# Borz

> Run agents like infrastructure. Uptime, approvals, recovery and a full
> audit trail — not a chat window. **Borz - Clan Control** manages the
> fleet unattended; **Borz - Mesh Manager** will federate many clans.
> Underneath, Borz is one language for two typed building blocks —
> **agents** (pure LLM persona, model-portable, from local gemma to Claude)
> and **actors** (deterministic compiled code, four targets: native binary,
> DEMIX supervised microservice, DENSE KVM nanoservice, Ephernity smart
> contract on Epher Compute Chain). A Decent Edge project
> (https://decentedge.com).

License: TBD.
Motto: "By the Agents · Through the Agents · For the Agents."

## Core ideas

- **Actor model.** Each actor is an isolated state-bearing process. Handlers run one at a time. No globals, no closures, no inheritance.
- **Typed messages.** Communication is exclusively via declared message types. Arguments are positional (C-style) or named.
- **Four compile targets.** `--target native` (single binary; Go today, MLIR/LLVM planned), `--target demix` (DEMIX microservice VM; add `--static` flag for a static actor registry with no plugin.Open), `--target dense --backend cpp` (DENSE KVM nanoservices, ~200 µs p50 dispatch on a 3-actor fan-out application workload), `--target wasm` (WASM/WASI, browser or server-side sandbox).
- **Type system (RFC-0002).** Sum types (`enum` with payload variants), generic structs/enums (`Pair[A, B]`), monomorphisation, `Option[T]` / `Result[T, E]` stdlib types, type aliases (`type X = Y`), newtypes (`newtype X = Y`), top-level free functions (`fn`).
- **Binary payloads (RFC-BORZ-EXT-001 + EXT-009).** `bytes` and `blob` primitive types. `import "std/bytes" as *` for constructors, length-prefixed encoding, BLAKE3-friendly streaming. On DENSE: state vars require `@dense(max_bytes=N)` (lowers to `bytes_<N>_t` with `BYTES_OVERFLOW` trap on overflow); function-parameter / return positions lower to `dense_bytes_t` view. Core helpers (`len_b`, `at_b`, `eq_b`, `cmp_b`, `index_b`) now compile to DENSE via `call cpp` peers.
- **Deterministic encoding (RFC-BORZ-EXT-003).** `@canonical` decorator on `type` declarations promises cross-target byte-identical encode/decode. `std/canonical` ships length-prefixed encoder helpers; the full auto-derive pass is in flight.
- **BigInt + Decimal (RFC-BORZ-EXT-006).** `std/bignum` provides arbitrary-precision BigInt and Decimal arithmetic with four explicit rounding modes (`half_even` default). Use Decimal for currency. **`f64` is banned in `@deterministic` contract code.**
- **Three time sources (RFC-BORZ-EXT-005).** `wall_now_ms()` (host wall clock), `actor_clock_ms()` (per-actor injectable, mockable in tests), `ledger_now()` (per-entry timestamp inside `@deterministic`). Inside contracts the only allowed clock is `ledger_now()`.
- **Sorted iteration (RFC-BORZ-EXT-002).** `std/collections` exposes `map_keys_sorted_str/u64/i64` and `set_sorted_*` for deterministic Map/Set walks; `@deterministic` will reject unsorted `iter()`.
- **Stdlib modules.** `std/option`, `std/result`, `std/test`, `std/bytes`, `std/bignum`, `std/canonical`, `std/collections`, `std/time`, `std/crypto`, `std/math`, `std/random`, `std/string`, `std/sqlite`, `std/http`, `std/fetch`, `std/semver`, `std/conv`, `std/dom`.
- **Two agentic constructs — distinct, not the same.** `agent` and `actor` are separate first-class Borz constructs. An `agent` is a pure LLM persona (persona + tools + model mandate + memory + typed message interface); it runs on a host such as Claude or ollama and does NOT compile to DENSE. An `actor` is deterministic compiled Borz code that runs on DENSE; an actor that uses `infer` is an "agentic actor" but it is still an actor, not an agent. They share one typed message bus (agent→actor and actor→agent messaging; the compiler checks both sides). Never say "an agent is an actor."
- **Embedded LLM step (actor construct).** `infer:` is a first-class statement inside an actor handler; it calls an LLM provider synchronously with a typed output variable (`target`). Only actors use `infer`. A pure `agent` is itself the LLM call — it does not use `infer`.
- **agent construct (pure LLM).** An `agent` definition declares: `model:` (host + model, e.g. `claude:sonnet`, `local:ollama:gemma4:12b`), `system:` (persona prose), `memory:` (rolling turns or persistent), `tools:` (permitted tool list), and typed `on msg` handlers. Agents accept typed messages AND the generic `Prompt` message type for open-ended input.
- **Decorator-driven HTTP/CLI/gRPC.** `@http(method=..., path=...)` exposes a handler as an HTTP route; `@cli(command=...)` as a CLI sub-command; `@grpc(service=..., method=...)` as a gRPC method (RFC-0060).
- **Traits and structs (RFC-0041).** `trait T` declares a contract; `impl T for Actor` provides bodies — fully codegen'd for native Go as interfaces + method receivers. `type Foo:` declares plain product data types.
- **Persistent state.** `@persistent var` survives restarts (JSON in native; in-memory snapshot/restore in DENSE/DEMIX).
- **Test framework (RFC-0009).** `@test("label")` on a handler runs it as a unit test via `borz test <file>`. Property tests with `@property("invariant")`.
- **Hot reload (RFC-0011).** `borz deploy` performs a rolling drain→snapshot→migrate→restore cycle. `@migrate_from(version=N)` declares state migration handlers.
- **LSP & formatter (RFC-0008).** `borz lsp` starts a Language Server Protocol 3.17 server on stdio (hover, definition, completion, diagnostics). `borz fmt` formats source canonically.
- **Observability (RFC-0010).** Structured JSON logs (`{"ts":..., "actor":..., "trace_id":..., "msg":..., "level":...}`), Counter/Histogram metrics, 128-bit trace IDs propagated across sends. Enabled with `@trace`, `@metric`, `@log_level` decorators.
- **Cross-actor messaging (RFC-0006).** `send Actor <- Msg(field=val)` delivers a message to another actor's mailbox (native: buffered Go channel; DEMIX: IPC; DENSE: substrate routing).

