@remnic/core 9.35.1 → 9.35.3

package/src/lifecycle/tombstones.ts

@@ -835,6 +835,46 @@ export function collectRetiredMemoriesForRebuild(
   return retired;
 }
 
+/**
+ * One-shot write-time resurrection gate (issue #1579 / #2213). Looks up the
+ * fact's identity in the tombstone store and, on a match, downgrades the
+ * frontmatter to `pending_review` + `blockedBy` IN PLACE. ADD-ONLY: an
+ * already-blocked or terminal-status record is left untouched. Pure over its
+ * inputs (no I/O beyond the injected store) so both `writeMemory`'s gate and
+ * the chunk-repair re-gate share one lookup + apply.
+ */
+export function applyTombstoneResurrectionGate(
+  store: Pick<TombstoneStore, "lookup">,
+  fm: {
+    id: string;
+    status?: string;
+    blockedBy?: string;
+    tombstoneBlockTier?: TombstoneMatchTier;
+    entityRef?: string;
+    contentHash?: string;
+  },
+  query: {
+    normalizedText: string;
+    supersessionKeys: string[];
+    namespace: string;
+  },
+): TombstoneMatch | null {
+  if (fm.status === "pending_review" && fm.blockedBy) return null;
+  if (!(fm.status === undefined || fm.status === "active" || fm.status === "pending_review")) return null;
+  const match = store.lookup({
+    contentHash: fm.contentHash,
+    normalizedText: query.normalizedText,
+    ...(fm.entityRef ? { entityRef: fm.entityRef } : {}),
+    ...(query.supersessionKeys.length > 0 ? { supersessionKeys: query.supersessionKeys } : {}),
+    namespace: query.namespace,
+  });
+  if (!match) return null;
+  fm.status = "pending_review";
+  fm.blockedBy = match.tombstoneId;
+  fm.tombstoneBlockTier = match.matchedTier;
+  return match;
+}
+
 /**
  * Build the live-emission tombstone inputs for a single retired FACT — one
  * input per derived supersession key (or a single keyless record when no

