@ai-matrx/messaging 0.13.1 → 0.15.0

package/dist/react.d.cts

@@ -208,7 +208,11 @@ interface Page<TItem, TCursor> {
 /** What the host injects. Identity ONLY — every hard part is in the package. */
 interface MessagingIdentity {
     readonly userId: UserId;
-    readonly organizationId: OrganizationId;
+    /**
+     * The active organization, or `null` when none is selected. Reads never
+     * depend on it; it is only where a NEW conversation lands.
+     */
+    readonly organizationId: OrganizationId | null;
 }
 interface DraftMessage {
     readonly conversationId: ConversationId;
@@ -525,7 +529,9 @@ declare function createOutbox(options: OutboxOptions): Outbox;
  * errors in 0.6 seconds. A missing session is a NORMAL lifecycle moment — it
  * warns and retries; it is never a red error.
  */
-type MessagingErrorCode = "session-unavailable" | "contention" | "forbidden" | "not-found" | "conflict" | "transport" | "invalid-response" | "misconfigured" | "unknown";
+type MessagingErrorCode = "session-unavailable" | "contention" | "forbidden" | "not-found" | "conflict" | "transport" | "invalid-response" | "misconfigured"
+/** A NEW conversation needs an organization to land in and none is selected. */
+ | "organization-required" | "unknown";
 declare class MessagingError extends Error {
     readonly code: MessagingErrorCode;
     /** The remedy. Nothing fails silently, and nothing fails without saying what to do. */
@@ -817,15 +823,21 @@ interface RepositoryOptions {
      */
     client: MessagingSupabaseClient;
     /**
-     * The active organization. Every conversation and message write carries it
-     * explicitly (R5).
+     * The active organization, or `null`/omitted when none is selected.
+     *
+     * 🚨 READS NEVER NEED IT (access belongs to the person, 2026-09-23). Every
+     * read here is answered by RLS as the session's user; the organization is
+     * only the DESTINATION of a NEW conversation. Without one, starting a
+     * conversation is refused with `organization-required` (the host asks the
+     * person to choose), and a message or member added to an EXISTING
+     * conversation is stamped with that conversation's own organization.
      *
      * 🚨 THERE IS NO `userId` HERE, AND THERE WILL NOT BE ONE (DD-241). Who is
      * acting is read from `client`'s own session — see `session-identity.ts` for
      * the class that closed and why a handed-in id could not be made safe by
      * convention. A caller that still passes `identity` is IGNORED and told so.
      */
-    organizationId: string;
+    organizationId?: string | null | undefined;
     /**
      * INTERNAL. The React provider already runs one session reader for its own
      * render loop and hands it here so the two cannot answer differently and so
@@ -846,8 +858,11 @@ interface RepositoryOptions {
     now?: (() => number) | undefined;
 }
 interface MessagingRepository {
-    /** The organization every write here is stamped with. */
-    readonly organizationId: OrganizationId;
+    /**
+     * The active organization new conversations land in, or `null` when none is
+     * selected — reads work either way.
+     */
+    readonly organizationId: OrganizationId | null;
     /**
      * Who the session says is acting — awaited, because the first `getSession()`
      * is a real read. Rejects with `session-unavailable` when nobody is signed
@@ -1004,11 +1019,18 @@ interface MessagingSnapshot {
     } | null;
     /** Conversations whose last open failed, keyed by id. Cleared on the next open. */
     readonly conversationReadFailures: ReadonlyMap<ConversationId, ConversationReadFailure>;
+    /**
+     * The inbox read FAILED (and no later read succeeded). Without it a failed
+     * first read left `hasLoadedConversations` false forever — a skeleton that
+     * never resolves is a screen telling a lie (RC-B12 round 11).
