diff --git a/quest/m3/README.md b/quest/m3/README.md
index 87166203b..a36212d1c 100644
--- a/quest/m3/README.md
+++ b/quest/m3/README.md
@@ -27,3 +27,5 @@ generic std gap is planned here even when moq never calls it.
 - [Buf on a deque of bytes](/quest/m3/ts-vecdeque-buf.md) - `bytes`' `Buf` for a deque of bytes translates
 - [std's panic messages hold std's capacity](/quest/m3/ts-panic-payload-capacity.md) - a hook reads native's `String` capacity from std's own formatted panics
 - [Browser APIs through wasm-bindgen](/quest/m3/ts-wasm-bindgen/README.md) - web-sys and js-sys imports become direct JS calls, so idiomatic crates such as web-rs's web-codecs translate as stock crates
+- [BufMut on a byte slice](/quest/m3/ts-bufmut-slices.md) - `bytes`' `BufMut` for `&mut [u8]` and `&mut [MaybeUninit<u8>]` translates
+- [Fields typed by an associated type](/quest/m3/ts-assoc-type-fields.md) - a generic struct's field of `<T as Trait>::Item` translates at each instance
diff --git a/quest/m3/ts-assoc-type-fields.md b/quest/m3/ts-assoc-type-fields.md
new file mode 100644
index 000000000..1efd288ba
--- /dev/null
+++ b/quest/m3/ts-assoc-type-fields.md
@@ -0,0 +1,20 @@
+# [M] Fields typed by an associated type
+
+## Goal
+
+[rust2-ts](/ts/README.md) translates a generic struct whose field is typed by an
+associated type of its parameter, such as smallvec's `Drain<'a, T: Array>` holding
+`<T as Array>::Item`, by resolving the projection at each instance, proven by differential
+tests against native Rust.
+
+## Plan
+
+Suggested on [#600](https://github.com/moq-dev/rust2/pull/600) (rangemap): it is 1 of
+smallvec's 10 model refusals at the moq pin. The rest are `unsafe` that the
+[ts-unsafe epic](/quest/m3/ts-unsafe/README.md) owns, and moq drops or binds smallvec, so
+this is a language gap rather than a consumer's.
+
+Decided with the maintainer on 2026-11-07: ✅ m3 (rejected: m2, drop), as a core language
+gap, not a smallvec-specific one.
+
+Public API: the translator's output.
diff --git a/quest/m3/ts-bufmut-slices.md b/quest/m3/ts-bufmut-slices.md
new file mode 100644
index 000000000..a882455f2
--- /dev/null
+++ b/quest/m3/ts-bufmut-slices.md
@@ -0,0 +1,19 @@
+# [S] BufMut on a byte slice
+
+## Goal
+
+[rust2-ts](/ts/README.md) translates `bytes`' `impl BufMut for &mut [u8]` and
+`impl BufMut for &mut [MaybeUninit<u8>]`, which write at the slice's front and advance
+past what they wrote, proven by differential tests against native Rust.
+
+## Plan
+
+Suggested on [#611](https://github.com/moq-dev/rust2/pull/611), which mapped `Buf` for a
+`VecDeque<u8>`: `mapped_self` (`ts/src/lower/stock.rs`) counts any `&[u8]` or `&mut [u8]`
+as mapped, but no `Buffer` covers a mutable slice, so both impls look refused the way the
+deque was. That was read from the code, not a test; reproduce it first.
+
+Decided with the maintainer on 2026-11-07: ✅ m3 (rejected: m2, drop), since rust2 aims to
+support all of std and its common crates' impls. No consumer at the moq pin.
+
+Public API: the translator's output.
diff --git a/quest/m3/ts-unsafe/README.md b/quest/m3/ts-unsafe/README.md
index fbe362cfd..f742691df 100644
--- a/quest/m3/ts-unsafe/README.md
+++ b/quest/m3/ts-unsafe/README.md
@@ -78,3 +78,4 @@ Public API: the translator's output.
 - [A slice's pointer cast to an array's](/quest/m3/ts-unsafe/array-casts.md) - `*(s as *const [u8] as *const [u8; N])` in a crate's own code, and `IoSlice`
 - [Unchecked integer operations](/quest/m3/ts-unsafe/unchecked-ops.md) - `unchecked_*` and `NonZero::new_unchecked` translate, aborting on a violated precondition
 - [UnsafeCell's raw accessors](/quest/m3/ts-unsafe/unsafecell.md) - `UnsafeCell::raw_get`, `from_mut`, and `replace` translate
+- [A Box of one uninitialized value](/quest/m3/ts-unsafe/box-new-uninit.md) - `Box::new_uninit` and `new_zeroed` for one value translate, through `write` and `assume_init`
diff --git a/quest/m3/ts-unsafe/box-new-uninit.md b/quest/m3/ts-unsafe/box-new-uninit.md
new file mode 100644
index 000000000..c29b39d38
--- /dev/null
+++ b/quest/m3/ts-unsafe/box-new-uninit.md
@@ -0,0 +1,20 @@
+# [S] A Box of one uninitialized value
+
+## Goal
+
+[rust2-ts](/ts/README.md) translates `Box::new_uninit` and `Box::new_zeroed` for one
+value, written through `Box<MaybeUninit<T>>::write` or its pointer and taken by
+`assume_init`, proven by differential tests against native Rust, including drops.
+
+## Plan
+
+Suggested on [#606](https://github.com/moq-dev/rust2/pull/606), which translated the slice
+forms (`Box::new_uninit_slice`, `write_clone_of_slice`). `ts/src/lower/library.rs` maps
+`new_uninit_slice` and `assume_init`, and `pointer::allocates` already names
+`new_uninit` and `new_zeroed`, but neither single-value constructor is mapped. Check
+which of `assume_init` and `write` already cover a single value before adding them.
+
+Decided with the maintainer on 2026-11-07: ✅ m3, in this epic (rejected: m2, drop). No
+consumer at the moq pin.
+
+Public API: the translator's output.