Current implementation: the shared-RAM contract and engineering record
Placement does not change the programming rule.
A vendor can place its RAM host on a local machine, an off-grid network or an Internet-reachable server. Applications write and read addressed state in each case. The vendor chooses how a name locates that host and what happens when the path or host fails.
The API belongs to the vendor.
A domain API can expose objects, containers and references that resolve to cells. The tuple-space contract is the underlying recommendation, not a restriction to a generic key/value interface. The vendor may add host operations for queries or aggregates rather than making every client retrieve all state.
An application may mount several vendor regions. A pointer into another region is meaningful only with the appropriate region contract and access. Shared structure should reference the truth rather than duplicate it.
Ponds give networks scope.
FD&F treats a pond as a membership scope, corresponding to the DIF idea. A lillypad is a local network that can participate in more than one pond. Those relationships can be nested in the architectural model; they need not form one flat partition of every machine.
The current implementation has one session per configured pond, one forward pond, and reach into other permitted ponds. It has namespace evidence for overlapping private prefixes. Arbitrary-depth recursive deployment and automatic propagation of authorization through such a hierarchy are not established by that evidence.
Policy travels with the region.
The vendor or administrator chooses enrollment, read/write permissions, reach policy and security requirements. Region membership alone does not authorize every application operation. A network that uses the same numerical private addresses as another is not automatically the same scope.
The current bridge refuses ambiguous identity resolution when more than one pond answers. It quarantines released aliases to reduce premature reuse. Programs with addresses embedded inside application payloads require their own handling; translating IP packet headers cannot discover those addresses.