shipyard: migrate remaining sibling-repo issues + reorg closed

- ISSUE-025 (RunPoller race) → TaskScheduler#10
- ISSUE-026 (delete probe test) → TaskScheduler#11
- ISSUE-027 (test helper DRY) → TaskScheduler#12
- ISSUE-028 removed — already resolved upstream (landed in TaskScheduler 0.4.0)
- ISSUE-031 (CVE fix) moved from Open to Closed — resolved in PR #118

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: blehnen

.shipyard/ISSUES.md

@@ -2,59 +2,6 @@
 
 ## Open
 
-### ISSUE-031: Transitive `System.Security.Cryptography.Xml 8.0.2` high-severity CVE (NU1903) via TaskScheduler integration tests
-- **Severity:** High (CVE, but surface is test-only)
-- **Source:** Phase 2 (dependency-refresh milestone) — surfaced during Debug build after bumping low-risk packages
-- **Repo:** DotNetWorkQueue (this repo)
-- **Status:** **Resolved** — Phase 3 Wave 5 PLAN-5.1, 2026-04-17. Added `<PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.6" />` to `Source/Directory.Packages.props` and `<PackageReference>` to TaskScheduler.Integration.Tests.csproj. NU1903 grep on `dotnet build -c Debug` output returns 0 matches for this package.
-- **Files:**
-  - `Source/DotNetWorkQueue.TaskScheduling.Distributed.TaskScheduler.Integration.Tests/*.csproj` (transitive path via `DotNetWorkQueue.TaskScheduling.Distributed.TaskScheduler 0.5.0`)
-- **Description:** Debug build surfaces 4× NU1903 warnings: `Package 'System.Security.Cryptography.Xml' 8.0.2 has a known high severity vulnerability` (GHSA-37gx-xxp4-5rgx and GHSA-w3x6-4m5h-cxqf). The package is a transitive dep pulled in through the TaskScheduler 0.5.0 NuGet via test-only paths — it is not in `Source/Directory.Packages.props` directly. Consumer shipping surface is unaffected.
-- **Remediation options:**
-  1. Add a direct `<PackageVersion>` for `System.Security.Cryptography.Xml` at a patched version (≥8.0.3 / ≥9.0.0 / ≥10.0.0 depending on the consuming test project's target) to force the CPM override.
-  2. Upstream fix in the TaskScheduler repo — drop or update the dep there and cut a new TaskScheduler release.
-  3. Accept the risk (test-integration-only, no production surface) and suppress the warning.
-- **Recommended:** Option 1 — add a CPM-level direct reference to force the patched transitive. Cheap, reversible, no upstream coordination needed. Evaluate during Phase 3 if scope permits; otherwise defer to a follow-up hygiene PR.
-- **Not a Phase 2 blocker** — warnings, not errors; unit tests all green.
-
-### ISSUE-028: Add `<remarks>` XML doc on TaskSchedulerJobCountSync.Start() describing non-blocking semantics
-- **Severity:** Minor
-- **Source:** Phase 1 (TaskScheduler lock fix) — Documenter review
-- **Repo:** DotNetWorkQueue.TaskScheduling.Distributed.TaskScheduler
-- **Status:** CLOSED (landed in Phase 2 release commit `b904ac3` as part of the 0.4.0 release, 2026-04-14)
-- **Description:** After Phase 1 made `Start()` non-blocking (poller runs on a dedicated background thread), the method's XML `<summary>` still just says "Starts this instance". Library consumers who subclass `TaskSchedulerJobCountSync` or wrap `ITaskSchedulerJobCountSync` can't see the behavior change from IDE tooltips.
-- **Remediation:** Add a `<remarks>` block to the `Start()` XML doc on both `Source/ITaskSchedulerJobCountSync.cs` and `Source/TaskSchedulerJobCountSync.cs`, describing the synchronous-then-background-poller handoff. ~10 lines across both files.
-- **Why deferred from Phase 1:** The ROADMAP.md Phase 1 success criterion #2 requires `ITaskSchedulerJobCountSync.cs` to be byte-identical to master. Strictly interpreted, XML doc comments are part of the file bytes. Adding them would break the literal invariant. Phase 2 (0.4.0 release) can land the doc change alongside the CHANGELOG entry — they both document the same observable behavior change.
-
-### ISSUE-027: Test helper DRY opportunity — XunitLogger / NextPort / BeaconInterface copied across 4 test files
-- **Severity:** Medium
-- **Source:** Phase 1 (TaskScheduler lock fix) — Simplifier review
-- **Repo:** DotNetWorkQueue.TaskScheduling.Distributed.TaskScheduler
-- **Status:** Open (deferred from Phase 1)
-- **Description:** `Source/DotNetWorkQueue.TaskScheduling.Distributed.TaskScheduler.Tests/` now has 4 test files (existing `TaskSchedulerJobCountSyncTests` + 3 new from PLAN-2.1) each with a verbatim copy of `private class XunitLogger : ILogger`, a per-file `_nextPort + NextPort()` counter, and a `BeaconInterface` static. About 80 LoC of pure copy-paste.
-- **Remediation:** Create `Source/DotNetWorkQueue.TaskScheduling.Distributed.TaskScheduler.Tests/NetMqTestSupport.cs` with an `internal sealed class XunitLogger`, an `internal static class TestPorts` with a decade-aware `Next()` that preserves disjoint seeds per caller, and an `internal static class BeaconInterfaces.Default`. Then delete the nested copies in each test file. Net delete ~60 LoC, effort ~20 minutes.
-- **Why deferred:** Phase 1 is a concurrency refactor; a test-helper consolidation is out of scope. Worth doing if Phase 2/3 adds more test files to this project.
-
-### ISSUE-026: NetMqQueueApiProbeTests.cs is design-time scaffolding superseded by real handler tests
-- **Severity:** Low
-- **Source:** Phase 1 (TaskScheduler lock fix) — Simplifier review
-- **Repo:** DotNetWorkQueue.TaskScheduling.Distributed.TaskScheduler
-- **Status:** Open (deferred from Phase 1)
-- **Description:** `Source/DotNetWorkQueue.TaskScheduling.Distributed.TaskScheduler.Tests/NetMqQueueApiProbeTests.cs` (35 LoC) was created in PLAN-1.1 Task 1 to validate that `NetMQQueue<T>` + `NetMQPoller` + `ReceiveReady` actually compile and run against NetMQ 4.0.2.2. The real handler tests from PLAN-2.1 now exercise the same API paths, making the probe redundant.
-- **Remediation:** Delete `NetMqQueueApiProbeTests.cs` entirely. Preserves the probe's historical role via git history.
-- **Why deferred:** Low-value cleanup; the file doesn't cost anything at runtime and it documents the original concern.
-
-### ISSUE-025: RunPoller start race on fast Start() → Dispose() cycles
-- **Severity:** Low (noisy, not functional)
-- **Source:** Phase 1 (TaskScheduler lock fix) — PLAN-1.3 code quality review
-- **Repo:** DotNetWorkQueue.TaskScheduling.Distributed.TaskScheduler
-- **Status:** Open (deferred from Phase 1)
-- **Files:**
-  - `Source/TaskSchedulerJobCountSync.cs` — `RunPoller()` method
-- **Description:** If `Dispose()` fires between `_pollerThread.Start()` and the `_poller = new NetMQPoller { _actor, _outbound }` assignment inside `RunPoller`, `_poller?.Stop()` no-ops because `_poller` is still null. The poller thread then constructs and runs an orphan poller until the underlying `_actor` is disposed, causing an `ObjectDisposedException` that is caught by the `RunPoller` try/catch but produces a noisy error log on pathological Start→Dispose cycles. Functionally safe — logged and swallowed — but cosmetically ugly.
-- **Remediation:** Add a `volatile bool _disposing` flag set by `Dispose(bool)` before `_poller?.Stop()`. `RunPoller` early-returns if `_disposing` is true before constructing `_poller`.
-- **Why deferred:** Not a functional bug, only affects error logs in a niche race. Good to fix in a later hardening pass.
-
 ### ISSUE-019: Missing SUMMARY-1.1.md artifact for Plan 1.1 (LiteDb history tests)
 - **Severity:** Important
 - **Source:** Plan 1.1 Review
@@ -136,6 +83,17 @@
 
