@@ -49,11 +49,16 @@ protobuf-net/protobuf-net | ProtoTranscoder.cs | OWN001 | 'sync' | non-product (
 protobuf-net/protobuf-net | Page.xaml.cs | OWN001 | local 'timer' | non-product (assorted/ Silverlight perf demo); TRUE POSITIVE — `timer` is a custom IDisposable Nuxleus.Performance.Stopwatch genuinely never disposed (the using(timer) block is commented out). Baselined as non-product, not as an FP
 
 # --- JamesNK/Newtonsoft.Json ----------------------------------------------------
-# STAYS BASELINED (soundness wall): JsonTextWriter is a THIRD-PARTY wrapper — the BCL pass-through
-# exemption (IsNoOpDisposeWrapper) covers only StreamReader/StreamWriter/BinaryReader/BinaryWriter,
-# whose disposal contract is known. Proving JsonTextWriter.Dispose is a no-op needs body analysis we
-# don't do. See docs/notes/no-op-dispose-wrapper.md.
-JamesNK/Newtonsoft.Json | TraceJsonReader.cs | OWN001 | _textWriter | no-op dispose: a JsonTextWriter over an in-memory StringWriter/StringBuilder holds no unmanaged resource, so leaving it undisposed releases nothing
+# STAYS BASELINED — and NOT soundly auto-fixable (investigated 2026-06-28, JsonTextWriter source).
+# JsonTextWriter is NOT a no-op type to dispose: Close() runs base.Close() (auto-completes open JSON
+# tokens — writes closing brackets to the underlying writer) and CloseBufferAndWriter(), which RETURNS
+# its rented `_writeBuffer` to `_arrayPool` when an ArrayPool is configured — a real pooled-buffer
+# release (the very POOL-leak class Own.NET tracks elsewhere) — and closes the underlying writer. So a
+# recursive "Dispose-is-a-no-op" recognizer would be UNSOUND (it can leak a pooled buffer) or would
+# correctly DECLINE — either way it does not clear this. The `_textWriter` instance is benign only by
+# INSTANCE facts (no ArrayPool set + the sink is a StringWriter), not a type-level no-op, so it stays
+# baselined — consistent with excluding writers from IsNoOpDisposeWrapper. See no-op-dispose-wrapper.md.
+JamesNK/Newtonsoft.Json | TraceJsonReader.cs | OWN001 | _textWriter | benign-by-instance, NOT a no-op type: JsonTextWriter.Close() returns a (possibly pooled) write buffer and auto-completes JSON tokens; harmless here only because no ArrayPool is set and the sink is a StringWriter — kept baselined (not soundly auto-fixable)
 JamesNK/Newtonsoft.Json | JsonSerializer.cs | OWN001 | serializer.Error | intra-call self-subscription: the serializer is freshly created from the same JsonSerializerSettings whose .Error handler it subscribes; source and handler are co-lifetimed
 
 # --- JoshClose/CsvHelper --------------------------------------------------------
 
@@ -55,22 +55,31 @@ The motivating oracle finding was Newtonsoft.Json's `TraceJsonReader._textWriter
 
 ```csharp
 _sw = new StringWriter(CultureInfo.InvariantCulture);
-_textWriter = new JsonTextWriter(_sw); // a no-op in truth — but JsonTextWriter is third-party
+_textWriter = new JsonTextWriter(_sw); // looks like a no-op — but JsonTextWriter is NOT a no-op type
 ```
 
