## Resource Leak (High)

### Trigger Signals

- File/network/database connection operations (`open`, `connect`, `createConnection`, `createWriteStream`)
- Resources created in try-catch without finally/using/defer release
- Unstopped goroutines (`go func()` with blocking operations but no exit mechanism)
- Unjoined threads (thread detached or not waited for completion)
- HTTP request Response Body not closed (`res.body` not `consume`d/`close`d)

### Judgment Process

1. **Identify resource creation points**: `Read` extracts all resource creation operations (`open`/`connect`/`createConnection`/`createReadStream`), marking resource variables
2. **Check release paths**: For each resource variable, `Read` checks whether all exit paths (return, throw, break) have corresponding release:
   - Normal path: is there `close`/`end`/`release`/`dispose`
   - Exception path (catch): is the resource released in a finally block or using statement
   - Early return: is there a leak
3. **Check language idiomatic release patterns**:
   - Python: whether `with` statement or `contextlib` is used
   - Go: whether `defer close()` is used
   - Java: whether try-with-resources is used
   - C++: whether RAII is used
   - Node.js: whether stream is piped to correct target or explicitly destroyed
4. **Check goroutine/thread leaks**:
   - Go: `Read` checks whether `go func()` has an exit mechanism (context cancellation, channel done signal)
   - Java: `Read` checks whether thread pools have shutdown logic (`shutdown`/`awaitTermination`)
5. **Check HTTP Response Body**: `Read` confirms whether HTTP response body is fully consumed or explicitly closed (Node.js `res.body.pipe(devNull)`, Go `io.Copy(io.Discard, res.Body)`)

### Evidence Construction

After confirming a defect, the output must include:
- Resource creation point (resource type and creation location, with file:line number)
- Missing release path (which exit path omitted the release)
- Business impact (connection pool exhaustion, file handle exhaustion, goroutine leak causing CPU spike)

### Exclusions

- Already using language idiomatic release patterns (Python with, Go defer, Java try-with-resources, C++ RAII)
- Resources managed by connection pools (lifecycle automatically managed by pool)
- Resources managed by frameworks (Express middleware, Spring Bean lifecycle)
- One-time programs/scripts (OS reclaims after process exit)
