feat(ts): translate a raw pointer behind a reference

quest/m2/ts-model/README.md

@@ -33,23 +33,23 @@ Decided with the maintainer on 2026-10-27, from a census of the model's 22 publi
   the translator is specific to moq: dependencies follow general rules, and moq's own
   changes (to its `unsafe` and its address keys, dropping or binding `hashlink`, `slab`, and
   `smallvec`) are one research-tier quest in moq's tree.
-- A dependency containing `unsafe` is bound by the consumer until
-  [unsafe code the translator can model](/quest/m3/ts-unsafe/README.md) translates it: decided
+- A dependency containing `unsafe` is bound by the consumer unless it uses only the
+  `unsafe` [m3's unsafe policy](/quest/m3/README.md) translates: decided
   with the maintainer on 2026-10-27, a stock crate translates with no annotations or config.
   Only true platform boundaries (clocks and DEFLATE) stay bound.
 - Each child measures this target by the census of `ts/moq/model.toml`, rooted at those
   types with the boundaries bound, which nightly reports beside the whole crate.
 - The end-to-end work stays here: the model's roots, its differential harness, and the
   `frames.ts` workload. moq writes the binding files `model.toml` names, in its own tree.
 
-The census at the pin on 2026-11-07: 51 refusals. `Timestamp` alone refuses nothing, and
+The census at the pin on 2026-11-07: 45 refusals. `Timestamp` alone refuses nothing, and
 the [model fixture](/ts/README.md#tests)'s harness runs it against native moq-net at the
 pin; each case it adds as a type translates. Every other root reaches the rest of the
 model, all of it moq's, for its research quest: kio's `log.rs` reads bytes as its segments
 and retires them through crossbeam-epoch, whose tagged pointers and inline closures (36
 refusals) translation refuses for good, and smallvec's union over a type parameter and
-raw parts (10) wait on [unsafe](/quest/m3/ts-unsafe/README.md), so moq rewrites or drops
-them, as it does the `unsafe` slice of `model/frame.rs`'s `Filled`.
+raw parts (4) stay refused under [m3's unsafe policy](/quest/m3/README.md), so moq
+rewrites or drops them, as it does the `unsafe` slice of `model/frame.rs`'s `Filled`.
 
 Decided with the maintainer on 2026-11-04, from a census at the bumped pin
 (moq-dev/rust2#390): the refusals no quest owned became child quests, since finished.
@@ -71,6 +71,6 @@ or pointers whose comparison disagreed with Rust after an address was reused:
   addresses (`model/cache.rs`, `model/frame.rs`).
 - ✅ moq gives its `unsafe` no `cfg(rust2_ts)` twins; it decides per item, when its quest
   starts, whether to rewrite one in safe Rust for both builds or wait for this translator.
-  Rejected: twins until [unsafe](/quest/m3/ts-unsafe/README.md) translates them.
+  Rejected: twins until rust2-ts translates them, which [m3's unsafe policy](/quest/m3/README.md) mostly refuses.
 
 Public API: the translator's output for moq-net's model.

quest/m3/README.md

@@ -42,7 +42,6 @@ memory model for values whose address is reinterpreted, without a consumer.
 
 - [Retrial Cranelift on moq's tests](/quest/m3/cranelift-unwind.md) - waits on upstream: moq's tests pass under Cranelift, so its CI can weigh it again
 - [Relink without rebuilding](/quest/m3/relink.md) - measure upstream's skip of dependency-only rebuilds on moq's edits once it reaches nightly
-- [Unsafe code the translator can model](/quest/m3/ts-unsafe/README.md) - a dependency using only `unsafe` the translator can model translates from source
 - [Waiting: drop the lang fixture's mul_add allowance](/quest/m3/ts-fma-allowance.md) - the differential fails on any `mul_add` difference again once wasm32's `fma` rounds exactly
 - [Waiting: type-check in process with tsrs](/quest/m3/ts-tsrs.md) - rust2-ts checks bindings through tsrs instead of `tsc` once it is a stable library
 - [Throw only where Rust panics](/quest/m3/ts-runtime-throws.md) - no runtime `rust2-ts:` error where native Rust goes on: exact, or refused at translation

quest/m3/ts-runtime-throws.md

@@ -23,6 +23,9 @@ only because translation can't see where a pointer came from:
   `AtIndex.reach`, raw slices of a field's byte, and `Bytes::slice_ref` of copied bytes,
   safe code with no exact answer while a `&str` stays a JS string. AGENTS.md allows the
   unsafe ones under m3's [unsafe policy](/quest/m3/README.md).
+  Two pointers made from one reference, one through a branch or loop, may each be in
+  an array of one of its own; keep the loud check rather than trace joins (decided
+  2026-11-07 in [#621](https://github.com/moq-dev/rust2/pull/621)).
 - Rejected: refusing all of them at translation, which refuses pointer arithmetic on any
   pointer parameter; keeping all as run-time checks.
 
@@ -52,7 +55,3 @@ What remains:
   follow-ups).
 
 Public API: the translator's output, and which crates translate.
-
-## Related
-
-- [Unsafe code the translator can model](/quest/m3/ts-unsafe/README.md) - the raw-pointer model several of these throws guard; its 2026-11-01 run-time failures now follow this quest's rule