diff --git a/devdocs/modernization/NET10-PORT.md b/devdocs/modernization/NET10-PORT.md
index 15476312..2263ea33 100644
--- a/devdocs/modernization/NET10-PORT.md
+++ b/devdocs/modernization/NET10-PORT.md
@@ -167,6 +167,69 @@ suite is waiting on (case 4653, case 4654, the contract issue).
 
 ---
 
+## Release 8.3.0 cases
+
+John's "next release" cases for AyaNova (exported 2026-10-24). Each is its own set of commits on
+`main` (`case NNNN - …`). Status: open unless noted. Security cases map to findings in
+`SECURITY-REVIEW.md` (finding IDs are permanent).
+
+**Security review** (priority 00)
+
+| Case | Name | Findings |
+|---|---|---|
+| 4710 | 2FA step requires the temp token (raven and sockeye) | F5, F41 |
+| 4711 | Placeholder/short JWT secret treated as unset | F1 |
+| 4712 | Customer contact route allowlist + ownership checks | F13, F14, F15, F16, F17 |
+| 4715 | Download file names checked (one helper) | F21 |
+| 4716 | Pick-list search text as SQL parameters | F18 |
+| 4717 | KPI interval allowlist | F26 |
+| 4718 | Report and translation import need create rights | F19, F24 |
+| 4719 | Report page network restricted; notification reports not run as SuperUser | F20 |
+| 4720 | Restricted roles filtered in report/export data | F27 |
+| 4721 | Client escaping of record text | F33 |
+| 4722 | DOMPurify and Vuetify upgrades (raven-client) | F34 |
+| 4723 | Direct SMTP: address from the record only | F3, F4 |
+| 4724 | SMTP: certificate checked, password never returned | F30, F31 |
+| 4725 | Sessions: password change ends sessions, exact-path token exemption, default SuperUser refused when licensed | F7, F8, F9 |
+| 4726 | Login throttling/lockout | F6 |
+| 4727 | Low severity hardening | F2, F10, F11, F12, F22, F23, F25, F29, F35, F36, F38, F39, F40 |
+| (none yet) | Contact users limited to customer roles | **F28** |
+
+**From the port and earlier triage**
+
+| Case | Name | Priority |
+|---|---|---|
+| 4692 | SuperUser can be deleted | 00 |
+| 4693 | FormFieldReference start-up race | 00 |
+| 4654 | General notification delivers at most once per 12 hours (circuit breaker) | 00 |
+| 4694 | Standalone launcher not shutting down PostgreSQL (raven-launcher) | 1 |
+| 4695 | Shipping the Visual C++ runtime DLLs with the standalone install | 1 |
+| 4696 | JWT secret missing from the standalone config.json | 1 |
+| 4697 | Relative date filters using the server's time zone | 1 |
+| 4698 | JWT placeholder in the LAN and Linux templates (same subject as 4711) | 1 |
+| 4699 | Linux desktop data-path note in the manual | 1, docs |
+| 4700 | Restore note for customers with a dedicated database role | 1, docs |
+| 4703 | Report JS console error logging | 1 |
+| 4705 | License.DoFetchAsync never tries the fifth licence server | 1 |
+| 4706 | Remove the unused RunProgram.Run | 1 |
+| 4707 | Stray cypress.json in raven-client | 1, investigate |
+| 4687 | Generator polls every second (raven and sockeye) | 1 |
+| 4682 | Time-only picker keeps the old date's DST offset | 1 |
+| 4665 | Health route: does it check the database? | 1, feature |
+| 4661 | Docs: password guidance | 1, docs |
+| 4636 | Docs: turn off 2FA before v7 to v8 migration | 1, docs |
+| 4634 | Docs: custom checkbox shows nothing for older records | 1, docs |
+| 4633 | Docs: pg_dump path quoting on Windows (likely fixed by the port; confirm) | 1, docs |
+| 4632 | AYANOVA_REPORT_RENDER_API_URL_OVERRIDE breaks customer notification reports | 1, investigate |
+| 4628 | Deleting a work order tied to a CSR gives a raw server error | 1, bug |
+| 4623 | Docs: migration, what is erased and what is kept | 1, docs |
+| 4602 | Logo upload UI: hide Upload and Delete until usable | 1, client |
+| 4579 | Windows permissions on folders AyaNova writes to (installers, docs, code) | 1, investigate |
+| 4690 | .NET 10 port umbrella case | 1 |
+
+Later, not 8.3.0: F42 (move the licence signing key out of Sockeye source) and F32 (rotate the
+FastMail password after the old Sockeye server is retired), John's cases.
+
 ## Open questions
 
 - Release version number (Sockeye's port was released as 8.1.0) Answer: 8.3.0 will be the version
diff --git a/devdocs/modernization/SECURITY-REVIEW.md b/devdocs/modernization/SECURITY-REVIEW.md
index 077fd66f..1ff578f2 100644
--- a/devdocs/modernization/SECURITY-REVIEW.md
+++ b/devdocs/modernization/SECURITY-REVIEW.md
@@ -846,6 +846,15 @@ Any logged-in user can add a general notification, with the sender's name and an
 any user id. Low on its own (in-app only); relevant with F3 for social engineering of staff
 by a customer contact. Pass 8: confirmed from code (`NotifyController.SendNotifyDirectMessage`, no role check, any `ToUserId`). Fix: staff only, or only to users the caller may see.
 
+## Cases
+
+John's cases for the findings (created 2026-10-24; full list in `NET10-PORT.md`, "Release 8.3.0
+cases"): 4710 (F5, F41), 4711 (F1), 4712 (F13 to F17), 4715 (F21), 4716 (F18), 4717 (F26),
+4718 (F19, F24), 4719 (F20), 4720 (F27), 4721 (F33), 4722 (F34), 4723 (F3, F4), 4724 (F30, F31),
+4725 (F7, F8, F9), 4726 (F6), 4727 (F2, F10, F11, F12, F22, F23, F25, F29, F35, F36, F38, F39,
+F40). **F28 has no case yet.** Not in 8.3.0: F32, F42 (John's later cases); F37 accepted. When a
+case is done, its findings' status becomes *fixed in case NNNN*.
+
 ## Customer contact route allowlist (draft, for the F13 to F17 fix)
 
 The API routes the client can call for a customer contact (`UserType` Customer or HeadOffice),