diff --git a/TODO.org b/TODO.org
index cce2e0a9..545df224 100644
--- a/TODO.org
+++ b/TODO.org
@@ -975,10 +975,7 @@ deliberate absence.
 
 ** DONE A read-only slice type
 CLOSED: [2026-09-25]
-=[const T]=; a =[T]= converts at the top of a type or under another const slice, never inside a writable one. =(addr (at v i))= of a read-only element is allowed, since a =(Ptr T)= is the C boundary and has no const form; a store is what is refused.
-
-** TODO The address of a read-only element is taken without complaint
-=(addr (at v i))= over a =[const T]= answers a writable =(Ptr T)=, so =slice-from-ptr= launders one back into a =[T]=; a string's byte refuses the same =addr=. Allowed because raylib's =load-image-from-memory= and =get-codepoint-previous= have no other way to hand a =[const u8]= to C. Decision needed: a const pointer type, or a refusal plus another route to C.
+=[const T]= and =(Ptr const T)=; a =[T]= or =(Ptr T)= converts at the top of a type or under another const one, never inside a writable one. The const is shallow: an element of a =[const [u8]]= and a Vec's buffer are writable. The address of read-only storage, a string's byte included, is a =(Ptr const T)=, and a C =const T *= parameter takes one.
 
 ** TODO (slice d 1) over a dyn string is refused where (at d i) works
 The typed and dyn spaces disagree about a spelling, which the standing rule
@@ -1089,11 +1086,6 @@ Decided 2026-09-25: the type-limit constants as a form taking a type, Odin's
 max(T), valid at any numeric type or a numeric?-bounded variable. For a float,
 min-of is the most negative finite value.
 
-** NEXT (Ptr const T), the pointer beside [const T]
-Decided 2026-09-25: addr through a read-only slice gives a (Ptr const T), which
-nothing writes through; (Ptr T) widens to it and never back; a C parameter
-declared const T* takes one. Closes the addr hole in [const T].
-
 * Backends
 
 ** DONE The x86 backend tracks LLVM at -O0
diff --git a/web/index.html b/web/index.html
index 67ffbe3f..a232e51b 100644
--- a/web/index.html
+++ b/web/index.html
@@ -526,6 +526,7 @@ notation reads as exactly one data item.</p>
 <tr><td><code>(Pool T)</code></td><td>generational slab storage, owning, copies the same way</td><td>items + slots + its allocator</td></tr>
 <tr><td><code>(Handle T)</code></td><td>a reference into a pool that reports a dead referent</td><td>index and generation packed into an <code>i64</code></td></tr>
 <tr><td><code>(Ptr T)</code></td><td>raw pointer</td><td>a pointer</td></tr>
+<tr><td><code>(Ptr const T)</code></td><td>a pointer nothing is written through: the address of read-only storage, and what a C <code>const T *</code> takes. A <code>(Ptr T)</code> converts to one, never the reverse</td><td>a pointer</td></tr>
 <tr><td><code>(Option T)</code></td><td><code>Some</code> / <code>None</code></td><td>tag byte + T</td></tr>
 <tr><td><code>(Fn [T ...] R)</code></td><td>a function value, which may have captured</td><td>a code address and an environment pointer</td></tr>
 <tr><td><code>(CFn [T ...] R)</code></td><td>a function value that cannot capture — the <code>C</code> is what a C function pointer would need, not a way to reach C today</td><td>a pointer</td></tr>