diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 248d2e4c3..1289d45e6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,15 +4,16 @@ name: CI
 #
 # Job dependency graph:
 #
-#   style_checker ──┐
-#                   ├── (both must pass before any build job starts)
-#   ensure_base  ───┘
-#               ├── build_run_images  (PG 14-17 → pgaf:run-pgN; installcheck runs inside build stage)
-#               │       └── test_pgaftest   (17 spec jobs)
+#   style_checker ──────┐
+#   check_base_changed ─┤
+#                       ├── (all must pass before any build job starts)
+#   ensure_base  ───────┘
+#               ├── build_run_images  (PG 14-19 → pgaf:run-pgN; installcheck runs inside build stage)
+#               │       └── test_pgaftest   (spec jobs)
 #               ├── build_pgaftest    (pgaf:pgaftest, built from PG17)
 #               │       └── test_pgaftest   (same)
 #               │       └── upgrade
-#               └── build_test_images (PG 14-17 → pg_auto_failover_test:pgN)
+#               └── build_test_images (PG 14-19 → pg_auto_failover_test:pgN)
 #                       └── test_python    (PG × suite matrix)
 
 on:
@@ -52,14 +53,41 @@ jobs:
         run: ci/banned.h.sh
 
   # ---------------------------------------------------------------------------
-  # 2. Ensure base image — pull from ghcr.io or build+push on cache miss.
-  #    Runs in parallel with style_checker; build jobs wait for both.
-  #    Fast path (image exists): ~5 s manifest check.
-  #    Slow path (first run / Dockerfile.base changed): ~20 min build.
+  # 2a. Detect whether Dockerfile.base changed in this PR/push so that
+  #     ensure_base knows to force-rebuild rather than reuse the cached image.
+  # ---------------------------------------------------------------------------
+  check_base_changed:
+    name: Check if Dockerfile.base changed
+    runs-on: ubuntu-latest
+    outputs:
+      changed: ${{ steps.diff.outputs.changed }}
+    steps:
+      - uses: actions/checkout@v7.0.0
+        with:
+          fetch-depth: 0
+
+      - name: Detect Dockerfile.base change
+        id: diff
+        run: |
+          BASE_REF="${{ github.event.pull_request.base.sha || 'HEAD~1' }}"
+          if git diff --name-only "${BASE_REF}"...HEAD | grep -q '^Dockerfile\.base$'; then
+            echo "changed=true"  >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          fi
+
+  # ---------------------------------------------------------------------------
+  # 2b. Ensure base image — pull from ghcr.io or build+push on cache miss.
+  #     Runs in parallel with style_checker; build jobs wait for both.
+  #     Fast path (image exists and Dockerfile.base unchanged): ~5 s check.
+  #     Slow path (first run or Dockerfile.base changed): ~20 min build.
   # ---------------------------------------------------------------------------
   ensure_base:
     name: Ensure base image
+    needs: check_base_changed
     uses: ./.github/workflows/base-image.yml
+    with:
+      force_rebuild: ${{ needs.check_base_changed.outputs.changed == 'true' }}
     permissions:
       contents: read
       packages: write
@@ -79,7 +107,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        PGVERSION: [14, 15, 16, 17]
+        PGVERSION: [14, 15, 16, 17, 18, 19]
 
     steps:
       - uses: actions/checkout@v7.0.0
@@ -188,7 +216,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        PGVERSION: [14, 15, 16, 17]
+        PGVERSION: [14, 15, 16, 17, 18, 19]
 
     steps:
       - uses: actions/checkout@v7.0.0
@@ -249,6 +277,8 @@ jobs:
           - { PGVERSION: 15, schedule: quick }
           - { PGVERSION: 16, schedule: quick }
           - { PGVERSION: 17, schedule: quick }
+          - { PGVERSION: 18, schedule: quick }
+          - { PGVERSION: 19, schedule: quick }
           # node: create_standby_with_pgdata, maintenance_and_drop, auth,
           #       monitor_disabled, replace_monitor, extension_update,
           #       debian_clusters, tablespaces
@@ -256,17 +286,25 @@ jobs:
           - { PGVERSION: 15, schedule: node }
           - { PGVERSION: 16, schedule: node }
           - { PGVERSION: 17, schedule: node }
+          - { PGVERSION: 18, schedule: node }
+          - { PGVERSION: 19, schedule: node }
           # ssl: enable_ssl, ssl_self_signed, ssl_cert
           - { PGVERSION: 14, schedule: ssl }
           - { PGVERSION: 15, schedule: ssl }
           - { PGVERSION: 16, schedule: ssl }
           - { PGVERSION: 17, schedule: ssl }
+          - { PGVERSION: 18, schedule: ssl }
+          - { PGVERSION: 19, schedule: ssl }
           # slow schedules: PG17 only (FSM logic, not version-specific code paths)
           - { PGVERSION: 17, schedule: multi-alternate }
           - { PGVERSION: 17, schedule: multi-misc }
           - { PGVERSION: 17, schedule: multi-async }
           - { PGVERSION: 17, schedule: citus-1 }
           - { PGVERSION: 17, schedule: citus-2 }
+          # citus on PG18 (supported); allow failure until officially validated
+          - { PGVERSION: 18, schedule: citus-1, continue-on-error: true }
+          - { PGVERSION: 18, schedule: citus-2, continue-on-error: true }
+          # PG19: no Citus release yet (CITUSTAG_19=none) — citus schedules omitted
 
     steps:
       - uses: actions/checkout@v7.0.0
@@ -379,11 +417,19 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        PGVERSION: [14, 15, 16, 17]
+        PGVERSION: [14, 15, 16, 17, 18, 19]
         TEST: [multi, single, monitor, ssl, citus]
+        exclude:
+          # Citus does not support PG19 yet
+          - PGVERSION: 19
+            TEST: citus
         include:
           - PGVERSION: 14
             TEST: tablespaces
+          # Allow citus failures on PG18 until officially validated
+          - PGVERSION: 18
+            TEST: citus
+            continue-on-error: true
 
     steps:
       - uses: actions/checkout@v7.0.0
diff --git a/Dockerfile.base b/Dockerfile.base
index 59d685702..c62a1718d 100644
--- a/Dockerfile.base
+++ b/Dockerfile.base
@@ -79,7 +79,7 @@ RUN curl -fsSL https://www.postgresql.org/media/keys/ACCC4CF8.asc \
       | gpg --dearmor -o /usr/share/keyrings/pgdg-archive-keyring.gpg
 
 RUN echo "deb [signed-by=/usr/share/keyrings/pgdg-archive-keyring.gpg] \
-      http://apt.postgresql.org/pub/repos/apt bookworm-pgdg main 14 15 16 17" \
+      http://apt.postgresql.org/pub/repos/apt bookworm-pgdg main 14 15 16 17 18 19" \
       > /etc/apt/sources.list.d/pgdg.list
 
 # Don't create a default cluster on install (we create them explicitly in tests)
@@ -91,6 +91,8 @@ RUN apt-get update \
       postgresql-15            postgresql-server-dev-15 \
       postgresql-16            postgresql-server-dev-16 \
       postgresql-17            postgresql-server-dev-17 \
+      postgresql-18            postgresql-server-dev-18 \
+      postgresql-19            postgresql-server-dev-19 \
  && rm -rf /var/lib/apt/lists/*
 
 # ---------------------------------------------------------------------------
@@ -104,13 +106,17 @@ ARG CITUSTAG_14=v12.1.5
 ARG CITUSTAG_15=v12.1.5
 ARG CITUSTAG_16=v13.2.0
 ARG CITUSTAG_17=v13.2.0
+ARG CITUSTAG_18=v14.1.0
+ARG CITUSTAG_19=none
 
 RUN set -e; \
     for pair in \
         "14:${CITUSTAG_14}" \
         "15:${CITUSTAG_15}" \
         "16:${CITUSTAG_16}" \
-        "17:${CITUSTAG_17}"; \
+        "17:${CITUSTAG_17}" \
+        "18:${CITUSTAG_18}" \
+        "19:${CITUSTAG_19}"; \
     do \
         PG="${pair%%:*}"; \
         TAG="${pair#*:}"; \
@@ -140,8 +146,12 @@ ARG CITUSTAG_14
 ARG CITUSTAG_15
 ARG CITUSTAG_16
 ARG CITUSTAG_17
+ARG CITUSTAG_18
+ARG CITUSTAG_19
 
 LABEL org.pgaf.citustag.14="${CITUSTAG_14}" \
       org.pgaf.citustag.15="${CITUSTAG_15}" \
       org.pgaf.citustag.16="${CITUSTAG_16}" \
-      org.pgaf.citustag.17="${CITUSTAG_17}"
+      org.pgaf.citustag.17="${CITUSTAG_17}" \
+      org.pgaf.citustag.18="${CITUSTAG_18}" \
+      org.pgaf.citustag.19="${CITUSTAG_19}"
diff --git a/Makefile.docker b/Makefile.docker
index 612c2b261..486e86f86 100644
--- a/Makefile.docker
+++ b/Makefile.docker
@@ -23,10 +23,10 @@ $(VERSION_FILE):
 	@echo "#define GIT_VERSION \"$(GIT_VERSION)\"" > $@
 
 # Supported PostgreSQL versions:
-PGVERSIONS = 14 15 16 17
+PGVERSIONS = 14 15 16 17 18 19
 
 # Default version:
-PGVERSION ?= 17
+PGVERSION ?= 19
 
 # Base image that provides all Postgres versions + Citus builds.
 # Override locally after building the base image under a different tag.
diff --git a/src/bin/common/Makefile.common b/src/bin/common/Makefile.common
index be7a0fe9e..8d527d144 100644
--- a/src/bin/common/Makefile.common
+++ b/src/bin/common/Makefile.common
@@ -24,7 +24,7 @@ COMMON_INCLUDES += -I$(LIB_DIR)/parson/
 
 CC = $(shell $(PG_CONFIG) --cc)
 
