[NO QA] Coerce instanceID to string in CSV company-card import to fix legacy-feed rejection

[MelvinBot]

Explanation of Change

CSV company-card transaction imports fail with the generic error "Please ensure all fields are filled out correctly and try again…" when re-importing into a pre-existing (legacy) feed. The failure is unrelated to the CSV contents — the request is rejected before any row is parsed.

Root cause: importCSVCompanyCards sends instanceID in the request settings payload. existingInstanceID is typed as a string, but for legacy feeds the value stored in Onyx/NVP can actually be a number at runtime. Because the code used existingInstanceID ?? Date.now().toString(), ?? only substitutes on null/undefined, so a numeric value passes straight through and JSON.stringify emits it as a bare number ("instanceID":1745351414130 instead of "instanceID":"1745351414130"). The backend reads instanceID with a string-only accessor, treats the numeric value as empty, and rejects the request as missing a required field.

This is why the bug only reproduces on legacy feeds with a stored numeric instanceID: the Add New Card wizard has no existingInstanceID and falls back to Date.now().toString(), a genuine string the backend accepts — so clean test accounts never hit it.

Fix: coerce existingInstanceID to a string before it is sent, so a numeric legacy value is serialized as a string. No data migration required.

Fixed Issues

$ #94178
PROPOSAL: #94178 (comment)

Tests

// TODO: The human co-author must fill out the tests you ran before marking this PR as "ready for review".
// Please describe what tests you performed that validate your change worked.

• Verify that no errors appear in the JS console

Offline tests

• Verify that no errors appear in the JS console

QA Steps

// TODO: The human co-author must fill out the QA tests you ran before marking this PR as "ready for review".
// Please describe what QA needs to do to validate your changes and what areas they need to test for regressions.

• Verify that no errors appear in the JS console

PR Author Checklist

• I linked the correct issue in the ### Fixed Issues section above
• I wrote clear testing steps that cover the changes made in this PR
  • I added steps for local testing in the Tests section
  • I added steps for the expected offline behavior in the Offline steps section
  • I added steps for Staging and/or Production testing in the QA steps section
  • I added steps to cover failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
  • I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)
  • I tested this PR with a High Traffic account against the staging or production API to ensure there are no regressions (e.g. long loading states that impact usability).
• I included screenshots or videos for tests on all platforms
• I ran the tests on all platforms & verified they passed on:
  • Android: Native
  • Android: mWeb Chrome
  • iOS: Native
  • iOS: mWeb Safari
  • MacOS: Chrome / Safari
• I verified there are no console errors (if there's a console error not related to the PR, report it or open an issue for it to be fixed)
• I followed proper code patterns (see Reviewing the code)
  • I verified that comments were added to code that is not self explanatory
  • I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
  • I verified any copy / text that was added to the app is grammatically correct in English. It adheres to proper capitalization guidelines (note: only the first word of header/labels should be capitalized), and is either coming verbatim from figma or has been approved by marketing (in order to get marketing approval, ask the Bug Zero team member to add the Waiting for copy label to the issue)
• If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
• I followed the guidelines as stated in the Review Guidelines
• I tested other components that can be impacted by my changes (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar are working as expected)
• If a new CSS style is added I verified that:
  • A similar style doesn't already exist
  • The style can't be created with an existing StyleUtils function (i.e. StyleUtils.getBackgroundAndBorderStyle(theme.componentBG))
• If new assets were added or existing ones were modified, I verified that:
  • The assets are optimized and compressed (for SVG files, run npm run compress-svg)
  • The assets load correctly across all supported platforms.
• If the PR modifies code that runs when editing or sending messages, I tested and verified there is no unexpected behavior for all supported markdown - URLs, single line code, code blocks, quotes, headings, bold, strikethrough, and italic.
• If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
• If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
• If the PR modifies a component or page that can be accessed by a direct deeplink, I verified that the code functions as expected when the deeplink is used - from a logged in and logged out account.
• If the PR modifies the UI (e.g. new buttons, new UI components, changing the padding/spacing/sizing, moving components, etc) or modifies the form input styles:
  • I verified that all the inputs inside a form are aligned with each other.
  • I added Design label and/or tagged @Expensify/design so the design team can review the changes.
• I added unit tests for any new feature or bug fix in this PR to help automatically prevent regressions in this user flow.
• If the main branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the Test steps.

