@@ -1128,16 +1128,24 @@ jobs:
           # the same silent-false-negative class #238 exists to close.
           echo "$out" | grep -qE "EmptyDisposeSample\.cs:[0-9]+:.*\[OWN001\].*'ia' is never disposed" \
             || { echo "FAIL: #240 flow: an inherited-IAsyncDisposable enumerator must still leak"; exit 1; }
+          # #240 review round 2: a BASE with a bare DisposeAsync (no IAsyncDisposable interface) must
+          # be caught by the base-chain scan -> still leak.
+          echo "$out" | grep -qE "EmptyDisposeSample\.cs:[0-9]+:.*\[OWN001\].*'ba' is never disposed" \
+            || { echo "FAIL: #240 flow: a base-chain bare DisposeAsync enumerator must still leak"; exit 1; }
+          # #240 review round 2: a NON-generic IEnumerator (does not force IDisposable) must stay
+          # flagged -> pins the IEnumerator<T>-only narrowing.
+          echo "$out" | grep -qE "EmptyDisposeSample\.cs:[0-9]+:.*\[OWN001\].*'ng' is never disposed" \
+            || { echo "FAIL: #240 flow: a non-generic-IEnumerator empty-Dispose local must still leak"; exit 1; }
           # #238 soundness: ScratchReader (empty source Dispose, NOT an enumerator) must stay flagged
           # in the flow path too — a weaver can rewrite a non-enumerator Dispose at build time.
           echo "$out" | grep -qE "EmptyDisposeSample\.cs:[0-9]+:.*\[OWN001\].*'s' is never disposed" \
             || { echo "FAIL: #238 flow: a NON-enumerator empty-source-Dispose local must stay flagged"; exit 1; }
           # exactly 5 EmptyDisposeSample findings -> the two provably-empty-Dispose ENUMERATOR locals
           # ('e' plain, 'x' explicit-interface — the #238 coverage fix) are SILENT; any leak of them
-          # would push the count past 6.
+          # would push the count past 8 (controls: s,r,lr,d,ar,ia,ba,ng).
           n225=$(echo "$out" | grep -cE "EmptyDisposeSample\.cs:[0-9]+:.*\[OWN00")
-          [ "$n225" = "6" ] \
-            || { echo "FAIL: #225/#238 flow: expected exactly 6 EmptyDisposeSample findings (controls only), got $n225"; exit 1; }
+          [ "$n225" = "8" ] \
+            || { echo "FAIL: #225/#238 flow: expected exactly 8 EmptyDisposeSample findings (controls only), got $n225"; exit 1; }
           # #238 weaver kill-switch: a directory carrying FodyWeavers.xml disables the exemption even
           # for a perfect enumerator shape — the weaved fixture's local must be FLAGGED.
           dotnet run --project frontend/roslyn/OwnSharp.Extractor -- \
 
@@ -1431,14 +1431,17 @@ static bool IsNoOpDisposeWrapper(BaseObjectCreationExpressionSyntax oce, Semanti
     return arg0 is not null && IsInMemoryDisposableBacking(model.GetTypeInfo(arg0).Type);
 }
 
-// Issue #225 — a user-defined type whose parameterless `Dispose()` body is provably EMPTY holds no
-// resource behind the interface: it implements IDisposable only to satisfy a contract (e.g.
-// `IEnumerator<T>`), so never calling Dispose() cannot leak. Recognised from SOURCE: the type
-// declares `void Dispose()` with a BLOCK body of ZERO statements, and no base in its chain carries a
-// Dispose to cascade to (the base is `object` / not IDisposable), so nothing real is skipped. A body
-// we cannot read (third-party metadata-only, or expression-bodied doing work) is NOT provably empty
-// and stays flagged — never a guessed drop. This generalises the named-BCL IsNoOpDisposeWrapper /
-// IsDisposeOptional idea to any type. Deliberately scoped to LOCAL disposables (the #201-sweep
+// Issue #225 (narrowed by #238) — a user-defined `IEnumerator<T>` whose parameterless `Dispose()`
+// body is provably EMPTY holds no resource behind the interface: `IEnumerator<T>` is the one
+// interface that FORCES IDisposable onto types that usually hold nothing, so never calling its
+// empty Dispose() cannot leak. Recognised from SOURCE: the type declares `void Dispose()` (plain or
+// explicit-interface) with a BLOCK body of ZERO statements, and no base in its chain carries a
+// Dispose to cascade to, no IAsyncDisposable / bare DisposeAsync anywhere in the type or its bases,
+// and no FodyWeavers.xml above it (an IL weaver could rewrite the "empty" body at build time — the
+// #238 soundness lesson). A body we cannot read (metadata-only, or expression-bodied doing work) is
+// NOT provably empty and stays flagged — never a guessed drop. Deliberately NOT "any type": that
+// over-broad framing was the #238 regression (263 silently-swallowed ClosedXML findings). Scoped to
+// LOCAL disposables (the #201-sweep
 // evidence — ClosedXML's `Slice.Enumerator` locals): a FIELD keeps its own disposal contract, so an
 // empty-Dispose field (the OwnIgnoreSample `Handle` stand-in) is unaffected.
 static bool HasEmptyDisposeBody(ITypeSymbol? t)
@@ -1478,10 +1481,14 @@ static bool HasEmptyDisposeBody(ITypeSymbol? t)
         return false;
     // Belt-and-braces for a bare `DisposeAsync()` method that the flow detector may treat as a
     // release without the type formally implementing IAsyncDisposable (declared or explicit-impl).
-    if (nt.GetMembers().OfType<IMethodSymbol>().Any(m => m.Parameters.Length == 0
-            && (m.Name == "DisposeAsync"
-                || m.ExplicitInterfaceImplementations.Any(x => x.Name == "DisposeAsync"))))
-        return false;
+    // Walk the ENTIRE base chain (review #240 round 2): GetMembers() returns only members declared
+    // on the current type, so a base with a bare DisposeAsync (no IAsyncDisposable, so AllInterfaces
+    // above misses it) would otherwise slip its real async cleanup through as an exemption.
+    for (var cur = nt; cur is not null && cur.SpecialType != SpecialType.System_Object; cur = cur.BaseType)
+        if (cur.GetMembers().OfType<IMethodSymbol>().Any(m => m.Parameters.Length == 0
+                && (m.Name == "DisposeAsync"
+                    || m.ExplicitInterfaceImplementations.Any(x => x.Name == "DisposeAsync"))))
+            return false;
     // #238 coverage: `void IDisposable.Dispose() { }` (explicit interface implementation — the
     // actual ClosedXML Slice.Enumerator spelling) is a Dispose too; GetMembers("Dispose") misses
     // it because its metadata name is "System.IDisposable.Dispose".
 