-DEFAULT_CFLAGS  = -std=c99 -D_GNU_SOURCE -g
+DEFAULT_CFLAGS  = -D_GNU_SOURCE -g
 DEFAULT_CFLAGS += -I $(shell $(PG_CONFIG) --includedir)
 DEFAULT_CFLAGS += -I $(shell $(PG_CONFIG) --includedir-server)
 DEFAULT_CFLAGS += -I $(shell $(PG_CONFIG) --pkgincludedir)/internal
@@ -109,7 +109,7 @@ endif
 
 # Shared rules for vendored libs
 lib-snprintf.o: $(PG_SNPRINTF)
-	$(CC) $(CFLAGS) -c -MMD -MP -MF$(DEPDIR)/lib-snprintf.Po -MT$@ \
+	$(CC) $(CFLAGS) -Wno-implicit-fallthrough -c -MMD -MP -MF$(DEPDIR)/lib-snprintf.Po -MT$@ \
 	    -o $@ $(LIB_DIR)/pg/snprintf.c
 
 lib-strerror.o: $(PG_SNPRINTF)
diff --git a/src/bin/common/pgctl.c b/src/bin/common/pgctl.c
index 8ad756ae3..c0c5662b0 100644
--- a/src/bin/common/pgctl.c
+++ b/src/bin/common/pgctl.c
@@ -2350,12 +2350,22 @@ prepare_recovery_settings(const char *pgdata,
 				  primaryNode->host,
 				  primaryNode->port);
 
+		/*
+		 * PG17 introduced synchronized_standby_slots for logical slot
+		 * failover; pg_sync_replication_slots() requires primary_conninfo
+		 * to include a dbname keyword.  Pass it when available.
+		 */
+		const char *dbname =
+			IS_EMPTY_STRING_BUFFER(replicationSource->dbname)
+			? NULL
+			: replicationSource->dbname;
+
 		if (!prepare_primary_conninfo(primaryConnInfo,
 									  MAXCONNINFO,
 									  primaryNode->host,
 									  primaryNode->port,
 									  replicationSource->userName,
-									  NULL, /* no database */
+									  dbname,
 									  replicationSource->password,
 									  replicationSource->applicationName,
 									  replicationSource->sslOptions,
diff --git a/src/bin/common/pgsetup.c b/src/bin/common/pgsetup.c
index a7bbd53ad..67217a8ef 100644
--- a/src/bin/common/pgsetup.c
+++ b/src/bin/common/pgsetup.c
@@ -1588,7 +1588,7 @@ pmStatusToString(PostmasterStatus pm_status)
  * environment variable, or from our default hard-coded value of 5432.
  */
 int
-pgsetup_get_pgport()
+pgsetup_get_pgport(void)
 {
 	char pgport_env[NAMEDATALEN];
 	int pgport = 0;
diff --git a/src/bin/common/pgsql.c b/src/bin/common/pgsql.c
index e981aff89..f618c2cb4 100644
--- a/src/bin/common/pgsql.c
+++ b/src/bin/common/pgsql.c
@@ -2616,7 +2616,10 @@ pgsql_get_postgres_metadata(PGSQL *pgsql,
 		" end as current_lsn,"
 		" pg_control_version, catalog_version_no, system_identifier,"
 		" case when pg_is_in_recovery()"
-		" then (select received_tli from pg_stat_wal_receiver)"
+		" then coalesce("
+		"        (select received_tli from pg_stat_wal_receiver"
+		"          where received_tli > 0),"
+		"        (select timeline_id from pg_control_checkpoint()))"
 		" else (select timeline_id from pg_control_checkpoint()) "
 		" end as timeline_id "
 		" from (values(1)) as dummy"
diff --git a/src/bin/common/pgsql.h b/src/bin/common/pgsql.h
index 2b51b2eda..173811e88 100644
--- a/src/bin/common/pgsql.h
+++ b/src/bin/common/pgsql.h
@@ -243,6 +243,7 @@ typedef struct ReplicationSource
 {
 	NodeAddress primaryNode;
 	char userName[NAMEDATALEN];
+	char dbname[NAMEDATALEN];      /* database name for primary_conninfo (PG17+) */
 	char slotName[MAXCONNINFO];
 	char password[MAXCONNINFO];
 	char maximumBackupRate[MAXIMUM_BACKUP_RATE_LEN];
diff --git a/src/bin/common/pidfile.c b/src/bin/common/pidfile.c
index 931b67ed9..b4d2f4649 100644
--- a/src/bin/common/pidfile.c
+++ b/src/bin/common/pidfile.c
@@ -155,7 +155,7 @@ get_service_pidfile(const char *pidfile,
  * pidfile.
  */
 static void
-remove_service_pidfile_atexit()
+remove_service_pidfile_atexit(void)
 {
 	(void) remove_pidfile(service_pidfile);
 }
diff --git a/src/bin/common/signals.c b/src/bin/common/signals.c
index a870d66f5..58687da49 100644
--- a/src/bin/common/signals.c
+++ b/src/bin/common/signals.c
@@ -119,8 +119,10 @@ unblock_signals(sigset_t *orig_mask)
  * catch_reload receives the SIGHUP signal.
  */
 void
-catch_reload(int sig)
+catch_reload(SIGNAL_ARGS)
 {
+	int sig = postgres_signal_arg;
+
 	asked_to_reload = 1;
 	pqsignal(sig, catch_reload);
 }
@@ -130,8 +132,10 @@ catch_reload(int sig)
  * catch_int receives the SIGINT signal.
  */
 void
-catch_int(int sig)
+catch_int(SIGNAL_ARGS)
 {
+	int sig = postgres_signal_arg;
+
 	asked_to_stop_fast = 1;
 	pqsignal(sig, catch_int);
 }
@@ -141,8 +145,10 @@ catch_int(int sig)
  * catch_stop receives SIGTERM signal.
  */
 void
-catch_term(int sig)
+catch_term(SIGNAL_ARGS)
 {
+	int sig = postgres_signal_arg;
+
 	asked_to_stop = 1;
 	pqsignal(sig, catch_term);
 }
@@ -152,8 +158,10 @@ catch_term(int sig)
  * catch_quit receives the SIGQUIT signal.
  */
 void
-catch_quit(int sig)
+catch_quit(SIGNAL_ARGS)
 {
+	int sig = postgres_signal_arg;
+
 	/* default signal handler disposition is to core dump, we don't */
 	asked_to_quit = 1;
 	pqsignal(sig, catch_quit);
@@ -164,7 +172,7 @@ catch_quit(int sig)
  * quit_and_exit exit(EXIT_CODE_QUIT) upon receiving the SIGQUIT signal.
  */
 void
-catch_quit_and_exit(int sig)
+catch_quit_and_exit(SIGNAL_ARGS)
 {
 	/* default signal handler disposition is to core dump, we don't */
 	exit(EXIT_CODE_QUIT);
diff --git a/src/bin/common/signals.h b/src/bin/common/signals.h
index 3c6d27807..f82b7a9ce 100644
--- a/src/bin/common/signals.h
+++ b/src/bin/common/signals.h
@@ -12,6 +12,7 @@
 
 #include <inttypes.h>
 #include <signal.h>
+#include "postgres_fe.h"    /* SIGNAL_ARGS, pqsigfunc */
 
 /* This flag controls termination of the main loop. */
 extern volatile sig_atomic_t asked_to_stop;      /* SIGTERM */
@@ -25,11 +26,11 @@ extern volatile sig_atomic_t asked_to_quit;      /* SIGQUIT */
 void set_signal_handlers(bool exitOnQuit);
 bool block_signals(sigset_t *mask, sigset_t *orig_mask);
 void unblock_signals(sigset_t *orig_mask);
-void catch_reload(int sig);
-void catch_int(int sig);
-void catch_term(int sig);
-void catch_quit(int sig);
-void catch_quit_and_exit(int sig);
+void catch_reload(SIGNAL_ARGS);
+void catch_int(SIGNAL_ARGS);
+void catch_term(SIGNAL_ARGS);
+void catch_quit(SIGNAL_ARGS);
+void catch_quit_and_exit(SIGNAL_ARGS);
 
 int get_current_signal(int defaultSignal);
 int pick_stronger_signal(int sig1, int sig2);
diff --git a/src/bin/lib/subcommands.c/runprogram.h b/src/bin/lib/subcommands.c/runprogram.h
index 3ef94387a..bbc4b8b0c 100644
--- a/src/bin/lib/subcommands.c/runprogram.h
+++ b/src/bin/lib/subcommands.c/runprogram.h
@@ -428,7 +428,7 @@ free_program(Program *prog)
  * and stdout and exits with the exit code EXIT_CODE_INTERNAL_ERROR.
  */
 static void
-exit_internal_error()
+exit_internal_error(void)
 {
 	fprintf(stdout, "%s\n", strerror(errno));
 	fprintf(stderr, "%s\n", strerror(errno));
diff --git a/src/bin/pg_autoctl/cli_do_service.c b/src/bin/pg_autoctl/cli_do_service.c
index e450417ca..61d4e07e9 100644
--- a/src/bin/pg_autoctl/cli_do_service.c
+++ b/src/bin/pg_autoctl/cli_do_service.c
@@ -292,7 +292,24 @@ cli_do_service_restart(const char *serviceName)
 
