Record the fixed defects in README, and pin the issue format

The status section now states each defect that was closed and what it cost
while open, in the same register as the rest of the page: the poisoned
deadline guard, the async double-charge, the prose-bracket parser, the
fan-out attribution, and the round event that was a measurement when it
should have been an envelope.

.github/ISSUE_TEMPLATE/task.md fixes the seven-section shape used by the ten
issues opened against this repo, so every future issue arrives with a summary,
why it matters, where in the code with a command to confirm it, what to change,
how to verify, acceptance criteria, and an explicit skill level. It also states
the house rule out loud: a change arrives with a test that fails without it,
checked by reverting the source and watching the test go red.

uv.lock is a stale-lock refresh, not a dependency change: pyproject already
said 0.1.1 while the lock still said 0.1.0a0.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: Shashankss1205

.github/ISSUE_TEMPLATE/task.md

@@ -0,0 +1,72 @@
+---
+name: Task or defect
+about: The standard format for every issue in this repository
+title: "area: what is wrong or missing, stated plainly"
+labels: ''
+assignees: ''
+---
+
+<!--
+Keep these seven sections, in this order, for every issue. The title prefix is
+the subsystem: runtime, planner, harness, observability, policy, session,
+server, cli, docs, packaging.
+
+The rule this repo runs on: a claim needs evidence. Quote the code or paste the
+command output that shows the problem, rather than describing it from memory.
+-->
+
+## Summary
+
+What is wrong or missing, in one short paragraph. Quote the offending code or the
+real command output rather than paraphrasing it.
+
+## Why this matters
+
+What breaks, or what a user cannot do, as a consequence. Prefer a concrete
+failure over an adjective.
+
+## Where in the code
+
+- `path/to/file.py:LINE` — what is there and why it is relevant
+
+Include a command a reader can run to confirm the problem for themselves:
+
+```bash
+```
+
+## What to change
+
+1. …
+2. …
+
+State anything deliberately out of scope, so a pull request does not grow past
+what was agreed here.
+
+## How to verify
+
+```bash
+uv run pytest -q
+uv run ruff check .
+```
+
+Note which new test proves the fix. This repo's convention is that a change
+arrives with a test that **fails without it** — check that by reverting your
+source edit and watching the new test go red.
+
+## Acceptance criteria
+
+- [ ] …
+- [ ] `uv run pytest` stays green and `uv run ruff check .` is clean
+- [ ] Any README or cookbook sentence this changes is updated in the same pull
+      request (several are byte-compared against real output by the test suite)
+
+## Skill level
+
+Pick one and delete the other.
+
+**good first issue** — say why it is well bounded, point at a sibling file that
+shows the pattern to copy, and invite questions on the issue.
+
+**experience required** — say which subsystems the change spans, what could
+silently break, and ask for a design comment on the issue before any code is
+written.

README.md

@@ -480,15 +480,21 @@ Re-derived on 2026-07-28 by running each item, not by reading the commit log.
 
 - **The HTTP API does not use the durable session layer.** It has its own `InProcessRuntime`, whose sessions die with the process and whose approvals are recorded without being delivered. [ROADMAP.md](ROADMAP.md) §12.3.
 - *Closed:* `grapharc plan` drives the governed loop; `PolicyEngine.edge_policy()` compiles the TOML document into the gate `AdmissionChecker` consults, and `grapharc plan --policy` is the caller; `grapharc demo --memory PATH` hands the shipped graphs the durable SQLite store.
+- *Closed:* the shipped registry withheld the trace recorder from its `PlannerNode` and `Materializer`, so `grapharc plan` wrote a file with no `plan` event and **no `start`/`end` pair for any node it executed** — the paragraph above claiming otherwise was true of a hand-wired loop and false of the one the command drives. Both now get the recorder, and a test asserts the phase counts.
 
