This is a bit more boilerplate because of painful impedance mismatch (is
augroup names the root source of truth? is ids the source of truth? who
knows? what does truth even mean?), but show an error reflecting what
the caller actually tried (they passed in an invalid id, not a null
string)