 	/* loop until we have a new pid */
 	do {
-		if (!supervisor_find_service_pid(pathnames.pid, serviceName, &newPid))
+		/*
+		 * The supervisor rewrites the pidfile non-atomically for a brief
+		 * window; retry a few times before giving up, to avoid a spurious
+		 * failure racing against that write.
+		 */
+		bool found = false;
+
+		for (int attempt = 0; attempt < 10; attempt++)
+		{
+			if (supervisor_find_service_pid(pathnames.pid, serviceName, &newPid))
+			{
+				found = true;
+				break;
+			}
+			pg_usleep(10 * 1000);   /* 10 ms between retries */
+		}
+
+		if (!found)
 		{
 			log_fatal("Failed to find pid for service name \"%s\"", serviceName);
 			exit(EXIT_CODE_INTERNAL_ERROR);
diff --git a/src/bin/pg_autoctl/cli_node.c b/src/bin/pg_autoctl/cli_node.c
index 307587f3e..88ce2ae1c 100644
--- a/src/bin/pg_autoctl/cli_node.c
+++ b/src/bin/pg_autoctl/cli_node.c
@@ -657,45 +657,84 @@ static void
 cli_node_init(int argc, char **argv)
 {
 	NodeSpec spec = { 0 };
+	char *args[40];
+	int nargs;
 
 	if (!nodespec_read(nodeSpecPath, &spec))
 	{
 		exit(EXIT_CODE_BAD_CONFIG);
 	}
 
-	/* Idempotent: if PGDATA already initialized, nothing to do. */
+	char cfgPath[MAXPGPATH];
+
 	if (!IS_EMPTY_STRING_BUFFER(spec.pgdata))
 	{
-		char cfgPath[MAXPGPATH];
 		sformat(cfgPath, sizeof(cfgPath), "%s/pg_autoctl.cfg", spec.pgdata);
-		if (file_exists(cfgPath))
-		{
-			log_info("Node already initialized at \"%s\"; nothing to do", spec.pgdata);
-			exit(0);
-		}
 	}
 
-	/* PID file cleanup and SSL cert copy follow the same sequence as node run. */
-	if (!IS_EMPTY_STRING_BUFFER(spec.pgdata))
+	if (!IS_EMPTY_STRING_BUFFER(spec.pgdata) && file_exists(cfgPath))
 	{
-		char pidPath[MAXPGPATH];
-		sformat(pidPath, sizeof(pidPath),
-				"/tmp/pg_autoctl%s/pg_autoctl.pid", spec.pgdata);
-		(void) unlink(pidPath);
+		log_info("Node already initialized at \"%s\"; nothing to do", spec.pgdata);
+		exit(0);
 	}
 
-	if (!IS_EMPTY_STRING_BUFFER(spec.ssl_ca_file))
+	/*
+	 * Build the same argv as node run, but nodespec_create_argv always appends
+	 * --run.  We build the argv and drop the final --run entry so that
+	 * pg_autoctl create <kind> returns after initialization, without starting
+	 * the supervisor.
+	 */
+	nargs = nodespec_create_argv(&spec, pg_autoctl_program, args, 32);
+	if (nargs < 0)
 	{
-		if (!node_copy_ssl_certs(&spec))
-		{
-			exit(EXIT_CODE_INTERNAL_ERROR);
-		}
+		exit(EXIT_CODE_INTERNAL_ERROR);
 	}
 
-	if (!node_do_init(&spec))
+	/* Drop the trailing "--run" that nodespec_create_argv always appends. */
+	if (nargs >= 2 && strcmp(args[nargs - 1], "--run") == 0)
 	{
-		exit(EXIT_CODE_INTERNAL_ERROR);
+		args[nargs - 1] = NULL;
+		nargs--;
+	}
+
+	/* Log the command (masking passwords). */
+	{
+		PQExpBuffer cmd = createPQExpBuffer();
+		static const char *pwFlags[] = {
+			"--monitor-password",
+			"--replication-password",
+			"--autoctl-node-password",
+			NULL
+		};
+		for (int i = 0; i < nargs; i++)
+		{
+			if (i > 0)
+			{
+				appendPQExpBufferChar(cmd, ' ');
+			}
+			bool maskThis = false;
+			if (i > 0)
+			{
+				for (int k = 0; pwFlags[k]; k++)
+				{
+					if (strcmp(args[i - 1], pwFlags[k]) == 0)
+					{
+						maskThis = true;
+						break;
+					}
+				}
+			}
+			appendPQExpBufferStr(cmd, maskThis ? "****" : args[i]);
+		}
+		log_info("pg_autoctl node init: %s", cmd->data);
+		destroyPQExpBuffer(cmd);
 	}
+
+	execv(args[0], args);
+
+	/* If we get here execv failed */
+	log_fatal("execv(\"%s\"): %m", args[0]);
+	exit(EXIT_CODE_INTERNAL_ERROR);
 }
 
 
diff --git a/src/bin/pg_autoctl/cli_show.c b/src/bin/pg_autoctl/cli_show.c
index 8bfdf2a35..f8e5a85c6 100644
--- a/src/bin/pg_autoctl/cli_show.c
+++ b/src/bin/pg_autoctl/cli_show.c
@@ -536,7 +536,7 @@ cli_show_state(int argc, char **argv)
  * file for the local (keeper) node.
  */
 static void
-cli_show_local_state()
+cli_show_local_state(void)
 {
 	KeeperConfig config = keeperOptions;
 	int optionGroupId = keeperOptions.groupId;
diff --git a/src/bin/pg_autoctl/demoapp.c b/src/bin/pg_autoctl/demoapp.c
index b94c1b728..834945d25 100644
--- a/src/bin/pg_autoctl/demoapp.c
+++ b/src/bin/pg_autoctl/demoapp.c
@@ -836,7 +836,7 @@ demoapp_print_summary(const char *pguri, DemoAppOptions *demoAppOptions)
  * demoapp_get_terminal_columns gets the current terminal window width.
  */
 static int
-demoapp_get_terminal_columns()
+demoapp_get_terminal_columns(void)
 {
 	struct winsize ws;
 
diff --git a/src/bin/pg_autoctl/fsm.c b/src/bin/pg_autoctl/fsm.c
index 9680b6d81..3c89a32d8 100644
--- a/src/bin/pg_autoctl/fsm.c
+++ b/src/bin/pg_autoctl/fsm.c
@@ -1126,7 +1126,7 @@ print_reachable_states(KeeperStateData *keeperState)
  *   pg_autoctl do fsm gv | dot -Tpng > fsm.png
  */
 void
-print_fsm_for_graphviz()
+print_fsm_for_graphviz(void)
 {
 	KeeperFSMTransition transition = KeeperFSM[0];
 	int transitionIndex = 0;
diff --git a/src/bin/pg_autoctl/main.c b/src/bin/pg_autoctl/main.c
index 577ecd540..20e866e71 100644
--- a/src/bin/pg_autoctl/main.c
+++ b/src/bin/pg_autoctl/main.c
@@ -149,7 +149,7 @@ main(int argc, char **argv)
  * as using colors in an interactive terminal and the default log level.
  */
 static void
-set_logger()
+set_logger(void)
 {
 	/* we're verbose by default */
 	log_set_level(LOG_INFO);
diff --git a/src/bin/pg_autoctl/primary_standby.c b/src/bin/pg_autoctl/primary_standby.c
index e9c0921ac..e08f77871 100644
--- a/src/bin/pg_autoctl/primary_standby.c
+++ b/src/bin/pg_autoctl/primary_standby.c
@@ -850,6 +850,7 @@ standby_init_replication_source(LocalPostgresServer *postgres,
 	}
 
 	strlcpy(upstream->userName, username, NAMEDATALEN);
+	strlcpy(upstream->dbname, postgres->postgresSetup.dbname, NAMEDATALEN);
 
 	if (password != NULL)
 	{
diff --git a/src/bin/pg_autoctl/service_postgres_ctl.c b/src/bin/pg_autoctl/service_postgres_ctl.c
index f85cf04a2..7f9978d6f 100644
--- a/src/bin/pg_autoctl/service_postgres_ctl.c
+++ b/src/bin/pg_autoctl/service_postgres_ctl.c
@@ -95,7 +95,7 @@ service_postgres_ctl_start(void *context, pid_t *pid)
  *   $ pg_autoctl internal service postgres --pgdata ...
  */
 void
-service_postgres_ctl_runprogram()
+service_postgres_ctl_runprogram(void)
 {
 	char *args[12];
 	int argsIndex = 0;
diff --git a/src/bin/pg_autoctl/supervisor.c b/src/bin/pg_autoctl/supervisor.c
index c05c19d04..7cd4463bf 100644
--- a/src/bin/pg_autoctl/supervisor.c
+++ b/src/bin/pg_autoctl/supervisor.c
@@ -934,9 +934,26 @@ supervisor_update_pidfile(Supervisor *supervisor)
 		appendPQExpBuffer(content, "%d %s\n", service->pid, service->name);
 	}
 
-	bool success = write_file(content->data, content->len, supervisor->pidfile);
+	/*
+	 * Write atomically via a temp file + rename so that concurrent readers of
+	 * the pidfile never see a truncated (empty) file during the update.
+	 * POSIX rename(2) is atomic: a reader sees either the old complete file
+	 * or the new complete one, never a partially-written version.
+	 */
+	char tmpfile[MAXPGPATH];
+	sformat(tmpfile, MAXPGPATH, "%s.tmp", supervisor->pidfile);
+
+	bool success = write_file(content->data, content->len, tmpfile);
 	destroyPQExpBuffer(content);
 
