From 7aa33726ca5adb1b84bfd170780128324d115127 Mon Sep 17 00:00:00 2001
From: Matthew Valancy <matthew.valancy@gmail.com>
Date: Tue, 27 Oct 2026 16:37:05 -0700
Subject: [PATCH 1/2] Update Turbo and Mermaid with installed consumer
 contracts

---
 package-lock.json                          | 470 ++++++++++++---------
 package.json                               |   7 +-
 packages/web/package.json                  |   2 +-
 tests/e2e/quality/project-transfer.spec.ts |   6 +-
 tests/toolchain/mermaid-contract.mjs       |  37 ++
 tests/toolchain/turbo-contract.mjs         |  64 +++
 turbo.json                                 |   5 +-
 7 files changed, 378 insertions(+), 213 deletions(-)
 create mode 100644 tests/toolchain/mermaid-contract.mjs
 create mode 100644 tests/toolchain/turbo-contract.mjs

diff --git a/package-lock.json b/package-lock.json
index 95d9d03a..b2ca2d09 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -23,7 +23,7 @@
         "eslint": "^8.54.0",
         "eslint-config-prettier": "^9.0.0",
         "prettier": "^3.1.0",
-        "turbo": "^1.13.4",
+        "turbo": "^2.11.10",
         "typescript": "^5.3.0"
       },
       "engines": {
@@ -917,10 +917,52 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/@chevrotain/types": {
-      "version": "11.1.2",
-      "resolved": "https://registry.npmjs.org/@chevrotain/types/-/types-11.1.2.tgz",
-      "integrity": "sha512-U+HFai5+zmJCkK86QsaJtoITlboZHBqrVketcO2ROv865xfCMSFpELQoz1GkX5GzME8pTa+3kbKrZHQtI0gdbw==",
+    "node_modules/@chevrotain/cst-dts-gen": {
+      "version": "13.2.0",
+      "resolved": "https://registry.npmjs.org/@chevrotain/cst-dts-gen/-/cst-dts-gen-13.2.0.tgz",
+      "integrity": "sha512-bA9dvWlhAUcHkNwU+8w9yiUxJPlj/Lm3VqS7MD+NbIR/7LmpNLuK/AWNFdCo/T3SK5ND0/UHf3IJvl/Jn/i6yg==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@chevrotain/gast": "13.2.0",
+        "@chevrotain/types": "13.2.0"
+      }
+    },
+    "node_modules/@chevrotain/cst-dts-gen/node_modules/@chevrotain/types": {
+      "version": "13.2.0",
+      "resolved": "https://registry.npmjs.org/@chevrotain/types/-/types-13.2.0.tgz",
+      "integrity": "sha512-7qrYHRlKfWf2AvBfJi5eVOrKAkbxvMFsy/iIHTGIiApNcEecCaVIdR+mIQhyCBsTDJxBz4JWXHMo6krbhR9hVg==",
+      "dev": true,
+      "license": "Apache-2.0"
+    },
+    "node_modules/@chevrotain/gast": {
+      "version": "13.2.0",
+      "resolved": "https://registry.npmjs.org/@chevrotain/gast/-/gast-13.2.0.tgz",
+      "integrity": "sha512-bCARdAsG+eEbOveSXcOAC7pVxA04I1ionzeMOwIYf5NX7SaS7zgn4Dgug2BSqoL+iyKeMNSorQjsFSHJHsCNwg==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@chevrotain/types": "13.2.0"
+      }
+    },
+    "node_modules/@chevrotain/gast/node_modules/@chevrotain/types": {
+      "version": "13.2.0",
+      "resolved": "https://registry.npmjs.org/@chevrotain/types/-/types-13.2.0.tgz",
+      "integrity": "sha512-7qrYHRlKfWf2AvBfJi5eVOrKAkbxvMFsy/iIHTGIiApNcEecCaVIdR+mIQhyCBsTDJxBz4JWXHMo6krbhR9hVg==",
+      "dev": true,
+      "license": "Apache-2.0"
+    },
+    "node_modules/@chevrotain/regexp-to-ast": {
+      "version": "13.2.0",
+      "resolved": "https://registry.npmjs.org/@chevrotain/regexp-to-ast/-/regexp-to-ast-13.2.0.tgz",
+      "integrity": "sha512-kxpUkLtiaK09ph+dib+Yvm+3sWSnuwlo25gqfKRgTPNmF6H7uW4gVkMjaRdtnN783S9sM6vUNWh9CsxYX4QwKw==",
+      "dev": true,
+      "license": "Apache-2.0"
+    },
+    "node_modules/@chevrotain/utils": {
+      "version": "13.2.0",
+      "resolved": "https://registry.npmjs.org/@chevrotain/utils/-/utils-13.2.0.tgz",
+      "integrity": "sha512-SzKYY68rseOrb9KILVzPsl6SjkQtdWw01SRGB5aCVI5kFcHltQsOYV3JB0Ffst72DgkvHCyDQ0NLwxtmCCf97Q==",
       "dev": true,
       "license": "Apache-2.0"
     },
@@ -1936,16 +1978,6 @@
         "@jridgewell/sourcemap-codec": "^1.4.14"
       }
     },
-    "node_modules/@mermaid-js/parser": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/@mermaid-js/parser/-/parser-1.2.1.tgz",
-      "integrity": "sha512-n12NohV3mrUyUL2o93IgG/ifeW9FTyeJn3zDxkhwa8MJ9Fxg3HQMlA3RiGmD/3UnJvheztkjjQAjA2T4LmUcpw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@chevrotain/types": "~11.1.2"
-      }
-    },
     "node_modules/@modelcontextprotocol/sdk": {
       "version": "1.32.2",
       "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.32.2.tgz",
@@ -2915,6 +2947,92 @@
         "react-dom": "^18.0.0"
       }
     },
+    "node_modules/@turbo/darwin-64": {
+      "version": "2.11.10",
+      "resolved": "https://registry.npmjs.org/@turbo/darwin-64/-/darwin-64-2.11.10.tgz",
+      "integrity": "sha512-By4idRap5+nLnMuRzLB4qkOPRlvNdyY1ne4VJYDyUoUB11H94k7uif9mbe3JT8JSNXs1D68uMcBj6hJ/jMQRvA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@turbo/darwin-arm64": {
+      "version": "2.11.10",
+      "resolved": "https://registry.npmjs.org/@turbo/darwin-arm64/-/darwin-arm64-2.11.10.tgz",
