
+                // Enforce allocator limit after merging set entries.
                 enforce_limit_anyhow()?;
             }
             (Value::Object(map), Value::Object(new)) => {
                 for (k, v) in new.iter() {
                     match map.get(k) {
-                        // Same key, different value: the rule produced two outputs for one path.
-                        Some(pv) if *pv != *v => bail!(
-                            "value for key `{}` generated multiple times: `{}` and `{}`",
-                            serde_json::to_string_pretty(&k).map_err(anyhow::Error::msg)?,
-                            serde_json::to_string_pretty(&pv).map_err(anyhow::Error::msg)?,
-                            serde_json::to_string_pretty(&v).map_err(anyhow::Error::msg)?,
-                        ),
-                        _ => {
-                            Rc::make_mut(map).insert(k.clone(), v.clone());
-                            enforce_limit_anyhow()?;
-                        }
-                    };
-                }
-            }
-            _ => bail!("error: could not merge value"),
-        };
-        Ok(())
-    }
-
-    /// Recursively deep-merge `new` into `self` — the data-document merge behind [`Engine::add_data`].
-    ///
-    /// Objects recurse per-key, sets union, equal values are a no-op, any other differing pair
-    /// conflicts. Set-union is a regorus extension (OPA data is JSON, which has no sets). Distinct
-    /// from the strict, non-recursive [`Value::merge`] used for rule outputs — use deep-merge ONLY
-    /// for data documents.
-    ///
-    /// [`Engine::add_data`]: crate::Engine::add_data
-    pub(crate) fn deep_merge(&mut self, new: Value) -> Result<()> {
-        self.deep_merge_at(new, 0)
-    }
-
-    /// Depth-tracked worker for [`deep_merge`](Value::deep_merge). See [`MAX_MERGE_DEPTH`].
-    fn deep_merge_at(&mut self, mut new: Value, depth: usize) -> Result<()> {
-        if depth >= MAX_MERGE_DEPTH {
-            bail!("data merge exceeds maximum nesting depth of {MAX_MERGE_DEPTH}");
-        }
-        if self == &new {
-            return Ok(());
-        }
-        match (self, &mut new) {
-            (v @ Value::Undefined, _) => *v = new,
-            (Value::Set(ref mut set), Value::Set(new)) => {
-                // Union without deep-cloning the RHS set: move elements if uniquely owned,
-                // else clone only the element handles (`Rc` bumps), never the whole `BTreeSet`.
-                let dst = Rc::make_mut(set);
-                match Rc::try_unwrap(core::mem::take(new)) {
-                    Ok(owned) => dst.extend(owned),
-                    Err(shared) => dst.extend(shared.iter().cloned()),
-                }
-                enforce_limit_anyhow()?;
-            }
-            (Value::Object(map), Value::Object(new)) => {
-                // What each incoming key requires of the target map. Decided from a read-only
-                // probe so a no-op or a conflict never triggers `Rc::make_mut` (and never clones
-                // a shared map); `make_mut` is taken lazily, only when a key actually mutates.
-                enum Step {
-                    Skip,
-                    Insert,
-                    Recurse,
-                    Conflict,
-                }
-                for (k, v) in new.iter() {
-                    let step = match map.get(k) {
-                        None => Step::Insert,
-                        Some(existing) if existing == v => Step::Skip,
-                        Some(existing)
-                            if matches!(
-                                (existing, v),
-                                (Value::Object(_), Value::Object(_))
-                                    | (Value::Set(_), Value::Set(_))
-                            ) =>
-                        {
-                            Step::Recurse
-                        }
-                        Some(_) => Step::Conflict,
-                    };
-                    match step {
-                        Step::Skip => {}
-                        Step::Insert => {
-                            Rc::make_mut(map).insert(k.clone(), v.clone());
-                            enforce_limit_anyhow()?;
-                        }
-                        // Both sides are containers: recurse so nested objects merge rather than
-                        // the subtree being replaced (OPA data-merge semantics).
-                        Step::Recurse => {
-                            let existing = Rc::make_mut(map).get_mut(k).ok_or_else(|| {
-                                anyhow!("internal error: key vanished during merge")
-                            })?;
-                            existing.deep_merge_at(v.clone(), depth.saturating_add(1))?;
-                        }
-                        Step::Conflict => {
-                            let existing = map.get(k).ok_or_else(|| {
-                                anyhow!("internal error: key vanished during merge")
-                            })?;
+                        Some(pv) if *pv != *v => {
                             bail!(
                                 "value for key `{}` generated multiple times: `{}` and `{}`",
                                 serde_json::to_string_pretty(&k).map_err(anyhow::Error::msg)?,
-                                serde_json::to_string_pretty(&existing)
-                                    .map_err(anyhow::Error::msg)?,
+                                serde_json::to_string_pretty(&pv).map_err(anyhow::Error::msg)?,
                                 serde_json::to_string_pretty(&v).map_err(anyhow::Error::msg)?,
                             )
                         }
-                    }
+                        _ => {
+                            Rc::make_mut(map).insert(k.clone(), v.clone());
+                            // Enforce allocator limit after merging object entries.
+                            enforce_limit_anyhow()?;
+                        }
+                    };
                 }
             }
             _ => bail!("error: could not merge value"),
         };
         Ok(())
     }
-
-    /// Read-only check that [`deep_merge`](Value::deep_merge)-ing `other` into `self` would not
-    /// conflict, without mutating or allocating.
-    ///
-    /// Lets [`Engine::add_data`] validate before merging in place. Since a conflict is the only
-    /// way the default-build merge can fail and it depends only on the inputs, a passing scan
-    /// guarantees the in-place `deep_merge` won't fail — avoiding the alternative of cloning the
-    /// whole document into a candidate just to validate. Only overlapping keys are walked, so
-    /// disjoint additions are near-free.
-    ///
-    /// [`Engine::add_data`]: crate::Engine::add_data
-    #[cfg(not(feature = "allocator-memory-limits"))]
-    pub(crate) fn check_mergeable(&self, other: &Value) -> Result<()> {
-        self.check_mergeable_at(other, 0)
-    }
-
-    /// Depth-tracked worker for [`check_mergeable`](Value::check_mergeable). See [`MAX_MERGE_DEPTH`].
-    #[cfg(not(feature = "allocator-memory-limits"))]
-    fn check_mergeable_at(&self, other: &Value, depth: usize) -> Result<()> {
-        if depth >= MAX_MERGE_DEPTH {
-            bail!("data merge exceeds maximum nesting depth of {MAX_MERGE_DEPTH}");
-        }
-        if self == other {
-            return Ok(());
-        }
-        match (self, other) {
-            (Value::Undefined, _) => Ok(()),
-            // Set union never conflicts.
-            (Value::Set(_), Value::Set(_)) => Ok(()),
-            (Value::Object(dst), Value::Object(src)) => {
-                for (k, sv) in src.iter() {
-                    // Only overlapping keys can conflict.
-                    if let Some(dv) = dst.get(k) {
-                        let both_mergeable = matches!(
-                            (dv, sv),
-                            (Value::Object(_), Value::Object(_)) | (Value::Set(_), Value::Set(_))
-                        );
-                        if both_mergeable {
-                            dv.check_mergeable_at(sv, depth.saturating_add(1))?;
-                        } else if dv != sv {
-                            bail!(
-                                "value for key `{}` generated multiple times: `{}` and `{}`",
-                                serde_json::to_string_pretty(&k).map_err(anyhow::Error::msg)?,
-                                serde_json::to_string_pretty(&dv).map_err(anyhow::Error::msg)?,
-                                serde_json::to_string_pretty(&sv).map_err(anyhow::Error::msg)?,
-                            )
-                        }
-                    }
-                }
-                Ok(())
-            }
-            _ => bail!("error: could not merge value"),
-        }
-    }
 }
 
 impl ops::Index<&Value> for Value {

src/value/set/iter.rs

@@ -1,103 +0,0 @@
-// Copyright (c) Microsoft Corporation.
-// Licensed under the MIT License.
-
-//! Opaque iterator types for [`Set`].
-//!
-//! These newtypes wrap the storage backend's iterators so the backend can be
-//! swapped without changing any iterator type signatures observed by callers.
-
-use alloc::collections::btree_set;
-use core::iter::FusedIterator;
-
-use super::Set;
-use crate::value::Value;
-
-/// Owned iterator over `Value` elements.
-#[derive(Debug)]
-pub struct IntoIter {
-    pub(super) inner: btree_set::IntoIter<Value>,
-}
-
-impl Iterator for IntoIter {
-    type Item = Value;
-    #[inline]
-    fn next(&mut self) -> Option<Self::Item> {
-        self.inner.next()
-    }
-    #[inline]
-    fn size_hint(&self) -> (usize, Option<usize>) {
-        self.inner.size_hint()
-    }
-}
-
-impl DoubleEndedIterator for IntoIter {
-    #[inline]
-    fn next_back(&mut self) -> Option<Self::Item> {
-        self.inner.next_back()
-    }
-}
-
-impl ExactSizeIterator for IntoIter {
-    #[inline]
-    fn len(&self) -> usize {
-        self.inner.len()
-    }
-}
-
-impl FusedIterator for IntoIter {}
-
-/// Borrowed iterator over `&Value` elements.
-#[derive(Debug, Clone)]
-pub struct Iter<'a> {
-    pub(super) inner: btree_set::Iter<'a, Value>,
-}
-
-impl<'a> Iterator for Iter<'a> {
-    type Item = &'a Value;
-    #[inline]
-    fn next(&mut self) -> Option<Self::Item> {
-        self.inner.next()
-    }
-    #[inline]
-    fn size_hint(&self) -> (usize, Option<usize>) {
-        self.inner.size_hint()
-    }
-}
-
-impl<'a> DoubleEndedIterator for Iter<'a> {
-    #[inline]
-    fn next_back(&mut self) -> Option<Self::Item> {
-        self.inner.next_back()
-    }
-}
-
-impl<'a> ExactSizeIterator for Iter<'a> {
-    #[inline]
-    fn len(&self) -> usize {
-        self.inner.len()
-    }
-}
-
-impl<'a> FusedIterator for Iter<'a> {}
-
-impl IntoIterator for Set {
-    type Item = Value;
-    type IntoIter = IntoIter;
-    #[inline]
-    fn into_iter(self) -> Self::IntoIter {
-        IntoIter {
-            inner: self.inner.into_iter(),
-        }
-    }
-}
-
-impl<'a> IntoIterator for &'a Set {
-    type Item = &'a Value;
-    type IntoIter = Iter<'a>;
-    #[inline]
-    fn into_iter(self) -> Self::IntoIter {
-        Iter {
-            inner: self.inner.iter(),
-        }
-    }
-}