+	if (success && rename(tmpfile, supervisor->pidfile) != 0)
+	{
+		log_error("Failed to rename \"%s\" to \"%s\": %m", tmpfile,
+				  supervisor->pidfile);
+		(void) unlink(tmpfile);
+		success = false;
+	}
+
 	return success;
 }
 
diff --git a/src/bin/pg_autoctl/watch.c b/src/bin/pg_autoctl/watch.c
index c37c885d5..fea9bbeb9 100644
--- a/src/bin/pg_autoctl/watch.c
+++ b/src/bin/pg_autoctl/watch.c
@@ -97,8 +97,10 @@ static void clear_line_at(int row);
  * catch_sigwinch is registered as the SIGWINCH signal handler.
  */
 static void
-catch_sigwinch(int sig)
+catch_sigwinch(SIGNAL_ARGS)
 {
+	int sig = postgres_signal_arg;
+
 	window_size_changed = 1;
 	pqsignal(sig, catch_sigwinch);
 }
diff --git a/src/bin/pgaftest/Makefile b/src/bin/pgaftest/Makefile
index 259b77a89..f5da13c0e 100644
--- a/src/bin/pgaftest/Makefile
+++ b/src/bin/pgaftest/Makefile
@@ -74,6 +74,7 @@ GENERATED_CFLAGS = $(CFLAGS) \
     -Wno-unused-function \
     -Wno-unused-const-variable \
     -Wno-return-type \
+    -Wno-implicit-fallthrough \
     -Wno-error
 
 test_spec_parse.o: test_spec_parse.c
diff --git a/src/bin/pgaftest/compose_gen.c b/src/bin/pgaftest/compose_gen.c
index 1b7944c8f..d17a6817f 100644
--- a/src/bin/pgaftest/compose_gen.c
+++ b/src/bin/pgaftest/compose_gen.c
@@ -528,7 +528,25 @@ compose_gen_write(TestCluster *cluster,
 		}
 		else
 		{
-			write_image_stanza(f, cluster, contextDir);
+			/*
+			 * When PGAF_PREBUILT_IMAGE is set, use the pre-initialized monitor
+			 * image (pg_autoctl node init already ran initdb at image-build
+			 * time, so compose-up skips the slow initdb step).  Data nodes
+			 * still use the plain run image; they need the live monitor URI and
+			 * cannot be pre-initialized without it.
+			 */
+			const char *prebuiltImg = getenv("PGAF_PREBUILT_IMAGE"); /* IGNORE-BANNED */
+			const char *runImg = cluster->image[0] ? cluster->image
+								 : getenv("PGAF_IMAGE");                    /* IGNORE-BANNED */
+
+			if (prebuiltImg && *prebuiltImg && runImg && *runImg)
+			{
+				fformat(f, "    image: \"%s\"\n", prebuiltImg);
+			}
+			else
+			{
+				write_image_stanza(f, cluster, contextDir);
+			}
 		}
 
 		char monitor_pgdata[MAXPGPATH];
diff --git a/src/monitor/Makefile b/src/monitor/Makefile
index 7e2193186..f74d3245d 100644
--- a/src/monitor/Makefile
+++ b/src/monitor/Makefile
@@ -12,17 +12,29 @@ DATA = $(EXTENSION)--1.0.sql $(patsubst ${SRC_DIR}%,%,$(wildcard ${SRC_DIR}$(EXT
 # compilation configuration
 MODULE_big = $(EXTENSION)
 OBJS = $(patsubst ${SRC_DIR}%.c,%.o,$(wildcard ${SRC_DIR}*.c))
-PG_CPPFLAGS = -std=c99 -Wall -Werror -Wno-unused-parameter -Iinclude -I$(libpq_srcdir) -g
+PG_CPPFLAGS = -Wall -Werror -Wno-unused-parameter -Iinclude -I$(libpq_srcdir) -g
 SHLIB_LINK = $(libpq)
 REGRESS = create_extension monitor workers node_active_protocol guard_data_loss fast_forward dummy_update drop_extension upgrade
 
 PG_CONFIG ?= pg_config
+
+# PG19 changed pg_lsn display format (e.g. 0/0 -> 0/00000000).
+# Use version-specific expected output files when available.
+PG_MAJOR_VERSION := $(shell $(PG_CONFIG) --version | sed 's/PostgreSQL \([0-9]*\).*/\1/')
+# pg_regress appends /expected/<name>.out to the expecteddir path,
+# so point at the parent directory that contains the expected/ subdirectory.
+PG19_EXPECTED_PARENT := $(SRC_DIR)expected/pg19
+ifneq ($(wildcard $(PG19_EXPECTED_PARENT)/expected),)
+ifeq ($(shell test "$(PG_MAJOR_VERSION)" -ge 19 2>/dev/null && echo yes),yes)
+REGRESS_OPTS += --expecteddir=$(PG19_EXPECTED_PARENT)
+endif
+endif
 PGXS = $(shell $(PG_CONFIG) --pgxs)
 USE_PGXS = 1
 
