Patch Turbo and Mermaid with executed consumer contracts

.agents/inbox/2026-10-27-tool-upgrades-need-executed-consumer-evidence.md

@@ -0,0 +1,38 @@
+# A tool's nonzero exit is not proof that its task failed correctly
+
+Date: 2026-10-27. Issue #185. Existing dependency lessons cover actual consumers
+and runner evidence; no indexed lesson distinguished a CLI parsing failure from
+an executed task's failure during a major build-tool migration.
+
+## Evidence
+
+The first Turbo 2 contract combined `--cache=local:rw` and `--force`. The tool
+returned `the argument '--cache' cannot be used with '--force'` before executing
+the intended failing task. `remaining-tooling-contract-cli-negative.log` retains
+this failure. The draft assertion rejected it; it is not acceptance evidence.
+
+The corrected contract selects local write-only cache mode for the negative
+case, then requires the real child's unique `owned-core-failure-23` marker,
+nonzero runner status and no dependent execution. It also proves dependency
+ordering, environment passthrough and cache invalidation/reuse. Installed Turbo,
+Mermaid/KaTeX and Vite contracts pass 3/3 on Node 22.18 and 24.22.1.
+
+Separately, old installed KaTeX 0.16.47 fails an inert inherited-trust expression
+that the patched consumer rejects. Lock inventory alone would not demonstrate
+that behavior. The browser test resolves Mermaid from its actual declaring
+workspace, including when npm places it outside root `node_modules`.
+
+## Cause and corrective rule
+
+Major tools can change CLI semantics, task configuration, environment filtering,
+dependency placement and rendering defaults. Verify the installed consumers and
+their observable outputs. Require evidence that the intended failure boundary
+was actually reached; an arbitrary nonzero process exit is insufficient. Keep
+compatibility choices explicit and retain unsuccessful draft evidence.
+
+## Limits
+
+These are owned local consumer checks, not production exposure or exploitability
+claims. No remote cache login, registry publication or deployment is performed.
+The [migration record](../../docs/quality/REMAINING_TOOLING_2026-10-27.md) records
+exact versions, primary sources, dated audits and remaining acceptance gates.

.agents/issues/INDEX.md

@@ -2,6 +2,7 @@
 
 | Symptom | Canonical lesson and regression |
 | --- | --- |
+| A tool upgrade's negative test exits before the intended failing task executes, or a hoisted renderer path changes | [Require executed consumer evidence](../inbox/2026-10-27-tool-upgrades-need-executed-consumer-evidence.md); installed Turbo and Mermaid contracts |
 | Pruned runtime starts failing imports, retains dev tools or loses auth across container replacement | [Installed consumer and persistence proof](../inbox/2026-10-27-runtime-images-need-installed-consumer-proof.md); `tests/runtime/run-image.mjs` |
 | A toolchain upgrade changes test counts, loses matcher types or drops unimported coverage | [Preserve discovery and consumer behavior](../inbox/2026-10-27-toolchain-upgrades-must-preserve-test-contracts.md); [migration evidence](../../docs/quality/TOOLCHAIN_MIGRATION_2026-10-27.md) |
 | OAuth links an unverified email, changes accounts after a provider email change, or leaves an orphan user after a link failure | [Provider proof and isolated atomic linking](../inbox/2026-10-27-oauth-linking-needs-provider-proof-and-atomicity.md); `oauth-identity`, `oauth-profiles` and actual `oauth-strategies` tests |

.agents/issues/security-audit-index.md

@@ -2,6 +2,7 @@
 
 | Symptom | Evidence and corrective rule |
 | --- | --- |
+| Turbo or Mermaid major upgrades clear advisories but can change environment, cache, dependency placement or rendering | [Executed consumer evidence](../inbox/2026-10-27-tool-upgrades-need-executed-consumer-evidence.md); [scoped migration and negative controls](../../docs/quality/REMAINING_TOOLING_2026-10-27.md) |
 | A toolchain upgrade changes test counts, loses matcher types or drops unimported coverage | [Preserve discovery and consumer behavior](../inbox/2026-10-27-toolchain-upgrades-must-preserve-test-contracts.md); [migration evidence](../../docs/quality/TOOLCHAIN_MIGRATION_2026-10-27.md) |
 | OAuth email metadata loses verification or callbacks log credential-bearing redirects | [Provider proof and isolated atomic linking](../inbox/2026-10-27-oauth-linking-needs-provider-proof-and-atomicity.md); [provider/recovery contract](../../docs/quality/OAUTH_IDENTITY.md) |
 | Login and reset links cross-use, or a reset/reactivation revives old sessions | [Bind purpose and session revision at the write](../inbox/2026-10-27-email-purpose-and-revision-are-auth-boundaries.md); real SQLite/HTTP/WebSocket `auth-link-boundary.test.ts` |