+      "integrity": "sha512-pyEYlVcuexOPa92p0Wlwl9YT1Is5D60lxN3ItWm3g30YLvFaUq86TF4BBWg5ZAc0uMTnrOzCvuCsOBTdzUWnRQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@turbo/linux-64": {
+      "version": "2.11.10",
+      "resolved": "https://registry.npmjs.org/@turbo/linux-64/-/linux-64-2.11.10.tgz",
+      "integrity": "sha512-1tYeR/IDZ5HEdsb0jNq2L2xam5nMQ+g80tlV2BZmv4OFw+pMcUM0mMmUcfc5wXPPNHVNPuDMjh9Y8G8HgXPLZA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android",
+        "linux"
+      ]
+    },
+    "node_modules/@turbo/linux-arm64": {
+      "version": "2.11.10",
+      "resolved": "https://registry.npmjs.org/@turbo/linux-arm64/-/linux-arm64-2.11.10.tgz",
+      "integrity": "sha512-HuekQxvVGhUd46g1Im/DKdOtglHr4/gguZAvzEpPUgtxNkztSa8lWhQEGQ+EmPQ0n7w19qjThFU+OfEEd0uvlw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android",
+        "linux"
+      ]
+    },
+    "node_modules/@turbo/windows-64": {
+      "version": "2.11.10",
+      "resolved": "https://registry.npmjs.org/@turbo/windows-64/-/windows-64-2.11.10.tgz",
+      "integrity": "sha512-UJOP3BkbreY3/JlMgJR6ZiimxYIBn+c+B4tnBIxD0E9c3Estmk+XoVNVBNBottZLNRXe3/ScgOU4+/k8tIWysg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@turbo/windows-arm64": {
+      "version": "2.11.10",
+      "resolved": "https://registry.npmjs.org/@turbo/windows-arm64/-/windows-arm64-2.11.10.tgz",
+      "integrity": "sha512-xOkEjF3ws/b/YNlc+bvJHMYBn+vL+QbEISZFVi0qS+ImmhA1X3/gmNmBrjjIG3dg6aeN+n6gQitzSkXQ286qJQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
     "node_modules/@types/aria-query": {
       "version": "5.0.4",
       "dev": true,
@@ -4783,6 +4901,30 @@
         "url": "https://github.com/sponsors/wooorm"
       }
     },
+    "node_modules/chevrotain": {
+      "version": "13.2.0",
+      "resolved": "https://registry.npmjs.org/chevrotain/-/chevrotain-13.2.0.tgz",
+      "integrity": "sha512-GTouk5YzgBxlTPCaDn5q0q2EJKkrYmnPF+HmF8v0Qo4r3iyPG7HJivkN1wthCXZcm3sIcZFpGTRovLPNdJNRCA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@chevrotain/cst-dts-gen": "13.2.0",
+        "@chevrotain/gast": "13.2.0",
+        "@chevrotain/regexp-to-ast": "13.2.0",
+        "@chevrotain/types": "13.2.0",
+        "@chevrotain/utils": "13.2.0"
+      },
+      "engines": {
+        "node": ">=22.0.0"
+      }
+    },
+    "node_modules/chevrotain/node_modules/@chevrotain/types": {
+      "version": "13.2.0",
+      "resolved": "https://registry.npmjs.org/@chevrotain/types/-/types-13.2.0.tgz",
+      "integrity": "sha512-7qrYHRlKfWf2AvBfJi5eVOrKAkbxvMFsy/iIHTGIiApNcEecCaVIdR+mIQhyCBsTDJxBz4JWXHMo6krbhR9hVg==",
+      "dev": true,
+      "license": "Apache-2.0"
+    },
     "node_modules/chokidar": {
       "version": "3.6.0",
       "license": "MIT",
@@ -5798,6 +5940,13 @@
       "dev": true,
       "license": "ISC"
     },
+    "node_modules/elkjs": {
+      "version": "0.9.3",
+      "resolved": "https://registry.npmjs.org/elkjs/-/elkjs-0.9.3.tgz",
+      "integrity": "sha512-f/ZeWvW/BCXbhGEf1Ujp29EASo/lk1FDnETgNKwJrsVvGZhUWCZyg3xLJjAsxfOmt8KjswHmI5EwCQcPMpOYhQ==",
+      "dev": true,
+      "license": "EPL-2.0"
+    },
     "node_modules/emoji-regex": {
       "version": "8.0.0",
       "license": "MIT"
@@ -6562,16 +6711,6 @@
       ],
       "license": "BSD-3-Clause"
     },
-    "node_modules/fastdom": {
-      "version": "1.0.12",
-      "resolved": "https://registry.npmjs.org/fastdom/-/fastdom-1.0.12.tgz",
-      "integrity": "sha512-LB+xjSTEbjHE1cWsxu+tN2Xqr1kpi+V9aADI7sVM5ZMaXyYGPHULQMzpJMYqOTULK/73pUkWVzzObFRBkPr+hg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "strictdom": "^1.0.1"
-      }
-    },
     "node_modules/fastq": {
       "version": "1.19.1",
       "license": "ISC",
@@ -8215,33 +8354,6 @@
         "safe-buffer": "^5.0.1"
       }
     },
-    "node_modules/katex": {
-      "version": "0.16.47",
-      "resolved": "https://registry.npmjs.org/katex/-/katex-0.16.47.tgz",
-      "integrity": "sha512-Eeo8Ys1doU1z+x8AZsPpQu+p/QcZBI5PeOo7QGQdy2x2m0MU/hYagBbGOmXwr5KVbEfVuWv9LpnQWeehogurjg==",
-      "dev": true,
-      "funding": [
-        "https://opencollective.com/katex",
-        "https://github.com/sponsors/katex"
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "commander": "^8.3.0"
-      },
-      "bin": {
-        "katex": "cli.js"
-      }
-    },
-    "node_modules/katex/node_modules/commander": {
-      "version": "8.3.0",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-8.3.0.tgz",
-      "integrity": "sha512-OkTL9umf+He2DZkUq8f8J9of7yL6RJKI24dVITBmNfZBmri9zYZQrKkuXiKhyfPSu8tUhnVBB1iKXevvnlR4Ww==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 12"
-      }
-    },
     "node_modules/keyv": {
       "version": "4.5.4",
       "dev": true,
@@ -8799,51 +8911,6 @@
         "node": ">= 8"
       }
     },
-    "node_modules/mermaid": {
-      "version": "11.17.2",
-      "resolved": "https://registry.npmjs.org/mermaid/-/mermaid-11.17.2.tgz",
