P1: CloudWatch Logs unbounded event storage — no retention enforcement #661

Summary

Log streams grow indefinitely with no max events per stream, no total log group size limits, and no age-based cleanup based on retention policy. Additional issues:

• Subscription filters stored indefinitely with no cleanup on log group deletion
• RecordsMatched set to len(allEvents) after timestamp filtering — should track actual regex-matched records
• Filter pattern matching uses strings.Contains() — AWS uses wildcard patterns like [ERROR] syntax
• TOCTOU in StartQuery: RLock released, query executed unprotected, then write lock acquired

Missing Features

• Retention policy not enforced (accepted but never applied)
• No metric filters / CloudWatch Metrics integration
• Tags lost on persistence restore
• Incomplete Insights query engine (no aggregation functions)

Impact

P1 — Memory exhaustion. Under sustained logging, memory grows without bound.

Fix

• Enforce retention policy with background cleanup
• Cap events per stream
• Fix RecordsMatched counting
• Add proper filter pattern matching

Files

• services/cloudwatchlogs/backend.go