*** a/src/backend/access/transam/xlog.c
--- b/src/backend/access/transam/xlog.c
***************
*** 11531,11536 **** CheckForStandbyTrigger(void)
--- 11531,11546 ----
  }
  
  /*
+  * Remove the files signaling a standby promotion request.
+  */
+ void
+ RemovePromoteSignalFiles(void)
+ {
+ 	unlink(PROMOTE_SIGNAL_FILE);
+ 	unlink(FALLBACK_PROMOTE_SIGNAL_FILE);
+ }
+ 
+ /*
   * Check to see if a promote request has arrived. Should be
   * called by postmaster after receiving SIGUSR1.
   */
*** a/src/backend/postmaster/postmaster.c
--- b/src/backend/postmaster/postmaster.c
***************
*** 1160,1165 **** PostmasterMain(int argc, char *argv[])
--- 1160,1186 ----
  	RemovePgTempFiles();
  
  	/*
+ 	 * Forcibly remove the files signaling a standby promotion
+ 	 * request. Otherwise, the existence of those files triggers
+ 	 * a promotion too early, whether a user wants that or not.
+ 	 *
+ 	 * This removal of files is usually unnecessary because they
+ 	 * can exist only during a few moments during a standby
+ 	 * promotion. However there is a race condition: if pg_ctl promote
+ 	 * is executed and creates the files during a promotion,
+ 	 * the files can stay around even after the server is brought up
+ 	 * to new master. Then, if new standby starts by using the backup
+ 	 * taken from that master, the files can exist at the server
+ 	 * startup and should be removed in order to avoid an unexpected
+ 	 * promotion.
+ 	 *
+ 	 * Note that promotion signal files need to be removed before
+ 	 * the startup process is invoked. Because, after that, they can
+ 	 * be used by postmaster's SIGUSR1 signal handler.
+ 	 */
+ 	RemovePromoteSignalFiles();
+ 
+ 	/*
  	 * If enabled, start up syslogger collection subprocess
  	 */
  	SysLoggerPID = SysLogger_Start();
*** a/src/include/access/xlog.h
--- b/src/include/access/xlog.h
***************
*** 261,266 **** extern XLogRecPtr GetRedoRecPtr(void);
--- 261,267 ----
  extern XLogRecPtr GetInsertRecPtr(void);
  extern XLogRecPtr GetFlushRecPtr(void);
  extern void GetNextXidAndEpoch(TransactionId *xid, uint32 *epoch);
+ extern void RemovePromoteSignalFiles(void);
  
  extern bool CheckPromoteSignal(void);
  extern void WakeupRecovery(void);