Hi Matthias,
I have been thinking more about this patch.
On 17 Aug 2026, Matthias van de Meent wrote:
> ... actual garbage on the
> page, not just an older version of the page ...
For a hint-only write without checksums, a mix of old and new sectors
can only lose some hints. Leaving the page LSN unchanged also preserves
FPI generation for the next ordinary change.
Writing garbage over previously durable bytes is a different failure
mode. I don't think PostgreSQL generally guarantees recovery from it:
pg_xact has no FPIs, pg_control relies on atomic sector writes, and
XLogWrite() rewrites the partly filled WAL page, including already
flushed records. We would need changes to WAL itself to cover that case.
An FPI still protects the heap if WAL survives. But is protection from
this broader failure mode a requirement for hint-bit logging when these
other critical structures remain exposed?
On 9 Sep 2026, Matthias van de Meent wrote:
> Getting rid of accurate page LSNs would re-introduce phantom
> visibility bits.
I see the missing interlock on the recovery side now. With an unchanged
page LSN, flushing replayed hints need not advance minRecoveryPoint
past their COMMIT records. The primary's existing commit-LSN check is
still there.
I haven't worked out the right fix for minRecoveryPoint yet, but if
that is the remaining obstacle, I'll think more about it.
Thank you!
Best regards, Andrey Borodin.
