diff --git a/docs/reference/file-map.md b/docs/reference/file-map.md
index 7e5e857..a476db2 100644
--- a/docs/reference/file-map.md
+++ b/docs/reference/file-map.md
@@ -210,6 +210,39 @@ snapshots every custom property's resolved value and every element's computed co
 and type, on all 7 pages, and diffs two snapshots. Use it for any task that claims to change
 styling without changing appearance.
 
+Wave 4 added three more, each written because its task's done-when could not be checked by
+anything that already existed:
+
+```bash
+python tests/aggregates_check.py    # B4  — do the counts come from the server?   16 checks
+python tests/url_state_check.py     # S3  — does the app's state have an address? 23 checks
+python tests/autosave_check.py      # S2/B5 — does unsaved work survive?          34 checks
+python tests/a11y_check.py          # S10/S11/S12 — announce, legible, focus      22 checks
+```
+
+Each tests what was *broken* rather than what is easy to assert. `aggregates_check.py` poisons
+localStorage and demands the dashboard still report the server's total; a test that only
+checked the totals were correct would have passed before `B4` was built. `a11y_check.py` runs
+with CDP focus emulation on, without which `:focus-visible` never matches in headless and every
+element reports a clean pass.
+
+**Run them one at a time.** Chained back to back they exhaust the headless browser's ports and
+all three abort with "browser would not start"; that failure looks like a code fault and is not
+one.
+
+### Baseline counts, updated
+
+| # | Metric | Wave 0 | Now | Changed by |
+|---|---|---|---|---|
+| 5 | sheets declaring their own `#0f62fe` | 4 (really 5, see §4) | **1** | `T3.2` |
+| 7 | `aria-live` / `role="alert"\|"status"` sites | 0 | **13** | `T4.4`, `T4.5` |
+| 8 | `pushState` | 0 | **2** (6 call sites via `wp-url.js`) | `T4.2` |
+| — | `outline: none` in stylesheets | 6 | **1**, with its replacement one rule above | `T3.4`, `T4.7` |
+| — | helper-text contrast, worst case | 3.01:1 | **4.56:1** | `T4.6` |
+
+Metrics 1–4 and 6 (native dialogs, `<div onclick>`, `.help-tip` badges) are wave 9's to move
+and are unchanged.
+
 `server/smoketest.py` is the one that is **not** self-contained: it drives a server you point
 it at and aborts unless `WP_SMOKE_USER` and `WP_SMOKE_PASSWORD` are set, because every route
 but `/api/health` needs a session. Use an admin account — it creates and deletes a project.