The instance kernel: the rest_for_one supervisor over an instance's live machinery (implementation.md §2). Started as the first child of the thin outer Fief.Supervisor, it holds every process that serves the instance; the outer wrapper adds only the shutdown-leave sentinel beside it (Fief.Node.ShutdownDrain, docs/leave-on-shutdown.md §2.6).

The ordering is load-bearing: when Fief.Node crashes, its lease and fencing state cannot be trusted, so everything after it is torn down and restarted through the join path — a crashed Fief.Node fences the node as a side effect of supervision. Fief.Router.Cache sits before Fief.Node so the routing cache survives such a restart; Fief.Vnode.Manager sits after it so agents die with an untrusted node.

Children: impl instance children (Fief.Vnode.instance_children/1, e.g. Fief.Key.Limbo — placed first so they survive every kernel restart) → authority adapter → Fief.Router.Cache → Fief.Node → Fief.Planner.Supervisor → Fief.Vnode.Manager. The vnode and planner layers are present only when a :vnode_impl is configured — an instance without an impl (the M3 test substrate) has nothing to own and therefore nothing to plan. leadership: false additionally disables the planner subtree for instances whose tests play planner themselves.

Leadership

leadership: :from_authority (default) runs Fief.Leadership.FromStore against the instance's StateStore, which must implement the Fief.Leadership.Store primitives (try_lead/3 + leader/1 — Fief.Authority.Local does; the M7 Postgres adapter's fief_leader row is the same shape). leadership: false disables election and the planner.

Vnode impl wiring

vnode_impl: {module, opts} (or a bare module) selects the Fief.Vnode implementation. When present:

• the default fence_action becomes {Fief.Vnode.Manager, :kill_all, [instance]} — fencing brutally kills every agent (an explicit :fence_action opt overrides, test seam);
• if the impl exports config_fingerprint/1, its result feeds the impl_fingerprint join-validation slot (an explicit :impl_fingerprint opt overrides, test seam);
• :handle_fence_deadline (ms, default 50) bounds the advisory handle_fence/2 before the unconditional kill.

Test seams (undocumented instance opts, build-order M2)

• :sim — a Fief.Sim.Scheduler.context/3 map, threaded to every fief process in the instance, each of which binds it at init. One opt joins the whole instance to a simulation. Its :node_id must match the instance's :node_id opt.
• :node_id — node-identity override (defaults to node()), so one BEAM can impersonate a cluster in protocol tests.
• authority: {:external, mod, handle} — use an already-running authority instead of starting one, so several simulated instances share one namespace-scoped Fief.Authority.Local (implementation.md §11).