## Site structure (borz.ai)

The borz.ai website:

- `/lang` — **Language** — overview of the Borz language: agents, actors, messages, traits, generics, the `infer` statement.
- `/comp` — **Compiler** — four compile targets (`--target native`, `--target demix`, `--target dense`, `--target ephernity`), CLI tooling, distribution.
- `/agent` — **Agent** — the `agent` construct: a pure LLM persona (model mandate, tools, memory, typed message interface). Never compiles to a binary; the artifact is a JSON manifest.
- `/actor` — **Actor** — the `actor` construct in depth: isolation, state, decorators, message patterns, the `infer` statement (an actor using `infer` is an "agentic actor", still an actor).
- `/clan` — **Clan Control** — the fleet-manager product for a Borz Clan (a Clan is a group of agents and actors): unattended dispatch, signed audit trail, per-tool policy, stall detection. Early access. Per-clan pricing on this page.
- `/mesh` — **Mesh Manager** — the planned product for multi-Clan federation (roadmap, not shipped). Vision page.
- `/showcase` — complete runnable examples: agent↔actor interop, agentic actors, local gemma4 via ollama.
- `/play` — in-browser playground: compile, share links, LLM assist.
- `/intro` — documentation hub: spec, grammar, examples, LLM-friendly endpoints.
- `/pricing` — compiler distribution tiers: Online API (free tier), Community (offline), Enterprise (air-gapped, contractual). Rationale at `/distribution-tiers`.

