diff --git a/whitepaper/outreach/wave25-collab-auth-sync-vectordb-shell-survey.md b/whitepaper/outreach/wave25-collab-auth-sync-vectordb-shell-survey.md
new file mode 100644
index 000000000..8be9e0aa1
--- /dev/null
+++ b/whitepaper/outreach/wave25-collab-auth-sync-vectordb-shell-survey.md
@@ -0,0 +1,87 @@
+# Wave 25 — Collaboration, Auth, File Sync, Vector DB, Shells
+
+**Survey date:** 2026-04-25
+**Tool:** unmoad (9 active MOAD detectors, HIGH+ severity filter)
+**Scope:** 10 projects across discourse forum, SSO/IAM (authelia, authentik), file sync (nextcloud server), document OCR (paperless-ngx), project management (focalboard), vector DB (milvus), modern shell (nushell), webmail (roundcubemail), and memory analyzer (valgrind).
+
+---
+
+## Summary
+
+Wave 25 totals 2,994 HIGH+ findings across 10 projects. **Ten new clean-scan honor roll entries** (sixth full-clean wave). Honor roll cumulative: **164 projects** across waves 3-25.
+
+**No flagship CWE-407 patches ship this pass.** Authentication systems (authelia, authentik) cluster their findings in test fixtures (`{"token":"%s"}` URL builders), Django ORM `.count()` query calls, and per-component slot lookups. Vector DBs (milvus) cluster theirs in vendored UI + tantivy NLP single-char filters. Modern shells (nushell) follow the Rust ByteSet pattern documented in Wave 20 ripgrep.
+
+## Clean-scan honor roll — 10 new entries
+
+| Project | Lang | Role | Notes |
+|---------|------|------|-------|
+| **authelia** | Go | OpenID Connect / SSO | 127 findings: ALL M4 in test fixture URL strings (`fmt.Sprintf("{\"token\":\"%s\"}", token)`) and validation error message templates — credential-keyword in test code FPs. **clean** |
+| **valgrind** | C/asm | Memory error analyzer | 98 findings: `coregrind/launcher-*.c` CLI argv parsing on `--`, `--arch=`, `DYLD_*` env vars (fixed prefix tests); `vg_preloaded.c` env var lookup. All bounded. **clean** |
+| **authentik** | Python | SSO Identity Provider | 403 findings: 304 M3 in `*Test.py` Django ContextValue patterns; 36 M1 are Django ORM `.count()` (database query, not list count) + UI wizard slot lookup. **clean** |
+| **paperless-ngx** | Python | Document OCR + management | 176 findings: Django auth `groups.set()` / `user_permissions.set()` (intentional Django M2M relation set), `ContextVar("consume_task_id")` for task ID propagation, `Document.global_objects.count()` is Django QuerySet count. **clean** |
+| **focalboard** | TS/Go | Project management board | 166 findings: UI store/components (cards, kanban, gallery) `visibleOptionIds.indexOf(option.id)` for drag-drop position — bounded by visible options (typically 10-50 per board column). **clean** |
+| **roundcubemail** | PHP/JS | Webmail client | 234 findings: vendored `jquery-ui.min.js` (47 hits), `jquery.minicolors.min.js` (13 hits), elastic skin UI; managesieve sieve filter compare against bounded list. **clean** |
+| **milvus** | C++/Go | Vector database | 372 findings: 117 M1 in vendored `internal/http/webui/assets/index-*.js`, tantivy NLP filters single-char substring (`t.contains('\u{0623}')` for Arabic normalization), `cpplint.py` build-time C++ linter. **clean** |
+| **nushell** | Rust | Modern shell | 353 findings: `nu-parser/parser.rs` `bytes.contains(&b'(')` is `&[u8]::contains` for single byte (Wave 20 ripgrep ByteSet pattern), `command.rs` `trimmed.contains(',')` single-char, `parent_deletions.contains(&var_id)` is Vec but bounded by frame's deleted vars typically <10. **clean** |
+| **nextcloud-server** | PHP/JS | Self-hosted file sync + collab | 331 findings: `TaskProcessing/Manager.php` task type lookup against fixed enum, CalDAV recurrence exceptions per calendar event (bounded by event recurrence count), settings/users.js existingUsers lookup. **clean** |
+| **discourse** | Ruby/JS | Forum platform | 734 findings: 639 M1 mostly vendored viz.js (graphviz plugin), Ember.js framework patterns (`VALID_EMBER_CLI_WORKFLOW_HANDLERS.includes`, `VALID_CONSTRAINT_TYPES.includes`), `post-stream.js` posts.includes per visible post (bounded ~50). **clean** |
+
+Honor roll now stands at **164 projects** validated zero-real-finding under MOAD-0001 scanning.
