Some such patterns are suggested in the note on durability. The pattern we explore is in distinct contrast to the pattern of how sense keys support factory requirements.

A trusted segment keeper can produce segments trusted to be read-only and can indeed compose these segments of other earlier such segments. Without this keeper responsibility, segment keepers seldom need the ability to incorporate segments from outside sources. Otherwise it might be that certain segment keepers would be merely relied upon to produce read-only segments.

The advantage of this scheme is that sensory logic is absent from the kernel. The disadvantages are:

• Specialized segment keepers are required and there is no general way to combine the functions of segment keepers. Thus one must settle for simplistic segment keepers to produce read-only segments.
• If libraries are to be shared between applications, the trusted segment keeper must accomplish this.
• Other uses of sensory keys are unsupported, such as a sensory key to a tree of nodes. Yet more trusted domain code could supply this function but that is a conceptual cost;