Add canonical source unit provenance

docs/internal/modules.md

@@ -40,9 +40,10 @@ evidence. The resolver and materializer behavior is described in
 ### `internal/modules/seriatim/input/transcript`
 
 The adapter decodes the supported transcript JSON, selects the source identity,
-computes the raw-input digest, validates segments, and maps each segment into a
-generic source unit with speaker and timestamp metadata. Its spec advertises the
-transcript capabilities consumed by D&D modules.
+computes canonical source provenance, validates segments, and maps each segment
+into a generic source unit with a self-reference plus speaker and timestamp
+metadata. Its spec advertises the transcript capabilities consumed by D&D
+modules.
 
 Parsing is strict about required values and duplicate unit IDs but deliberately
 ignores unrelated Seriatim fields. The external format and derived-identity

docs/internal/pipeline.md

@@ -74,6 +74,11 @@ selected input adapter. Later stage requests receive the generic source model;
 extract requests receive chunk-scoped input material, while chunk, merge, and
 normalize requests retain access to the original source material.
 
+Source validation requires every unit to carry a canonical self-reference to
+its containing document and its own unit ID. Explicit clone, checkpoint, and
+debug boundaries retain that reference, and the canonical source digest covers
+it deterministically.
+
 `pipeline.RunOutput` carries the run manifest, accepted normalized results,
 rejected results, warnings, checkpoint events, and logical files returned by the
 output encoder. The CLI owns diagnostics and durable filesystem writes after the