Scope candidate blob readers to validation

docs/internal/validation.md

@@ -47,7 +47,13 @@ and checks supported anchors; outside-checkout and submodule observations are
 written to the shared output writer. A nil writer keeps library use quiet.
 `CandidateTree` gets metadata and bytes from Git objects, reads blob bytes
 lazily, and resolves destinations without consulting the worktree or
-neighboring files.
+neighboring files. Each tree owns one lazy Git blob reader; direct tree users
+must close it when finished. The shared validation executor closes its tree on
+every return before product checks or build callbacks run. A metadata-only
+selection never starts the reader. Per-read contexts cancel an in-flight blob
+exchange without tying the reader lifetime to a short-lived caller context.
+Until formatting and parsed-result reuse are in place, regular-file bytes stay
+cached by object ID for the lifetime of the tree.
 
 The internal Markdown parser uses Goldmark to record inline, reference, and
 autolinks, images, titles, and their source use sites, and to build heading

docs/roadmap/implementation.md

@@ -1,6 +1,6 @@
 # Computational Efficiency Implementation Plan
 
-**Status:** Stages 1–4 complete; Stages 5–11 pending.
+**Status:** Stages 1–5 complete; Stages 6–11 pending.
 
 ## Purpose And Baseline
 
@@ -316,6 +316,22 @@ preserve workspace/file-size metadata behavior. Re-run content benchmarks with
 reader startup and closure included in the content-operation timing. Update
 [validation mechanics](../internal/validation.md) for the landed lifecycle.
 
+**Completion:** Complete. `CandidateTree` owns a lazy batch reader and exposes
+idempotent cleanup. The shared executor closes it on every post-load return,
+before product checks or build callbacks; metadata-only runs leave it unstarted.
+Earlier check failures and cancellation remain primary, while an unexpected
+reader exit after successful content checks becomes a contextual failure for
+the last content-reading check. Direct tree users close their readers. The
+temporary object-ID byte cache remains until Stage 6. Validation, candidate,
+and root facade tests passed. Content benchmark timings now include reader
+startup and close (Go 1.26.8, Git 2.53.0, Linux x86_64 Intel Core i5-7260U,
+three repetitions): unique reads took 59.8–77.9 ms loose and 22.8–43.0 ms
+packed; unique-file formatting took 114–188 ms loose and 33.7–55.7 ms packed;
+repeated-ID reads took 2.18–6.45 ms, repeated-ID formatting took 4.75–6.62 ms,
+and the Markdown workload took 15.0–16.9 ms. Compared with the Stage 1 timings,
+these measurements reflect the shared Git process and include its lifecycle;
+timing varies on the shared machine.
+
 ## Stage 6: Release One-Use Source Bytes And Reuse Formatting Results
 
 **Owners:** `internal/validation/tree.go`, `validation.go`, and destination tests.