intakelisted

# Intake — priming **Canonical spec:** `docs/domains/intake.md` — read it for the four verbs, all invariants, key files, and gotchas. Terms of record: `UBIQUITOUS_LANGUAGE.md` § Lifecycle (Intake, Git-History Intake, Watermark). `IntakeService` owns gating, dedup, store plumbing, dry-run, and result aggregation; each extractor knows exactly one source. Every seeded memory lands on the import trust floor (`Provenance = Intake`). ## Core invariants (get these right) - **The bulk write runs `Validate: false` on purpose** — that path throws and aborts the batch. Intake calls `WriteValidator.Validate` per candidate in the sink: **skip-not-abort**, reason surfaced, and nothing is ever stored unscanned. - **Blank a rejected candidate's content in the result** — otherwise a caught secret leaks out through CLI/REST output. - **Intake ids are content-addressed via `MemoryIdGenerator`** — that's what makes re-ingest a single `GetAsync` probe, and minting locally would make every intake memory read as tampered. - **Every skip carries a reason** so "0 new" is never mysterious. - **Git intake mines the pattern, never diff lines**; the gate is a deterministic Conventional-Commits allowlist (`fix` → Procedure, feat/perf/refactor → Insight). - **Read the git watermark before the run, advance it after** (at-least-once; dedup absorbs replays). Dry runs never advance it. - **Out-of-repo sources are opt-in and path-constrained** — the Claude-memory extractor reads only the resol