Memory Optimization

Radiant Security's AI SOC platform aggregates a continuous stream of raw security alerts per tenant into incidents, then enriches each incident's alerts with threat intel as new signals arrive. A teammate wrote the aggregator below and it works, but it's the top suspect for the service's growing memory footprint.

import copy

class AlertAggregator:
    def __init__(self):
        self.raw_alerts = []
        self.incidents = {}
        self.enrichment_cache = {}

    def ingest(self, alert):
        self.raw_alerts.append(alert)
        incident_id = alert["incident_id"]
        incident = self.incidents.setdefault(incident_id, {
            "incident_id": incident_id,
            "alerts": [],
            "context": alert["raw_context"],
        })
        incident["alerts"].append(alert)

    def enrich(self, incident_id, threat_intel):
        incident = self.incidents[incident_id]
        enriched = []
        for a in incident["alerts"]:
            merged = copy.deepcopy(a)
            merged["threat_intel"] = threat_intel
            merged["full_context"] = incident["context"]
            enriched.append(merged)
        self.enrichment_cache[incident_id] = enriched
        incident["enriched_alerts"] = enriched
        return enriched

    def close_incident(self, incident_id):
        return self.incidents[incident_id]

    def stats(self):
        return {
            "total_alerts_seen": len(self.raw_alerts),
            "open_incidents": len(self.incidents),
        }

Assume this runs as a long-lived, in-process aggregator handling a continuous stream of alerts per tenant, and that enrich() gets called again on the same incident every time new threat intel arrives (a normal pattern here). Explain, in writing, exactly where this code's memory usage grows without bound, and how you would redesign it so steady-state memory stays flat once incidents close.