Address review comments

index.bs

@@ -3195,8 +3195,8 @@ associated with or [=scoped=] to, respectively.
         When [=clients=], [=client platforms=], or [=authenticators=] display a {{PublicKeyCredentialEntity/name}}'s value, they should always use UI elements to provide a clear boundary around the displayed value, and not allow overflow into other elements [[css-overflow-3]].
 
         When storing a {{PublicKeyCredentialEntity/name}} member's value,
-        [=authenticators=] MUST support any value whose length in the UTF-8 character encoding is 64 bytes or less.
-        Authenticators MAY truncate the value as described in [[#sctn-strings-truncation]].
+        [=authenticators=] MAY truncate the value as described in [[#sctn-strings-truncation]]
+        using a size limit greater than or equal to 64 bytes.
 </div>
 
 
@@ -3268,8 +3268,8 @@ credential.
         When [=clients=], [=client platforms=], or [=authenticators=] display a {{PublicKeyCredentialUserEntity/displayName}}'s value, they should always use UI elements to provide a clear boundary around the displayed value, and not allow overflow into other elements [[css-overflow-3]].
 
         When storing a {{PublicKeyCredentialUserEntity/displayName}} member's value,
-        [=authenticators=] MUST support any value whose length in the UTF-8 character encoding is 64 bytes or less.
-        Authenticators MAY truncate the value as described in [[#sctn-strings-truncation]].
+        [=authenticators=] MAY truncate the value as described in [[#sctn-strings-truncation]]
+        using a size limit greater than or equal to 64 bytes.
 </div>
 
 
@@ -4922,7 +4922,13 @@ Authenticators may be required to store arbitrary strings chosen by a [=[RP]=],
 
 ### String Truncation ### {#sctn-strings-truncation}
 
-Each arbitrary string in the API will have some accommodation for the potentially limited resources available to an [=authenticator=]. If string value truncation is the chosen accommodation then authenticators MAY truncate in order to make the string fit within a length equal to or greater than the specified minimum supported length. Such truncation SHOULD also respect UTF-8 sequence boundaries or [=grapheme cluster=] boundaries [[UAX29]]. This defines the maximum truncation permitted and authenticators MUST NOT truncate further.
+Each arbitrary string in the API will have some accommodation for the potentially limited resources available to an [=authenticator=].
+If string truncation is the chosen accommodation,
+then the authenticator MAY choose a size limit equal to or greater than the specified minimum supported length
+and truncate the string to fit within that limit.
+Such truncation SHOULD also respect UTF-8 code point boundaries or [=grapheme cluster=] boundaries [[UAX29]].
+The resulting truncated value MAY be shorter than the chosen size limit
+but MUST NOT be shorter than the longest prefix substring that satisfies the size limit and ends on a [=grapheme cluster=] boundary.
 
 For example, in <a href="#fig-stringTruncation">figure <span class="figure-num-following"></span></a> the string is 65 bytes long. If truncating to 64 bytes then the final 0x88 byte must be removed purely because of space reasons. Since that leaves a partial UTF-8 sequence the remainder of that sequence may also be removed. Since that leaves a partial [=grapheme cluster=] an authenticator may remove the remainder of that cluster.