+     */
+    readonly conversationsLoadError: string | null;
 }
 interface MessagingStore {
     snapshot(): MessagingSnapshot;
     subscribe(listener: (snapshot: MessagingSnapshot) => void): () => void;
     setConversations(items: readonly ConversationSummary[], hasMore: boolean): void;
+    setConversationsLoadError(message: string | null): void;
     /**
      * Switch the archive axis. Clears the list and marks it UNLOADED: the rows
      * on screen belong to the old filter, and leaving them there while the new
@@ -1118,6 +1140,8 @@ interface MessagingEngine {
      * refreshes the archived count the reveal label prints.
      */
     setArchiveFilter(next: MessagingArchiveFilter): Promise<void>;
+    /** Read the inbox again (the failed-read view's Try again). Never throws; a failure lands in the snapshot. */
+    refreshInbox(): Promise<void>;
     /** Re-read how many archived conversations exist, for the reveal's label. */
     refreshArchivedCount(): Promise<void>;
     /** Open a conversation: load its thread and subscribe to its channel. */
@@ -1269,7 +1293,12 @@ interface MessagingProviderProps {
      * (DD-241). There is no `userId` prop, on purpose.
      */
     client: MessagingSupabaseClient | null | undefined;
-    /** The active organization. Every write carries it (R5). */
+    /**
+     * The active organization, or `null` when none is selected. Messaging runs
+     * without one: every read is the person's own. It is the destination of a
+     * NEW conversation (refused as `organization-required` without it) and of
+     * AI runs (the AI actions do not render without it).
+     */
     organizationId: string | null | undefined;
     /**
      * The Matrx API transport for AI features. Omit to run messaging without AI;
@@ -1356,6 +1385,10 @@ interface UseConversationsResult {
     hasMore: boolean;
     /** True only on the FIRST load; a refresh must not blank the list. */
     isInitialLoading: boolean;
+    /** The inbox read failed; the list shows the failure (never a skeleton forever, never "empty"). */
+    loadError: string | null;
+    /** Read the inbox again. */
+    retry: () => void;
     totalUnreadConversations: number;
     loadMore: () => void;
     select: (id: ConversationId) => void;
@@ -1778,9 +1811,13 @@ declare function formatLastSeen(lastSeenMs: number | null, now?: number): string
 
 declare function projectUserSummary(row: Record<string, unknown>): UserSummary;
 declare function projectMessageAction(value: unknown): MessageAction | null;
-declare function projectMessage(row: Record<string, unknown>, fallbackOrganizationId: OrganizationId): Message;
+declare function projectMessage(row: Record<string, unknown>, 
+/** The active organization, or `null` when none is selected (reads never need one). */
+fallbackOrganizationId: OrganizationId | null): Message;
 declare function projectParticipantRole(value: unknown): ParticipantRole;
-declare function projectConversationSummary(row: Record<string, unknown>, viewerId: UserId, fallbackOrganizationId: OrganizationId): ConversationSummary;
+declare function projectConversationSummary(row: Record<string, unknown>, viewerId: UserId, 
+/** The active organization, or `null` when none is selected (reads never need one). */
+fallbackOrganizationId: OrganizationId | null): ConversationSummary;
 
 /**
  * MATRX REFERENCES — a message can name a platform entity, and everything it

package/dist/react.d.ts

@@ -208,7 +208,11 @@ interface Page<TItem, TCursor> {
 /** What the host injects. Identity ONLY — every hard part is in the package. */
 interface MessagingIdentity {
     readonly userId: UserId;
-    readonly organizationId: OrganizationId;
+    /**
+     * The active organization, or `null` when none is selected. Reads never
+     * depend on it; it is only where a NEW conversation lands.
+     */
+    readonly organizationId: OrganizationId | null;
 }
 interface DraftMessage {
     readonly conversationId: ConversationId;
@@ -525,7 +529,9 @@ declare function createOutbox(options: OutboxOptions): Outbox;
  * errors in 0.6 seconds. A missing session is a NORMAL lifecycle moment — it
  * warns and retries; it is never a red error.