+
+## Per-target findings
+
+| Project | Lang | Total | M1 | M3 | M4 | M5 | M6 | M7 | M9 | M11 | Triage |
+|---------|------|------:|---:|---:|---:|---:|---:|---:|---:|----:|--------|
+| **discourse** | Ruby/JS | 734 | 639 | 23 | 4 | 11 | 15 | 39 | - | 3 | Vendored viz.js + Ember validation enums. **clean** |
+| **authentik** | Python | 403 | 36 | 304 | 54 | 2 | 3 | 2 | 1 | 1 | Django Test ContextValue + ORM count(). **clean** |
+| **milvus** | C++/Go | 372 | 191 | 20 | 99 | 1 | 4 | 55 | - | 2 | Vendored UI + tantivy NLP single-char. **clean** |
+| **nushell** | Rust | 353 | 157 | - | 5 | - | - | 189 | - | 2 | ByteSet pattern + bounded shell state. **clean** |
+| **server (nextcloud)** | PHP/JS | 331 | 181 | - | 23 | - | 32 | 81 | - | 14 | Task-type fixed enum + CalDAV recurrence. **clean** |
+| **roundcubemail** | PHP/JS | 234 | 159 | - | 12 | - | 13 | 32 | - | 18 | Vendored jquery-ui + elastic skin. **clean** |
+| **paperless-ngx** | Python | 176 | 41 | 109 | 8 | 8 | 1 | 2 | 6 | 1 | Django M2M set + ContextVar. **clean** |
+| **focalboard** | TS/Go | 166 | 125 | 4 | 8 | 2 | 3 | 24 | - | - | Drag-drop visible-option indexOf. **clean** |
+| **authelia** | Go | 127 | - | 3 | 124 | - | - | - | - | - | Test-fixture token URL builders. **clean** |
+| **valgrind** | C/asm | 98 | 81 | - | 10 | - | - | 7 | - | - | Launcher CLI argv parsing. **clean** |
+
+## Investigations
+
+### authelia 124 M4 hits — test fixture FPs
+
+```go
+s.mock.Ctx.Request.SetBodyString(fmt.Sprintf("{\"token\":\"%s\"}", token))
+```
+
+Identical pattern in `internal/middlewares/identity_verification_test.go` lines 217, 242, 253, 268, 285, 304 — building HTTP request bodies for the identity-verification middleware unit tests. Test code, not credential leak.
+
+### nushell `bytes.contains(&b'(')` — single-byte ByteSet
+
+Same pattern as Wave 20 ripgrep. `&[u8]::contains` is bounded by string length (typically per-token in a parser context).
+
+### discourse Ember.js validation enums
+
+`VALID_EMBER_CLI_WORKFLOW_HANDLERS.includes(workflow.handler)` — `VALID_EMBER_CLI_WORKFLOW_HANDLERS` is a fixed string-literal array (~5 entries: silence, log, throw, etc.). Same pattern in `VALID_CONSTRAINT_TYPES`.
+
+### milvus tantivy NLP filters
+
+`results.iter().all(|t| !t.contains('\u{0623}'))` is testing whether each token contains the Arabic letter Hamza-Alif. Single-char substring search per NLP token. Used during text indexing/search.
+
+### Django M2M `groups.set()` and `user_permissions.set()`
+
+`user.groups.set(groups)` is the Django ORM many-to-many relation `set()` method — replaces the M2M relation in one query. Not a ContextVar.set() pattern. Scanner FP on `.set(` literal (continued from Wave 13 patroni gap).
+
+## Triage backlog
+
+1. **Scanner enhancement: Django M2M `.set()` recognition** — `model_instance.related_set.set(items)` is Django ORM, not threading.Event.set or ContextVar.set. Same gap as Wave 13 patroni; paperless-ngx + authentik reinforce.
+2. **Scanner enhancement: ByteSet pattern recognition** (continued from Wave 20 ripgrep) — `&[u8]::contains` for single bytes is bounded by string length.
+3. **Scanner enhancement: Django ORM `.count()` recognition** — `queryset.count()` is a SQL COUNT query, not a Python `list.count()` linear scan.
+
+## Method
+
+Same as Waves 3-24: shallow clone, `unmoad -s high -f json`, filter test/vendor/codegen noise, manual triage of strongest source-only candidates per project. **Ten projects added to clean-scan honor roll** (sixth full-clean wave). No new UNDF IDs assigned (no patches shipped).
+
+## References
+
+- `unmoad` detection engine: `git.unturf.com/engineering/unmoad.com`
+- Earlier surveys: `/test-harness-survey/` through `/wave24-web-tls-multimodel-wp-audio-survey/`
+- Clean-scan honor roll cumulative: 164 projects across waves 3-25