Bug: task modal's upload-policy chain queries getPolicy with an empty organizationId — useGovernancePolicy and 4 sibling hooks lack the 'skip' guard

[larryro]

Problem

Since the v0.4.14 boundary guard landed (#3021, shipped in #3052), org-scoped queries reaching the server with organizationId: "" are rejected as structured ORG_ID_REQUIRED. The client is still sending them:

Uncaught RLSError: Organization id is required.

• GlitchTip TALE-PROJECT-11R — born 2026-08-25T06:11Z, hours after v0.4.14 deployed, exactly as the fix(platform): classify dead-org errors and recover stale clients #3052 review predicted for the residual caller-side gap. 32 events by 2026-08-27T02:19Z and accelerating (10 by 8/25 12:42Z → 26 by 8/26 11:48Z → 32 now), from authenticated demo users in normal use — not stale tabs.
• All 32 events carry func: governance/queries:getPolicy; no other org-scoped function has ever fired with an empty id.
• Pre-guard predecessor: TALE-PROJECT-OU — Not a member of organization <empty>, 92 events 2026-07-07 → 2026-08-25, quiet since the guard went live. Its sampled events were the same getPolicy path (40/42).

Root cause (verified at 0453e65)

Components mount org-scoped subscriptions while their parent record is still resolving, substituting '' for the org id. The one chain matching every live event:

1. task-modal.tsx#L1026-L1029 — useConvexFileUpload({ organizationId: task?.organizationId ?? '', … }) mounts while useTask(taskId) is still resolving, so task is undefined
2. use-convex-file-upload.ts#L104 — useUploadPolicy(config.organizationId) unconditionally
3. governance/hooks/queries.ts#L253-L254 — useUploadPolicy → useGovernancePolicy(organizationId, 'upload_policy')
4. governance/hooks/queries.ts#L52-L59 — useGovernancePolicy subscribes with no 'skip' guard, so the '' goes over the wire.

The same file already has the house pattern next door: usePasswordPolicy (#L100-L108) passes 'skip' until the org id is truthy — as do useAccessibleModels, useLegalHolds, useOrgMembersForPicker.

Where else (same class)

Unguarded siblings in the same file — will fire for any falsy caller: usePiiConfig (L45), useDsarPolicyForUi (L62), useMyFeatureFlags (L68), useMyBudgetStatus (L74).

Known ?? '' feeders (zero server events to date, but the same race): task-modal.tsx L984 useActorDirectory, L996 useTaskStatusChoreography, L1000 useTaskSubjectContract; kanban-board.tsx L55 and use-task-board-dnd.ts L92 (tasks[0]?.organizationId ?? ''); message-toolbar.tsx L89 (useFeedbackActions); dictation-button.tsx L82; members-settings.tsx L68.

Suggested

1. 'skip'-on-falsy guard in useGovernancePolicy and the four unguarded siblings — the smallest change that silences the live stream, and it covers every current and future caller of those hooks.
2. Sweep the ?? '' call sites so org-scoped queries pass 'skip' (or don't mount) until a real id exists.
3. Close the class: dev-assert (or auto-skip) in useConvexQuery when an organizationId arg is '', or type org ids so ?? '' no longer typechecks into query args.

Acceptance

• Opening/closing the task modal (including the E2E project specs) produces no new ORG_ID_REQUIRED events.
• TALE-PROJECT-11R stays flat after the next demo deploy; no '' org id leaves the client.

Tracking

• Board task: TAL-9 "Org-scoped queries fire with empty organizationId (?? '' races) — sweep call sites so ORG_ID_REQUIRED goes quiet"
• Related: Bug: getOrganizationMember throws a bare RLSError — uncaught by Convex, and it says "Not a member" even when the organization was deleted #3021 / fix(platform): classify dead-org errors and recover stale clients #3052 (server boundary, shipped), Bug: every visit to /dashboard/<deleted org id> fires a burst of uncaught server errors — OrgSlugUnresolvableError / RLSError / ORG_NOT_FOUND #3019 (deleted-org incident).

[larryro]

GlitchTip sweep 2026-09-01 — group flat, fix verifiably unshipped: don't read the quiet as resolution.

TALE-PROJECT-11R has been flat at 69 events since 2026-08-29T10:09Z (~2.6 days). In that window demo took two deploys — 0.4.17 → 0.5.3 (registered 08-31T04:11Z) → 0.5.4 (08-31T08:27Z, current) — and had post-deploy traffic on Monday (client activity through 18:05Z, including authenticated getPolicy calls at 09:21Z from the #3119 group).

But verified today at both v0.5.4 and HEAD 5e67beb:

• useGovernancePolicy still subscribes unguarded (services/platform/app/features/settings/governance/hooks/queries.ts:51), as do the four siblings usePiiConfig (:44), useDsarPolicyForUi (:61), useMyFeatureFlags (:67), useMyBudgetStatus (:73).
• The task-modal ?? '' feeders are intact — lines drifted to task-modal.tsx:981/:993/:997/:1025.
• v0.5.4→main adds only feat(platform): reuse the Entra SSO app for Microsoft 365 import #3116/fix(platform): task-agent runs move the card, stream, and self-chain #3117/fix(platform): automation equipment, wizard model pin, and drive chain #3118; none touch this path.

So the flatness is a usage pattern (weekend + the racing modal-mount path not being exercised), exactly the caveat the earlier watch set. One in-file precedent worth copying when fixing: the 0.5.x refactor added the 'skip'-on-falsy pattern to the entire legal-hold hook family in the same file (queries.ts:178-305) — the five hooks above are the remaining unguarded set.

Tracked on the tale board as TAL-9.

[larryro]

GlitchTip freshness note (sweep 2026-09-05): TALE-PROJECT-11R resumed today after ~7 days flat — and from a different user.

• New event 2026-09-05T09:10:26Z; the group is now at 70 events (had been flat at 69 since 2026-08-29T10:09Z). Composition unchanged: governance/queries:getPolicy with an empty organization id (ConvexError ORG_ID_REQUIRED), culprit getOrganizationMember.
• The event carries a different authenticated demo user (…8d2hta) than the one behind the entire 08-28/08-29 run (…8cy0pz) — the modal-mount race fires for whoever exercises the path, confirming the systemic read over any single-user explanation.
• Watch outcome: the 08-29 → 09-05 quiet window was a traffic pattern, not resolution. Demo still runs 0.5.4 (no release registered since 08-31T08:27Z), where this fix is verifiably absent per the 09-01 check — the 'skip'-on-falsy guard in useGovernancePolicy + its 4 unguarded siblings remains the smallest change that silences the stream.

(Board: TAL-9, still todo.)

[yannickmonney]

Closing as obsolete. Reads now go through the REST adapter registry, whose getPolicy adapter treats '' as absent, falls back to the org in the /dashboard/$id URL and otherwise skips the query (app/lib/backend/settings.ts). An empty id that did reach the server would get a 400 INVALID_QUERY, not an uncaught error, and the 0.5 GlitchTip data has no such events.