diff --git a/quest/m3/ts-unsafe.md b/quest/m3/ts-unsafe.md
index 251fa6095..97782afdb 100644
--- a/quest/m3/ts-unsafe.md
+++ b/quest/m3/ts-unsafe.md
@@ -56,6 +56,10 @@ none of its own `unsafe`.
   by buffer and byte offset closes it.
 - `UnsafeCell::raw_get`, `from_mut`, and `replace`, refused with their span: none is in
   moq's census at the pin.
+- A byte pointer moved past its own `Uint8Array` view into the rest of the buffer, such as
+  a byte vector's spare capacity: it fails loudly at run time, since each view knows only
+  its own range. One shared view per buffer, with each pointer's byte offset into it,
+  closes it. Found by [#455](https://github.com/moq-dev/rust2/pull/455).
 - A slice's pointer cast to an array's of its length, `*(s as *const [u8] as *const
   [u8; N])`, which `bytes`' `Buf::get_u16` and wider read a crate's own buffer through
   ([#222](https://github.com/moq-dev/rust2/pull/222)): the bytes keep their type, so