Heikki Linnakangas <heikki.linnakangas@enterprisedb.com> writes:
> Simon Riggs wrote:
>> AFAICS the problem Heikki is worried about exists 8.2+. If you stop
>> recovery, edit recovery.conf to an earlier recovery target and then
>> re-run recovery then it is possible that data that would not exist until
>> after the (new) recovery point has made its way to disk. The code in 8.4
>> does a few things to improve that but the base problem persists and
>> revoking code won't change that. We should describe the issue in the
>> docs and leave it at that - there is no particular reason to believe
>> anybody would want to do such a thing.
> The way I've bumped into that is when playing with pg_standby:
> [ different scenario *not* involving any explicit recovery target ]
Okay, I misunderstood that code as being intended to prevent some
scenario that was new with Hot Standby. I still think it's a bad
solution though because of the large number of pg_control writes it
will cause. I agree that the code can be made to work in connection
with the fixes for the immediate bugs, but I am not convinced that we
want it there in its current form.
regards, tom lane