-      "integrity": "sha512-V6K3C8EBdEsPFZXSKMJe6ppQOENxuHARr9GvHX4hh47lAbhMRD9qf4oEK7LoaRQxULMa80/qt5gHO73aCleBBg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@braintree/sanitize-url": "^7.1.2",
-        "@iconify/utils": "^3.0.2",
-        "@mermaid-js/parser": "^1.2.1",
-        "@types/d3": "^7.4.3",
-        "@upsetjs/venn.js": "^2.0.0",
-        "cytoscape": "^3.34.0",
-        "cytoscape-cose-bilkent": "^4.1.0",
-        "cytoscape-fcose": "^2.2.0",
-        "d3": "^7.9.0",
-        "d3-sankey": "^0.12.3",
-        "dagre-d3-es": "7.0.14",
-        "dayjs": "^1.11.21",
-        "dompurify": "^3.3.3",
-        "es-toolkit": "^1.45.1",
-        "fastdom": "1.0.12",
-        "katex": "^0.16.47",
-        "khroma": "^2.1.0",
-        "marked": "^16.3.0",
-        "roughjs": "^4.6.6",
-        "stylis": "^4.3.6",
-        "ts-dedent": "^2.2.0",
-        "uuid": "^11.1.0 || ^12 || ^13 || ^14.0.0"
-      }
-    },
-    "node_modules/mermaid/node_modules/uuid": {
-      "version": "14.0.3",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.3.tgz",
-      "integrity": "sha512-Sc5u1VVln93y1Xnz4R+CunOZc7R9LUcTmhj7Rc7Eg3HVcf7rVn2FOoa812fe0W8p3jD7xeoGSYbfqCGGH2B6xw==",
-      "dev": true,
-      "funding": [
-        "https://github.com/sponsors/broofa",
-        "https://github.com/sponsors/ctavan"
-      ],
-      "license": "MIT",
-      "bin": {
-        "uuid": "dist-node/bin/uuid"
-      }
-    },
     "node_modules/methods": {
       "version": "1.1.2",
       "license": "MIT",
@@ -11673,12 +11740,12 @@
         "node": ">= 0.4"
       }
     },
-    "node_modules/strictdom": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/strictdom/-/strictdom-1.0.1.tgz",
-      "integrity": "sha512-cEmp9QeXXRmjj/rVp9oyiqcvyocWab/HaoN4+bwFeZ7QzykJD6L3yD4v12K1x0tHpqRqVpJevN3gW7kyM39Bqg==",
-      "dev": true,
-      "license": "MIT"
+    "node_modules/string_decoder": {
+      "version": "1.3.0",
+      "license": "MIT",
+      "dependencies": {
+        "safe-buffer": "~5.2.0"
+      }
     },
     "node_modules/string-width": {
       "version": "4.2.3",
@@ -11793,13 +11860,6 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/string_decoder": {
-      "version": "1.3.0",
-      "license": "MIT",
-      "dependencies": {
-        "safe-buffer": "~5.2.0"
-      }
-    },
     "node_modules/stringify-entities": {
       "version": "4.0.4",
       "resolved": "https://registry.npmjs.org/stringify-entities/-/stringify-entities-4.0.4.tgz",
@@ -12302,105 +12362,23 @@
       }
     },
     "node_modules/turbo": {
-      "version": "1.13.4",
-      "resolved": "https://registry.npmjs.org/turbo/-/turbo-1.13.4.tgz",
-      "integrity": "sha512-1q7+9UJABuBAHrcC4Sxp5lOqYS5mvxRrwa33wpIyM18hlOCpRD/fTJNxZ0vhbMcJmz15o9kkVm743mPn7p6jpQ==",
+      "version": "2.11.10",
+      "resolved": "https://registry.npmjs.org/turbo/-/turbo-2.11.10.tgz",
+      "integrity": "sha512-3GJYwig8ygEI89oaOZdduJX8/aw6O9eRPYHoIt6T3FZl9hkKjiyIspufJoVgqXihPoJu8M5CSV0DlZvzfohBCw==",
       "dev": true,
-      "license": "MPL-2.0",
+      "license": "MIT",
       "bin": {
         "turbo": "bin/turbo"
       },
       "optionalDependencies": {
-        "turbo-darwin-64": "1.13.4",
-        "turbo-darwin-arm64": "1.13.4",
-        "turbo-linux-64": "1.13.4",
-        "turbo-linux-arm64": "1.13.4",
-        "turbo-windows-64": "1.13.4",
-        "turbo-windows-arm64": "1.13.4"
+        "@turbo/darwin-64": "2.11.10",
+        "@turbo/darwin-arm64": "2.11.10",
+        "@turbo/linux-64": "2.11.10",
+        "@turbo/linux-arm64": "2.11.10",
+        "@turbo/windows-64": "2.11.10",
+        "@turbo/windows-arm64": "2.11.10"
       }
     },
-    "node_modules/turbo-darwin-64": {
-      "version": "1.13.4",
-      "resolved": "https://registry.npmjs.org/turbo-darwin-64/-/turbo-darwin-64-1.13.4.tgz",
-      "integrity": "sha512-A0eKd73R7CGnRinTiS7txkMElg+R5rKFp9HV7baDiEL4xTG1FIg/56Vm7A5RVgg8UNgG2qNnrfatJtb+dRmNdw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MPL-2.0",
-      "optional": true,
-      "os": [
-        "darwin"
-      ]
-    },
-    "node_modules/turbo-darwin-arm64": {
-      "version": "1.13.4",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MPL-2.0",
-      "optional": true,
-      "os": [
-        "darwin"
-      ]
-    },
-    "node_modules/turbo-linux-64": {
-      "version": "1.13.4",
-      "resolved": "https://registry.npmjs.org/turbo-linux-64/-/turbo-linux-64-1.13.4.tgz",
-      "integrity": "sha512-Bq0JphDeNw3XEi+Xb/e4xoKhs1DHN7OoLVUbTIQz+gazYjigVZvtwCvgrZI7eW9Xo1eOXM2zw2u1DGLLUfmGkQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MPL-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/turbo-linux-arm64": {
-      "version": "1.13.4",
-      "resolved": "https://registry.npmjs.org/turbo-linux-arm64/-/turbo-linux-arm64-1.13.4.tgz",
-      "integrity": "sha512-BJcXw1DDiHO/okYbaNdcWN6szjXyHWx9d460v6fCHY65G8CyqGU3y2uUTPK89o8lq/b2C8NK0yZD+Vp0f9VoIg==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MPL-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/turbo-windows-64": {
