The 16x IOPS amplification is the part that clicked. Prefetch turns the primary sequential writes into 8k random reads on the standby, so a cheap cloud disk hits its IOPS cap even when bytes-read looks fine. Combined with the standby state machine that will not go back to streaming until local WAL is fully replayed, a brief walreceiver blip during a bulk update becomes a half-hour write freeze on the primary. I would turn recovery_prefetch off on any sync replica sitting on provisioned IOPS, and keep a second standby with ANY 1 so one lagging node cannot stall commits.