I am thinking out loud here.
The practice in Keykos is to brand domains according to the code that they obey.
Keykos has never attempted to keep siblings separated except in-so-far as they lack references to each other.
Lacking such references is essential for factory style confinement.
If siblings come to hold external references to each other, they can arrange efficient cooperation.
The motivation and safety of this are discussed here.
This note is a criticism of that stance.
If a set of domains each obey a Java interpreter, it seems wrong for them to be branded alike.
This practice is not built into any Keykos code below the factory.
This is not too serious for we can build a supplier of factories each with the same components except for the brander.
I had not seen this need before but it is only a little awkward.
This is merely the most blatant example of domains that obey the same code but come to mistrust each other.
Perhaps we can regain our familiar thought patterns by renaming concepts:
There is a new sort of thing, the JavaDomain, which obeys Java byte codes and is not a domain (which obeys machine code).
(It is impemented with a domain but that is beside the point.)
JavaDomains are branded according to the Java byte code they obey.
This is not especially a problem for the Java interpreter is already relied upon to adhere to the semantics of the JVM which precludes such conivance between siblings.