 **Real limits of things that do work**
 
 - **Admission authorises a kind, not its arguments.** A proposal carrying `args={"path": "/etc/passwd"}` is admitted on the strength of its kind alone.
 - **The audit-hook sandbox is in-process confinement, not a kernel boundary.** `os.stat` outside the workspace is not blocked, because CPython raises no event for it. `ContainerExecutor` is the boundary where one is needed.
 - **`run_command` is not confined.** Argv-only and never a shell, but the child is an ordinary process with your privileges.
+- *Closed:* a `max_seconds` past the platform's `time_t` — `float("inf")`, or a plausible "effectively unlimited" like `1e10` — used to **disable the deadline guard for the rest of the process**. `setitimer` raised *after* the SIGALRM handler was installed and the process-wide slot taken, leaking both, so every later run silently fell back to the mechanism that cannot unwind a blocking syscall: a 0.3s ceiling then took a 5s sleep to notice. Arming is undone on failure now, and the armed delay is clamped to what both mechanisms accept.
+- *Closed:* every `async def` node **double-charged** its token re-reports. The re-report ledger was keyed by thread ident, but `on_llm_end` is sync — under `ainvoke` LangChain dispatches it to a worker thread while the body stays on the event loop — so the automatic charge found no ledger and the node's named re-report was charged again. Any node using the shipped `charge_usage`, `AgentNode._charge_tokens` or `planner.proposal._charge` reported double its real spend and hit `max_tokens` at half its declared allowance. The ledger is a `contextvars` scope now, which also fixes an inner scope discarding the enclosing node's.
+- *Closed:* a bracket anywhere in a model's **prose** hijacked JSON extraction, because only the first `{`/`[` was ever tried. `Based on the context [lines 3-5]: {…}` was rejected as unparseable, and — worse — `Analysis (note [1]): {"supported": false}` returned a perfectly valid `[1]`, substituting a fabricated value for the verifier's actual answer. Every opener is tried now, longest parse wins; junk still returns `None`, so fail-closed is unchanged.
 - **`interrupt()` suspends but cannot be resumed.** LangGraph's native interrupt stops the graph and shows on `get_state`, and there is no supported resume path — resuming means passing a `Command` as *input*, which is closed by design. Use the session layer's approval gate for human-in-the-loop.
 - **Still unwrapped from LangGraph:** `retry_policy`, `cache_policy`, `durability`, subgraphs. `.inner` reaches them, but execution entry points there fail closed, so `.inner` is an inspection escape hatch and not a way to run the graph.
 - **Cost is recorded when a backend reports one, estimated when it does not.** Both gateways publish the provider's `cost_usd` through the same `llm_output` envelope, the runtime's usage callback writes it onto the node's `end` event, and an agent's `model` events carry the per-call breakdown. A backend that reports no price still falls back to a `RateCard` estimate, and the two figures stay apart — `recorded_cost_usd` is never a guess. Still missing: no tenant on a trace event, so per-tenant attribution is not offered.
+- **A node's tokens are its own, not the run's movement while it ran.** Worth stating because it was the other way round: an `end` event carried the difference between two readings of the run's *shared* meter, so under fan-out the workers' windows overlapped and each was credited with its siblings' concurrent spend. Three workers costing 8 tokens each traced as 24/16/8, and `metrics` and `cost` agreed on 48 for 24 tokens of real work — doubling the estimated bill purely because the work ran in parallel. Attribution now comes from a per-node scope on the meter, so the same work costs the same serially and in parallel; a hand charge the usage callback never saw still lands on the node that made it.
+- **A planning round is an envelope, not a measurement.** A `round` event used to carry the planner's `tokens` and the round's `duration_ms`, both of which `metrics`, `cost` and `replay` add on top of node totals — and the planner's spend was already reported by its own `plan` event, so it was counted twice, and a round's duration encloses the plan plus every node it ran. Neither is on the event now; both are on its `state_delta` as `round_tokens` / `round_iterations` / `round_duration_ms`, where no reader sums them. `RoundRecord.iterations` also holds a figure now rather than always `0`.
 - **The Claude CLI backend is completion-only.** Tool calling and structured output need one of the OpenAI-wire backends: `openrouter`, `openai`, or a local `ollama`.
 - **A session turn is synchronous**, and a runner claim is a claim rather than a lease — nothing reclaims a session whose runner died holding it.
 - **A bare model spec resolves to the paid `claude-cli` backend.** `--model mock` does not reach the scripted double; it becomes the model name `mock` on the subscription backend. Only the slash form (`mock/anything`) reaches the double. A mistyped backend *with* a slash is rejected properly, exit 2.