src/value/set/mod.rs

@@ -1,269 +0,0 @@
-// Copyright (c) Microsoft Corporation.
-// Licensed under the MIT License.
-
-//! See [`Set`].
-
-mod iter;
-mod serde;
-
-use alloc::collections::BTreeSet;
-use core::cmp::Ordering;
-use core::fmt;
-use core::ops::Bound;
-
-use crate::value::Value;
-
-#[allow(unused_imports)] // surface for downstream PRs
-pub use iter::{IntoIter, Iter};
-
-/// Opaque, ordered set of [`Value`]s.
-///
-/// The current backing storage is `BTreeSet<Value>`. The inner field is
-/// private so the representation can change (hash-backed, lazy, bloom-fronted,
-/// FFI-backed) without touching call sites.
-///
-/// # Iteration
-///
-/// - [`Set::iter`] — implementation-defined order; non-resumable.
-/// - [`Set::iter_sorted`] — sorted by `Value::Ord`; non-resumable.
-/// - [`Set::cursor`] / [`Set::next`] — implementation-defined order,
-///   resumable; cheapest per-step cost. Used by interpreter/RVM when iteration
-///   must yield mid-flight.
-#[derive(Default, Clone, Eq, PartialEq)]
-pub struct Set {
-    inner: BTreeSet<Value>,
-}
-
-impl Set {
-    /// Create an empty `Set`.
-    #[inline]
-    pub const fn new() -> Self {
-        Self {
-            inner: BTreeSet::new(),
-        }
-    }
-
-    #[inline]
-    pub fn len(&self) -> usize {
-        self.inner.len()
-    }
-
-    #[inline]
-    pub fn is_empty(&self) -> bool {
-        self.inner.is_empty()
-    }
-
-    #[inline]
-    pub fn contains(&self, value: &Value) -> bool {
-        self.inner.contains(value)
-    }
-
-    #[inline]
-    pub fn get(&self, value: &Value) -> Option<&Value> {
-        self.inner.get(value)
-    }
-
-    /// First element in sorted order (by `Value::Ord`).
-    #[inline]
-    pub fn first(&self) -> Option<&Value> {
-        self.iter_sorted().next()
-    }
-
-    /// Last element in sorted order (by `Value::Ord`).
-    #[inline]
-    pub fn last(&self) -> Option<&Value> {
-        self.iter_sorted().next_back()
-    }
-
-    /// Iteration in implementation-defined order. Non-resumable.
-    ///
-    /// For the current BTree-backed storage this happens to be sorted, but
-    /// callers MUST NOT depend on that. Use [`Set::iter_sorted`] when
-    /// deterministic order is required, or [`Set::cursor`] when iteration
-    /// must yield and resume.
-    #[inline]
-    pub fn iter(&self) -> impl Iterator<Item = &Value> + '_ {
-        self.inner.iter()
-    }
-
-    /// Iteration in sorted order (by `Value::Ord`). Non-resumable.
-    ///
-    /// Use this for serialization, snapshots, hashing, `Debug`, etc.
-    #[inline]
-    pub fn iter_sorted(&self) -> Iter<'_> {
-        // BTree backend iterates sorted natively.
-        Iter {
-            inner: self.inner.iter(),
-        }
-    }
-
-    /// Insert `value`. Returns `true` if the value was newly inserted.
-    #[inline]
-    pub fn insert(&mut self, value: Value) -> bool {
-        self.inner.insert(value)
-    }
-
-    #[inline]
-    pub fn remove(&mut self, value: &Value) -> bool {
-        self.inner.remove(value)
-    }
-
-    #[inline]
-    pub fn retain<F>(&mut self, f: F)
-    where
-        F: FnMut(&Value) -> bool,
-    {
-        self.inner.retain(f);
-    }
-
-    #[inline]
-    pub fn clear(&mut self) {
-        self.inner.clear();
-    }
-
-    #[inline]
-    pub fn append(&mut self, other: &mut Set) {
-        self.inner.append(&mut other.inner);
-    }
-
-    /// Set intersection. Returns a new `Set` containing the elements
-    /// present in both `self` and `other`.
-    pub fn intersection(&self, other: &Set) -> Set {
-        Set {
-            inner: self.inner.intersection(&other.inner).cloned().collect(),
-        }
-    }
-
-    /// Set union. Returns a new `Set` containing the elements present in
-    /// either `self` or `other`.
-    pub fn union(&self, other: &Set) -> Set {
-        Set {
-            inner: self.inner.union(&other.inner).cloned().collect(),
-        }
-    }
-
-    /// Set difference. Returns a new `Set` containing the elements present
-    /// in `self` but not in `other`.
-    pub fn difference(&self, other: &Set) -> Set {
-        Set {
-            inner: self.inner.difference(&other.inner).cloned().collect(),
-        }
-    }
-
-    #[inline]
-    pub fn is_subset(&self, other: &Set) -> bool {
-        self.inner.is_subset(&other.inner)
-    }
-
-    /// Wrap into a `Value::Set`.
-    #[inline]
-    pub fn into_value(self) -> Value {
-        Value::Set(crate::Rc::new(self.inner))
-    }
-
-    /// Create a resumable cursor over elements in implementation-defined
-    /// order. Stable for the lifetime of `&self`. O(1).
-    ///
-    /// The cursor is fully self-owned (it stores a clone of the last-seen
-    /// element, not a reference) so it can be stored as a field of a
-    /// long-lived state struct — e.g. an RVM iteration frame that persists
-    /// across instruction dispatches. As a consequence, mutating the `Set`
-    /// between `next()` calls is not rejected by the borrow checker; the
-    /// resulting iteration order in that case is unspecified.
-    #[inline]
-    pub const fn cursor(&self) -> SetCursor {
-        SetCursor {
-            inner: SetCursorInner::BTree(None),
-        }
-    }
-
-    /// Advance `cursor` and yield the next element. O(log n) for the BTree
-    /// backend (range probe); future hash/inline variants may be O(1).
-    pub fn next<'a>(&'a self, cursor: &mut SetCursor) -> Option<&'a Value> {
-        let SetCursorInner::BTree(ref mut last) = cursor.inner;
-        let next = last.as_ref().map_or_else(
-            || self.inner.iter().next(),
-            |prev| {
-                // `(Bound<&T>, Bound<&T>)` impls `RangeBounds<T>` — no clone
-                // needed to build the resume bound.
-                self.inner
-                    .range((Bound::Excluded(prev), Bound::Unbounded))
-                    .next()
-            },
-        );
-        let v = next?;
-        *last = Some(v.clone());
-        Some(v)
-    }
-}
-
-/// Opaque resumable cursor over a [`Set`]'s elements in
-/// implementation-defined order.
-///
-/// Self-owned: holds no borrow on the `Set`, so it can be stored as a
-/// field of a long-lived state struct (e.g. an RVM iteration frame).
-#[derive(Debug, Clone)]
-pub struct SetCursor {
-    inner: SetCursorInner,
-}
-
-#[derive(Debug, Clone)]
-enum SetCursorInner {
-    /// BTree backend cursor: tracks last-seen element. `None` means "before start".
-    BTree(Option<Value>),
-}
-
-// ---- Hand-written Ord/PartialOrd ----------------------------------------
-//
-// Implemented in terms of `iter_sorted()` so ordering is consistent with the
-// canonical (sorted) view of the elements and is therefore independent of
-// the storage variant.
-
-impl Ord for Set {
-    fn cmp(&self, other: &Self) -> Ordering {
-        self.iter_sorted().cmp(other.iter_sorted())
-    }
-}
-
-impl PartialOrd for Set {
-    #[inline]
-    fn partial_cmp(&self, other: &Self) -> Option<Ordering> {
-        Some(self.cmp(other))
-    }
-}
-
-impl fmt::Debug for Set {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        // Use sorted iteration so Debug output is stable across storage
-        // variants.
-        f.debug_set().entries(self.iter_sorted()).finish()
-    }
-}
-
-impl Extend<Value> for Set {
-    fn extend<I: IntoIterator<Item = Value>>(&mut self, iter: I) {
-        self.inner.extend(iter);
-    }
-}
-
-impl FromIterator<Value> for Set {
-    fn from_iter<I: IntoIterator<Item = Value>>(iter: I) -> Self {
-        Self {
-            inner: BTreeSet::from_iter(iter),
-        }
-    }
-}
-
-impl From<BTreeSet<Value>> for Set {
-    #[inline]
-    fn from(set: BTreeSet<Value>) -> Self {
-        Self { inner: set }
-    }
-}
-
-impl From<Set> for Value {
-    #[inline]
-    fn from(s: Set) -> Self {
-        s.into_value()
-    }
-}

src/value/set/serde.rs

@@ -1,44 +0,0 @@
-// Copyright (c) Microsoft Corporation.
-// Licensed under the MIT License.
-
-//! Serde `Serialize`/`Deserialize` impls for [`Set`].
-
-use core::fmt;
-
-use serde::de::{Deserialize, Deserializer, Error as _, SeqAccess, Visitor};
-use serde::ser::{Serialize, Serializer};
-
-use super::Set;
-use crate::value::Value;
-
-impl Serialize for Set {
-    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
-        // Sets serialize as JSON arrays. Sorted iteration: canonical output.
-        serializer.collect_seq(self.iter_sorted())
-    }
-}
-
-struct SetVisitor;
-
-impl<'de> Visitor<'de> for SetVisitor {
-    type Value = Set;
-
-    fn expecting(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.write_str("a sequence of Values")
-    }
-
-    fn visit_seq<A: SeqAccess<'de>>(self, mut access: A) -> Result<Self::Value, A::Error> {
-        let mut set = Set::new();
-        while let Some(v) = access.next_element::<Value>()? {
-            set.insert(v);
-            crate::utils::limits::check_memory_limit_if_needed().map_err(A::Error::custom)?;
-        }
-        Ok(set)
-    }
-}
-
-impl<'de> Deserialize<'de> for Set {
-    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
-        deserializer.deserialize_seq(SetVisitor)
-    }
-}

src/value/tests.rs

@@ -2,7 +2,6 @@
 // Licensed under the MIT License.
 
 #![allow(
-    clippy::panic,
     clippy::expect_used,
     clippy::unwrap_used,
     clippy::indexing_slicing,
@@ -14,11 +13,11 @@
     clippy::pattern_type_mismatch
 )]
 
-use alloc::collections::{BTreeMap, BTreeSet};
+use alloc::collections::BTreeMap;
 use alloc::format;
 use alloc::vec::Vec;
 