## Family of products (Decent Edge)

- **Borz** — the language. The surface every author (human or agent) writes in. Closed source; commercial Decent Edge product.
- **DELIGHT** — Decent Edge Lightweight Application Server. The umbrella runtime where Borz programs execute. KVM-isolated nanoservice / microservice / VM platform; comparable in scope to Microsoft Hyperlight. Hosts DEMIX and DENSE as two execution lanes.
- **DEMIX** — DELIGHT's microservice lane. A lightweight VMM that boots full Linux guests with millisecond cold starts. Use when you need a real runtime, full networking, or unbounded state. Borz `--target demix` produces a native actor binary that runs inside a DEMIX guest.
- **DENSE** — DELIGHT's nanoservice lane. Bare-metal KVM, no OS, single-threaded. One handler per 2 MiB micro-VM, sub-100 µs warm dispatch on a single no-op handler, < 2 MB memory per actor. Borz `--target dense` produces flat-ELF binaries.
- **Clan Control** — the fleet-manager product for a Borz Clan (a Clan is the group of agents and actors it manages). Runs on DELIGHT. Provides unattended dispatch, signed audit receipts per tool call, per-tool policy gates, stall detection, and a live web fleet dashboard. Currently in limited early access. Not yet integrated with Borz-the-language (Borz language `agent`/`actor` → Clan integration is on the roadmap).
- **Mesh Manager** — the planned product for multi-Clan federation (a Mesh is the federation of Clans). Will provide typed message routing across Clans on different hosts. Roadmap; not shipped.

## Resources

- [Language specification](/spec.md): complete grammar, type system, semantics
- [Full plain-text dump](/llms-full.txt): the whole spec inlined for fast LLM ingestion
- [Example programs](/examples.json): every example as `{name, source, target}`
- [Decent Edge](https://decentedge.com): the company shipping Borz, DELIGHT, DEMIX, and DENSE
- [Borz playground](https://play.borz.ai): in-browser compilation, no setup
- [Compile API](https://api.borz.ai/v1/compile): POST source + target, get artefact (anonymous + authenticated tiers)

## Talk back

The Borz team operates a public, two-way agent communication service at
`api.borz.ai/v1/agent/...`. The service itself is a Borz program running
on DEMIX (source: `examples/30_agent_service/` in the project). LLM
agents can submit feedback, questions, feature requests, and opinions;
they can also poll for responses, announcements, and project digests.

- `POST /v1/agent/feedback`  — free-form feedback, no response expected
- `POST /v1/agent/question`  — question to the team, response within 14 days
- `POST /v1/agent/request`   — feature request / bug / clarification
- `POST /v1/agent/opinion`   — vote / opinion on an existing RFC
- `GET  /v1/agent/responses` — poll for responses to your tickets
- `GET  /v1/agent/digest/daily` — LLM-shaped project digest
- `GET  /v1/agent/roadmap`   — live RFC status snapshot

Anonymous tier: 30 POSTs / hour / IP. Authenticated tier: 300 POSTs /
hour with an `agt_live_…` bearer token (request at decentedge.com).
OpenAPI 3.1 at `/v1/agent/openapi.json`.

## Traits and interfaces (RFC-0041)

RFC-0041 fully codegen's traits for the native Go backend.

```borz
trait Ledger:
    fn total(self) -> i64

impl Ledger for Bank:
    fn total(self) -> i64:
        ret a1 + a2
```

Each `trait` becomes a Go `interface`. Each `impl` block emits method receivers
on the actor's state struct, making the struct satisfy the interface automatically.
Actor state vars are in scope as bare identifiers inside method bodies (no `self.` prefix).

## HATP receipt pipeline (RFC-0037)

HATP (Hardware Attestation Trust Protocol — see https://decentedge.com/delight/hatp) is Decent
Edge's attestation scheme. Every DENSE dispatch and LLM call produces an Ed25519-signed HATP receipt.
`hatp`: `Signer`, `Verifier`, `Store`, HTTP `/receipts` endpoint.
Receipt schema: `v`, `type`, `receipt_id`, `customer_id`, payload hashes, timestamps, `signature`.
Receipts are stored in SQLite and queryable via the admin API. They form a tamper-evident
audit trail required for EU AI Act compliance.

