The pin scope read the privacy-projected label, which stays flat across
organization switches, so pins survived an account change. Scope on the
raw label beside the addressing identity.