State pinSet.pin's precondition, and file readSurvey.edge's unchecked pins

pins.go

@@ -50,7 +50,9 @@ func (p *pinSet) add(t *table, r int) {
 	p.spill[t] = r
 }
 
-// pin pins row r of t, and the rows of t's ancestors it links to.
+// pin pins row r of t, and the rows of t's ancestors it links to. It checks nothing, so r must
+// agree with the row p pins of nearestPinned(t): ask clash first, as pinRow does, or draw r inside
+// it, as drawIn does.
 func (p *pinSet) pin(t *table, r int) {
 	for stop := p.nearestPinned(t); t != stop; t = t.parentT {
 		p.add(t, r)

todo.md

@@ -31,8 +31,8 @@ on 2026-09-29 a third time (Navigation 7.0, Locality 5.6, Shape 6.3, Self-suffic
 
 This round, in order:
 
-- State at `pinSet.pin` that its caller proved r sits inside the nearest pinned
-  ancestor, which `pinRow` and `drawIn` do.
+- Ask `clash` before `readSurvey.edge` enters a read's pins, or refuse the clash there:
+  `pin` checks nothing, and `replayPairs` compares reads within one draw group only.
 - Delete the prose two or more seats found empty: `loadData`'s comment, which also names
   `linkRefs` where `bind` runs, `table.drawRow`'s, `table.selector`'s, and `render.go`'s
   second and third "compile validated" notes.