  */
-type MessagingErrorCode = "session-unavailable" | "contention" | "forbidden" | "not-found" | "conflict" | "transport" | "invalid-response" | "misconfigured" | "unknown";
+type MessagingErrorCode = "session-unavailable" | "contention" | "forbidden" | "not-found" | "conflict" | "transport" | "invalid-response" | "misconfigured"
+/** A NEW conversation needs an organization to land in and none is selected. */
+ | "organization-required" | "unknown";
 declare class MessagingError extends Error {
     readonly code: MessagingErrorCode;
     /** The remedy. Nothing fails silently, and nothing fails without saying what to do. */
@@ -817,15 +823,21 @@ interface RepositoryOptions {
      */
     client: MessagingSupabaseClient;
     /**
-     * The active organization. Every conversation and message write carries it
-     * explicitly (R5).
+     * The active organization, or `null`/omitted when none is selected.
+     *
+     * 🚨 READS NEVER NEED IT (access belongs to the person, 2026-09-23). Every
+     * read here is answered by RLS as the session's user; the organization is
+     * only the DESTINATION of a NEW conversation. Without one, starting a
+     * conversation is refused with `organization-required` (the host asks the
+     * person to choose), and a message or member added to an EXISTING
+     * conversation is stamped with that conversation's own organization.
      *
      * 🚨 THERE IS NO `userId` HERE, AND THERE WILL NOT BE ONE (DD-241). Who is
      * acting is read from `client`'s own session — see `session-identity.ts` for
      * the class that closed and why a handed-in id could not be made safe by
      * convention. A caller that still passes `identity` is IGNORED and told so.
      */
-    organizationId: string;
+    organizationId?: string | null | undefined;
     /**
      * INTERNAL. The React provider already runs one session reader for its own
      * render loop and hands it here so the two cannot answer differently and so
@@ -846,8 +858,11 @@ interface RepositoryOptions {
     now?: (() => number) | undefined;
 }
 interface MessagingRepository {
-    /** The organization every write here is stamped with. */
-    readonly organizationId: OrganizationId;
+    /**
+     * The active organization new conversations land in, or `null` when none is
+     * selected — reads work either way.
+     */
+    readonly organizationId: OrganizationId | null;
     /**
      * Who the session says is acting — awaited, because the first `getSession()`
      * is a real read. Rejects with `session-unavailable` when nobody is signed
@@ -1004,11 +1019,18 @@ interface MessagingSnapshot {
     } | null;
     /** Conversations whose last open failed, keyed by id. Cleared on the next open. */
     readonly conversationReadFailures: ReadonlyMap<ConversationId, ConversationReadFailure>;
+    /**
+     * The inbox read FAILED (and no later read succeeded). Without it a failed
+     * first read left `hasLoadedConversations` false forever — a skeleton that
+     * never resolves is a screen telling a lie (RC-B12 round 11).
+     */
+    readonly conversationsLoadError: string | null;
 }
 interface MessagingStore {
     snapshot(): MessagingSnapshot;
     subscribe(listener: (snapshot: MessagingSnapshot) => void): () => void;
     setConversations(items: readonly ConversationSummary[], hasMore: boolean): void;
+    setConversationsLoadError(message: string | null): void;
     /**
      * Switch the archive axis. Clears the list and marks it UNLOADED: the rows
      * on screen belong to the old filter, and leaving them there while the new
@@ -1118,6 +1140,8 @@ interface MessagingEngine {
      * refreshes the archived count the reveal label prints.
      */
     setArchiveFilter(next: MessagingArchiveFilter): Promise<void>;
+    /** Read the inbox again (the failed-read view's Try again). Never throws; a failure lands in the snapshot. */
+    refreshInbox(): Promise<void>;
     /** Re-read how many archived conversations exist, for the reveal's label. */
     refreshArchivedCount(): Promise<void>;
     /** Open a conversation: load its thread and subscribe to its channel. */
@@ -1269,7 +1293,12 @@ interface MessagingProviderProps {
      * (DD-241). There is no `userId` prop, on purpose.