docs/quality/REMAINING_TOOLING_2026-10-27.md

@@ -0,0 +1,77 @@
+# Turbo and Mermaid consumer migration — 2026-10-27
+
+This completes the remaining npm-tooling slice of #185. It is stacked on the
+reviewed runtime-packaging and camera corrections. It does not close Debian OS
+triage #209, authorize publication or establish deployed-site clearance.
+
+## Changes and compatibility
+
+Turbo 1.13.4 becomes 2.11.10. The configuration uses `tasks` and declares the
+existing npm 10.8.2 package manager. Explicit `envMode: loose` preserves the old
+task environment behavior; this change does not silently adopt Turbo 2's strict
+environment filtering. Build-affecting declared variables, including the offline
+flag, remain in the cache hash. Task dependencies, outputs and persistent dev
+tasks retain their previous meaning. No remote-cache login or publication is
+performed by the contract tests.
+
+The installed Turbo contract executes an owned two-workspace build: dependency
+output must exist before its consumer, an unlisted environment variable must
+arrive, changing the offline flag must invalidate both outputs, and an unchanged
+run must reuse the cache. A real upstream task exits 23 with a unique marker;
+the runner must fail and must not execute its dependent. Fixture removal is strict.
+
+Mermaid 11.17.2 becomes 12.2.0. Its Node consumer resolves KaTeX 0.18.10; the
+shipped browser IIFE embeds KaTeX 0.18.11. Both are above the advisory's 0.18.2
+patch boundary. Mermaid remains a development/test dependency: the app exports
+diagram text and does not load Mermaid into its application bundle. Browser
+contracts load the actual installed IIFE from the web workspace, so a changed
+npm hoisting location cannot silently select a different consumer.
+
+Mermaid 12 changes default layout/appearance and raises its own browser floor.
+The export acceptance explicitly selects dagre/default/classic to preserve its
+existing rendering expectation. Node 22.18 and the installed Chrome meet the new
+tool's requirements. GraphDone's application build target is unchanged; these
+tests do not claim the Mermaid 12 renderer runs on older supported app browsers.
+
+Only these dependency families and their required transitive package placements
+change. No production dependency version changes, blanket overrides or runtime
+image package additions are included.
+
+## Evidence and limits
+
+- Clean Node 22.18/npm 10.8.2 install succeeds. Fresh full and production npm
+  audits both report zero findings on 2026-10-27; retained JSON records the dated
+  advisory result, not a permanent absence of vulnerabilities.
+- All-package build, types and lint pass. Coverage executes 715 passing tests
+  plus the existing 26 explicitly skipped database cases. Those skips are not
+  database acceptance; the separate real-Neo4j CI contract remains required.
+  Harness 192/192 passes. Existing warnings remain.
+- Installed Turbo, Mermaid/KaTeX and Vite contracts pass 3/3 on Node 22.18 and
+  Node 24.22.1. Vite checks include real HMR state preservation, HTTP/WebSocket
+  proxying, secret-file denial and offline-shell behavior.
+- The old installed KaTeX 0.16.47 fails the inherited-trust regression: an
+  options prototype can enable a JavaScript link. The patched consumer rejects
+  it. The expression is inert test text; no link is clicked or script executed.
+- An initial Turbo probe used mutually exclusive `--cache` and `--force` flags
+  and failed before running a task. That failure is retained, not credited as
+  task-failure propagation. The final probe uses local write-only cache mode and
+  requires the actual failing child's unique output marker.
+- The final composed offline production build and full portable-project browser
+  journey pass (27.7 seconds, one worker, zero retries). The journey checks actual
+  import/export, offline reload, malformed/quota failures, real exported Mermaid
+  rendering, responsive controls and zero sync writes. Independent implementation
+  review also repeated the two new contracts and old/new KaTeX negative. Final
+  documentation review and exact-head CI are pending.
+
+Local evidence is under the owned `/tmp/graphdone-resolution-20261027` directory
+in `remaining-tooling-*` and `katex-inherited-trust-negative.log`. Final CI must
+repeat applicable image, browser and Node-version gates; previous stack heads
+do not establish acceptance of a changed composition.
+
+Primary references:
+
+- [Turbo migration and environment behavior](https://turborepo.dev/docs/crafting-your-repository/upgrading)
+- [Turbo package-manager detection advisory](https://github.com/vercel/turborepo/security/advisories/GHSA-3qcw-2rhx-2726)
+- [Turbo login callback advisory](https://github.com/vercel/turborepo/security/advisories/GHSA-hcf7-66rw-9f5r)
+- [Mermaid 12 breaking changes](https://github.com/mermaid-js/mermaid/releases/tag/mermaid@12.0.0)
+- [KaTeX inherited-trust advisory](https://github.com/KaTeX/KaTeX/security/advisories/GHSA-238p-pmpm-9mq7)