diff --git a/whitepaper/outreach/wave23-frontend-loggers-image-survey.md b/whitepaper/outreach/wave23-frontend-loggers-image-survey.md
new file mode 100644
index 000000000..cc84b4966
--- /dev/null
+++ b/whitepaper/outreach/wave23-frontend-loggers-image-survey.md
@@ -0,0 +1,83 @@
+# Wave 23 — Frontend Frameworks, Loggers, Image Formats
+
+**Survey date:** 2026-04-25
+**Tool:** unmoad (9 active MOAD detectors, HIGH+ severity filter)
+**Scope:** 10 projects across frontend frameworks (angular, vue/core, svelte, lit), tooling (eslint), embedded scripting (mruby), Java logging (log4j2), Go logging (zap), and image formats (libpng, libavif).
+
+---
+
+## Summary
+
+Wave 23 totals 1,401 HIGH+ findings across 10 projects. **Ten new clean-scan honor roll entries** (fourth full-clean wave; zap is genuinely zero-finding). Honor roll cumulative: **144 projects** across waves 3-23.
+
+**No flagship CWE-407 patches ship this pass.** Frontend frameworks (angular, vue, svelte, lit) cluster their `.includes()`/`.find()` calls in compile-time SFC processors, schematics migration tools, and a11y rule lookups bounded by HTML/ARIA spec. Image format libraries (libpng, libavif) cluster theirs in test/CLI tooling.
+
+## Clean-scan honor roll — 10 new entries
+
+| Project | Lang | Role | Notes |
+|---------|------|------|-------|
+| **zap (uber-go)** | Go | Structured logging library | **Zero findings**. Genuine zero-HIGH+ result on Uber's flagship Go logger. Tight, well-disciplined codebase. |
+| **vue/core** | TS | Vue 3 framework core | 31 findings: `defineProps.ts` `type.includes(UNKNOWN_TYPE)` is String.includes substring (Vue inspecting type strings); `compileScript.ts` MACROS.includes (fixed Vue macro list ~5 entries: defineProps, defineEmits, defineModel, etc.); all build-time SFC compiler. **clean** |
+| **lit** | TS | Web Components library | 51 findings: most in test files (`reactive-element_dev_mode_test.ts`), `localize-tools` build-time CLI commands.includes (small fixed list), AsyncLocalStorage in SSR (intentional async context). **clean** |
+| **libavif** | C | AV1 image format | 20 findings: `avifutil.c` file extension strcmp ("avif", "y4m"), `avifenc.c`/`avifdec.c` CLI argv parsing, `codec_aom.c` AOM option name lookup (small fixed list). **clean** |
+| **libpng** | C | PNG reference library | 42 findings: ALL in `pngtest.c`, `contrib/libtests/`, `contrib/tools/` — test/utility tooling. Core libpng clean. |
+| **mruby** | C/Ruby | Embedded Ruby implementation | 54 findings: `mrblib/string.rb` `(1..2).include?(args.length)` is Range.include? (O(1)); `lib/mruby/build.rb` exclusions list (build-time); `tools/lrama/` is the Lrama parser generator that mruby ships (build-time). **clean** |
+| **angular** | TS | Angular framework | 386 findings: `vscode-ng-language-service/integration/lsp/` test, `core/schematics/ng-generate/` migration tools (build-time), `service-worker` URL caching list (bounded by registered cached URLs, typically <100), `animations` namespaceList (bounded by animation count). **clean** |
+| **svelte** | TS | Svelte compiler | 105 findings: `compiler/migrate/index.js` build-time migration, `internal/client/reactivity/props.js` `target.exclude.includes(key)` per prop (exclude list small); `a11y/index.js` invisible_elements/aria_roles fixed HTML/ARIA spec lists; build-time download script. **clean** |
+| **eslint** | JS | JS linter | 88 findings: vendored `css-vars-ponyfill@2.js`, build-time `Makefile.js`, lint rule fixed token lists (`memberSyntaxSortOrder`, `exceptions.openers`, `exceptions.closers`). **clean** |
+| **logging-log4j2** | Java | Apache Java logger | 624 findings: 456 M3 in `*Test.java` JUnit ExtensionContext, 55 M1 in `CronExpression.java` cron-token analysis (single-char `expr.indexOf('L')`), `MapFilter` per-map-value list contains (bounded by map size <50), `ScriptManager.allowedLanguages.contains` (small fixed allowed list), `StyleConverter.Arrays.toString(options).contains(...)` is String.contains. **clean** |
+
+Honor roll now stands at **144 projects** validated zero-real-finding under MOAD-0001 scanning.
