Re: Fix crash during recovery when redo segment is missing

> An argument that would sound in favor of a switch from PANIC to FATAL
> is the testing side: if one removes the segment where the checkpoint
> record resides, we crash.  Of course, one should not do that, but I
> have been wondering for years if it would not be a good thing idea to
> lift that a bit and expand the in-core tests and how we expect the
> startup process to deal with things.  One of my line of thoughts is
> that the PANIC behavior is inherited from a time where we did not have
> online backups and archive recovery, where such manipulations have
> never been possible to start with because WAL segments had a full life
> only linked to the backend in pg_wal.  Perhaps others don't agree with
> that, that's fine.

Makes sense. I agree that with modern features like backups, archiving
and external WAL handling, it’s common for WAL segments to go missing
due to operational scenarios, and these cases are often recoverable.
So switching to FATAL seems appropriate.

I would prefer to discuss this in a separate thread with a more
accurate subject line so we can get more opinions. Please let me know
if it is ok or you would rather continue the discussion here.

> It would be easy enough to expand the test added by 15f68cebdcec to
> check the no-checkpoint case, of course.  I just did that this morning
> while quickly testing various recovery patterns, which was easier than
> rewriting a new script for the job.  :)

Thanks for this. I also tested it by adding a TAP test. I initially
planned to share it, but decided instead to start a new thread first,
gather more opinions, and then share a patch if we agree on making the
change.


Best Regards,
Nitin Jadhav
Azure Database for PostgreSQL
Microsoft