# Immutable home subnet; fork (copy-then-diverge) is the cross-subnet move, not re-home

<!-- [doc->REQ-INST-15] -->
> **Delivered (M4-D9-5, 2026-06-04):** home assignment at creation
> (`spt_store::home` — auto-if-one / ask-if-many / local-only-until-first-join,
> carried forward across re-binds, no setter) + `sync_subnets = [home]`
> creation seeding + `spt fork <src> <new_id> --subnet <target>
> [--delete-source]` (one-time copy of both context tiers as fresh seed
> commits — copied-then-independent; join-time collision check against the
> target; the source untouched unless deleted). Same-node only in v1 — the
> remote arm composes with M5 instantiate-anywhere's consent gate.

## Status

accepted (2026-06-02)

## Context

ADR-0006 gave each endpoint a **home subnet** — the default sync scope (subnet-exclusive mind replication) and the anchor that qualifies its bare name — assigned at creation. It did not say whether home can *change* over an endpoint's life. The obvious feature request is "re-home": move an existing agent's mind from subnet A to subnet B.

Re-home is deceptively expensive. Under node-global identity (ADR-0003) with per-subnet registries and `hidden ⟹ not synced` (ADR-0006), moving the home of a *live* identity raises migration semantics with no clean answer: does the mind already replicated on A's nodes get purged or stranded? what happens to in-flight sync and the `a-<id>` branch on A? is the bare-name qualification anchor changing mid-life (breaking addresses others have cached)? Each is a real, separately-decidable hazard, and together they make re-home a migration subsystem, not a setting.

## Decision

**Home subnet is immutable. There is no re-home.** To place an agent's mind in a different subnet, **`spt fork`** it: create a **new, identity-distinct endpoint** whose home is the target subnet, **seeded with a one-time copy** of the source's mind (the live + project Cross-node Psyche sync tiers). The fork and source **diverge** immediately — no ongoing sync. The source is untouched; it may be deleted afterward (`--delete-source`).

This sidesteps every re-home hazard: nothing migrates, nothing is stranded, the source's mind and addresses are unchanged until the user explicitly deletes it. The fork's id defaults to the source's bare name if free in the target subnet (the ADR-0006 join-time collision check; else prompt/rename); its adapter follows the normal creation rule.

A fork is deliberately **not an instance** and **not a rename**:
- **instance** — *same* identity, another node, *synced* mind (ADR-0003).
- **rename** — *same* identity, new label, rippled (ADR-0006).
- **fork** — *new* identity, another subnet, *copied-then-independent* mind (this ADR).

## Consequences

- Endpoint identity gains a clean lifecycle — create → (rename | fork) → delete — with no scope-mutation operation. Code may assume an endpoint's home never changes.
- "Move my agent to the work fleet" is a copy + optional delete, not an in-place migration; the two endpoints are independent afterward (intentional — divergent minds in divergent fleets).
- `fork` is a new v1/M4 endpoint operation alongside `rename`; it reuses the join-time collision check and the adapter/creation rules. Cross-node *fork* (source and target on different nodes) composes with instantiate-anywhere's consent gate.
- Records the rejected alternative (re-home) so it is not re-proposed; extends ADR-0006 (multi-subnet membership) and builds on ADR-0003 (node-anchored identity).