Make command line references pipeline scoped

docs/consumers/dnd-pipeline.md

@@ -24,7 +24,9 @@ files. Use absolute paths for service and subprocess deployments. In
 particular, observe these different resolution rules:
 
 - reference paths in YAML are resolved relative to the Notarius configuration
-  file; and
+  file;
+- reference paths passed with `--reference` are resolved relative to the
+  Notarius process working directory; and
 - `promptkit.profile_file` is resolved relative to the Notarius process working
   directory.
 
@@ -73,9 +75,21 @@ notarius run dnd-session \
   --config /absolute/path/to/notarius.yml \
   --input /absolute/path/to/transcripts/final.trimmed.json \
   --output-dir /absolute/path/to/notarius-output \
+  --reference party=/absolute/path/to/references/party.txt \
+  --reference players=/absolute/path/to/references/players.txt \
+  --reference glossary=/absolute/path/to/references/glossary.txt \
+  --reference spell_catalog=/absolute/path/to/references/spells.json \
   --json
 ```
 
+Each unqualified reference is pipeline-scoped: Notarius supplies it to every
+selected D&D target that declares the slot. A deployment may omit an optional
+reference it does not maintain, and may use the lane- or binding-qualified
+forms from the [CLI reference](../cli.md#reference-selectors) for an exceptional
+override. The registry, scene-description, combat-turn, and NPC-occurrence
+references declared between ordered steps in the complete configuration are
+generated artifacts. Do not pass those handoffs on the CLI.
+
 The caller should:
 
 - capture stdout and stderr separately;

docs/consumers/subprocess.md

@@ -31,13 +31,36 @@ notarius run pipeline-id \
 ```
 
 Use absolute paths for supplied input, configuration, output-root, and
-reference files. Notarius generates a stable prompt session for the resolved
-input module and exact input bytes. Pass **--session-id** only when intentionally
-grouping different invocations under a different session. Supply credentials
-through Notarius's documented configuration and environment mechanisms, never
-as command-line arguments or generated secret-bearing configuration. In
-particular, a session identifier is provider-visible and is not a credential
-mechanism.
+reference files. Pass each external reference as its own argument-vector pair;
+do not construct and invoke a shell command. An unqualified reference selector
+supplies that file to every compatible selected target. Lane and stage
+qualification are available for exceptional overrides, while generated
+same-run references remain part of configured pipeline composition. The
+[CLI reference](../cli.md#reference-selectors) owns the exact selector and
+precedence contract.
+
+The maintained D&D subprocess workflow uses this facility for campaign context:
+
+```sh
+notarius run dnd-session \
+  --config /absolute/path/to/notarius.yml \
+  --input /absolute/path/to/transcripts/final.trimmed.json \
+  --output-dir /absolute/path/to/notarius-output \
+  --reference party=/absolute/path/to/references/party.txt \
+  --reference players=/absolute/path/to/references/players.txt \
+  --reference glossary=/absolute/path/to/references/glossary.txt \
+  --reference spell_catalog=/absolute/path/to/references/spells.json \
+  --json
+```
+
+Only pass the external references available to and desired by the deployment.
+Notarius generates a stable prompt session for the resolved input module and
+exact input bytes; reference changes do not change it. Pass **--session-id**
+only when intentionally grouping different invocations under a different
+session. Supply credentials through Notarius's documented configuration and
+environment mechanisms, never as command-line arguments or generated
+secret-bearing configuration. In particular, a session identifier is
+provider-visible and is not a credential mechanism.
 
 Wait for the process before interpreting standard output. Only an exit status
 of 0 permits decoding the receipt. On a nonzero exit, retain standard error for