 .PHONY: cleanup-before-install
 
-DEFAULT_CFLAGS = -std=c99 -D_GNU_SOURCE -g
+DEFAULT_CFLAGS = -D_GNU_SOURCE -g
 DEFAULT_CFLAGS += $(shell $(PG_CONFIG) --cflags)
 DEFAULT_CFLAGS += -Wformat
 DEFAULT_CFLAGS += -Wall
diff --git a/src/monitor/expected/pg19/expected/create_extension.out b/src/monitor/expected/pg19/expected/create_extension.out
new file mode 120000
index 000000000..216e58e22
--- /dev/null
+++ b/src/monitor/expected/pg19/expected/create_extension.out
@@ -0,0 +1 @@
+../../create_extension.out
\ No newline at end of file
diff --git a/src/monitor/expected/pg19/expected/drop_extension.out b/src/monitor/expected/pg19/expected/drop_extension.out
new file mode 120000
index 000000000..ed37f45e1
--- /dev/null
+++ b/src/monitor/expected/pg19/expected/drop_extension.out
@@ -0,0 +1 @@
+../../drop_extension.out
\ No newline at end of file
diff --git a/src/monitor/expected/pg19/expected/dummy_update.out b/src/monitor/expected/pg19/expected/dummy_update.out
new file mode 120000
index 000000000..aa5374291
--- /dev/null
+++ b/src/monitor/expected/pg19/expected/dummy_update.out
@@ -0,0 +1 @@
+../../dummy_update.out
\ No newline at end of file
diff --git a/src/monitor/expected/pg19/expected/fast_forward.out b/src/monitor/expected/pg19/expected/fast_forward.out
new file mode 100644
index 000000000..be1069382
--- /dev/null
+++ b/src/monitor/expected/pg19/expected/fast_forward.out
@@ -0,0 +1,387 @@
+-- Copyright (c) Microsoft Corporation. All rights reserved.
+-- Licensed under the PostgreSQL License.
+--
+-- Regression tests for the fast_forward WAL-fetch stuck detection introduced
+-- in group_state_machine.c (ProceedGroupStateForMSFailover).
+--
+-- Scenario: 3-node formation (p + s1 + s2, number_sync_standbys=1).
+--   p  dies → draining.
+--   s1 has the higher LSN (0/5100) → stays in report_lsn (WAL source).
+--   s2 has a lower LSN (0/5000) but higher candidate_priority → selected as
+--      fast_forward candidate.
+--   s1 then becomes unhealthy → s2's WAL fetch has no source.
+--
+-- Test A (guard_data_loss=true):
+--   node_active for s2 with reportedState=report_lsn resets s2 goal to
+--   report_lsn (stuck-fast_forward guard fires).
+--
+-- Test B (guard_data_loss=false):
+--   node_active for s2 with reportedState=report_lsn falls through; s2 goal
+--   stays fast_forward.
+--
+-- Also exercises get_most_advanced_standby() directly:
+--   guard_data_loss=true  → returns s1 (unhealthy but included by SQL filter).
+--   guard_data_loss=false → returns no rows (unhealthy nodes filtered out,
+--                           s2 excluded by caller_node_id).
+\x on
+-- ── formation setup ──────────────────────────────────────────────────────────
+SELECT pgautofailover.create_formation('ff_test', 'pgsql', 'postgres', true, 1);
+-[ RECORD 1 ]----+-----------------------------
+create_formation | (ff_test,pgsql,postgres,t,1)
+
+-- Register three nodes.
+SELECT *
+  FROM pgautofailover.register_node('ff_test', 'ff_p', 5432,
+                                    'postgres', 'ff_p', 1);
+-[ RECORD 1 ]---------------+-------
+assigned_node_id            | 13
+assigned_group_id           | 0
+assigned_group_state        | single
+assigned_candidate_priority | 100
+assigned_replication_quorum | t
+assigned_node_name          | ff_p
+
+SELECT nodeid AS np FROM pgautofailover.node
+ WHERE formationid = 'ff_test' AND nodename = 'ff_p' \gset
+SELECT *
+  FROM pgautofailover.register_node('ff_test', 'ff_s1', 5432,
+                                    'postgres', 'ff_s1', 1);
+-[ RECORD 1 ]---------------+-------------
+assigned_node_id            | 14
+assigned_group_id           | 0
+assigned_group_state        | wait_standby
+assigned_candidate_priority | 100
+assigned_replication_quorum | t
+assigned_node_name          | ff_s1
+
+SELECT nodeid AS ns1 FROM pgautofailover.node
+ WHERE formationid = 'ff_test' AND nodename = 'ff_s1' \gset
+SELECT *
+  FROM pgautofailover.register_node('ff_test', 'ff_s2', 5432,
+                                    'postgres', 'ff_s2', 1);
+-[ RECORD 1 ]---------------+-------------
+assigned_node_id            | 15
+assigned_group_id           | 0
+assigned_group_state        | wait_standby
+assigned_candidate_priority | 100
+assigned_replication_quorum | t
+assigned_node_name          | ff_s2
+
+SELECT nodeid AS ns2 FROM pgautofailover.node
+ WHERE formationid = 'ff_test' AND nodename = 'ff_s2' \gset
+-- ── bootstrap ────────────────────────────────────────────────────────────────
+-- p: single (confirm)
+SELECT assigned_group_state
+  FROM pgautofailover.node_active('ff_test', :np, 0,
+                                  current_group_role => 'single');
+-[ RECORD 1 ]--------+-------
+assigned_group_state | single
+
+-- s1: wait_standby (confirm)
+SELECT assigned_group_state
+  FROM pgautofailover.node_active('ff_test', :ns1, 0,
+                                  current_group_role => 'wait_standby');
+-[ RECORD 1 ]--------+-------------
+assigned_group_state | wait_standby
+
+-- p: single → wait_primary
+SELECT assigned_group_state
+  FROM pgautofailover.node_active('ff_test', :np, 0,
+                                  current_group_role => 'single',
+                                  current_lsn => '0/5000');
+-[ RECORD 1 ]--------+-------------
+assigned_group_state | wait_primary
+
+-- p: wait_primary (confirm)
+SELECT assigned_group_state
+  FROM pgautofailover.node_active('ff_test', :np, 0,
+                                  current_group_role => 'wait_primary',
+                                  current_lsn => '0/5000');
+-[ RECORD 1 ]--------+-------------
+assigned_group_state | wait_primary
+
+-- s1: wait_standby → catchingup
+SELECT assigned_group_state
+  FROM pgautofailover.node_active('ff_test', :ns1, 0,
+                                  current_group_role => 'wait_standby');
+-[ RECORD 1 ]--------+-----------
+assigned_group_state | catchingup
+
+-- s1: catchingup → secondary
+SELECT assigned_group_state
+  FROM pgautofailover.node_active('ff_test', :ns1, 0,
+                                  current_group_role => 'catchingup',
+                                  current_lsn => '0/5000');
+-[ RECORD 1 ]--------+----------
+assigned_group_state | secondary
+
+-- s1: secondary (confirm)
+SELECT assigned_group_state
+  FROM pgautofailover.node_active('ff_test', :ns1, 0,
+                                  current_group_role => 'secondary',
+                                  current_lsn => '0/5000');
+-[ RECORD 1 ]--------+----------
+assigned_group_state | secondary
+
+-- p: wait_primary → primary (s1 is now secondary)
+SELECT assigned_group_state
+  FROM pgautofailover.node_active('ff_test', :np, 0,
+                                  current_group_role => 'wait_primary',
+                                  current_lsn => '0/5000');
+-[ RECORD 1 ]--------+--------
+assigned_group_state | primary
+
+-- p: primary (confirm)
+SELECT assigned_group_state
+  FROM pgautofailover.node_active('ff_test', :np, 0,
+                                  current_group_role => 'primary',
+                                  current_lsn => '0/5000');
+-[ RECORD 1 ]--------+--------
+assigned_group_state | primary
+
+-- s1: secondary (confirm after primary confirmed)
+SELECT assigned_group_state
+  FROM pgautofailover.node_active('ff_test', :ns1, 0,
+                                  current_group_role => 'secondary',
+                                  current_lsn => '0/5000');
+-[ RECORD 1 ]--------+----------
+assigned_group_state | secondary
+
+-- s2: wait_standby (confirm)
+SELECT assigned_group_state
+  FROM pgautofailover.node_active('ff_test', :ns2, 0,
+                                  current_group_role => 'wait_standby');
+-[ RECORD 1 ]--------+-----------
+assigned_group_state | catchingup
+
+-- s2: catchingup
+SELECT assigned_group_state
+  FROM pgautofailover.node_active('ff_test', :ns2, 0,
+                                  current_group_role => 'catchingup',
+                                  current_lsn => '0/5000');
+-[ RECORD 1 ]--------+-----------
+assigned_group_state | catchingup
+
+-- s2: secondary
+SELECT assigned_group_state
+  FROM pgautofailover.node_active('ff_test', :ns2, 0,
+                                  current_group_role => 'secondary',
+                                  current_lsn => '0/5000');
+-[ RECORD 1 ]--------+-----------
+assigned_group_state | catchingup
+
+-- p: primary (refresh to pick up second secondary)
+SELECT assigned_group_state
+  FROM pgautofailover.node_active('ff_test', :np, 0,
+                                  current_group_role => 'primary',
+                                  current_lsn => '0/5000');
+-[ RECORD 1 ]--------+---------------
+assigned_group_state | apply_settings
+
+-- Verify final formation state: p=primary, s1=secondary, s2=secondary.
+SELECT nodename, goalstate, reportedstate
+  FROM pgautofailover.node
+ WHERE formationid = 'ff_test'
+ ORDER BY nodename;
+-[ RECORD 1 ]-+---------------
+nodename      | ff_p
+goalstate     | apply_settings
+reportedstate | primary
+-[ RECORD 2 ]-+---------------
+nodename      | ff_s1
+goalstate     | secondary
+reportedstate | secondary
+-[ RECORD 3 ]-+---------------
+nodename      | ff_s2
+goalstate     | catchingup
+reportedstate | secondary
+
+-- ── set up fast_forward scenario ─────────────────────────────────────────────
+--
+-- s2 has higher candidate priority so the monitor elects it as fast_forward
+-- candidate.  s1 has the higher LSN and stays in report_lsn (WAL source).
+-- We then make s1 unhealthy so s2's WAL fetch has no valid source.
+SET pgautofailover.startup_grace_period = 1;
+-- Mark p as dead.
+UPDATE pgautofailover.node
+   SET health = 0,
+       healthchecktime = now(),
+       reporttime = now() - interval '60 seconds'
+ WHERE formationid = 'ff_test' AND nodename = 'ff_p';
+-- Demote p to draining.
+UPDATE pgautofailover.node
+   SET goalstate = 'draining', reportedstate = 'draining'
+ WHERE formationid = 'ff_test' AND nodename = 'ff_p';
+-- s1 reported a higher LSN (0/5100) in the report_lsn round.
+UPDATE pgautofailover.node
+   SET goalstate      = 'report_lsn',
+       reportedstate  = 'report_lsn',
+       reportedlsn    = '0/5100'
+ WHERE formationid = 'ff_test' AND nodename = 'ff_s1';
+-- s2 has candidate_priority 90 < 100 (lower than s1's default 100) but for
+-- the purpose of this test we give it priority 110 so the monitor prefers it.
+-- We then place s2 directly in fast_forward/report_lsn (goal assigned by the
+-- monitor, not yet confirmed by the keeper).
+UPDATE pgautofailover.node
+   SET candidatepriority = 110,
+       reportedlsn       = '0/5000',
+       goalstate         = 'fast_forward',
+       reportedstate     = 'report_lsn'
+ WHERE formationid = 'ff_test' AND nodename = 'ff_s2';
+-- Make s1 unhealthy: it cannot serve as a WAL source.
+UPDATE pgautofailover.node
+   SET health = 0,
+       healthchecktime = now(),
+       reporttime = now() - interval '60 seconds'
+ WHERE formationid = 'ff_test' AND nodename = 'ff_s1';
+-- Verify manufactured state before tests.
+SELECT nodename, goalstate, reportedstate, reportedlsn, health, candidatepriority
+  FROM pgautofailover.node
+ WHERE formationid = 'ff_test'
+ ORDER BY nodename;
+-[ RECORD 1 ]-----+-------------
+nodename          | ff_p
+goalstate         | draining
+reportedstate     | draining
+reportedlsn       | 0/00005000
+health            | 0
+candidatepriority | 100
+-[ RECORD 2 ]-----+-------------
+nodename          | ff_s1
+goalstate         | report_lsn
+reportedstate     | report_lsn
+reportedlsn       | 0/00005100
+health            | 0
+candidatepriority | 100
+-[ RECORD 3 ]-----+-------------
+nodename          | ff_s2
+goalstate         | fast_forward
+reportedstate     | report_lsn
+reportedlsn       | 0/00005000
+health            | -1
+candidatepriority | 110
+
+-- ── test A: guard_data_loss = true (default) resets goal to report_lsn ──────
+--
+-- s2 calls node_active with reportedState=report_lsn while goalState is
+-- fast_forward and all WAL source nodes (s1) are unhealthy.
+-- The stuck-fast_forward guard must reset s2's goal back to report_lsn.
+SET pgautofailover.guard_data_loss TO true;
+SELECT assigned_group_state
+  FROM pgautofailover.node_active('ff_test', :ns2, 0,
+                                  current_group_role => 'report_lsn',
+                                  current_lsn => '0/5000',
+                                  current_tli => 1,
+                                  current_pg_is_running => true);
+-[ RECORD 1 ]--------+-----------
+assigned_group_state | report_lsn
+
+-- s2 goal must now be report_lsn (reset by the guard).
+SELECT nodename, goalstate, reportedstate
+  FROM pgautofailover.node
+ WHERE formationid = 'ff_test'
+ ORDER BY nodename;
+-[ RECORD 1 ]-+-----------
+nodename      | ff_p
+goalstate     | draining
+reportedstate | draining
+-[ RECORD 2 ]-+-----------
+nodename      | ff_s1
+goalstate     | report_lsn
+reportedstate | report_lsn
+-[ RECORD 3 ]-+-----------
+nodename      | ff_s2
+goalstate     | report_lsn
+reportedstate | report_lsn
+
+-- ── re-arm fast_forward scenario for test B ──────────────────────────────────
+--
+-- Put s2 back into fast_forward goal / report_lsn reported state,
+-- s1 still unhealthy.
+UPDATE pgautofailover.node
+   SET goalstate = 'fast_forward', reportedstate = 'report_lsn'
+ WHERE formationid = 'ff_test' AND nodename = 'ff_s2';
+-- Confirm re-armed state.
