The shutdown-leave sentinel (docs/leave-on-shutdown.md §3.2): the last child of the outer Fief.Supervisor, whose only job is to run a graceful Fief.Node.leave/1 and wait for the drain to finish while the kernel — the Fief.Node, the planner, and Fief.Vnode.Manager — is still alive behind it.

It is a placement, not a protocol. While the instance serves it holds two fields and does nothing (init/1 traps exits and returns; zero runtime cost). On a genuine teardown the supervisor terminates children in reverse start order, so this last child's terminate/2 runs first, against a fully live kernel — the one placement where the drain has agents to hand off and an authority to write through (§2.3). It sits outside the kernel's rest_for_one restart unit, so a kernel-internal crash never terminates it and never trips a spurious leave (§2.6).

terminate/2:

• only on a real shutdown reason (:shutdown / {:shutdown, _}); any other reason returns immediately — a crashing sentinel must not drain;
• calls Fief.Node.leave/1, tolerating a dead node (the outer supervisor is tearing down because the kernel already exited — nothing to drain);
• on :ok or {:error, :leaving} (we won the race, or an explicit pre-SIGTERM leave/1 is mid-drain) it polls the node's published status on the instance's leave_drain_interval cadence until :stopped (or :fenced, the failure path taking over), then lets the tree fall;
• on any other leave/1 error (:stopped — an orchestrated drain already ran, the idempotence case; :fenced and friends — cannot leave gracefully, degrade to the failure path) it returns at once.

The wait loop carries no deadline of its own: the supervisor kills the sentinel at the child-spec shutdown: value, which is the configured leave_on_shutdown timeout. The poll sleep routes through Fief.Seam so sim-joined instances stay deterministic (though the shape gate keeps the sentinel off most sim instances — those run leadership: false).