-Structurally identical, but `JsonTextWriter` is a **third-party** wrapper (`JsonWriter`,
-not a BCL `TextWriter`). We cannot prove *its* `Dispose` is pass-through without modelling
-its body — and asserting a no-op we cannot prove is exactly the unsound over-reach that
-sank the static-class subscriber exemption (see
-[`oracle-known-fps.md` → Rejected approaches](oracle-known-fps.md)). So Newtonsoft's
-`_textWriter` stays a **baselined** finding in
-[`oracle-fp-baseline.txt`](../../corpus/oracle-fp-baseline.txt), not a silent drop.
-
-Retiring that baseline entry would need a general, recursive "Dispose is a no-op"
-analysis over a first-party type's body (it disposes only dispose-optional members and
-holds no unmanaged handle). That is a larger, higher-risk capability; until it lands, only
-the BCL pass-through adapters — whose disposal contract is documented and fixed — are
-exempted.
+It looks structurally identical to the BCL reader case, but a 2026-06-28 read of the real
+`JsonTextWriter` source shows it is **not a no-op type to dispose**:
+
+- `Close()` runs `base.Close()` — which **auto-completes open JSON tokens** (writes closing
+  brackets to the underlying writer) — then `CloseBufferAndWriter()`;
+- `CloseBufferAndWriter()` **returns its rented `_writeBuffer` to `_arrayPool`** when an
+  `ArrayPool` is configured — a real **pooled-buffer release** (the very POOL-leak class
+  Own.NET tracks elsewhere) — and closes the underlying writer.
+
+So disposal has genuine side effects (a conditional pooled-buffer return, token-completion
+writes). This is the same reason we **exclude writers** (`StreamWriter`/`BinaryWriter`) from
+`IsNoOpDisposeWrapper` — a writer's `Dispose` does real work. A recursive "Dispose is a
+no-op" recognizer over the body would therefore either be **unsound** (it can leak a pooled
+buffer) or correctly **decline** — so it would not clear this finding regardless. Asserting a
+no-op we cannot prove is exactly the unsound over-reach that sank the static-class subscriber
+exemption (see [`oracle-known-fps.md` → Rejected approaches](oracle-known-fps.md)).
+
+The `_textWriter` *instance* is benign only by **instance facts** — no `ArrayPool` is set on
+it, and its sink is a `StringWriter` — not by any type-level no-op property. So it stays a
+**baselined** finding in [`oracle-fp-baseline.txt`](../../corpus/oracle-fp-baseline.txt), not
+a silent drop, and the "recursive Dispose-no-op analysis" idea is **shelved as not worth
+building** (it wouldn't soundly clear the one case that motivated it).
 
 ## Corpus
 
 
@@ -178,14 +178,18 @@ entry and let the oracle re-confirm clean.
    native/extra resource), and a path that builds `new StreamReader(path)` (a real file
    handle) keeps the field flagged. Corpus fixture
    `field-noop-dispose-wrapper`; full rationale
-   [`no-op-dispose-wrapper.md`](no-op-dispose-wrapper.md). **Still open — the soundness
-   wall:** Newtonsoft's `_textWriter` is a `JsonTextWriter` over a `StringWriter` —
-   structurally the same no-op, but `JsonTextWriter` is a **third-party** wrapper whose
-   `Dispose` we cannot prove is pass-through without modelling its body. Suppressing it
-   would be the same unsound over-reach as the rejected static-class exemption, so it
-   **stays baselined**. Retiring it needs a general recursive "Dispose-is-a-no-op" body
-   analysis (a first-party type that disposes only dispose-optional members and holds no
-   unmanaged handle) — larger and higher-risk; deferred. Note the NLog `_xmlSource` /
+   [`no-op-dispose-wrapper.md`](no-op-dispose-wrapper.md). **Stays baselined — and NOT
+   soundly auto-fixable (investigated 2026-06-28):** Newtonsoft's `_textWriter` is a
+   `JsonTextWriter` over a `StringWriter`, but reading the real `JsonTextWriter` source shows
+   it is **not a no-op type** — `Close()` runs `base.Close()` (auto-completes open JSON
+   tokens, writing closing brackets) and `CloseBufferAndWriter()`, which **returns its rented
+   `_writeBuffer` to `_arrayPool`** when an `ArrayPool` is set (a real pooled-buffer release,
+   the POOL-leak class we track) and closes the writer. So a recursive "Dispose-is-a-no-op"
+   recognizer would be **unsound** (it can leak a pooled buffer) or correctly **decline** —
+   either way it would not clear this. The instance is benign only by **instance facts** (no
+   `ArrayPool` set + the sink is a `StringWriter`), not a type-level no-op — the same reason
+   we exclude writers from `IsNoOpDisposeWrapper`. The recursive-analysis idea is therefore
+   **shelved as not worth building**, not merely deferred. Note the NLog `_xmlSource` /
    `_reusable*Stream` reals are also third-party wrappers (`CharEnumerator`,
    `ReusableStreamCreator`) of the same benign shape and stay **kept visible** for the
    same reason — we can't prove their disposal is a no-op, so we don't silently drop them.