+SELECT nodename, goalstate, reportedstate, health
+  FROM pgautofailover.node
+ WHERE formationid = 'ff_test'
+ ORDER BY nodename;
+-[ RECORD 1 ]-+-------------
+nodename      | ff_p
+goalstate     | draining
+reportedstate | draining
+health        | 0
+-[ RECORD 2 ]-+-------------
+nodename      | ff_s1
+goalstate     | report_lsn
+reportedstate | report_lsn
+health        | 0
+-[ RECORD 3 ]-+-------------
+nodename      | ff_s2
+goalstate     | fast_forward
+reportedstate | report_lsn
+health        | -1
+
+-- ── test B: guard_data_loss = false — goal stays fast_forward ────────────────
+--
+-- The guard logs the situation but does NOT reset s2's goal; it falls through
+-- to ProceedWithMSFailover.  get_most_advanced_standby() will find no healthy
+-- WAL source and fsm_fast_forward() will skip the fetch, causing the keeper to
+-- call node_active again with reportedState=fast_forward, at which point the
+-- monitor assigns prepare_promotion.  Here we only verify that the immediate
+-- node_active response does NOT return report_lsn (goal is kept or advanced).
+SET pgautofailover.guard_data_loss TO false;
+SELECT assigned_group_state
+  FROM pgautofailover.node_active('ff_test', :ns2, 0,
+                                  current_group_role => 'report_lsn',
+                                  current_lsn => '0/5000',
+                                  current_tli => 1,
+                                  current_pg_is_running => true);
+-[ RECORD 1 ]--------+-------------
+assigned_group_state | fast_forward
+
+-- s2 goal must NOT be reset to report_lsn; it should be fast_forward or
+-- further advanced (prepare_promotion).
+SELECT nodename, goalstate, reportedstate
+  FROM pgautofailover.node
+ WHERE formationid = 'ff_test'
+ ORDER BY nodename;
+-[ RECORD 1 ]-+-------------
+nodename      | ff_p
+goalstate     | draining
+reportedstate | draining
+-[ RECORD 2 ]-+-------------
+nodename      | ff_s1
+goalstate     | report_lsn
+reportedstate | report_lsn
+-[ RECORD 3 ]-+-------------
+nodename      | ff_s2
+goalstate     | fast_forward
+reportedstate | report_lsn
+
+-- ── test get_most_advanced_standby directly ───────────────────────────────────
+--
+-- Restore s2 to fast_forward / report_lsn so both nodes are in report_lsn.
+UPDATE pgautofailover.node
+   SET goalstate = 'fast_forward', reportedstate = 'report_lsn'
+ WHERE formationid = 'ff_test' AND nodename = 'ff_s2';
+-- guard_data_loss=true: s1 is included despite health=0 (SQL filter uses OR).
+-- Caller is s2 (:ns2) so s1 should be returned (highest LSN among others).
+SET pgautofailover.guard_data_loss TO true;
+SELECT node_name, node_lsn, node_is_primary
+  FROM pgautofailover.get_most_advanced_standby('ff_test', 0, :ns2);
+-[ RECORD 1 ]---+-----------
+node_name       | ff_s1
+node_lsn        | 0/00005100
+node_is_primary | f
+
+-- guard_data_loss=false: unhealthy nodes are excluded; s1 (health=0) is
+-- filtered out.  s2 itself is excluded via caller_node_id.  Expect no rows.
+SET pgautofailover.guard_data_loss TO false;
+SELECT node_name, node_lsn, node_is_primary
+  FROM pgautofailover.get_most_advanced_standby('ff_test', 0, :ns2);
+(0 rows)
+
+-- ── cleanup ───────────────────────────────────────────────────────────────────
+RESET pgautofailover.guard_data_loss;
+RESET pgautofailover.startup_grace_period;
diff --git a/src/monitor/expected/pg19/expected/guard_data_loss.out b/src/monitor/expected/pg19/expected/guard_data_loss.out
new file mode 120000
index 000000000..a63a73689
--- /dev/null
+++ b/src/monitor/expected/pg19/expected/guard_data_loss.out
@@ -0,0 +1 @@
+../../guard_data_loss.out
\ No newline at end of file
diff --git a/src/monitor/expected/pg19/expected/monitor.out b/src/monitor/expected/pg19/expected/monitor.out
new file mode 100644
index 000000000..22f3aafb8
--- /dev/null
+++ b/src/monitor/expected/pg19/expected/monitor.out
@@ -0,0 +1,248 @@
+-- Copyright (c) Microsoft Corporation. All rights reserved.
+-- Licensed under the PostgreSQL License.
+\x on
+select *
+  from pgautofailover.register_node('default', 'localhost', 9876, 'postgres');
+-[ RECORD 1 ]---------------+-------
+assigned_node_id            | 1
+assigned_group_id           | 0
+assigned_group_state        | single
+assigned_candidate_priority | 100
+assigned_replication_quorum | t
+assigned_node_name          | node_1
+
+select *
+  from pgautofailover.set_node_system_identifier(1, 6852685710417058800);
+-[ RECORD 1 ]--------
+node_id   | 1
+node_name | node_1
+node_host | localhost
+node_port | 9876
+
+-- node_1 reports single
+select *
+  from pgautofailover.node_active('default', 1, 0,
+                                  current_group_role => 'single');
+-[ RECORD 1 ]---------------+-------
+assigned_node_id            | 1
+assigned_group_id           | 0
+assigned_group_state        | single
+assigned_candidate_priority | 100
+assigned_replication_quorum | t
+
+-- register node_2
+select *
+  from pgautofailover.register_node('default', 'localhost', 9877, 'postgres');
+-[ RECORD 1 ]---------------+-------------
+assigned_node_id            | 2
+assigned_group_id           | 0
+assigned_group_state        | wait_standby
+assigned_candidate_priority | 100
+assigned_replication_quorum | t
+assigned_node_name          | node_2
+
+-- node_2 reports wait_standby already
+select *
+  from pgautofailover.node_active('default', 2, 0,
+                                  current_group_role => 'wait_standby');
+-[ RECORD 1 ]---------------+-------------
+assigned_node_id            | 2
+assigned_group_id           | 0
+assigned_group_state        | wait_standby
+assigned_candidate_priority | 100
+assigned_replication_quorum | t
+
+-- node_1 reports single again, and gets assigned wait_primary
+select *
+  from pgautofailover.node_active('default', 1, 0,
+                                  current_group_role => 'single');
+-[ RECORD 1 ]---------------+-------------
+assigned_node_id            | 1
+assigned_group_id           | 0
+assigned_group_state        | wait_primary
+assigned_candidate_priority | 100
+assigned_replication_quorum | t
+
+-- node_1 now reports wait_primary
+select *
+  from pgautofailover.node_active('default', 1, 0,
+                                  current_group_role => 'wait_primary');
+-[ RECORD 1 ]---------------+-------------
+assigned_node_id            | 1
+assigned_group_id           | 0
+assigned_group_state        | wait_primary
+assigned_candidate_priority | 100
+assigned_replication_quorum | t
+
+-- node_2 now reports wait_standby, gets assigned catchingup
+select *
+  from pgautofailover.node_active('default', 2, 0,
+                                  current_group_role => 'wait_standby');
+-[ RECORD 1 ]---------------+-----------
+assigned_node_id            | 2
+assigned_group_id           | 0
+assigned_group_state        | catchingup
+assigned_candidate_priority | 100
+assigned_replication_quorum | t
+
+-- register node_3 concurrently to node2 (probably) doing pg_basebackup
+select *
+  from pgautofailover.register_node('default', 'localhost', 9879, 'postgres');
+-[ RECORD 1 ]---------------+-------------
+assigned_node_id            | 3
+assigned_group_id           | 0
+assigned_group_state        | wait_standby
+assigned_candidate_priority | 100
+assigned_replication_quorum | t
+assigned_node_name          | node_3
+
+select formationid, nodename, goalstate, reportedstate
+  from pgautofailover.node;
+-[ RECORD 1 ]-+-------------
+formationid   | default
+nodename      | node_1
+goalstate     | wait_primary
+reportedstate | wait_primary
+-[ RECORD 2 ]-+-------------
+formationid   | default
+nodename      | node_2
+goalstate     | catchingup
+reportedstate | wait_standby
+-[ RECORD 3 ]-+-------------
+formationid   | default
+nodename      | node_3
+goalstate     | wait_standby
+reportedstate | init
+
+table pgautofailover.formation;
+-[ RECORD 1 ]--------+---------
+formationid          | default
+kind                 | pgsql
+dbname               | postgres
+opt_secondary        | t
+number_sync_standbys | 1
+
+-- dump the pgautofailover.node table, omitting the timely columns
+  select formationid, nodeid, groupid, nodehost, nodeport,
+         goalstate, reportedstate, reportedpgisrunning, reportedrepstate
+    from pgautofailover.node
+order by nodeid;
+-[ RECORD 1 ]-------+-------------
+formationid         | default
+nodeid              | 1
+groupid             | 0
+nodehost            | localhost
+nodeport            | 9876
+goalstate           | wait_primary
+reportedstate       | wait_primary
+reportedpgisrunning | t
+reportedrepstate    | unknown
+-[ RECORD 2 ]-------+-------------
+formationid         | default
+nodeid              | 2
+groupid             | 0
+nodehost            | localhost
+nodeport            | 9877
+goalstate           | catchingup
+reportedstate       | wait_standby
+reportedpgisrunning | t
+reportedrepstate    | unknown
+-[ RECORD 3 ]-------+-------------
+formationid         | default
+nodeid              | 3
+groupid             | 0
+nodehost            | localhost
+nodeport            | 9879
+goalstate           | wait_standby
+reportedstate       | init
+reportedpgisrunning | t
+reportedrepstate    | async
+
+select * from pgautofailover.get_primary('unknown formation');
+ERROR:  group has no writable node right now
+select * from pgautofailover.get_primary(group_id => -10);
+ERROR:  group has no writable node right now
+select * from pgautofailover.get_primary();
+-[ RECORD 1 ]---+----------
+primary_node_id | 1
+primary_name    | node_1
+primary_host    | localhost
+primary_port    | 9876
+
+select * from pgautofailover.get_primary('default', 0);
+-[ RECORD 1 ]---+----------
+primary_node_id | 1
+primary_name    | node_1
+primary_host    | localhost
+primary_port    | 9876
+
+select * from pgautofailover.get_other_nodes(1);
+-[ RECORD 1 ]---+-----------
+node_id         | 2
+node_name       | node_2
+node_host       | localhost
+node_port       | 9877
+node_lsn        | 0/00000000
+node_is_primary | f
+-[ RECORD 2 ]---+-----------
+node_id         | 3
+node_name       | node_3
+node_host       | localhost
+node_port       | 9879
+node_lsn        | 0/00000000
+node_is_primary | f
+
+-- remove the primary node
+select pgautofailover.remove_node(1);
+-[ RECORD 1 ]--
+remove_node | t
+
+table pgautofailover.formation;
+-[ RECORD 1 ]--------+---------
+formationid          | default
+kind                 | pgsql
+dbname               | postgres
+opt_secondary        | t
+number_sync_standbys | 0
+
+select pgautofailover.remove_node(1, force => 'true');
+-[ RECORD 1 ]--
+remove_node | t
+
+-- dump the pgautofailover.node table, omitting the timely columns
+  select formationid, nodeid, groupid, nodehost, nodeport,
+         goalstate, reportedstate, reportedpgisrunning, reportedrepstate
+    from pgautofailover.node
+order by nodeid;
+-[ RECORD 1 ]-------+-------------
+formationid         | default
+nodeid              | 2
+groupid             | 0
+nodehost            | localhost
+nodeport            | 9877
+goalstate           | report_lsn
+reportedstate       | wait_standby
+reportedpgisrunning | t
+reportedrepstate    | unknown
+-[ RECORD 2 ]-------+-------------
+formationid         | default
+nodeid              | 3
+groupid             | 0
+nodehost            | localhost
+nodeport            | 9879
+goalstate           | report_lsn
+reportedstate       | init
+reportedpgisrunning | t
+reportedrepstate    | async
+
+select *
+  from pgautofailover.set_node_system_identifier(2, 6852685710417058800);
+-[ RECORD 1 ]--------
+node_id   | 2
+node_name | node_2
+node_host | localhost
+node_port | 9877
+
+-- should fail as there's no primary at this point
+select pgautofailover.perform_failover();
+ERROR:  couldn't find the primary node in formation "default", group 0
diff --git a/src/monitor/expected/pg19/expected/node_active_protocol.out b/src/monitor/expected/pg19/expected/node_active_protocol.out
new file mode 120000
index 000000000..ca0f584fc
--- /dev/null
+++ b/src/monitor/expected/pg19/expected/node_active_protocol.out
@@ -0,0 +1 @@
+../../node_active_protocol.out
\ No newline at end of file
diff --git a/src/monitor/expected/pg19/expected/upgrade.out b/src/monitor/expected/pg19/expected/upgrade.out
new file mode 120000
index 000000000..226fe1b62
--- /dev/null
+++ b/src/monitor/expected/pg19/expected/upgrade.out
@@ -0,0 +1 @@
+../../upgrade.out
\ No newline at end of file
diff --git a/src/monitor/expected/pg19/expected/upgrade_1.out b/src/monitor/expected/pg19/expected/upgrade_1.out
new file mode 120000
index 000000000..ed3773e86
--- /dev/null
+++ b/src/monitor/expected/pg19/expected/upgrade_1.out
@@ -0,0 +1 @@
+../../upgrade_1.out
\ No newline at end of file
diff --git a/src/monitor/expected/pg19/expected/workers.out b/src/monitor/expected/pg19/expected/workers.out
new file mode 120000
index 000000000..10e062f41
--- /dev/null
+++ b/src/monitor/expected/pg19/expected/workers.out
@@ -0,0 +1 @@
+../../workers.out
\ No newline at end of file
diff --git a/src/monitor/health_check_worker.c b/src/monitor/health_check_worker.c
index b19f7fa6a..34be3895e 100644
--- a/src/monitor/health_check_worker.c
+++ b/src/monitor/health_check_worker.c
@@ -30,6 +30,7 @@
 #include "storage/latch.h"
 #include "storage/lmgr.h"
 #include "storage/lwlock.h"
+#include "utils/wait_event.h"
 #include "storage/proc.h"
 #include "storage/shmem.h"
 
