What about logging the shutdown checkpoint on the old master?
On the standby side, we could cross-check it with a function confirming:
1/ the very last XLogRecord received was the old master shutdown checkpoint
2/ the received shutdown checkpoint has the same LSN
Additionally, the new instructions in the doc might include recommendation, what to do if we
found that shutdown checkpoint wasn't received and replayed by the replica-to-promote. From my
understanding, before promotion, we could "manually" transfer missing WAL data from the old,
inactive master and replay it on the replica-to-promote (of course, if recovery_command is
properly configured on it). Right?
By the way, if it looks to me that it might be better to write more than just few sentences, what if it
will be a new chapter – say, "Switchover", next to "Failover". It would also give better understanding
to the reading, explicitly distinguishing planned and unplanned processes of master/replica role
changes.
Regards,
Nik