-use super::{Object, Set};
+use super::Object;
 use crate::value::Value;
 
 fn val(i: u64) -> Value {
@@ -563,306 +562,3 @@ fn object_insert_returns_previous_value() {
     assert_eq!(obj.insert(val(0), val(2)), Some(val(1)));
     assert_eq!(obj.get(&val(0)), Some(&val(2)));
 }
-
-// =========================================================================
-// Set tests
-// =========================================================================
-
-const SET_SIZES: &[u64] = &[0, 1, 2, 4, 8, 64, 256, 1024];
-
-#[test]
-fn set_iter_sorted_matches_btreeset_oracle() {
-    for &n in SET_SIZES {
-        let values: Vec<Value> = (0..n).map(val).collect();
-        let oracle: BTreeSet<Value> = values.iter().cloned().collect();
-        let s: Set = values.into_iter().collect();
-        let actual: Vec<&Value> = s.iter_sorted().collect();
-        let expected: Vec<&Value> = oracle.iter().collect();
-        assert_eq!(actual, expected, "size {n}");
-    }
-}
-
-#[test]
-fn set_iter_multiset_equality_with_oracle() {
-    for &n in SET_SIZES {
-        let values: Vec<Value> = (0..n).map(val).collect();
-        let oracle: BTreeSet<Value> = values.iter().cloned().collect();
-        let s: Set = values.into_iter().collect();
-        let mut a: Vec<Value> = s.iter().cloned().collect();
-        let mut b: Vec<Value> = oracle.iter().cloned().collect();
-        a.sort();
-        b.sort();
-        assert_eq!(a, b);
-    }
-}
-
-#[test]
-fn set_algebra_matches_btreeset() {
-    let a_vals: Vec<Value> = (0..32_u64).map(val).collect();
-    let b_vals: Vec<Value> = (16..48_u64).map(val).collect();
-    let a_btree: BTreeSet<Value> = a_vals.iter().cloned().collect();
-    let b_btree: BTreeSet<Value> = b_vals.iter().cloned().collect();
-    let a: Set = a_vals.into_iter().collect();
-    let b: Set = b_vals.into_iter().collect();
-
-    fn sorted<'a, I: Iterator<Item = &'a Value>>(it: I) -> Vec<&'a Value> {
-        let mut v: Vec<&Value> = it.collect();
-        v.sort();
-        v
-    }
-
-    let inter_set = a.intersection(&b);
-    assert_eq!(
-        sorted(inter_set.iter_sorted()),
-        sorted(a_btree.intersection(&b_btree))
-    );
-
-    let union_set = a.union(&b);
-    assert_eq!(
-        sorted(union_set.iter_sorted()),
-        sorted(a_btree.union(&b_btree))
-    );
-
-    let diff_set = a.difference(&b);
-    assert_eq!(
-        sorted(diff_set.iter_sorted()),
-        sorted(a_btree.difference(&b_btree))
-    );
-
-    // Subset: trivial + non-trivial cases.
-    let proper_subset: Set = (0..16_u64).map(val).collect();
-    let non_subset: Set = (30..50_u64).map(val).collect();
-    assert!(a.is_subset(&a));
-    assert!(proper_subset.is_subset(&a));
-    assert!(!non_subset.is_subset(&a));
-}
-
-#[test]
-fn set_first_last() {
-    let s: Set = (0..16_u64).map(val).collect();
-    assert_eq!(s.first(), Some(&val(0)));
-    assert_eq!(s.last(), Some(&val(15)));
-    assert!(Set::new().first().is_none());
-}
-
-#[test]
-fn set_serde_roundtrip() {
-    for &n in &[0_u64, 1, 8, 64] {
-        let s: Set = (0..n).map(val).collect();
-        let json = serde_json::to_string(&s).expect("ser");
-        let back: Set = serde_json::from_str(&json).expect("de");
-        assert_eq!(s, back, "size {n}");
-    }
-}
-
-#[test]
-fn set_append_drains_other() {
-    let mut a: Set = (0..4_u64).map(val).collect();
-    let mut b: Set = (4..8_u64).map(val).collect();
-    a.append(&mut b);
-    assert_eq!(a.len(), 8);
-    assert!(b.is_empty());
-}
-
-#[test]
-fn set_value_cow_make_mut_isolates_clones() {
-    let a = Value::new_set();
-    let b = a.clone();
-    let mut b_owned = b;
-    b_owned.as_set_mut().expect("set").insert(Value::from("x"));
-    assert_eq!(a.as_set().expect("set").len(), 0);
-    assert_eq!(b_owned.as_set().expect("set").len(), 1);
-}
-
-#[test]
-fn set_from_iter_dedups_duplicates() {
-    let s: Set = [val(1), val(1), val(2), val(2), val(2)]
-        .into_iter()
-        .collect();
-    assert_eq!(s.len(), 2);
-    assert!(s.contains(&val(1)));
-    assert!(s.contains(&val(2)));
-}
-
-#[test]
-fn set_accessor_coverage() {
-    let mut s: Set = (0..4_u64).map(val).collect();
-
-    assert!(s.contains(&val(2)));
-    assert!(!s.contains(&val(100)));
-
-    assert_eq!(s.get(&val(2)), Some(&val(2)));
-    assert!(s.get(&val(100)).is_none());
-
-    assert!(s.remove(&val(2)));
-    assert!(!s.remove(&val(2)));
-    assert_eq!(s.len(), 3);
-
-    s.retain(|v| v != &val(0));
-    assert!(!s.contains(&val(0)));
-    assert_eq!(s.len(), 2);
-
-    s.clear();
-    assert!(s.is_empty());
-    assert!(!s.contains(&val(1)));
-}
-
-#[test]
-fn set_into_iterator_ref() {
-    let s: Set = (0..4_u64).map(val).collect();
-    let mut count = 0;
-    for _v in &s {
-        count += 1;
-    }
-    assert_eq!(count, 4);
-}
-
-#[test]
-fn set_cursor_yields_every_element_once() {
-    for &n in SET_SIZES {
-        let vals: Vec<Value> = (0..n).map(val).collect();
-        let s: Set = vals.clone().into_iter().collect();
-        let mut cursor = s.cursor();
-        let mut collected: Vec<Value> = Vec::new();
-        while let Some(v) = s.next(&mut cursor) {
-            collected.push(v.clone());
-        }
-        let mut a = collected;
-        a.sort();
-        let mut b = vals;
-        b.sort();
-        assert_eq!(a, b, "size {n}");
-    }
-}
-
-#[test]
-fn set_cursor_empty_returns_none_immediately() {
-    let s = Set::new();
-    let mut c = s.cursor();
-    assert!(s.next(&mut c).is_none());
-}
-
-#[test]
-fn set_ord_invariant_to_insertion_order() {
-    let mut a = Set::new();
-    let mut b = Set::new();
-    for i in 0..16_u64 {
-        a.insert(val(i));
-    }
-    for i in (0..16_u64).rev() {
-        b.insert(val(i));
-    }
-    assert_eq!(a.cmp(&b), core::cmp::Ordering::Equal);
-}
-
-fn top_object_rc(v: &Value) -> crate::Rc<Object> {
-    match v {
-        Value::Object(rc) => crate::Rc::clone(rc),
-        other => panic!("expected object, got {other:?}"),
-    }
-}
-
-/// A no-op deep-merge (every incoming key already present with an equal value) must not clone
-/// the target map. `deep_merge` acquires mutable access lazily, so when nothing changes at a
-/// level the shared `Rc` is left untouched.
-#[test]
-fn deep_merge_noop_subset_does_not_clone_object() {
-    let mut a = Value::from_json_str(r#"{"x": {"deep": 1}, "y": 2}"#).unwrap();
-    // Keep a second reference so the map's refcount > 1: eager `make_mut` would clone here.
-    let shared = a.clone();
-    let before = top_object_rc(&a);
-
-    // Strict subset with identical values: no insert, no recurse, no conflict at any level.
-    a.deep_merge(Value::from_json_str(r#"{"y": 2}"#).unwrap())
-        .unwrap();
-
-    let after = top_object_rc(&a);
-    assert!(
-        crate::Rc::ptr_eq(&before, &after),
-        "no-op merge must not clone the shared object map"
-    );
-    assert_eq!(a, shared, "value must be unchanged by a no-op merge");
-}
-
-/// An equal nested object under a shared key is a no-op too — the equality short-circuit runs
-/// before any mutable access, so the map is not cloned.
-#[test]
-fn deep_merge_equal_nested_object_does_not_clone() {
-    let mut a = Value::from_json_str(r#"{"cfg": {"a": 1, "b": 2}, "n": 5}"#).unwrap();
-    let _shared = a.clone();
-    let before = top_object_rc(&a);
-
-    a.deep_merge(Value::from_json_str(r#"{"cfg": {"a": 1, "b": 2}}"#).unwrap())
-        .unwrap();
-
-    let after = top_object_rc(&a);
-    assert!(
-        crate::Rc::ptr_eq(&before, &after),
-        "merging an equal nested object must not clone the map"
-    );
-}
-
-/// A conflict on the first overlapping key is reported without cloning the target map: the
-/// read-only probe detects the conflict before any mutable access is taken.
-#[test]
-fn deep_merge_conflict_does_not_clone_object() {
-    let mut a = Value::from_json_str(r#"{"x": 1, "y": 2}"#).unwrap();
-    let _shared = a.clone();
-    let before = top_object_rc(&a);
-
-    let err = a
-        .deep_merge(Value::from_json_str(r#"{"x": 999}"#).unwrap())
-        .unwrap_err();
-    assert!(format!("{err}").contains("generated multiple times"));
-
-    let after = top_object_rc(&a);
-    assert!(
-        crate::Rc::ptr_eq(&before, &after),
-        "a conflict must not clone the shared object map"
-    );
-}
-
-/// Nest `depth` objects `{"k": {"k": ... leaf}}` iteratively, so building the value can't itself
-/// overflow and there's no parser to cap depth first.
-fn nest(depth: usize, leaf: Value) -> Value {
-    let mut v = leaf;
-    for _ in 0..depth {
-        let mut m = BTreeMap::new();
-        m.insert(Value::from("k"), v);
-        v = Value::from(m);
-    }
-    v
-}
-
-/// Over-deep data must fail with a clean `Err`, not overflow the stack. A `Value` can be built
-/// without serde_json's parse-time cap (the native bindings), so `deep_merge` must guard itself.
-#[test]
-fn deep_merge_rejects_excessive_depth() {
-    let depth = super::MAX_MERGE_DEPTH + 50;
-    // Shared key `k` on both sides forces full-depth recursion; distinct leaves keep the trees
-    // unequal so the equality short-circuit never fires.
-    let mut a = nest(depth, Value::from_json_str(r#"{"a": 1}"#).unwrap());
-    let b = nest(depth, Value::from_json_str(r#"{"b": 2}"#).unwrap());
-
-    let err = a.deep_merge(b).unwrap_err();
-    assert!(
-        format!("{err}").contains("nesting depth"),
-        "expected a depth-limit error, got: {err}"
-    );
-}
-
-/// The pre-scan carries the same guard, so the default build rejects over-deep input up front
-/// (leaving the live document untouched) instead of overflowing during validation.
-#[cfg(not(feature = "allocator-memory-limits"))]
-#[test]
-fn check_mergeable_rejects_excessive_depth() {
-    let depth = super::MAX_MERGE_DEPTH + 50;
-    let a = nest(depth, Value::from_json_str(r#"{"a": 1}"#).unwrap());
-    let b = nest(depth, Value::from_json_str(r#"{"b": 2}"#).unwrap());
-
-    let err = a.check_mergeable(&b).unwrap_err();
-    assert!(
-        format!("{err}").contains("nesting depth"),
-        "expected a depth-limit error, got: {err}"
-    );
-}

tests/interpreter/cases/builtins/numbers/mod.yaml

@@ -62,12 +62,3 @@ cases:
         x = 1 % 1.1
     query: data.test
     error: modulo on floating-point number
-
-  - note: integral float too large to convert
-    data: {}
-    modules:
-      - |
-        package test
-        x = 100000000000000000e-1 % 2
-    query: data.test
-    error: modulo on floating-point number