package/src/local-llm-helpers.ts

@@ -1,3 +1,4 @@
+import { log } from "./logger.js";
 export function isAbortError(err: unknown): boolean {
   if (!err || typeof err !== "object") return false;
   const maybe = err as { name?: string; message?: string };
@@ -56,3 +57,173 @@ export function extractNonRecoverableBackendReasonFromErrorText(errorText: strin
     return null;
   }
 }
+
+/**
+ * Flatten a fetch rejection into one line, including the `cause` undici hides
+ * the real reason behind (`fetch failed` alone says nothing).
+ */
+export function describeFetchFailure(err: unknown): string {
+  const name = err instanceof Error ? err.name : "";
+  const message = err instanceof Error ? err.message : String(err);
+  const cause: unknown = err instanceof Error ? (err as Error & { cause?: unknown }).cause : undefined;
+  const causeText = cause instanceof Error
+    ? ` (cause: ${cause.name}: ${cause.message}${
+      typeof (cause as Error & { code?: unknown }).code === "string"
+        ? ` [${String((cause as Error & { code?: unknown }).code)}]`
+        : ""
+    })`
+    : cause === undefined
+      ? ""
+      : ` (cause: ${String(cause)})`;
+  return `${name ? `${name}: ` : ""}${message}${causeText}`;
+}
+
+/**
+ * What to record when every availability probe failed.
+ *
+ * A probe that TIMED OUT is not evidence the backend is down: the budget is a
+ * fixed 2s and a busy event loop can burn it before the socket is scheduled,
+ * so the backend looks dead while it answers other callers in single-digit ms.
+ * Caching that verdict took extraction offline for a whole health-check
+ * interval at a time (issue #2210), so a timeout leaves availability UNKNOWN —
+ * this call fails, the next one re-probes instead of reading a stale false.
+ *
+ * A backend that ANSWERED and said no is a real verdict and stays cached, or
+ * the daemon re-probes a known-bad endpoint on every request.
+ */
+export function resolveUnavailableVerdict(args: {
+  baseUrl: string;
+  sawAbortedProbe: boolean;
+  wasAvailable: boolean | null;
+}): { cacheVerdict: boolean; warning: string | null } {
+  if (args.sawAbortedProbe) {
+    return {
+      cacheVerdict: false,
+      warning:
+        `local LLM availability probe timed out at ${args.baseUrl} (event loop busy?); treating availability as ` +
+        "unknown and re-probing on the next request rather than marking the backend down",
+    };
+  }
+  return {
+    cacheVerdict: true,
+    // Surfaced at warn, not debug: extraction stops silently when this flips,
+    // and the daemon emits no debug at all unless configured for it.
+    warning: args.wasAvailable !== false ? `local LLM became unavailable at ${args.baseUrl}` : null,
+  };
+}
+
+export interface ProbeFetchResult {
+  ok: boolean;
+  data: unknown;
+  status: number | null;
+  /** The probe hit its own budget rather than getting an answer. */
+  aborted?: boolean;
+}
+
+/**
+ * One health-probe request.
+ *
+ * Every failure is logged with its cause: a transport error and a 404 both
+ * returned `ok: false` with nothing recorded, so an unreachable backend was
+ * indistinguishable from a wrong path and an availability failure had no
+ * diagnosable reason at all (§22, issue #2210).
+ */
+export async function probeFetch(
+  url: string,
+  options: { timeoutMs: number; headers: Record<string, string>; signal?: AbortSignal },
+): Promise<ProbeFetchResult> {
+  const controller = new AbortController();
+  const requestSignal = options.signal
+    ? AbortSignal.any([options.signal, controller.signal])
+    : controller.signal;
+  const timeout = setTimeout(() => controller.abort(), options.timeoutMs);
+  try {
+    const response = await fetch(url, { signal: requestSignal, headers: options.headers });
+    clearTimeout(timeout);
+    if (!response.ok) {
+      log.debug(`local LLM probe: ${url} returned HTTP ${response.status}`);
+      return { ok: false, data: null, status: response.status };
+    }
+    const contentType = response.headers.get("content-type");
+    const data = contentType?.includes("application/json") ? await response.json() : await response.text();
+    return { ok: true, data, status: response.status };
+  } catch (err) {
+    clearTimeout(timeout);
+    const aborted = isAbortError(err);
+    log.debug(
+      `local LLM probe: ${url} ${aborted ? `timed out after ${options.timeoutMs}ms` : "failed"}: ${describeFetchFailure(err)}`,
+    );
+    return { ok: false, data: null, status: null, aborted };
+  }
+}
+
+interface PendingProbe {
+  promise: Promise<boolean>;
+  controller: AbortController;
+  /** Callers still awaiting this sequence; at zero the sequence is aborted. */
+  waiters: number;
+}
+
+/**
+ * Collapses concurrent probe sequences onto one in-flight run.
+ *
+ * A timed-out availability probe deliberately caches nothing (issue #2210),
+ * which removed the false verdict that used to absorb concurrent callers:
+ * every queued request would then run its own full probe sequence, on a host
+ * already slow enough to blow the probe budget.
+ *
+ * Cancellation is refcounted rather than shared: one caller walking away must
+ * not abort a sequence the others are still waiting on, so the underlying task
+ * is aborted only once every waiter has gone.
+ */
+export class SingleFlightProbe {
+  private pending: PendingProbe | null = null;
+
+  run(task: (signal: AbortSignal) => Promise<boolean>, signal?: AbortSignal): Promise<boolean> {
+    let active = this.pending;
+    if (!active) {
+      const controller = new AbortController();
+      const created: PendingProbe = { promise: Promise.resolve(false), controller, waiters: 0 };
+      created.promise = task(controller.signal).finally(() => {
+        if (this.pending === created) this.pending = null;
+      });
+      this.pending = created;
+      active = created;
+    }
+    const entry = active;
+    entry.waiters += 1;
+    let released = false;
+    const release = () => {
+      if (released) return;
+      released = true;
+      entry.waiters -= 1;
+      if (entry.waiters > 0) return;
+      // Detach BEFORE aborting. `pending` would otherwise still point at this
+      // doomed entry until the task's own `finally` runs a microtask later, and
+      // a caller arriving in that window would join an aborted sequence and
+      // read its `false` as a verdict.
+      if (this.pending === entry) this.pending = null;
+      entry.controller.abort();
+    };
+    if (!signal) return entry.promise.finally(release);
+    return new Promise<boolean>((resolve, reject) => {
+      const onAbort = () => {
+        release();
+        resolve(false);
+      };
+      signal.addEventListener("abort", onAbort, { once: true });
+      entry.promise.then(
+        (value) => {
+          signal.removeEventListener("abort", onAbort);
+          release();
+          resolve(value);
+        },
+        (err: unknown) => {
+          signal.removeEventListener("abort", onAbort);
+          release();
+          reject(err instanceof Error ? err : new Error(String(err)));
+        },
+      );
+    });
+  }
+}

