ADR 0017 — the adstrate: the off-record referent tier (CAS, cell, wire)

• Status: accepted
• Date: 2026-06-13
• Builds on: 0013 ("facts/CAS/cell/wire as the primitive surfaces"), 0016 (stele is the fact substrate; the "primitive services" this ADR names)
• Relates: 0012 (the theory tier this one is the dual of), arche RFC 0001 (the four primitives)

The tier between the substrate and its occupants gets a name and a definition: the adstrate — the layer alongside the floor, as sub- is the layer under it. An adstrate is a referent category outside the record — content (CAS), state (cell), flow (wire) — with an identity discipline that keeps every fact-binding to it re-checkable. Its contract is stated entirely in facts; its payload is precisely what facts cannot contain; its implementations are ordinary occupants. Theories hold the substrate's irreducible judgments; the adstrate holds its irreducible referents.

Context

Three documents gesture at this tier without defining it. 0016 decomposes arche into "primitive services" but says nothing about what makes them primitive. 0013 names "facts/CAS/cell/wire as the primitive surfaces" in a single passing clause. The glossary's primitive entry (arche RFC 0001) defines the effect-surface sense — protected, uniform across spaces, not composable from existing primitives — for all four: facts, CAS, cell, wire.

Since then the fact primitive was promoted into the substrate itself (stele, 0016), leaving the other three in an undefined position: constitutionally referenced by the candidate theories' vocabulary ("needs this cell, emits on this wire" — 0013 §1; "CAS is the byte mechanism; an artifact is the immutable content as a fact-mediated, space-scoped object" — §3), yet mechanically ordinary stele clients with no privileged path. Neither substrate nor mere tenant.

The gap is starting to cost. The work-plane notes (scratch/agentic-development.md) lean on this tier implicitly — judgment facts are "over immutable subjects", change-subject artifacts bind to arche-cas, the effectuator pattern "gates on an immutable subject" — and every one of those rules is only well-posed because a content-addressed referent category exists. Without a name and a test, the tier's boundary gets decided implicitly by the next port (arche-cas is queued), and "domain-free service" starts to pass for "primitive".

Decision

1. The tier is named the adstrate. The morphological sibling of substrate: sub- "the layer under", ad- "the layer alongside" (the substrate/superstrate/adstrate triad is established usage in linguistics). The position is the claim: an adstrate is beside the floor — constitutionally named by the substrate's own vocabulary, like no occupant is; mechanically an ordinary fact-governed client, like no substrate member is. Collectively "the adstrate" (stele is the substrate; CAS, cell, and wire are the adstrate); per category "an adstrate" (CAS is the content adstrate, cell the state adstrate, wire the flow adstrate).

2. An adstrate is a referent category with an identity discipline. The record can refer to other facts and carry small values — and nothing else. An adstrate extends what facts can denote: a new category of thing outside the record (content, state, flow), under an identity discipline that keeps the binding re-checkable — content addressing for CAS (a sha256:… binding is verified by rehashing), a stable name over governed transitions for cell, a channel identity for wire. The dividing line against occupants: adstrates extend denotation; occupants extend action. A runner, a connector, a steward act in the world and assert observations about it; they add no new kind of thing a fact can point at.

3. Interface in facts, payload off-record. An adstrate's entire public face is its fact language — bindings, grants, endpoint attestations, GC participation — plus its identity discipline. Its substance is precisely what facts cannot hold. This makes the opacity symmetric, and the symmetry is the design: opaque downward — consumers couple to the fact language and the identity discipline, never to the implementer, so any occupant may serve a given adstrate and swapping it is invisible; opaque upward — the implementer never learns what the payload means (CAS does not know an artifact is a change-subject; the wire does not know what flows through it). The adstrate exports stele's body-agnosticism one level out.

4. The adstrate test. A service is an adstrate only if it introduces a referent category facts could not otherwise bind to — not definable from the existing categories plus the record. This is the referent-side counterpart of 0012's irreducibility test for theories, and it sharpens RFC 0001's "not composable from existing primitives": in particular, anything implementable through facts is not an adstrate — it is data on the record, however domain-free its service wrapping. Symmetrically, that is why law is substrate and not adstrate: policy content is fact-borne (grants, rule-facts) and evaluated by logos; its substance is symbolic and the record swallows it whole. The adstrate is the remainder after the record has swallowed everything symbolic.

5. Terminology is fixed accordingly. Primitive keeps its arche RFC 0001 effect-surface sense and covers all four surfaces, facts included; adstrate is the three off-record ones — the primitives minus the record. 0016's "primitive services" reads as "adstrate implementations" where it means CAS/cell/wire and "occupants" where it means runners and controllers. Capability stays reserved for the candidate theory (0013): an adstrate has capabilities — when that theory crystallizes, an adstrate's offer is stated in capability vocabulary — it is not one.

6. The trust gradient is recorded, not hidden. "Trusted only as far as its bindings check" varies by adstrate. CAS's re-checkability is intrinsic — rehash the bytes and the implementation cannot lie. Cell and wire cannot offer that: a state read or a delivery claim is only as good as the implementer's signed attestation plus whatever probes verify it (the runtime-endpoint probe pattern, atlas#523). CAS is the gold-standard adstrate; the others are adstrates on credit — one reason CAS ports first (0016 §3).

Consequences

• The glossary gains adstrate (concepts.json + regenerated glossary.md); the existing primitive entry keeps the RFC 0001 sense per §5. The site picks both up automatically.
• The tier table for the family reads: substrate (ontos · logos · thesmos · horos · stele — the irreducible judgments and the record) / adstrate (CAS · cell · wire — the irreducible referents) / occupants (runners, connectors, stewards, services — replaceable actors the theories make claims about).
• No topology change. layer in constellation.json stays substance | downstream | infrastructure; adstrate is a semantic tier, not a layer value. Adstrate implementations (arche-cas, …) register as downstream members on crystallization, exactly as 0016 prescribes. If the distinction ever needs to be machine-readable, that is a separate decision.
• Cell's adstrate status is an open question, on the record. process.v0 already derives mutable state as a fold over facts (the desired fold by generation), which is exactly the §4 disqualifier. Whether cell names a genuine referent category or reduces to the record is decided when cell crystallizes — not implicitly by building it.
• The test bites future proposals: "domain-free" is not "adstrate". A notification service, a search index, a cache compose existing categories; they are occupants. A new adstrate claim must show a referent facts cannot otherwise bind to — the expected rare case (execution? — currently held by realization as theory plus runner as occupant) goes through an ADR, not a repo name.