feat(review): the standard path puts back engine findings the coordinator dropped

commands/trekreview.md

@@ -351,9 +351,14 @@ git diff --name-only "$before_sha".."$after_sha" > "{project_dir}/.review-scope.
 git diff --name-only HEAD >> "{project_dir}/.review-scope.txt"
 node ${CLAUDE_PLUGIN_ROOT}/lib/review/engine-findings.mjs \
   --scope "{project_dir}/.review-scope.txt" --repo-root "$(git rev-parse --show-toplevel)" \
-  "{project_dir}/.review-engine-code-review.json"
+  "{project_dir}/.review-engine-code-review.json" \
+  > "{project_dir}/.review-engine-payload-code-review.json" \
+  && cat "{project_dir}/.review-engine-payload-code-review.json"
 ```
 
+The converted payload is saved to `{project_dir}/.review-engine-payload-{engine}.json`
+(`code-review` or `security-review`), the same stdout, also written: Phase 7's finalize
+reads it from there. Never edit that file by hand.
 Exit 0 prints a reviewer payload (`claude-code-review` /
 `claude-security-review`) for Phase 6 plus `out_of_scope`: engine findings on
 files outside the review's SHA range (`/security-review` diffs against
@@ -610,7 +615,7 @@ Workflow({
 A reviewer that returns nothing, an engine listed in `engineNotRun`, or a coordinator that returns no verdict and findings forbids `ALLOW` on this path too (`missing_reviewers` in the result), and the result's `allow_blocked_by` names each one (`missing-reviewer:<name>`, the coordinator as `missing-reviewer:review-coordinator`);
 Phase 7 writes that list as the trailing JSON block's `allow_blocked_by`, so the verdict gate reads such a WARN review as not performed in full (exit 2; a BLOCK stays exit 1).
 On this path dedup ranks as Pass 1 does (both paths), and after the coordinator each finding is matched to its own row, its `(file, line, rule_key)` triplet plus its title, trimmed and in lower case: of the engine findings in a row no returned finding is on, the one with the highest severity (on a tie, the first seen) is put back at its own severity (operator decision 23), and a returned finding is never below the lower of its reviewer counterpart's severity and its catalogue tier (floor (b)); its counterpart is its own row, else the strictest row on its triplet.
-So the workflow path is stricter than the prose path.
+Both paths put back engine findings; the workflow path also applies floor (b).
 
 Contract (verified in S10 part B — follow exactly):
 - **Pass `args` as a JSON object.** The script defensively re-parses a JSON *string*, but
@@ -685,7 +690,13 @@ findings reach review.md only through finalize's carry, so the verdict gate read
 `finalized: true` as exit 2 (`review-not-measured: round 2+ review not finalized`), never green.
 Finalize writes `round`, `round_base`, `finalized: true`, `ran` (what ran this round, read from the
 `.review-out-*.md` and `.review-engine-payload-*.json` files) and, from round 2, `resolved` with a
-`## Resolved since round <n>` section; a carried BLOCKER gets its `### Step R<n>`. `review-answers.mjs carry`
+`## Resolved since round <n>` section; a carried BLOCKER gets its `### Step R<n>`.
+The standard path now puts back engine findings at MAJOR or above the way the workflow path does: finalize's
+first pass reads the Phase 4.7 payloads itself from `{project_dir}` (`.review-engine-payload-*.json`, no new
+argument), and each engine finding at MAJOR or BLOCKER whose row no finding of review.md carries is put back at its
+own severity, with the line `**Source:** engine {name}, put back by the standard-path comparison` in its entry; the
+verdict is only raised, and a put-back BLOCKER gets its `### Step R<n>`. An engine finding in `out_of_scope` stays
+declined (`engine:out-of-scope`). `review-answers.mjs carry`
 writes an `## Answers` row with `Carried from` for each carried MAJOR the operator accepted in an
 earlier round; on exit 1 or 2 print the reason in one line and continue: no answer is carried.
 A finding is pre-existing when it sits on a line the range `scope_sha_start..scope_sha_end` did not add or