diff --git a/internal/source/k8s/k8s.go b/internal/source/k8s/k8s.go
index 7492ce7..08b67f0 100644
--- a/internal/source/k8s/k8s.go
+++ b/internal/source/k8s/k8s.go
@@ -836,6 +836,16 @@ func (s *Source) trackUpsert(sink cert.Sink, b cert.Bundle) {
 	sink.Upsert(b)
 }
 
+// deleteAllRefs scans the entire tracked set looking for entries that
+// match a given (kind, location). On large clusters with high churn of
+// namespace labels (which call deleteAllRefs on every namespace event)
+// this O(total-refs) loop becomes the dominant cost in onNamespace.
+//
+// TODO(perf): replace s.tracked with a two-level index
+// `map[kind+":"+namespace+"/"]map[string]struct{}` so deleteAllRefs only
+// walks refs that actually live in the affected namespace. Deferred
+// until we observe the bottleneck in practice — see Lot 4 of the audit
+// plan.
 func (s *Source) deleteAllRefs(sink cert.Sink, kind, loc string) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
diff --git a/pkg/cert/pem/pem.go b/pkg/cert/pem/pem.go
index 29263ec..3fc5a76 100644
--- a/pkg/cert/pem/pem.go
+++ b/pkg/cert/pem/pem.go
@@ -31,6 +31,15 @@ func New() Parser { return Parser{} }
 func (Parser) Format() string { return cert.FormatPEM }
 
 // Parse implements cert.FormatParser.
+//
+// TODO(memory): on cert-manager-style installs (hundreds of TLS Secrets
+// referencing the same intermediate CA), every Bundle holds an
+// independently parsed copy of the shared CA — wasting ~2 MB per 500
+// secrets versus the ~5 KB theoretical floor. A SHA-256(DER) → cached
+// *x509.Certificate interner here would dedupe shared chain links. Not
+// a leak (cleared on Bundle drop), just byte-level redundancy. Deferred
+// until the steady-state heap profile says it matters — see Lot 4 of
+// the audit plan.
 func (Parser) Parse(data []byte, ref cert.SourceRef, _ cert.ParseOptions) cert.Bundle {
 	b := cert.Bundle{Source: ref}