Read blob sizes only for selected validation inputs

docs/internal/validation.md

@@ -59,22 +59,24 @@ workspace-file check using the same candidate inventory. Resolved module bodies
 are parsed once per blob object ID; only owned filesystem-replacement targets
 and line numbers remain cached. Each declaration path receives findings from
 that summary in its own path context.
-The optional file-size check uses each blob's captured Git size, including
-symlink link-text bytes, and skips entries without a blob size such as gitlinks.
-It applies normalized literal file/directory exclusions with path-boundary
-matching, then returns the first oversized path with `FileSizeMeasurement`.
+The optional file-size check applies normalized literal file/directory
+exclusions with path-boundary matching, then requests local Git sizes for the
+remaining selected blobs. Sizes include symlink link-text bytes; gitlinks are
+omitted. The check returns the first oversized path with `FileSizeMeasurement`.
 The optional Markdown check follows file-size inspection and uses the same
 candidate tree. It parses regular Markdown blobs, resolves local destinations,
 and checks supported anchors; outside-checkout and submodule observations are
 written to the shared output writer. A nil writer keeps library use quiet.
-`CandidateTree` gets metadata and bytes from Git objects, reads blob bytes
-lazily, and resolves destinations without consulting the worktree or
-neighboring files. Each tree owns one lazy Git blob reader; direct tree users
-must close it when finished. The shared validation executor closes its tree on
-every return before product checks or build callbacks run. A metadata-only
-selection never starts the reader. Per-read contexts cancel an in-flight blob
-exchange. The context supplied when creating the tree governs the reader
-lifetime, including shutdown and child reaping.
+`CandidateTree` enumerates full repository path, type, mode, and object metadata
+without requiring blob contents or sizes. Checks acquire sizes and bytes for
+their selected inputs and required references. Unreferenced blobs in excluded
+modules remain outside those reads. Destinations resolve without consulting
+the worktree or neighboring files. Each tree owns one lazy Git blob reader;
+direct tree users must close it when finished. The shared validation executor
+closes its tree on every return before product checks or build callbacks run.
+A metadata-only selection never starts the reader. Per-read contexts cancel
+an in-flight blob exchange. The context supplied when creating the tree governs
+the reader lifetime, including shutdown and child reaping.
 Regular-file reads return independent caller-owned byte slices and are not
 retained by the tree. Symlink targets are retained as immutable owned strings
 by blob object ID; explicitly reading a symlink still returns independent

docs/roadmap/remediation.md

@@ -1,6 +1,6 @@
 # Remediation: module release implementation review
 
-Status: open; issues 1–14 are complete, and issue 15 requires remediation.
+Status: complete; all fifteen findings addressed and verified.
 The initial review examined `90559fe`, compared with planning baseline `dbfae9e`.
 The follow-up repository audit examined `6b0b8ce`, including those corrections.
 
@@ -544,7 +544,18 @@ network-capable preparation must continue to work.
 
 ## Issue 15: Limit blob availability requirements to selected validation inputs (P2)
 
-Status: open. Category: module-scope leakage through eager metadata enrichment.
+Status: complete. Category: module-scope leakage through eager metadata enrichment.
+
+**Completion:** Tree enumeration now acquires path/type/mode/object metadata
+independently of blobs. The size check requests sizes only for selected,
+non-excluded blobs; other checks read contents and references when needed.
+Filtered sparse-clone regressions cover formatting, sizes, workspace metadata,
+explicit shared selection, exclusions, required shared contents, and required
+Markdown references. They failed before the correction and now preserve each
+check's scope and error identity without transport or object-database changes.
+Existing size, symlink, gitlink, vendor, boundary, reader/cache, and cancellation
+tests pass. The complete offline suite, compiled API/dependency check,
+documentation links, and whitespace checks pass for all four follow-up fixes.
 
 **Evidence:** [ReadCandidateTreeForScope](../../internal/validation/tree.go)
 calls [ReadTree](../../internal/git/source.go) before constructing module and