[bug] A typo'd or forward $ref resolves to undefined — pipelines run to completion on missing data #244

Root cause of the class #243 is one instance of.

What happens

resolveInputValue (lib/pipeline.ts:206) resolves references by lookup, with no existence check:

if (typeof obj.$param === "string") { … return scope.params[obj.$param]; }   // :221
if (typeof obj.$ref === "string")   return readPath(scope.outputs, obj.$ref); // :223

and readPath returns undefined the moment a segment is missing (:191-199).

So three distinct authoring mistakes are all indistinguishable from "this value is legitimately
absent":

1. A typo'd bind — {"$ref": "geo.lat"} when the step bound geocode.
2. A forward reference — $ref to a bind produced by a LATER step. Steps run in order, so the
   output does not exist yet.
3. An undeclared param — {"$param": "citty"}, or a param the caller never supplied.

Each yields undefined, which is then handed to the step handler.

Why that is worse than it sounds

Handlers treat absent as default, not as error — asArray(undefined) → [],
Number(undefined) || 0 → 0, and so on. Combined, a single-character typo produces a pipeline
where every step succeeds, the run completes, and the output is empty or wrong. There is no
failed step, no error-log row, nothing to notice. See #243 for a concrete instance where this
silently drops every record.

Why this is cheap to fix

validatePipeline (:158) already collects exactly what is needed and uses it only for
duplicate detection:

const binds = new Set<string>();
…
if (binds.has(s.bind as string)) return `Step ${i}: duplicate bind "${s.bind}"`;
binds.add(s.bind as string);

Walk each step's inputs in the same loop and check the ROOT segment of every $ref against the
binds seen so far — that catches typos and forward references in one test, because "so far" is
precisely the set of outputs that will exist when the step runs.

Two details to get right:

• Implicit binds. stepBind (:187) defaults to step${index}, so $ref: "step3.foo" is
  legal without an explicit bind. The known-name set must include both.
• $param. Pipeline defs declare their params (params?: Record<string, {description?}>, the
  same map agent-think renders for the model). A $param naming something undeclared is an
  authoring error and can be rejected the same way. Be careful with item / item.* inside a
  forEach body — those are scope-provided, not params.

Only the first path segment can be checked statically (a $ref into a step's output shape is
not knowable ahead of time), but the first segment is where typos and ordering mistakes live.

Suggested shape

• Extend validatePipeline as above. It already runs on every stored def
  (:319 if (!def || validatePipeline(def) !== null) return null;), so bad defs are rejected at
  save/seed time rather than discovered as an empty run months later.
• seed-drift.test.ts already compares seeded defs to the reference JSON; this validation would
  also protect the first-party pipelines (lead-finder, site-builder, site-deploy) from a rename
  quietly breaking a $ref.

Verification

• A $ref to an unknown bind is rejected at validate time, naming the step and the bad reference.
• A $ref to a bind declared by a LATER step is rejected.
• $ref: "step2.x" is accepted when step 2 has no explicit bind.
• $param: "item.lat" inside a forEach body is still accepted.
• Every first-party seeded pipeline still validates — if one doesn't, that is a real bug this
  found, not a test to relax.