diff --git a/devdocs/modernization/NET10-PORT.md b/devdocs/modernization/NET10-PORT.md
index 7269ae6e..e855dbbf 100644
--- a/devdocs/modernization/NET10-PORT.md
+++ b/devdocs/modernization/NET10-PORT.md
@@ -177,7 +177,7 @@ John's "next release" cases for AyaNova (exported 2026-10-24). Each is its own s
 
 | Case | Name | Findings |
 |---|---|---|
-| 4710 | 2FA step requires the temp token (raven and sockeye) | F5, F41. **raven done** (proof script 401 on both bypasses; new integration test `TwoFactor`); sockeye next |
+| 4710 | 2FA step requires the temp token (raven and sockeye) | F5, F41. **Done**: raven `141bdeb8` (proof script 401 on both bypasses; integration test `TwoFactor` in `8e5eec4`); sockeye `f7c1d7c` (same checks on local Sockeye with a temporary user). Sockeye to be deployed to its new droplet by John; 2FA can be turned back on once each server runs the fix |
 | 4711 | Placeholder/short JWT secret treated as unset (4698 folded in: random secret generated at install, server ignores a leftover placeholder) | F1 |
 | 4712 | Customer contact route allowlist + ownership checks | F13, F14, F15, F16, F17 |
 | 4713 | Contact users limited to customer roles | F28 |
diff --git a/devdocs/modernization/SECURITY-REVIEW.md b/devdocs/modernization/SECURITY-REVIEW.md
index deb6df26..af31840e 100644
--- a/devdocs/modernization/SECURITY-REVIEW.md
+++ b/devdocs/modernization/SECURITY-REVIEW.md
@@ -189,7 +189,7 @@ take the next free number; a fixed or accepted finding keeps its ID and changes
 
 | ID | Severity | Status | Title |
 |---|---|---|---|
-| F41 | **Critical** | confirmed (code) | F5 also in Sockeye (internet-facing admin login) and in the 8.2.x business AyaNova server |
+| F41 | **Critical** | **fixed in case 4710** (Sockeye; the business server gets it with 8.3.0) | F5 also in Sockeye (internet-facing admin login) and in the 8.2.x business AyaNova server |
 | F42 | High | confirmed (code) | The licence-signing RSA private keys are hardcoded in Sockeye's source and binaries |
 | F5 | **Critical** | **fixed in case 4710** | 2FA login step accepts an empty or missing temp token: the password is skipped for users with 2FA on |
 | F1 | Critical (installs that kept it) | **confirmed** | Placeholder JWT secret in the LAN/IIS and Linux server config templates |