tests/interpreter/cases/import/tests.yaml

@@ -188,435 +188,3 @@ cases:
         import input
     query: data.test
     want_result: {}
-  - note: function call through import
-    modules:
-      - |
-        package lib
-        import rego.v1
-
-        double(x) := 2 * x
-      - |
-        package rules
-        import rego.v1
-        import data.lib
-
-        result := lib.double(21)
-    query: data.rules.result
-    want_result: 42
-  - note: function call through import alias
-    modules:
-      - |
-        package lib
-        import rego.v1
-
-        double(x) := 2 * x
-      - |
-        package rules
-        import rego.v1
-        import data.lib as l
-
-        result := l.double(21)
-    query: data.rules.result
-    want_result: 42
-  - note: function imported directly
-    modules:
-      - |
-        package lib
-        import rego.v1
-
-        double(x) := 2 * x
-      - |
-        package rules
-        import rego.v1
-        import data.lib.double
-
-        result := double(21)
-    query: data.rules.result
-    want_result: 42
-  - note: function call through import, nested package
-    modules:
-      - |
-        package a.b.c
-        import rego.v1
-
-        double(x) := 2 * x
-      - |
-        package rules
-        import rego.v1
-        import data.a
-
-        result := a.b.c.double(21)
-    query: data.rules.result
-    want_result: 42
-  - note: default function value via import
-    modules:
-      - |
-        package lib
-        import rego.v1
-
-        default pick(_) := "fallback"
-
-        pick(x) := x if x == "a"
-      - |
-        package rules
-        import rego.v1
-        import data.lib
-
-        a := lib.pick("a")
-        b := lib.pick("z")
-    query: data.rules
-    want_result:
-      a: a
-      b: fallback
-  - note: with override applies to function call through import
-    modules:
-      - |
-        package lib
-        import rego.v1
-
-        double(x) := 2 * x
-      - |
-        package lib2
-        import rego.v1
-
-        fake(x) := 1000 + x
-      - |
-        package rules
-        import rego.v1
-        import data.lib
-
-        result := lib.double(5)
-
-        main := x if {
-          x := result with data.lib.double as data.lib2.fake
-        }
-    query: data.rules.main
-    want_result: 1005
-  - note: with override target written through import alias
-    modules:
-      - |
-        package lib
-        import rego.v1
-
-        double(x) := 2 * x
-      - |
-        package lib2
-        import rego.v1
-
-        fake(x) := 1000 + x
-      - |
-        package rules
-        import rego.v1
-        import data.lib
-
-        result := data.lib.double(5)
-
-        main := x if {
-          x := result with lib.double as data.lib2.fake
-        }
-    query: data.rules.main
-    want_result: 1005
-  - note: with override replacement written through import alias
-    modules:
-      - |
-        package lib
-        import rego.v1
-
-        double(x) := 2 * x
-      - |
-        package lib2
-        import rego.v1
-
-        fake(x) := 1000 + x
-      - |
-        package rules
-        import rego.v1
-        import data.lib
-        import data.lib2
-
-        result := data.lib.double(5)
-
-        main := x if {
-          x := result with data.lib.double as lib2.fake
-        }
-    query: data.rules.main
-    want_result: 1005
-  - note: import alias shadows builtin namespace
-    modules:
-      - |
-        package lib
-        import rego.v1
-
-        unmarshal(_) := {"from": "lib"}
-      - |
-        package rules
-        import rego.v1
-        import data.lib as json
-
-        result := json.unmarshal(`[1,2]`)
-    query: data.rules.result
-    want_result:
-      from: lib
-  - note: with override target written through builtin-shadowing alias
-    modules:
-      - |
-        package lib
-        import rego.v1
-
-        unmarshal(_) := {"from": "lib"}
-      - |
-        package lib2
-        import rego.v1
-
-        unmarshal(_) := {"from": "lib2"}
-      - |
-        package rules
-        import rego.v1
-        import data.lib as json
-
-        result := json.unmarshal(`[1]`)
-
-        main := x if {
-          x := result with json.unmarshal as data.lib2.unmarshal
-        }
-    query: data.rules.main
-    want_result:
-      from: lib2
-  - note: with override replacement written through builtin-shadowing alias
-    modules:
-      - |
-        package lib
-        import rego.v1
-
-        double(x) := 2 * x
-      - |
-        package lib2
-        import rego.v1
-
-        unmarshal(_) := {"from": "lib2"}
-      - |
-        package rules
-        import rego.v1
-        import data.lib
-        import data.lib2 as json
-
-        result := lib.double(5)
-
-        main := x if {
-          x := result with data.lib.double as json.unmarshal
-        }
-    query: data.rules.main
-    want_result:
-      from: lib2
-  - note: with override target aliasing a non-function rule overrides the value
-    modules:
-      - |
-        package flib
-        import rego.v1
-
-        default flag := false
-
-        flag := true if input.x == 1
-      - |
-        package rules
-        import rego.v1
-        import data.flib as fl
-
-        result := data.flib.flag
-
-        main := x if {
-          x := result with fl.flag as 5
-        }
-    query: data.rules.main
-    want_result: 5
-  - note: import shadows module-local rule for function calls
-    modules:
-      - |
-        package lib
-        import rego.v1
-
-        double(x) := 2 * x
-      - |
-        package rules
-        import rego.v1
-        import data.lib
-
-        lib.double(x) := 100 * x
-
-        main := lib.double(3)
-    query: data.rules.main
-    want_result: 6
-  - note: import shadows module-local value rule for function calls
-    modules:
-      - |
-        package lib
-        import rego.v1
-
-        double(x) := 2 * x
-      - |
-        package rules
-        import rego.v1
-        import data.lib
-
-        lib.double := 7
-
-        main := lib.double(3)
-    query: data.rules.main
-    want_result: 6
-  - note: fully qualified function call with import present
-    modules:
-      - |
-        package lib
-        import rego.v1
-
-        double(x) := 2 * x
-      - |
-        package rules
-        import rego.v1
-        import data.lib
-
-        result := data.lib.double(21)
-    query: data.rules.result
-    want_result: 42
-  - note: unknown function through import is an error
-    modules:
-      - |
-        package lib
-        import rego.v1
-
-        double(x) := 2 * x
-      - |
-        package rules
-        import rego.v1
-        import data.lib
-
-        result := lib.missing(1)
-    query: data.rules.result
-    error: could not find function
-  - note: function call in module without imports
-    modules:
-      - |
-        package rules
-
-        double(x) := 2 * x
-
-        result := double(21)
-    query: data.rules.result
-    want_result: 42
-  - note: call to non-function value rule through import is an error
-    modules:
-      - |
-        package lib
-        import rego.v1
-
-        x := 5
-      - |
-        package rules
-        import rego.v1
-        import data.lib
-
-        result := lib.x(1)
-    query: data.rules.result
-    error: could not find function
-  - note: call to rule path prefix through import is an error
-    modules:
-      - |
-        package lib
-        import rego.v1
-
-        a.c := 9
-      - |
-        package rules
-        import rego.v1
-        import data.lib
-
-        result := lib.a(7)
-    query: data.rules.result
-    error: could not find function
-  - note: call to prefix of default function through import is an error
-    modules:
-      - |
-        package lib
-        import rego.v1
-
-        default a.b(_) := 1
-
-        a.b(x) := x * 2 if x > 10
-      - |
-        package rules
-        import rego.v1
-        import data.lib
-
-        result := lib.a(7)
-    query: data.rules.result
-    error: could not find function
-  - note: default-only function call through import
-    modules:
-      - |
-        package lib
-        import rego.v1
-
-        default dfl(_) := 42
-      - |
-        package rules
-        import rego.v1
-        import data.lib
-
-        result := lib.dfl(5)
-    query: data.rules.result
-    want_result: 42
-  - note: overload error does not leak callee module imports
-    strict: false
-    modules:
-      - |
-        package libx
-        import rego.v1
-
-        h(_) := "WRONG"
-      - |
-        package liby
-        import rego.v1
-
-        h(_) := "RIGHT"
-      - |
-        package lib
-        import rego.v1
-        import data.libx as ali
-
-        m(_) := 1
-
-        m(_) := 2
-
-        f(x) := 100 if x == 1
-
-        f(x) := y if {
-          x == 1
-          y := m(1)
-        }
-      - |
-        package rules
-        import rego.v1
-        import data.lib
-        import data.liby as ali
-
-        main := [v, w] if {
-          v := lib.f(1)
-          w := ali.h(1)
-        }
-    query: data.rules.main
-    want_result: [100, "RIGHT"]
-  - note: with target through dotted bracket key import
-    data:
-      "a.b":
-        x: 1
-    modules:
-      - |
-        package rules
-        import rego.v1
-        import data["a.b"] as ab
-
-        main := x if {
-          x := data["a.b"].x with ab.x as 2
-        }
-    query: data.rules.main
-    want_result: 2

tests/interpreter/cases/rule/multiple_outputs.yaml

@@ -1,223 +0,0 @@
-# Copyright (c) Microsoft Corporation.
-# Licensed under the MIT License.
-
-# How multiple rule definitions writing to the same path combine vs. conflict.
-# Cross-checked against OPA v1.2.0 (`opa eval`); modules use `rego.v1` to match it.
-#
-#   * Zero-arg `f()` materializes as a COMPLETE document: any two differing outputs
-#     conflict, even disjoint objects (OPA does NOT deep-merge).
-#   * Partial-object `p[k]` and ref-head `p.q.r` COMBINE across disjoint keys/paths,
-#     but conflict on the same key/leaf with a different value (no deep-merge).
-#   * Equal re-definitions (same value twice) are tolerated in every family.
-
-cases:
-  # ----------------------------------------------------------------------------
-  # Zero-arg functions: materialize as a complete document.
-  # ----------------------------------------------------------------------------
-  - note: fn_single_output
-    data: {}
-    modules:
-      - |
-        package test
-        import rego.v1
-
-        f() := {"a": 1}
-    query: data.test.f
-    want_result:
-      a: 1
-
-  - note: fn_identical_outputs_tolerated
-    data: {}
-    modules:
-      - |
-        package test
-        import rego.v1
-
-        f() := {"a": 1}
-
-        f() := {"a": 1}
-    query: data.test.f
-    want_result:
-      a: 1
-
-  - note: fn_toplevel_disjoint_conflict
-    data: {}
-    modules:
-      - |
-        package test
-        import rego.v1
-
-        f() := {"a": 1}
-
-        f() := {"b": 2}
-    query: data.test.f
-    error: "rules should not produce multiple outputs"
-
-  - note: fn_nested_object_conflict_no_deep_merge
-    data: {}
-    modules:
-      - |
-        package test
-        import rego.v1
-
-        f() := {"a": {"x": 1}}
-
-        f() := {"a": {"y": 2}}
-    query: data.test.f
-    error: "rules should not produce multiple outputs"
-
-  # ----------------------------------------------------------------------------
-  # Partial-object rules with static keys: combine across disjoint keys.
-  # ----------------------------------------------------------------------------
-  - note: partial_object_disjoint_keys_combine
-    data: {}
-    modules:
-      - |
-        package test
-        import rego.v1
-
-        p["a"] := 1
-
-        p["b"] := 2
-    query: data.test.p
-    want_result:
-      a: 1
-      b: 2
-
-  - note: partial_object_same_key_same_value_tolerated
-    data: {}
-    modules:
-      - |
-        package test
-        import rego.v1
-
-        p["a"] := 1
-
-        p["a"] := 1
-    query: data.test.p
-    want_result:
-      a: 1
-
-  - note: partial_object_same_key_diff_scalar_conflict
-    data: {}
-    modules:
-      - |
-        package test
-        import rego.v1
-
-        p["a"] := 1
-
-        p["a"] := 2
-    query: data.test.p
-    error: "rule conflicts with the following rule"
-
-  - note: partial_object_same_key_object_values_conflict_no_deep_merge
-    data: {}
-    modules:
-      - |
-        package test
-        import rego.v1
-
-        p["a"] := {"x": 1}
-
-        p["a"] := {"y": 2}
-    query: data.test.p
-    error: "rule conflicts with the following rule"
-
-  # ----------------------------------------------------------------------------
-  # Ref-head rules: combine across disjoint sub-paths.
-  # ----------------------------------------------------------------------------
-  - note: refhead_disjoint_subpaths_combine
-    data: {}
-    modules:
-      - |
-        package test
-        import rego.v1
-
-        p.q.r := 1
-
-        p.q.s := 2
-    query: data.test.p
-    want_result:
-      q:
-        r: 1
-        s: 2
-
-  - note: refhead_same_leaf_diff_value_conflict
-    data: {}
-    modules:
-      - |
-        package test
-        import rego.v1
-
-        p.q.r := 1
-
-        p.q.r := 2
-    query: data.test.p
-    error: "rule conflicts with the following rule"
-
-  - note: refhead_same_node_object_values_conflict_no_deep_merge
-    data: {}
-    modules:
-      - |
-        package test
-        import rego.v1
-
-        p.q := {"r": 1}
-
-        p.q := {"s": 2}
-    query: data.test.p
-    error: "rule conflicts with the following rule"
-
-  # ----------------------------------------------------------------------------
-  # Dynamic partial objects (keys computed at eval time).
-  # ----------------------------------------------------------------------------
-  - note: dynamic_partial_disjoint_keys_combine
-    data: {}
-    modules:
-      - |
-        package test
-        import rego.v1
-
-        m := {"a": 1, "b": 2}
-
-        p[k] := v if {
-          some k, v in m
-        }
-    query: data.test.p
-    want_result:
-      a: 1
-      b: 2
-
-  - note: dynamic_partial_same_key_same_value_tolerated
-    data: {}
-    modules:
-      - |
-        package test
-        import rego.v1
-
-        vals := [7, 7]
-
-        p[k] := v if {
-          some v in vals
-          k := "a"
-        }
-    query: data.test.p
-    want_result:
-      a: 7
-
-  - note: dynamic_partial_same_key_diff_value_conflict
-    data: {}
-    modules:
-      - |
-        package test
-        import rego.v1
-
-        vals := [1, 2]
-
-        p[k] := v if {
-          some v in vals
-          k := "a"
-        }
-    query: data.test.p
-    error: "rules must not produce multiple outputs"