Screenshots/Videos

Android: Native

Android: mWeb Chrome

iOS: Native

iOS: mWeb Safari

MacOS: Chrome / Safari

[MelvinBot]

I created this PR from an upstream branch since I don't have push access to your fork.

To take ownership of this branch and be able to push updates, run:

git remote add upstream https://github.com/Expensify/App.git
git fetch upstream claude-coerce-instanceid-string
git checkout -b claude-coerce-instanceid-string upstream/claude-coerce-instanceid-string
git push -u origin claude-coerce-instanceid-string

Then you can close this PR and open a new one from your fork.

[codecov]

Codecov Report

✅ Changes either increased or maintained existing code coverage, great job!

Files with missing lines	Coverage Δ
src/libs/actions/CompanyCards.ts	0.00% <0.00%> (ø)
... and 13 files with indirect coverage changes

[MelvinBot]

I analyzed the checks — there's no code-related failure to fix.

The only failing check is PR Author Checklist / checklist, and its log shows why:

You completed 0 out of 38 checklist items with 12 unfinished items
##[error]PR Author Checklist is not completely filled out.

This is the human author checklist, not a CI/test failure. It's failing because the ### Tests and ### QA Steps sections still have the // TODO: The human co-author must fill out… placeholders and none of the checklist boxes are ticked. I can't complete these on your behalf — they require the human co-author to confirm the testing/QA that was actually performed.

To clear it, cretadn22 needs to fill out the Tests / QA steps and tick the PR Author Checklist boxes.

Every real CI check has passed, including the ones relevant to this change:

• ✅ typecheck, ESLint check, Oxfmt check, React Compiler Compliance
• ✅ All 8 test (job N) jobs, Bun tests, Storybook tests
• ✅ build variants, spellcheck, knip, Check for unused styles

(The baseline-perf-tests / branch-perf-tests jobs were still running at analysis time — they're informational benchmarks and don't block merge.)

So nothing to push here — the failing check just needs the author checklist filled in by a human.

[cretadn22]

@MelvinBot Mark this PR as ready

[melvin-bot]

@cretadn22 Please copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button]

[MelvinBot]

🤖 Done — this PR is now marked Ready for review (no longer a draft).

[cretadn22]