-      "version": "1.13.4",
-      "resolved": "https://registry.npmjs.org/turbo-windows-64/-/turbo-windows-64-1.13.4.tgz",
-      "integrity": "sha512-OFFhXHOFLN7A78vD/dlVuuSSVEB3s9ZBj18Tm1hk3aW1HTWTuAw0ReN6ZNlVObZUHvGy8d57OAGGxf2bT3etQw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MPL-2.0",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
-    },
-    "node_modules/turbo-windows-arm64": {
-      "version": "1.13.4",
-      "resolved": "https://registry.npmjs.org/turbo-windows-arm64/-/turbo-windows-arm64-1.13.4.tgz",
-      "integrity": "sha512-u5A+VOKHswJJmJ8o8rcilBfU5U3Y1TTAfP9wX8bFh8teYF1ghP0EhtMRLjhtp6RPa+XCxHHVA2CiC3gbh5eg5g==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MPL-2.0",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
-    },
     "node_modules/type-check": {
       "version": "0.4.0",
       "dev": true,
@@ -14852,6 +14830,7 @@
         "express-session": "^1.18.2",
         "graphql": "^16.8.0",
         "graphql-scalars": "^1.22.0",
+        "graphql-tag": "^2.12.6",
         "graphql-ws": "^5.14.0",
         "jsonwebtoken": "^9.0.2",
         "neo4j-driver": "^5.15.0",
@@ -14863,8 +14842,7 @@
         "passport-linkedin-oauth2": "^2.0.0",
         "sqlite3": "^6.0.1",
         "uuid": "^11.1.0",
-        "ws": "^8.14.0",
-        "graphql-tag": "^2.12.6"
+        "ws": "^8.14.0"
       },
       "devDependencies": {
         "@types/bcryptjs": "^2.4.6",
@@ -15398,12 +15376,19 @@
         "eslint-plugin-react-hooks": "^4.6.0",
         "globals": "^16.3.0",
         "jsdom": "^23.0.0",
-        "mermaid": "^11.17.2",
+        "mermaid": "^12.2.0",
         "postcss": "^8.4.0",
         "vite": "^7.3.7",
         "vitest": "^4.1.12"
       }
     },
+    "packages/web/node_modules/@chevrotain/types": {
+      "version": "13.2.0",
+      "resolved": "https://registry.npmjs.org/@chevrotain/types/-/types-13.2.0.tgz",
+      "integrity": "sha512-7qrYHRlKfWf2AvBfJi5eVOrKAkbxvMFsy/iIHTGIiApNcEecCaVIdR+mIQhyCBsTDJxBz4JWXHMo6krbhR9hVg==",
+      "dev": true,
+      "license": "Apache-2.0"
+    },
     "packages/web/node_modules/@eslint-community/eslint-utils": {
       "version": "4.10.1",
       "resolved": "https://registry.npmjs.org/@eslint-community/eslint-utils/-/eslint-utils-4.10.1.tgz",
@@ -15487,6 +15472,19 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "packages/web/node_modules/@mermaid-js/parser": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/@mermaid-js/parser/-/parser-2.0.1.tgz",
+      "integrity": "sha512-j37dj/h6p6pots1L7pLPPNuABEEu9WP4OYg9pW1g+nYG331j0+3canE9OagtYdytYvdSAMG+2fKU5cxep6LgjA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@chevrotain/types": "~13.2.0"
+      },
+      "engines": {
+        "node": ">=22.12.0"
+      }
+    },
     "packages/web/node_modules/@rolldown/pluginutils": {
       "version": "1.0.0-rc.3",
       "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.0-rc.3.tgz",
@@ -15769,6 +15767,16 @@
         "node": "20 || >=22"
       }
     },
+    "packages/web/node_modules/commander": {
+      "version": "15.0.0",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-15.0.0.tgz",
+      "integrity": "sha512-z67u4ZhzCL/Tydu1lJARtEZYWbWaN7oYLHbsuzocr6y4N6WZAagG3RQ4FW61V1/0+jImpj293XfrcYnd1qxtPg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=22.12.0"
+      }
+    },
     "packages/web/node_modules/cookie": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/cookie/-/cookie-1.1.1.tgz",
@@ -15955,6 +15963,58 @@
         "node": ">=16"
       }
     },
+    "packages/web/node_modules/katex": {
+      "version": "0.18.10",
+      "resolved": "https://registry.npmjs.org/katex/-/katex-0.18.10.tgz",
+      "integrity": "sha512-/B6p9eY9DX7aHBfpkHdpirDTZ5QH9xTwL9y837PWuzuv41O5jFdqNQwVQEQsimY0/iVNkwBY4+4hMfhQ7d4Dbw==",
+      "dev": true,
+      "funding": [
+        "https://opencollective.com/katex",
+        "https://github.com/sponsors/katex"
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "commander": "^15.0.0"
+      },
+      "bin": {
+        "katex": "cli.js"
+      }
+    },
+    "packages/web/node_modules/mermaid": {
+      "version": "12.2.0",
+      "resolved": "https://registry.npmjs.org/mermaid/-/mermaid-12.2.0.tgz",
+      "integrity": "sha512-w7nr/SFrLO7BaVTs3dQTvYSV6nYSBj0Yy9DjBhsIJtAcHqRzXSq4Pg32ujHZ/AdWsAMNEvvhbm5dt9E2tOiHzw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@braintree/sanitize-url": "^7.1.2",
+        "@iconify/utils": "^3.0.2",
+        "@mermaid-js/parser": "^2.0.1",
+        "@types/d3": "^7.4.3",
+        "@upsetjs/venn.js": "^2.0.0",
+        "chevrotain": "~13.2.0",
+        "cytoscape": "^3.34.0",
+        "cytoscape-cose-bilkent": "^4.1.0",
+        "cytoscape-fcose": "^2.2.0",
+        "d3": "^7.9.0",
+        "d3-sankey": "^0.12.3",
+        "dagre-d3-es": "7.0.14",
+        "dayjs": "^1.11.21",
+        "dompurify": "^3.4.12",
+        "elkjs": "^0.9.3",
