Re: Archive-fed logical decoding: pausing recovery on slot conflict

Hi hackers,

Here is v2. Self-review found that v1 advanced catalog_xmin from the
startup process once confirmed_flush_lsn reached the pause point. That
is not safe: confirmed output does not prove that logical decoding no
longer needs older catalog rows.

V2 leaves horizon advancement entirely to logical decoding and
auto-resumes only after the slot's effective horizons no longer
conflict. It now uses the same predicate as normal slot invalidation,
including both xmin horizons and shared catalogs. It also avoids
pausing before Hot Standby is active and prevents auto-resume from
overriding a separate manual pause.

There is an important limitation: a pause does not guarantee that every
slot can be preserved. If the WAL already replayed does not let logical
decoding derive a sufficiently recent safe horizon, the operator must
drop the slot or resume recovery and let it be invalidated.

The TAP test now uses one archive-only standby and covers automatic
resume, a concurrent manual pause, a shared-catalog conflict, and
promotion from the conflict pause.

PFA v2.

Thank you!

Best regards, Andrey Borodin.