docs: clarify multipart streaming memory behavior

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: codebyjass

README.md

@@ -226,6 +226,8 @@ Active Cipher Storage supports that flow, but the browser still does not get enc
 
 Use `EncryptedMultipartUpload` for this backend-managed upload flow.
 
+**Memory behavior:** the app does not assemble the whole file before uploading. Each `upload_part` call reads the incoming frontend chunk, encrypts that chunk into an authenticated ACS frame, and flushes encrypted bytes to S3 multipart upload parts as soon as the S3 minimum part size is reached. Keep frontend chunks bounded (for example 256 KiB to 5 MiB); a single frontend chunk is read into memory for that request.
+
 ```ruby
 uploader = ActiveCipherStorage::EncryptedMultipartUpload.new(
   s3_client:  Aws::S3::Client.new(region: "us-east-1"),
@@ -306,6 +308,8 @@ Use `stream_decrypted` when you need to send a large encrypted file to a client
 
 The adapter reads encrypted bytes from S3, decrypts authenticated chunks as they arrive, and yields plaintext chunks to your block. Memory usage stays bounded by one Active Cipher Storage chunk, which is 5 MiB by default.
 
+Use `stream_decrypted` for huge files. `get_decrypted` returns an IO for convenience, but it buffers the encrypted object before decrypting and is intended for small objects or tooling, not large client downloads.
+
 ```ruby
 s3 = ActiveCipherStorage::Adapters::S3Adapter.new(
   bucket:     "my-bucket",