RFC-7: Thermite 3 — a surface generation for a language written by agents

[maxinelevesque]

The horizon behind RFC-6,
so the anchor reads as one step of a stated plan rather than an isolated request
for five keyword renames.

This asks for nothing except the anchor. It introduces no requirement and
proposes no capability. What it wants is a direction check:

1. Is a surface generation wanted at all? If not, RFC-6 should be closed and
   the six documents behind this one are never written up. That is a cheap
   outcome and it is the reason this exists.
2. Does the organising rule hold? Every clause is a third-person-singular
   verb whose subject is the item. It decided every name in RFC-6 — it is why
   inv became keeps rather than staying a noun in a verb slot — and it is
   the one thing worth arguing about before any of it is built.
3. Is the ordering right? Six capability proposals, each depending on the one
   before, with what each costs.

Why it exists

RFC-6 defends keeps and measures with a clause-grammar rule. Read against
five keywords alone, that rule looks like more machinery than the job needs. It
earns its keep because seven more clauses have to fit it — survives, asks,
promises and the rest — and that fact was not visible anywhere in RFC-6.

The name follows the convention RFC-1
set. Thermite 2 changed what the language can prove; this changes what it reads
like. That separability is the whole reason the cheap-to-review part can go
first.

What is in it

Fourteen sections carrying the surface with a status mark on each construct —
anchor, later, or research — so it is always clear what is being
asked for now and what is not.

§15 writes the whole surface out as one coherent paging subsystem, so it reads as
a language rather than a pile of decisions. That listing does not certify and
says so in place.

The appendix carries the probe results the design was built on, each a
forge check at 84d276e7 against Verus 0.2026.05.24.ecee80a. Several
contradicted the documentation:

• fx write(a_region_that_does_not_exist) on a body that touches nothing
  certifies at L3 — the row is unchecked in both directions.
• req true certifies at L3 while ens true is rejected as EnsIsTrivial.
• The fx diverge exemption does not reach loops, so an intentionally infinite
  loop — a scheduler idle loop — is only writable by supplying a measure that
  cannot decrease, and the false measure then sits in the source where a later
  reader will believe it. That one is worth a defect report on its own.

Sequencing

Steps 4 through 9 each have a design document behind them and stay unfiled
until the direction here is answered. Nothing after the anchor is proposed.

Depends on #128

Targets rfc/full-words so its links to RFC-6 resolve. GitHub retargets as the
stack merges. Gates run locally under Python 3.11: rfc-check and doc-drift
both exit 0; this RFC touches no requirement, so the registry is unchanged.

Per RFC-5's convention, this should not be squash-merged.

🤖 Generated with Claude Code