## Callback Leak (Medium)

### Trigger Signals

- `addEventListener`/`on`/`subscribe`/`register` without paired `removeEventListener`/`off`/`unsubscribe`/`unregister`
- `setInterval`/`setTimeout` without paired `clearInterval`/`clearTimeout`
- Observer/pub-sub pattern subscriptions not cancelled at appropriate times
- EventEmitter/Bus listener registrations not cleaned up

### Judgment Process

1. **Identify register-unregister pairs**: `find_references` tracks registration calls like `addEventListener`/`on`/`subscribe`, marking all `removeEventListener`/`off`/`unsubscribe` calls
2. **Check unregister timing**: `Read` confirms whether unregistration occurs when the object is destroyed:
   - Whether the class has `dispose`/`destroy`/`cleanup` methods
   - Whether cleanup logic exists in `componentWillUnmount`/`onUnmounted`/`finalize`
   - Whether there is unified cancellation via `AbortController` pattern
3. **Check timer cleanup**: `Read` tracks return values of `setInterval`/`setTimeout`, confirming whether there is corresponding cleanup:
   - Cleanup on component unmount
   - Cleanup in error paths (cannot only clean up normal paths)
4. **Check observer cleanup**: `Read` confirms whether subscribers actively unsubscribe when no longer needed, rather than relying on the observable's lifecycle

### Evidence Construction

After confirming a defect, the output must include:
- Registration point (callback/listener registration location, with file:line number)
- Missing unregister point (where cleanup should occur but does not)
- Number of leaked callbacks (e.g., registered in a loop but not cleaned up)
- Business impact (continuous memory growth, destroyed objects still being called back, event handling anomalies)

### Exclusions

- Already using `AbortController` for unified management (`signal.addEventListener`)
- Already using `{ once: true }` one-time listeners
- Framework auto-managed listeners (React useEffect cleanup, Vue onUnmounted already cleaned up)
- Global/application-level listeners (designed to have same lifecycle as the application)