Reviewer Checklist

• I have verified the author checklist is complete (all boxes are checked off).
• I verified the correct issue is linked in the ### Fixed Issues section above
• I verified testing steps are clear and they cover the changes made in this PR
  • I verified the steps for local testing are in the Tests section
  • I verified the steps for Staging and/or Production testing are in the QA steps section
  • I verified the steps cover any possible failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
  • I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)
• I checked that screenshots or videos are included for tests on all platforms
• I included screenshots or videos for tests on all platforms
• I verified that the composer does not automatically focus or open the keyboard on mobile unless explicitly intended. This includes checking that returning the app from the background does not unexpectedly open the keyboard.
• I verified tests pass on all platforms & I tested again on:
  • Android: HybridApp
  • Android: mWeb Chrome
  • iOS: HybridApp
  • iOS: mWeb Safari
  • MacOS: Chrome / Safari
• If there are any errors in the console that are unrelated to this PR, I either fixed them (preferred) or linked to where I reported them in Slack
• I verified proper code patterns were followed (see Reviewing the code)
  • I verified that any callback methods that were added or modified are named for what the method does and never what callback they handle (i.e. toggleReport and not onIconClick).
  • I verified that comments were added to code that is not self explanatory
  • I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
  • I verified any copy / text that was added to the app is grammatically correct in English. It adheres to proper capitalization guidelines (note: only the first word of header/labels should be capitalized), and is either coming verbatim from figma or has been approved by marketing (in order to get marketing approval, ask the Bug Zero team member to add the Waiting for copy label to the issue)
• If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
• I verified that this PR follows the guidelines as stated in the Review Guidelines
• I verified other components that can be impacted by these changes have been tested, and I retested again (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar have been tested & I retested again)
• If a new component is created I verified that:
  • A similar component doesn't exist in the codebase
  • All props are defined accurately and each prop has a /** comment above it */
  • The file is named correctly
  • The component has a clear name that is non-ambiguous and the purpose of the component can be inferred from the name alone
  • The only data being stored in the state is data necessary for rendering and nothing else
  • For Class Components, any internal methods passed to components event handlers are bound to this properly so there are no scoping issues (i.e. for onClick={this.submit} the method this.submit should be bound to this in the constructor)
  • Any internal methods bound to this are necessary to be bound (i.e. avoid this.submit = this.submit.bind(this); if this.submit is never passed to a component event handler like onClick)
  • All JSX used for rendering exists in the render method
  • The component has the minimum amount of code necessary for its purpose, and it is broken down into smaller components in order to separate concerns and functions
• If any new file was added I verified that:
  • The file has a description of what it does and/or why is needed at the top of the file if the code is not self explanatory
• If a new CSS style is added I verified that:
  • A similar style doesn't already exist
  • The style can't be created with an existing StyleUtils function (i.e. StyleUtils.getBackgroundAndBorderStyle(theme.componentBG)
• If the PR modifies code that runs when editing or sending messages, I tested and verified there is no unexpected behavior for all supported markdown - URLs, single line code, code blocks, quotes, headings, bold, strikethrough, and italic.
• If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
• If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
• If the PR modifies a component or page that can be accessed by a direct deeplink, I verified that the code functions as expected when the deeplink is used - from a logged in and logged out account.
• If the PR modifies the UI (e.g. new buttons, new UI components, changing the padding/spacing/sizing, moving components, etc) or modifies the form input styles:
  • I verified that all the inputs inside a form are aligned with each other.
  • I added Design label and/or tagged @Expensify/design so the design team can review the changes.
• For any bug fix or new feature in this PR, I verified that sufficient unit tests are included to prevent regressions in this flow.
• If the main branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the Test steps.
• I have checked off every checkbox in the PR reviewer checklist, including those that don't apply to this PR.

Screenshots/Videos

Android: HybridApp

Screen.Recording.2026-07-09.at.20.19.43.mov

Android: mWeb Chrome

Screen.Recording.2026-07-09.at.20.12.51.mov

iOS: HybridApp

Screen.Recording.2026-07-09.at.20.20.05.mov

iOS: mWeb Safari

Screen.Recording.2026-07-09.at.20.20.39.mov

MacOS: Chrome / Safari

Screen.Recording.2026-07-09.at.20.10.01.mov

[cretadn22]

@blimpich Could you mind completing the author checklist (because I can't edit)? Additionally, it might be worth generating an ad-hoc build so @VictoriaExpensify can test it on her account

Testing Steps:

1. Navigate to Workspace > Company Cards.
2. Click Add Card.
3. Select a bank/card feed option.
4. Click Import transactions from file.
5. Upload a CSV file containing card transactions.
6. Map all required columns correctly. (The CSV columns were mapped correctly during the import flow.)
7. Complete the import process.

[github-actions]

🚧 blimpich has triggered a test Expensify/App build. You can view the workflow run here.

[MelvinBot]

🤖 I analyzed the failing checks — there's no code fix to push here.

The only failing check is the PR Author Checklist (checklist / authorChecklist.ts). Every other check (tests, typecheck, ESLint, build, perf, etc.) is passing.

The checklist action reports:

You completed 12 out of 38 checklist items with 0 unfinished items
PR Author Checklist is not completely filled out.

There are no unchecked boxes (0 unfinished items) — the failure is that the action expects 38 items but the PR body only contains 12. The dynamically-generated checklist items (added based on the files changed in this PR) aren't present in the description, so the action counts them as incomplete.

This is a human-owned checklist, not a code or test failure, so it isn't something I can "fix" by pushing a commit. To clear it, the human co-author needs to update the PR description using the most up-to-date template (PULL_REQUEST_TEMPLATE.md) and check every box — including the dynamic items the action generated for the changed files.

cretadn22 once the checklist is filled out and re-run, this PR should be all green.

[github-actions]

🧪🧪 Use the links below to test this adhoc build on Android, iOS, and Web. Happy testing! 🧪🧪
Built from App PR #95695.

