Thomas Lockhart <lockhart@fourpalms.org> writes:
> If so, we should consider supporting some sort of error
> state that prevents further damage.
This seems reasonable (though I'd still question whether a bad LSN is
sufficient reason to force the whole database into read-only mode).
> Vadim's solution uses the only
> current mechanism available, which is to force the database to shut down
> until it can be evaluated.
But one of the big problems with his solution is that it gets in the way
of evaluating the problem. A read-only mode seems like a better way.
regards, tom lane