+        "es-toolkit": "^1.45.1",
+        "katex": "^0.18.0",
+        "khroma": "^2.1.0",
+        "marked": "^16.3.0",
+        "roughjs": "^4.6.6",
+        "stylis": "^4.3.6",
+        "ts-dedent": "^2.2.0",
+        "uuid": "^11.1.0 || ^12 || ^13 || ^14.0.0"
+      },
+      "engines": {
+        "node": ">=22.12.0"
+      }
+    },
     "packages/web/node_modules/react-refresh": {
       "version": "0.18.0",
       "resolved": "https://registry.npmjs.org/react-refresh/-/react-refresh-0.18.0.tgz",
diff --git a/package.json b/package.json
index 68339c18..3cb1e3ea 100644
--- a/package.json
+++ b/package.json
@@ -76,7 +76,7 @@
     "qc:operator-login": "playwright test tests/e2e/quality/operator-login.spec.ts --project=GraphDone-Core/dev-neo4j/chromium --headed --workers=1 --reporter=line",
     "test:operations": "tsx scripts/test-operations-local.mts && tsx scripts/test-admin-bootstrap.mts",
     "qc:captcha": "playwright test --config playwright.captcha.config.ts --headed --workers=1 --retries=0",
-    "test:toolchain": "node --test tests/toolchain/vite-contract.mjs"
+    "test:toolchain": "node --test tests/toolchain/*-contract.mjs"
   },
   "devDependencies": {
     "@types/node": "^20.10.0",
@@ -85,7 +85,7 @@
     "eslint": "^8.54.0",
     "eslint-config-prettier": "^9.0.0",
     "prettier": "^3.1.0",
-    "turbo": "^1.13.4",
+    "turbo": "^2.11.10",
     "typescript": "^5.3.0"
   },
   "engines": {
@@ -109,5 +109,6 @@
     "@apollo/federation-internals@2.14.4": {
       "uuid": "11.1.1"
     }
-  }
+  },
+  "packageManager": "npm@10.8.2"
 }
diff --git a/packages/web/package.json b/packages/web/package.json
index 1985c10c..b4e76f46 100644
--- a/packages/web/package.json
+++ b/packages/web/package.json
@@ -52,7 +52,7 @@
     "eslint-plugin-react-hooks": "^4.6.0",
     "globals": "^16.3.0",
     "jsdom": "^23.0.0",
-    "mermaid": "^11.17.2",
+    "mermaid": "^12.2.0",
     "postcss": "^8.4.0",
     "vite": "^7.3.7",
     "vitest": "^4.1.12"
diff --git a/tests/e2e/quality/project-transfer.spec.ts b/tests/e2e/quality/project-transfer.spec.ts
index 2bc82ffc..75f6056c 100644
--- a/tests/e2e/quality/project-transfer.spec.ts
+++ b/tests/e2e/quality/project-transfer.spec.ts
@@ -2,6 +2,8 @@ import {test,expect} from '@playwright/test';
 import {readFile,writeFile,unlink} from 'node:fs/promises';
 import {readFileSync} from 'node:fs';
 import {resolve} from 'node:path';
+import {createRequire} from 'node:module';
+const webRequire=createRequire(resolve('packages/web/package.json'));
 const example=JSON.parse(readFileSync('docs/formats/project-v1.example.json','utf8'));
 async function account(page:any){return page.evaluate(async()=>{
  const owner=JSON.parse(localStorage.getItem('currentUser')||sessionStorage.getItem('currentUser')||'null').id;
@@ -66,8 +68,8 @@ test('student / engineer: portable project round trip, offline, safe Mermaid and
  expect(mmdDownload.suggestedFilename()).toMatch(/\.mmd$/);expect(mmd).not.toContain('<script>');expect(mmd).not.toContain('%%{init');
  // Local blank tab, never send project content to an external Mermaid service.
  const render=await browser.newPage();await render.setContent('<div id="diagram"></div>');
- await render.addScriptTag({path:resolve('node_modules/mermaid/dist/mermaid.min.js')});
- const result=await render.evaluate(async(source)=>{const m=(window as any).mermaid;m.initialize({startOnLoad:false,securityLevel:'strict'});await m.parse(source);const {svg}=await m.render('project-diagram',source);document.querySelector('#diagram')!.innerHTML=svg;return {nodes:document.querySelectorAll('.node').length,edges:document.querySelectorAll('.flowchart-link').length,text:document.body.textContent};},mmd);
+ await render.addScriptTag({path:webRequire.resolve('mermaid/dist/mermaid.min.js')});
+ const result=await render.evaluate(async(source)=>{const m=(window as any).mermaid;m.initialize({startOnLoad:false,securityLevel:'strict',layout:'dagre',theme:'default',look:'classic'});await m.parse(source);const {svg}=await m.render('project-diagram',source);document.querySelector('#diagram')!.innerHTML=svg;return {nodes:document.querySelectorAll('.node').length,edges:document.querySelectorAll('.flowchart-link').length,text:document.body.textContent};},mmd);
  expect(result.nodes).toBe(3);expect(result.edges).toBe(1);expect(result.text).toContain('Plan the launch 🚀');await render.screenshot({path:'test-artifacts/quality/project-mermaid.png'});await render.close();
  for(const [width,height] of [[320,568],[390,844],[844,390],[1024,768],[1440,900],[2560,1440]]){
   await page.keyboard.press('Escape');await page.setViewportSize({width,height});region=await openMenu(page);
diff --git a/tests/toolchain/mermaid-contract.mjs b/tests/toolchain/mermaid-contract.mjs
new file mode 100644
index 00000000..fa693ba9
--- /dev/null
+++ b/tests/toolchain/mermaid-contract.mjs
@@ -0,0 +1,37 @@