tests/memory_limits.rs

@@ -185,75 +185,3 @@ fn vm_memory_limit_during_large_allocation() {
         Ok(value) => panic!("expected VM memory limit error, got value {value:?}"),
     }
 }
-
-/// On the `allocator-memory-limits` build, an `add_data` whose merge trips the memory limit
-/// mid-way must leave the data document unchanged — no partial insertions may leak. Atomicity
-/// here relies on the candidate-copy commit (`check_mergeable` models conflicts, not limits).
-#[test]
-fn add_data_memory_limit_partial_merge_is_atomic() {
-    let mut guard = LimitGuard::lock();
-    let mut engine = Engine::new();
-
-    // Seed existing data while the limit is relaxed.
-    engine
-        .add_data(Value::from_json_str(r#"{ "a": { "existing": 1 } }"#).expect("valid JSON"))
-        .expect("seed add_data");
-
-    // Merge `{ "a": { "k0": 0, ... } }` into `a` as pure insertions. The count is sized to
-    // beat the limit check's throttling — a check only fires every MEMORY_CHECK_STRIDE (16)
-    // insertions or per MEMORY_CHECK_DELTA_BYTES (32 KiB), and mimalloc's usage snapshot lags
-    // small allocations — so the trip lands mid-merge rather than after it completes.
-    let elements = 20_000;
-    let mut payload = String::with_capacity(elements * 16);
-    payload.push_str("{\"a\":{");
-    for i in 0..elements {
-        if i > 0 {
-            payload.push(',');
-        }
-        payload.push_str("\"k");
-        payload.push_str(&i.to_string());
-        payload.push_str("\":");
-        payload.push_str(&i.to_string());
-    }
-    payload.push_str("}}");
-    let big = Value::from_json_str(&payload).expect("valid JSON");
-
-    // What the engine must still hold if the add is rejected.
-    let pristine = Value::from_json_str(r#"{ "a": { "existing": 1 } }"#).expect("valid JSON");
-
-    // Budget 0: the merge's insertions trip the limit mid-way.
-    guard.set_with_additional_budget(0);
-
-    let err = engine
-        .add_data(big)
-        .expect_err("expected memory limit error during add_data merge");
-    assert_memory_limit_error(&err);
-
-    // Atomicity: the rejected add must leave data untouched — no `k*` keys leaked.
-    assert_eq!(engine.get_data(), pristine);
-}
-
-/// Companion for the candidate-copy build: a *conflict* must also be atomic (the candidate is
-/// discarded before commit). Default-build conflict atomicity is covered in
-/// `src/tests/interpreter/mod.rs`; this exercises the distinct candidate-copy branch.
-#[test]
-fn add_data_conflict_is_atomic_on_allocator_build() {
-    // Hold the lock (no budget set) so the conflict — not a limit — is the sole failure.
-    let _guard = LimitGuard::lock();
-    let mut engine = Engine::new();
-
-    engine
-        .add_data(Value::from_json_str(r#"{ "a": { "z": 1 } }"#).expect("valid JSON"))
-        .expect("seed add_data");
-
-    // `m` sorts before `z`, so a naive in-place merge inserts `m` then hits the `z` conflict
-    // (1 vs 3). The whole call must be rejected with `m` left out.
-    assert!(engine
-        .add_data(Value::from_json_str(r#"{ "a": { "m": 2, "z": 3 } }"#).expect("valid JSON"))
-        .is_err());
-
-    assert_eq!(
-        engine.get_data(),
-        Value::from_json_str(r#"{ "a": { "z": 1 } }"#).expect("valid JSON")
-    );
-}

tests/opa.rs

@@ -26,6 +26,7 @@ const OPA_TODO_FOLDERS: &[&str] = &[
     "baseandvirtualdocs",
     "dataderef",
     "defaultkeyword",
+    "every",
     "fix1863",
     "functions",
     "partialdocconstants",
@@ -101,20 +102,6 @@ fn log_rvm_skip(case_note: &str, folder_name: Option<&str>) {
     }
 }
 
-/// Allows temporarily enabling RVM verification for folders otherwise listed in
-/// `OPA_TODO_FOLDERS`, without editing the source. Set `OPA_UNSKIP_FOLDERS` to a
-/// comma-separated list of folder names (e.g. `every,functions`) or `all`.
-/// Intended for auditing latent RVM bugs in currently-skipped constructs.
-fn folder_rvm_unskipped(folder: &str) -> bool {
-    match std::env::var("OPA_UNSKIP_FOLDERS") {
-        Ok(list) => {
-            let list = list.trim();
-            list.eq_ignore_ascii_case("all") || list.split(',').any(|f| f.trim() == folder)
-        }
-        Err(_) => false,
-    }
-}
-
 fn setup_engine_for_case(case: &TestCase, is_rego_v0_test: bool) -> Result<EngineSetup> {
     let mut engine = Engine::new();
 
@@ -401,7 +388,7 @@ fn run_opa_tests(opa_tests_dir: String, folders: &[String]) -> Result<()> {
         let folder_name = folder_name_from_path(path_dir);
         let skip_rvm_for_folder = folder_name
             .as_deref()
-            .map(|folder| OPA_TODO_FOLDERS.contains(&folder) && !folder_rvm_unskipped(folder))
+            .map(|folder| OPA_TODO_FOLDERS.contains(&folder))
             .unwrap_or(false);
 
         if path.is_dir() {

tests/rvm/rego/cases/imports.yaml

@@ -95,204 +95,3 @@ cases:
         }
     query: data.rules.present
     want_result: true
-  - note: import_function_call
-    modules:
-      - |
-        package lib
-        import rego.v1
-
-        double(x) := 2 * x
-      - |
-        package rules
-        import data.lib
-        import rego.v1
-
-        result := lib.double(21)
-    query: data.rules.result
-    want_result: 42
-  - note: import_function_call_alias
-    modules:
-      - |
-        package lib
-        import rego.v1
-
-        double(x) := 2 * x
-      - |
-        package rules
-        import data.lib as mylib
-        import rego.v1
-
-        result := mylib.double(21)
-    query: data.rules.result
-    want_result: 42
-  - note: import_function_directly
-    modules:
-      - |
-        package lib
-        import rego.v1
-
-        double(x) := 2 * x
-      - |
-        package rules
-        import data.lib.double
-        import rego.v1
-
-        result := double(21)
-    query: data.rules.result
-    want_result: 42
-  - note: import_function_call_nested_package
-    modules:
-      - |
-        package a.b.c
-        import rego.v1
-
-        double(x) := 2 * x
-      - |
-        package rules
-        import data.a
-        import rego.v1
-
-        result := a.b.c.double(21)
-    query: data.rules.result
-    want_result: 42
-  - note: import_alias_shadows_builtin_namespace
-    modules:
-      - |
-        package lib
-        import rego.v1
-
-        unmarshal(_) := {"from": "lib"}
-      - |
-        package rules
-        import rego.v1
-        import data.lib as json
-
-        result := json.unmarshal(`[1,2]`)
-    query: data.rules.result
-    want_result:
-      from: lib
-  - note: default_function_value_via_import
-    skip: true  # TODO: cross-package calls to functions with default values fail to compile ("not a valid rule path"), even with fully-qualified paths
-    modules:
-      - |
-        package lib
-        import rego.v1
-
-        default pick(_) := "fallback"
-
-        pick(x) := x if x == "a"
-      - |
-        package rules
-        import rego.v1
-        import data.lib
-
-        a := lib.pick("a")
-        b := lib.pick("z")
-    query: data.rules
-    want_result:
-      a: a
-      b: fallback
-  - note: import_shadows_module_local_rule_for_function_calls
-    modules:
-      - |
-        package lib
-        import rego.v1
-
-        double(x) := 2 * x
-      - |
-        package rules
-        import rego.v1
-        import data.lib
-
-        lib.double(x) := 100 * x
-
-        main := lib.double(3)
-    query: data.rules.main
-    want_result: 6
-  - note: import_shadows_module_local_value_rule_for_function_calls
-    modules:
-      - |
-        package lib
-        import rego.v1
-
-        double(x) := 2 * x
-      - |
-        package rules
-        import rego.v1
-        import data.lib
-
-        lib.double := 7
-
-        main := lib.double(3)
-    query: data.rules.main
-    want_result: 6
-  - note: import_fully_qualified_function_call
-    modules:
-      - |
-        package lib
-        import rego.v1
-
-        double(x) := 2 * x
-      - |
-        package rules
-        import rego.v1
-        import data.lib
-
-        result := data.lib.double(21)
-    query: data.rules.result
-    want_result: 42
-  - note: unknown_function_through_import
-    modules:
-      - |
-        package lib
-        import rego.v1
-
-        double(x) := 2 * x
-      - |
-        package rules
-        import rego.v1
-        import data.lib
-
-        result := lib.missing(1)
-    query: data.rules.result
-    want_error: "Unknown function"
-  - note: function_call_without_imports
-    modules:
-      - |
-        package rules
-
-        double(x) := 2 * x
-
-        result := double(21)
-    query: data.rules.result
-    want_result: 42
-  - note: non_function_value_rule_through_import
-    modules:
-      - |
-        package lib
-        import rego.v1
-
-        x := 5
-      - |
-        package rules
-        import rego.v1
-        import data.lib
-
-        result := lib.x(1)
-    query: data.rules.result
-    want_error: "Unknown function"
-  - note: rule_path_prefix_through_import
-    modules:
-      - |
-        package lib
-        import rego.v1
-
-        a.c := 9
-      - |
-        package rules
-        import rego.v1
-        import data.lib
-
-        result := lib.a(7)
-    query: data.rules.result
-    want_error: "Unknown function"

