---
title: Capabilities and degraded modes
description: What the Desk needs from the artifact runtime (db, user, downloads), and exactly what each page does when one is missing, empty or failing.
sidebar:
  order: 2
---

## What it is

The Desk declares three runtime capabilities when published: `db` (the workspace store), `user` (who is viewing) and `downloads` (saving a file). Each page has a designed state for when one is missing or a read fails.

## Why it exists

A Desk is opened in previews, private windows, by people not signed in, and before any run. A blank page in any of those cases looks broken. Every state says what is true in fixed words and offers at most one next action.

## How it works

| Capability | Used for | Without it |
|---|---|---|
| `db` | Every read and write | The page shows only "This page needs the db capability. Republish it with db declared." |
| `user` | The viewer id: read, done, acknowledge, and `by` on decisions | Per-viewer state is off: "Read and done are not available for this visit." Decisions record `by: null`. It never falls back to browser storage |
| `downloads` | CSV export from Browse | "Saving a file is not available here. Copy the text below." with the CSV in a read-only text box |

The viewer confirms or declines each save; a decline shows "Not saved."

### States

| State | When | Shows |
|---|---|---|
| `not-set-up` | No `meta/definition` | "<name> is not set up yet." and the seed command |
| `first-run` | No runs yet | "Nothing has run yet." with each producer's next run, or "No <plural> yet. They appear after <producer> runs." |
| `loading` | Reading | "Loading ..." with static placeholder rows, never animated |
| `read-error` | A read failed | "Could not read <collection>. Other pages still work." and Try again |
| `empty-filter` | Filters match nothing | "No <plural> match these filters." and Clear filters |
| `quiet` | Nothing needs the person | "Nothing needs you." with last runs |
| `inbox-empty` | No messages | "No messages yet." (or the unread and done variants) |
| `suggestions-empty` | No proposals | "No suggestions waiting." |
| `read-only` | Demo data | "Demo data, read only. Changes cannot be saved on this page." |

A refused write shows "Not saved: <reason>".

### Store limits

The page side of the store is last-writer-wins, with no version pin. Two people saving the same setting keep the later save, and the Settings page says so.

> Since 0.5.0: the Desk is designed around the store's documented limits (db.d.ts 0.2.91): one `orderBy` per query, at most 10 `where` clauses, `limit` from 1 to 1000, no cursors or counts, 64 subscriptions, and 25,000 documents. On `quota_exceeded` the Desk says "The Desk is full (25,000 records). Ask the routine owner to clear old records." With a null viewer, actions that need one show "Sign in to make changes". A null `downloads` capability hides Download and keeps Copy.

## Worked example

A colleague opens Hiring Signals' Desk from a link while signed out. Browse and record pages render. Inbox shows messages but no read or done controls, with "Read and done are not available for this visit." Keeping a role still works and records `by: null`.

## Common pitfalls

- **Republishing without `user`.** Read and done disappear for everyone.
- **Assuming a save is merged.** It is last write wins.
- **Using browser storage for state that matters.** Only conveniences (theme, density) live there.

## Related

- [The Desk](/desk)
- [Storage](/infrastructure/storage)