fix(review): the engine of a payload is read from an own property

Review finding 3799ea6c; the same lookup in engine-findings.mjs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/review/brief-conflict-findings.test.mjs

@@ -20,6 +20,7 @@ import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import * as m from '../../lib/review/coordinator-contract.mjs';
 import { extractFindingsBlock } from '../../lib/review/findings-schema.mjs';
+import { toReviewerPayload } from '../../lib/review/engine-findings.mjs';
 
 const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..', '..');
 const GATE = join(ROOT, 'lib', 'review', 'verdict-gate.mjs');
@@ -535,3 +536,32 @@ test('decision 13 — the prose states the tie rule (coordinator Pass 1, Handove
   assert.match(h6, /takes? `engine` from the payload a finding arrived in/);
   assert.match(h6, /on a severity tie[^.]*a reviewer-agent finding survives[^.]*over an engine finding/i);
 });
+
+// ---- The engine of a payload is read from an own property (review 3799ea6c) --
+//
+// A payload `reviewer` named after an Object.prototype member must not pick up
+// an inherited function or object as its engine: such a payload is a reviewer
+// payload, its findings carry no `engine`, and the contract's output is plain
+// JSON. The same lookup in engine-findings.mjs refuses an engine named after
+// one with the existing "engine must be one of" error.
+
+for (const name of ['toString', 'constructor', 'hasOwnProperty', 'valueOf', '__proto__']) {
+  test(`own property — a payload reviewer named ${name} gives findings no engine, and runContract's output survives a JSON round trip`, () => {
+    const { engine: _e, ...finding } = codeReviewDefect();
+    const ingested = m.ingest(payload(name, [finding]));
+    assert.equal(ingested.findings.length, 1);
+    assert.equal('engine' in ingested.findings[0], false,
+      `a payload reviewer named ${name} is not an engine payload`);
+    const result = m.runContract(payload(name, [finding]));
+    assert.deepEqual(JSON.parse(JSON.stringify(result)), result,
+      'runContract output is plain JSON (no inherited function or object as engine)');
+    assertAllOutputLegal(result);
+  });
+}
+
+test('own property — toReviewerPayload refuses engine toString with the "engine must be one of" error', () => {
+  const r = toReviewerPayload({ engine: 'toString', findings: [] });
+  assert.equal(r.ok, false, 'toString is not an engine');
+  assert.equal(r.errors.length, 1);
+  assert.match(r.errors[0], /^engine must be one of code-review\|security-review, got "toString"$/);
+});