diff --git a/PORTABLE_ARTIFACTS.md b/PORTABLE_ARTIFACTS.md
index 99284a2..0f4618a 100644
--- a/PORTABLE_ARTIFACTS.md
+++ b/PORTABLE_ARTIFACTS.md
@@ -43,16 +43,20 @@ workspace authentication and explicit file registry; it never interprets an HTTP
 path as a Nix store path. Applications cannot import Replicache through the SDK.
 
 `checked-artifacts.nix` evaluates a package's `checkedArtifacts` output without
-activation. `loadCheckedArtifactWorld` then verifies manifest bytes, the trusted
+activation. During the checked Nix build, `loadCheckedArtifactWorld` verifies manifest bytes, the selected
 generator identity, and exact regenerated binding sources. Receipts are consistency
 evidence from a trusted Nix build, not cryptographic attestations of remote builds.
-The separate manifest-only loader is useful for candidate diagnostics; activation
-must use the checked loader.
+The build stores the checked plan, kernel/query programs, their digests and original
+compiler provenance in its immutable candidate output. Runtime loading validates
+that output's identities, artifact contents and supported runtime contracts. It
+does not regenerate bindings or programs with the currently running compiler.
+Nix owns rebuilding and cache reuse when a toolchain input changes.
 
 The root `camino-artifact-builds` check exercises actual reader/service outputs,
 module and process execution, browser shared imports, rejection recovery, and
-altered receipt rejection. The managed workspace host verifies these receipts
-before activation. No adapter pretends this ABI works in the old server dispatcher.
+altered receipt rejection at the build boundary. The managed workspace host loads
+the resulting checked candidate before activation. No adapter pretends this ABI
+works in the old server dispatcher.
 
 Component packages add `components = { inherit (react) sdk runtime; entries; }`.
 The ordinary execution candidate checker supplies the selected React build inputs