functionalscript · sergey-shandar · Aug 14, 2026 · Aug 13, 2026 · Aug 13, 2026 · Aug 13, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -20,6 +20,13 @@ history.
 
 ## Unreleased
 
+- `text/utf16`: `u16` now rejects non-integers, so a fractional word is
+  reported invalid (`0xFFFFFFFF`) instead of being misclassified by the
+  surrogate/BMP range checks — which only partition the integers in
+  `0x0000`–`0xFFFF`. That closes the only path into
+  `utf16ByteToCodePointOp`'s trailing fallback arm, which is removed along
+  with its `isHighSurrogate` recheck
+  [#1540](https://github.com/functionalscript/functionalscript/pull/1540)
 - `media/json/parser`: `endArray`/`endObject` no longer branch on `state.top`
   and `tokenToValue` drops its defensive default arm — the parser's state
   machine already guarantees these invariants, so the dead branches are gone

diff --git a/fjs/text/utf16/module.f.mjs b/fjs/text/utf16/module.f.mjs
@@ -120,6 +120,8 @@ const codePointToUtf16 = codePoint => {
 export const fromCodePointList
     = flatMap(codePointToUtf16)
 
+const isInU16Range = contains(0x0000, 0xFFFF)
+
 /**
  * Validates whether a given 16-bit unsigned integer (U16) falls within the valid range for UTF-16 code units.
  *
@@ -135,9 +137,14 @@ export const fromCodePointList
  * const edgeCaseHigh = u16(0xFFFF)  // true: Maximum valid value for UTF-16
  * ```
  *
+ * `U16` is just `number`, so this also rejects non-integers — `isBmpCodePoint`,
+ * `isHighSurrogate`, and `isLowSurrogate` only partition the *integers* in
+ * `0x0000`–`0xFFFF` with no gap; a fractional value would fall between two of
+ * those ranges and be misclassified downstream if it were let through here.
+ *
  * @type {(i: U16) => boolean}
  */
-const u16 = contains(0x0000, 0xFFFF)
+const u16 = i => Number.isInteger(i) && isInU16Range(i)
 
 
 /**
@@ -191,9 +198,11 @@ const utf16ByteToCodePointOp = (word, state) => {
         const low = word - 0xdc00
         return [[(high << 10) + low + 0x10000], null]
     }
+    // `isLowSurrogate`, `isBmpCodePoint`, and `isHighSurrogate` partition the
+    // full `u16` range with no gap, and `isLowSurrogate` was already ruled out
+    // above, so a non-BMP `word` here is always a high surrogate.
     if (isBmpCodePoint(word)) { return [[state | errorMask, word], null] }
-    if (isHighSurrogate(word)) { return [[state | errorMask], word] }
-    return [[state | errorMask, word | errorMask], null]
+    return [[state | errorMask], word]
 }
 
 

diff --git a/fjs/text/utf16/proof.f.mjs b/fjs/text/utf16/proof.f.mjs
@@ -51,6 +51,21 @@ export const proof = {
         () => {
             const result = stringify(toArray(toCodePointList([56320, 0])))
             assertEq(result, '[-2147427328,0]')
+        },
+        // `U16` is just `number`, so a non-integer in [0x0000, 0xFFFF] is a
+        // possible (if malformed) input. It must be rejected as invalid, not
+        // misclassified by the surrogate/BMP range checks, which only
+        // partition the integers in that range.
+        () => {
+            const result = stringify(toArray(toCodePointList([56319.5])))
+            assertEq(result, '[4294967295]')
+        },
+        // A non-integer word doesn't disturb a pending high surrogate: it is
+        // reported invalid on its own, and the surrogate is still flagged
+        // unpaired at EOF.
+        () => {
+            const result = stringify(toArray(toCodePointList([55296, 56319.5])))
+            assertEq(result, '[4294967295,-2147428352]')
         }
     ],
     fromCodePointList: [

diff --git a/fjs/text/utf16/todo/unreachable-pending-state-fallthrough.md b/fjs/text/utf16/todo/unreachable-pending-state-fallthrough.md