{"record":{"id":"3f319eff141c2aaf","repo":"opentofu/opentofu","slug":"lock-id-q-does-not-match-existing-lock-id-s-s","errorCode":null,"errorMessage":"lock ID %q does not match existing lock ID \"%s/%s\"","messagePattern":"lock ID %q does not match existing lock ID \"(.+?)/(.+?)\"","errorType":"exception","errorClass":"statemgr.LockError","httpStatus":null,"severity":"error","filePath":"internal/backend/remote/backend_state.go","lineNumber":212,"sourceCode":"\t\t// Verify the expected lock ID.\n\t\tif r.lockInfo.ID != id {\n\t\t\tlockErr.Err = fmt.Errorf(\"lock ID does not match existing lock\")\n\t\t\treturn lockErr\n\t\t}\n\n\t\t// Unlock the workspace.\n\t\t_, err := r.client.Workspaces.Unlock(ctx, r.workspace.ID)\n\t\tif err != nil {\n\t\t\tlockErr.Err = err\n\t\t\treturn lockErr\n\t\t}\n\n\t\treturn nil\n\t}\n\n\t// Verify the optional force-unlock lock ID.\n\tif r.organization+\"/\"+r.workspace.Name != id {\n\t\tlockErr.Err = fmt.Errorf(\n\t\t\t\"lock ID %q does not match existing lock ID \\\"%s/%s\\\"\",\n\t\t\tid,\n\t\t\tr.organization,\n\t\t\tr.workspace.Name,\n\t\t)\n\t\treturn lockErr\n\t}\n\n\t// Force unlock the workspace.\n\t_, err := r.client.Workspaces.ForceUnlock(ctx, r.workspace.ID)\n\tif err != nil {\n\t\tlockErr.Err = err\n\t\treturn lockErr\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":194,"sourceCodeEnd":230,"githubUrl":"https://github.com/opentofu/opentofu/blob/3561785c48c1ce615e7c50261bd351f26053efa2/internal/backend/remote/backend_state.go#L194-L230","documentation":"In the force-unlock path where the client has no in-process lock info (r.lockInfo == nil), the remote backend only accepts the composite lock ID \"organization/workspace-name\". Any other value — for example a UUID-style lock ID from the local backend — is rejected, with the expected ID echoed inside the message.","triggerScenarios":"tofu force-unlock <id> against a remote backend workspace where <id> is not the exact \"ORG/WORKSPACE\" string, e.g. a UUID copied from a local-backend lock error or the workspace's internal ID used instead of its name.","commonSituations":"Pasting a lock ID from a different backend type; using the workspace ID (ws-xxxx) instead of its name; wrong organization name or casing; trailing whitespace in the ID argument.","solutions":["Run force-unlock with the exact \"ORG/WORKSPACE-NAME\" string shown between the quotes in this error.","Double-check the organization and workspace names in your backend block for typos and casing.","If the CLI still rejects it, unlock via the workspace UI (Settings > Locking)."],"exampleFix":"# before: local-style UUID used against a remote workspace\ntofu force-unlock 2b002e2c-91f7-4d9f-a4a3-fbe7ff205e35\n\n# after: the composite org/workspace lock ID from the error message\ntofu force-unlock \"my-org/prod\"","handlingStrategy":"validation","validationCode":"// Build and verify the expected force-unlock ID before invoking it\nexpected := fmt.Sprintf(\"%s/%s\", organization, workspaceName)\nif unlockID != expected {\n    return fmt.Errorf(\"expected lock ID %q, got %q — remote backend force-unlock takes ORG/WORKSPACE\", expected, unlockID)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Remember the remote backend lock ID format is ORG/WORKSPACE-NAME, not a UUID.","Copy the ID verbatim from between the quotes in the error message.","Prefer UI unlock when the CLI rejects the ID repeatedly."],"tags":["force-unlock","state-lock","remote-backend","id-mismatch"],"backgroundTag":null,"analyzedSha":"3561785c48c1ce615e7c50261bd351f26053efa2","analyzedAt":"2026-08-15T23:27:16.226Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}