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import test from 'node:test';
+import { chromium } from '@playwright/test';
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), '../..');
+const webRequire = createRequire(resolve(root, 'packages/web/package.json'));
+
+test('installed Mermaid renders exported syntax and KaTeX rejects inherited trust', { timeout: 30000 }, async () => {
+  const mermaidRequire = createRequire(webRequire.resolve('mermaid'));
+  const katex = mermaidRequire('katex');
+  const options = Object.assign(Object.create({ trust: true }), { throwOnError: false });
+  const markup = katex.renderToString('\\href{javascript:graphdoneProbe}{probe}', options);
+  assert.doesNotMatch(markup, /<a\b|href="javascript:/i);
+  const browser = await chromium.launch(process.env.QC_BROWSER_PORT ? { channel: 'chrome' } : {});
+  try {
+    const page = await browser.newPage();
+    await page.route('**/*', route => route.abort());
+    await page.setContent('<div id="diagram"></div>');
+    await page.addScriptTag({ path: webRequire.resolve('mermaid/dist/mermaid.min.js') });
+    const result = await page.evaluate(async () => {
+      window.mermaid.initialize({ startOnLoad: false, securityLevel: 'strict', layout: 'dagre', theme: 'default', look: 'classic' });
+      const source = 'flowchart LR\n  a["Plan the launch 🚀"] -->|DEPENDS_ON| b["Review &amp; ship"]';
+      await window.mermaid.parse(source);
+      const { svg } = await window.mermaid.render('owned-diagram', source);
+      document.querySelector('#diagram').innerHTML = svg;
+      return { nodes: document.querySelectorAll('.node').length, edges: document.querySelectorAll('.flowchart-link').length, text: document.body.textContent };
+    });
+    assert.equal(result.nodes, 2);
+    assert.equal(result.edges, 1);
+    assert.match(result.text, /Plan the launch 🚀/);
+  } finally {
+    await browser.close();
+  }
+});
diff --git a/tests/toolchain/turbo-contract.mjs b/tests/toolchain/turbo-contract.mjs
new file mode 100644
index 00000000..afb59340
--- /dev/null
+++ b/tests/toolchain/turbo-contract.mjs
@@ -0,0 +1,64 @@
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import { mkdtemp, mkdir, readFile, writeFile, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import test from 'node:test';
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), '../..');
+const turbo = join(root, 'node_modules/turbo/bin/turbo');
+
+test('installed Turbo preserves dependency order, environment, cache invalidation and task failures', { timeout: 30000 }, async () => {
+  const fixture = await mkdtemp(join(tmpdir(), 'graphdone-turbo-'));
+  try {
+    const config = JSON.parse(await readFile(join(root, 'turbo.json'), 'utf8'));
+    const manifest = JSON.parse(await readFile(join(root, 'package.json'), 'utf8'));
+    assert.equal(config.envMode, 'loose');
+    assert.ok(config.tasks.build.env.includes('VITE_OFFLINE_SYNC'));
+    await writeFile(join(fixture, 'package.json'), JSON.stringify({ name: 'owned-turbo-contract', private: true, packageManager: manifest.packageManager, workspaces: ['packages/*'] }));
+    await writeFile(join(fixture, '.gitignore'), 'dist/\n.turbo/\nexecutions.log\n');
+    await writeFile(join(fixture, 'turbo.json'), JSON.stringify({ envMode: config.envMode, tasks: { build: config.tasks.build } }));
+    const packages = { '': { name: 'owned-turbo-contract', workspaces: ['packages/*'] } };
+    for (const name of ['core', 'web']) {
+      const dir = join(fixture, 'packages', name);
+      await mkdir(dir, { recursive: true });
+      const pkg = { name: `@owned/${name}`, version: '1.0.0', scripts: { build: 'node build.cjs' }, ...(name === 'web' ? { dependencies: { '@owned/core': '1.0.0' } } : {}) };
+      await writeFile(join(dir, 'package.json'), JSON.stringify(pkg));
+      packages[`packages/${name}`] = pkg;
+      packages[`node_modules/@owned/${name}`] = { resolved: `packages/${name}`, link: true };
+      await writeFile(join(dir, 'build.cjs'), `const fs=require('node:fs');
+if (${JSON.stringify(name)} === 'core' && process.env.GRAPHDONE_PROBE_FAIL === 'yes') { process.stderr.write('owned-core-failure-23\\n'); process.exit(23); }
+if (${JSON.stringify(name)} === 'web') {
+  const core=JSON.parse(fs.readFileSync('../core/dist/result.json','utf8'));
+  if (core.flavor !== process.env.VITE_OFFLINE_SYNC) throw Error('dependency output is stale');
+}
+fs.mkdirSync('dist',{recursive:true});
+fs.appendFileSync('executions.log','executed\\n');
+fs.writeFileSync('dist/result.json',JSON.stringify({flavor:process.env.VITE_OFFLINE_SYNC,passed:process.env.GRAPHDONE_PROBE_PASSTHROUGH}));
+`);
+    }
+    await writeFile(join(fixture, 'package-lock.json'), JSON.stringify({ name: 'owned-turbo-contract', lockfileVersion: 3, requires: true, packages }));
+    const run = (flavor, fail = false) => spawnSync(process.execPath, [turbo, 'run', 'build', fail ? '--cache=local:w' : '--cache=local:rw'], {