      */
     client: MessagingSupabaseClient | null | undefined;
-    /** The active organization. Every write carries it (R5). */
+    /**
+     * The active organization, or `null` when none is selected. Messaging runs
+     * without one: every read is the person's own. It is the destination of a
+     * NEW conversation (refused as `organization-required` without it) and of
+     * AI runs (the AI actions do not render without it).
+     */
     organizationId: string | null | undefined;
     /**
      * The Matrx API transport for AI features. Omit to run messaging without AI;
@@ -1356,6 +1385,10 @@ interface UseConversationsResult {
     hasMore: boolean;
     /** True only on the FIRST load; a refresh must not blank the list. */
     isInitialLoading: boolean;
+    /** The inbox read failed; the list shows the failure (never a skeleton forever, never "empty"). */
+    loadError: string | null;
+    /** Read the inbox again. */
+    retry: () => void;
     totalUnreadConversations: number;
     loadMore: () => void;
     select: (id: ConversationId) => void;
@@ -1778,9 +1811,13 @@ declare function formatLastSeen(lastSeenMs: number | null, now?: number): string
 
 declare function projectUserSummary(row: Record<string, unknown>): UserSummary;
 declare function projectMessageAction(value: unknown): MessageAction | null;
-declare function projectMessage(row: Record<string, unknown>, fallbackOrganizationId: OrganizationId): Message;
+declare function projectMessage(row: Record<string, unknown>, 
+/** The active organization, or `null` when none is selected (reads never need one). */
+fallbackOrganizationId: OrganizationId | null): Message;
 declare function projectParticipantRole(value: unknown): ParticipantRole;
-declare function projectConversationSummary(row: Record<string, unknown>, viewerId: UserId, fallbackOrganizationId: OrganizationId): ConversationSummary;
+declare function projectConversationSummary(row: Record<string, unknown>, viewerId: UserId, 
+/** The active organization, or `null` when none is selected (reads never need one). */
+fallbackOrganizationId: OrganizationId | null): ConversationSummary;
 
 /**
  * MATRX REFERENCES — a message can name a platform entity, and everything it

package/dist/react.js

@@ -762,7 +762,7 @@ function projectMessage(row, fallbackOrganizationId) {
     id: requiredStr(row, "id", operation),
     conversationId: requiredStr(row, "conversation_id", operation),
     senderId: requiredStr(row, "sender_id", operation),
-    organizationId: str(row, "organization_id") ?? fallbackOrganizationId,
+    organizationId: str(row, "organization_id") ?? fallbackOrganizationId ?? "",
     content: typeof row["content"] === "string" ? row["content"] : "",
     kind: MESSAGE_KINDS.has(kindRaw) ? kindRaw : "text",
     // A row read from the DB is at least `sent`. `sending`/`failed` are outbox
@@ -810,7 +810,7 @@ function projectConversationSummary(row, viewerId, fallbackOrganizationId) {
       groupName,
       groupImageUrl,
       createdBy: createdBy === null ? null : createdBy,
-      organizationId: str(row, "organization_id") ?? fallbackOrganizationId,
+      organizationId: str(row, "organization_id") ?? fallbackOrganizationId ?? "",
       createdAt,
       updatedAt,
       metadata: jsonObject(row["metadata"])
@@ -876,6 +876,7 @@ function createMessagingStore() {
   let threads = /* @__PURE__ */ new Map();
   let activeConversationId = null;
   let conversationReadFailures = /* @__PURE__ */ new Map();
+  let conversationsLoadError = null;
   const listeners = /* @__PURE__ */ new Set();
   let cached = null;
   function snapshot() {
@@ -889,7 +890,8 @@ function createMessagingStore() {
       totalUnreadConversations: conversations.filter((item) => item.unreadCount > 0).length,
       archiveFilter,
       archivedCount,
-      conversationReadFailures
+      conversationReadFailures,
+      conversationsLoadError
     };
     return cached;
   }
@@ -934,6 +936,12 @@ function createMessagingStore() {
       conversations = normalizeConversations(items);
       hasMoreConversations = hasMore;
       hasLoadedConversations = true;
+      conversationsLoadError = null;
+      emit();
+    },
+    setConversationsLoadError(message) {
+      if (message === conversationsLoadError) return;
+      conversationsLoadError = message;
       emit();
     },
     setArchiveFilter(next) {
@@ -1143,7 +1151,11 @@ function createMessagingEngine(options) {
           optimisticMessage({
             conversationId: entry.draft.conversationId,
             senderId: identity.userId,
-            organizationId: identity.organizationId,
+            // Client-only until the confirmed row replaces it: the active
+            // organization, else the conversation's own.
