diff --git a/CLAUDE.md b/CLAUDE.md
index 3f11800d..6e2f5ea1 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -65,7 +65,7 @@ The rest of the modernization plan: `devdocs/modernization/ROADMAP.md`.
 ## Environment
 
 - Windows 11, PowerShell, VS Code. Visual Studio only for `ravenqbi`.
-- .NET SDK 10.0.103 only (no 8 SDK; it still builds `net8.0`). Runtimes 8.0.24 and 10.0.3 (also 6.0.36).
+- .NET SDK 10.0.402 (installed with winget) and 10.0.103 (from Visual Studio 2026); no `global.json`, so builds use the newest. No 8 SDK (the 10 SDK still builds `net8.0`). Runtimes 8.0.24, 10.0.3 and 10.0.13 (also 6.0.36).
 - Local server: `http://localhost:7575`, API base `/api/v8/`.
 - Compile-time constant `SUBSCRIPTION_BUILD` (`-p:SUBSCRIPTION_BUILD=true`) distinguishes the hosted build; use `#if SUBSCRIPTION_BUILD`.
 
diff --git a/devdocs/build/BUILD.md b/devdocs/build/BUILD.md
index 41dbd26e..f70dcbec 100644
--- a/devdocs/build/BUILD.md
+++ b/devdocs/build/BUILD.md
@@ -36,7 +36,7 @@ that can run this from scratch, use the tool list and install commands in `DEV-V
 
 | Tool | Version | Used for |
 |---|---|---|
-| .NET SDK | 10.0.x | Server and launcher |
+| .NET SDK | 10.0.x, newest | Server and launcher. **Update before every release build** (`winget install --id Microsoft.DotNet.SDK.10 -e`, or `winget upgrade` once installed that way): the Windows standalone server and the launcher are self-contained and ship the .NET runtime of the SDK that built them (SDK 10.0.103 → runtime 10.0.3; 10.0.402 → 10.0.13). The SDK that comes with Visual Studio is not updated by winget |
 | Node.js | **12.22.9 exactly** | Front end. Newer versions break `fibers` |
 | Python | 3.11 | MkDocs |
 | MkDocs + mkdocs-material | MkDocs 1.x | Customer manual (`pip install "mkdocs<2" mkdocs-material`). Material for MkDocs does not work with MkDocs 2.0: keep the pin until the docs move to Zensical (see `../modernization/ROADMAP.md`) |
diff --git a/devdocs/modernization/NET10-PORT.md b/devdocs/modernization/NET10-PORT.md
index d7b118d6..ceb9d191 100644
--- a/devdocs/modernization/NET10-PORT.md
+++ b/devdocs/modernization/NET10-PORT.md
@@ -144,9 +144,9 @@ suite is waiting on (case 4653, case 4654, the contract issue).
   - **Subscription server setup script** (`sockeye-client/src/views/biz-subscription-server.vue`, around lines 1350-1423; filled in per server and copied to the clipboard from the "Script" menu, used for every new subscription droplet): `apt-get install -y aspnetcore-runtime-8.0` (line 1377) → the .NET 10 runtime from whichever source the test droplet confirms; remove the `mkdir`/`chmod g+rwx` of `/var/ayanova/Chrome` and `ChromeHeadlessShell` (lines 1396-1397, 1402-1403), the browser now downloads to `/var/ayanova/data/report-browser`. Verify by running the updated script on the test droplet. Part of this port (John, 2026-10-22). Runtime and Chrome-folder change committed in `sockeye-client` `main` (2026-10-23); **do not deploy a Sockeye client built from it before 8.3.0 is released** (the script installs the released zip; 8.2.4 needs .NET 8). 26.04 support and hardening committed in `sockeye-client` `main` (`64d8f62`, 2026-10-23), tested end to end on a fresh 26.04.1 droplet: PostgreSQL via `postgresql-common`'s `apt.postgresql.org.sh` (`apt-key` is gone in newer Ubuntu); `libgdk-pixbuf2.0-0` → `libgdk-pixbuf-2.0-0` (the only library name missing on 26.04); unique random PostgreSQL password and JWT secret per server, written to PostgreSQL, `config.json` and `/root/ayanova-secrets.txt` (600); `config.json` 640 `root:www-data`; John's `52no-phasing` apt setting
   - Self-hosted Linux customers (server and desktop zips are framework-dependent)
   - Windows LAN: `lan.iss` prompts for the ASP.NET Core Hosting Bundle. Text and link updated to .NET 10 (2026-10-23); installer test still in section 4
-  - Windows standalone and the launcher are self-contained: no runtime needed on the customer's machine. **But they carry the .NET runtime of the build machine's SDK:** SDK 10.0.103 → runtime 10.0.3 (the Sandbox test logged `.Net Version - 10.0.3`; Linux hosts run 10.0.13). Before the final release build, update the workstation's .NET 10 SDK to the newest release (`winget upgrade --id Microsoft.DotNet.SDK.10`; 10.0.402 offered on 2026-10-23) so the standalone package ships the current runtime with its security fixes. 8.2.4 did the same with .NET 8.0.13
+  - Windows standalone and the launcher are self-contained: no runtime needed on the customer's machine. **But they carry the .NET runtime of the build machine's SDK:** SDK 10.0.103 → runtime 10.0.3 (the Sandbox test logged `.Net Version - 10.0.3`; Linux hosts run 10.0.13). Before the final release build, update the workstation's .NET 10 SDK to the newest release so the standalone package ships the current runtime with its security fixes. 8.2.4 did the same with .NET 8.0.13. **Done 2026-10-23:** SDK 10.0.402 installed with winget (`winget upgrade` did not find the Visual Studio-installed 10.0.103); test publish of the standalone server and the launcher bundles runtime 10.0.13. Standing note added to `devdocs/build/BUILD.md`
 - [x] Customer manual (`docs/`): system requirements and upgrade instructions for self-hosted customers. Report browser move (section 3): manual already updated in the same commit (`ops-config-report-render-browser-path.md`, `ops-install-linux-server.md`, `ops-upgrade-linux-server.md`, `ops-upgrade-linux-desktop.md`). .NET 10 runtime install and upgrade steps (Windows LAN and IIS, Linux server and desktop), Ubuntu 24.04/26.04, backup password note and the 8.3.0 changelog draft: `111d7922` (2026-10-23). Changelog wording to be finalised by John before release
-- [ ] Build machines: the workstation already has the .NET 10 SDK (10.0.103). The backup laptop needs it before it can build 8.3.0 (`winget install --id Microsoft.DotNet.SDK.10 -e --source winget`; the .NET 8 SDK is no longer needed); tracked with the laptop's other catch-up items in `devdocs/build/BUILD.md`. `devdocs/build/DEV-VM-SETUP.md` and `devdocs/build/BUILD.md` updated (2026-10-23). The build VM is deprecated (John, 2026-10-23): n/a
+- [ ] Build machines: the workstation has the .NET 10 SDK (10.0.402, plus 10.0.103 from Visual Studio). The backup laptop needs it before it can build 8.3.0 (`winget install --id Microsoft.DotNet.SDK.10 -e --source winget`; the .NET 8 SDK is no longer needed); tracked with the laptop's other catch-up items in `devdocs/build/BUILD.md`. `devdocs/build/DEV-VM-SETUP.md` and `devdocs/build/BUILD.md` updated (2026-10-23). The build VM is deprecated (John, 2026-10-23): n/a
 - [ ] Final gate runs on the finished code
 - [ ] Merge, per repo:
   ```powershell