tests/rvm/rego/cases/loops_and_quantifiers.yaml

@@ -44,295 +44,6 @@ cases:
     query: data.test.main
     want_result: true
 
-  - note: every_body_fails_for_one_element
-    data: {}
-    modules:
-      - |
-        package test
-        main := result if {
-          every x in [1, 2, 3] {
-            x > 1
-          }
-          result := true
-        }
-    query: data.test.main
-    want_result: "#undefined"
-
-  - note: every_body_fails_for_all_elements
-    data: {}
-    modules:
-      - |
-        package test
-        main := result if {
-          every x in [1, 2, 3] {
-            x > 100
-          }
-          result := true
-        }
-    query: data.test.main
-    want_result: "#undefined"
-
-  - note: every_used_directly_as_condition_false
-    data: {}
-    modules:
-      - |
-        package test
-        allowed if {
-          every x in [1, 2, 3] {
-            x > 1
-          }
-        }
-        main := allowed
-    query: data.test.main
-    want_result: "#undefined"
-
-  - note: every_used_directly_as_condition_true
-    data: {}
-    modules:
-      - |
-        package test
-        allowed if {
-          every x in [1, 2, 3] {
-            x > 0
-          }
-        }
-        main := allowed
-    query: data.test.main
-    want_result: true
-
-  - note: every_over_non_iterable_number_is_undefined
-    data: {}
-    modules:
-      - |
-        package test
-        allowed if {
-          every x in 42 {
-            x > 1
-          }
-        }
-        main := allowed
-    query: data.test.main
-    want_result: "#undefined"
-
-  - note: every_over_non_iterable_string_is_undefined
-    data: {}
-    modules:
-      - |
-        package test
-        allowed if {
-          every x in "hello" {
-            x == x
-          }
-        }
-        main := allowed
-    query: data.test.main
-    want_result: "#undefined"
-
-  - note: every_over_empty_array_is_vacuously_true
-    data: {}
-    modules:
-      - |
-        package test
-        allowed if {
-          every x in [] {
-            x > 1
-          }
-        }
-        main := allowed
-    query: data.test.main
-    want_result: true
-
-  - note: every_with_inner_some_matching_nothing_fails
-    data: {}
-    modules:
-      - |
-        package test
-        allowed if {
-          every c in [1, 2] {
-            some x in []
-            c == x
-          }
-        }
-        main := allowed
-    query: data.test.main
-    want_result: "#undefined"
-
-  - note: every_with_inner_some_matching_succeeds
-    data: {}
-    modules:
-      - |
-        package test
-        allowed if {
-          every c in [1, 2] {
-            some x in [1, 2, 3]
-            c == x
-          }
-        }
-        main := allowed
-    query: data.test.main
-    want_result: true
-
-  - note: every_with_hoisted_index_matching_nothing_fails
-    data: {}
-    modules:
-      - |
-        package test
-        allowed if {
-          every c in [1] {
-            some i
-            [2, 3][i] == c
-          }
-        }
-        main := allowed
-    query: data.test.main
-    want_result: "#undefined"
-
-  - note: every_with_hoisted_index_matching_succeeds
-    data: {}
-    modules:
-      - |
-        package test
-        allowed if {
-          every c in [2, 3] {
-            some i
-            [1, 2, 3][i] == c
-          }
-        }
-        main := allowed
-    query: data.test.main
-    want_result: true
-
-  - note: every_keyval_over_object_succeeds
-    data: {}
-    modules:
-      - |
-        package test
-        allowed if {
-          every k, v in {"a": 1, "b": 2} {
-            v > 0
-          }
-        }
-        main := allowed
-    query: data.test.main
-    want_result: true
-
-  - note: every_keyval_over_object_fails
-    data: {}
-    modules:
-      - |
-        package test
-        allowed if {
-          every k, v in {"a": 1, "b": 2} {
-            v > 1
-          }
-        }
-        main := allowed
-    query: data.test.main
-    want_result: "#undefined"
-
-  - note: every_over_set_domain_succeeds
-    data: {}
-    modules:
-      - |
-        package test
-        allowed if {
-          every x in {1, 2, 3} {
-            x > 0
-          }
-        }
-        main := allowed
-    query: data.test.main
-    want_result: true
-
-  - note: every_over_empty_object_is_vacuously_true
-    data: {}
-    modules:
-      - |
-        package test
-        allowed if {
-          every k, v in {} {
-            v > 1
-          }
-        }
-        main := allowed
-    query: data.test.main
-    want_result: true
-
-  - note: every_over_empty_set_is_vacuously_true
-    data: {}
-    modules:
-      - |
-        package test
-        allowed if {
-          every x in set() {
-            x > 1
-          }
-        }
-        main := allowed
-    query: data.test.main
-    want_result: true
-
-  - note: every_over_undefined_domain_is_undefined
-    data: {}
-    modules:
-      - |
-        package test
-        allowed if {
-          every x in input.missing {
-            x > 0
-          }
-        }
-        main := allowed
-    query: data.test.main
-    want_result: "#undefined"
-
-  - note: every_nested_inside_every_succeeds
-    data: {}
-    modules:
-      - |
-        package test
-        allowed if {
-          every row in [[1, 2], [3, 4]] {
-            every c in row {
-              c > 0
-            }
-          }
-        }
-        main := allowed
-    query: data.test.main
-    want_result: true
-
-  - note: every_nested_inside_every_fails
-    data: {}
-    modules:
-      - |
-        package test
-        allowed if {
-          every row in [[1, 2], [3, 0]] {
-            every c in row {
-              c > 0
-            }
-          }
-        }
-        main := allowed
-    query: data.test.main
-    want_result: "#undefined"
-
-  - note: every_with_outer_binding
-    data: {}
-    modules:
-      - |
-        package test
-        allowed if {
-          threshold := 5
-          every x in [6, 7, 8] {
-            x > threshold
-          }
-        }
-        main := allowed
-    query: data.test.main
-    want_result: true
-
   - note: simple_loop_test
     data: {}
     modules:

