Capabilities and degraded modes

What the Desk needs from the artifact runtime (db, user, downloads), and exactly what each page does when one is missing, empty or failing.

What it is

The Desk declares three runtime capabilities when published: db (the workspace store), user (who is viewing) and downloads (saving a file). Each page has a designed state for when one is missing or a read fails.

Why it exists

A Desk is opened in previews, private windows, by people not signed in, and before any run. A blank page in any of those cases looks broken. Every state says what is true in fixed words and offers at most one next action.

How it works

Capability	Used for	Without it
`db`	Every read and write	The page shows only “This page needs the db capability. Republish it with db declared.”
`user`	The viewer id: read, done, acknowledge, and `by` on decisions	Per-viewer state is off: “Read and done are not available for this visit.” Decisions record `by: null`. It never falls back to browser storage
`downloads`	CSV export from Browse	“Saving a file is not available here. Copy the text below.” with the CSV in a read-only text box

The viewer confirms or declines each save; a decline shows “Not saved.”

States

State	When	Shows
`not-set-up`	No `meta/definition`	“ is not set up yet.” and the seed command
`first-run`	No runs yet	“Nothing has run yet.” with each producer’s next run, or “No yet. They appear after runs.”
`loading`	Reading	“Loading …” with static placeholder rows, never animated
`read-error`	A read failed	“Could not read . Other pages still work.” and Try again
`empty-filter`	Filters match nothing	“No match these filters.” and Clear filters
`quiet`	Nothing needs the person	“Nothing needs you.” with last runs
`inbox-empty`	No messages	“No messages yet.” (or the unread and done variants)
`suggestions-empty`	No proposals	“No suggestions waiting.”
`read-only`	Demo data	“Demo data, read only. Changes cannot be saved on this page.”

A refused write shows “Not saved: ”.

Store limits

The page side of the store is last-writer-wins, with no version pin. Two people saving the same setting keep the later save, and the Settings page says so.

Since 0.5.0: the Desk is designed around the store’s documented limits (db.d.ts 0.2.91): one orderBy per query, at most 10 where clauses, limit from 1 to 1000, no cursors or counts, 64 subscriptions, and 25,000 documents. On quota_exceeded the Desk says “The Desk is full (25,000 records). Ask the routine owner to clear old records.” With a null viewer, actions that need one show “Sign in to make changes”. A null downloads capability hides Download and keeps Copy.

Worked example

A colleague opens Hiring Signals’ Desk from a link while signed out. Browse and record pages render. Inbox shows messages but no read or done controls, with “Read and done are not available for this visit.” Keeping a role still works and records by: null.

Common pitfalls

Republishing without user. Read and done disappear for everyone.
Assuming a save is merged. It is last write wins.
Using browser storage for state that matters. Only conveniences (theme, density) live there.