package/src/local-llm.ts

@@ -12,8 +12,12 @@ import {
   extractNonRecoverableBackendReason,
   extractNonRecoverableBackendReasonFromErrorText,
   isAbortError,
+  probeFetch,
+  resolveUnavailableVerdict,
+  type ProbeFetchResult,
   normalizeBackendTripReason,
   waitForRetryBackoff,
+  SingleFlightProbe,
 } from "./local-llm-helpers.js";
 
 /** Trim trailing slash characters without backtracking regex. */
@@ -256,6 +260,7 @@ export class LocalLlmClient {
   private config: PluginConfig;
   private isAvailable: boolean | null = null;
   private lastHealthCheck: number = 0;
+  private readonly availabilityProbe = new SingleFlightProbe();
   private detectedType: LocalLlmType | null = null;
   private cachedModelInfo: LocalModelInfo | null = null;
   private cachedLmsContext: number | null = null;
@@ -371,39 +376,20 @@ export class LocalLlmClient {
 
 
   /**
-   * Fetch with timeout for health checks
+   * Fetch with timeout for health checks. Body lives in the sibling helper so
+   * this file stays under its size ceiling (issue #1995).
    */
   private async fetchWithTimeout(
     url: string,
     timeoutMs: number = 2000,
     headers?: Record<string, string>,
     signal?: AbortSignal,
-  ): Promise<{ ok: boolean; data: unknown; status: number | null }> {
-    const controller = new AbortController();
-    const requestSignal = signal ? AbortSignal.any([signal, controller.signal]) : controller.signal;
-    const timeout = setTimeout(() => controller.abort(), timeoutMs);
-
-    try {
-      const response = await fetch(url, {
-        signal: requestSignal,
-        headers: this.buildRequestHeaders({ Accept: "application/json", ...(headers ?? {}) }),
-      });
-      clearTimeout(timeout);
-
-      if (!response.ok) {
-        return { ok: false, data: null, status: response.status };
-      }
-
-      const contentType = response.headers.get("content-type");
-      if (contentType?.includes("application/json")) {
-        return { ok: true, data: await response.json(), status: response.status };
-      } else {
-        return { ok: true, data: await response.text(), status: response.status };
-      }
-    } catch (err) {
-      clearTimeout(timeout);
-      return { ok: false, data: null, status: null };
-    }
+  ): Promise<ProbeFetchResult> {
+    return await probeFetch(url, {
+      timeoutMs,
+      headers: this.buildRequestHeaders({ Accept: "application/json", ...(headers ?? {}) }),
+      signal,
+    });
   }
 
   private async probeLmStudioNativeModels(
@@ -445,8 +431,11 @@ export class LocalLlmClient {
     if (this.isAvailable !== null && now - this.lastHealthCheck < LocalLlmClient.HEALTH_CHECK_INTERVAL_MS) {
       return this.isAvailable;
     }
+    return await this.availabilityProbe.run((probeSignal) => this.probeAvailability(probeSignal), signal);
+  }
 
-    // Normalize URL - replace localhost with 127.0.0.1, remove trailing slashes.
+  private async probeAvailability(signal?: AbortSignal): Promise<boolean> {
+    const now = Date.now();
     // Probe server-native endpoints from the server root even when users configure
     // the OpenAI-compatible `/v1` base URL for chat completions.
     const configuredBaseUrl = trimTrailingSlashes(
@@ -454,6 +443,10 @@ export class LocalLlmClient {
     );
     const probeBaseUrl = stripTrailingV1Path(configuredBaseUrl);
     let sawUnauthorizedProbe = false;
+    // A probe that TIMED OUT says the event loop was busy, not that the backend
+    // is down (issue #2210). Tracked separately so a loaded daemon cannot cache
+    // itself into a blackout.
+    let sawAbortedProbe = false;
 