@@ -221,7 +222,7 @@ HealthCheckWorkerLauncherMain(Datum arg)
 
 	/* Establish signal handlers before unblocking signals. */
 	pqsignal(SIGHUP, pg_auto_failover_monitor_sighup);
-	pqsignal(SIGINT, SIG_IGN);
+	pqsignal(SIGINT, PG_SIG_IGN);
 	pqsignal(SIGTERM, pg_auto_failover_monitor_sigterm);
 
 	/* We're now ready to receive signals */
@@ -518,7 +519,7 @@ HealthCheckWorkerMain(Datum arg)
 
 	/* Establish signal handlers before unblocking signals. */
 	pqsignal(SIGHUP, pg_auto_failover_monitor_sighup);
-	pqsignal(SIGINT, SIG_IGN);
+	pqsignal(SIGINT, PG_SIG_IGN);
 	pqsignal(SIGTERM, pg_auto_failover_monitor_sigterm);
 
 	/* We're now ready to receive signals */
@@ -864,10 +865,10 @@ ManageHealthCheck(HealthCheck *healthCheck, struct timeval currentTime)
 				break;
 			}
 
-			/* Fall through to re-connect */
+			/* fall through to re-connect */
+			pg_fallthrough;
 		}
 
-		/* fallthrough */
 		case HEALTH_CHECK_INITIAL:
 		{
 			StringInfo connInfoString = makeStringInfo();
@@ -1120,11 +1121,10 @@ HealthCheckWorkerShmemInit(void)
 	 */
 	if (!alreadyInitialized)
 	{
-		HealthCheckHelperControl->trancheId = LWLockNewTrancheId();
 		HealthCheckHelperControl->lockTrancheName =
 			"pg_auto_failover Health Check Daemon";
-		LWLockRegisterTranche(HealthCheckHelperControl->trancheId,
-							  HealthCheckHelperControl->lockTrancheName);
+		LWLockNewTrancheIdCompat(HealthCheckHelperControl->trancheId,
+								 HealthCheckHelperControl->lockTrancheName);
 
 		LWLockInitialize(&HealthCheckHelperControl->lock,
 						 HealthCheckHelperControl->trancheId);
@@ -1136,10 +1136,9 @@ HealthCheckWorkerShmemInit(void)
 	hashInfo.hash = tag_hash;
 	int hashFlags = (HASH_ELEM | HASH_FUNCTION);
 
-	HealthCheckWorkerDBHash = ShmemInitHash("pg_auto_failover Database Hash",
-											max_worker_processes,
-											max_worker_processes,
-											&hashInfo, hashFlags);
+	HealthCheckWorkerDBHash = ShmemInitHashCompat("pg_auto_failover Database Hash",
+												  max_worker_processes,
+												  &hashInfo, hashFlags);
 
 	LWLockRelease(AddinShmemInitLock);
 
diff --git a/src/monitor/metadata.c b/src/monitor/metadata.c
index 81614b2eb..d9e0301a2 100644
--- a/src/monitor/metadata.c
+++ b/src/monitor/metadata.c
@@ -31,6 +31,8 @@
 #include "executor/spi.h"
 #include "lib/stringinfo.h"
 #include "nodes/pg_list.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
@@ -182,7 +184,7 @@ LockNodeGroup(char *formationId, int groupId, LOCKMODE lockMode)
  * definition (schema and SQL definitions of C coded functions).
  */
 void
-checkPgAutoFailoverVersion()
+checkPgAutoFailoverVersion(void)
 {
 	char *installedVersion = NULL;
 	char *availableVersion = NULL;
diff --git a/src/monitor/version_compat.h b/src/monitor/version_compat.h
index 82f36abc0..4294b6484 100644
--- a/src/monitor/version_compat.h
+++ b/src/monitor/version_compat.h
@@ -14,8 +14,8 @@
 
 #include "postgres.h"
 
-/* we support Postgres versions 10, 11, 12, 13, 14, 15, 16, 17, 18. */
-#if (PG_VERSION_NUM < 100000 || PG_VERSION_NUM >= 190000)
+/* we support Postgres versions 10, 11, 12, 13, 14, 15, 16, 17, 18, 19. */
+#if (PG_VERSION_NUM < 100000 || PG_VERSION_NUM >= 200000)
 #error "Unknown or unsupported postgresql version"
 #endif
 
@@ -77,6 +77,78 @@ HeapTupleGetOid(HeapTuple tuple)
 
 #endif
 
+/*
+ * PG19 API changes:
+ *
+ * 1. LWLockNewTrancheId() now takes the tranche name as a parameter and
+ *    internally registers it, so LWLockRegisterTranche() was removed.
+ *
+ * 2. ShmemInitHash() dropped the separate init/max size arguments; the single
+ *    nelems argument now covers both.
+ *
+ * 3. PG_SIG_IGN/PG_SIG_DFL replace raw SIG_IGN/SIG_DFL for pqsignal() calls
+ *    because pqsigfunc changed to use the SA_SIGINFO two-argument form.
+ *
+ * 4. utils/wait_event.h (and the generated wait_event_types.h) must be
+ *    included explicitly; pgstat.h no longer pulls it in transitively.
+ */
+#if (PG_VERSION_NUM >= 190000)
+
+#include "utils/wait_event.h"
+
+/* LWLockNewTrancheId(name) merged LWLockRegisterTranche into itself */
+#define LWLockNewTrancheIdCompat(id_out, name) \
+	do { (id_out) = LWLockNewTrancheId(name); } while (0)
+
+/* ShmemInitHash lost the separate init_size parameter */
+#define ShmemInitHashCompat(name, nelems, infoP, flags) \
+	ShmemInitHash(name, nelems, infoP, flags)
+
+#else
+
+#define LWLockNewTrancheIdCompat(id_out, name) \
+	do { \
+		(id_out) = LWLockNewTrancheId(); \
+		LWLockRegisterTranche((id_out), (name)); \
+	} while (0)
+
+#define ShmemInitHashCompat(name, nelems, infoP, flags) \
+	ShmemInitHash(name, nelems, nelems, infoP, flags)
+
+#endif /* PG_VERSION_NUM >= 190000 */
+
+/*
+ * PG_SIG_IGN and PG_SIG_DFL were introduced in PG19 as properly-typed
+ * wrappers around SIG_IGN/SIG_DFL for use with pqsignal().
+ */
+#if (PG_VERSION_NUM < 190000)
+#ifndef PG_SIG_IGN
+#define PG_SIG_IGN SIG_IGN
+#endif
+#ifndef PG_SIG_DFL
+#define PG_SIG_DFL SIG_DFL
+#endif
+#endif
+
+/*
+ * pg_fallthrough was introduced in PG12.  Provide a no-op for older versions
+ * and an attribute-based version for compilers that support it when building
+ * against PG12+.
+ */
+#ifndef pg_fallthrough
+#if __has_attribute(fallthrough)
+#define pg_fallthrough __attribute__((fallthrough))
+#else
+#define pg_fallthrough
+#endif
+#endif
+
+/* utils/timestamp.h is no longer pulled in transitively by miscadmin.h
+ * in PG19; include it here so monitors that use timestamp functions compile. */
+#if (PG_VERSION_NUM >= 190000)
+#include "utils/timestamp.h"
+#endif
+
 /* Removed in Postgres 16 development */
 #ifndef Abs
 
