{"record":{"id":"39716a89cb06c145","repo":"tailscale/tailscale","slug":"aum-with-parent-x-cannot-be-applied-to-a-state-wi","errorCode":null,"errorMessage":"aum with parent %x cannot be applied to a state with parent %x","messagePattern":"aum with parent %x cannot be applied to a state with parent %x","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"tka/tka.go","lineNumber":465,"sourceCode":"\tif aum.MessageKind == AUMRemoveKey && len(state.Keys) == 1 {\n\t\tif kid, err := state.Keys[0].ID(); err == nil && bytes.Equal(aum.KeyID, kid) {\n\t\t\treturn errors.New(\"cannot remove the last key in the state\")\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc checkParent(aum AUM, state State) error {\n\tparent, hasParent := aum.Parent()\n\tif !hasParent {\n\t\treturn errors.New(\"aum has no parent\")\n\t}\n\tif state.LastAUMHash == nil {\n\t\treturn errors.New(\"cannot check update parent hash against a state with no previous AUM\")\n\t}\n\tif *state.LastAUMHash != parent {\n\t\treturn fmt.Errorf(\"aum with parent %x cannot be applied to a state with parent %x\", state.LastAUMHash, parent)\n\t}\n\treturn nil\n}\n\n// Head returns the AUM digest of the latest update applied to the state\n// machine.\nfunc (a *Authority) Head() AUMHash {\n\treturn *a.state.LastAUMHash\n}\n\n// Open initializes an existing TKA from the given tailchonk.\n//\n// Only use this if the current node has initialized an Authority before.\n// If a TKA exists on other nodes but there's nothing locally, use Bootstrap().\n// If no TKA exists anywhere and you are creating it for the first\n// time, use New().\nfunc Open(storage Chonk) (*Authority, error) {\n\ta, err := storage.LastActiveAncestor()","sourceCodeStart":447,"sourceCodeEnd":483,"githubUrl":"https://github.com/tailscale/tailscale/blob/6e0912f97994f927632b34ae9e63b53d6516a6ac/tka/tka.go#L447-L483","documentation":"Raised by checkParent when an AUM's parent hash does not equal state.LastAUMHash: the update claims to chain onto a different predecessor than the state it is being verified against. This indicates a fork, an out-of-order update, or an AUM applied to stale state.","triggerScenarios":"Thrown at tka/tka.go:465 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Recompute the state at the AUM's actual parent (computeStateAt on aum.Parent()) instead of assuming the current head","For legitimate forks, let fork-resolution logic (hash/signature-weight ordering) pick the winning chain","Drop updates that reference parents not present in storage"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6e0912f97994f927632b34ae9e63b53d6516a6ac","analyzedAt":"2026-08-18T08:17:25.280Z","contentChangedAt":"2026-08-18T08:17:25.280Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}