fix(review): the review keeps the findings that are right

voyage-lekerepo end-to-end trial (2026-10-06), report points 1, 5, 11:

- engine-findings: recommended_action is "Fix <file:line> so this no longer
  happens: <failure scenario>", not "Resolve: <title>" (8 of 8 engine
  findings were set aside as actionability:empty); the coordinator never
  sets an engine finding aside for Actionability.
- findings-schema --repo-root: a cited line past the end of an existing
  file is FINDING_LINE_OUT_OF_RANGE, so Phase 5's bounded re-ask fixes it
  before the coordinator sees it. The reviewers' instruction said "the
  actual line number from the diff"; it now says the file's own line,
  never the patch's.
- fill-finding-ids.mjs: the coordinator (no shell) writes @@ID_<n>@@ and
  trekreview Phase 7 computes them over (file, line, rule_key); an
  unresolved placeholder or a wrong 40-hex id fails. The 4-field id with
  `title` the docs named is gone; the code always used three.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

agents/review-coordinator.md

@@ -86,9 +86,8 @@ identical. When findings collide:
 - Concatenate the kept finding's `detail` with a one-line note: "Also
   flagged by {other reviewer}: {their title}." This preserves
   attribution without duplicating the row.
-- Recompute the finding `id` using the canonical SHA1 algorithm
-  (`finding-id.mjs`) over `(file, line, rule_key, title)`. Do not
-  carry over the placeholder hex from the reviewer.
+- Do not carry over the reviewer's id: write the placeholder `@@ID_<n>@@`
+  (see *Recompute IDs* under Hard rules).
 
 Findings with `line: 0` are file-scoped. Two file-scoped findings with
 identical `(file, rule_key)` and `line == 0` collide.
@@ -104,6 +103,13 @@ is load-bearing** — see *Suppression is two-valued* below:
 | Accuracy | `file` resolves under the repo root AND `line` is plausible (≥ 0; ≤ file line count when known) | Path traversal escape, negative line, or impossibly large line number | **dropped** (`accuracy:refuted`) |
 | Actionability | `recommended_action` is non-empty AND begins with an imperative verb | Empty action, "consider …" hedges, or restating the title | `unverified` (`actionability:empty`) |
 
+A finding that carries `engine` (`code-review` / `security-review`) came
+from Claude Code's own review through `lib/review/engine-findings.mjs`, which
+writes its action from the engine's failure scenario; it is
+never set aside for Actionability. (Before this rule the converter wrote
+`Resolve: <title>`, and 8 of 8 engine findings were set aside in the
+voyage-lekerepo trial, 2026-10-06.)
+
 Succinctness and Actionability read the finding's *packaging*; neither
 examines the claim, so neither can establish the finding is unreal. Accuracy
 does: a citation that escapes the repo root refutes the finding as a claim
@@ -347,10 +353,15 @@ for the ID list.
   tiebreak uses the catalogue tier, not the reviewer's emitted value.
 - **Block-style YAML for findings list.** The frontmatter parser
   (`lib/util/frontmatter.mjs`) does not support flow-style arrays.
-- **Recompute IDs.** The reviewers emit placeholder hex IDs. Recompute
-  the canonical 40-char SHA1 from `(file, line, rule_key, title)` using
-  the algorithm in `lib/parsers/finding-id.mjs`. The frontmatter
-  `findings:` list and the JSON block IDs must match.
+- **IDs are computed by code, not by you.** You have no shell, so you
+  cannot compute the SHA1. Wherever finding n's id belongs — the frontmatter
+  `findings:` list, its `### ` heading, `**Source finding:**`, a `Verify:`
+  line and its `id` in the JSON block — write the placeholder `@@ID_<n>@@`,
+  where n is its 1-based position in the JSON block's `findings` array.
+  `/trekreview` Phase 7 runs `lib/review/fill-finding-ids.mjs`, which
+  replaces each placeholder with the id computed over `(file, line,
+  rule_key)` (`lib/parsers/finding-id.mjs`) and refuses a placeholder with
+  no finding behind it.
 - **Suppressed findings are accountable.** When you remove a finding via
   Pass 2 or Pass 3, log it in `## Suppressed Findings` with the reason and
   its fate (`[dropped]` / `[unverified]`), and list every `[unverified]` one