> One possible test enhancement would be to assert that pg_control, > the WAL files, and backup_label remain unchanged after each refusal.
I would leave that out. The check runs before pg_resetwal reads pg_control, right after the postmaster.pid check, so nothing has been written at that point. The postmaster.pid refusal has no such test either. I did check by hand, and all three are unchanged after each refusal.
