The instant you might have been charged is not the provider's response, it is the moment before the request leaves your process. Write it to a row before the HTTP call and a dead worker becomes recoverable without guessing: nothing written means retry is safe, a saved request id means poll, and the gap between them needs a third terminal state.
A b-tree that has lost most of its keys keeps every page it allocated: PostgreSQL reclaims completely empty index pages, but a page with a few keys left on it stays put, and no autovacuum setting changes that. Measure the damage with pgstatindex.avg_leaf_density against the b-tree default fillfactor of 90, predict the recovery as size x density / 90, and fix it with REINDEX rather than VACUUM FULL.
With replication slots enabled, hot_standby_feedback moves the bloat risk onto the primary; raising max_standby_streaming_delay feeds the HAProxy check that ejects the replica. Two hundred cancelled queries and thirty-odd replica ejections looked like one problem, but barely one in twenty lined up.
Treat a disk that fails on writes as read-only: stream pg_dump over SSH to the target, pull EOL images from the registry instead of rebuilding them, and anchor rsync excludes with a leading slash. Notes from moving a Docker app of some fifteen services with a PostgreSQL database on the order of ten gigabytes.