docs(meta): add the context glossary and the plumbing-contract ADR

Two artifacts the repo's documented structure called for but had never
gained: meta/ is the first context with a CONTEXT.md, and the base image's
contract is the first decision scoped to a single context rather than the
repo.

The ADR records what the code already did and the docs denied. The library
reads host-git-common-path and host-timezone by name and links to
/host-git-common; those are contract terms, so the README's claim that the
stub 'does not constrain where the host keeps anything' was only half true.
It constrains the names, not the sources. Syndic/.dotfiles is the evidence:
presenting the same host state in a different shape let its copy diverge in
kind rather than in detail.

The glossary also disambiguates 'plumbing' from git's own plumbing/porcelain
sense, which .git-plumbing/ maximises the collision with. The term stays --
it is apt in the ordinary sense and renaming it would reach the command, the
env prefix, the function prefix, both repos' docs and an unadopted consumer.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: Syndic

CONTEXT-MAP.md

@@ -27,8 +27,7 @@ it). Repo-wide decisions live in `docs/adr/`.
   Treat a request for anything under "planned" as unimplemented: a redundancy check that matched a
   request against this domain language would otherwise close a real one as already-done.
 
-- **Repo meta** — `meta/`
-  _(`CONTEXT.md` not yet written)_
+- **Repo meta** — `meta/` ([`CONTEXT.md`](meta/CONTEXT.md))
 
   The monorepo's own automation: `meta/scripts/` (pre-commit checks, changed-path classification,
   Renovate proposal ratification and manual-job triggering, base-image pin sync) and

meta/CONTEXT.md

@@ -0,0 +1,60 @@
+# Repo meta
+
+The monorepo's own automation: the repo-health checks that enforce cross-cutting invariants, and
+the shared devcontainer base image that Syndic repos build their development environments on. It
+operates on the other contexts rather than shipping anything a user runs.
+
+## Language
+
+### Devcontainer base image
+
+**Base image**:
+The devcontainer image this context assembles and publishes for Syndic repos to build on. It
+carries the container half of the plumbing and nothing else — no language toolchains, no features.
+_Avoid_: shared image, common image
+
+**Consumer**:
+A repo whose devcontainer Dockerfile `FROM`s the base image. This repo is one; `Syndic/.dotfiles`
+is the other.
+_Avoid_: client, downstream, dependent
+
+**Plumbing**:
+The bridging of host state into a container — the git common directory, the host timezone, the
+material a signed commit needs. Not git's plumbing/porcelain sense: nothing here is a low-level git
+command.
+_Avoid_: bootstrap, host integration
+
+**Host stub**:
+The `initializeCommand` script a consumer keeps, which runs on the developer's host before any
+container exists. Its job is to present host state in the shape the container consumes, without
+dictating where the host keeps anything.
+_Avoid_: initialize script, host script
+
+**Dispatcher**:
+The single command a consumer's lifecycle hooks call to apply every shared plumbing step for a
+phase. Being one command rather than a library is what lets a new step reach every consumer on its
+next base image bump, with no edit on their side.
+
+**Contract**:
+The interface between a consumer's host stub and the base image: the file names, symlink names and
+values the stub must present, plus the destinations the plumbing writes to. Conforming to it is
+what adoption means.
+
+### Repo health
+
+**Check**:
+A guard that enforces an invariant no single language toolchain owns. Whether it blocks depends on
+where it runs — CI, pre-commit, or on-save in the editor — not on what it is.
+_Avoid_: gate, guard, linter, validator
+
+**Derived file**:
+A checked-in file that is reproducible from other checked-in sources, so it is regenerated rather
+than hand-edited and its staleness is a defect a check can find. Distinct from a dependency, whose
+value comes from outside the repo and is bumped rather than derived — the same artifact can be one
+in this repo and the other in a consumer.
+_Avoid_: generated file, lockfile
+
+**Marker comment**:
+A comment that tells Renovate which version string a line carries, where the file's own syntax
+can't. A marker no pattern claims is invisible rather than broken, which is the failure mode it is
+prone to.

meta/docs/adr/0001-the-plumbing-contract-includes-the-host-presentation-shape.md

@@ -0,0 +1,42 @@
+# The plumbing contract includes the host-presentation shape
+
+The shared devcontainer base image's contract with a consumer is not merely "call the dispatcher".
+It includes the shape the host stub must present: fixed file names under `.git-plumbing/`, fixed
+symlink names beside it, and the destinations the plumbing writes to. A consumer conforms to that
+layout. What stays free is where on the host each value is read from, which is what the symlink
+indirection buys.
+
+## Considered options
+
+### The steps only — rejected
+
+Under this reading the image publishes behaviour, and each consumer presents host state however it
+likes. It is what `meta/devcontainer-base/README.md` implied by saying the stub "does not constrain
+where the host keeps anything".
+
+The code never matched it. `plumbing_apply_git_common` reads `$PLUMBING_DIR/host-git-common-path`
+by name and links it to `/host-git-common`; `plumbing_apply_all` reads `host-timezone` by name.
+Those are contract terms whether or not they are written down as such. Leaving them undocumented
+means the next consumer discovers them by breakage rather than by reading, and `Syndic/.dotfiles`
+demonstrates the cost: it presents `known_hosts` and `allowed_signers` as snapshot files where this
+repo presents them as bind-mounted symlinks, so its copy of the plumbing diverged in kind rather
+than in detail.
+
+### The steps plus the shape — accepted
+
+The contract names the files, the symlinks and the destinations, and the README documents them as
+an interface. The host stub's remaining freedom is real but bounded: it chooses what each symlink
+points at, so a developer's `known_hosts` can live anywhere, but it does not choose the name the
+container looks for.
+
+## Consequences
+
+- Adoption is conformance, not integration. `Syndic/.dotfiles` moves to the documented shape rather
+  than keeping its own; its snapshot-based handling is an artefact of age, not a variant to support.
+- A consumer that wants a different layout has one supported answer — change the symlink target —
+  and one unsupported one. That is deliberate: configurability on this axis would reintroduce the
+  divergence the shared image exists to remove.
+- The contract is versioned by the image digest like everything else, so widening it is a base
+  image change that reaches consumers on their next bump.
+- What the image cannot carry stays outside the contract and unsolved: the host stub itself, the
+  two bind mounts, and `containerEnv`. Tracked in #248.