+      cwd: fixture,
+      encoding: 'utf8',
+      timeout: 15000,
+      env: { PATH: process.env.PATH, CI: 'true', TURBO_TELEMETRY_DISABLED: '1', VITE_OFFLINE_SYNC: flavor, GRAPHDONE_PROBE_PASSTHROUGH: 'owned-value', GRAPHDONE_PROBE_FAIL: fail ? 'yes' : 'no' },
+    });
+    const first = run('false');
+    assert.equal(first.status, 0, first.stderr + first.stdout);
+    for (const name of ['core', 'web']) assert.deepEqual(JSON.parse(await readFile(join(fixture, 'packages', name, 'dist/result.json'), 'utf8')), { flavor: 'false', passed: 'owned-value' });
+    const second = run('true');
+    assert.equal(second.status, 0, second.stderr + second.stdout);
+    for (const name of ['core', 'web']) assert.equal(JSON.parse(await readFile(join(fixture, 'packages', name, 'dist/result.json'), 'utf8')).flavor, 'true');
+    const cached = run('true');
+    assert.equal(cached.status, 0, cached.stderr + cached.stdout);
+    const failed = run('true', true);
+    assert.notEqual(failed.status, 0);
+    assert.equal(failed.error, undefined);
+    assert.match(failed.stderr + failed.stdout, /owned-core-failure-23/);
+    for (const name of ['core', 'web']) assert.equal((await readFile(join(fixture, 'packages', name, 'executions.log'), 'utf8')).trim().split('\n').length, 2);
+  } finally {
+    await rm(fixture, { recursive: true });
+  }
+});
diff --git a/turbo.json b/turbo.json
index ad8c4694..ad64e758 100644
--- a/turbo.json
+++ b/turbo.json
@@ -1,7 +1,8 @@
 {
   "$schema": "https://turbo.build/schema.json",
   "globalDependencies": ["**/.env.*local"],
-  "pipeline": {
+  "envMode": "loose",
+  "tasks": {
     "build": {
       "dependsOn": ["^build"],
       "outputs": ["dist/**", ".next/**", "build/**"],
@@ -37,4 +38,4 @@
       "cache": false
     }
   }
-}
\ No newline at end of file
+}

From 525ca4e5aa5bd4a918ad85165d0f2a0e8caf59ac Mon Sep 17 00:00:00 2001
From: Matthew Valancy <matthew.valancy@gmail.com>
Date: Tue, 27 Oct 2026 16:39:56 -0700
Subject: [PATCH 2/2] Record tooling migration boundaries and retained negative
 evidence

---
 ...pgrades-need-executed-consumer-evidence.md | 38 +++++++++
 .agents/issues/INDEX.md                       |  1 +
 .agents/issues/security-audit-index.md        |  1 +
 docs/quality/REMAINING_TOOLING_2026-10-27.md  | 77 +++++++++++++++++++
 4 files changed, 117 insertions(+)
 create mode 100644 .agents/inbox/2026-10-27-tool-upgrades-need-executed-consumer-evidence.md
 create mode 100644 docs/quality/REMAINING_TOOLING_2026-10-27.md

diff --git a/.agents/inbox/2026-10-27-tool-upgrades-need-executed-consumer-evidence.md b/.agents/inbox/2026-10-27-tool-upgrades-need-executed-consumer-evidence.md
new file mode 100644
index 00000000..75c71d8f
--- /dev/null
+++ b/.agents/inbox/2026-10-27-tool-upgrades-need-executed-consumer-evidence.md
@@ -0,0 +1,38 @@
+# A tool's nonzero exit is not proof that its task failed correctly
+
+Date: 2026-10-27. Issue #185. Existing dependency lessons cover actual consumers
+and runner evidence; no indexed lesson distinguished a CLI parsing failure from
+an executed task's failure during a major build-tool migration.
+
+## Evidence
+
+The first Turbo 2 contract combined `--cache=local:rw` and `--force`. The tool
+returned `the argument '--cache' cannot be used with '--force'` before executing
+the intended failing task. `remaining-tooling-contract-cli-negative.log` retains
+this failure. The draft assertion rejected it; it is not acceptance evidence.
+
+The corrected contract selects local write-only cache mode for the negative
+case, then requires the real child's unique `owned-core-failure-23` marker,
+nonzero runner status and no dependent execution. It also proves dependency
+ordering, environment passthrough and cache invalidation/reuse. Installed Turbo,
+Mermaid/KaTeX and Vite contracts pass 3/3 on Node 22.18 and 24.22.1.
+
+Separately, old installed KaTeX 0.16.47 fails an inert inherited-trust expression
+that the patched consumer rejects. Lock inventory alone would not demonstrate
+that behavior. The browser test resolves Mermaid from its actual declaring
+workspace, including when npm places it outside root `node_modules`.
+
+## Cause and corrective rule
+
+Major tools can change CLI semantics, task configuration, environment filtering,
+dependency placement and rendering defaults. Verify the installed consumers and
+their observable outputs. Require evidence that the intended failure boundary
+was actually reached; an arbitrary nonzero process exit is insufficient. Keep
+compatibility choices explicit and retain unsuccessful draft evidence.
+
+## Limits
+
+These are owned local consumer checks, not production exposure or exploitability
+claims. No remote cache login, registry publication or deployment is performed.
+The [migration record](../../docs/quality/REMAINING_TOOLING_2026-10-27.md) records
+exact versions, primary sources, dated audits and remaining acceptance gates.
