I've got a 3 level setup, with a primary/secondary pair that are big machines, and a tertiary that's enough for an emergency, but not much more. They're all run

I've got a 3 level setup, with a primary/secondary pair that are big machines, and a tertiary that's enough for an emergency, but not much more. They're all running hot spare. I didn't feel safe blatting the new primary back to the secondary till we had the third level in there, since once you've failed over, you're at the mercy of that one machine and your latest backup is on the one that you're overwriting. The third level one will follow the change in the recovery timeline if it's incremented in recovery.conf, and you make sure that it gets the appropriate history file.