Make command line references pipeline scoped

docs/internal/cli.md

@@ -115,6 +115,16 @@ to checkpoint identity and `pipeline.RunInput`. The public flag and stability
 contract are defined by the [CLI reference](../cli.md#run); framework and LLM
 packages only transport the supplied value.
 
+The CLI also owns the scope grammar for reference flags. It enumerates the
+selected chunk and lane targets from registered module specifications, expands
+pipeline- and lane-scoped actions into exact stage-and-lane bindings, and
+resolves overlapping bind and unbind actions by specificity before calling
+configuration resolution. The generic pipeline therefore receives only exact
+`ReferenceBinding` and `ReferenceUnbind` values and has no knowledge of CLI
+selector syntax. Configuration resolution retains ownership of configured
+external/generated conflicts, required slots, and module compatibility; file
+materialization still occurs afterward.
+
 For `run --json`, the CLI constructs and encodes its private run-result receipt
 after a successful runner result is available, before it publishes logical
 output files. It writes the prepared receipt to standard output only after
@@ -166,8 +176,9 @@ is discoverable.
 - **internal/cli/production_contract_test.go** covers registrar composition,
   production catalog contents, assets, and representative configuration
   validation.
-- **internal/cli/reference_contract_test.go** covers CLI reference overrides,
-  origin separation, and materialization boundaries.
+- **internal/cli/reference_contract_test.go** covers scoped CLI reference
+  expansion, specificity, bind/unbind conflicts, generated-reference
+  protection, origin separation, and materialization boundaries.
 - **internal/cli/state_hardening_test.go** covers safe run identity, state
   roots, and failure ordering.