tests/rvm/rego/cases/registered_host_await.yaml

@@ -1,610 +0,0 @@
-cases:
-  - note: registered_builtin_suspendable
-    data: {}
-    input:
-      account_id: "acct-42"
-    skip_interpreter: true
-    execution_mode: suspendable
-    host_await_builtins:
-      - name: get_account
-        arg_count: 1
-    modules:
-      - |
-        package demo
-        import rego.v1
-
-        allow if {
-          account := get_account({"id": input.account_id})
-          account.status == "active"
-        }
-    query: data.demo.allow
-    host_await_responses_suspendable:
-      - id: "get_account"
-        args:
-          id: "acct-42"
-        value:
-          status: "active"
-          name: "Alice"
-    want_result: true
-
-  - note: registered_builtin_run_to_completion
-    data: {}
-    input:
-      lang: "es"
-    skip_interpreter: true
-    execution_mode: run-to-completion
-    host_await_builtins:
-      - name: translate
-        arg_count: 1
-    modules:
-      - |
-        package demo
-        import rego.v1
-
-        greeting := msg if {
-          msg := translate(input.lang)
-        }
-    query: data.demo.greeting
-    host_await_responses:
-      - id: "translate"
-        value: "hola"
-    want_result: "hola"
-
-  - note: registered_builtin_run_to_completion_rejects_args
-    data: {}
-    input:
-      lang: "es"
-    skip_interpreter: true
-    execution_mode: run-to-completion
-    # `args:` payload validation is only meaningful in suspendable mode, where
-    # the harness sees each call's argument. In run-to-completion mode the VM
-    # consumes pre-loaded responses internally, so an `args:` expectation can
-    # never be checked. Rather than silently ignore it (which would let a case
-    # "assert" a payload that is never verified), the harness rejects it.
-    host_await_builtins:
-      - name: translate
-        arg_count: 1
-    modules:
-      - |
-        package demo
-        import rego.v1
-
-        greeting := msg if {
-          msg := translate(input.lang)
-        }
-    query: data.demo.greeting
-    host_await_responses:
-      - id: "translate"
-        args: "es"
-        value: "hola"
-    want_error: "not supported in run-to-completion mode"
-
-  - note: registered_builtin_multiple_names
-    data: {}
-    input:
-      user_id: "user-7"
-    skip_interpreter: true
-    execution_mode: suspendable
-    host_await_builtins:
-      - name: lookup
-        arg_count: 1
-      - name: persist
-        arg_count: 1
-    modules:
-      - |
-        package demo
-        import rego.v1
-
-        result := {"data": fetched, "stored": saved} if {
-          fetched := lookup(input.user_id)
-          saved := persist({"id": input.user_id, "action": "audit"})
-        }
-    query: data.demo.result
-    host_await_responses_suspendable:
-      - id: "lookup"
-        args: "user-7"
-        value:
-          name: "Charlie"
-      - id: "persist"
-        args:
-          id: "user-7"
-          action: "audit"
-        value: true
-    want_result:
-      data:
-        name: "Charlie"
-      stored: true
-
-  - note: registered_builtin_suspendable_queue
-    data: {}
-    input:
-      items: ["alpha", "beta", "gamma"]
-    skip_interpreter: true
-    execution_mode: suspendable
-    host_await_builtins:
-      - name: enrich
-        arg_count: 1
-    modules:
-      - |
-        package demo
-        import rego.v1
-
-        results := [r |
-          item := input.items[_]
-          r := enrich(item)
-        ]
-    query: data.demo.results
-    host_await_responses_suspendable:
-      - id: "enrich"
-        args: "alpha"
-        value: "enriched-alpha"
-      - id: "enrich"
-        args: "beta"
-        value: "enriched-beta"
-      - id: "enrich"
-        args: "gamma"
-        value: "enriched-gamma"
-    want_result: ["enriched-alpha", "enriched-beta", "enriched-gamma"]
-
-  - note: registered_builtin_shadows_user_function
-    data: {}
-    input:
-      key: "test-key"
-    skip_interpreter: true
-    execution_mode: suspendable
-    host_await_builtins:
-      - name: resolve
-        arg_count: 1
-    modules:
-      - |
-        package demo
-        import rego.v1
-
-        # This user-defined function should be shadowed by the registered builtin
-        resolve(x) := {"local": true, "key": x}
-
-        result := resolve(input.key)
-    query: data.demo.result
-    host_await_responses_suspendable:
-      - id: "resolve"
-        args: "test-key"
-        value: "from-host"
-    # The registered builtin takes precedence — result is the host response, not the user function
-    want_result: "from-host"
-
-  - note: registered_builtin_multi_arg_object_packing
-    data: {}
-    input:
-      user: "alice"
-      resource: "/api/data"
-    skip_interpreter: true
-    execution_mode: suspendable
-    host_await_builtins:
-      - name: check_access
-        arg_count: 1
-    modules:
-      - |
-        package demo
-        import rego.v1
-
-        # Multi-value calls pack arguments into a single object
-        allowed if {
-          result := check_access({"user": input.user, "resource": input.resource})
-          result.granted == true
-        }
-    query: data.demo.allowed
-    host_await_responses_suspendable:
-      - id: "check_access"
-        args:
-          user: "alice"
-          resource: "/api/data"
-        value:
-          granted: true
-          reason: "admin"
-    want_result: true
-
-  - note: registered_builtin_rejects_arg_count_greater_than_one
-    data: {}
-    input:
-      key: "k1"
-      value: "v1"
-    skip_interpreter: true
-    execution_mode: suspendable
-    host_await_builtins:
-      - name: kv_store
-        arg_count: 2
-    modules:
-      - |
-        package demo
-        import rego.v1
-
-        result := kv_store(input.key, input.value)
-    query: data.demo.result
-    # Registration fails with an error because arg_count must be 1.
-    # Use object packing instead: kv_store({"key": input.key, "value": input.value})
-    want_error: "arg_count == 1"
-
-  - note: registered_builtin_overrides_standard_builtin
-    data: {}
-    input:
-      duration: "2h30m"
-    skip_interpreter: true
-    execution_mode: suspendable
-    host_await_builtins:
-      - name: time.parse_duration_ns
-        arg_count: 1
-    modules:
-      - |
-        package demo
-        import rego.v1
-
-        # time.parse_duration_ns is a standard Rego builtin (1 arg, returns nanoseconds).
-        # Registering it as a host-await builtin shadows the standard implementation.
-        duration_ns := time.parse_duration_ns(input.duration)
-    query: data.demo.duration_ns
-    host_await_responses_suspendable:
-      - id: "time.parse_duration_ns"
-        args: "2h30m"
-        value: 9000000000000
-    # Host returns 9000000000000 (custom value) instead of the real parse result.
-    # This proves the registered builtin shadows the standard one.
-    want_result: 9000000000000
-
-  - note: registered_builtin_rejects_reserved_name
-    data: {}
-    input: {}
-    skip_interpreter: true
-    execution_mode: suspendable
-    host_await_builtins:
-      - name: __builtin_host_await
-        arg_count: 1
-    modules:
-      - |
-        package demo
-        import rego.v1
-        result := true
-    query: data.demo.result
-    # __builtin_host_await is a reserved name handled by the explicit code path;
-    # registering it as a host-await builtin is rejected at compile time.
-    want_error: "__builtin_host_await is a reserved name"
-
-  - note: registered_builtin_empty_list_is_noop
-    data: {}
-    input: {}
-    skip_interpreter: true
-    execution_mode: suspendable
-    # Empty registration list: nothing is registered, the policy compiles
-    # normally and no HostAwait machinery fires.
-    host_await_builtins: []
-    modules:
-      - |
-        package demo
-        import rego.v1
-        result := 42
-    query: data.demo.result
-    want_result: 42
-
-  - note: registered_builtin_rejects_duplicate_name
-    data: {}
-    input: {}
-    skip_interpreter: true
-    execution_mode: suspendable
-    # Registering the same name twice is rejected (rather than silently
-    # overwritten) so the host can't accidentally clobber its own registration.
-    host_await_builtins:
-      - name: lookup
-        arg_count: 1
-      - name: lookup
-        arg_count: 1
-    modules:
-      - |
-        package demo
-        import rego.v1
-        result := lookup("anything")
-    query: data.demo.result
-    want_error: "already registered"
-
-  - note: registered_builtin_rejects_empty_name
-    data: {}
-    input: {}
-    skip_interpreter: true
-    execution_mode: suspendable
-    # The empty identifier is meaningless; reject at registration time.
-    host_await_builtins:
-      - name: ""
-        arg_count: 1
-    modules:
-      - |
-        package demo
-        import rego.v1
-        result := true
-    query: data.demo.result
-    want_error: "must not be empty"
-
-  - note: registered_builtin_rejects_whitespace_name
-    data: {}
-    input: {}
-    skip_interpreter: true
-    execution_mode: suspendable
-    # Whitespace-only names are equivalent to empty for registration purposes.
-    host_await_builtins:
-      - name: "   "
-        arg_count: 1
-    modules:
-      - |
-        package demo
-        import rego.v1
-        result := true
-    query: data.demo.result
-    want_error: "leading/trailing whitespace"
-
-  - note: registered_builtin_rejects_leading_whitespace_name
-    data: {}
-    input: {}
-    skip_interpreter: true
-    execution_mode: suspendable
-    # Whitespace-padded names would never match the trimmed identifier produced
-    # by the Rego parser, creating an unreachable registration. Reject at
-    # registration time so misconfiguration is loud, not silent.
-    host_await_builtins:
-      - name: " lookup"
-        arg_count: 1
-    modules:
-      - |
-        package demo
-        import rego.v1
-        result := true
-    query: data.demo.result
-    want_error: "leading/trailing whitespace"
-
-  - note: registered_builtin_rejects_trailing_whitespace_name
-    data: {}
-    input: {}
-    skip_interpreter: true
-    execution_mode: suspendable
-    host_await_builtins:
-      - name: "lookup "
-        arg_count: 1
-    modules:
-      - |
-        package demo
-        import rego.v1
-        result := true
-    query: data.demo.result
-    want_error: "leading/trailing whitespace"
-
-  - note: registered_builtin_out_param_syntax
-    data: {}
-    input: {}
-    skip_interpreter: true
-    execution_mode: suspendable
-    # Rego's "output-param" calling form: `f(in, out)` desugars to `f(in)`
-    # with the return value unified with `out`. With a registered arg_count=1
-    # builtin, only the first positional argument (input) reaches the host;
-    # the second positional is the output binding, not a second host-await
-    # argument. The host returns the response, which is then unified with the
-    # output binding (here, `out`).
-    host_await_builtins:
-      - name: lookup
-        arg_count: 1
-    modules:
-      - |
-        package demo
-        import rego.v1
-        result := out if {
-          lookup("ping", out)
-        }
-    query: data.demo.result
-    host_await_responses_suspendable:
-      - id: "lookup"
-        args: "ping"
-        value: "pong"
-    want_result: "pong"
-
-  - note: registered_builtin_mixed_with_explicit_builtin_host_await
-    data: {}
-    input: {}
-    skip_interpreter: true
-    execution_mode: suspendable
-    # Both invocation forms in the same policy. The explicit
-    # __builtin_host_await call uses the user-supplied identifier ("kv_get"),
-    # while the registered "lookup" name resolves to a HostAwait with the
-    # registered identifier. Both are emitted as HostAwait instructions and
-    # consume from their respective identifier queues.
-    host_await_builtins:
-      - name: lookup
-        arg_count: 1
-    modules:
-      - |
-        package demo
-        import rego.v1
-        registered_value := lookup("alpha")
-        explicit_value   := __builtin_host_await("beta", "kv_get")
-        result := {
-          "registered": registered_value,
-          "explicit":   explicit_value,
-        }
-    query: data.demo.result
-    host_await_responses_suspendable:
-      - id: "lookup"
-        args: "alpha"
-        value: "from_registered"
-      - id: "kv_get"
-        args: "beta"
-        value: "from_explicit"
-    want_result:
-      registered: "from_registered"
-      explicit:   "from_explicit"
-
-  - note: registered_builtin_does_not_intercept_qualified_calls
-    data: {}
-    input:
-      key: "alpha"
-    skip_interpreter: true
-    execution_mode: suspendable
-    # Pins the documented FQN behavior: a registered name (`resolve`) only
-    # intercepts the unqualified call form (`resolve(x)`) inside the
-    # registering package. A package-qualified call (`data.other.resolve(x)`)
-    # resolves through the normal user-defined function path. The other
-    # package's `resolve` is invoked and returns its own value — the host
-    # never sees the call. The test asserts both: the registered intercept
-    # is consumed once (from the unqualified call), and the qualified call
-    # returns the user-rule output without registering as a host-await.
-    host_await_builtins:
-      - name: resolve
-        arg_count: 1
-    modules:
-      - |
-        package other
-        import rego.v1
-        resolve(k) := result if {
-          result := sprintf("user-rule-handled:%s", [k])
-        }
-      - |
-        package demo
-        import rego.v1
-        intercepted := resolve(input.key)
-        bypassed    := data.other.resolve(input.key)
-        result := {
-          "intercepted": intercepted,
-          "bypassed":    bypassed,
-        }
-    query: data.demo.result
-    host_await_responses_suspendable:
-      - id: "resolve"
-        args: "alpha"
-        value: "from_host"
-    want_result:
-      intercepted: "from_host"
-      bypassed: "user-rule-handled:alpha"
-
-  - note: registered_builtin_same_package_qualified_reaches_local_rule
-    data: {}
-    input:
-      key: "alpha"
-    skip_interpreter: true
-    execution_mode: suspendable
-    # When a registered name *also* exists as a rule in the registering
-    # package, the bare call is intercepted (HostAwait) while the
-    # same-package qualified call reaches the local rule. Registration is a
-    # bare-name intercept only; the qualified path resolves as it normally
-    # would. This gives a policy a deliberate escape hatch: register `resolve`
-    # for host interception, yet still reach the local rule via
-    # `data.demo.resolve` when the host should be bypassed.
-    host_await_builtins:
-      - name: resolve
-        arg_count: 1
-    modules:
-      - |
-        package demo
-        import rego.v1
-        resolve(k) := sprintf("local-rule:%s", [k])
-        intercepted := resolve(input.key)
-        bypassed    := data.demo.resolve(input.key)
-        result := {
-          "intercepted": intercepted,
-          "bypassed":    bypassed,
-        }
-    query: data.demo.result
-    host_await_responses_suspendable:
-      - id: "resolve"
-        args: "alpha"
-        value: "from_host"
-    want_result:
-      intercepted: "from_host"
-      bypassed: "local-rule:alpha"
-
-  - note: registered_builtin_shadows_standard_builtin_by_bare_name
-    data: {}
-    input: {}
-    skip_interpreter: true
-    execution_mode: suspendable
-    # Registering a name that collides with a standard builtin (`count`)
-    # intercepts the bare call form: `count([...])` compiles to a HostAwait
-    # instead of invoking the built-in implementation. The qualified form
-    # `data.demo.count([...])` has no meaning for a builtin (builtins are
-    # callable only by bare name) and would fail to compile with
-    # `Unknown function` whether or not `count` is registered, so it is not
-    # exercised here.
-    host_await_builtins:
-      - name: count
-        arg_count: 1
-    modules:
-      - |
-        package demo
-        import rego.v1
-        result := count([10, 20, 30])
-    query: data.demo.result
-    host_await_responses_suspendable:
-      - id: "count"
-        args: [10, 20, 30]
-        value: "from_host"
-    want_result: "from_host"
-
-  - note: registered_builtin_qualified_unknown_function_when_no_rule
-    data: {}
-    input:
-      key: "alpha"
-    skip_interpreter: true
-    execution_mode: suspendable
-    # Registration is a bare-name intercept and creates no rule. A qualified
-    # call to the registered name therefore has nothing to resolve to (no rule
-    # exists at `data.demo.resolve`) and fails to compile with
-    # `Unknown function` — the same outcome as without registration. Pins the
-    # documented "otherwise compilation fails with Unknown function" case.
-    host_await_builtins:
-      - name: resolve
-        arg_count: 1
-    modules:
-      - |
-        package demo
-        import rego.v1
-        result := data.demo.resolve(input.key)
-    query: data.demo.result
-    want_error: "Unknown function"
-
-  - note: registered_builtin_qualified_builtin_name_is_unknown_function
-    data: {}
-    input: {}
-    skip_interpreter: true
-    execution_mode: suspendable
-    # A standard builtin has no package-qualified form: `data.demo.count([...])`
-    # fails with `Unknown function` whether or not `count` is registered as a
-    # host-await builtin. Pins the parenthetical in the docs.
-    host_await_builtins:
-      - name: count
-        arg_count: 1
-    modules:
-      - |
-        package demo
-        import rego.v1
-        result := data.demo.count([10, 20, 30])
-    query: data.demo.result
-    want_error: "Unknown function"
-
-  - note: registered_builtin_suspendable_set_argument
-    data: {}
-    input: {}
-    skip_interpreter: true
-    execution_mode: suspendable
-    # Regression pin for the host-await argument comparison: the policy passes
-    # a *set* as the payload. The runtime argument is already a `Value::Set`,
-    # and the expected `args` decodes (via the `set!` helper) to the same set.
-    # The harness must compare them directly -- re-running `process_value` on the
-    # runtime argument would bail with "unexpected set in value read from
-    # json/yaml" and fail the case for the wrong reason.
-    host_await_builtins:
-      - name: lookup
-        arg_count: 1
-    modules:
-      - |
-        package demo
-        import rego.v1
-        result := lookup({1, 2, 3})
-    query: data.demo.result
-    host_await_responses_suspendable:
-      - id: "lookup"
-        args:
-          set!: [1, 2, 3]
-        value: "found"
-    want_result: "found"