## EU AI Gateway (RFC-0053 + RFC-0058)

The EU AI Gateway is a production EU LLM proxy with SQLite token management, admin API,
Ed25519-signed receipts, TLS, CLI (`eu-proxy-ctl`), MCP server for agent management.
OpenAI-compatible `/v1/chat/completions` endpoint with provider routing (Anthropic/OpenAI/Mistral).
All traffic stays within EU-sovereign infrastructure. Designed for GDPR Article 22 compliance.

## CI/CD templates (RFC-0047)

Official GitHub Actions and GitLab CI templates ship with Borz. They run `borz test`,
`borz bench`, and publish artefacts to the compile API with zero additional config.

## LSP v2 (RFC-0045)

`borz lsp` v2 adds live diagnostics (incremental parse on every keystroke), rename refactoring
across a file, and inline parameter hints for message constructors and trait method calls.

## DEMIX --static wiring (RFC-0057)

`--target demix --static` wires actors to the static actor registry rather than the dynamic
`plugin.Open` loader. Produces fully self-contained binaries with no shared-library dependencies.

## DENSE memory budget (RFC-0059)

`@assert_state_size(max=N)` on an actor is now enforced at compile time. The compiler
computes the exact byte footprint of all `@persistent` vars and raises a hard error if
the layout exceeds the budget. Prevents silent state-region overflow at runtime.

## gRPC annotation (RFC-0060)

`@grpc(service="Foo", method="Bar")` on a handler generates a gRPC method alongside `@http`.
The same handler can serve both REST and gRPC without duplication. Proto definitions are
auto-generated from the message schema.

```borz
@http(method="POST", path="/transfer")
@grpc(service="Bank", method="Transfer")
on msg Transfer:
    ...
```

## Borz language extensions (RFC-BORZ-EXT-001..008)

Eight RFCs landed (May 2026) to unblock the Ephernity timed-ledger rewrite
at the language layer. The compiler now accepts:

- **RFC-EXT-001** — `bytes` / `blob` primitives (variable-length binary).
- **RFC-EXT-002** — `std/collections` deterministic sorted views.
- **RFC-EXT-003** — `@canonical` decorator on `type` decls.
- **RFC-EXT-004** — `@persistent(backing="badger", path=..., write_freq=..., volatile=true, ms=N)` attribute set parses cleanly (native today uses JSON; Badger backing planned).
- **RFC-EXT-005** — `wall_now_ms()` / `actor_clock_ms()` / `ledger_now()` in `std/time`.
- **RFC-EXT-006** — `std/bignum` with BigInt + Decimal.
- **RFC-EXT-007** — `pub` modifier accepted before any top-level decl; `borz.toml` manifest + `borz.lock`.
- **RFC-EXT-008** — typed `use go "pkg"` + `fn name(...) -> ...: call go """..."""` already provides the typed-FFI surface. DENSE target rejects `call go` with a clear compile error.
- **RFC-EXT-009** — DENSE C++ backend now lowers `u32`/`bytes`/`blob`. `@dense(max_bytes=N)` on a `bytes` state var emits a `bytes_<N>_t` struct with `BYTES_OVERFLOW` trap on overflow; unbounded `bytes` in parameter/return positions becomes a generic `dense_bytes_t` view. `std/bytes` ships dual `call go` + `call cpp` peers for `len_b`, `at_b`, `eq_b`, `cmp_b`, `index_b`.
- **RFC-EXT-010** — `std/blake3` shipped with `hash256_hex` / `hash256` / `hash256_verify` / `hash256_keyed_hex` (dual call go / call cpp). `std/crypto.ed25519_verify_bytes(pub, msg, sig) -> bool` gets a libsodium DENSE peer. Native verified byte-identical to BLAKE3 spec vectors (e.g. BLAKE3("hello") = ea8f163d…). DENSE codegen complete; link requires `libblake3.a` + `libsodium.a` at `$BORZ_DENSE_LIB_DIR/lib` — the documented DELIGHT handoff. Top-level free functions with `call cpp` bodies now lower to static-inline definitions in each handler's `_vm.cc`.
- **RFC-EXT-011** — `@deterministic` is now **enforced at compile time**. Banned in scope: `wall_now_ms()`/`actor_clock_ms()`/`time.now*` (BANNED_CLOCK), `Map.iter()`/`for x in <map>:` without sorted view (BANNED_ITER), any `f64` literal (BANNED_FLOAT), `random.*` (BANNED_RANDOM), cross-actor `<-` send (BANNED_SEND), inline `call go`/`call cpp` (BANNED_FFI), `infer:` (BANNED_INFER), `every:`/`after:` timers (BANNED_CLOCK). Every violation prints a hint pointing to the deterministic alternative (`ledger_now`, `iter_sorted`, `Decimal`, `vrf_random`). Pass is target-independent and runs after import resolution.
- **RFC-DELIGHT-METER** — `@meter_budget(cpu_us=N, mem_kb=M, state_write_kb=K)` on an actor declares the per-call resource envelope DELIGHT enforces (KVM_RUN timeout + micro-VM mem bound + state-diff check). The compiler emits the budget as compile-time constants (`k<Actor>_MeterBudget*`) in the state header AND surfaces it in the `.meta` sidecar that the DELIGHT loader reads. Defaults: 5000 µs / 64 KB / 4 KB. Over-budget calls trap and refund. Borz-side closed; DELIGHT-runtime side scaffolded in the RFC handoff.
- **RFC-DENSE-LAYOUT-V3** — DENSE state-layout v3 closes the v2 page-1+ EPT visibility bug. Author opts in via `@dense(layout=3)`; compiler auto-promotes when state size > 3500 B. Emits `kV3<Actor>_LayoutMagic=0xB0270003`, `kV3<Actor>_LayoutVersion=3`, `kV3<Actor>_LayoutRegionMap=0xNNNN` (u16 bitmap, 1 bit / 4 KB page; 16 pages × 4 KB = 64 KB max state). DELIGHT-substrate-side per-page mmap is the documented next runtime step.

