First I note that I brush aside the problem in my proposal for active networks, the glass net idea where the problem is indeed severe.
I am tempted to call the problem the tourista problem for the analogy with the traveler who must find alternative supplies of food and water. A closely related problem is when I build an object whose behavior is defined by code that you provide.
These are problems that lexical scoping addresses. The default use of lexical scoping may not give the results you want but you can usually arrange for such results. When code has moved over a wire to another world it becomes increasingly difficult to maintain comfortable connections. I heard of an Englishman who came to America in the early 19th century and continued to have his shirts done by a London laundry. The latency was several months.
Here is how the problem seems to play out in the Keykos scheme of things. We had to resist allowing the instance construction code access to user’s directory to acquire what it needs. There was risk of the code malfunctioning, and risk to the resource owner as well, but where is code that constructs complex objects to get its raw material such as space and keys to stuff that most Keykos programs require? If you design code to wield the object DISCRIM, what should your code access when it is running for me?
The factory dealt with this problem, effectively setting standards that were broadly useful. It did not address the problem of visitors, however. A late change in factory design allowed the factory builder to add new keys to a sealed factory and thus “upgrade” the factory. This was required for recursive objects that would invoke their own factory to yield siblings. This is tantamount to the Scheme construct (letrec ((x (... x ...))) ... x ...) Mutual recursion is possible in factory logic as well as the letrec construct.
In Scheme as well as Keykos different releases of an object may be available under different names. A public slot would hold the requestor’s key for objects that obey the most recent version of some code. One can squirrel away a copy of a key found there and retain access to the source of objects with the old behavior.
If a software supplier wants to vouch for the behavior of his code away from home, it seems necessary to depend on behavior of his infrastructure at the site where it runs.
See this too on foreign travel.