One fill per herd.

The read path never enters the owning process. A hit is a caller-side :ets.lookup against the public L1 table, so reads cost nothing but the lookup and scale with schedulers, not with one GenServer’s mailbox. The owner is consulted only on a miss, and that is where the second law holds: one fill per herd. Concurrent misses on the same key coalesce onto a single in-flight load — the first caller’s flight checks L2, falls through to the declared loader, writes both layers, and every waiter reads that one answer.

Expiry is deliberately uneven. Rows expire on a jittered clock, ttl plus or minus ttl times a jitter fraction, so a cohort filled together never expires together and a herd never forms at the second boundary; a sweeper reclaims dead rows on a fixed tick, so memory is bounded by the declaration rather than by luck. The cache’s footprint is what its tables declared, held to by a clock, not an accident of traffic.

A full cache degrades, it does not fail. When the table is at capacity and nothing has expired, a fill still serves its caller and skips the insert: the cache becomes a pass-through, answering from L2 and the loader without caching the result, never refusing a read. And the kind law runs before either layer is touched — a wrong-namespace id is refused at the door, the series’ oldest rule riding into the cache unchanged.