@@ -144,8 +144,22 @@ extension blocks, and text round-trips unchanged on every supported platform reg
 whether `wchar_t` is 16 bits (Windows) or 32 bits (Linux, macOS).
 
 Text that is not valid Unicode is rejected rather than silently altered: converting a
-`std::wstring` containing unpaired UTF-16 surrogates, or reading a column whose bytes are not
-well-formed UTF-8, throws `std::range_error`.
+`std::wstring` containing unpaired UTF-16 surrogates, or reading a TEXT value whose bytes are
+not well-formed UTF-8, throws `std::range_error`. A column holding a BLOB where a
+`MEMBER_TEXT` field is declared is skipped like a `NULL`, leaving the member untouched, so its
+bytes are never decoded.
+
+Note that a `std::wstring` still counts code *units*, not code points, so `size()` and indexing
+differ across platforms for text above U+FFFF: `L"\U0001F600".size()` is 2 where `wchar_t` is 16
+bits and 1 where it is 32 bits. What round-trips identically is the text itself.
+
+#### Reading databases written before this fix
+
+Earlier versions stored text above U+FFFF as CESU-8 when built where `wchar_t` is 16 bits
+(Windows), encoding each surrogate half separately. Reading such a value now throws
+`std::range_error` rather than returning it. Because the old encode and decode were wrong in the
+same way, that data appeared to round-trip on Windows and was written ill-formed to the file;
+databases written on Linux or macOS, and any text within the BMP, are unaffected.
 
 ### Nullable fields
 
 
@@ -46,13 +46,18 @@ namespace sqlite_reflection {
 /// overlong encodings, truncated sequences, stray or invalid lead and continuation bytes,
 /// surrogate code points encoded directly (CESU-8), unpaired UTF-16 surrogates, and anything
 /// above U+10FFFF.
-class REFLECTION_EXPORT Utf8 {
+///
+/// Note that rejecting CESU-8 means text written by a pre-fix build of this library, where
+/// wchar_t is 16 bits, no longer reads back. That data was stored ill-formed; because encoding
+/// and decoding were wrong in the same way it used to survive a round trip on Windows, so the
+/// break surfaces only now. See the text encoding section of README.md.
+class REFLECTION_EXPORT Unicode {
 public:
     /// Encodes Unicode code points as UTF-8
-    static std::string FromCodePoints(const char32_t* code_points, size_t count);
+    static std::string Utf8FromCodePoints(const char32_t* code_points, size_t count);
 
     /// Decodes UTF-8 into Unicode code points
-    static std::u32string ToCodePoints(const char* utf8_string, size_t byte_count);
+    static std::u32string CodePointsFromUtf8(const char* utf8_string, size_t byte_count);
 
     /// Encodes Unicode code points as UTF-16 code units, using a surrogate pair above U+FFFF
     static std::u16string Utf16FromCodePoints(const char32_t* code_points, size_t count);
 
@@ -24,61 +24,60 @@
 
 #include <numeric>
 
-#include "internal/utf8.h"
+#include "internal/unicode.h"
 
 using namespace sqlite_reflection;
 
 namespace {
+// Copies a string of code units into a string of a different unit type, one unit at a time. The
+// casts are value-preserving in the directions used below, except for a negative wchar_t on a
+// platform where it is signed, which widens to a value above U+10FFFF and is then rejected by
+// the validation in Unicode.
+template <typename To, typename From>
+To cast_each(const From& source) {
+    To result;
+    result.reserve(source.size());
+    for (size_t i = 0; i < source.size(); ++i) {
+        result.push_back(static_cast<typename To::value_type>(source[i]));
+    }
+    return result;
+}
+
 // wchar_t holds UTF-16 code units where it is 16 bits wide (Windows) and Unicode code points
 // where it is 32 bits wide (Linux, macOS). Selecting the path by width is what keeps text above
 // U+FFFF identical across platforms; a single facet cannot serve both, which is the defect this
-// replaced. See internal/utf8.h.
+// replaced. See internal/unicode.h.
 template <size_t WideCharSize>
 struct WideCodec;
 
 template <>
 struct WideCodec<2> {
     static std::u32string ToCodePoints(const std::wstring& wide_string) {
-        std::u16string code_units;
-        code_units.reserve(wide_string.size());
-        for (size_t i = 0; i < wide_string.size(); ++i) {
-            code_units.push_back(static_cast<char16_t>(wide_string[i]));
-        }
-        return Utf8::CodePointsFromUtf16(code_units.data(), code_units.size());
+        const auto code_units = cast_each<std::u16string>(wide_string);
+        return Unicode::CodePointsFromUtf16(code_units.data(), code_units.size());
     }
 
