Best possible solution:

Use the shared UTF-16-safe truncator for this config-get diagnostic path and add redacted real terminal/log proof showing a long emoji-containing value truncates without a dangling surrogate.

Do we have a high-confidence way to reproduce the issue?

Yes, source-level. Current main slices rendered config-get output at a fixed UTF-16 code-unit boundary, so a JSON-rendered value with an emoji high surrogate at the cutoff can produce a dangling surrogate; I did not execute a live run in this read-only review.

Is this the best way to solve the issue?

Yes for the production code. Reusing the existing shared UTF-16 truncator is the narrow maintainable fix for this output path; the remaining gap is proof, not a different implementation layer.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 3ccf2a07393e.

Label changes:

• add P2: This is a normal-priority diagnostic-output correctness fix with limited blast radius to Crestodian config reads.
• add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: No after-fix real behavior proof is present; a redacted terminal transcript, copied live output, or logs from a Crestodian/config-get run would satisfy this gate if private paths, tokens, endpoints, and other sensitive details are redacted. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

• P2: This is a normal-priority diagnostic-output correctness fix with limited blast radius to Crestodian config reads.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: No after-fix real behavior proof is present; a redacted terminal transcript, copied live output, or logs from a Crestodian/config-get run would satisfy this gate if private paths, tokens, endpoints, and other sensitive details are redacted. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

PR surface:

Source +1. Total +1 across 1 file.

What I checked:

• Current main behavior: Current main still truncates rendered config-get output with a raw slice(0, CONFIG_GET_OUTPUT_MAX_CHARS), which can leave a dangling UTF-16 surrogate when an emoji crosses the boundary. (src/crestodian/operations.ts:965, 3ccf2a07393e)
• PR patch behavior: The PR head changes only that truncation call to truncateUtf16Safe(rendered, CONFIG_GET_OUTPUT_MAX_CHARS) and adds the corresponding import. (src/crestodian/operations.ts:966, fd4098360b9d)
• Helper contract: truncateUtf16Safe floors the limit and delegates to sliceUtf16Safe, which adjusts bounds to avoid returning dangling surrogate halves. (packages/normalization-core/src/utf16-slice.ts:43, 3ccf2a07393e)
• Helper tests: The shared UTF-16 helper already has tests for truncation, zero/negative limits, and surrogate-pair boundaries. (packages/normalization-core/src/utf16-slice.test.ts:56, 3ccf2a07393e)
• Import subpath contract: The @openclaw/normalization-core/utf16-slice subpath is exported by the workspace package, so the proposed direct import is supported. (packages/normalization-core/package.json:47, 3ccf2a07393e)
• Runtime entry points: Crestodian chat, TUI handoff, and the ring-zero crestodian tool all route parsed operations into executeCrestodianOperation, so this config-get output path is user-reachable through Crestodian. (src/agents/tools/crestodian-tool.ts:381, 3ccf2a07393e)

Likely related people:

• steipete: Authored and merged the large Crestodian conversational onboarding work that added config get/schema read operations to the ring-zero setup flow and repeatedly touched src/crestodian/operations.ts. (role: feature owner and recent area contributor; confidence: high; commits: 4c588811f312, ecb9090ec43a; files: src/crestodian/operations.ts, src/crestodian/chat-engine.ts, src/agents/tools/crestodian-tool.ts)
• fuller-stack-dev: Authored the merged providerless Crestodian model-setup work that recently modified src/crestodian/operations.ts and adjacent Crestodian setup paths. (role: recent adjacent contributor; confidence: medium; commits: 2520edab4ce1; files: src/crestodian/operations.ts, src/crestodian/chat-engine.ts, src/agents/tools/crestodian-tool.ts)

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.