Scope candidate blob readers to validation

docs/internal/validation.md

@@ -47,7 +47,13 @@ and checks supported anchors; outside-checkout and submodule observations are
 written to the shared output writer. A nil writer keeps library use quiet.
 `CandidateTree` gets metadata and bytes from Git objects, reads blob bytes
 lazily, and resolves destinations without consulting the worktree or
-neighboring files.
+neighboring files. Each tree owns one lazy Git blob reader; direct tree users
+must close it when finished. The shared validation executor closes its tree on
+every return before product checks or build callbacks run. A metadata-only
+selection never starts the reader. Per-read contexts cancel an in-flight blob
+exchange without tying the reader lifetime to a short-lived caller context.
+Until formatting and parsed-result reuse are in place, regular-file bytes stay
+cached by object ID for the lifetime of the tree.
 
 The internal Markdown parser uses Goldmark to record inline, reference, and
 autolinks, images, titles, and their source use sites, and to build heading