Problem

The Content sidebar coupled personal Pin to sidebar / Unpin from sidebar actions to shared edit/manage permission. A view-only collaborator therefore lost the entire overflow menu, even though pinning is private to that person. Viewer rows also shifted because the add-child slot disappeared.

Approach

Separate personal sidebar capability from shared Page authority, preserving current-main pin vocabulary and per-user sidebar ordering. Each live row implementation keeps a stable two-slot action cluster: overflow first, then add-child. When child creation is unavailable, the plus remains visible as a native-disabled, muted control.

What changed

• Centralized sidebar action availability for personal pinning versus shared edit/manage actions.
• Applied the permission and alignment boundary to DatabaseSidebarRow and DocumentTreeItem; current-main pinned rows continue through the database-row path.
• Kept viewer menus limited to Pin/Unpin while retaining existing editor/admin actions.
• Added focused permission, ordering, keyboard/callback, layout, and editor-regression tests.
• Added a user-facing Content changelog entry.

Safety

This does not change Page roles or grant shared mutations. Viewers still cannot delete, move, create children, drag, or perform other shared changes. There are no schema, action, application-state, or feature-flag changes.

Verification

• Exact head: 0cb5102a6e6015e92f8d9368842e4ef8cd45b738; integrated merge base: 60749ec7730dc1d5523c8745e70a27c5b7b65a03.
• Current main: 64c93b4ed55e0c1fe8b1a4fd1a91210c6e7d212b. Its post-candidate delta is limited to package-release metadata, Netlify ignore script/tests, and Clips player/comment code, classified acceptance-disjoint from Content sidebar and sharing authorization.
• Complete material diff: eight files, 515 insertions and 22 deletions; SHA-256 e7ec1ca64520fe0748e1892409cffc11ce0fbe65b611c785f88ca6caaf4c06ab.
• Focused sidebar and viewer-authorization matrix — 62 tests passed across five files.
• Full Content suite — 2,060 passed, 3 expected failures, 5 skipped; 168 files passed and 1 skipped.
• Content typecheck — passed.
• Content product-impact policy — 30 passed.
• Independent permission review — approved this exact head with no findings; the reviewer additionally passed 23 core sharing-access tests and confirmed the organization-membership resolver grants only viewer authority while editor assertions reject.
• All nine required checks are green on this exact head: Build, Content DB tests, Content parity, Core integration tests, Fast tests, standalone Chat generation, Lint and format, Plan E2E, and scaffold creation.
• Authenticated exact-head H1–H3 passed in a freshly claimed Codex in-app browser tab against the task-owned localhost process whose cwd was this exact-head worktree. The viewer workspace row exposed overflow first and a gray native-disabled plus second; its menu contained only Pin to sidebar; pinning created the private Pinned membership whose menu contained only Unpin from sidebar; unpinning restored the observed initial unpinned baseline. The final menu again contained only Pin to sidebar. No shared mutation was exposed or performed. Screenshots are retained in the governing task evidence directory.
• The localhost preview was stopped after acceptance and port 8080 was verified free.

Review focus

• A viewer can only perform the personal Pin/Unpin action.
• The disabled plus preserves alignment and cannot receive focus or invoke child-creation callbacks.
• Current-main personal sidebar ordering, delete confirmation, opened-database context, and pinned-row routing remain unchanged.

content_product_impact:
  lane: contract_repair
  features:
    - content.feature.find-your-place-again
    - content.feature.make-the-workspace-yours
  capabilities:
    - content.navigation.sidebar
  record_change: none
  proof:
    - pnpm --filter content test
  rationale: The change repairs the personal sidebar permission contract without changing shared Page authority.