Documentation accuracy sweep: mmap, Blake3, pickle, orjson, master-key env var

[27Bslash6]

Summary

Several user-facing docs/strings describe behavior that does not exist:

• "zero-copy memory-mapped reads (lowest read memory)" for compression=none — no mmap path exists anywhere (settings.py:124, arrow_serializer.py:88-90,142,222). See EPIC: Zero-copy mmap read path for the File backend (large-object read RSS) #171.
• "Blake3 checksums" — ByteStorage uses xxHash3-64 (rust/src/lib.rs:46,52 + CLAUDE.md/DEVELOPMENT.md). BLAKE3 is only the cache-key hash. (core doc issue tracks the Rust side.)
• "plain pickle" for auto no-integrity mode — it is plain msgpack, no pickle anywhere (serializers/__init__.py:75). Misleads on both security surface and object support.
• orjson docstring claims "compression handled by Rust layer if enabled" — orjson never touches ByteStorage (orjson_serializer.py:141).
• Master-key error/docstring says REDIS_CACHE_MASTER_KEY; the real var is CACHEKIT_MASTER_KEY (encryption_wrapper.py:131, cache_handler.py:292).

Fix

Correct each string to match implemented behavior (or, for mmap, gate the claim on #171 landing).

[27Bslash6]

Per-claim disposition, re-verified on main (f7b15d9, 2026-09-04). Two of the five needed a fix; the fix is #280, which closes this issue on merge. The paths this issue cites have rotted — CLAUDE.md no longer exists and settings.py is now src/cachekit/config/settings.py — current locations are given per row.

#	Claim	Disposition	Where it is true now
1	"zero-copy memory-mapped reads" for compression=none	Verified now TRUE — with bounds. #171 shipped the path end-to-end.	src/cachekit/backends/file/backend.py (_MmapHandle, mmap.mmap(fd, st_size, access=ACCESS_READ), MMAP_MAX_BYTES = 512 MB); routed in cache_handler.py; protocol in backends/base.py; tested in tests/unit/test_mmap_read_path.py incl. a real-mmap Arrow roundtrip; documented in docs/backends/file.md. The claim lives at config/settings.py:190 and serializers/arrow_serializer.py:212,318. Eligibility is narrow and the docs say so: Arrow/pandas plaintext, compression="none", POSIX only, payload above the 14-byte header and ≤ 512 MB. Excluded cases are pinned by test_default_serializer_not_eligible, test_encrypted_arrow_not_eligible, test_arrow_return_format_not_eligible.
2	"Blake3 checksums"	Corrected. rust/src/lib.rs:51,57 already read xxHash3-64; the four surviving sites (tests/competitive/test_cachetools_comparison.py, rust/TEST_EXPANSION_SUMMARY.md ×2, rust/supply-chain/config.toml note) plus the SECURITY.md mis-attribution are fixed in #280. hash_utils.py keeps BLAKE3 — it is the cache-key hash, a different subsystem. Rust side: cachekit-io/cachekit-core#46 closed with evidence.
3	"auto" + integrity off = "plain pickle"	Corrected in #280. AutoSerializer never pickles: default_format accepts only "msgpack" (serializers/auto_serializer.py) and the non-ByteStorage path is raw msgpack. serializers/__init__.py docstring now says so.
4	orjson "compression handled by Rust layer if enabled"	Corrected in #280. OrjsonSerializer never enters ByteStorage; its envelope is [xxHash3-64 checksum][json] or raw json (serializers/orjson_serializer.py). Comment now says so.
5	master-key error names REDIS_CACHE_MASTER_KEY	Verified FIXED by #194.	tests/unit/test_encryption_config_resolution.py:8,59 asserts the string is absent from the error message; the real variable CACHEKIT_MASTER_KEY is what config/settings.py reads.

Tracked as LAB-3017 under epic LAB-105.