+            organizationId: identity.organizationId ?? store.snapshot().conversations.find(
+              (item) => item.conversation.id === entry.draft.conversationId
+            )?.conversation.organizationId ?? "",
             content: entry.draft.content,
             clientMessageId: entry.clientMessageId,
             ...entry.draft.kind !== void 0 ? { kind: entry.draft.kind } : {},
@@ -1162,10 +1174,20 @@ function createMessagingEngine(options) {
   }
   async function reloadInbox() {
     if (disposed) return;
-    const page = await repository.listConversations({
-      limit: conversationPageSize,
-      archived: store.snapshot().archiveFilter
-    });
+    let page;
+    try {
+      page = await repository.listConversations({
+        limit: conversationPageSize,
+        archived: store.snapshot().archiveFilter
+      });
+    } catch (error) {
+      if (!disposed) {
+        store.setConversationsLoadError(
+          error instanceof Error ? error.message : typeof error === "string" ? error : "The conversation list could not be read."
+        );
+      }
+      throw error;
+    }
     if (disposed) return;
     conversationCursor = page.nextCursor;
     store.setConversations(page.items, page.hasMore);
@@ -1250,6 +1272,13 @@ function createMessagingEngine(options) {
         }
       });
     },
+    async refreshInbox() {
+      try {
+        await reloadInbox();
+      } catch (error) {
+        reportError(error, "inboxRefresh");
+      }
+    },
     async setArchiveFilter(next) {
       if (next === store.snapshot().archiveFilter) return;
       store.setArchiveFilter(next);
@@ -1632,12 +1661,15 @@ var RPCS = {
 };
 var MESSAGE_COLUMNS = "id,conversation_id,sender_id,organization_id,content,message_type,status,reply_to_id,client_message_id,action_data,media_url,media_thumbnail_url,media_metadata,created_at,edited_at,deleted_at,deleted_for_everyone,metadata";
 var CONVERSATION_COLUMNS = "id,type,group_name,group_image_url,created_by,organization_id,created_at,updated_at,metadata";
+function optionalOrg(organizationId) {
+  return typeof organizationId === "string" && organizationId.length > 0 ? organizationId : null;
+}
 function requireOrg(organizationId, operation) {
-  if (typeof organizationId !== "string" || organizationId.length === 0) {
+  if (organizationId === null) {
     throw new MessagingError(
-      "misconfigured",
-      `${operation}: no organization_id`,
-      "Every conversation and message write carries an explicit organization_id (R5). Pass a real org on <MessagingProvider>; the package refuses the write rather than letting an unscoped row reach the database."
+      "organization-required",
+      `${operation}: no organization selected`,
+      "A new conversation is filed under one organization. Ask the person to choose one, then pass it as organizationId on <MessagingProvider>. Reading and replying to existing conversations never needs it."
