diff --git a/pins.go b/pins.go
index 9c5e469..8d33cde 100644
--- a/pins.go
+++ b/pins.go
@@ -68,7 +68,7 @@ func (p *pinSet) pin(t *table, r int) {
 	}
 }
 
-// each calls fn for every pinned row, in pin order, the spilled ones by table name.
+// each calls fn for every pinned row, in pin order, the spilled ones by path.
 func (p *pinSet) each(fn func(t *table, r int)) {
 	for _, q := range p.inline[:p.n] {
 		fn(q.t, q.row)
@@ -77,7 +77,7 @@ func (p *pinSet) each(fn func(t *table, r int)) {
 	for t := range p.spill {
 		spilled = append(spilled, t)
 	}
-	sort.Slice(spilled, func(i, j int) bool { return spilled[i].category < spilled[j].category })
+	sort.Slice(spilled, func(i, j int) bool { return spilled[i].path < spilled[j].path })
 	for _, t := range spilled {
 		fn(t, p.spill[t])
 	}
diff --git a/todo.md b/todo.md
index a324f76..8e81116 100644
--- a/todo.md
+++ b/todo.md
@@ -49,8 +49,9 @@ This round, in order:
   `entered`'s `pinsAncestors` flag stop restating `walkTable`'s draw condition and
   `rowOf`'s ancestor rule: a change to how a render draws rows still leaves the fence
   proving the old rule. Hold a row rendered whole in `drawAt` beside `drawn`, so
-  `pinSet` holds only what `pin` pins and `alternatives` needs no exception. Needs the
-  item above.
+  `pinSet` holds only what `pin` pins and `alternatives` needs no exception. Settle a
+  cell of a municipality drawn whole beside a path pinning a region it is not in. Needs
+  the item above.
 - Register a transform once: `transforms` restates the `lowercase`, `uppercase` and
   `ascii` entries in `builtins`, and `valueProof.template` classifies by the first while
   render calls the second. Derive the numeric builtins `valueProof.template` lists in
@@ -290,7 +291,7 @@ because pairing a street with its exact postnummer rewrites shipped rows.
 - Hold every change the charter says owes a `CHANGELOG.md` entry to one in CI: the
   check covers `data` and `testdata/shipped_shape.txt` alone, where `AGENTS.md` adds a
   flag, an exit code, an exported name, a fence, a builtin and the lowest Go.
-- Measure the allocation gate over the shipped `geo` trees too: `pinSet.pins [8]` is sized
+- Measure the allocation gate over the shipped `geo` trees too: `pinSet.inline [8]` is sized
   for them, and `perf_test.go` checks a synthetic five-deep tree only.
 - Make a named draw group's hold lazy, `&hold{}` in `renderScope.hold`: it escapes
   to the heap anyway, so its two eager maps buy no stack and cost two allocations per