The agent lifecycle layer (implementation.md §5.5, §6.3): a small one_for_all supervisor holding the per-instance agent DynamicSupervisor and the reconciliation tracker. Sits AFTER Fief.Node under the instance's rest_for_one root, so a Fief.Node crash tears the whole vnode layer down and rebuilds it through the join path.

Reconciliation

Ownership changes reach this layer synchronously: Fief.Node calls reconcile/1 after every table refresh (activate / poll / explicit refresh). The tracker scans the cached route rows for vnodes where this node is owner or prev_owner (the desired agent set), starts missing agents, terminates agents whose vnodes left the set (settled donors, reassigned-away vnodes), and pings the rest — each agent derives its own posture (:serving/:donor, handoff_in/handoff_out) from the same cached row, so restart recovery and reconciliation share one code path. The whole chain (Node → tracker → agents) is synchronous calls, strictly downward: under simulation one stepped refresh is one complete reconciliation.

Fencing

kill_all/2 is the instance's default fence_action when a vnode impl is configured ({Fief.Vnode.Manager, :kill_all, [instance]} — the reason arrives last, M3 convention). It sends every agent the advisory {:fief_fence, deadline_ms} (handle_fence/2 runs in the agent under that deadline), arms one seam timer, and at the deadline brutally kills whatever is still alive via DynamicSupervisor.terminate_child/2 (child specs are shutdown: :brutal_kill; impl subtrees die via links, impl ETS tables die with their owning agent). The kill is unconditional — user code cannot outlive the fence by being slow. A fenced tracker refuses further reconciles; recovery is the supervision restart through the join path.