     static std::wstring FromCodePoints(const std::u32string& code_points) {
-        const auto code_units = Utf8::Utf16FromCodePoints(code_points.data(), code_points.size());
-        std::wstring wide_string;
-        wide_string.reserve(code_units.size());
-        for (size_t i = 0; i < code_units.size(); ++i) {
-            wide_string.push_back(static_cast<wchar_t>(code_units[i]));
-        }
-        return wide_string;
+        const auto code_units = Unicode::Utf16FromCodePoints(code_points.data(), code_points.size());
+        return cast_each<std::wstring>(code_units);
     }
 };
 
 template <>
 struct WideCodec<4> {
     static std::u32string ToCodePoints(const std::wstring& wide_string) {
-        std::u32string code_points;
-        code_points.reserve(wide_string.size());
-        for (size_t i = 0; i < wide_string.size(); ++i) {
-            code_points.push_back(static_cast<char32_t>(wide_string[i]));
-        }
-        return code_points;
+        return cast_each<std::u32string>(wide_string);
     }
 
     static std::wstring FromCodePoints(const std::u32string& code_points) {
-        std::wstring wide_string;
-        wide_string.reserve(code_points.size());
-        for (size_t i = 0; i < code_points.size(); ++i) {
-            wide_string.push_back(static_cast<wchar_t>(code_points[i]));
-        }
-        return wide_string;
+        return cast_each<std::wstring>(code_points);
     }
 };
 
+// Only the two widths above are implemented; without this the failure is an incomplete-type
+// error inside the typedef rather than a statement about portability.
+static_assert(sizeof(wchar_t) == 2 || sizeof(wchar_t) == 4, "sqlite_reflection supports wchar_t of 16 or 32 bits only");
+
 typedef WideCodec<sizeof(wchar_t)> PlatformWideCodec;
 }  // namespace
 
@@ -98,11 +97,11 @@ std::string StringUtilities::FromDouble(double value) {
 
 std::string StringUtilities::ToUtf8(const std::wstring& wide_string) {
     const auto code_points = PlatformWideCodec::ToCodePoints(wide_string);
-    return Utf8::FromCodePoints(code_points.data(), code_points.size());
+    return Unicode::Utf8FromCodePoints(code_points.data(), code_points.size());
 }
 
 std::wstring StringUtilities::FromUtf8(const char* utf8_string, size_t byte_count) {
-    const auto code_points = Utf8::ToCodePoints(utf8_string, byte_count);
+    const auto code_points = Unicode::CodePointsFromUtf8(utf8_string, byte_count);
     return PlatformWideCodec::FromCodePoints(code_points);
 }
 
 
@@ -20,39 +20,39 @@
 // OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 // SOFTWARE.
 
-#include "internal/utf8.h"
+#include "internal/unicode.h"
 
 #include <stdexcept>
 
 using namespace sqlite_reflection;
 
 namespace {
 const char32_t kMaxCodePoint = 0x10FFFF;
-const char32_t kFirstSurrogate = 0xD800;
-const char32_t kLastSurrogate = 0xDFFF;
 const char32_t kFirstSupplementary = 0x10000;
 
 const char16_t kFirstHighSurrogate = 0xD800;
 const char16_t kLastHighSurrogate = 0xDBFF;
 const char16_t kFirstLowSurrogate = 0xDC00;
 const char16_t kLastLowSurrogate = 0xDFFF;
 
-void reject(const char* reason) {
+[[noreturn]] void throw_invalid_unicode(const char* reason) {
     throw std::range_error(std::string("invalid Unicode input: ") + reason);
 }
 
+// The surrogate range is exactly the first high through the last low surrogate; the char16_t
+// operands widen to char32_t for the comparison.
 bool is_surrogate(char32_t code_point) {
-    return code_point >= kFirstSurrogate && code_point <= kLastSurrogate;
+    return code_point >= kFirstHighSurrogate && code_point <= kLastLowSurrogate;
 }
 
 // A code point that no valid encoding may carry: surrogates are reserved for UTF-16 pairing
 // and must never appear on their own, and nothing above U+10FFFF exists.
 void reject_if_not_scalar_value(char32_t code_point) {
     if (is_surrogate(code_point)) {
-        reject("surrogate code point");
+        throw_invalid_unicode("surrogate code point");
     }
     if (code_point > kMaxCodePoint) {
-        reject("code point above U+10FFFF");
+        throw_invalid_unicode("code point above U+10FFFF");
     }
 }
 
@@ -83,21 +83,23 @@ size_t sequence_length(unsigned char lead) {
 // code point above U+10FFFF. The lead byte alone cannot exclude these (Unicode Table 3-7).
 void reject_if_invalid_second_byte(unsigned char lead, unsigned char second) {
     if (lead == 0xE0 && second < 0xA0) {
-        reject("overlong three-byte sequence");
+        throw_invalid_unicode("overlong three-byte sequence");
     }
     if (lead == 0xED && second > 0x9F) {
-        reject("surrogate code point encoded in UTF-8");
+        throw_invalid_unicode(
+            "surrogate code point encoded in UTF-8 (CESU-8), as written by a pre-fix build of this "
+            "library where wchar_t is 16 bits");
     }
     if (lead == 0xF0 && second < 0x90) {
-        reject("overlong four-byte sequence");
+        throw_invalid_unicode("overlong four-byte sequence");
     }
     if (lead == 0xF4 && second > 0x8F) {
-        reject("code point above U+10FFFF");
+        throw_invalid_unicode("code point above U+10FFFF");
     }
 }
 }  // namespace
 
