The cache bounds entries (default 4096 slots), not bytes: values are file contents up to 64MB apiece, so worst-case retained bytes are unbounded in practice. The watcher caps indexing reads at 512KB which bounds the cold-scan path, but direct indexFile callers (edit flows, snapshot adoption is borrowed/zero-copy so exempt) can park arbitrarily large owned values.

Sketch: track owned_bytes on put/evict/remove; when a put would exceed a byte budget (configurable, e.g. 256MB), run additional second-chance evictions until under budget, and refuse to cache single values above a per-entry ceiling (search already re-reads from disk on miss via readContentForSearch's 64MB path). No failing test — enhancement filed per #550/#564 precedent.