I think this formulation (attached v3) has fewer moving parts.
However, now that I did that, I wonder if this is really the best
approach to solve this problem. Maybe instead of doing this at the BRIN
level, it should be handled at the autovac level, by having the worker
copy the work-item to local memory and remove it from the shared list as
soon as it is in progress. That way, if *any* error occurs while trying
to execute it, it will go away instead of being retried for all
eternity.
Preliminary patch for that attached as autovacuum-workitem.patch.
I would propose to clean that up to apply instead of your proposed fix.