-std::string Utf8::FromCodePoints(const char32_t* code_points, size_t count) {
+std::string Unicode::Utf8FromCodePoints(const char32_t* code_points, size_t count) {
     std::string utf8_string;
     utf8_string.reserve(count);
 
@@ -125,7 +127,7 @@ std::string Utf8::FromCodePoints(const char32_t* code_points, size_t count) {
     return utf8_string;
 }
 
-std::u32string Utf8::ToCodePoints(const char* utf8_string, size_t byte_count) {
+std::u32string Unicode::CodePointsFromUtf8(const char* utf8_string, size_t byte_count) {
     std::u32string code_points;
     code_points.reserve(byte_count);
 
@@ -134,10 +136,10 @@ std::u32string Utf8::ToCodePoints(const char* utf8_string, size_t byte_count) {
         const auto lead = static_cast<unsigned char>(utf8_string[i]);
         const size_t length = sequence_length(lead);
         if (length == 0) {
-            reject("byte cannot start a UTF-8 sequence");
+            throw_invalid_unicode("byte cannot start a UTF-8 sequence");
         }
         if (i + length > byte_count) {
-            reject("truncated UTF-8 sequence");
+            throw_invalid_unicode("truncated UTF-8 sequence");
         }
 
         if (length == 1) {
@@ -148,7 +150,7 @@ std::u32string Utf8::ToCodePoints(const char* utf8_string, size_t byte_count) {
 
         const auto second = static_cast<unsigned char>(utf8_string[i + 1]);
         if (!is_continuation(second)) {
-            reject("missing UTF-8 continuation byte");
+            throw_invalid_unicode("missing UTF-8 continuation byte");
         }
         reject_if_invalid_second_byte(lead, second);
 
@@ -164,7 +166,7 @@ std::u32string Utf8::ToCodePoints(const char* utf8_string, size_t byte_count) {
         for (size_t j = 1; j < length; ++j) {
             const auto byte = static_cast<unsigned char>(utf8_string[i + j]);
             if (!is_continuation(byte)) {
-                reject("missing UTF-8 continuation byte");
+                throw_invalid_unicode("missing UTF-8 continuation byte");
             }
             code_point = (code_point << 6) | static_cast<char32_t>(byte & 0x3F);
         }
@@ -177,7 +179,7 @@ std::u32string Utf8::ToCodePoints(const char* utf8_string, size_t byte_count) {
     return code_points;
 }
 
-std::u16string Utf8::Utf16FromCodePoints(const char32_t* code_points, size_t count) {
+std::u16string Unicode::Utf16FromCodePoints(const char32_t* code_points, size_t count) {
     std::u16string utf16_string;
     utf16_string.reserve(count);
 
@@ -198,7 +200,7 @@ std::u16string Utf8::Utf16FromCodePoints(const char32_t* code_points, size_t cou
     return utf16_string;
 }
 
-std::u32string Utf8::CodePointsFromUtf16(const char16_t* utf16_string, size_t count) {
+std::u32string Unicode::CodePointsFromUtf16(const char16_t* utf16_string, size_t count) {
     std::u32string code_points;
     code_points.reserve(count);
 
@@ -207,7 +209,7 @@ std::u32string Utf8::CodePointsFromUtf16(const char16_t* utf16_string, size_t co
         const char16_t unit = utf16_string[i];
 
         if (unit >= kFirstLowSurrogate && unit <= kLastLowSurrogate) {
-            reject("unpaired low surrogate");
+            throw_invalid_unicode("unpaired low surrogate");
         }
 
         if (unit < kFirstHighSurrogate || unit > kLastHighSurrogate) {
@@ -217,12 +219,12 @@ std::u32string Utf8::CodePointsFromUtf16(const char16_t* utf16_string, size_t co
         }
 
         if (i + 1 >= count) {
-            reject("high surrogate at end of input");
+            throw_invalid_unicode("high surrogate at end of input");
         }
 
         const char16_t low = utf16_string[i + 1];
         if (low < kFirstLowSurrogate || low > kLastLowSurrogate) {
-            reject("high surrogate not followed by a low surrogate");
+            throw_invalid_unicode("high surrogate not followed by a low surrogate");
         }
 
         const char32_t high_bits = static_cast<char32_t>(unit - kFirstHighSurrogate) << 10;