[Bug] Design canvas public share fails with "unscannable" content scan error

Bug Description

A /design canvas cannot be shared publicly — public serving refuses the version as unscannable

Summary

A design canvas published from Claude Code's /design skill cannot be given
"Anyone with the link" access. The share UI first blocks on the downloads
capability; once that is dropped, the share request itself fails, and the API
gives a different reason entirely:

PATCH /api/frame/perm/<artifact-id>?org=<org-id>
{"read":{"mode":"public","users":[]},"shared":"<version>"}

{"error":"frame: public serving requires the served version's content scan to be dispatched (unscannable)",
 "reason":"unscannable"}

This makes a design canvas unshareable with anyone outside the publisher's
organization, which removes the only route by which an external collaborator
(a designer, a client, a contractor) can look at one.

Why this looks like a bug rather than a policy

1. The two failure messages disagree with each other. The share dropdown

says the artifact "offers file downloads, so it can't be shared publicly" —
a capability explanation. Removing the capability makes the option
selectable, and then the actual request fails for an unrelated reason
(unscannable). A user following the first message's advice arrives at a
dead end with no way to understand why.

1. unscannable is never surfaced in the UI. The dialog shows a generic

"This version can't be shared publicly. Publish a new version or change the
shared version, then try again." Both of those suggested remedies are
useless here — publishing new versions and re-pointing the shared version
both fail identically. The real reason is only visible in the network
response.

1. The condition is structural, not content-specific (tested — see below). A design

canvas embeds the whole canvas editor (~2MB of minified JS) in every
published page, before any design content exists. If that alone exceeds
whatever the content scan can handle, then no canvas produced by /design
can ever be shared publicly — which the /design skill's own documentation
does not anticipate. It states the opposite: "a canvas that declared export
shares within the organization only … while one without export can also be
shared by public link when the share dialog offers it."

Reproduction

1. In Claude Code, run /design and have it publish any canvas.
2. Open the artifact → Share.
3. General access → "Anyone with the link" is disabled, with the note that the

artifact offers file downloads.

1. Republish declaring only the artifact-publish capability (no downloads).
2. "Anyone with the link" is now selectable. Select it and confirm "Share

publicly".

1. The dialog flashes the options and then shows "This version can't be shared

publicly. Publish a new version or change the shared version, then try
again." The underlying PATCH returns reason: "unscannable".

What was eliminated

• Not the version pointer. "Shared version" was already Latest, and

selecting explicit versions changes nothing.

• Not the capability declaration. Republished with {"self":{},"downloads":{}},

then {"self":{}}, then {} (no capabilities at all). All three fail the
same way, so the block is not a capability grant.

• Page size was reduced from ~2.7MB to ~2.2MB by removing embedded base64

fonts from the artboards (238KB + 225KB of artboard source down to 33KB +
20KB). The smaller version fails identically, which
points the finger at the editor payload itself rather than at anything the
design content contributes.

Expected behaviour

Either:

• a design canvas can be served publicly (the scan handles it, or canvases are

exempted), or

• the UI says up front that design canvases cannot be shared outside the

organization, instead of offering an option that always fails — and the
/design documentation is corrected to match.

Environment

• Claude Code, /design skill (canvas editor preview), runtime contract 0.1.31
• Published page ~2.2–2.7MB, 2 artboards, 6 embedded PNGs
• macOS, Firefox 153

Environment Info

• Platform: darwin
• Terminal: ghostty
• Version: 2.1.237
• Feedback ID: 32fd593f-1964-4104-a9f5-4a8366f23be6

Errors

[]