{"record":{"id":"e762e4e866555d8c","repo":"nats-io/nats-server","slug":"errors-new-strings-join-errs-n","errorCode":null,"errorMessage":"errors.New(strings.Join(errs, \"\\n\"))","messagePattern":"errors\\.New\\(strings\\.Join\\(errs, \"\\\\n\"\\)\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/accounts.go","lineNumber":4408,"sourceCode":"\t}\n\tif err != nil {\n\t\trespondToUpdate(s, reply, _EMPTY_, fmt.Sprintf(\"delete accounts request by %s failed\", subj), err)\n\t\treturn\n\t}\n\terrs := []string{}\n\tpassCnt := 0\n\tfor _, acc := range accIds {\n\t\tif err := store.delete(acc.(string)); err != nil {\n\t\t\terrs = append(errs, err.Error())\n\t\t} else {\n\t\t\tpassCnt++\n\t\t}\n\t}\n\tif len(errs) == 0 {\n\t\trespondToUpdate(s, reply, _EMPTY_, fmt.Sprintf(\"deleted %d accounts\", passCnt), nil)\n\t} else {\n\t\trespondToUpdate(s, reply, _EMPTY_, fmt.Sprintf(\"deleted %d accounts, failed for %d\", passCnt, len(errs)),\n\t\t\terrors.New(strings.Join(errs, \"\\n\")))\n\t}\n}\n\nfunc getOperatorKeys(s *Server) (string, map[string]struct{}, bool, error) {\n\tvar op string\n\tvar strict bool\n\tkeys := make(map[string]struct{})\n\tif opts := s.getOpts(); opts != nil && len(opts.TrustedOperators) > 0 {\n\t\top = opts.TrustedOperators[0].Subject\n\t\tstrict = opts.TrustedOperators[0].StrictSigningKeyUsage\n\t\tif !strict {\n\t\t\tkeys[opts.TrustedOperators[0].Subject] = struct{}{}\n\t\t}\n\t\tfor _, key := range opts.TrustedOperators[0].SigningKeys {\n\t\t\tkeys[key] = struct{}{}\n\t\t}\n\t}\n\tif len(keys) == 0 {","sourceCodeStart":4390,"sourceCodeEnd":4426,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/accounts.go#L4390-L4426","documentation":"Returned by consumerMemStore.Update when a pending entry's sequence is outside the valid window: it must be strictly greater than AckFloor.Stream and not exceed Delivered.Stream. A pending sequence at/below the ack floor means it was already acknowledged; one beyond delivered means it was never delivered. Either case indicates a corrupt state.","triggerScenarios":"Calling consumerMemStore.Update with state.Pending containing a sequence seq where seq <= AckFloor.Stream or seq > Delivered.Stream.","commonSituations":"Stale pending maps not pruned after acks; state reconstructed from partial snapshots; double-applied redelivery state in clustered failover.","solutions":["Prune pending entries with seq <= AckFloor.Stream before Update","Drop pending entries with seq > Delivered.Stream or fix the delivered sequence","Rebuild the pending set from actual unacknowledged deliveries"],"exampleFix":"// before\nst.Pending[40] = &Pending{40, ts} // ack floor is 50\nconsumer.Update(st)\n// after\nfor seq := range st.Pending {\n    if seq <= st.AckFloor.Stream || seq > st.Delivered.Stream {\n        delete(st.Pending, seq)\n    }\n}\nconsumer.Update(st)","handlingStrategy":"validation","validationCode":"for seq := range st.Pending {\n    if seq <= st.AckFloor.Stream || seq > st.Delivered.Stream {\n        delete(st.Pending, seq)\n    }\n}\nconsumer.Update(st)","typeGuard":null,"tryCatchPattern":"if err := consumer.Update(st); err != nil {\n    if strings.Contains(err.Error(), \"bad pending entry\") {\n        // prune out-of-range pending and retry once\n    }\n}","preventionTips":["Prune pending on every ack that advances the stream ack floor","Treat pending as a set strictly inside (ackFloor, delivered]","Validate state from snapshots/peers before applying"],"tags":["jetstream","consumer-state","pending","validation"],"backgroundTag":"invalid-pending-sequence","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}