[iliaal]

Summary

• Check exact closing-delimiter bytes after validating UTF-8, instead of extracting a multibyte substring for every candidate token.
• Preserve mbstring substitution behavior for malformed strings passed directly to NicknameMapper with a legacy fallback.
• Cover ASCII, multi-character, Unicode, combining-mark, orphan-quote, punctuation and malformed-input cases.

Measured benefit

A focused PHP 8.4.26 benchmark mapping an unmatched quote followed by a 16 KiB Unicode token 1,000 times took 30–31 ms before and 6–14 ms after across five paired runs. This measures the closer scan workload, not general parser throughput.

Validation

• PHPUnit: 1,203 tests / 3,125 assertions passed with a 256 MiB limit.
• PHPStan level 9 and PHP 8.5 compatibility analysis passed.
• PHP CS Fixer dry run, 69 syntax checks, Composer audit, baseline/README/deprecation guards and diff checks passed.
• Independent differential review: 25,000 valid-input cases, then 90,000 arbitrary-byte cases with six mbstring substitution settings; no remaining differences.
• All 84 remote file entries (paths, modes and blob hashes) match the tested local tree. Tree: 2f9d3a9518d5e3f868b9ba7fc1595c79f0692998.

Exact-head CI passed all five jobs: PHP 8.3 / 8.4 / 8.5 tests (including Composer audit), static analysis (including the PHP 8.5 compatibility gate), and code style. No jobs or steps were skipped.