Module tiered 

Tiered StorageBackend — the Redis L1 → Postgres L2 → object L3 read-through / write-through cache resolver.

TieredBackend composes three StorageBackends into one. It is itself a StorageBackend, so it drops straight into AppState.storage (Arc<dyn StorageBackend>) with zero server change — the daemon consumes exactly one backend and does not care that it is three underneath.

Read path (read-through + promotion)

get_* tries the tiers top-down and promotes on a lower-tier hit:

L1 (Redis, hot)  ── hit ─▶ return
  │ miss
L2 (Postgres)    ── hit ─▶ warm L1, return
  │ miss
L3 (object)      ── hit ─▶ warm L2, warm L1, return
  │ miss
Ok(None)   (re-derive is the caller's job)

Promotion is best-effort: the read already succeeded, so a failed warm of an upper tier is logged (tracing::warn!) and swallowed — it never turns a successful read into an error. Because every key is content-derived, an L1 miss satisfied by L2/L3 returns the same bytes for the same key (read-through transparency).

Write path (typed WritePolicy)

Every policy writes both durable tiers (L2 and L3) before returning — so a pod roll that loses the ephemeral L1 loses nothing, and each tier alone can satisfy a later read identically. The policies differ only in how they treat the hot L1 tier:

• WritePolicy::WriteThrough (default) — durable tiers first, then warm L1.
• WritePolicy::WriteBack — warm L1 first (immediate hot availability for a racing read), then persist the durable tiers before returning (still crash-safe: it does not acknowledge before the durable flush). See the tier note on why fully-async deferred write-back is deliberately unshipped.
• WritePolicy::WriteAround — durable tiers only, skip L1 (avoids polluting the hot tier with write-once-read-never blobs; L1 fills lazily on read).

A durable-tier write failure propagates (?); an L1 warm failure is best-effort (logged), for the same reason promotion is.

delete / list_narinfos

delete fans out to all three tiers best-effort (content-addressed storage makes delete a GC operation, not a correctness one — a key always resolves to its content or to nothing; mirror S3Storage::delete). list_narinfos unions the authoritative durable tiers (L2 ∪ L3), deduped; L1 is skipped because it is only a partial hot subset.

Structs

TieredBackend

Three-tier read-through / write-through cache resolver.

Enums

TieredTier

The honest self-description of what TieredBackend has been proven against — asserted by the honest gate so a claim cannot be silently rounded up.

WritePolicy

How a put propagates across the tiers. See the module docs for the full contract; every policy persists both durable tiers before returning.

Constants

TIERED_BACKEND_TIER

The shipped tier of TieredBackend. Asserted by the honest gate; bumping it to LiveClusterProven without a live integration test is a build-failing round-up.