Read blob sizes only for selected validation inputs

docs/internal/validation.md

@@ -59,22 +59,24 @@ workspace-file check using the same candidate inventory. Resolved module bodies
 are parsed once per blob object ID; only owned filesystem-replacement targets
 and line numbers remain cached. Each declaration path receives findings from
 that summary in its own path context.
-The optional file-size check uses each blob's captured Git size, including
-symlink link-text bytes, and skips entries without a blob size such as gitlinks.
-It applies normalized literal file/directory exclusions with path-boundary
-matching, then returns the first oversized path with `FileSizeMeasurement`.
+The optional file-size check applies normalized literal file/directory
+exclusions with path-boundary matching, then requests local Git sizes for the
+remaining selected blobs. Sizes include symlink link-text bytes; gitlinks are
+omitted. The check returns the first oversized path with `FileSizeMeasurement`.
 The optional Markdown check follows file-size inspection and uses the same
 candidate tree. It parses regular Markdown blobs, resolves local destinations,
 and checks supported anchors; outside-checkout and submodule observations are
 written to the shared output writer. A nil writer keeps library use quiet.
-`CandidateTree` gets metadata and bytes from Git objects, reads blob bytes
-lazily, and resolves destinations without consulting the worktree or
-neighboring files. Each tree owns one lazy Git blob reader; direct tree users
-must close it when finished. The shared validation executor closes its tree on
-every return before product checks or build callbacks run. A metadata-only
-selection never starts the reader. Per-read contexts cancel an in-flight blob
-exchange. The context supplied when creating the tree governs the reader
-lifetime, including shutdown and child reaping.
+`CandidateTree` enumerates full repository path, type, mode, and object metadata
+without requiring blob contents or sizes. Checks acquire sizes and bytes for
+their selected inputs and required references. Unreferenced blobs in excluded
+modules remain outside those reads. Destinations resolve without consulting
+the worktree or neighboring files. Each tree owns one lazy Git blob reader;
+direct tree users must close it when finished. The shared validation executor
+closes its tree on every return before product checks or build callbacks run.
+A metadata-only selection never starts the reader. Per-read contexts cancel
+an in-flight blob exchange. The context supplied when creating the tree governs
+the reader lifetime, including shutdown and child reaping.
 Regular-file reads return independent caller-owned byte slices and are not
 retained by the tree. Symlink targets are retained as immutable owned strings
 by blob object ID; explicitly reading a symlink still returns independent