---

title: 08 — Pin / Ghim Policy date: 2026-05-31

08 — Pin / Ghim Policy

Each list/layer supports pinned (ghim) rows so humans/AI can monitor key rows quickly. Pins must be PG-backed, governed, scoped, counted/auditable — never frontend local-only.

Reuse search result (verified live)

Searched public for %pin%/%favorit%/%watch% and KB for pin/favorite/watchlist/monitoring artifacts. No pin/favorite/watchlist table exists → REGISTRY_MISSING. Closest live concepts are issue monitoring (system_issues) and the audit queue (entity_audit_queue, PIV-018) — neither is a user/role pin. → Pin/ghim is genuinely NEW.

Proposed minimal registry (PROPOSE-ONLY — GATED_BY_APPROVAL; do NOT implement)

registry_pin:

column	type	note
id	int PK
object_ref	text	pinned object (entity_code / pivot filter-path / substrate key)
object_kind	text	species/composition kind so the pin survives drill-layer changes
surface_ref	text	which surface/list/layer (e.g. registries-pivot:PIV-007)
pinned_by	text	actor (user/agent id)
scope	text	global | user | role | team
scope_ref	text	role/team id when scope ≠ global/user
reason	text	monitoring rationale
priority	int	display/triage order
created_at	timestamptz
active	bool	soft state (soft-retire, never hard delete — Đ0 Atom)

Governance (must hold before implementation)

• Birth (Đ0-G/Đ2): created via the birth path → ID + birth record like every entity; counted by PIV-32x registry_pin (PIVOT_MISSING until born).
• Registered (Đ2/Đ23): added to meta_catalog so it is itself visible, monitored, subject to the orphan/phantom invariant. A pin table not registered would itself be an orphan.
• Governed (Đ37): owner = a governance Mother / monitoring sub-registry (likely GOV-COUNCIL); scope changes auditable; soft-retire only.
• Auditable (Đ45): every pin/unpin is an event (event_outbox pin.created/pin.removed), not silent UI state.
• Pivot-countable (Đ26): pinned_count per surface is a pivot dimension, shown on the reflection screen.

Contract field

A node carries pin_state (pinned | unpinned | pinned-by-role | pinned-by-team), resolved server-side from registry_pin filtered by the viewer's scope. Nuxt renders the flag; never stores pins locally.

No-hardcode tests

• T-PIN-1: pin_state derives from a PG registry_pin query; any localStorage/in-memory pin array in web/ ⇒ hardcode_violation.
• T-PIN-2: registry_pin appears in meta_catalog and has a pivot (else orphan by Đ23/Đ26).

Verdict

NEW, propose-only. Minimal, governed, scoped, born+registered+counted. Not implemented — design contract only, pending approval (Đ32-class additive change).

---

Round 4 One-Roof Governance Concept Patch (2026-06-01)

Concept-level, additive, no version bump, technical implementation DEFERRED. Concept canon: knowledge/dev/design/one-roof-governance-concepts/ (M-DEF-1, C-6, M-DEF-6).

Pin scope decides governed vs Class 0 (M-DEF-1 shared-truth test). A pin is governed only when it affects shared truth or carries write/approval power. Apply the scope column this doc already proposes:

• scope = user (a single person's private pin) → Class 0 (non-governed): single-user-private, read-only vs shared truth, no approval/execution power → 0 governance issue; it needs no accountable owner.
• scope ∈ {global, role, team} (a pin others see as truth, or that drives a shared list/policy) → governed object: it needs birth + registration + an accountable owner per scope (M-DEF-3) + a coverage profile — exactly as this doc's Governance section requires. A global pin whose policy is unowned → pin_policy_unowned.
• The Class-0 source set is a COUNCIL-owned list — exclusion from governance must itself be governed, never silent.

This refines this doc's "owner = likely GOV-COUNCIL": COUNCIL owns the global/shared pin policy; user-scoped pins are Class 0 and are not COUNCIL-owned objects.

Crossover boundary (C-6, council default). A Class-0 (user) pin that becomes exportable / shareable crosses into governed at the moment of export/share (sharing changes shared-truth reachability — M-DEF-1). Recommended default: governed-at-share; legacy-bypass regularization deadline = 60 days. Council ratification item (C-6) — recorded, not decided here.

Governed exception (M-DEF-6) if a pin ever bypasses the roof. Any temporary pin-policy bypass must be a governed exception: 11-field record + state fingerprint + mandatory replacement_plan + max-2-renewals + non-exemptable floors; interim store admin_fallback_log until a native grant_governance_exception action-type exists (SB-1).

Blockers: SB-1 (native exception/owner action-types), SB-2 (object ownership edge to bind the global pin's owner), OP-B only if pins become IU-scoped. Full register: Canon doc 03. No registry_pin schema or implementation added here — this doc's NEW / propose-only verdict is unchanged.