Incrementally Updated Backups and restartpoints

Our documentation suggests that you can take a base backup of a warm
standby server while it's running:

> If we take a backup of the standby server's data directory while it is processing logs shipped from the primary, we will be able to reload that data and restart the standby's recovery process from the last restart point. We no longer need to keep WAL files from before the restart point. If we need to recover, it will be faster to recover from the incrementally updated backup than from the original base backup.

That doesn't seem safe. If the server makes a new restartpoint while the
backup is running, and pg_control is backed up after the new
restartpoint is made, recovery will restart from the new restartpoint.
That is wrong; recovery needs to restart at the restartpoint that was
most recent when the backup started. This is basically the same issue we
have solved in master with the backup_label file.

I wonder if it would be enough to document that pg_control must be
backed up first?

--
Heikki Linnakangas
EnterpriseDB http://www.enterprisedb.com