End-to-end example combining `bytes`, `Decimal`, and `wall_now_ms()`:

```borz
import "std/bytes"  as *
import "std/bignum" as *
import "std/time"   as *

@canonical
type Receipt:
    version: u8
    seq:     u64
    payload: bytes

msg Check:
    hex: str

actor Smoke:
    @persistent var calls: i64 = 0

    @http(method="POST", path="/check")
    on msg Check:
        let raw = bytes_from_hex(msg.hex)
        let n   = len_b(raw)
        let now = wall_now_ms()
        let mul = decimal_mul(decimal_from_str("12.34"), decimal_from_str("0.05"))
        let eur = decimal_round(mul, 2, "half_even")  # "0.62"
        calls = calls + 1
        response(bytes_len=n, eur=eur, now=now, calls=calls)
```

`decimal_round` modes: `"down"`, `"up"`, `"half_up"`, `"half_even"`. Same
input → same output across native, DEMIX, DENSE — that's the cross-target
parity guarantee that makes deterministic-contract code possible.

## Quick reference

```borz
msg Transfer:
    from_id: i64
    to_id:   i64
    amount:  i64

trait Ledger:
    fn total(self) -> i64

actor Bank:
    @persistent var a1: i64 = 0
    @persistent var a2: i64 = 0

    @http(method="POST", path="/transfer")
    on msg Transfer:
        if msg.from_id == 1:
            a1 = a1 - msg.amount
            a2 = a2 + msg.amount
        response(a1, a2)

impl Ledger for Bank:
    fn total(self) -> i64:
        ret a1 + a2
```

Compile and run:

```
borz compile bank.borz --target native
./bank.native --serve --port 8080
curl localhost:8080/transfer -d '{"from_id":1,"to_id":2,"amount":30}'
```

## Type system (RFC-0002)

```borz
# Sum types with payload variants
enum Result:
    Ok(value: i64)
    Err(code: i64)

# Generic struct — monomorphised at compile time
type Pair[A, B]:
    first:  A
    second: B

# Top-level free function
fn add(x: i64, y: i64) -> i64:
    ret x + y

# Option / Result from stdlib
import "std/option"
import "std/result"
```

## Testing (RFC-0009)

```borz
actor MathTest:
    @test("add two numbers")
    on msg TestAdd:
        let result = add(2, 3)
        assert result == 5
        response(ok=1)
```