@@ -4,12 +4,13 @@
 
 namespace Own.Samples;
 
-// Issue #225 — a user-defined type whose Dispose() body is provably EMPTY holds no resource behind
-// the interface (it implements IDisposable only to satisfy a contract, e.g. IEnumerator<T>), so a
-// LOCAL of it that is never disposed cannot leak. Generalises the named-BCL no-op exemption
-// (field-notes entry 9 / IsNoOpDisposeWrapper) to any type. Mirrors ClosedXML's Slice.Enumerator.
-// Negative controls prove it does not over-widen. A FIELD keeps its own disposal contract (out of
-// scope here), so the OwnIgnoreSample `Handle` field stand-in is unaffected.
+// Issue #225 (narrowed by #238) — a user-defined `IEnumerator<T>` whose Dispose() body is provably
+// EMPTY holds no resource behind the interface (IEnumerator<T> is the one interface that FORCES
+// IDisposable onto a type that usually holds nothing), so a LOCAL of it never disposed cannot leak.
+// Mirrors ClosedXML's Slice.Enumerator. The exemption is deliberately NOT "any type" (that was the
+// #238 regression) and NOT the non-generic IEnumerator (which does not extend IDisposable). The
+// negative controls below pin every edge of the narrowing. A FIELD keeps its own disposal contract
+// (out of scope here), so the OwnIgnoreSample `Handle` field stand-in is unaffected.
 
 // EMPTY Dispose — implements IDisposable only because IEnumerator<T> requires it (the ClosedXML
 // shape). Its Dispose does literally nothing.
@@ -112,6 +113,40 @@ public sealed class InheritedAsyncEnumerator : AsyncOwnerBase, IEnumerator<int>
     public void Dispose() { }   // empty sync, but the base owns a real DisposeAsync
 }
 
+// #240 review round 2 P2 — the base owns a BARE DisposeAsync() and does NOT implement
+// IAsyncDisposable, so neither AllInterfaces nor a current-type-only member scan catches it; only
+// walking the whole base chain does. An empty sync Dispose here must STILL leak.
+public abstract class BareAsyncBase
+{
+    private readonly System.Threading.CancellationTokenSource _cts = new();
+    public System.Threading.Tasks.ValueTask DisposeAsync()           // bare, no interface, on the BASE
+    {
+        _cts.Dispose();
+        return default;
+    }
+}
+public sealed class BareInheritedAsyncEnumerator : BareAsyncBase, IEnumerator<int>
+{
+    private int _i;
+    public int Current => _i;
+    object IEnumerator.Current => Current;
+    public bool MoveNext() => ++_i <= 3;
+    public void Reset() => _i = 0;
+    public void Dispose() { }   // empty sync, but the base owns a bare real DisposeAsync
+}
+
+// #240 review round 2 P2 — a NON-generic System.Collections.IEnumerator does NOT extend IDisposable,
+// so pairing it with IDisposable is author-chosen, not forced: the motivating proof does not apply
+// and an empty-Dispose local must STAY flagged. Pins the IEnumerator<T>-only narrowing.
+public sealed class LegacyEnumerator : IEnumerator, IDisposable
+{
+    private int _i;
+    public object Current => _i;
+    public bool MoveNext() => ++_i <= 3;
+    public void Reset() => _i = 0;
+    public void Dispose() { }   // empty, but the type was not FORCED to implement IDisposable
+}
+
 public sealed class EmptyDisposeConsumers
 {
     // SILENT: an empty-Dispose enumerator local, iterated and never disposed (the ClosedXML shape).
@@ -178,4 +213,24 @@ public int LeakInheritedAsync()
         while (ia.MoveNext()) n++; // base DisposeAsync is real -> LEAK
         return n;
     }
+
+    // FLAGGED (control, #240 review round 2): base owns a BARE DisposeAsync (no interface) -> the
+    // base-chain scan must catch it -> LEAK.
+    public int LeakBareInheritedAsync()
+    {
+        var ba = new BareInheritedAsyncEnumerator();
+        var n = 0;
+        while (ba.MoveNext()) n++; // base bare DisposeAsync is real -> LEAK
+        return n;
+    }
+
+    // FLAGGED (control, #240 review round 2): non-generic IEnumerator + IDisposable is not forced ->
+    // the IEnumerator<T>-only narrowing must keep it flagged -> LEAK.
+    public int LeakLegacy()
+    {
+        var ng = new LegacyEnumerator();
+        var n = 0;
+        while (ng.MoveNext()) n++; // non-generic enumerator, author-coupled IDisposable -> LEAK
+        return n;
+    }
 }