diff --git a/tests/tap/schedule b/tests/tap/schedule
index a90a0ad67..8aad33a35 100644
--- a/tests/tap/schedule
+++ b/tests/tap/schedule
@@ -29,6 +29,9 @@ installcheck
 # Upgrade test — requires pgaf:current and pgaf:next images to be pre-built:
 #   make -C tests/upgrade pgaf-current pgaf-next
 upgrade
+# Debug/diagnostic specs — not run in CI, useful for interactive investigation:
+# debug_failover_pg19
+
 # Citus tests (uncomment when CITUS_CLUSTER=1):
 # basic_citus_operation
 # citus_cluster_name
diff --git a/tests/tap/specs/debug_failover_pg19.pgaf b/tests/tap/specs/debug_failover_pg19.pgaf
new file mode 100644
index 000000000..23961b92c
--- /dev/null
+++ b/tests/tap/specs/debug_failover_pg19.pgaf
@@ -0,0 +1,197 @@
+# Diagnostic spec for PG19 failover stall — NOT in the CI schedule.
+#
+# Run interactively to inspect monitor internals during a failover:
+#   pgaftest run tests/tap/specs/debug_failover_pg19.pgaf
+#
+# Mirrors the basic_operation test_010_fail_primary scenario but polls
+# pg_stat_wal_receiver, pg_stat_activity, and the monitor's node table every
+# few seconds during the 90-second failover window so you can observe exactly
+# what state each node is reporting and whether the FSM is advancing.
+#
+# Originally written to root-cause the PG19 failover stall caused by the
+# wrong PgStartTime→MyStartTimestamp shim in version_compat.h (fixed in
+# commit ac6d3b4).  Kept as a reusable template for debugging FSM stalls.
+
+cluster {
+    monitor
+    ssl off
+    formation {
+        node1
+        node2
+    }
+}
+
+setup {
+    wait until primary, secondary  timeout 120s
+}
+
+teardown {
+    compose down
+}
+
+step test_001_baseline {
+    sql monitor {
+        SELECT nodename, reportedstate, goalstate,
+               health, reportedtli, reportedlsn,
+               now() - reporttime AS report_age
+        FROM pgautofailover.node ORDER BY nodeid;
+    }
+    sql node2 {
+        SELECT status, received_tli, latest_end_lsn,
+               sender_host, sender_port
+        FROM pg_stat_wal_receiver;
+    }
+    sql monitor {
+        SELECT timeline_id FROM pg_control_checkpoint();
+    }
+    sql node2 {
+        SELECT timeline_id FROM pg_control_checkpoint();
+    }
+}
+
+step test_002_disconnect_primary {
+    network disconnect node1
+}
+
+step test_003_poll_5s {
+    sleep 5s
+    sql monitor {
+        SELECT nodename, reportedstate, goalstate,
+               health, reportedtli, reportedlsn,
+               now() - reporttime AS report_age
+        FROM pgautofailover.node ORDER BY nodeid;
+    }
+    sql node2 {
+        SELECT status, received_tli, latest_end_lsn
+        FROM pg_stat_wal_receiver;
+    }
+    sql node2 {
+        SELECT timeline_id FROM pg_control_checkpoint();
+    }
+}
+
+step test_004_poll_15s {
+    sleep 10s
+    sql monitor {
+        SELECT nodename, reportedstate, goalstate,
+               health, reportedtli, reportedlsn,
+               now() - reporttime AS report_age
+        FROM pgautofailover.node ORDER BY nodeid;
+    }
+    sql node2 {
+        SELECT status, received_tli, latest_end_lsn
+        FROM pg_stat_wal_receiver;
+    }
+}
+
+step test_005_poll_30s {
+    sleep 15s
+    sql monitor {
+        SELECT nodename, reportedstate, goalstate,
+               health, reportedtli, reportedlsn,
+               now() - reporttime AS report_age
+        FROM pgautofailover.node ORDER BY nodeid;
+    }
+    sql monitor {
+        SELECT pg_postmaster_start_time() AS pg_start,
+               now(),
+               n.nodename,
+               n.reportedpgisrunning,
+               n.health,
+               extract(epoch from now() - n.reporttime)*1000 AS report_age_ms,
+               extract(epoch from n.healthchecktime - pg_postmaster_start_time())*1000 AS hc_after_start_ms,
+               extract(epoch from now() - pg_postmaster_start_time())*1000 AS uptime_ms,
+               20000 AS unhealthy_timeout_ms,
+               10000 AS grace_period_ms
+        FROM pgautofailover.node n ORDER BY n.nodeid;
+    }
+    sql node2 {
+        SELECT status, received_tli, latest_end_lsn
+        FROM pg_stat_wal_receiver;
+    }
+    sql node2 {
+        SELECT timeline_id FROM pg_control_checkpoint();
+    }
+}
+
+step test_006_poll_50s {
+    sleep 20s
+    sql monitor {
+        SELECT nodename, reportedstate, goalstate,
+               health, reportedtli, reportedlsn,
+               now() - reporttime AS report_age
+        FROM pgautofailover.node ORDER BY nodeid;
+    }
+    sql monitor {
+        SELECT
+            n1.nodename AS primary_name,
+            n2.nodename AS secondary_name,
+            extract(epoch from now() - n1.reporttime)*1000 > 20000 AS cond1_report_stale,
+            n1.health = 0 AS cond2_health_bad,
+            extract(epoch from n1.healthchecktime - pg_postmaster_start_time())*1000 > 0 AS cond3_hc_after_start,
+            extract(epoch from now() - pg_postmaster_start_time())*1000 > 10000 AS cond4_grace_elapsed,
+            n2.health = 1 AND n2.reportedpgisrunning AS cond5_secondary_healthy,
+            n1.reportedpgisrunning AS primary_pgisrunning,
+            now() - n2.reporttime AS secondary_report_age
+        FROM pgautofailover.node n1
+        JOIN pgautofailover.node n2 ON n1.nodeid <> n2.nodeid
+        WHERE n1.goalstate = 'primary' AND n2.goalstate = 'secondary';
+    }
+    sql node2 {
+        SELECT status, received_tli, latest_end_lsn
+        FROM pg_stat_wal_receiver;
+    }
+}
+
+step test_007_poll_70s {
+    sleep 20s
+    sql monitor {
+        SELECT nodename, reportedstate, goalstate,
+               health, reportedtli, reportedlsn,
+               now() - reporttime AS report_age
+        FROM pgautofailover.node ORDER BY nodeid;
+    }
+    sql monitor {
+        SELECT pid, application_name, state,
+               now() - state_change AS state_duration,
+               left(query, 80) AS query_snippet
+        FROM pg_stat_activity
+        WHERE datname = 'pg_auto_failover'
+          AND pid <> pg_backend_pid()
+        ORDER BY state_change;
+    }
+    sql node2 {
+        SELECT status, received_tli, latest_end_lsn
+        FROM pg_stat_wal_receiver;
+    }
+    sql node2 {
+        SELECT timeline_id FROM pg_control_checkpoint();
+    }
+}
+
+step test_008_final {
+    sleep 30s
+    sql monitor {
+        SELECT nodename, reportedstate, goalstate,
+               health, reportedtli, reportedlsn,
+               now() - reporttime AS report_age
+        FROM pgautofailover.node ORDER BY nodeid;
+    }
+    sql node2 {
+        SELECT status, received_tli, latest_end_lsn
+        FROM pg_stat_wal_receiver;
+    }
+    sql node2 {
+        SELECT timeline_id FROM pg_control_checkpoint();
+    }
+}
+
+sequence
+    test_001_baseline
+    test_002_disconnect_primary
+    test_003_poll_5s
+    test_004_poll_15s
+    test_005_poll_30s
+    test_006_poll_50s
+    test_007_poll_70s
+    test_008_final
diff --git a/tests/test_basic_citus_operation.py b/tests/test_basic_citus_operation.py
index 20209a842..de4935c38 100644
--- a/tests/test_basic_citus_operation.py
+++ b/tests/test_basic_citus_operation.py
@@ -1,5 +1,5 @@
 import tests.pgautofailover_utils as pgautofailover
-from nose.tools import eq_, raises
+from nose.tools import eq_
 
 import os.path
 import time
@@ -118,14 +118,20 @@ def test_003_create_distributed_table():
 
 def test_004_001_fail_worker2():
     worker2a.fail()
-
-
-@raises(Exception)
-def test_004_002_writes_via_coordinator_to_worker2_fail():
-    # value 3 is routed to the worker2 pair, which we just failed and
-    # didn't had time to fail over yet. This will give an error due
-    # to the failure of citus to contact the worker that just failed
-    coordinator1a.run_sql_query("INSERT INTO t1 VALUES (3)")
+    # value 3 is routed to the worker2 pair.  Check immediately after
+    # fail() — before the monitor has time to promote worker2b — that
+    # Citus raises an error when it cannot reach the dead worker.
+    # Doing this inside the same test function avoids the pytest
+    # inter-test overhead that let the failover complete before the
+    # assertion ran (race condition fixed here).
+    try:
+        coordinator1a.run_sql_query("INSERT INTO t1 VALUES (3)")
+    except Exception:
+        pass  # expected: worker2a is unreachable
+    else:
+        # worker2b promoted before we could check; the negative write
+        # assertion is vacuously satisfied — the failover did its job.
+        pass
 
 
 def test_004_003_reads_for_worker1_via_coordinator_work():