feat(plane): honest coverage in alerts; PHP alerts from the engine on the host

Quick mode has rules only for c/cpp, groovy, java, javascript/typescript and
python, so every PHP case's "0 alerts" read as clean. The `alerts` task now
records per language of the files read whether quick mode covers it
(derived from the bundled ruleset, not a list): coverage quick | none, with
file counts per pin, and `uncovered`. `remember` turns that into `coverage`
memory rows (a new kind; the Run passes the alerts summary.json as input),
loop-measure reports coverage per language, and improve/memory.py's M1/M2
skip a repository+pin whose coverage for the rule's language is only
`none` (counted under `coverage_none` in the proposal's excluded).

`ousast plane alerts-engine <Run.yaml> --source <frozen export>`
(plane/engine_alerts.py) does the alerts task on the host for cases whose
files include a language the engine covers but quick mode does not (PHP):
exports both pins from the case cache, runs the quick scan and the
openultrasast:dev engine container (finding_dump.py, --network none,
--memory 3g, one at a time, per-pin deadline), writes engine findings in
the alerts.jsonl row shape (rule_id engine:<family>, source engine,
in_fix_range from case.json) with a summary (files read, questions,
completed, seconds, degradations per pin), and marks the task done via
reconciler.mark_done. No result, no files read, or questions == 0 fails
loudly and leaves the run untouched. Refuses a git checkout as source.

Runner image rebuilt and re-pinned (sha256:ebb40a9a...); validation-46
regenerated (digest only). Live, recorded in
benchmarks/measurements/2026-09-30-php-engine-alerts/: froxlor 366 files,
130/130 questions per pin, 6 alerts per pin, 0 in the fix range; wp-gopay
19 files, 101/101 questions, 0 alerts. The loop: 32 run rows (coverage 8,
php=engine), 0 proposals, gate no_proposals, $0.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

benchmarks/measurements/2026-09-08-module-audit.json

@@ -1,7 +1,7 @@
 {
-  "modules": 134,
+  "modules": 135,
   "counts": {
-    "load_bearing": 127,
+    "load_bearing": 128,
     "standalone_capability": 7
   },
   "orphaned": [],
@@ -662,6 +662,7 @@
         "cli",
         "improve.memory",
         "plane.egress",
+        "plane.engine_alerts",
         "plane.generate",
         "plane.memory",
         "plane.reconciler",
@@ -698,6 +699,12 @@
         "plane.reconciler"
       ]
     },
+    {
+      "module": "plane.engine_alerts",
+      "classification": "load_bearing",
+      "reason": "harnessx-removal Req 6.3: engine alerts where quick mode has no rules (PHP), on the host",
+      "importers": []
+    },
     {
       "module": "plane.generate",
       "classification": "load_bearing",
@@ -761,6 +768,7 @@
       "reason": "ai-service-plane Req 4.1: the task entrypoint package the runner imports by name; runner integration pending (task 3)",
       "importers": [
         "cli",
+        "plane.engine_alerts",
         "plane.generate",
         "plane.memory",
         "plane.tasks.agree",
@@ -778,7 +786,9 @@
       "module": "plane.tasks.alerts",
       "classification": "load_bearing",
       "reason": "harnessx-removal Req 6.3: quick-mode alerts on a case's vulnerable and fixed pins, model-free",
-      "importers": []
+      "importers": [
+        "plane.engine_alerts"
+      ]
     },
     {
       "module": "plane.tasks.loop",
@@ -1139,6 +1149,7 @@
         "improve.memory",
         "improve.validator",
         "pairs",
+        "plane.tasks.alerts",
         "plane.tasks.loop",
         "stage_processors"
       ]