Android 🤖	iOS 🍎
https://ad-hoc-expensify-cash.s3.us-east-1.amazonaws.com/rock-artifacts/ad-hoc/rock-android-Adhoc-6372cc93764-54ebcb2-bb03a9a097ae6971890bb609205dcc99c2ae9d35/index.html	https://ad-hoc-expensify-cash.s3.us-east-1.amazonaws.com/rock-artifacts/ad-hoc/rock-ios-device-AdHoc-6372cc9-54ebcb2-2fe837f51686cdd50045ab0ac2131f31c870dc92/index.html

Web 🕸️
https://95695.pr-testing.expensify.com

---

👀 View the workflow run that generated this build 👀

[blimpich]

@cretadn22 given this comment and how we'd need a "legacy" feed I think we just mark this as NO QA and ship it and then ask the customer if it's fixed for them. I don't think @VictoriaExpensify reproduced this issue personally

[MelvinBot]

🤖 Re-checked — the situation is unchanged. The only failing check is still the PR Author Checklist (checklist / authorChecklist.ts); every code, test, lint, typecheck, build, and perf check is green.

You completed 12 out of 38 checklist items with 0 unfinished items
PR Author Checklist is not completely filled out.

There's no code fix to push here. This isn't a bug in the change — the author checklist in the PR description is stale relative to the current PULL_REQUEST_TEMPLATE.md (12 items present, 38 expected), so the action counts the missing items as incomplete.

This is a human-owned verification gate — several items (offline testing, high-traffic-account testing, etc.) attest that a person actually performed those checks, so I won't tick them on a human's behalf. To turn it green, the human co-author (cretadn22) needs to:

1. Replace the checklist section of the PR description with the current template above.
2. Genuinely verify and check every box.

Once that's done the checklist check will pass on its next run.

[OSBotify]

✋ This PR was not deployed to staging yet because QA is ongoing. It will be automatically deployed to staging after the next production release.

[MelvinBot]

🤖 I re-checked — there is still no code fix to push. The only failing check is the PR Author Checklist; every test, lint, typecheck, build, and perf check passes.

The checklist / authorChecklist.ts action reports:

You completed 12 out of 38 checklist items with 0 unfinished items
PR Author Checklist is not completely filled out.

0 unfinished items means there are no unchecked boxes — the failure is that the PR description only contains 12 of the 38 checklist items the current template requires. The description was created from an outdated/partial checklist, so 26 required items (including the dynamic, file-based ones) are missing entirely.

I can't resolve this by pushing a commit, and I won't check these boxes for you — they are human attestations ("I tested this offline", "I tested with a High Traffic account", etc.) that only the human co-author can truthfully confirm.

To clear the check, the human co-author needs to:

1. Copy the current checklist from PULL_REQUEST_TEMPLATE.md into this PR's description.
2. Check every box after verifying each item.
3. The checklist check re-runs automatically on the edit and should go green.

cretadn22 once the description is updated, this PR should be all green.

[OSBotify]

🚀 Deployed to staging by https://github.com/blimpich in version: 9.4.33-0 🚀

platform	result
🕸 web 🕸	success ✅
🤖 android 🤖	success ✅
🍎 iOS 🍎	cancelled 🔪

[MelvinBot]

🤖 Help site review: no docs changes required.

I reviewed this PR against the help articles under App/docs/articles and no updates are needed.

Why: This is a purely internal bug fix. It coerces existingInstanceID to a string (existingInstanceID ? String(existingInstanceID) : Date.now().toString()) so that a legacy feed's numeric instanceID is serialized correctly and no longer rejected by the backend. It changes no user-facing behavior, UI, feature flow, tab/setting labels, or copy — it simply restores the already-documented CSV company-card import flow for legacy feeds.

The relevant article, Import Company Card Transactions From a Spreadsheet, already describes the import and "upload additional transactions to an existing card feed" steps accurately, and its error/troubleshooting FAQ is about file contents/formatting — not this backend rejection. Nothing in it becomes inaccurate as a result of this change, so there's no draft PR to open.

@cretadn22, please review the linked help site PR and confirm it reflects the current behavior. Then mark the linked help site PR Ready for review — in this case no help site PR was created since no changes are required.