From 4c67df42f67190b6e4d65341562b17f6c502ce60 Mon Sep 17 00:00:00 2001
From: Alex Chan <alexc@tailscale.com>
Date: Mon, 10 Nov 2025 12:03:41 +0000
Subject: [PATCH] tka: log a better error if there are no chain candidates

Previously if `chains` was empty, it would be passed to `computeActiveAncestor()`,
which would fail with the misleading error "multiple distinct chains".

Updates tailscale/corp#33846

Signed-off-by: Alex Chan <alexc@tailscale.com>
Change-Id: Ib93a755dbdf4127f81cbf69f3eece5a388db31c8
---
 tka/tka.go | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tka/tka.go b/tka/tka.go
index a8144e96f..c34e35e7b 100644
--- a/tka/tka.go
+++ b/tka/tka.go
@@ -391,6 +391,10 @@ func computeActiveChain(storage Chonk, lastKnownOldest *AUMHash, maxIter int) (c
 		return chain{}, fmt.Errorf("computing candidates: %v", err)
 	}
 
+	if len(chains) == 0 {
+		return chain{}, errors.New("no chain candidates in AUM storage")
+	}
+
 	// Find the right ancestor.
 	oldestHash, err := computeActiveAncestor(chains)
 	if err != nil {