     // Try to detect which server type is running
     if (signal?.aborted) return false;
@@ -462,6 +455,7 @@ export class LocalLlmClient {
       log.debug(`checking ${serverConfig.type} at ${healthUrl}`);
 
       const result = await this.fetchWithTimeout(healthUrl, 2000, undefined, signal);
+      if (result.aborted) sawAbortedProbe = true;
       if (signal?.aborted) return false;
       if (result.ok && serverConfig.detectFn(result.data)) {
         if (serverConfig.type === "mlx") {
@@ -481,6 +475,7 @@ export class LocalLlmClient {
         if (serverConfig.type === "llamacpp") {
           let sawLlamaCppSignal = false;
           const propsProbe = await this.fetchWithTimeout(`${probeBaseUrl}/props`, 2000, undefined, signal);
+          if (propsProbe.aborted) sawAbortedProbe = true;
           if (signal?.aborted) return false;
           if (propsProbe.ok && isLlamaCppPropsResponse(propsProbe.data)) {
             sawLlamaCppSignal = true;
@@ -491,6 +486,7 @@ export class LocalLlmClient {
 
           const modelsUrl = `${probeBaseUrl}${serverConfig.modelsEndpoint}`;
           const modelsProbe = await this.fetchWithTimeout(modelsUrl, 2000, undefined, signal);
+          if (modelsProbe.aborted) sawAbortedProbe = true;
           if (signal?.aborted) return false;
           if (modelsProbe.ok && isLlamaCppModelsResponse(modelsProbe.data)) {
             sawLlamaCppSignal = true;
@@ -523,6 +519,7 @@ export class LocalLlmClient {
     try {
       const modelsUrl = `${probeBaseUrl}/v1/models`;
       const result = await this.fetchWithTimeout(modelsUrl, 2000, undefined, signal);
+      if (result.aborted) sawAbortedProbe = true;
       if (signal?.aborted) return false;
       if (result.ok) {
         this.isAvailable = true;
@@ -538,14 +535,21 @@ export class LocalLlmClient {
       // Fall through to unavailable
     }
 
-    this.isAvailable = false;
+    const wasAvailable = this.isAvailable;
     this.detectedType = null;
-    this.lastHealthCheck = now;
     if (sawUnauthorizedProbe) {
       log.warn(
         `local LLM availability probe was unauthorized at ${configuredBaseUrl}; verify localLlmApiKey and localLlmAuthHeader settings`,
       );
     }
+    const verdict = resolveUnavailableVerdict({
+      baseUrl: configuredBaseUrl,
+      sawAbortedProbe,
+      wasAvailable,
+    });
+    this.isAvailable = verdict.cacheVerdict ? false : null;
+    this.lastHealthCheck = verdict.cacheVerdict ? now : 0;
+    if (verdict.warning) log.warn(verdict.warning);
     log.debug("local LLM not available at", configuredBaseUrl);
     return false;
   }

package/src/maintenance/memory-governance.ts

@@ -6,6 +6,7 @@ import type { MemoryFile, MemoryStatus } from "../types.js";
 import { RECALL_FALLBACK_DIRS } from "../utils/category-dir.js";
 import { bumpMemoryCorpusVersionForDir } from "../memory-corpus-version.js";
 import { assertPathInsideRoot } from "../utils/path-containment.js";
+import { requestEntityCanonicalIdReconcile } from "../storage/entity-canonical-id-references.js";
 
 export type MemoryGovernanceMode = "shadow" | "apply";
 export type MemoryGovernanceReasonCode =
@@ -1021,6 +1022,9 @@ export async function restoreMemoryGovernanceRun(
     // same-process or peer readAllMemories rescans mid-batch and never serves a
     // partially-restored corpus (Cursor Medium, #1902).
     bumpMemoryCorpusVersionForDir(options.memoryDir);
+    // Restored bytes predate the current migration journal and can carry
+    // legacy entity references (issue #2213) — request one reconcile pass.
+    await requestEntityCanonicalIdReconcile(path.join(options.memoryDir, "state"));
   }
 
   return {

package/src/page-versioning.ts

@@ -27,6 +27,10 @@ import {
 } from "node:fs/promises";
 import { ALL_CATEGORY_DIRS, RECALL_FALLBACK_DIRS } from "./utils/category-dir.js";
 import { bumpMemoryCorpusVersionForDir } from "./memory-corpus-version.js";
+import {
+  pathMayCarryEntityRefs,
+  requestEntityCanonicalIdReconcile,
+} from "./storage/entity-canonical-id-references.js";
 
