In pgPool-II 3.7.5 configuration pgpool.conf, is recovery_user a role or a system user? I'm having trouble configuing pgPool-II 3.7.5 for online recovery. In pgpool.conf, there is a parameter called recovery_user along with a recovery_password that are somehow used to run recovery_1st_stage_command. 

The pgPool docs say of recovery_user:


  Specifies the PostgreSQL user name to perform online recovery.


To me, this indicates very clearly that recovery_user is the name of a PostgreSQL user (role in the database). However, in a previous version of the docs, it also says


  You need to setup ssh so that recovery_user can login from the primary to the standby without being asked for a password.


which clearly indicates that recovery_user should be a system user. Granted this is documentation from pretty different versions but it's hard for me to believe that the implementation of this feature changed in that way.

Which is it, is recovery_user a database role or a server user?

Bonus: Please explain how pgPool-II orchestrates running recovery_1st_stage_command
I don't use pgpool, but it must be the OS user who runs the database server.  It cannot be a user within the PostgreSQL database, as a failed database cannot accept connections until after it has been recovered.