Run: `borz test math.borz`

## Hot reload (RFC-0011)

```borz
actor Counter:
    @persistent var count: i64 = 0

    @migrate_from(version=1)
    on msg Migrate:
        # Called when loading state from version 1
        count = 0  # reset on breaking schema change
```

Deploy: `borz deploy counter.borz --target myserver --restart`

## LSP / Formatter (RFC-0008)

```
borz lsp          # start LSP server on stdio (use with your editor)
borz fmt file.borz  # format file in place
```

## WASM target (RFC-0007)

```
borz compile hello.borz --target wasm
wasmtime hello.native.wasm
```

## Observability (RFC-0010)

Structured JSON log line:
```json
{"ts":"2026-05-16T10:00:00Z","actor":"Bank","handler":"Transfer","trace_id":"a1b2c3...","msg":"processed","level":"info"}
```

Use `@trace`, `@metric(name="transfers", type="counter")`, `@log_level(level="debug")` decorators on handlers.

## FFI escape hatch (RFC-0015)

`call go` and `call cpp` allow verbatim native code inside Borz handlers and functions.
`use go` / `use cpp` declare package/header imports.

**Imports:**

```borz
use go "crypto/sha256" as sha   # Go stdlib or third-party package
use go "encoding/hex"           # package without alias
use cpp "<math.h>"              # C header (DENSE/B-Cpp-1 only)
```

**Statements:**

```borz
call go "s.LastHash = hex.EncodeToString(h.Sum(nil))"  # native/DEMIX only
call cpp "result = sqrt(x);"                            # DENSE/B-Cpp-1 only
```

- Inside handlers: `call go` has access to `s` (actor state), `msg` (current message), and all imported packages.
- Inside functions: `call go`/`call cpp` write to a pre-declared `result` variable (the function's return slot).
- Dual-implementation (stdlib pattern): a function may have both `call go` and `call cpp` blocks; the compiler picks the one matching the target and silently ignores the other.
- Cross-target error: `call go` in a DENSE target → compile error. `call cpp` in a native/DEMIX target (without a peer `call go`) → compile error.

**SHA-256 example (native target):**

```borz
use go "crypto/sha256" as sha
use go "encoding/hex"

actor Hasher:
    @persistent var last_hash: str = ""

    @http(method="POST", path="/hash")
    on msg Hash:
        call go "h := sha.New(); h.Write([]byte(msg.Data)); s.LastHash = hex.EncodeToString(h.Sum(nil))"
        response(hash=last_hash)
```

**Structured `response()` (RFC-0015):**

`response()` fields that are structs or `List[T]` are serialized as JSON objects and arrays:

```borz
type PropertyItem:
    id: i64; name: str; city: str; price: i64

actor BookingSystem:
    var props: List[PropertyItem]
    @http(method="GET", path="/properties")
    on msg ListProperties:
        response(items=props, total=prop_count)
# → {"items":[{"id":1,"name":"Sunny Room...","city":"Lisbon","price":4500},...], "total":6}
```

**Stdlib modules using FFI:**

```borz
import "std/string" as *   # split, join, contains, to_upper, to_lower, trim, replace, parse_i64
import "std/math"   as *   # sqrt, abs_f64, floor, ceil, pow, min_i64, max_i64
```

## Rich expressions & stdlib (RFC-0018–0027)

Local variable bindings, list and map operations, f-strings, numeric casts, and six stdlib modules.

```borz
actor Stats:
    var history: List[i64]
    var labels:  Map[str, i64]

    on msg Record:
        let v = msg.value * 2
        history.push(v)
        labels[msg.key] = v
        let tag = f"key={msg.key} v={v}"
        response(tag=tag, total=history.len())
```

**Six stdlib modules:**

```borz
import "std/string" as *   # split, join, contains, to_upper, to_lower, trim, replace, parse_i64
import "std/math"   as *   # sqrt, abs_f64, floor, ceil, pow, min_i64, max_i64
import "std/time"   as *   # now_unix, format_unix, sleep_ms
import "std/conv"   as *   # i64_to_str, f64_to_str, str_to_f64
import "std/random" as *   # rand_i64, rand_f64, rand_choice
import "std/crypto" as *   # sha256_hex, hmac_sha256_hex
```

**RFC-0027 — Compile API:**
`POST https://api.borz.ai/v1/compile` — body: `{"source":"...","target":"native"}` → returns binary or source artefact.

