failover vs. read only queries

Hi,

When the trigger file is created while the recovery keeps
waiting for the release of the lock by read only queries,
it might take a very long time for the standby to become
the master. The recovery cannot go ahead until those read
only queries have gone away. This would increase the downtime
at the failover, and degrade the high availability.

To fix the problem, when the trigger file is found, I think
that we should cancel all the running read only queries
immediately (or forcibly use -1 as the max_standby_delay
since that point) and make the recovery go ahead. If some
people prefer queries over failover even when they create the
trigger file, we can make the trigger behavior selectable in
response to the content of the trigger file like pg_standby
does.

This problem looks like a bug, so I'd like to fix that for
9.0. But the amount of code change might not be small.
Thought?

Regards,

--
Fujii Masao
NIPPON TELEGRAPH AND TELEPHONE CORPORATION
NTT Open Source Software Center