docs(matrix): consolidate ten conflicting sdk-feature-matrix PRs into one code-verified refresh (LAB-1400)

CHANGELOG.md

@@ -4,6 +4,24 @@ All notable changes to the CacheKit Protocol Specification.
 
 ## [Unreleased]
 
+### SDK Feature Matrix
+
+- Consolidated ten conflicting open matrix PRs into one code-verified end-state
+  (LAB-1400), regenerated from current SDK code rather than from the stale PR
+  diffs. Cells that **reversed** — check these if you built on them: key
+  rotation (py/rs ✅ → ❌ fleet-wide; `rotate_key()` is a `NotImplemented`
+  stub, and cachekit-py's importable PyO3 `KeyRotationState` succeeds while
+  rotating nothing), Rust `::secure` preset and Rust sync support (both ✅ →
+  never existed), Builder API (py/ts ✅ → ❌), hardware-acceleration detection
+  (rs ✅ → not re-exported; ts N/A → ❌), TypeScript Arrow (🔜 → ❌), and
+  Python's encrypted read path (documented fail-closed → **fail-open by
+  default**). Six Rust reliability cells are marked 🚧 unreleased: LAB-518 /
+  LAB-728 / LAB-729 are on `main` but absent from the published 0.5.0 crate.
+  New rows: Retry, Graceful degradation, Cross-instance L1 invalidation
+  (LAB-520), client-L1 stale-while-revalidate (LAB-728), Orjson serializer,
+  plus an Observability section (LAB-275). Supersedes protocol#25, #28, #29,
+  #31, #32, #33, #35, #37, #40, #43.
+
 ### Specs
 
 - StorageEnvelope `compressed_data` canonical encoding flipped from MessagePack

decisions/key-rotation.md

@@ -8,7 +8,7 @@
 | **Date** | 2026-07-23 |
 | **Ticket** | LAB-516 (filed by the LAB-275 cross-SDK feature-gap audit) |
 | **Normative spec** | [`spec/encryption.md` → Key Rotation (Keyring)](../spec/encryption.md#key-rotation-keyring) — the spec section owns the rules; this record owns the rationale and runbooks. |
-| **Implementation** | Not yet shipped in any SDK — tracked as LAB-516 sub-issues. The [feature matrix](../sdk-feature-matrix.md) rotation row is corrected to ❌ fleet-wide by the LAB-275 audit PR ([protocol#29](https://github.com/cachekit-io/protocol/pull/29)) and flips per SDK only as each implementation ships. |
+| **Implementation** | Not yet shipped in any SDK — tracked as LAB-516 sub-issues. `ZeroKnowledgeEncryptor::rotate_key()` returns `NotImplemented` (`cachekit-core/src/encryption/core.rs:492`). The [feature matrix](../sdk-feature-matrix.md#encryption) rotation row reads ❌ fleet-wide as of the LAB-1400 consolidation and flips per SDK only as each implementation ships. |
 
 ---