     );
   }
   return organizationId;
@@ -1649,7 +1681,7 @@ function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, jittered));
 }
 function createMessagingRepository(options) {
-  const org = requireOrg(options.organizationId, "createMessagingRepository");
+  const org = optionalOrg(options.organizationId);
   const handedIn = options.identity;
   if (handedIn !== void 0 && handedIn !== null && handedIn.userId !== void 0) {
     options.onDiagnostic?.(
@@ -1719,6 +1751,11 @@ function createMessagingRepository(options) {
     });
     return found;
   }
+  async function organizationOfExisting(conversationId) {
+    if (org !== null) return org;
+    const conversation = await repository.getConversation(conversationId);
+    return conversation.organizationId;
+  }
   const repository = {
     organizationId: org,
     actingUserId,
@@ -1851,6 +1888,7 @@ function createMessagingRepository(options) {
     },
     async getOrCreateDirectConversation(otherUserId) {
       const operation = "getOrCreateDirectConversation";
+      const destination = requireOrg(org, operation);
       const me = await actingUser(operation);
       const id = await withSessionRetry(
         operation,
@@ -1862,7 +1900,7 @@ function createMessagingRepository(options) {
             // not a preference.
             p_user1_id: me,
             p_user2_id: otherUserId,
-            p_organization_id: org
+            p_organization_id: destination
           },
           operation
         )
@@ -1874,13 +1912,14 @@ function createMessagingRepository(options) {
     },
     async createGroupConversation({ name, memberIds }) {
       const operation = "createGroupConversation";
+      const destination = requireOrg(org, operation);
       const me = await actingUser(operation);
       const { data, error } = await withSessionRetry(
         operation,
         async () => db().from(TABLES.conversations).insert({
           type: "group",
           group_name: name,
-          organization_id: org,
+          organization_id: destination,
           created_by: me
         }).select("id").single()
       );
@@ -1895,7 +1934,7 @@ function createMessagingRepository(options) {
           conversation_id: conversationId,
           user_id: userId,
           role: userId === me ? "owner" : "member",
-          organization_id: org,
+          organization_id: destination,
           created_by: me
         }))
       );
@@ -1905,10 +1944,11 @@ function createMessagingRepository(options) {
     async insertMessage(draft, clientMessageId) {
       const operation = "insertMessage";
       const me = await actingUser(operation);
+      const destination = await organizationOfExisting(draft.conversationId);
       const { data, error } = await db().from(TABLES.messages).insert({
         conversation_id: draft.conversationId,
         sender_id: me,
-        organization_id: org,
+        organization_id: destination,
         created_by: me,
         content: draft.content,
         message_type: draft.kind ?? "text",
@@ -1969,12 +2009,13 @@ function createMessagingRepository(options) {
     async addMembers(conversationId, memberIds) {
       const operation = "addMembers";
       const me = await actingUser(operation);
+      const destination = await organizationOfExisting(conversationId);
       const { error } = await db().from(TABLES.participants).insert(
         memberIds.map((userId) => ({
           conversation_id: conversationId,
           user_id: userId,
           role: "member",
-          organization_id: org,
+          organization_id: destination,
           created_by: me
         }))
       );
@@ -2085,7 +2126,7 @@ function MessagingProvider(props) {
   }, [strayUserId]);
   const session = useSessionUserId(client, props.onDiagnostic);
   const userId = session.snapshot.userId;
-  const ready = client != null && userId !== null && typeof organizationId === "string" && organizationId.length > 0;
+  const ready = client != null && userId !== null;
   const hostProvidesRealtime = useIsRealtimeProviderMounted();
   const runtime = /* @__PURE__ */ jsx(
     MessagingRuntime,
@@ -2121,12 +2162,13 @@ function MessagingRuntime(props) {
       actionRegistry.register(handler);
     });
   }, [actionRegistry, handlers]);
-  const ready = client != null && manager !== null && sessionIdentity !== null && userId !== null && typeof organizationId === "string" && organizationId.length > 0;
+  const ready = client != null && manager !== null && sessionIdentity !== null && userId !== null;
+  const activeOrganizationId = typeof organizationId === "string" && organizationId.length > 0 ? organizationId : null;
   const engine = useMemo(() => {
     if (!ready || manager === null || sessionIdentity === null || userId === null) return null;
     const identity = {
       userId,
-      organizationId
+      organizationId: activeOrganizationId
     };
     const report = (event) => {
       (diagnosticRef.current ?? defaultDiagnostics)(event);
@@ -2137,7 +2179,7 @@ function MessagingRuntime(props) {
       // supabase-shape.ts); everything below this line works against the rich
       // contract, which `supabase-shape.test.ts` proves a real client honors.
