diff --git a/whitepaper/outreach/wave4-linter-ci-survey.md b/whitepaper/outreach/wave4-linter-ci-survey.md
index 6ecb2e225..7c439c421 100644
--- a/whitepaper/outreach/wave4-linter-ci-survey.md
+++ b/whitepaper/outreach/wave4-linter-ci-survey.md
@@ -91,13 +91,13 @@ All three are small, tight, well-maintained codebases. Zero MOAD-pattern hits at
 
 ## Triage follow-ups identified for future waves
 
-1. **PHP_CodeSniffer Tokenizers/PHP.php** — 15 M11 CRIT ReDoS findings in PHP tokenizer; worth a targeted follow-up with a catastrophic-backtracking bench.
+1. **PHP_CodeSniffer Tokenizers/PHP.php** — 15 M11 CRIT ReDoS findings flagged. **Investigated and determined false positives**: the nested-quantifier pattern `((?<!\.)_[0-9A-F][0-9A-F.]*)+$` has an underscore-anchored inner group, so each outer iteration starts at a fresh `_` boundary — no overlap between inner group matches, no catastrophic backtracking. Empirical test at N=10..50 shows sub-millisecond match time across pathological inputs. Scanner sees shape but semantics are safe. Leaving the rule as-is; scanner could be taught to recognize the anchor-prefix case.
 2. **ktlint ELEMENT_TYPES_ALLOWING_PRECEDING_WHITESPACE.contains** — Kotlin ktlint hot path in SpacingAroundAngleBrackets rule.
-3. **pylint base_checker MSG_ORDER.index** — Python checker sort key O(N) on every message comparison.
+3. **pylint base_checker MSG_ORDER.index** — Python checker sort key O(N) on every message comparison. `_MSG_ORDER` is 5-10 items so per-sort cost is bounded; low-medium priority.
 4. **black pgen2 dfa.index** — parser generator state lookup, once at init but scales with grammar size.
-5. **golangci-lint migrate_linter_names.go** — 8 M1 hits in migration-cli code.
-6. **tektoncd/pipeline taskrun forbidden-env scan** — slices.Contains per env var on reconciler, mostly bounded-N.
-7. **aws-cdk region-info.ts** — 10 M1 hits; CDK runs per-synth, impact worth measuring.
+5. **golangci-lint migrate_linter_names.go** — 8 M1 hits in migration-cli code (one-shot tool, not a hot path).
+6. **tektoncd/pipeline taskrun forbidden-env scan** — `slices.Contains` per env var on reconciler. List is 2-4 items, bounded-N, low priority.
+7. **aws-cdk region-info.ts limitedRegionMap** — **Investigated**: `partitions.includes(...)` inside per-region loop is a real O(R×P) pattern, but realistic scale is R≈35 regions × P≈2-4 partitions. Python bench at R=2000 P=100 shows only 2.9× speedup — constant-factor improvement, not a CWE-407 complexity-class emergency. Cleanup-grade; not patch-shipped this session.
 
 ## Method