On Thu, Sep 10, 2026 at 5:08 PM Daniel Gustafsson <[email protected]> wrote: > I have a feeling this had been brought up in one of all the postcommit > threads, > but I fail to find it now (perhaps it was a basebackup and not checksums > thread?). The gist of that discussion was that there is somewhere between > very > little add nothing we can do to protect against orphaned/external files in the > datadir when using the catalog as the main source of truth for what we expect > it to contain. I wonder if the best we can do is to document exactly how to > verify the state of the page when getting a backup page verification failure?
I think that it is fine to disclaim external files -- if you add random files to the data directory, stuff may break, and that's sad, but oh well. But I think orphaned files are a completely different ball game. That's just a normal outcome of running PostgreSQL for a period of time under real-world conditions, and to my knowledge this would be the first feature that doesn't work with them. I'd like to hear what others think, but my first reaction is to think that's probably not OK. If we don't remove the files automatically, and don't even provide any tools to remove the files manually, I think it follows logically that everything we ship has to cope with their possible existence. Otherwise, it seems like we're shipping a feature that sometimes doesn't work and for which we can't even provide reliable steps to fix it when it doesn't. -- Robert Haas