diff --git a/.agents/issues/INDEX.md b/.agents/issues/INDEX.md
index 3244f069..2620fd35 100644
--- a/.agents/issues/INDEX.md
+++ b/.agents/issues/INDEX.md
@@ -2,6 +2,7 @@
 
 | Symptom | Canonical lesson and regression |
 | --- | --- |
+| A tool upgrade's negative test exits before the intended failing task executes, or a hoisted renderer path changes | [Require executed consumer evidence](../inbox/2026-10-27-tool-upgrades-need-executed-consumer-evidence.md); installed Turbo and Mermaid contracts |
 | Pruned runtime starts failing imports, retains dev tools or loses auth across container replacement | [Installed consumer and persistence proof](../inbox/2026-10-27-runtime-images-need-installed-consumer-proof.md); `tests/runtime/run-image.mjs` |
 | A toolchain upgrade changes test counts, loses matcher types or drops unimported coverage | [Preserve discovery and consumer behavior](../inbox/2026-10-27-toolchain-upgrades-must-preserve-test-contracts.md); [migration evidence](../../docs/quality/TOOLCHAIN_MIGRATION_2026-10-27.md) |
 | OAuth links an unverified email, changes accounts after a provider email change, or leaves an orphan user after a link failure | [Provider proof and isolated atomic linking](../inbox/2026-10-27-oauth-linking-needs-provider-proof-and-atomicity.md); `oauth-identity`, `oauth-profiles` and actual `oauth-strategies` tests |
diff --git a/.agents/issues/security-audit-index.md b/.agents/issues/security-audit-index.md
index 75c090a7..76e94b94 100644
--- a/.agents/issues/security-audit-index.md
+++ b/.agents/issues/security-audit-index.md
@@ -2,6 +2,7 @@
 
 | Symptom | Evidence and corrective rule |
 | --- | --- |
+| Turbo or Mermaid major upgrades clear advisories but can change environment, cache, dependency placement or rendering | [Executed consumer evidence](../inbox/2026-10-27-tool-upgrades-need-executed-consumer-evidence.md); [scoped migration and negative controls](../../docs/quality/REMAINING_TOOLING_2026-10-27.md) |
 | A toolchain upgrade changes test counts, loses matcher types or drops unimported coverage | [Preserve discovery and consumer behavior](../inbox/2026-10-27-toolchain-upgrades-must-preserve-test-contracts.md); [migration evidence](../../docs/quality/TOOLCHAIN_MIGRATION_2026-10-27.md) |
 | OAuth email metadata loses verification or callbacks log credential-bearing redirects | [Provider proof and isolated atomic linking](../inbox/2026-10-27-oauth-linking-needs-provider-proof-and-atomicity.md); [provider/recovery contract](../../docs/quality/OAUTH_IDENTITY.md) |
 | Login and reset links cross-use, or a reset/reactivation revives old sessions | [Bind purpose and session revision at the write](../inbox/2026-10-27-email-purpose-and-revision-are-auth-boundaries.md); real SQLite/HTTP/WebSocket `auth-link-boundary.test.ts` |
diff --git a/docs/quality/REMAINING_TOOLING_2026-10-27.md b/docs/quality/REMAINING_TOOLING_2026-10-27.md
new file mode 100644
index 00000000..9d80945d
--- /dev/null
+++ b/docs/quality/REMAINING_TOOLING_2026-10-27.md
@@ -0,0 +1,77 @@
+# Turbo and Mermaid consumer migration — 2026-10-27
+
+This completes the remaining npm-tooling slice of #185. It is stacked on the
+reviewed runtime-packaging and camera corrections. It does not close Debian OS
+triage #209, authorize publication or establish deployed-site clearance.
+
+## Changes and compatibility
+
+Turbo 1.13.4 becomes 2.11.10. The configuration uses `tasks` and declares the
+existing npm 10.8.2 package manager. Explicit `envMode: loose` preserves the old
+task environment behavior; this change does not silently adopt Turbo 2's strict
+environment filtering. Build-affecting declared variables, including the offline
+flag, remain in the cache hash. Task dependencies, outputs and persistent dev
+tasks retain their previous meaning. No remote-cache login or publication is
+performed by the contract tests.
+
+The installed Turbo contract executes an owned two-workspace build: dependency
+output must exist before its consumer, an unlisted environment variable must
+arrive, changing the offline flag must invalidate both outputs, and an unchanged
+run must reuse the cache. A real upstream task exits 23 with a unique marker;
+the runner must fail and must not execute its dependent. Fixture removal is strict.
+
+Mermaid 11.17.2 becomes 12.2.0. Its Node consumer resolves KaTeX 0.18.10; the
+shipped browser IIFE embeds KaTeX 0.18.11. Both are above the advisory's 0.18.2
+patch boundary. Mermaid remains a development/test dependency: the app exports
+diagram text and does not load Mermaid into its application bundle. Browser
+contracts load the actual installed IIFE from the web workspace, so a changed
+npm hoisting location cannot silently select a different consumer.
+
+Mermaid 12 changes default layout/appearance and raises its own browser floor.
+The export acceptance explicitly selects dagre/default/classic to preserve its
+existing rendering expectation. Node 22.18 and the installed Chrome meet the new
+tool's requirements. GraphDone's application build target is unchanged; these
+tests do not claim the Mermaid 12 renderer runs on older supported app browsers.
+
+Only these dependency families and their required transitive package placements
+change. No production dependency version changes, blanket overrides or runtime
+image package additions are included.
+
+## Evidence and limits
+
+- Clean Node 22.18/npm 10.8.2 install succeeds. Fresh full and production npm
+  audits both report zero findings on 2026-10-27; retained JSON records the dated
+  advisory result, not a permanent absence of vulnerabilities.
+- All-package build, types and lint pass. Coverage executes 715 passing tests
+  plus the existing 26 explicitly skipped database cases. Those skips are not
+  database acceptance; the separate real-Neo4j CI contract remains required.
+  Harness 192/192 passes. Existing warnings remain.
+- Installed Turbo, Mermaid/KaTeX and Vite contracts pass 3/3 on Node 22.18 and
+  Node 24.22.1. Vite checks include real HMR state preservation, HTTP/WebSocket
+  proxying, secret-file denial and offline-shell behavior.
+- The old installed KaTeX 0.16.47 fails the inherited-trust regression: an
+  options prototype can enable a JavaScript link. The patched consumer rejects
+  it. The expression is inert test text; no link is clicked or script executed.
+- An initial Turbo probe used mutually exclusive `--cache` and `--force` flags
+  and failed before running a task. That failure is retained, not credited as
+  task-failure propagation. The final probe uses local write-only cache mode and
+  requires the actual failing child's unique output marker.
+- The final composed offline production build and full portable-project browser
+  journey pass (27.7 seconds, one worker, zero retries). The journey checks actual
+  import/export, offline reload, malformed/quota failures, real exported Mermaid
+  rendering, responsive controls and zero sync writes. Independent implementation
+  review also repeated the two new contracts and old/new KaTeX negative. Final
+  documentation review and exact-head CI are pending.
+
+Local evidence is under the owned `/tmp/graphdone-resolution-20261027` directory
+in `remaining-tooling-*` and `katex-inherited-trust-negative.log`. Final CI must
+repeat applicable image, browser and Node-version gates; previous stack heads
+do not establish acceptance of a changed composition.
+
+Primary references:
+
+- [Turbo migration and environment behavior](https://turborepo.dev/docs/crafting-your-repository/upgrading)
+- [Turbo package-manager detection advisory](https://github.com/vercel/turborepo/security/advisories/GHSA-3qcw-2rhx-2726)
+- [Turbo login callback advisory](https://github.com/vercel/turborepo/security/advisories/GHSA-hcf7-66rw-9f5r)
+- [Mermaid 12 breaking changes](https://github.com/mermaid-js/mermaid/releases/tag/mermaid@12.0.0)
+- [KaTeX inherited-trust advisory](https://github.com/KaTeX/KaTeX/security/advisories/GHSA-238p-pmpm-9mq7)