 ## Closed
 
+### ISSUE-031: Transitive `System.Security.Cryptography.Xml 8.0.2` high-severity CVE (NU1903) via TaskScheduler integration tests
+- **Severity:** High (CVE, but surface is test-only)
+- **Source:** Phase 2 (dependency-refresh milestone) — surfaced during Debug build after bumping low-risk packages
+- **Repo:** DotNetWorkQueue (this repo)
+- **Status:** Resolved — Phase 3 Wave 5 PLAN-5.1, commit `3d6b9949`, 2026-04-17. Added `<PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.6" />` to `Source/Directory.Packages.props` and `<PackageReference>` to `DotNetWorkQueue.TaskScheduling.Distributed.TaskScheduler.Integration.Tests.csproj`. NU1903 grep on `dotnet build -c Debug` returns 0 matches for this package.
+- **Files:**
+  - `Source/Directory.Packages.props`
+  - `Source/DotNetWorkQueue.TaskScheduling.Distributed.TaskScheduler.Integration.Tests/DotNetWorkQueue.TaskScheduling.Distributed.TaskScheduler.Integration.Tests.csproj`
+- **Description:** Debug build surfaced 4× NU1903 warnings: `Package 'System.Security.Cryptography.Xml' 8.0.2 has a known high severity vulnerability` (GHSA-37gx-xxp4-5rgx and GHSA-w3x6-4m5h-cxqf). The package was a transitive dep pulled in through the TaskScheduler 0.5.0 NuGet via test-only paths — not in `Directory.Packages.props` directly. Consumer shipping surface was unaffected.
+- **Resolution:** Option 1 chosen — added a direct CPM `<PackageVersion>` at 10.0.6 to force the patched transitive. Cheap, reversible, no upstream coordination needed. Fix landed alongside Phase 3 major bumps in PR #118.
+
 ### ISSUE-023: Stray blank line and double blank line artifacts from NETFULL removal
 - **Severity:** Suggestion
 - **Source:** simplifier (Phase 3)