 // ---------------------------------------------------------------------------
 // Public interfaces
@@ -342,9 +346,20 @@ export async function revertToVersion(
   // non-memory queue dirs (questions/). Use RECALL_FALLBACK_DIRS — a revert of a
   // questions/ page must NOT bump the recall corpus sentinel and force a rescan.
   const revertedTop = relPath(pagePath, resolvedMemoryDir).split(path.sep)[0];
-  if ((RECALL_FALLBACK_DIRS as readonly string[]).includes(revertedTop)) {
+  const inRecallTier = (RECALL_FALLBACK_DIRS as readonly string[]).includes(revertedTop);
+  if (inRecallTier) {
     bumpMemoryCorpusVersionForDir(resolvedMemoryDir);
   }
+  // A pre-migration snapshot can reintroduce a legacy entityRef — or, under
+  // entities/, a legacy relationship target rewriteRelationshipTargets had
+  // migrated — that the target's completed journal already renamed (issue
+  // #2213); the revert keeps the snapshot bytes faithful, so request one
+  // bounded reconcile pass instead. pathMayCarryEntityRefs is the migration's
+  // own scan scope (hot recall + cold + archive + entities), which is wider
+  // than the corpus bump above on purpose.
+  if (pathMayCarryEntityRefs(resolvedMemoryDir, pagePath)) {
+    await requestEntityCanonicalIdReconcile(path.join(resolvedMemoryDir, "state"));
+  }
   log.debug(`page-versioning: reverted ${pagePath} to version ${versionId}`);
 
   return version;

package/src/review/index.ts

@@ -9,6 +9,58 @@ import fs from "node:fs";
 import path from "node:path";
 import { getCategoryDir, ALL_CATEGORY_DIRS } from "../utils/category-dir.js";
 import { bumpMemoryCorpusVersionForDir } from "../memory-corpus-version.js";
+import {
+  HistoricalEntityCanonicalIdCache,
+  canonicalizeEntityRefFrontmatter,
+  repairContentAfterJournalMoveSync,
+} from "../storage/entity-canonical-id-references.js";
+
+// Write-boundary journal cache for review-queue promotions (issue #2213).
+const historicalIdCache = new HistoricalEntityCanonicalIdCache();
+
+/**
+ * In-place raw rewrite under the uniform write-boundary rule (issue #2213):
+ * canonicalize the effective entityRef at the write and REPAIR when the
+ * journal moved across it — these rewrites re-serialize whole records, so an
+ * unrelated approve/dismiss/flag must not write a legacy ref back out. On
+ * repair exhaustion the ORIGINAL bytes are restored before the retryable
+ * error propagates: performReview bumps the corpus sentinel only after the
+ * action returns, so a half-applied rewrite would be invisible to a warm
+ * cache while the caller is told the action failed.
+ */
+function writeReviewFileCanonicalized(memoryDir: string, filePath: string, content: string): void {
+  const stateDir = path.join(memoryDir, "state");
+  const idsAtWrite = historicalIdCache.get(stateDir);
+  let originalBytes: string | null = null;
+  try {
+    originalBytes = fs.readFileSync(filePath, "utf8");
+  } catch {
+    originalBytes = null; // new file — rollback is removal
+  }
+  const written = canonicalizeEntityRefFrontmatter(content, idsAtWrite);
+  fs.writeFileSync(filePath, written, "utf8");
+  try {
+    repairContentAfterJournalMoveSync({
+      stateDir,
+      cache: historicalIdCache,
+      idsAtWrite,
+      rawContent: content,
+      lastWritten: written,
+      rewrite: (next) => fs.writeFileSync(filePath, next, "utf8"),
+    });
+  } catch (err) {
+    try {
+      if (originalBytes === null) {
+        fs.unlinkSync(filePath);
+      } else {
+        fs.writeFileSync(filePath, originalBytes, "utf8");
+      }
+    } catch {
+      // Best effort — the retryable repair error is the primary signal.
+    }
+    throw err;
+  }
+}
 
 // ── Types ────────────────────────────────────────────────────────────────────
 
@@ -295,13 +347,16 @@ function approveItem(
   const fm = parseFrontmatter(content);
   if (!fm) return { itemId, action: "approve", message: "Could not parse frontmatter" };
 
