Best possible solution:

Keep the helper substitution, but route plugin code through openclaw/plugin-sdk/text-utility-runtime, preserve package dependency contracts, and add redacted real behavior proof for at least one changed runtime path before merge.

Do we have a high-confidence way to reproduce the issue?

Yes, source-reproducible: current main uses raw slice at the touched truncation boundaries, so placing an emoji surrogate pair across those caps can produce a dangling surrogate. I did not run a live OpenClaw/Codex/Telegram/TUI scenario in this read-only review.

Is this the best way to solve the issue?

No as submitted: using the UTF-16-safe helper is the right implementation shape, but plugin production code should use the existing plugin SDK facade instead of importing the private normalization package directly.

Full review comments:

• [P1] Use the plugin SDK helper in Codex plugin code — extensions/codex/src/app-server/context-engine-projection.ts:1
  This file is part of the published @openclaw/codex plugin, whose package metadata does not declare or bundle @openclaw/normalization-core, and that package is private. Importing it directly can make the installed plugin fail to resolve the helper; use openclaw/plugin-sdk/text-utility-runtime, which already exports truncateUtf16Safe, and apply the same facade pattern to the Telegram plugin import.
  Confidence: 0.91
• [P2] Keep Telegram on the plugin SDK helper surface — extensions/telegram/src/bot-core.ts:1
  Telegram plugin production code is under the same extension boundary, and nearby raw-update-log.ts already imports truncateUtf16Safe from openclaw/plugin-sdk/text-utility-runtime. This new private workspace-package import creates a second dependency path for the same helper and should use the facade instead.
  Confidence: 0.86

Overall correctness: patch is incorrect
Overall confidence: 0.84

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 6433b8272350.

Label changes:

• add P2: This is a bounded text-corruption bug fix with limited blast radius, but the submitted PR needs package-boundary repair and proof before merge.
• add merge-risk: 🚨 compatibility: The PR can break installed or upgraded plugin packages by adding private workspace-package imports that the plugin package metadata does not satisfy.
• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🦪 silver shellfish and patch quality is 🧂 unranked krab.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: Only test/CI-style evidence is visible; the contributor should add redacted terminal output, copied live output, logs, or a recording showing an after-fix changed runtime path, then update the PR body for re-review.

Label justifications:

• P2: This is a bounded text-corruption bug fix with limited blast radius, but the submitted PR needs package-boundary repair and proof before merge.
• merge-risk: 🚨 compatibility: The PR can break installed or upgraded plugin packages by adding private workspace-package imports that the plugin package metadata does not satisfy.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🦪 silver shellfish and patch quality is 🧂 unranked krab.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: Only test/CI-style evidence is visible; the contributor should add redacted terminal output, copied live output, logs, or a recording showing an after-fix changed runtime path, then update the PR body for re-review.

PR surface:

Source +10, Tests +31. Total +41 across 6 files.

What I checked:

• PR adds private package imports in plugin production files: The patch adds @openclaw/normalization-core/utf16-slice imports to extensions/codex/src/app-server/context-engine-projection.ts and extensions/telegram/src/bot-core.ts. (extensions/codex/src/app-server/context-engine-projection.ts:1, d7104bdbf4ba)
• Extension boundary requires plugin SDK imports and package-owned runtime deps: Scoped policy says extension production code should import through openclaw/plugin-sdk/*, and plugin runtime dependencies belong in the owning plugin package. (extensions/AGENTS.md:27, 6433b8272350)
• Codex package cannot satisfy the new private import as published: @openclaw/codex lists runtime dependencies but not @openclaw/normalization-core, and its release metadata publishes to npm with bundleRuntimeDependencies: false. (extensions/codex/package.json:10, 6433b8272350)
• Normalization core is a private workspace package: The direct import target is marked private: true, so plugin production code should not depend on it as an installed external package dependency. (packages/normalization-core/package.json:2, 6433b8272350)
• Public plugin SDK facade already exports the required helpers: openclaw/plugin-sdk/text-utility-runtime exports both sliceUtf16Safe and truncateUtf16Safe; existing Codex and Telegram sibling code already uses this facade. (src/plugin-sdk/text-utility-runtime.ts:21, 6433b8272350)
• Current main source supports the reported bug class: Current main still uses raw slice in the touched Codex projection, Telegram raw-log preview, CLI session-history, and TUI local-shell truncation sites, so the surrogate-boundary issue is source-reproducible. (extensions/codex/src/app-server/context-engine-projection.ts:487, 6433b8272350)

Likely related people:

• steipete: Recent maintainer verification and merge comments on adjacent UTF-16 truncation fixes established the helper/facade pattern and proof expectations for Codex/Gateway display paths. (role: recent reviewer and merger; confidence: high; commits: c2cc50c9a07a, 8c608ae67485; files: extensions/codex/src/app-server/approval-bridge.ts, packages/normalization-core/src/utf16-slice.ts, src/plugin-sdk/text-utility-runtime.ts)
• lsr911: Current-main blame and related PR history show recent work across the same UTF-16-safe truncation helper rollout, including the overlapping Telegram raw-update-log PR. (role: recent adjacent UTF-16 truncation contributor; confidence: medium; commits: 8c608ae67485, 96a77fd057f1; files: extensions/telegram/src/bot-core.ts, packages/normalization-core/src/utf16-slice.ts)
• xialonglee: Merged Codex app-server UTF-16 truncation work in the same plugin area used the plugin SDK text helper facade and is relevant to the Codex-side import pattern. (role: adjacent Codex plugin contributor; confidence: medium; commits: c2cc50c9a07a, 96c885e4aabd; files: extensions/codex/src/app-server/approval-bridge.ts, extensions/codex/src/app-server/elicitation-bridge.ts)

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.