tailscale/tailscale · error

aum with parent %x cannot be applied to a state with parent

Error message

aum with parent %x cannot be applied to a state with parent %x

What it means

Raised by checkParent when an AUM's parent hash does not equal state.LastAUMHash: the update claims to chain onto a different predecessor than the state it is being verified against. This indicates a fork, an out-of-order update, or an AUM applied to stale state.

Source

Thrown at tka/tka.go:465

	if aum.MessageKind == AUMRemoveKey && len(state.Keys) == 1 {
		if kid, err := state.Keys[0].ID(); err == nil && bytes.Equal(aum.KeyID, kid) {
			return errors.New("cannot remove the last key in the state")
		}
	}

	return nil
}

func checkParent(aum AUM, state State) error {
	parent, hasParent := aum.Parent()
	if !hasParent {
		return errors.New("aum has no parent")
	}
	if state.LastAUMHash == nil {
		return errors.New("cannot check update parent hash against a state with no previous AUM")
	}
	if *state.LastAUMHash != parent {
		return fmt.Errorf("aum with parent %x cannot be applied to a state with parent %x", state.LastAUMHash, parent)
	}
	return nil
}

// Head returns the AUM digest of the latest update applied to the state
// machine.
func (a *Authority) Head() AUMHash {
	return *a.state.LastAUMHash
}

// Open initializes an existing TKA from the given tailchonk.
//
// Only use this if the current node has initialized an Authority before.
// If a TKA exists on other nodes but there's nothing locally, use Bootstrap().
// If no TKA exists anywhere and you are creating it for the first
// time, use New().
func Open(storage Chonk) (*Authority, error) {
	a, err := storage.LastActiveAncestor()

View on GitHub (pinned to 6e0912f979)

Solutions

1. Recompute the state at the AUM's actual parent (computeStateAt on aum.Parent()) instead of assuming the current head
2. For legitimate forks, let fork-resolution logic (hash/signature-weight ordering) pick the winning chain
3. Drop updates that reference parents not present in storage

When it happens

Trigger: Thrown at tka/tka.go:465 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/39716a89cb06c145. Report an issue: GitHub.