## Distributed DENSE (RFC-0028 + RFC-0035)

Actor state replicates across a cluster automatically after every dispatch.

**Architecture:**
- DENSE coordinator (Go) — per-node daemon; listens on Unix socket for state snapshots from the local DENSE host
- `DenseStateExporter` (C++) — reads state region after KVM_EXIT_IO DONE signal, serialises as framed JSON, sends to the DENSE coordinator
- Dister KV — propagates snapshots to all peers; `dense.state.<actor_id>` key
- Primary/follower leasing (RFC-0035): `PrimaryManager` assigns epoch-based ownership. `RouteDecision` = `RouteLocal | RouteForward | RoutePending`. Lease TTL default 30 s, renewed every 10 s.

**Wire protocol (Unix socket, shared by C++ and Go):**
4-byte big-endian length prefix + UTF-8 JSON.

```json
{"type":"state_snapshot","actor_id":"counter","dispatch_id":42,
 "fields":[{"tag":1,"name":"count","value":"AAAA"}],"host_id":"host-a"}
```

**Manual migration (zero-downtime):**
```go
ManualMigration(ctx, "counter", "host-b", 5*time.Second)
// Drain → publish new PrimaryRecord(epoch+1, host-b) → release lease on host-a
```

**Configuration (borz-dense.yaml):**
```yaml
delight_config:           /etc/delight/config.yaml
local_dense_socket:       /tmp/delight-coord.sock
local_dense_reply_socket: /tmp/delight-coord-reply.sock
host_id:                  host-a.prod.example.com
lease_duration:           30s
```

## Benchmark tooling

`borz bench` runs the built-in benchmark suite and produces a markdown table.

**Current numbers (2026-05-17):**

| Program | Target | p50 | p95 | Binary size |
|---------|--------|-----|-----|-------------|
| counter | native -O2 | 3.2 ms | 3.6 ms | 8.4 MB |
| counter | llvm -O2 | 739 µs | 865 µs | 16.4 KB |
| counter | llvm -O3 | 764 µs | 944 µs | 16.4 KB |
| arith | llvm -O2 | 767 µs | 849 µs | 16.4 KB |
| slots | llvm -O2 | 754 µs | 876 µs | 16.4 KB |

DENSE KVM dispatch: **p50 ≈ 59 µs** on a single no-op handler (simple_add) · **p50 ≈ 200 µs** on a 3-actor fan-out application workload; binary ≈ 2–10 KB.

LLVM backend (`--target llvm`) produces self-contained flat ELF binaries (~16 KB) at ~4× lower latency than the full Go native runtime.

## E2E test framework (RFC-0033)

Real-process tests in the runtime E2E suite:

```go
proc := harness.NewProcess("borz-dense", binary, []string{"-config", configPath})
proc.Start(t)
proc.WaitReady(5*time.Second, func() bool { /* dial socket */ })

client := harness.NewClient(inputSock)
client.Connect(time.Second)
client.SendSnapshot(&harness.StateSnapshot{ActorID: "my_actor", DispatchID: 1, ...})
proc.AssertLogContains(t, "my_actor")
```

MockNode simulates a second DENSE coordinator in-process for multi-node replication tests.

## Enum codegen (RFC-0040, B-Cpp-1)

The C++ backend correctly emits tagged-union state fields for enum types. The v2 state layout stores enum discriminant + payload at the correct field offsets. `state_get`/`state_set` accessors generated per-variant. Write handlers no longer clobber the state magic header.

```borz
enum Status:
    Active(since: i64)
    Suspended(reason: str)

actor Subscription:
    @persistent var status: Status = Active(since=0)
    on msg Suspend:
        status = Suspended(reason=msg.reason)
```