[marcelo-maciel]

Docs for fullstackhero/dotnet-starter-kit#1426 (the fix for fullstackhero/dotnet-starter-kit#1417).

The role-permission syncer section of Authorization now says the sync is authoritative for the built-in Basic and Admin roles: it removes permission claims the catalog no longer grants, logs each removal at Warning, keeps the root tenant's IsRoot permissions and leaves non-permission claims alone. The changelog entry carries the upgrade note that narrowing IsBasic or removing a permission now revokes it on existing tenants at the next start.

Following the review on #1426, a new "Hosts that load only some modules" subsection documents PermissionSyncOptions:RemoveRevoked (default true; set it to false on a host that registers IdentityModule without every other module), the empty-target guard, the Information-level log for a lost removal race between two instances, and that during a rolling deploy an old-version instance that restarts re-adds a revoked claim until the next new-version start. The Identity configuration block and the production checklist point to that subsection, and the changelog upgrade note carries the switch and the rolling-deploy line. A second changelog entry covers the move of the .NET 10 packages to 10.0.13 for the 2026-10-13 advisories, which is part of the same code PR.

Also fixes a pre-existing error in building-blocks/caching.mdx: it said the RolePermissionSyncer warms the permission cache, while the syncer only invalidates it (through the permissions tag) when it adds or removes a system-role claim.

Files: src/content/docs/security/authorization.mdx, src/content/docs/changelog/index.mdx, src/content/docs/building-blocks/caching.mdx, src/content/docs/modules/identity.mdx, src/content/docs/security/production-checklist.mdx

npx astro check: 0 errors, 0 warnings.

[iammukeshm]

Thanks! I dated the changelog entry for today's merge and dropped the 10.0.13 dependency bullet, since that change shipped with #1447.