tests/rvm/rego/mod.rs

@@ -41,7 +41,6 @@ struct TestCase {
     pub host_await_responses: Option<Vec<HostAwaitResponseSpec>>,
     pub host_await_responses_run_to_completion: Option<Vec<HostAwaitResponseSpec>>,
     pub host_await_responses_suspendable: Option<Vec<HostAwaitResponseSpec>>,
-    pub host_await_builtins: Option<Vec<HostAwaitBuiltinSpec>>,
 }
 
 fn default_strict() -> bool {
@@ -56,24 +55,14 @@ struct YamlTest {
 #[derive(Debug, Clone, Deserialize, Serialize, PartialEq)]
 struct HostAwaitResponseSpec {
     pub id: Value,
-    pub args: Option<Value>,
     pub value: Value,
 }
 
-#[derive(Debug, Clone, Deserialize, Serialize, PartialEq)]
-struct HostAwaitBuiltinSpec {
-    pub name: String,
-    pub arg_count: usize,
-}
-
-type HostAwaitResponseMap = BTreeMap<Value, VecDeque<(Option<Value>, Value)>>;
-
 #[derive(Debug, Clone)]
 struct RvmExecutionOptions {
     execution_mode: ExecutionMode,
     host_await_responses_run_to_completion: Option<Vec<(Value, Vec<Value>)>>,
-    host_await_responses_suspendable: Option<HostAwaitResponseMap>,
-    host_await_builtins: Option<Vec<(String, usize)>>,
+    host_await_responses_suspendable: Option<BTreeMap<Value, VecDeque<Value>>>,
 }
 
 impl Default for RvmExecutionOptions {
@@ -82,7 +71,6 @@ impl Default for RvmExecutionOptions {
             execution_mode: ExecutionMode::RunToCompletion,
             host_await_responses_run_to_completion: None,
             host_await_responses_suspendable: None,
-            host_await_builtins: None,
         }
     }
 }
@@ -94,13 +82,12 @@ fn render_program_listing(program: &Program) -> String {
 
 fn build_host_await_response_map(
     responses: &[HostAwaitResponseSpec],
-) -> anyhow::Result<HostAwaitResponseMap> {
-    let mut map: HostAwaitResponseMap = BTreeMap::new();
+) -> anyhow::Result<BTreeMap<Value, VecDeque<Value>>> {
+    let mut map: BTreeMap<Value, VecDeque<Value>> = BTreeMap::new();
     for response in responses {
         let id = process_value(&response.id)?;
-        let expected_args = response.args.as_ref().map(process_value).transpose()?;
         let value = process_value(&response.value)?;
-        map.entry(id).or_default().push_back((expected_args, value));
+        map.entry(id).or_default().push_back(value);
     }
     Ok(map)
 }
@@ -108,24 +95,10 @@ fn build_host_await_response_map(
 fn build_host_await_response_vec(
     responses: &[HostAwaitResponseSpec],
 ) -> anyhow::Result<Vec<(Value, Vec<Value>)>> {
-    // Run-to-completion responses are pre-loaded into the VM, which consumes
-    // them internally without surfacing each call's argument to the harness.
-    // There is therefore no point at which an `args:` expectation could be
-    // checked, so silently dropping it would let a case "assert" a payload
-    // that is never verified. Reject `args:` up front instead, pointing the
-    // author at suspendable mode where argument validation is supported.
-    if let Some(response) = responses.iter().find(|response| response.args.is_some()) {
-        return Err(anyhow::anyhow!(
-            "`args:` payload validation is not supported in run-to-completion mode \
-             (response for id {:?}); drop the `args:` field or move the case to \
-             execution_mode: suspendable",
-            response.id
-        ));
-    }
     let map = build_host_await_response_map(responses)?;
     Ok(map
         .into_iter()
-        .map(|(id, values)| (id, values.into_iter().map(|(_, output)| output).collect()))
+        .map(|(id, values)| (id, values.into_iter().collect()))
         .collect())
 }
 
@@ -138,20 +111,12 @@ fn build_execution_options(case: &TestCase) -> anyhow::Result<RvmExecutionOption
         }
     };
 
-    // Only build the run-to-completion response vec when the case actually
-    // runs in RTC mode. A suspendable case may legitimately use the shared
-    // `host_await_responses` field with `args:` expectations (validated via
-    // the suspendable map below); building the RTC vec for it would wrongly
-    // trip the RTC-only `args:` rejection in `build_host_await_response_vec`.
-    let rtc_responses = if execution_mode == ExecutionMode::RunToCompletion {
-        case.host_await_responses_run_to_completion
-            .as_ref()
-            .or(case.host_await_responses.as_ref())
-            .map(|responses| build_host_await_response_vec(responses))
-            .transpose()?
-    } else {
-        None
-    };
+    let rtc_responses = case
+        .host_await_responses_run_to_completion
+        .as_ref()
+        .or(case.host_await_responses.as_ref())
+        .map(|responses| build_host_await_response_vec(responses))
+        .transpose()?;
 
     let suspendable_responses = case
         .host_await_responses_suspendable
@@ -160,18 +125,10 @@ fn build_execution_options(case: &TestCase) -> anyhow::Result<RvmExecutionOption
         .map(|responses| build_host_await_response_map(responses))
         .transpose()?;
 
-    let ha_builtins = case.host_await_builtins.as_ref().map(|specs| {
-        specs
-            .iter()
-            .map(|s| (s.name.clone(), s.arg_count))
-            .collect()
-    });
-
     Ok(RvmExecutionOptions {
         execution_mode,
         host_await_responses_run_to_completion: rtc_responses,
         host_await_responses_suspendable: suspendable_responses,
-        host_await_builtins: ha_builtins,
     })
 }
 
@@ -270,13 +227,7 @@ fn compile_and_run_rvm_with_all_entry_points(
     listing_out: &mut Option<String>,
     execution_options: &RvmExecutionOptions,
 ) -> anyhow::Result<Vec<Value>> {
-    let ha_builtins = execution_options
-        .host_await_builtins
-        .as_ref()
-        .map(|b| b.iter().map(|(n, a)| (n.as_str(), *a)).collect::<Vec<_>>())
-        .unwrap_or_default();
-    let program =
-        Compiler::compile_from_policy_with_host_await(compiled_policy, entry_points, &ha_builtins)?;
+    let program = Compiler::compile_from_policy(compiled_policy, entry_points)?;
 
     // Basic serialization sanity check keeps regressions visible in CI.
     test_round_trip_serialization(program.as_ref()).map_err(|e| anyhow::anyhow!(e))?;
@@ -318,12 +269,8 @@ fn compile_and_run_rvm_with_all_entry_points(
                         return Err(anyhow::anyhow!("{}", error));
                     }
                     ExecutionState::Suspended { reason, .. } => match reason {
-                        SuspendReason::HostAwait {
-                            identifier,
-                            argument,
-                            ..
-                        } => {
-                            let (expected_args, response) = suspendable_responses
+                        SuspendReason::HostAwait { identifier, .. } => {
+                            let response = suspendable_responses
                                 .get_mut(identifier)
                                 .and_then(|queue| queue.pop_front())
                                 .ok_or_else(|| {
@@ -332,24 +279,6 @@ fn compile_and_run_rvm_with_all_entry_points(
                                         identifier
                                     )
                                 })?;
-                            if let Some(expected) = expected_args {
-                                // `argument` is already a runtime `Value`; the
-                                // expected side has been through `process_value`
-                                // once at YAML decode time (see
-                                // `build_host_await_response_map`). Comparing
-                                // raw runtime values keeps fixture sentinels like
-                                // "#undefined" from coercing a runtime string
-                                // payload into a different shape, which would
-                                // otherwise let tests pass for the wrong reason.
-                                if argument != &expected {
-                                    return Err(anyhow::anyhow!(
-                                        "HostAwait argument mismatch for {:?}: expected {:?}, got {:?}",
-                                        identifier,
-                                        expected,
-                                        argument
-                                    ));
-                                }
-                            }
                             vm.resume(Some(response))?;
                         }
                         other => {
@@ -436,34 +365,7 @@ fn yaml_test_impl(file: &str) -> Result<()> {
             Some(engine.eval_rule(case.query.clone()))
         };
 
-        let execution_options = match build_execution_options(&case) {
-            Ok(options) => options,
-            Err(options_error) => {
-                // A malformed host-await fixture (e.g. an `args:` expectation on
-                // a run-to-completion response, which can never be validated) is
-                // reported here. Mirror the compilation-error handling below: if
-                // the case expects an error, match it; otherwise fail hard.
-                if let (None, Some(expected_error)) = (&case.want_result, &case.want_error) {
-                    let error_str = options_error.to_string();
-                    if error_str.contains(expected_error) {
-                        println!(
-                            "✓ Execution-options error matches expected for case '{}'",
-                            case.note
-                        );
-                        println!("passed");
-                        continue;
-                    }
-                    panic_with_listing!(
-                        &last_listing,
-                        &case.note,
-                        "Execution-options error does not match expected for case '{}':\nExpected: '{expected_error}'\nActual: '{error_str}'",
-                        case.note
-                    );
-                }
-                dump_rvm_listing(&case.note, &last_listing);
-                return Err(options_error);
-            }
-        };
+        let execution_options = build_execution_options(&case)?;
 
         if let Err(compilation_error) = &compilation_result {
             if let (None, Some(expected_error)) = (&case.want_result, &case.want_error) {