pgsql: Is lock needed with synchronous replication?

I gather from the [wiki](http://wiki.clusterlabs.org/wiki/PgSQL_Replicated_Cluster) and #699 that stopping the master with a slave running, can leave the old master and the slave (now promoted to master) in inconsistent states - hence why PGSQL.lock isn't removed when the master is stopped in this case [in pgsql_real_stop()].

However, for controlled changeovers (e.g. pcs standby , or pcs resource move ... ), we don't experience any inconsistencies. i.e. we can just remove lock and carry on.

We are using synchronous replication (rep_mode="sync"). If this is "active" (slave has PGSQL-data-status: STREAMING|SYNC), it this sufficient to prevent inconsistencies?

i.e. if pgsql_real_stop() checked that all slaves are STREAMING|SYNC, could it then **safely** remove the lock file?

Or are there other things that can go wrong, even with synchronous replication?

(I note that #805 also discusses the lock file)

Steve Pritchard
British Trust for Ornithology