+
+## Per-target findings
+
+| Project | Lang | Total | M1 | M3 | M4 | M5 | M6 | M7 | M9 | M11 | Triage |
+|---------|------|------:|---:|---:|---:|---:|---:|---:|---:|----:|--------|
+| **logging-log4j2** | Java | 624 | 55 | 456 | - | 54 | - | 55 | - | 4 | JUnit ExtensionContext + CronExpression + bounded allowedLanguages. **clean** |
+| **angular** | TS | 386 | 307 | - | 23 | 20 | 2 | 32 | 1 | 1 | Build-time schematics + service-worker bounded URLs. **clean** |
+| **svelte** | TS | 105 | 98 | 4 | - | 2 | - | 1 | - | - | Build-time migrate + a11y spec lists. **clean** |
+| **eslint** | JS | 88 | 66 | - | - | - | - | 17 | - | 5 | Vendored ponyfill + lint rule token lists. **clean** |
+| **mruby** | C/Ruby | 54 | 52 | - | 2 | - | - | - | - | - | Range.include? + Lrama parser generator. **clean** |
+| **lit** | TS | 51 | 47 | 2 | - | 2 | - | - | - | - | Test files + localize-tools. **clean** |
+| **libpng** | C | 42 | 42 | - | - | - | - | - | - | - | Test/utility tools only. **clean** |
+| **vue/core** | TS | 31 | 30 | - | - | 1 | - | - | - | - | SFC compiler + macro lookup. **clean** |
+| **libavif** | C | 20 | 19 | - | 1 | - | - | - | - | - | CLI args + AOM option name. **clean** |
+| **zap (uber-go)** | Go | 0 | - | - | - | - | - | - | - | - | **Zero findings.** Genuine clean. |
+
+## Investigation: zap zero-finding result
+
+Uber's `zap` Go logger is the most popular structured-logging library in the Go ecosystem. Zero HIGH+ findings across all 9 active MOAD detectors. Tight ~30k LOC core, well-disciplined code review, zero `slices.Contains` patterns in the hot path, no debug-level credential logging, no leaked context, no thundering-herd, no weak hash on credential paths. Joins `wireguard-go`, `longhorn-engine`, `ghostpdl`, and the cloud SDK reference clients in the small set of projects with literally zero scanner findings.
+
+## Other investigations
+
+### log4j2 CronExpression single-char + bounded MapFilter
+
+`expr.indexOf('L')` is single-char string position scan. `MapFilter.java` walks the configured map filter rules (typically <50 per logger config) and checks substring matches. `ScriptManager.allowedLanguages.contains(name)` is per-script-execute against a static config list (typically 1-5 enabled scripting languages).
+
+### angular service-worker URL caching
+
+`service-worker/worker/src/assets.ts:126` `this.urls.indexOf(url)` per HTTP request to determine if the resource is in the cache. `this.urls` is the registered service-worker cache list — bounded by the asset registration manifest, typically <100 URLs even for large PWAs.
+
+### svelte ARIA role lookup
+
+`a11y/index.js:166` `aria_roles.includes(current_role)` checks against the fixed ARIA role spec (~80 roles). Bounded by the W3C ARIA specification.
+
+### libpng test-only findings
+
+All 42 findings in `libpng` are in `pngtest.c`, `contrib/libtests/pngstest.c`, `contrib/libtests/pngvalid.c`, `contrib/libtests/pnggetset.c`, `contrib/tools/`. The libpng core (in `png*.c` at root) is clean.
+
+## Triage backlog
+
+1. **Scanner enhancement: JUnit ExtensionContext test plumbing** (continued from Wave 14/18/19) — log4j2 reinforces with 456 hits.
+2. **Scanner enhancement: build-time tooling path suppression** — `core/schematics`, `migrate/`, `Makefile.js`, `lib/mruby/build.rb` clusters across multiple frameworks would benefit.
+3. **Scanner enhancement: Range.include? Ruby method awareness** — mruby's `(1..2).include?(args.length)` is O(1) range check, not list scan.
+
+## Method
+
+Same as Waves 3-22: shallow clone, `unmoad -s high -f json`, filter test/vendor/build-time noise, manual triage of strongest source-only candidates per project. **Ten projects added to clean-scan honor roll** (fourth full-clean wave). No new UNDF IDs assigned (no patches shipped).
+
+## References
+
+- `unmoad` detection engine: `git.unturf.com/engineering/unmoad.com`
+- Earlier surveys: `/test-harness-survey/` through `/wave22-eda-games-hpc-codecs-httpd-survey/`
+- Clean-scan honor roll cumulative: 144 projects across waves 3-23