Best possible solution:

Land one narrow branch, this PR or #102607, after redacted Mattermost slash-command or runtime-log proof demonstrates surrogate-boundary truncation; close the other as duplicate after a proof-positive branch is selected or merged.

Do we have a high-confidence way to reproduce the issue?

Yes from source inspection: current main slices sanitized Mattermost slash-command strings at fixed UTF-16 code-unit lengths, so a surrogate pair crossing the 300 or 200 boundary can be split. I did not establish a live Mattermost reproduction.

Is this the best way to solve the issue?

Yes for the code shape: using the existing plugin SDK text helper at the final truncation step is the narrowest maintainable fix and preserves sanitizer ordering and limits. The remaining gap is proof, not a better implementation layer.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against c067802cda3a.

Label changes:

• add P3: This is a low-blast-radius Mattermost diagnostics/log correctness fix with no evidence of a user-blocking workflow.
• add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body has rationale only; it does not include after-fix Mattermost slash-command or runtime-log proof from a real setup, terminal/live output, recording, or redacted logs. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

• P3: This is a low-blast-radius Mattermost diagnostics/log correctness fix with no evidence of a user-blocking workflow.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body has rationale only; it does not include after-fix Mattermost slash-command or runtime-log proof from a real setup, terminal/live output, recording, or redacted logs. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

PR surface:

Source +3. Total +3 across 1 file.

What I checked:

• Current main behavior: Current main still truncates sanitized Mattermost slash-command lookup errors and log values with .slice(0, 300) and .slice(0, 200), so a surrogate pair crossing either limit can be split. (extensions/mattermost/src/mattermost/slash-http.ts:169, c067802cda3a)
• Affected runtime path: The sanitizer output feeds slash-command validation fallback logs, channel lookup failure logs, command handler errors, and slash reply failure logs. (extensions/mattermost/src/mattermost/slash-http.ts:349, c067802cda3a)
• Proposed patch shape: The PR preserves the redaction pipeline and existing 300/200 limits while replacing only the final truncation calls with truncateUtf16Safe. (extensions/mattermost/src/mattermost/slash-http.ts:143, 87dc33e30b0b)
• Helper contract: truncateUtf16Safe floors the limit and delegates to sliceUtf16Safe, which backs away from dangling surrogate halves at slice boundaries. (packages/normalization-core/src/utf16-slice.ts:44, c067802cda3a)
• Helper coverage: Existing normalization-core tests cover normal truncation and surrogate-pair boundary behavior for truncateUtf16Safe. (packages/normalization-core/src/utf16-slice.test.ts:56, c067802cda3a)
• Related duplicate candidate: fix(mattermost): keep slash command error truncation UTF-16 safe #102607 has the same one-file patch but is also labeled and reviewed as needing real behavior proof, so it is not a proof-positive canonical replacement yet. (extensions/mattermost/src/mattermost/slash-http.ts:143, 68b5c8affcec)

Likely related people:

• eleqtrizit: GitHub commit history shows the Mattermost slash callback validation work that added the sanitizer and slash validation log paths now being changed. (role: introduced behavior; confidence: high; commits: 9c0975c1c20e; files: extensions/mattermost/src/mattermost/slash-http.ts, extensions/mattermost/src/mattermost/slash-http.test.ts)
• steipete: Recent history shows multiple Mattermost slash-http and normalization-core maintenance commits, including slash validation cache hardening and UTF-16 helper package work. (role: recent area contributor; confidence: high; commits: 20fbb8bd149b, 2f33554ed4f8, b22c36f1125c; files: extensions/mattermost/src/mattermost/slash-http.ts, extensions/mattermost/src/mattermost/slash-http.test.ts, packages/normalization-core/src/utf16-slice.ts)
• mukhtharcm: CONTRIBUTING.md lists Mattermost as this person's area, making them a relevant routing candidate even though sampled line history points to other recent contributors. (role: listed area owner; confidence: medium; files: CONTRIBUTING.md, extensions/mattermost/src/mattermost/slash-http.ts)
• hugenshen: Authored the recently merged adjacent Mattermost UTF-16 truncation fix for inbound previews, which shares the same invariant but not this slash-http call site. (role: adjacent contributor; confidence: medium; commits: 1fb6e2890217; files: extensions/mattermost/src/mattermost/monitor.ts, extensions/mattermost/src/mattermost/monitor.inbound-system-event.test.ts)

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.