Let's see... that message is built via: $context->msg( $descMsg, $descParams )->parseAsBlock(), with the page name link inside the message coming from {{SUBJECTPAGENAME}}. It's then passed into Html::rawElement which shouldn't be escaping anything (note: the links are fine), so the value of SUBJECTPAGENAME is presumably already over-escaped by this point.

This could be interacting in unexpected ways, because I'm fairly sure there's no way to wind up with markup in SUBJECTPAGENAME on a normal wiki -- DISPLAYTITLE is the normal method used to get markup into page titles, and it won't be used for SUBJECTPAGENAME.

@Tgr Do you know where abstract wikipedia is doing its override for the value of SUBJECTPAGENAME? I'm curious to see what the message is actually working with here.

(Things are being inconsistent in general on wikifunctions.org about page names -- note that the page title on the talk page is just Talk:Z10599 whereas it uses the whole Function: random integer in range Z10599 display on the main view...)

The extra markup is actually coming from the link syntax itself [[…]], not from SUBJECTPAGENAME, and the override is implemented here: https://gerrit.wikimedia.org/g/mediawiki/extensions/WikiLambda/+/26dfabea7870fb892adecf7002c9b310aa7fc6c0/includes/HookHandler/PageRenderingHandler.php#182

(For reference for anyone else wanting to debug this, the DiscussionTools code displaying the message is here: https://gerrit.wikimedia.org/g/mediawiki/extensions/DiscussionTools/+/3209cf8f1837629be042d5a7d7d145a4e17cbff8/includes/Hooks/PageHooks.php#510)

I don't know how it ends up double-escaped. Both the WikiLambda code and the DiscussionTools code look correct to me at a glance, and the override for link labels works correctly in other scenarios (e.g. this API request: https://www.wikifunctions.org/wiki/Special:ApiSandbox#action=parse&format=json&title=Talk%3AZ10599&text=[[%3A{{SUBJECTPAGENAME}}]]%0A%0A{{SUBJECTPAGENAME}}&prop=text&disablelimitreport=1&formatversion=2).

Thank you!