diff --git a/devdocs/modernization/NET10-PORT.md b/devdocs/modernization/NET10-PORT.md
index 2263ea33..48fabccc 100644
--- a/devdocs/modernization/NET10-PORT.md
+++ b/devdocs/modernization/NET10-PORT.md
@@ -192,7 +192,8 @@ John's "next release" cases for AyaNova (exported 2026-10-24). Each is its own s
 | 4724 | SMTP: certificate checked, password never returned | F30, F31 |
 | 4725 | Sessions: password change ends sessions, exact-path token exemption, default SuperUser refused when licensed | F7, F8, F9 |
 | 4726 | Login throttling/lockout | F6 |
-| 4727 | Low severity hardening | F2, F10, F11, F12, F22, F23, F25, F29, F35, F36, F38, F39, F40 |
+| 4727 | Low severity hardening | F2, F10, F11, F12, F22, F23, F25, F29, F35, F36, F38; the AyaNova half of F39 (DB ID not shown anonymously) |
+| 4681 | Sockeye: licence/trial request hardening (tagged sockeye, rockfish) | F40; the Sockeye half of F39 (repeatable licence fetch) |
 | (none yet) | Contact users limited to customer roles | **F28** |
 
 **From the port and earlier triage**
@@ -227,6 +228,8 @@ John's "next release" cases for AyaNova (exported 2026-10-24). Each is its own s
 | 4579 | Windows permissions on folders AyaNova writes to (installers, docs, code) | 1, investigate |
 | 4690 | .NET 10 port umbrella case | 1 |
 
+Sockeye cases (exported 2026-10-24): 4710 (also in the table above) and 4681. 4681 predates the review: a trial request with a made-up address made Sockeye send its verification email, which bounced to support@ (Fastmail notice, 2026-10-16).
+
 Later, not 8.3.0: F42 (move the licence signing key out of Sockeye source) and F32 (rotate the
 FastMail password after the old Sockeye server is retired), John's cases.
 
diff --git a/devdocs/modernization/SECURITY-REVIEW.md b/devdocs/modernization/SECURITY-REVIEW.md
index 1ff578f2..2789fe8d 100644
--- a/devdocs/modernization/SECURITY-REVIEW.md
+++ b/devdocs/modernization/SECURITY-REVIEW.md
@@ -851,8 +851,8 @@ by a customer contact. Pass 8: confirmed from code (`NotifyController.SendNotify
 John's cases for the findings (created 2026-10-24; full list in `NET10-PORT.md`, "Release 8.3.0
 cases"): 4710 (F5, F41), 4711 (F1), 4712 (F13 to F17), 4715 (F21), 4716 (F18), 4717 (F26),
 4718 (F19, F24), 4719 (F20), 4720 (F27), 4721 (F33), 4722 (F34), 4723 (F3, F4), 4724 (F30, F31),
-4725 (F7, F8, F9), 4726 (F6), 4727 (F2, F10, F11, F12, F22, F23, F25, F29, F35, F36, F38, F39,
-F40). **F28 has no case yet.** Not in 8.3.0: F32, F42 (John's later cases); F37 accepted. When a
+4725 (F7, F8, F9), 4726 (F6), 4727 (F2, F10, F11, F12, F22, F23, F25, F29, F35, F36, F38, and
+the AyaNova half of F39), Sockeye 4681 (F40 and the Sockeye half of F39). **F28 has no case yet.** Not in 8.3.0: F32, F42 (John's later cases); F37 accepted. When a
 case is done, its findings' status becomes *fixed in case NNNN*.
 
 ## Customer contact route allowlist (draft, for the F13 to F17 fix)