Re: pg_rewind WAL segments deletion pitfall

Hi,

I noticed some strange behaviour in the keepwal logic.

The keepwal filename is built from the timeline of the segment being
read, which is the *target's* TLI:

current_tli = xlogreader->seg.ws_tli;
XLogFileName(xlogfname + sizeof(XLOGDIR), current_tli, ...);
keepwal_add_entry(xlogfname);

When the source cluster is on a lower timeline than the target, the
rewound node ends up with stray segment from a timeline newer than
the source's, e.g.:

000000020000000000000002 (rewound)
000000030000000000000002 (rewound)
000000040000000000000002 (rewound)
000000080000000000000002 (kept by keepwal)

I have a small fix that clamps the keepwal TLI to the source's latest
timeline, so each entry refers to a segment the source can actually
hold:

current_tli = Min(xlogreader->seg.ws_tli, source_tli);

A TAP test (012_leftover_wal_segment.pl) reproduces by bumping the
target's timeline past the divergence point, promoting the standby as
the lower-TLI source, rewinding, and asserting that no segment left in
the target's pg_wal carries a TLI above the source's. It fails
without the patch and passes with it.

Patch attached. Thoughts?