feat(plan-management): implement alert-remediation-plan system v1.3

- 8 new store modules + matcher + initialResponse + aggregation + remediation + AlertStateMonitor + planGenerator

- alert chain auto-integrated after runInspection: freeze snapshot + generate response + real-time agg + auto-start monitor

- AlertAIPanel component + MonitoringDetailPanel expandable alert list

- PlanManagementPage: full page with list/edit/AI generate/templates/commands

electron/bridges/inspection/alertRecordStore.cjs

@@ -364,6 +364,75 @@ function updateNote(readFn, writeFn, alertId, note) {
   return { ...alert };
 }
 
+// ---------- v1.3 扩展：预案匹配 / 初始响应包 / 处置 / 审计 ----------
+
+/**
+ * 匹配时刻冻结快照（D9）
+ */
+function setMatchedPlanSnapshot(readFn, writeFn, alertId, snapshot) {
+  _ensureLoaded(readFn);
+  const alert = _alerts.find((a) => a.id === alertId);
+  if (!alert) return null;
+
+  alert.matched_plan_id = snapshot?.id || null;
+  alert.matched_template_id = snapshot?.template_id || null;
+  alert.matched_plan_snapshot = snapshot ? JSON.parse(JSON.stringify(snapshot)) : null;
+  alert.match_score = null;
+  alert.frozen_at = Date.now();
+  _appendAudit(alert, "plan_matched", { plan_id: snapshot?.id });
+  _saveAlerts(writeFn);
+  return { ...alert };
+}
+
+function setInitialResponse(readFn, writeFn, alertId, response) {
+  _ensureLoaded(readFn);
+  const alert = _alerts.find((a) => a.id === alertId);
+  if (!alert) return null;
+
+  alert.initial_response = response;
+  const auditAction = response?.generator === "fallback" ? "initial_response_fallback" : "initial_response_generated";
+  _appendAudit(alert, auditAction, { status: response?.status });
+  _saveAlerts(writeFn);
+  return { ...alert };
+}
+
+function setRemediation(readFn, writeFn, alertId, remediation) {
+  _ensureLoaded(readFn);
+  const alert = _alerts.find((a) => a.id === alertId);
+  if (!alert) return null;
+
+  alert.remediation = remediation;
+  _saveAlerts(writeFn);
+  return { ...alert };
+}
+
+function appendAudit(readFn, writeFn, alertId, action, detail) {
+  _ensureLoaded(readFn);
+  const alert = _alerts.find((a) => a.id === alertId);
+  if (!alert) return null;
+
+  _appendAudit(alert, action, detail);
+  _saveAlerts(writeFn);
+  return { ...alert };
+}
+
+function _appendAudit(alert, action, detail) {
+  if (!alert.audit_log) alert.audit_log = [];
+  alert.audit_log.push({ ts: Date.now(), actor: "system", action, detail });
+  // 限制审计长度
+  if (alert.audit_log.length > 200) alert.audit_log = alert.audit_log.slice(-200);
+}
+
+/**
+ * AlertStateMonitor 用：列出 active + acknowledged 的告警
+ */
+function listActiveForMonitor(readFn) {
+  _ensureLoaded(readFn);
+  return _alerts.filter(
+    (a) => a.status === ALERT_RECORD_STATUS.ACTIVE || a.status === ALERT_RECORD_STATUS.ACKNOWLEDGED
+  );
+}
+
 // ---------- 统计 ----------
 
 function getAlertStats(readFn) {
@@ -403,6 +472,14 @@ module.exports = {
   updateNote,
   // 统计
   getAlertStats,
+  // v1.3 扩展：预案匹配 / 初始响应包 / 处置 / 审计
+  setMatchedPlanSnapshot,
+  setInitialResponse,
+  setRemediation,
+  appendAudit,
+  listActiveForMonitor,
+  _createAlert, // 供 aggregationEngine 用
+  _saveAlerts,  // 供 aggregationEngine 用
   // 内部
   _resetForTest,
 };