From: Tom Lane <tgl@sss.pgh.pa.us>
To: Tomas Vondra <tomas.vondra@enterprisedb.com>
cc: Amit Kapila <amit.kapila16@gmail.com>, vignesh C <vignesh21@gmail.com>,
        PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Subject: Re: confirmed flush lsn seems to be move backward in certain error cases
In-reply-to: <d882d134-6a7a-4e92-ba65-174feb3f19f6@enterprisedb.com>
References: <CALDaNm3hgow2+oEov5jBk4iYP5eQrUCF1yZtW7+dV3J__p4KLQ@mail.gmail.com> <CAA4eK1KqYQHA67bhUJLJx1GOCcJHm=rgLU4OSKb-ft2hq40FSA@mail.gmail.com> <CALDaNm1Z+o99eyv1pvMHF2rHQX8Kgcox9asDnGDTuxFJ0G4z5w@mail.gmail.com> <CAA4eK1+2cACaeEw7pDQs6eH8nRCiDw+temUv0fUe=JXJGaAXzQ@mail.gmail.com> <CALDaNm0LLLvBjDK4z71kC8bonpq2xz=JODO6Lrek3Yqvu-KVKQ@mail.gmail.com> <CAA4eK1+_d564ap4JrZ2dRO9tk7DyGFMDC48+dTWvguTrRqwBNA@mail.gmail.com> <d882d134-6a7a-4e92-ba65-174feb3f19f6@enterprisedb.com>
Comments: In-reply-to Tomas Vondra <tomas.vondra@enterprisedb.com>
	message dated "Tue, 11 Jun 2024 15:42:44 +0200"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <1053869.1718133289.1@sss.pgh.pa.us>
Date: Tue, 11 Jun 2024 15:14:49 -0400
Message-ID: <1053870.1718133289@sss.pgh.pa.us>
Archived-At: <https://www.postgresql.org/message-id/1053870.1718133289%40sss.pgh.pa.us>
Precedence: bulk

Tomas Vondra <tomas.vondra@enterprisedb.com> writes:
> Why should it be OK for the subscriber to confirm a flush LSN and then
> later take that back and report a lower LSN? Seems somewhat against my
> understanding of what "flush LSN" means.
> The commit message explains this happens when the subscriber does not
> need to do anything for - but then why shouldn't it just report the
> prior LSN, in such cases?

Yeah, I was wondering about that too when I saw the commit go by.

> I haven't looked into the details, but my concern is this removes an
> useful assert, protecting us against certain type of bugs. And now we'll
> just happily ignore them. Is that a good idea?

If we think this is a real protection, then it shouldn't be an Assert
anyway, because it will not protect production systems that way.
It needs to be regular test-and-elog.  Or maybe test-and-ignore-the-
bogus-value?  If you want to take this seriously then you need to
define a recovery procedure after the problem is detected.

			regards, tom lane