pub const DEFAULT_CAP: usize = 10_000;
Default maximum number of events retained before the oldest are evicted.
Bounds disk use while still tolerating a multi-minute upstream outage at typical audit-event rates.