-  // Issue #1579 — when approving a tombstone-blocked memory, fire the
-  // revocation hook so the content is re-allowed (append-only log: a
-  // `kind: "revocation"` entry supersedes the tombstone at lookup). Clear
-  // blockedBy/tombstoneBlockTier on the promoted memory so it is fully
-  // active. Fire-and-forget: a hook failure never fails the approval.
+  // Issue #1579 — approving a tombstone-blocked memory fires the revocation
+  // hook so the content is re-allowed (append-only log: a `kind: "revocation"`
+  // entry supersedes the tombstone at lookup). Deferred until the approval's
+  // writes commit (Codex P2, round 19): revoking before the promote left a
+  // failed repair with the non-resurrection guard already destroyed, letting
+  // a later extraction resurrect the content. Fire-and-forget once invoked:
+  // a hook failure never fails the approval.
   const blockedBy = typeof fm.blockedBy === "string" ? fm.blockedBy : null;
-  if (blockedBy && options.onApproveBlockedMemory) {
+  const fireBlockedRevocation = (): void => {
+    if (!blockedBy || !options.onApproveBlockedMemory) return;
     try {
       const maybe = options.onApproveBlockedMemory(blockedBy, itemId);
       if (maybe && typeof (maybe as Promise<void>).then === "function") {
@@ -310,7 +365,7 @@ function approveItem(
     } catch {
       /* fire-and-forget — never fail the approval (gotcha #13) */
     }
-  }
+  };
 
   const updatedContent = updateFrontmatterFields(content, {
     confidence: "0.9",
@@ -324,7 +379,8 @@ function approveItem(
   });
 
   if (found.location === "category") {
-    fs.writeFileSync(found.filePath, updatedContent, "utf8");
+    writeReviewFileCanonicalized(memoryDir, found.filePath, updatedContent);
+    fireBlockedRevocation();
     return {
       itemId,
       action: "approve",
@@ -342,10 +398,38 @@ function approveItem(
   const outputPath = path.join(targetDir, dateDir, path.basename(found.filePath));
 
   ensureSafeDirectory(rootReal, path.dirname(outputPath));
-  const promotedPath = writeFileWithoutClobber(outputPath, updatedContent, itemId);
+  // The suggestions/review queue dirs sit OUTSIDE the migration's reference
+  // scan, so a queued pre-migration item can still carry a legacy entityRef
+  // (issue #2213): promote it canonicalized against the target journal, and
+  // REPAIR when the journal moved across the write.
+  const reviewStateDir = path.join(memoryDir, "state");
+  const idsAtWrite = historicalIdCache.get(reviewStateDir);
+  const promotedWritten = canonicalizeEntityRefFrontmatter(updatedContent, idsAtWrite);
+  const promotedPath = writeFileWithoutClobber(outputPath, promotedWritten, itemId);
+  try {
+    repairContentAfterJournalMoveSync({
+      stateDir: reviewStateDir,
+      cache: historicalIdCache,
+      idsAtWrite,
+      rawContent: updatedContent,
+      lastWritten: promotedWritten,
+      rewrite: (next) => fs.writeFileSync(promotedPath, next, "utf8"),
+    });
+  } catch (err) {
+    // Roll back so a retried approve does not clobber-fail against a partial
+    // promotion; the queue entry survives untouched (Bugbot).
+    try {
+      fs.unlinkSync(promotedPath);
+    } catch {
+      // Best effort — the retryable repair error below is the primary signal.
+    }
+    throw err;
+  }
 
-  // Remove from review
+  // Remove from review, THEN revoke: the guard only falls once the approval
+  // has fully committed (promoted file repaired + queue entry gone).
   fs.unlinkSync(found.filePath);
+  fireBlockedRevocation();
 
   return {
     itemId,
@@ -372,13 +456,13 @@ function dismissItem(
   }
 
   const content = fs.readFileSync(found.filePath, "utf8");
-  fs.writeFileSync(
+  writeReviewFileCanonicalized(
+    memoryDir,
     found.filePath,
     updateFrontmatterFields(content, {
       reviewDismissed: "true",
       reviewDismissedAt: new Date().toISOString(),
     }),
-    "utf8",
   );
   return {
     itemId,
@@ -403,7 +487,7 @@ function flagItem(
     flagged: "true",
     flaggedAt: new Date().toISOString(),
   });
-  fs.writeFileSync(found.filePath, fixed);
+  writeReviewFileCanonicalized(memoryDir, found.filePath, fixed);
   return {
     itemId,
     action: "flag",