docs(dates): record the true-instant date contract

- CONTEXT.md: date/time vocabulary (true instant, wall clock, camera
  offset, display zone, filename date class, ...)
- ADR-0001: dates are true instants; wall clocks are a display concern
- un-ignore docs/adr/ so decisions land in git

CONTEXT.md

@@ -0,0 +1,64 @@
+# ImageApi
+
+A photo/video memory system: it ingests media from one or more libraries, derives metadata
+(hashes, dates, faces, insights) that follows the bytes rather than the path, and serves it
+to two consumers (the Apollo web UI and the FileViewer mobile app) plus a message store (SMS-API).
+
+## Language
+
+### Dates & time
+
+**True instant**:
+The actual moment a photo or video was captured, as Unix seconds. The one clock the whole
+system matches against — SMS messages, location track points, and photo dates are all true
+instants, so they compare directly with no conversion.
+_Avoid_: epoch, real UTC, wall time
+
+**Wall clock**:
+The local time the capturing device showed (e.g. "14:30 on the beach"), independent of where
+the owner is. A wall clock is not an instant until paired with a zone; it is what the UI's
+metadata line and insight prompts show so memories read the way the camera remembered them.
+_Avoid_: local time, naive date, camera time, date_taken
+
+**Camera offset**:
+The zone offset that converts a photo's wall clock into its true instant, resolved per photo
+at ingest from the most specific evidence available (an explicit EXIF offset tag, then GPS
+position, then the server's zone as a flagged assumption). Recorded on the row so the
+conversion is auditable.
+_Avoid_: timezone, tz, server offset
+
+**Display zone**:
+The IANA zone name of the owner, used for day-level grouping (memories buckets, timelines,
+daily summaries) and for rendering wall clocks when a photo carries no camera offset. Stored
+as a zone name, never a fixed minute offset, so DST changes stay correct.
+_Avoid_: timezone_offset, tz_offset_minutes, client offset
+
+**Date source**:
+Which step of the ingest waterfall filled a photo's date — EXIF tag, external metadata
+tool, filename, filesystem time, or a manual edit. Recorded per row so weak entries can be
+re-resolved when a better tool arrives and so any row's date can be explained.
+_Avoid_: provenance, origin
+
+**Filename date class**:
+Filenames whose name itself carries the capture date (screenshots, timestamp-named exports).
+For this class the filename is the original date of record and outranks EXIF, even though
+EXIF wins everywhere else. Each pattern in the class carries its own convention: some names
+encode a wall clock, others encode a true instant.
+_Avoid_: regex dates, name parsing
+
+**Manual date**:
+A date the operator sets by hand, expressed as a wall clock in the display zone at edit time
+and stored as the resulting true instant. The prior value is kept as the original date.
+_Avoid_: corrected date, user date
+
+**Re-anchoring (legacy)**:
+The pre-instant habit of storing wall clocks as if they were UTC and having every consumer
+shift them back by a zone. Survives only in the frozen legacy column and in the consumer
+code that migrates off it; new code never re-anchors.
+_Avoid_: tz fix, offset correction, naive handling
+
+**Derived day data**:
+Insights and pre-computed artifacts grouped by calendar day (daily message summaries,
+reel pre-generation). Because it is keyed on the day, re-dating a photo across a day
+boundary invalidates the derived data for that day, which regenerates on its normal schedule.
+_Avoid_: cache, nightly output