Version and bind module build receipts

docs/consumers/build.md

@@ -83,6 +83,8 @@ points inside the source tree.
 
 For delivery from a tagged checkout, `deliver` builds selected tagged-source
 targets into temporary storage by default. Use `--assets DIR` to deliver a
-separate build output; ReleaseKit requires its receipt and verifies the source,
-build settings, and artifact hashes before the first Gitea write. See the
+separate build output; ReleaseKit requires the current module-bound receipt and
+checks its source identity and normalized build settings. It verifies artifact
+bytes and sizes during delivery before the first Gitea write. Older receipts
+must be regenerated with the updated `build` command. See the
 [delivery consumer guide](delivery.md) for page-only delivery and retry states.

docs/consumers/delivery.md

@@ -89,9 +89,11 @@ RELEASEKIT_GITEA_TOKEN="$GITEA_TOKEN" releasekit deliver --assets dist v1.2.3
 
 The build command does not need delivery credentials. The `--assets DIR`
 directory must contain the private `.releasekit-build.json` receipt created by
-`build`. ReleaseKit checks the receipt's repository, commit, version, resolved
-module directory and path, full tag, build settings, and file hashes before
-making a remote request; caller-owned files remain available for retries.
+`build`. ReleaseKit checks its schema, repository, commit, version, resolved
+module directory and path, full tag, normalized build settings, and artifact
+declarations. Old receipts must be regenerated with the updated `build`
+command. Delivery verifies the artifact bytes and sizes before making a hosted
+request; caller-owned files remain available for retries.
 Ordinary `deliver` does not download application dependencies or change the
 checkout.