Add canonical source unit provenance

docs/internal/pipeline.md

@@ -74,6 +74,11 @@ selected input adapter. Later stage requests receive the generic source model;
 extract requests receive chunk-scoped input material, while chunk, merge, and
 normalize requests retain access to the original source material.
 
+Source validation requires every unit to carry a canonical self-reference to
+its containing document and its own unit ID. Explicit clone, checkpoint, and
+debug boundaries retain that reference, and the canonical source digest covers
+it deterministically.
+
 `pipeline.RunOutput` carries the run manifest, accepted normalized results,
 rejected results, warnings, checkpoint events, and logical files returned by the
 output encoder. The CLI owns diagnostics and durable filesystem writes after the