diff --git a/TODO.md b/TODO.md
index 48b3f72..a00b1ef 100644
--- a/TODO.md
+++ b/TODO.md
@@ -30,11 +30,6 @@ P2: security: per-origin rate limiting
 
 # Completed Steps
 
-- 2026-10-16 the generator page lower-cases the source host and writes an empty
-  source path as `/` before it makes the encrypted URL, as `/v1/image/` does
-  (closes #293). A host written in upper and in lower case, or a source URL with
-  no path and with the path `/`, made two cache keys and two upstream requests
-  for one image.
 - 2026-10-16 a size with one side `0` keeps the side computed from the source's
   proportions at 1 or more (closes #283): it was rounded down, so for a thin
   source it came out at 0, and libvips then made the size square. An 8192x1
@@ -49,6 +44,11 @@ P2: security: per-origin rate limiting
   the image is scaled to cover the size, so that source at `100x0` comes out at
   8192x1. `README.md` now says this under Signature Specification, and says how
   a `0` side is worked out where it said `0` meant the original.
+- 2026-10-16 the generator page lower-cases the source host and writes an empty
+  source path as `/` before it makes the encrypted URL, as `/v1/image/` does
+  (closes #293). A host written in upper and in lower case, or a source URL with
+  no path and with the path `/`, made two cache keys and two upstream requests
+  for one image.
 - 2026-10-16 the source URL a request fetches is built with `net/url` from the
   source host, path and query, not joined as text (closes #288). The source
   path, decoded, is fetched percent-encoded again, so `100%25.png` fetches