       client,
-      organizationId,
+      organizationId: activeOrganizationId,
       // THE SAME READER the render loop above uses. Two readers would be two
       // answers during the tick an account switch takes.
       sessionIdentity,
@@ -2170,14 +2212,14 @@ function MessagingRuntime(props) {
       }
     });
     return built;
-  }, [ready, manager, sessionIdentity, userId, organizationId]);
+  }, [ready, manager, sessionIdentity, userId, activeOrganizationId]);
   useEffect(() => {
     if (engine === null) return void 0;
     void engine.start().catch((error) => {
       (diagnosticRef.current ?? defaultDiagnostics)({
         level: "error",
         message: `Messaging failed to start: ${String(error?.message ?? error)}`,
-        remedy: "Check the signed-in session and organization, then reload the surface."
+        remedy: "Check the signed-in session, then reload the surface."
       });
     });
     return () => {
@@ -2191,9 +2233,10 @@ function MessagingRuntime(props) {
   const sourceFeature = props.sourceFeature;
   const ai = useMemo(() => {
     if (transport === void 0 || agents === void 0 || !ready) return null;
+    if (activeOrganizationId === null) return null;
     return createMessagingAi({
       transport,
-      organizationId,
+      organizationId: activeOrganizationId,
       agents,
       ...maxTranscriptMessages !== void 0 ? { maxTranscriptMessages } : {},
       ...sourceApp !== void 0 ? { sourceApp } : {},
@@ -2203,7 +2246,7 @@ function MessagingRuntime(props) {
     transport,
     agents,
     ready,
-    organizationId,
+    activeOrganizationId,
     maxTranscriptMessages,
     sourceApp,
     sourceFeature
@@ -2254,7 +2297,7 @@ function useRequiredMessagingHost() {
   const host = useMessagingHost();
   if (host === null) {
     throw new Error(
-      "[@ai-matrx/messaging] No messaging host. Wrap this tree in <MessagingProvider client={supabase} userId={userId} organizationId={orgId}> and render it only once auth has resolved."
+      "[@ai-matrx/messaging] No messaging host. Wrap this tree in <MessagingProvider client={supabase} organizationId={orgId}> and render it only once auth has resolved."
     );
   }
   return host;
@@ -2379,7 +2422,11 @@ function useConversations() {
     hasMore: snapshot?.hasMoreConversations ?? false,
     // "Not loaded yet" is a FACT from the store, never a guess. Showing
     // "No conversations yet" before the first read is a screen telling a lie.
-    isInitialLoading: snapshot === null || !snapshot.hasLoadedConversations,
+    isInitialLoading: snapshot === null || !snapshot.hasLoadedConversations && snapshot.conversationsLoadError === null,
+    loadError: snapshot?.conversationsLoadError ?? null,
+    retry: () => {
+      void host?.engine.refreshInbox();
+    },
     totalUnreadConversations: snapshot?.totalUnreadConversations ?? 0,
     loadMore: () => {
       void host?.engine.loadMoreConversations();
@@ -2644,7 +2691,8 @@ function useMessageAction(message) {
       const context = {
         messageId: message.id,
         actorId: host.identity.userId,
-        organizationId: host.identity.organizationId,
+        // The active organization, else the organization the message lives in.
