Add specification

CONTEXT.md

@@ -0,0 +1,27 @@
+# WireGuard Client Management
+
+Terminology for managing device access to a WireGuard VPN.
+
+## Language
+
+**Draft**:
+Changes prepared by the administrator but not yet saved through Commit.
+
+**Commit**:
+Saving prepared changes without applying them to the running VPN.
+
+**Unapplied changes**:
+Differences between the saved configuration and the running VPN state. Applied through a separate restart operation.
+
+**Backup**:
+A copy of the saved server configuration, client metadata, and encrypted vault. Drafts and existing unencrypted client files are excluded.
+
+**Client**:
+An individual device with its own key pair and VPN connection configuration. One person may have multiple clients.
+_Avoid_: User, account
+
+**Client alias**:
+An administrator-friendly name for a client. A client is identified by its public key rather than its alias.
+
+**Anomalous client record**:
+A record with only a server configuration entry or only a client connection file, without its corresponding counterpart. Records are matched by public key and are not automatically repaired when discovered.