standby switchover: CHECKPOINT executed on NULL superuser connection when repmgr user has pg_checkpoint

[Morpheion]

Environment:

• repmgr 5.5.0
• PostgreSQL 19beta2
• Rocky Linux 9.8
• streaming replication with one primary, one standby and one witness
• repmgr database user is intentionally not a superuser
• repmgr has been granted the predefined PostgreSQL role pg_checkpoint

Problem:
During repmgr standby switchover, repmgr correctly detects that the non-superuser connection is allowed to execute CHECKPOINT because the role has pg_checkpoint. However, the actual CHECKPOINT call is executed using superuser_conn instead of the connection that was successfully validated.

Relevant code in repmgr-action-standby.c:

PGconn *checkpoint_conn = local_conn;

if (superuser_conn != NULL)
checkpoint_conn = superuser_conn;

if (can_execute_checkpoint(checkpoint_conn) == true)
{
log_notice(_("issuing CHECKPOINT"));
checkpoint(superuser_conn);
}

The permission check is performed using checkpoint_conn, but the actual CHECKPOINT is executed using superuser_conn.

If no superuser connection was supplied with -S/--superuser, superuser_conn is NULL.

Observed output:

WARNING: no superuser connection available
DETAIL: it is recommended to perform switchover operations with a database superuser

NOTICE: issuing CHECKPOINT
ERROR: unable to execute CHECKPOINT

The switchover itself may still complete successfully, but the CHECKPOINT operation fails.

Expected behavior:
The same connection which successfully passed can_execute_checkpoint() should be used for the CHECKPOINT operation.

Proposed minimal fix:

• checkpoint(superuser_conn);

• checkpoint(checkpoint_conn);

Reproduction:

1. Use a non-superuser repmgr role.
2. Grant:
   GRANT pg_checkpoint TO repmgr;
3. Do not provide -S/--superuser.
4. Execute:
   repmgr standby switchover -f /etc/repmgr/19/repmgr.conf --siblings-follow --force-rewind --verbose

Validation:
After changing checkpoint(superuser_conn) to checkpoint(checkpoint_conn), the issue was tested with real controlled switchovers in both directions between the two PostgreSQL nodes.

In both directions:

• CHECKPOINT completed without error
• promotion completed successfully
• the demoted primary reattached as standby
• replication slot cleanup completed successfully
• the witness followed the new primary
• the complete switchover finished successfully

This does not appear to be PostgreSQL 19-specific. The issue is exposed by a least-privilege configuration where repmgr is not a superuser but has the pg_checkpoint role. The existing permission check already supports this configuration; only the connection used for the actual CHECKPOINT call appears to be incorrect.