+        organizationId: host.identity.organizationId ?? message.organizationId,
         choice
       };
       host.actions.execute(action, context).then(setReceipt).catch((cause) => {
@@ -2965,6 +3013,7 @@ function EmptyState(props) {
 }
 
 // src/react/components.tsx
+import { ErrorBox } from "@ai-matrx/design-system";
 import { Fragment, jsx as jsx4, jsxs as jsxs2 } from "react/jsx-runtime";
 var AI_LABELS = {
   catchUp: "Catch me up",
@@ -2982,7 +3031,9 @@ function ConversationList(props) {
     activeConversationId,
     archiveFilter,
     setArchiveFilter,
-    archivedCount
+    archivedCount,
+    loadError,
+    retry
   } = useConversations();
   const RowChrome = useMessagingHost()?.wrapConversationRow ?? null;
   const [query, setQuery] = useState2("");
@@ -3047,7 +3098,20 @@ function ConversationList(props) {
       }
     ) }) : null,
     /* @__PURE__ */ jsxs2("div", { className: "mx-msg__scroll", children: [
-      isInitialLoading ? /* @__PURE__ */ jsx4(ConversationSkeleton, {}) : visible.length === 0 ? /* @__PURE__ */ jsx4(
+      isInitialLoading ? /* @__PURE__ */ jsx4(ConversationSkeleton, {}) : loadError !== null && visible.length === 0 ? (
+        // A failed read resolves to the failure — never a skeleton forever,
+        // never "No conversations yet" (RC-B12 round 11). ErrorBox is the
+        // design-system error slot: the host fills it with its menu.
+        /* @__PURE__ */ jsx4(
+          ReadFailureBox,
+          {
+            title: "Couldn't load your conversations",
+            message: loadError,
+            operation: "List your conversations",
+            onRetry: retry
+          }
+        )
+      ) : visible.length === 0 ? /* @__PURE__ */ jsx4(
         EmptyState,
         {
           title: query.length > 0 ? "No matches" : showingArchive ? "No archived conversations" : "No conversations yet",
@@ -3224,10 +3288,11 @@ function ConversationView(props) {
         body: "It doesn't exist, or you aren't a member of it."
       }
     ) : conversation.error !== null && messages.length === 0 ? /* @__PURE__ */ jsx4(
-      EmptyState,
+      ReadFailureBox,
       {
         title: "Couldn't load this conversation",
-        body: "Check your connection, then open it again."
+        message: conversation.error.message || "Check your connection, then open it again.",
+        operation: "Open this conversation"
       }
     ) : messages.length === 0 ? /* @__PURE__ */ jsx4(EmptyState, { title: "No messages yet", body: "Say something to get started." }) : /* @__PURE__ */ jsxs2("div", { className: "mx-msg__messages", children: [
       conversation.hasMoreOlder ? /* @__PURE__ */ jsx4(
@@ -3558,6 +3623,29 @@ function MessagingInbox(props) {
     }
   );
 }
+function ReadFailureBox({
+  title,
+  message,
+  operation,
+  onRetry
+}) {
+  return /* @__PURE__ */ jsxs2("div", { className: "mx-msg__empty", role: "alert", children: [
+    /* @__PURE__ */ jsx4(
+      ErrorBox,
+      {
+        as: "div",
+        title,
+        message,
+        operation,
+        origin: "messaging",
+        style: { color: "var(--mx-msg-danger)", fontWeight: 600 },
+        children: title
+      }
+    ),
+    /* @__PURE__ */ jsx4("p", { children: message }),
+    onRetry ? /* @__PURE__ */ jsx4("button", { type: "button", className: "mx-msg__button mx-msg__button--ghost", onClick: onRetry, children: "Try again" }) : null
+  ] });
+}
 export {
   AgentTag,
   AlertIcon,